1262 files changed, 87546 insertions, 32806 deletions

diff --git a/src/lib/libcrypto/Attic/Makefile b/src/lib/libcrypto/Attic/Makefile
index f4813d3aaa..c0b6e906a8 100644
--- a/src/lib/libcrypto/Attic/Makefile
+++ b/src/lib/libcrypto/Attic/Makefile
@@ -34,8 +34,8 @@ SDIRS=	md2 md5 sha mdc2 hmac ripemd \
 GENERAL=Makefile README crypto-lib.com install.com
 
 LIB= $(TOP)/libcrypto.a
-LIBSRC= cryptlib.c mem.c cversion.c ex_data.c tmdiff.c cpt_err.c
-LIBOBJ= cryptlib.o mem.o cversion.o ex_data.o tmdiff.o cpt_err.o
+LIBSRC= cryptlib.c mem.c mem_dbg.c cversion.c ex_data.c tmdiff.c cpt_err.c ebcdic.c
+LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o tmdiff.o cpt_err.o ebcdic.o
 
 SRC= $(LIBSRC)
 
@@ -57,6 +57,11 @@ buildinf.h: ../Makefile.ssl
         echo "  #define DATE \"`date`\""; \
         echo "#endif" ) >buildinf.h
 
+testapps:
+        if echo ${SDIRS} | fgrep ' des '; \
+        then cd des && $(MAKE) CC='$(CC)' INCLUDES='${INCLUDES}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' des; fi
+        cd pkcs7 && $(MAKE) CC='$(CC)' INCLUDES='${INCLUDES}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' testapps
+
 subdirs:
         @for i in $(SDIRS) ;\
         do \
@@ -122,7 +127,7 @@ lint:
         done;
 
 depend:
-        if [ ! -e buildinf.h ]; then touch buildinf.h; fi # fake buildinf.h if it does not exist
+        if [ ! -f buildinf.h ]; then touch buildinf.h; fi # fake buildinf.h if it does not exist
         $(MAKEDEPEND) $(INCLUDE) $(DEPFLAG) $(PROGS) $(LIBSRC)
         if [ ! -s buildinf.h ]; then rm buildinf.h; fi
         @for i in $(SDIRS) ;\
@@ -151,29 +156,40 @@ dclean:
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
 cpt_err.o: ../include/openssl/crypto.h ../include/openssl/err.h
-cpt_err.o: ../include/openssl/opensslv.h ../include/openssl/stack.h
+cpt_err.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+cpt_err.o: ../include/openssl/stack.h
 cryptlib.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 cryptlib.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 cryptlib.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 cryptlib.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-cryptlib.o: ../include/openssl/stack.h cryptlib.h
+cryptlib.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+cryptlib.o: cryptlib.h
 cversion.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 cversion.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 cversion.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 cversion.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-cversion.o: ../include/openssl/stack.h buildinf.h cryptlib.h
+cversion.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+cversion.o: buildinf.h cryptlib.h
 ex_data.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 ex_data.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 ex_data.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 ex_data.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
-ex_data.o: ../include/openssl/opensslv.h ../include/openssl/stack.h cryptlib.h
+ex_data.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+ex_data.o: ../include/openssl/stack.h cryptlib.h
 mem.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 mem.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 mem.o: ../include/openssl/e_os2.h ../include/openssl/err.h
-mem.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
-mem.o: ../include/openssl/opensslv.h ../include/openssl/stack.h cryptlib.h
+mem.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+mem.o: ../include/openssl/safestack.h ../include/openssl/stack.h cryptlib.h
+mem_dbg.o: ../include/openssl/bio.h ../include/openssl/buffer.h
+mem_dbg.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
+mem_dbg.o: ../include/openssl/e_os2.h ../include/openssl/err.h
+mem_dbg.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
+mem_dbg.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+mem_dbg.o: ../include/openssl/stack.h cryptlib.h
 tmdiff.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 tmdiff.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 tmdiff.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 tmdiff.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-tmdiff.o: ../include/openssl/stack.h ../include/openssl/tmdiff.h cryptlib.h
+tmdiff.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+tmdiff.o: ../include/openssl/tmdiff.h cryptlib.h
diff --git a/src/lib/libcrypto/Makefile.ssl b/src/lib/libcrypto/Makefile.ssl
index 2fcbf18545..cab75d9f80 100644
--- a/src/lib/libcrypto/Makefile.ssl
+++ b/src/lib/libcrypto/Makefile.ssl
@@ -34,8 +34,8 @@ SDIRS=	md2 md5 sha mdc2 hmac ripemd \
 GENERAL=Makefile README crypto-lib.com install.com
 
 LIB= $(TOP)/libcrypto.a
-LIBSRC= cryptlib.c mem.c cversion.c ex_data.c tmdiff.c cpt_err.c
-LIBOBJ= cryptlib.o mem.o cversion.o ex_data.o tmdiff.o cpt_err.o
+LIBSRC= cryptlib.c mem.c mem_dbg.c cversion.c ex_data.c tmdiff.c cpt_err.c ebcdic.c
+LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o tmdiff.o cpt_err.o ebcdic.o
 
 SRC= $(LIBSRC)
 
@@ -57,6 +57,11 @@ buildinf.h: ../Makefile.ssl
         echo "  #define DATE \"`date`\""; \
         echo "#endif" ) >buildinf.h
 
+testapps:
+        if echo ${SDIRS} | fgrep ' des '; \
+        then cd des && $(MAKE) CC='$(CC)' INCLUDES='${INCLUDES}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' des; fi
+        cd pkcs7 && $(MAKE) CC='$(CC)' INCLUDES='${INCLUDES}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' testapps
+
 subdirs:
         @for i in $(SDIRS) ;\
         do \
@@ -122,7 +127,7 @@ lint:
         done;
 
 depend:
-        if [ ! -e buildinf.h ]; then touch buildinf.h; fi # fake buildinf.h if it does not exist
+        if [ ! -f buildinf.h ]; then touch buildinf.h; fi # fake buildinf.h if it does not exist
         $(MAKEDEPEND) $(INCLUDE) $(DEPFLAG) $(PROGS) $(LIBSRC)
         if [ ! -s buildinf.h ]; then rm buildinf.h; fi
         @for i in $(SDIRS) ;\
@@ -151,29 +156,40 @@ dclean:
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
 cpt_err.o: ../include/openssl/crypto.h ../include/openssl/err.h
-cpt_err.o: ../include/openssl/opensslv.h ../include/openssl/stack.h
+cpt_err.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+cpt_err.o: ../include/openssl/stack.h
 cryptlib.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 cryptlib.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 cryptlib.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 cryptlib.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-cryptlib.o: ../include/openssl/stack.h cryptlib.h
+cryptlib.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+cryptlib.o: cryptlib.h
 cversion.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 cversion.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 cversion.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 cversion.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-cversion.o: ../include/openssl/stack.h buildinf.h cryptlib.h
+cversion.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+cversion.o: buildinf.h cryptlib.h
 ex_data.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 ex_data.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 ex_data.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 ex_data.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
-ex_data.o: ../include/openssl/opensslv.h ../include/openssl/stack.h cryptlib.h
+ex_data.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+ex_data.o: ../include/openssl/stack.h cryptlib.h
 mem.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 mem.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 mem.o: ../include/openssl/e_os2.h ../include/openssl/err.h
-mem.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
-mem.o: ../include/openssl/opensslv.h ../include/openssl/stack.h cryptlib.h
+mem.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+mem.o: ../include/openssl/safestack.h ../include/openssl/stack.h cryptlib.h
+mem_dbg.o: ../include/openssl/bio.h ../include/openssl/buffer.h
+mem_dbg.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
+mem_dbg.o: ../include/openssl/e_os2.h ../include/openssl/err.h
+mem_dbg.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
+mem_dbg.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+mem_dbg.o: ../include/openssl/stack.h cryptlib.h
 tmdiff.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 tmdiff.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 tmdiff.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 tmdiff.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-tmdiff.o: ../include/openssl/stack.h ../include/openssl/tmdiff.h cryptlib.h
+tmdiff.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+tmdiff.o: ../include/openssl/tmdiff.h cryptlib.h
diff --git a/src/lib/libcrypto/asn1/Makefile.ssl b/src/lib/libcrypto/asn1/Makefile.ssl
index 5d668411f6..a17a713a75 100644
--- a/src/lib/libcrypto/asn1/Makefile.ssl
+++ b/src/lib/libcrypto/asn1/Makefile.ssl
@@ -23,34 +23,34 @@ APPS=
 
 LIB=$(TOP)/libcrypto.a
 LIBSRC= a_object.c a_bitstr.c a_utctm.c a_gentm.c a_time.c a_int.c a_octet.c \
-        a_print.c a_type.c a_set.c a_dup.c a_d2i_fp.c a_i2d_fp.c a_bmp.c \
-        a_enum.c a_vis.c a_utf8.c a_sign.c a_digest.c a_verify.c \
+        a_null.c a_print.c a_type.c a_set.c a_dup.c a_d2i_fp.c a_i2d_fp.c a_bmp.c \
+        a_enum.c a_vis.c a_utf8.c a_sign.c a_digest.c a_verify.c a_mbstr.c \
         x_algor.c x_val.c x_pubkey.c x_sig.c x_req.c x_attrib.c \
-        x_name.c x_cinf.c x_x509.c x_crl.c x_info.c x_spki.c nsseq.c \
+        x_name.c x_cinf.c x_x509.c x_x509a.c x_crl.c x_info.c x_spki.c nsseq.c \
         d2i_r_pr.c i2d_r_pr.c d2i_r_pu.c i2d_r_pu.c \
         d2i_s_pr.c i2d_s_pr.c d2i_s_pu.c i2d_s_pu.c \
         d2i_pu.c d2i_pr.c i2d_pu.c i2d_pr.c\
-        t_req.c t_x509.c t_crl.c t_pkey.c \
+        t_req.c t_x509.c t_x509a.c t_crl.c t_pkey.c t_spki.c t_bitst.c \
         p7_i_s.c p7_signi.c p7_signd.c p7_recip.c p7_enc_c.c p7_evp.c \
         p7_dgst.c p7_s_e.c p7_enc.c p7_lib.c \
         f_int.c f_string.c i2d_dhp.c i2d_dsap.c d2i_dhp.c d2i_dsap.c n_pkey.c \
         f_enum.c a_hdr.c x_pkey.c a_bool.c x_exten.c \
-        asn1_par.c asn1_lib.c asn1_err.c a_meth.c a_bytes.c \
+        asn1_par.c asn1_lib.c asn1_err.c a_meth.c a_bytes.c a_strnid.c \
         evp_asn1.c asn_pack.c p5_pbe.c p5_pbev2.c p8_pkey.c
 LIBOBJ= a_object.o a_bitstr.o a_utctm.o a_gentm.o a_time.o a_int.o a_octet.o \
-        a_print.o a_type.o a_set.o a_dup.o a_d2i_fp.o a_i2d_fp.o a_bmp.o \
-        a_enum.o a_vis.o a_utf8.o a_sign.o a_digest.o a_verify.o \
+        a_null.o a_print.o a_type.o a_set.o a_dup.o a_d2i_fp.o a_i2d_fp.o a_bmp.o \
+        a_enum.o a_vis.o a_utf8.o a_sign.o a_digest.o a_verify.o a_mbstr.o \
         x_algor.o x_val.o x_pubkey.o x_sig.o x_req.o x_attrib.o \
-        x_name.o x_cinf.o x_x509.o x_crl.o x_info.o x_spki.o nsseq.o \
+        x_name.o x_cinf.o x_x509.o x_x509a.o x_crl.o x_info.o x_spki.o nsseq.o \
         d2i_r_pr.o i2d_r_pr.o d2i_r_pu.o i2d_r_pu.o \
         d2i_s_pr.o i2d_s_pr.o d2i_s_pu.o i2d_s_pu.o \
         d2i_pu.o d2i_pr.o i2d_pu.o i2d_pr.o \
-        t_req.o t_x509.o t_crl.o t_pkey.o \
+        t_req.o t_x509.o t_x509a.o t_crl.o t_pkey.o t_spki.o t_bitst.o \
         p7_i_s.o p7_signi.o p7_signd.o p7_recip.o p7_enc_c.o p7_evp.o \
         p7_dgst.o p7_s_e.o p7_enc.o p7_lib.o \
         f_int.o f_string.o i2d_dhp.o i2d_dsap.o d2i_dhp.o d2i_dsap.o n_pkey.o \
         f_enum.o a_hdr.o x_pkey.o a_bool.o x_exten.o \
-        asn1_par.o asn1_lib.o asn1_err.o a_meth.o a_bytes.o \
+        asn1_par.o asn1_lib.o asn1_err.o a_meth.o a_bytes.o a_strnid.o \
         evp_asn1.o asn_pack.o p5_pbe.o p5_pbev2.o p8_pkey.o
 
 SRC= $(LIBSRC)
@@ -160,11 +160,13 @@ a_digest.o: ../../include/openssl/err.h ../../include/openssl/evp.h
 a_digest.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
 a_digest.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 a_digest.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-a_digest.o: ../../include/openssl/opensslv.h ../../include/openssl/rc2.h
-a_digest.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
-a_digest.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
-a_digest.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-a_digest.o: ../../include/openssl/stack.h ../cryptlib.h
+a_digest.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+a_digest.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+a_digest.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+a_digest.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+a_digest.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+a_digest.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+a_digest.o: ../cryptlib.h
 a_dup.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 a_dup.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 a_dup.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
@@ -207,6 +209,13 @@ a_int.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 a_int.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 a_int.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 a_int.o: ../cryptlib.h
+a_mbstr.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_mbstr.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_mbstr.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_mbstr.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_mbstr.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+a_mbstr.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+a_mbstr.o: ../cryptlib.h
 a_meth.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_meth.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_meth.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -214,6 +223,13 @@ a_meth.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 a_meth.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 a_meth.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 a_meth.o: ../cryptlib.h
+a_null.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_null.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_null.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_null.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_null.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+a_null.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+a_null.o: ../cryptlib.h
 a_object.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_object.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_object.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -259,6 +275,13 @@ a_sign.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 a_sign.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 a_sign.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 a_sign.o: ../cryptlib.h
+a_strnid.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_strnid.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_strnid.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_strnid.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_strnid.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+a_strnid.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+a_strnid.o: ../../include/openssl/stack.h ../cryptlib.h
 a_time.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_time.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_time.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -788,6 +811,24 @@ p8_pkey.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p8_pkey.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 p8_pkey.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
 p8_pkey.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+t_bitst.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+t_bitst.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+t_bitst.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+t_bitst.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+t_bitst.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_bitst.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_bitst.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_bitst.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_bitst.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+t_bitst.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+t_bitst.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+t_bitst.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+t_bitst.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+t_bitst.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+t_bitst.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+t_bitst.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+t_bitst.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+t_bitst.o: ../../include/openssl/x509v3.h ../cryptlib.h
 t_crl.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_crl.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_crl.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -812,15 +853,17 @@ t_pkey.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 t_pkey.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 t_pkey.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 t_pkey.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-t_pkey.o: ../../include/openssl/stack.h ../cryptlib.h
+t_pkey.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+t_pkey.o: ../cryptlib.h
 t_req.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_req.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_req.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-t_req.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-t_req.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-t_req.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-t_req.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-t_req.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+t_req.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+t_req.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_req.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_req.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_req.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_req.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 t_req.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 t_req.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 t_req.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -829,7 +872,24 @@ t_req.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 t_req.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 t_req.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 t_req.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-t_req.o: ../cryptlib.h
+t_req.o: ../../include/openssl/x509v3.h ../cryptlib.h
+t_spki.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+t_spki.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+t_spki.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+t_spki.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+t_spki.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_spki.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_spki.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_spki.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_spki.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+t_spki.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+t_spki.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+t_spki.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+t_spki.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+t_spki.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+t_spki.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+t_spki.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+t_spki.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 t_x509.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_x509.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_x509.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -848,6 +908,23 @@ t_x509.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 t_x509.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 t_x509.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 t_x509.o: ../../include/openssl/x509v3.h ../cryptlib.h
+t_x509a.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+t_x509a.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+t_x509a.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+t_x509a.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+t_x509a.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_x509a.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_x509a.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_x509a.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_x509a.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+t_x509a.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+t_x509a.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+t_x509a.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+t_x509a.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+t_x509a.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+t_x509a.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+t_x509a.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+t_x509a.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 x_algor.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 x_algor.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 x_algor.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
@@ -1088,3 +1165,20 @@ x_x509.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 x_x509.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 x_x509.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
 x_x509.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+x_x509a.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+x_x509a.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+x_x509a.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+x_x509a.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+x_x509a.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x_x509a.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x_x509a.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x_x509a.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x_x509a.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+x_x509a.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+x_x509a.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+x_x509a.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+x_x509a.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+x_x509a.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+x_x509a.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+x_x509a.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+x_x509a.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
diff --git a/src/lib/libcrypto/asn1/a_bitstr.c b/src/lib/libcrypto/asn1/a_bitstr.c
index 38ea802be8..c77456b315 100644
--- a/src/lib/libcrypto/asn1/a_bitstr.c
+++ b/src/lib/libcrypto/asn1/a_bitstr.c
@@ -60,6 +60,15 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_BIT_STRING *ASN1_BIT_STRING_new(void)
+{ return M_ASN1_BIT_STRING_new(); }
+
+void ASN1_BIT_STRING_free(ASN1_BIT_STRING *x)
+{ M_ASN1_BIT_STRING_free(x); }
+
+int ASN1_BIT_STRING_set(ASN1_BIT_STRING *x, unsigned char *d, int len)
+{ return M_ASN1_BIT_STRING_set(x, d, len); }
+
 int i2d_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
         {
         int ret,j,r,bits,len;
@@ -121,7 +130,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
 
         if ((a == NULL) || ((*a) == NULL))
                 {
-                if ((ret=ASN1_BIT_STRING_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_BIT_STRING_new()) == NULL) return(NULL);
                 }
         else
                 ret=(*a);
@@ -164,7 +173,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
                 s=NULL;
 
         ret->length=(int)len;
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->data=s;
         ret->type=V_ASN1_BIT_STRING;
         if (a != NULL) (*a)=ret;
@@ -173,7 +182,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
 err:
         ASN1err(ASN1_F_D2I_ASN1_BIT_STRING,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_BIT_STRING_free(ret);
+                M_ASN1_BIT_STRING_free(ret);
         return(NULL);
         }
 
diff --git a/src/lib/libcrypto/asn1/a_bmp.c b/src/lib/libcrypto/asn1/a_bmp.c
index 6075871984..d9ac5a0475 100644
--- a/src/lib/libcrypto/asn1/a_bmp.c
+++ b/src/lib/libcrypto/asn1/a_bmp.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_BMPSTRING *ASN1_BMPSTRING_new(void)
+{ return M_ASN1_BMPSTRING_new(); }
+
+void ASN1_BMPSTRING_free(ASN1_BMPSTRING *x)
+{ M_ASN1_BMPSTRING_free(x); }
+
 int i2d_ASN1_BMPSTRING(ASN1_BMPSTRING *a, unsigned char **pp)
         {
         return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
diff --git a/src/lib/libcrypto/asn1/a_bytes.c b/src/lib/libcrypto/asn1/a_bytes.c
index e452e03b88..8cde695804 100644
--- a/src/lib/libcrypto/asn1/a_bytes.c
+++ b/src/lib/libcrypto/asn1/a_bytes.c
@@ -71,7 +71,7 @@ B_ASN1_T61STRING,B_ASN1_VIDEOTEXSTRING,B_ASN1_IA5STRING,0,
 B_ASN1_UNIVERSALSTRING,B_ASN1_UNKNOWN,B_ASN1_BMPSTRING,B_ASN1_UNKNOWN,
         };
 
-static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c);
+static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c);
 /* type is a 'bitmap' of acceptable string types.
  */
 ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, unsigned char **pp,
@@ -124,7 +124,7 @@ ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, unsigned char **pp,
         else
                 s=NULL;
 
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->length=(int)len;
         ret->data=s;
         ret->type=tag;
@@ -205,7 +205,7 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                 c.tag=Ptag;
                 c.xclass=Pclass;
                 c.max=(length == 0)?0:(p+length);
-                if (!asn1_collate_primative(ret,&c)) 
+                if (!asn1_collate_primitive(ret,&c)) 
                         goto err; 
                 else
                         {
@@ -218,8 +218,8 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                         {
                         if ((ret->length < len) || (ret->data == NULL))
                                 {
-                                if (ret->data != NULL) Free((char *)ret->data);
-                                s=(unsigned char *)Malloc((int)len);
+                                if (ret->data != NULL) Free(ret->data);
+                                s=(unsigned char *)Malloc((int)len + 1);
                                 if (s == NULL)
                                         {
                                         i=ERR_R_MALLOC_FAILURE;
@@ -229,12 +229,13 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                         else
                                 s=ret->data;
                         memcpy(s,p,(int)len);
+                        s[len] = '\0';
                         p+=len;
                         }
                 else
                         {
                         s=NULL;
-                        if (ret->data != NULL) Free((char *)ret->data);
+                        if (ret->data != NULL) Free(ret->data);
                         }
 
                 ret->length=(int)len;
@@ -253,11 +254,11 @@ err:
         }
 
 
-/* We are about to parse 0..n d2i_ASN1_bytes objects, we are to collapes
- * them into the one struture that is then returned */
+/* We are about to parse 0..n d2i_ASN1_bytes objects, we are to collapse
+ * them into the one structure that is then returned */
 /* There have been a few bug fixes for this function from
  * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
-static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
+static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
         {
         ASN1_STRING *os=NULL;
         BUF_MEM b;
diff --git a/src/lib/libcrypto/asn1/a_digest.c b/src/lib/libcrypto/asn1/a_digest.c
index 8c45add557..3370aae998 100644
--- a/src/lib/libcrypto/asn1/a_digest.c
+++ b/src/lib/libcrypto/asn1/a_digest.c
@@ -58,16 +58,19 @@
 
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
 #include <openssl/evp.h>
 #include <openssl/buffer.h>
 #include <openssl/x509.h>
 
-int ASN1_digest(int (*i2d)(), EVP_MD *type, char *data, unsigned char *md,
-             unsigned int *len)
+int ASN1_digest(int (*i2d)(), const EVP_MD *type, char *data,
+                unsigned char *md, unsigned int *len)
         {
         EVP_MD_CTX ctx;
         int i;
diff --git a/src/lib/libcrypto/asn1/a_dup.c b/src/lib/libcrypto/asn1/a_dup.c
index c0a8709f3b..3202a816d0 100644
--- a/src/lib/libcrypto/asn1/a_dup.c
+++ b/src/lib/libcrypto/asn1/a_dup.c
@@ -78,6 +78,6 @@ char *ASN1_dup(int (*i2d)(), char *(*d2i)(), char *x)
         i=i2d(x,&p);
         p= b;
         ret=d2i(NULL,&p,i);
-        Free((char *)b);
+        Free(b);
         return(ret);
         }
diff --git a/src/lib/libcrypto/asn1/a_enum.c b/src/lib/libcrypto/asn1/a_enum.c
index 9239ecc439..ccf62e5a04 100644
--- a/src/lib/libcrypto/asn1/a_enum.c
+++ b/src/lib/libcrypto/asn1/a_enum.c
@@ -65,6 +65,12 @@
  * for comments on encoding see a_int.c
  */
 
+ASN1_ENUMERATED *ASN1_ENUMERATED_new(void)
+{ return M_ASN1_ENUMERATED_new(); }
+
+void ASN1_ENUMERATED_free(ASN1_ENUMERATED *x)
+{ M_ASN1_ENUMERATED_free(x); }
+
 int i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a, unsigned char **pp)
         {
         int pad=0,ret,r,i,t;
@@ -142,7 +148,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
 
         if ((a == NULL) || ((*a) == NULL))
                 {
-                if ((ret=ASN1_ENUMERATED_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_ENUMERATED_new()) == NULL) return(NULL);
                 ret->type=V_ASN1_ENUMERATED;
                 }
         else
@@ -171,7 +177,12 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
                 goto err;
                 }
         to=s;
-        if (*p & 0x80) /* a negative number */
+        if(!len) {
+                /* Strictly speaking this is an illegal ENUMERATED but we
+                 * tolerate it.
+                 */
+                ret->type=V_ASN1_ENUMERATED;
+        } else if (*p & 0x80) /* a negative number */
                 {
                 ret->type=V_ASN1_NEG_ENUMERATED;
                 if ((*p == 0xff) && (len != 1)) {
@@ -208,7 +219,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
                 p+=len;
         }
 
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->data=s;
         ret->length=(int)len;
         if (a != NULL) (*a)=ret;
@@ -217,7 +228,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
 err:
         ASN1err(ASN1_F_D2I_ASN1_ENUMERATED,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_ENUMERATED_free(ret);
+                M_ASN1_ENUMERATED_free(ret);
         return(NULL);
         }
 
@@ -231,7 +242,7 @@ int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v)
         if (a->length < (sizeof(long)+1))
                 {
                 if (a->data != NULL)
-                        Free((char *)a->data);
+                        Free(a->data);
                 if ((a->data=(unsigned char *)Malloc(sizeof(long)+1)) != NULL)
                         memset((char *)a->data,0,sizeof(long)+1);
                 }
@@ -295,7 +306,7 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
         int len,j;
 
         if (ai == NULL)
-                ret=ASN1_ENUMERATED_new();
+                ret=M_ASN1_ENUMERATED_new();
         else
                 ret=ai;
         if (ret == NULL)
@@ -311,7 +322,7 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
         ret->length=BN_bn2bin(bn,ret->data);
         return(ret);
 err:
-        if (ret != ai) ASN1_ENUMERATED_free(ret);
+        if (ret != ai) M_ASN1_ENUMERATED_free(ret);
         return(NULL);
         }
 
diff --git a/src/lib/libcrypto/asn1/a_gentm.c b/src/lib/libcrypto/asn1/a_gentm.c
index 226474f057..84062170e8 100644
--- a/src/lib/libcrypto/asn1/a_gentm.c
+++ b/src/lib/libcrypto/asn1/a_gentm.c
@@ -63,6 +63,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_new(void)
+{ return M_ASN1_GENERALIZEDTIME_new(); }
+
+void ASN1_GENERALIZEDTIME_free(ASN1_GENERALIZEDTIME *x)
+{ M_ASN1_GENERALIZEDTIME_free(x); }
+
 int i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a, unsigned char **pp)
         {
 #ifdef CHARSET_EBCDIC
@@ -106,7 +112,7 @@ ASN1_GENERALIZEDTIME *d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a,
         return(ret);
 err:
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_GENERALIZEDTIME_free(ret);
+                M_ASN1_GENERALIZEDTIME_free(ret);
         return(NULL);
         }
 
@@ -193,7 +199,7 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
 #endif
 
         if (s == NULL)
-                s=ASN1_GENERALIZEDTIME_new();
+                s=M_ASN1_GENERALIZEDTIME_new();
         if (s == NULL)
                 return(NULL);
 
diff --git a/src/lib/libcrypto/asn1/a_hdr.c b/src/lib/libcrypto/asn1/a_hdr.c
index 1171d36443..434610e8e1 100644
--- a/src/lib/libcrypto/asn1/a_hdr.c
+++ b/src/lib/libcrypto/asn1/a_hdr.c
@@ -102,7 +102,7 @@ ASN1_HEADER *ASN1_HEADER_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,ASN1_HEADER);
-        M_ASN1_New(ret->header,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->header,M_ASN1_OCTET_STRING_new);
         ret->meth=NULL;
         ret->data=NULL;
         return(ret);
@@ -112,8 +112,8 @@ ASN1_HEADER *ASN1_HEADER_new(void)
 void ASN1_HEADER_free(ASN1_HEADER *a)
         {
         if (a == NULL) return;
-        ASN1_OCTET_STRING_free(a->header);
+        M_ASN1_OCTET_STRING_free(a->header);
         if (a->meth != NULL)
                 a->meth->destroy(a->data);
-        Free((char *)a);
+        Free(a);
         }
diff --git a/src/lib/libcrypto/asn1/a_i2d_fp.c b/src/lib/libcrypto/asn1/a_i2d_fp.c
index 6bd845443c..d9b8035e17 100644
--- a/src/lib/libcrypto/asn1/a_i2d_fp.c
+++ b/src/lib/libcrypto/asn1/a_i2d_fp.c
@@ -108,6 +108,6 @@ int ASN1_i2d_bio(int (*i2d)(), BIO *out, unsigned char *x)
                 j+=i;
                 n-=i;
                 }
-        Free((char *)b);
+        Free(b);
         return(ret);
         }
diff --git a/src/lib/libcrypto/asn1/a_int.c b/src/lib/libcrypto/asn1/a_int.c
index d05436378b..8b6794e8c1 100644
--- a/src/lib/libcrypto/asn1/a_int.c
+++ b/src/lib/libcrypto/asn1/a_int.c
@@ -60,6 +60,18 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_INTEGER *ASN1_INTEGER_new(void)
+{ return M_ASN1_INTEGER_new();}
+
+void ASN1_INTEGER_free(ASN1_INTEGER *x)
+{ M_ASN1_INTEGER_free(x);}
+
+ASN1_INTEGER *ASN1_INTEGER_dup(ASN1_INTEGER *x)
+{ return M_ASN1_INTEGER_dup(x);}
+
+int ASN1_INTEGER_cmp(ASN1_INTEGER *x, ASN1_INTEGER *y)
+{ return M_ASN1_INTEGER_cmp(x,y);}
+
 /* 
  * This converts an ASN1 INTEGER into its DER encoding.
  * The internal representation is an ASN1_STRING whose data is a big endian
@@ -160,7 +172,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
 
         if ((a == NULL) || ((*a) == NULL))
                 {
-                if ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);
                 ret->type=V_ASN1_INTEGER;
                 }
         else
@@ -190,7 +202,12 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                 goto err;
                 }
         to=s;
-        if (*p & 0x80) /* a negative number */
+        if(!len) {
+                /* Strictly speaking this is an illegal INTEGER but we
+                 * tolerate it.
+                 */
+                ret->type=V_ASN1_INTEGER;
+        } else if (*p & 0x80) /* a negative number */
                 {
                 ret->type=V_ASN1_NEG_INTEGER;
                 if ((*p == 0xff) && (len != 1)) {
@@ -231,7 +248,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                 memcpy(s,p,(int)len);
         }
 
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->data=s;
         ret->length=(int)len;
         if (a != NULL) (*a)=ret;
@@ -240,7 +257,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
 err:
         ASN1err(ASN1_F_D2I_ASN1_INTEGER,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_INTEGER_free(ret);
+                M_ASN1_INTEGER_free(ret);
         return(NULL);
         }
 
@@ -260,7 +277,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
 
         if ((a == NULL) || ((*a) == NULL))
                 {
-                if ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);
                 ret->type=V_ASN1_INTEGER;
                 }
         else
@@ -289,7 +306,8 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                 goto err;
                 }
         to=s;
-                ret->type=V_ASN1_INTEGER;
+        ret->type=V_ASN1_INTEGER;
+        if(len) {
                 if ((*p == 0) && (len != 1))
                         {
                         p++;
@@ -297,8 +315,9 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                         }
                 memcpy(s,p,(int)len);
                 p+=len;
+        }
 
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->data=s;
         ret->length=(int)len;
         if (a != NULL) (*a)=ret;
@@ -307,7 +326,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
 err:
         ASN1err(ASN1_F_D2I_ASN1_UINTEGER,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_INTEGER_free(ret);
+                M_ASN1_INTEGER_free(ret);
         return(NULL);
         }
 
@@ -321,7 +340,7 @@ int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
         if (a->length < (sizeof(long)+1))
                 {
                 if (a->data != NULL)
-                        Free((char *)a->data);
+                        Free(a->data);
                 if ((a->data=(unsigned char *)Malloc(sizeof(long)+1)) != NULL)
                         memset((char *)a->data,0,sizeof(long)+1);
                 }
@@ -385,7 +404,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
         int len,j;
 
         if (ai == NULL)
-                ret=ASN1_INTEGER_new();
+                ret=M_ASN1_INTEGER_new();
         else
                 ret=ai;
         if (ret == NULL)
@@ -401,7 +420,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
         ret->length=BN_bn2bin(bn,ret->data);
         return(ret);
 err:
-        if (ret != ai) ASN1_INTEGER_free(ret);
+        if (ret != ai) M_ASN1_INTEGER_free(ret);
         return(NULL);
         }
 
diff --git a/src/lib/libcrypto/asn1/a_mbstr.c b/src/lib/libcrypto/asn1/a_mbstr.c
new file mode 100644
index 0000000000..7a710d5459
--- /dev/null
+++ b/src/lib/libcrypto/asn1/a_mbstr.c
@@ -0,0 +1,390 @@
+/* a_mbstr.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+
+static int traverse_string(const unsigned char *p, int len, int inform,
+                 int (*rfunc)(unsigned long value, void *in), void *arg);
+static int in_utf8(unsigned long value, void *arg);
+static int out_utf8(unsigned long value, void *arg);
+static int type_str(unsigned long value, void *arg);
+static int cpy_asc(unsigned long value, void *arg);
+static int cpy_bmp(unsigned long value, void *arg);
+static int cpy_univ(unsigned long value, void *arg);
+static int cpy_utf8(unsigned long value, void *arg);
+static int is_printable(unsigned long value);
+
+/* These functions take a string in UTF8, ASCII or multibyte form and
+ * a mask of permissible ASN1 string types. It then works out the minimal
+ * type (using the order Printable < IA5 < T61 < BMP < Universal < UTF8)
+ * and creates a string of the correct type with the supplied data.
+ * Yes this is horrible: it has to be :-(
+ * The 'ncopy' form checks minimum and maximum size limits too.
+ */
+
+int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask)
+{
+        return ASN1_mbstring_ncopy(out, in, len, inform, mask, 0, 0);
+}
+
+int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask, 
+                                        long minsize, long maxsize)
+{
+        int str_type;
+        int ret;
+        int outform, outlen;
+        ASN1_STRING *dest;
+        unsigned char *p;
+        int nchar;
+        char strbuf[32];
+        int (*cpyfunc)(unsigned long,void *) = NULL;
+        if(len == -1) len = strlen((const char *)in);
+        if(!mask) mask = DIRSTRING_TYPE;
+
+        /* First do a string check and work out the number of characters */
+        switch(inform) {
+
+                case MBSTRING_BMP:
+                if(len & 1) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                         ASN1_R_INVALID_BMPSTRING_LENGTH);
+                        return -1;
+                }
+                nchar = len >> 1;
+                break;
+
+                case MBSTRING_UNIV:
+                if(len & 3) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                         ASN1_R_INVALID_UNIVERSALSTRING_LENGTH);
+                        return -1;
+                }
+                nchar = len >> 2;
+                break;
+
+                case MBSTRING_UTF8:
+                nchar = 0;
+                /* This counts the characters and does utf8 syntax checking */
+                ret = traverse_string(in, len, MBSTRING_UTF8, in_utf8, &nchar);
+                if(ret < 0) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                                 ASN1_R_INVALID_UTF8STRING);
+                        return -1;
+                }
+                break;
+
+                case MBSTRING_ASC:
+                nchar = len;
+                break;
+
+                default:
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_UNKNOWN_FORMAT);
+                return -1;
+        }
+
+        if((minsize > 0) && (nchar < minsize)) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_SHORT);
+                sprintf(strbuf, "%ld", minsize);
+                ERR_add_error_data(2, "minsize=", strbuf);
+                return -1;
+        }
+
+        if((maxsize > 0) && (nchar > maxsize)) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_LONG);
+                sprintf(strbuf, "%ld", maxsize);
+                ERR_add_error_data(2, "maxsize=", strbuf);
+                return -1;
+        }
+
+        /* Now work out minimal type (if any) */
+        if(traverse_string(in, len, inform, type_str, &mask) < 0) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_ILLEGAL_CHARACTERS);
+                return -1;
+        }
+
+
+        /* Now work out output format and string type */
+        outform = MBSTRING_ASC;
+        if(mask & B_ASN1_PRINTABLESTRING) str_type = V_ASN1_PRINTABLESTRING;
+        else if(mask & B_ASN1_IA5STRING) str_type = V_ASN1_IA5STRING;
+        else if(mask & B_ASN1_T61STRING) str_type = V_ASN1_T61STRING;
+        else if(mask & B_ASN1_BMPSTRING) {
+                str_type = V_ASN1_BMPSTRING;
+                outform = MBSTRING_BMP;
+        } else if(mask & B_ASN1_UNIVERSALSTRING) {
+                str_type = V_ASN1_UNIVERSALSTRING;
+                outform = MBSTRING_UNIV;
+        } else {
+                str_type = V_ASN1_UTF8STRING;
+                outform = MBSTRING_UTF8;
+        }
+        if(!out) return str_type;
+        if(*out) {
+                dest = *out;
+                if(dest->data) {
+                        dest->length = 0;
+                        Free(dest->data);
+                        dest->data = NULL;
+                }
+                dest->type = str_type;
+        } else {
+                dest = ASN1_STRING_type_new(str_type);
+                if(!dest) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                                        ERR_R_MALLOC_FAILURE);
+                        return -1;
+                }
+                *out = dest;
+        }
+        /* If both the same type just copy across */
+        if(inform == outform) {
+                if(!ASN1_STRING_set(dest, in, len)) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,ERR_R_MALLOC_FAILURE);
+                        return -1;
+                }
+                return str_type;
+        } 
+
+        /* Work out how much space the destination will need */
+        switch(outform) {
+                case MBSTRING_ASC:
+                outlen = nchar;
+                cpyfunc = cpy_asc;
+                break;
+
+                case MBSTRING_BMP:
+                outlen = nchar << 1;
+                cpyfunc = cpy_bmp;
+                break;
+
+                case MBSTRING_UNIV:
+                outlen = nchar << 2;
+                cpyfunc = cpy_univ;
+                break;
+
+                case MBSTRING_UTF8:
+                outlen = 0;
+                traverse_string(in, len, inform, out_utf8, &outlen);
+                cpyfunc = cpy_utf8;
+                break;
+        }
+        if(!(p = Malloc(outlen + 1))) {
+                ASN1_STRING_free(dest);
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY,ERR_R_MALLOC_FAILURE);
+                return -1;
+        }
+        dest->length = outlen;
+        dest->data = p;
+        p[outlen] = 0;
+        traverse_string(in, len, inform, cpyfunc, &p);
+        return str_type;        
+}
+
+/* This function traverses a string and passes the value of each character
+ * to an optional function along with a void * argument.
+ */
+
+static int traverse_string(const unsigned char *p, int len, int inform,
+                 int (*rfunc)(unsigned long value, void *in), void *arg)
+{
+        unsigned long value;
+        int ret;
+        while(len) {
+                if(inform == MBSTRING_ASC) {
+                        value = *p++;
+                        len--;
+                } else if(inform == MBSTRING_BMP) {
+                        value = *p++ << 8;
+                        value |= *p++;
+                        len -= 2;
+                } else if(inform == MBSTRING_UNIV) {
+                        value = *p++ << 24;
+                        value |= *p++ << 16;
+                        value |= *p++ << 8;
+                        value |= *p++;
+                        len -= 4;
+                } else {
+                        ret = UTF8_getc(p, len, &value);
+                        if(ret < 0) return -1;
+                        len -= ret;
+                        p += ret;
+                }
+                if(rfunc) {
+                        ret = rfunc(value, arg);
+                        if(ret <= 0) return ret;
+                }
+        }
+        return 1;
+}
+
+/* Various utility functions for traverse_string */
+
+/* Just count number of characters */
+
+static int in_utf8(unsigned long value, void *arg)
+{
+        int *nchar;
+        nchar = arg;
+        (*nchar)++;
+        return 1;
+}
+
+/* Determine size of output as a UTF8 String */
+
+static int out_utf8(unsigned long value, void *arg)
+{
+        long *outlen;
+        outlen = arg;
+        *outlen += UTF8_putc(NULL, -1, value);
+        return 1;
+}
+
+/* Determine the "type" of a string: check each character against a
+ * supplied "mask".
+ */
+
+static int type_str(unsigned long value, void *arg)
+{
+        unsigned long types;
+        types = *((unsigned long *)arg);
+        if((types & B_ASN1_PRINTABLESTRING) && !is_printable(value))
+                                        types &= ~B_ASN1_PRINTABLESTRING;
+        if((types & B_ASN1_IA5STRING) && (value > 127))
+                                        types &= ~B_ASN1_IA5STRING;
+        if((types & B_ASN1_T61STRING) && (value > 0xff))
+                                        types &= ~B_ASN1_T61STRING;
+        if((types & B_ASN1_BMPSTRING) && (value > 0xffff))
+                                        types &= ~B_ASN1_BMPSTRING;
+        if(!types) return -1;
+        *((unsigned long *)arg) = types;
+        return 1;
+}
+
+/* Copy one byte per character ASCII like strings */
+
+static int cpy_asc(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q = (unsigned char) value;
+        (*p)++;
+        return 1;
+}
+
+/* Copy two byte per character BMPStrings */
+
+static int cpy_bmp(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q++ = (unsigned char) ((value >> 8) & 0xff);
+        *q = (unsigned char) (value & 0xff);
+        *p += 2;
+        return 1;
+}
+
+/* Copy four byte per character UniversalStrings */
+
+static int cpy_univ(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q++ = (unsigned char) ((value >> 24) & 0xff);
+        *q++ = (unsigned char) ((value >> 16) & 0xff);
+        *q++ = (unsigned char) ((value >> 8) & 0xff);
+        *q = (unsigned char) (value & 0xff);
+        *p += 4;
+        return 1;
+}
+
+/* Copy to a UTF8String */
+
+static int cpy_utf8(unsigned long value, void *arg)
+{
+        unsigned char **p;
+        int ret;
+        p = arg;
+        /* We already know there is enough room so pass 0xff as the length */
+        ret = UTF8_putc(*p, 0xff, value);
+        *p += ret;
+        return 1;
+}
+
+/* Return 1 if the character is permitted in a PrintableString */
+static int is_printable(unsigned long value)
+{
+        int ch;
+        if(value > 0x7f) return 0;
+        ch = (int) value;
+        /* Note: we can't use 'isalnum' because certain accented 
+         * characters may count as alphanumeric in some environments.
+         */
+        if((ch >= 'a') && (ch <= 'z')) return 1;
+        if((ch >= 'A') && (ch <= 'Z')) return 1;
+        if((ch >= '0') && (ch <= '9')) return 1;
+        if ((ch == ' ') || strchr("'()+,-./:=?", ch)) return 1;
+        return 0;
+}
diff --git a/src/lib/libcrypto/asn1/a_null.c b/src/lib/libcrypto/asn1/a_null.c
new file mode 100644
index 0000000000..119fd784be
--- /dev/null
+++ b/src/lib/libcrypto/asn1/a_null.c
@@ -0,0 +1,119 @@
+/* a_null.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+
+/* ASN1 functions for NULL type. For compatibility with other ASN1 code
+ * it returns a pointer to an "ASN1_NULL" structure. The new/free functions
+ * don't need to do any allocating because nothing is stored in a NULL.
+ */
+
+int i2d_ASN1_NULL(ASN1_NULL *a, unsigned char **pp)
+        {
+        if(!a) return 0;
+        if (pp) ASN1_put_object(pp,0,0,V_ASN1_NULL,V_ASN1_UNIVERSAL);
+        return 2;
+        }
+
+ASN1_NULL *d2i_ASN1_NULL(ASN1_NULL **a, unsigned char **pp, long length)
+        {
+        ASN1_NULL *ret = NULL;
+        unsigned char *p;
+        long len;
+        int inf,tag,xclass;
+        int i=0;
+
+        p= *pp;
+        inf=ASN1_get_object(&p,&len,&tag,&xclass,length);
+        if (inf & 0x80)
+                {
+                i=ASN1_R_BAD_OBJECT_HEADER;
+                goto err;
+                }
+
+        if (tag != V_ASN1_NULL)
+                {
+                i=ASN1_R_EXPECTING_A_NULL;
+                goto err;
+                }
+
+        if (len != 0)
+                {
+                i=ASN1_R_NULL_IS_WRONG_LENGTH;
+                goto err;
+                }
+        ret=(ASN1_NULL *)1;
+        if (a != NULL) (*a)=ret;
+        *pp=p;
+        return(ret);
+err:
+        ASN1err(ASN1_F_D2I_ASN1_NULL,i);
+        return(ret);
+        }
+
+ASN1_NULL *ASN1_NULL_new(void)
+{
+        return (ASN1_NULL *)1;
+}
+
+void ASN1_NULL_free(ASN1_NULL *a)
+{
+        return;
+}
diff --git a/src/lib/libcrypto/asn1/a_object.c b/src/lib/libcrypto/asn1/a_object.c
index b94b418ee8..09d56fb669 100644
--- a/src/lib/libcrypto/asn1/a_object.c
+++ b/src/lib/libcrypto/asn1/a_object.c
@@ -222,8 +222,8 @@ ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, unsigned char **pp,
                 }
         if ((ret->data == NULL) || (ret->length < len))
                 {
-                if (ret->data != NULL) Free((char *)ret->data);
-                ret->data=(unsigned char *)Malloc((int)len);
+                if (ret->data != NULL) Free(ret->data);
+                ret->data=(unsigned char *)Malloc(len ? (int)len : 1);
                 ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
                 if (ret->data == NULL)
                         { i=ERR_R_MALLOC_FAILURE; goto err; }
@@ -269,7 +269,7 @@ void ASN1_OBJECT_free(ASN1_OBJECT *a)
         if (a == NULL) return;
         if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS)
                 {
-#ifndef CONST_STRICT /* disable purely for compile-time strict const checking. Doing this on a "real" compile will cause mempory leaks */
+#ifndef CONST_STRICT /* disable purely for compile-time strict const checking. Doing this on a "real" compile will cause memory leaks */
                 if (a->sn != NULL) Free((void *)a->sn);
                 if (a->ln != NULL) Free((void *)a->ln);
 #endif
diff --git a/src/lib/libcrypto/asn1/a_octet.c b/src/lib/libcrypto/asn1/a_octet.c
index 7659a13bd3..2586f4327d 100644
--- a/src/lib/libcrypto/asn1/a_octet.c
+++ b/src/lib/libcrypto/asn1/a_octet.c
@@ -60,11 +60,23 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_OCTET_STRING *ASN1_OCTET_STRING_new(void)
+{ return M_ASN1_OCTET_STRING_new(); }
+
+void ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *x)
+{ M_ASN1_OCTET_STRING_free(x); }
+
+ASN1_OCTET_STRING *ASN1_OCTET_STRING_dup(ASN1_OCTET_STRING *x)
+{ return M_ASN1_OCTET_STRING_dup(x); }
+
+int ASN1_OCTET_STRING_cmp(ASN1_OCTET_STRING *a, ASN1_OCTET_STRING *b)
+{ return M_ASN1_OCTET_STRING_cmp(a, b); }
+
+int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)
+{ return M_ASN1_OCTET_STRING_set(x, d, len); }
+
 int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
-        {
-        return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
-                V_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL));
-        }
+{ return M_i2d_ASN1_OCTET_STRING(a, pp); }
 
 ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,
              unsigned char **pp, long length)
diff --git a/src/lib/libcrypto/asn1/a_print.c b/src/lib/libcrypto/asn1/a_print.c
index cdec7a1561..b7bd2bd18a 100644
--- a/src/lib/libcrypto/asn1/a_print.c
+++ b/src/lib/libcrypto/asn1/a_print.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_IA5STRING *ASN1_IA5STRING_new(void)
+{ return M_ASN1_IA5STRING_new();}
+
+void ASN1_IA5STRING_free(ASN1_IA5STRING *x)
+{ M_ASN1_IA5STRING_free(x);}
+
 int i2d_ASN1_IA5STRING(ASN1_IA5STRING *a, unsigned char **pp)
         { return(M_i2d_ASN1_IA5STRING(a,pp)); }
 
@@ -67,15 +73,30 @@ ASN1_IA5STRING *d2i_ASN1_IA5STRING(ASN1_IA5STRING **a, unsigned char **pp,
              long l)
         { return(M_d2i_ASN1_IA5STRING(a,pp,l)); }
 
+ASN1_T61STRING *ASN1_T61STRING_new(void)
+{ return M_ASN1_T61STRING_new();}
+
+void ASN1_T61STRING_free(ASN1_T61STRING *x)
+{ M_ASN1_T61STRING_free(x);}
+
 ASN1_T61STRING *d2i_ASN1_T61STRING(ASN1_T61STRING **a, unsigned char **pp,
              long l)
         { return(M_d2i_ASN1_T61STRING(a,pp,l)); }
 
+ASN1_PRINTABLESTRING *ASN1_PRINTABLESTRING_new(void)
+{ return M_ASN1_PRINTABLESTRING_new();}
+
+void ASN1_PRINTABLESTRING_free(ASN1_PRINTABLESTRING *x)
+{ M_ASN1_PRINTABLESTRING_free(x);}
+
 ASN1_PRINTABLESTRING *d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a,
              unsigned char **pp, long l)
         { return(M_d2i_ASN1_PRINTABLESTRING(a,pp,
              l)); }
 
+int i2d_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING *a, unsigned char **pp)
+        { return(M_i2d_ASN1_PRINTABLESTRING(a,pp)); }
+
 int i2d_ASN1_PRINTABLE(ASN1_STRING *a, unsigned char **pp)
         { return(M_i2d_ASN1_PRINTABLE(a,pp)); }
 
@@ -149,6 +170,11 @@ int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s)
         return(1);
         }
 
+ASN1_STRING *DIRECTORYSTRING_new(void)
+{ return M_DIRECTORYSTRING_new();}
+
+void DIRECTORYSTRING_free(ASN1_STRING *x)
+{ M_DIRECTORYSTRING_free(x);}
 
 int i2d_DIRECTORYSTRING(ASN1_STRING *a, unsigned char **pp)
         { return(M_i2d_DIRECTORYSTRING(a,pp)); }
@@ -157,6 +183,12 @@ ASN1_STRING *d2i_DIRECTORYSTRING(ASN1_STRING **a, unsigned char **pp,
              long l)
         { return(M_d2i_DIRECTORYSTRING(a,pp,l)); }
 
+ASN1_STRING *DISPLAYTEXT_new(void)
+{ return M_DISPLAYTEXT_new();}
+
+void DISPLAYTEXT_free(ASN1_STRING *x)
+{ M_DISPLAYTEXT_free(x);}
+
 int i2d_DISPLAYTEXT(ASN1_STRING *a, unsigned char **pp)
         { return(M_i2d_DISPLAYTEXT(a,pp)); }
 
diff --git a/src/lib/libcrypto/asn1/a_sign.c b/src/lib/libcrypto/asn1/a_sign.c
index 57595692e5..cfb4bca4f1 100644
--- a/src/lib/libcrypto/asn1/a_sign.c
+++ b/src/lib/libcrypto/asn1/a_sign.c
@@ -58,10 +58,13 @@
 
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
 #include <openssl/bn.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
@@ -126,11 +129,11 @@ int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
                 ASN1err(ASN1_F_ASN1_SIGN,ERR_R_EVP_LIB);
                 goto err;
                 }
-        if (signature->data != NULL) Free((char *)signature->data);
+        if (signature->data != NULL) Free(signature->data);
         signature->data=buf_out;
         buf_out=NULL;
         signature->length=outl;
-        /* In the interests of compatability, I'll make sure that
+        /* In the interests of compatibility, I'll make sure that
          * the bit string has a 'not-used bits' value of 0
          */
         signature->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
@@ -138,8 +141,8 @@ int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
 err:
         memset(&ctx,0,sizeof(ctx));
         if (buf_in != NULL)
-                { memset((char *)buf_in,0,(unsigned int)inl); Free((char *)buf_in); }
+                { memset((char *)buf_in,0,(unsigned int)inl); Free(buf_in); }
         if (buf_out != NULL)
-                { memset((char *)buf_out,0,outll); Free((char *)buf_out); }
+                { memset((char *)buf_out,0,outll); Free(buf_out); }
         return(outl);
         }
diff --git a/src/lib/libcrypto/asn1/a_strnid.c b/src/lib/libcrypto/asn1/a_strnid.c
new file mode 100644
index 0000000000..ab8417ffab
--- /dev/null
+++ b/src/lib/libcrypto/asn1/a_strnid.c
@@ -0,0 +1,247 @@
+/* a_strnid.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/objects.h>
+
+
+static STACK_OF(ASN1_STRING_TABLE) *stable = NULL;
+static void st_free(ASN1_STRING_TABLE *tbl);
+static int sk_table_cmp(ASN1_STRING_TABLE **a, ASN1_STRING_TABLE **b);
+static int table_cmp(ASN1_STRING_TABLE *a, ASN1_STRING_TABLE *b);
+
+
+/* This is the global mask for the mbstring functions: this is use to
+ * mask out certain types (such as BMPString and UTF8String) because
+ * certain software (e.g. Netscape) has problems with them.
+ */
+
+static unsigned long global_mask = 0xFFFFFFFFL;
+
+void ASN1_STRING_set_default_mask(unsigned long mask)
+{
+        global_mask = mask;
+}
+
+unsigned long ASN1_STRING_get_default_mask(void)
+{
+        return global_mask;
+}
+
+/* This function sets the default to various "flavours" of configuration.
+ * based on an ASCII string. Currently this is:
+ * MASK:XXXX : a numerical mask value.
+ * nobmp : Don't use BMPStrings (just Printable, T61).
+ * pkix : PKIX recommendation in RFC2459.
+ * utf8only : only use UTF8Strings (RFC2459 recommendation for 2004).
+ * default:   the default value, Printable, T61, BMP.
+ */
+
+int ASN1_STRING_set_default_mask_asc(char *p)
+{
+        unsigned long mask;
+        char *end;
+        if(!strncmp(p, "MASK:", 5)) {
+                if(!p[5]) return 0;
+                mask = strtoul(p + 5, &end, 0);
+                if(*end) return 0;
+        } else if(!strcmp(p, "nombstr"))
+                         mask = ~(B_ASN1_BMPSTRING|B_ASN1_UTF8STRING);
+        else if(!strcmp(p, "pkix"))
+                        mask = ~B_ASN1_T61STRING;
+        else if(!strcmp(p, "utf8only")) mask = B_ASN1_UTF8STRING;
+        else if(!strcmp(p, "default"))
+            mask = 0xFFFFFFFFL;
+        else return 0;
+        ASN1_STRING_set_default_mask(mask);
+        return 1;
+}
+
+/* The following function generates an ASN1_STRING based on limits in a table.
+ * Frequently the types and length of an ASN1_STRING are restricted by a 
+ * corresponding OID. For example certificates and certificate requests.
+ */
+
+ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, const unsigned char *in,
+                                        int inlen, int inform, int nid)
+{
+        ASN1_STRING_TABLE *tbl;
+        ASN1_STRING *str = NULL;
+        unsigned long mask;
+        int ret;
+        if(!out) out = &str;
+        tbl = ASN1_STRING_TABLE_get(nid);
+        if(tbl) {
+                mask = tbl->mask;
+                if(!(tbl->flags & STABLE_NO_MASK)) mask &= global_mask;
+                ret = ASN1_mbstring_ncopy(out, in, inlen, inform, tbl->mask,
+                                        tbl->minsize, tbl->maxsize);
+        } else ret = ASN1_mbstring_copy(out, in, inlen, inform, DIRSTRING_TYPE & global_mask);
+        if(ret <= 0) return NULL;
+        return *out;
+}
+
+/* Now the tables and helper functions for the string table:
+ */
+
+/* size limits: this stuff is taken straight from RFC2459 */
+
+#define ub_name                         32768
+#define ub_common_name                  64
+#define ub_locality_name                128
+#define ub_state_name                   128
+#define ub_organization_name            64
+#define ub_organization_unit_name       64
+#define ub_title                        64
+#define ub_email_address                128
+
+/* This table must be kept in NID order */
+
+static ASN1_STRING_TABLE tbl_standard[] = {
+{NID_commonName,                1, ub_common_name, DIRSTRING_TYPE, 0},
+{NID_countryName,               2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
+{NID_localityName,              1, ub_locality_name, DIRSTRING_TYPE, 0},
+{NID_stateOrProvinceName,       1, ub_state_name, DIRSTRING_TYPE, 0},
+{NID_organizationName,          1, ub_organization_name, DIRSTRING_TYPE, 0},
+{NID_organizationalUnitName,    1, ub_organization_unit_name, DIRSTRING_TYPE, 0},
+{NID_pkcs9_emailAddress,        1, ub_email_address, B_ASN1_IA5STRING, STABLE_NO_MASK},
+{NID_pkcs9_unstructuredName,    1, -1, PKCS9STRING_TYPE, 0},
+{NID_pkcs9_challengePassword,   1, -1, PKCS9STRING_TYPE, 0},
+{NID_pkcs9_unstructuredAddress, 1, -1, DIRSTRING_TYPE, 0},
+{NID_givenName,                 1, ub_name, DIRSTRING_TYPE, 0},
+{NID_surname,                   1, ub_name, DIRSTRING_TYPE, 0},
+{NID_initials,                  1, ub_name, DIRSTRING_TYPE, 0},
+{NID_name,                      1, ub_name, DIRSTRING_TYPE, 0},
+{NID_dnQualifier,               -1, -1, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK}
+};
+
+static int sk_table_cmp(ASN1_STRING_TABLE **a, ASN1_STRING_TABLE **b)
+{
+        return (*a)->nid - (*b)->nid;
+}
+
+static int table_cmp(ASN1_STRING_TABLE *a, ASN1_STRING_TABLE *b)
+{
+        return a->nid - b->nid;
+}
+
+ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid)
+{
+        int idx;
+        ASN1_STRING_TABLE *ttmp;
+        ASN1_STRING_TABLE fnd;
+        fnd.nid = nid;
+        ttmp = (ASN1_STRING_TABLE *) OBJ_bsearch((char *)&fnd,
+                                        (char *)tbl_standard, 
+                        sizeof(tbl_standard)/sizeof(ASN1_STRING_TABLE),
+                        sizeof(ASN1_STRING_TABLE), (int(*)())table_cmp);
+        if(ttmp) return ttmp;
+        if(!stable) return NULL;
+        idx = sk_ASN1_STRING_TABLE_find(stable, &fnd);
+        if(idx < 0) return NULL;
+        return sk_ASN1_STRING_TABLE_value(stable, idx);
+}
+        
+int ASN1_STRING_TABLE_add(int nid,
+                 long minsize, long maxsize, unsigned long mask,
+                                unsigned long flags)
+{
+        ASN1_STRING_TABLE *tmp;
+        char new_nid = 0;
+        flags &= ~STABLE_FLAGS_MALLOC;
+        if(!stable) stable = sk_ASN1_STRING_TABLE_new(sk_table_cmp);
+        if(!stable) {
+                ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        if(!(tmp = ASN1_STRING_TABLE_get(nid))) {
+                tmp = Malloc(sizeof(ASN1_STRING_TABLE));
+                if(!tmp) {
+                        ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD,
+                                                        ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                tmp->flags = flags | STABLE_FLAGS_MALLOC;
+                tmp->nid = nid;
+                new_nid = 1;
+        } else tmp->flags = (tmp->flags & STABLE_FLAGS_MALLOC) | flags;
+        if(minsize != -1) tmp->minsize = minsize;
+        if(maxsize != -1) tmp->maxsize = maxsize;
+        tmp->mask = mask;
+        if(new_nid) sk_ASN1_STRING_TABLE_push(stable, tmp);
+        return 1;
+}
+
+void ASN1_STRING_TABLE_cleanup(void)
+{
+        STACK_OF(ASN1_STRING_TABLE) *tmp;
+        tmp = stable;
+        if(!tmp) return;
+        stable = NULL;
+        sk_ASN1_STRING_TABLE_pop_free(tmp, st_free);
+}
+
+static void st_free(ASN1_STRING_TABLE *tbl)
+{
+        if(tbl->flags & STABLE_FLAGS_MALLOC) Free(tbl);
+}
+
+IMPLEMENT_STACK_OF(ASN1_STRING_TABLE)
diff --git a/src/lib/libcrypto/asn1/a_time.c b/src/lib/libcrypto/asn1/a_time.c
index c1690a5694..b193f1c71f 100644
--- a/src/lib/libcrypto/asn1/a_time.c
+++ b/src/lib/libcrypto/asn1/a_time.c
@@ -66,6 +66,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_TIME *ASN1_TIME_new(void)
+{ return M_ASN1_TIME_new(); }
+
+void ASN1_TIME_free(ASN1_TIME *x)
+{ M_ASN1_TIME_free(x); }
+
 int i2d_ASN1_TIME(ASN1_TIME *a, unsigned char **pp)
         {
 #ifdef CHARSET_EBCDIC
diff --git a/src/lib/libcrypto/asn1/a_type.c b/src/lib/libcrypto/asn1/a_type.c
index 3f2ecee5c2..161ef81197 100644
--- a/src/lib/libcrypto/asn1/a_type.c
+++ b/src/lib/libcrypto/asn1/a_type.c
@@ -282,7 +282,7 @@ void ASN1_TYPE_free(ASN1_TYPE *a)
         {
         if (a == NULL) return;
         ASN1_TYPE_component_free(a);
-        Free((char *)(char *)a);
+        Free(a);
         }
 
 int ASN1_TYPE_get(ASN1_TYPE *a)
diff --git a/src/lib/libcrypto/asn1/a_utctm.c b/src/lib/libcrypto/asn1/a_utctm.c
index 688199fdd2..07565974e3 100644
--- a/src/lib/libcrypto/asn1/a_utctm.c
+++ b/src/lib/libcrypto/asn1/a_utctm.c
@@ -66,6 +66,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_UTCTIME *ASN1_UTCTIME_new(void)
+{ return M_ASN1_UTCTIME_new(); }
+
+void ASN1_UTCTIME_free(ASN1_UTCTIME *x)
+{ M_ASN1_UTCTIME_free(x); }
+
 int i2d_ASN1_UTCTIME(ASN1_UTCTIME *a, unsigned char **pp)
         {
 #ifndef CHARSET_EBCDIC
@@ -109,7 +115,7 @@ ASN1_UTCTIME *d2i_ASN1_UTCTIME(ASN1_UTCTIME **a, unsigned char **pp,
         return(ret);
 err:
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_UTCTIME_free(ret);
+                M_ASN1_UTCTIME_free(ret);
         return(NULL);
         }
 
@@ -192,7 +198,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
 #endif
 
         if (s == NULL)
-                s=ASN1_UTCTIME_new();
+                s=M_ASN1_UTCTIME_new();
         if (s == NULL)
                 return(NULL);
 
diff --git a/src/lib/libcrypto/asn1/a_utf8.c b/src/lib/libcrypto/asn1/a_utf8.c
index 4a8a92e9e4..b5125af224 100644
--- a/src/lib/libcrypto/asn1/a_utf8.c
+++ b/src/lib/libcrypto/asn1/a_utf8.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_UTF8STRING *ASN1_UTF8STRING_new(void)
+{ return M_ASN1_UTF8STRING_new();}
+
+void ASN1_UTF8STRING_free(ASN1_UTF8STRING *x)
+{ M_ASN1_UTF8STRING_free(x);}
+
 int i2d_ASN1_UTF8STRING(ASN1_UTF8STRING *a, unsigned char **pp)
         {
         return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
@@ -81,3 +87,152 @@ ASN1_UTF8STRING *d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a, unsigned char **pp,
         return(ret);
         }
 
+
+/* UTF8 utilities */
+
+/* This parses a UTF8 string one character at a time. It is passed a pointer
+ * to the string and the length of the string. It sets 'value' to the value of
+ * the current character. It returns the number of characters read or a
+ * negative error code:
+ * -1 = string too short
+ * -2 = illegal character
+ * -3 = subsequent characters not of the form 10xxxxxx
+ * -4 = character encoded incorrectly (not minimal length).
+ */
+
+int UTF8_getc(const unsigned char *str, int len, unsigned long *val)
+{
+        const unsigned char *p;
+        unsigned long value;
+        int ret;
+        if(len <= 0) return 0;
+        p = str;
+
+        /* Check syntax and work out the encoded value (if correct) */
+        if((*p & 0x80) == 0) {
+                value = *p++ & 0x7f;
+                ret = 1;
+        } else if((*p & 0xe0) == 0xc0) {
+                if(len < 2) return -1;
+                if((p[1] & 0xc0) != 0x80) return -3;
+                value = (*p++ & 0x1f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x80) return -4;
+                ret = 2;
+        } else if((*p & 0xf0) == 0xe0) {
+                if(len < 3) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0xf) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x800) return -4;
+                ret = 3;
+        } else if((*p & 0xf8) == 0xf0) {
+                if(len < 4) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x7) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x10000) return -4;
+                ret = 4;
+        } else if((*p & 0xfc) == 0xf8) {
+                if(len < 5) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) 
+                   || ((p[4] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x3) << 24;
+                value |= (*p++ & 0x3f) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x200000) return -4;
+                ret = 5;
+        } else if((*p & 0xfe) == 0xfc) {
+                if(len < 6) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) 
+                   || ((p[4] & 0xc0) != 0x80) 
+                   || ((p[5] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x1) << 30;
+                value |= (*p++ & 0x3f) << 24;
+                value |= (*p++ & 0x3f) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x4000000) return -4;
+                ret = 6;
+        } else return -2;
+        *val = value;
+        return ret;
+}
+
+/* This takes a character 'value' and writes the UTF8 encoded value in
+ * 'str' where 'str' is a buffer containing 'len' characters. Returns
+ * the number of characters written or -1 if 'len' is too small. 'str' can
+ * be set to NULL in which case it just returns the number of characters.
+ * It will need at most 6 characters.
+ */
+
+int UTF8_putc(unsigned char *str, int len, unsigned long value)
+{
+        if(!str) len = 6;       /* Maximum we will need */
+        else if(len <= 0) return -1;
+        if(value < 0x80) {
+                if(str) *str = (unsigned char)value;
+                return 1;
+        }
+        if(value < 0x800) {
+                if(len < 2) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 6) & 0x1f) | 0xc0);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 2;
+        }
+        if(value < 0x10000) {
+                if(len < 3) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 12) & 0xf) | 0xe0);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 3;
+        }
+        if(value < 0x200000) {
+                if(len < 4) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 18) & 0x7) | 0xf0);
+                        *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 4;
+        }
+        if(value < 0x4000000) {
+                if(len < 5) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 24) & 0x3) | 0xf8);
+                        *str++ = (unsigned char)(((value >> 18) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 5;
+        }
+        if(len < 6) return -1;
+        if(str) {
+                *str++ = (unsigned char)(((value >> 30) & 0x1) | 0xfc);
+                *str++ = (unsigned char)(((value >> 24) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 18) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                *str = (unsigned char)((value & 0x3f) | 0x80);
+        }
+        return 6;
+}
diff --git a/src/lib/libcrypto/asn1/a_verify.c b/src/lib/libcrypto/asn1/a_verify.c
index 6383d2c698..d4aede85c3 100644
--- a/src/lib/libcrypto/asn1/a_verify.c
+++ b/src/lib/libcrypto/asn1/a_verify.c
@@ -58,10 +58,13 @@
 
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
 #include <openssl/bn.h>
 #include <openssl/x509.h>
 #include <openssl/objects.h>
@@ -98,7 +101,7 @@ int ASN1_verify(int (*i2d)(), X509_ALGOR *a, ASN1_BIT_STRING *signature,
         EVP_VerifyUpdate(&ctx,(unsigned char *)buf_in,inl);
 
         memset(buf_in,0,(unsigned int)inl);
-        Free((char *)buf_in);
+        Free(buf_in);
 
         if (EVP_VerifyFinal(&ctx,(unsigned char *)signature->data,
                         (unsigned int)signature->length,pkey) <= 0)
diff --git a/src/lib/libcrypto/asn1/a_vis.c b/src/lib/libcrypto/asn1/a_vis.c
index 2072be780d..5cfc080bec 100644
--- a/src/lib/libcrypto/asn1/a_vis.c
+++ b/src/lib/libcrypto/asn1/a_vis.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_VISIBLESTRING *ASN1_VISIBLESTRING_new(void)
+{ return M_ASN1_VISIBLESTRING_new(); }
+
+void ASN1_VISIBLESTRING_free(ASN1_VISIBLESTRING *x)
+{ M_ASN1_VISIBLESTRING_free(x); }
+
 int i2d_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING *a, unsigned char **pp)
         {
         return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
diff --git a/src/lib/libcrypto/asn1/asn1.h b/src/lib/libcrypto/asn1/asn1.h
index 5c2d8999bc..99bd64a11e 100644
--- a/src/lib/libcrypto/asn1/asn1.h
+++ b/src/lib/libcrypto/asn1/asn1.h
@@ -68,6 +68,10 @@ extern "C" {
 #include <openssl/stack.h>
 #include <openssl/safestack.h>
 
+#ifdef VMS
+#include <openssl/vms_idhacks.h>
+#endif
+
 #define V_ASN1_UNIVERSAL                0x00
 #define V_ASN1_APPLICATION              0x40
 #define V_ASN1_CONTEXT_SPECIFIC         0x80
@@ -77,7 +81,7 @@ extern "C" {
 #define V_ASN1_PRIMITIVE_TAG            0x1f
 #define V_ASN1_PRIMATIVE_TAG            0x1f
 
-#define V_ASN1_APP_CHOOSE               -2      /* let the recipent choose */
+#define V_ASN1_APP_CHOOSE               -2      /* let the recipient choose */
 
 #define V_ASN1_UNDEF                    -1
 #define V_ASN1_EOC                      0
@@ -129,6 +133,13 @@ extern "C" {
 #define B_ASN1_UNKNOWN          0x1000
 #define B_ASN1_UTF8STRING       0x2000
 
+/* For use with ASN1_mbstring_copy() */
+#define MBSTRING_FLAG           0x1000
+#define MBSTRING_ASC            (MBSTRING_FLAG|1)
+#define MBSTRING_BMP            (MBSTRING_FLAG|2)
+#define MBSTRING_UNIV           (MBSTRING_FLAG|3)
+#define MBSTRING_UTF8           (MBSTRING_FLAG|4)
+
 #define DECLARE_ASN1_SET_OF(type) \
 int i2d_ASN1_SET_OF_##type(STACK_OF(type) *a,unsigned char **pp, \
                            int (*func)(type *,unsigned char **), int ex_tag, \
@@ -165,7 +176,7 @@ typedef struct asn1_ctx_st
         int tag;        /* tag from last 'get object' */
         int xclass;     /* class from last 'get object' */
         long slen;      /* length of last 'get object' */
-        unsigned char *max; /* largest value of p alowed */
+        unsigned char *max; /* largest value of p allowed */
         unsigned char *q;/* temporary variable */
         unsigned char **pp;/* variable */
         int line;       /* used in error processing */
@@ -200,7 +211,34 @@ typedef struct asn1_string_st
         long flags;
         } ASN1_STRING;
 
-#ifndef DEBUG
+#define STABLE_FLAGS_MALLOC     0x01
+#define STABLE_NO_MASK          0x02
+#define DIRSTRING_TYPE  \
+ (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_BMPSTRING|B_ASN1_UTF8STRING)
+#define PKCS9STRING_TYPE (DIRSTRING_TYPE|B_ASN1_IA5STRING)
+
+typedef struct asn1_string_table_st {
+        int nid;
+        long minsize;
+        long maxsize;
+        unsigned long mask;
+        unsigned long flags;
+} ASN1_STRING_TABLE;
+
+DECLARE_STACK_OF(ASN1_STRING_TABLE)
+
+/* size limits: this stuff is taken straight from RFC2459 */
+
+#define ub_name                         32768
+#define ub_common_name                  64
+#define ub_locality_name                128
+#define ub_state_name                   128
+#define ub_organization_name            64
+#define ub_organization_unit_name       64
+#define ub_title                        64
+#define ub_email_address                128
+
+#ifdef NO_ASN1_TYPEDEFS
 #define ASN1_INTEGER            ASN1_STRING
 #define ASN1_ENUMERATED         ASN1_STRING
 #define ASN1_BIT_STRING         ASN1_STRING
@@ -234,6 +272,8 @@ typedef struct asn1_string_st ASN1_VISIBLESTRING;
 typedef struct asn1_string_st ASN1_UTF8STRING;
 #endif
 
+typedef int ASN1_NULL;
+
 typedef struct asn1_type_st
         {
         int type;
@@ -281,60 +321,58 @@ typedef struct asn1_header_st
         ASN1_METHOD *meth;
         } ASN1_HEADER;
 
-#define ASN1_STRING_length(x)   ((x)->length)
-#define ASN1_STRING_type(x)     ((x)->type)
-#define ASN1_STRING_data(x)     ((x)->data)
+/* This is used to contain a list of bit names */
+typedef struct BIT_STRING_BITNAME_st {
+        int bitnum;
+        const char *lname;
+        const char *sname;
+} BIT_STRING_BITNAME;
+
+
+#define M_ASN1_STRING_length(x) ((x)->length)
+#define M_ASN1_STRING_length_set(x, n)  ((x)->length = (n))
+#define M_ASN1_STRING_type(x)   ((x)->type)
+#define M_ASN1_STRING_data(x)   ((x)->data)
 
 /* Macros for string operations */
-#define ASN1_BIT_STRING_new()   (ASN1_BIT_STRING *)\
+#define M_ASN1_BIT_STRING_new() (ASN1_BIT_STRING *)\
                 ASN1_STRING_type_new(V_ASN1_BIT_STRING)
-#define ASN1_BIT_STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_BIT_STRING_dup(a) (ASN1_BIT_STRING *)\
+#define M_ASN1_BIT_STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_BIT_STRING_dup(a) (ASN1_BIT_STRING *)\
                 ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_BIT_STRING_cmp(a,b) ASN1_STRING_cmp(\
+#define M_ASN1_BIT_STRING_cmp(a,b) ASN1_STRING_cmp(\
                 (ASN1_STRING *)a,(ASN1_STRING *)b)
-#define ASN1_BIT_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
-/* i2d_ASN1_BIT_STRING() is a function */
-/* d2i_ASN1_BIT_STRING() is a function */
+#define M_ASN1_BIT_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
 
-#define ASN1_INTEGER_new()      (ASN1_INTEGER *)\
+#define M_ASN1_INTEGER_new()    (ASN1_INTEGER *)\
                 ASN1_STRING_type_new(V_ASN1_INTEGER)
-#define ASN1_INTEGER_free(a)            ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_INTEGER_dup(a) (ASN1_INTEGER *)ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_INTEGER_cmp(a,b)   ASN1_STRING_cmp(\
+#define M_ASN1_INTEGER_free(a)          ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_INTEGER_dup(a) (ASN1_INTEGER *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_INTEGER_cmp(a,b) ASN1_STRING_cmp(\
                 (ASN1_STRING *)a,(ASN1_STRING *)b)
-/* ASN1_INTEGER_set() is a function, also see BN_to_ASN1_INTEGER() */
-/* ASN1_INTEGER_get() is a function, also see ASN1_INTEGER_to_BN() */
-/* i2d_ASN1_INTEGER() is a function */
-/* d2i_ASN1_INTEGER() is a function */
 
-#define ASN1_ENUMERATED_new()   (ASN1_ENUMERATED *)\
+#define M_ASN1_ENUMERATED_new() (ASN1_ENUMERATED *)\
                 ASN1_STRING_type_new(V_ASN1_ENUMERATED)
-#define ASN1_ENUMERATED_free(a)         ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_ENUMERATED_dup(a) (ASN1_ENUMERATED *)ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_ENUMERATED_cmp(a,b)        ASN1_STRING_cmp(\
+#define M_ASN1_ENUMERATED_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_ENUMERATED_dup(a) (ASN1_ENUMERATED *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_ENUMERATED_cmp(a,b)      ASN1_STRING_cmp(\
                 (ASN1_STRING *)a,(ASN1_STRING *)b)
-/* ASN1_ENUMERATED_set() is a function, also see BN_to_ASN1_ENUMERATED() */
-/* ASN1_ENUMERATED_get() is a function, also see ASN1_ENUMERATED_to_BN() */
-/* i2d_ASN1_ENUMERATED() is a function */
-/* d2i_ASN1_ENUMERATED() is a function */
 
-#define ASN1_OCTET_STRING_new() (ASN1_OCTET_STRING *)\
+#define M_ASN1_OCTET_STRING_new()       (ASN1_OCTET_STRING *)\
                 ASN1_STRING_type_new(V_ASN1_OCTET_STRING)
-#define ASN1_OCTET_STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_OCTET_STRING_dup(a) (ASN1_OCTET_STRING *)\
+#define M_ASN1_OCTET_STRING_free(a)     ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_OCTET_STRING_dup(a) (ASN1_OCTET_STRING *)\
                 ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_OCTET_STRING_cmp(a,b) ASN1_STRING_cmp(\
+#define M_ASN1_OCTET_STRING_cmp(a,b) ASN1_STRING_cmp(\
                 (ASN1_STRING *)a,(ASN1_STRING *)b)
-#define ASN1_OCTET_STRING_set(a,b,c)    ASN1_STRING_set((ASN1_STRING *)a,b,c)
-#define ASN1_OCTET_STRING_print(a,b)    ASN1_STRING_print(a,(ASN1_STRING *)b)
+#define M_ASN1_OCTET_STRING_set(a,b,c)  ASN1_STRING_set((ASN1_STRING *)a,b,c)
+#define M_ASN1_OCTET_STRING_print(a,b)  ASN1_STRING_print(a,(ASN1_STRING *)b)
 #define M_i2d_ASN1_OCTET_STRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_OCTET_STRING,\
-                V_ASN1_OCTET_STRING)
-/* d2i_ASN1_OCTET_STRING() is a function */
+                V_ASN1_UNIVERSAL)
 
-#define ASN1_PRINTABLE_new()    ASN1_STRING_type_new(V_ASN1_T61STRING)
-#define ASN1_PRINTABLE_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_PRINTABLE_new()  ASN1_STRING_type_new(V_ASN1_T61STRING)
+#define M_ASN1_PRINTABLE_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_PRINTABLE(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                 pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_ASN1_PRINTABLE(a,pp,l) \
@@ -345,10 +383,11 @@ typedef struct asn1_header_st
                         B_ASN1_BIT_STRING| \
                         B_ASN1_UNIVERSALSTRING|\
                         B_ASN1_BMPSTRING|\
+                        B_ASN1_UTF8STRING|\
                         B_ASN1_UNKNOWN)
 
-#define DIRECTORYSTRING_new() ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
-#define DIRECTORYSTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_DIRECTORYSTRING_new() ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
+#define M_DIRECTORYSTRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_DIRECTORYSTRING(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                                                 pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_DIRECTORYSTRING(a,pp,l) \
@@ -359,8 +398,8 @@ typedef struct asn1_header_st
                         B_ASN1_UNIVERSALSTRING|\
                         B_ASN1_UTF8STRING)
 
-#define DISPLAYTEXT_new() ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
-#define DISPLAYTEXT_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_DISPLAYTEXT_new() ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
+#define M_DISPLAYTEXT_free(a) ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_DISPLAYTEXT(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                                                 pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_DISPLAYTEXT(a,pp,l) \
@@ -369,9 +408,9 @@ typedef struct asn1_header_st
                         B_ASN1_BMPSTRING|\
                         B_ASN1_UTF8STRING)
 
-#define ASN1_PRINTABLESTRING_new() (ASN1_PRINTABLESTRING *)\
+#define M_ASN1_PRINTABLESTRING_new() (ASN1_PRINTABLESTRING *)\
                 ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
-#define ASN1_PRINTABLESTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_PRINTABLESTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_PRINTABLESTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_PRINTABLESTRING,\
                 V_ASN1_UNIVERSAL)
@@ -379,9 +418,9 @@ typedef struct asn1_header_st
                 (ASN1_PRINTABLESTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_PRINTABLESTRING)
 
-#define ASN1_T61STRING_new()    (ASN1_T61STRING_STRING *)\
+#define M_ASN1_T61STRING_new()  (ASN1_T61STRING *)\
                 ASN1_STRING_type_new(V_ASN1_T61STRING)
-#define ASN1_T61STRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_T61STRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_T61STRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_T61STRING,\
                 V_ASN1_UNIVERSAL)
@@ -389,10 +428,10 @@ typedef struct asn1_header_st
                 (ASN1_T61STRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_T61STRING)
 
-#define ASN1_IA5STRING_new()    (ASN1_IA5STRING *)\
+#define M_ASN1_IA5STRING_new()  (ASN1_IA5STRING *)\
                 ASN1_STRING_type_new(V_ASN1_IA5STRING)
-#define ASN1_IA5STRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_IA5STRING_dup(a)   \
+#define M_ASN1_IA5STRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_IA5STRING_dup(a) \
                         (ASN1_IA5STRING *)ASN1_STRING_dup((ASN1_STRING *)a)
 #define M_i2d_ASN1_IA5STRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_IA5STRING,\
@@ -401,38 +440,25 @@ typedef struct asn1_header_st
                 (ASN1_IA5STRING *)d2i_ASN1_type_bytes((ASN1_STRING **)a,pp,l,\
                         B_ASN1_IA5STRING)
 
-#define ASN1_UTCTIME_new()      (ASN1_UTCTIME *)\
+#define M_ASN1_UTCTIME_new()    (ASN1_UTCTIME *)\
                 ASN1_STRING_type_new(V_ASN1_UTCTIME)
-#define ASN1_UTCTIME_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_UTCTIME_dup(a) (ASN1_UTCTIME *)ASN1_STRING_dup((ASN1_STRING *)a)
-/* i2d_ASN1_UTCTIME() is a function */
-/* d2i_ASN1_UTCTIME() is a function */
-/* ASN1_UTCTIME_set() is a function */
-/* ASN1_UTCTIME_check() is a function */
-
-#define ASN1_GENERALIZEDTIME_new()      (ASN1_GENERALIZEDTIME *)\
+#define M_ASN1_UTCTIME_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UTCTIME_dup(a) (ASN1_UTCTIME *)ASN1_STRING_dup((ASN1_STRING *)a)
+
+#define M_ASN1_GENERALIZEDTIME_new()    (ASN1_GENERALIZEDTIME *)\
                 ASN1_STRING_type_new(V_ASN1_GENERALIZEDTIME)
-#define ASN1_GENERALIZEDTIME_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_GENERALIZEDTIME_dup(a) (ASN1_GENERALIZEDTIME *)ASN1_STRING_dup(\
+#define M_ASN1_GENERALIZEDTIME_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_GENERALIZEDTIME_dup(a) (ASN1_GENERALIZEDTIME *)ASN1_STRING_dup(\
         (ASN1_STRING *)a)
-/* i2d_ASN1_GENERALIZEDTIME() is a function */
-/* d2i_ASN1_GENERALIZEDTIME() is a function */
-/* ASN1_GENERALIZEDTIME_set() is a function */
-/* ASN1_GENERALIZEDTIME_check() is a function */
 
-#define ASN1_TIME_new() (ASN1_TIME *)\
+#define M_ASN1_TIME_new()       (ASN1_TIME *)\
                 ASN1_STRING_type_new(V_ASN1_UTCTIME)
-#define ASN1_TIME_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_TIME_dup(a) (ASN1_TIME *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_TIME_free(a)     ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_TIME_dup(a) (ASN1_TIME *)ASN1_STRING_dup((ASN1_STRING *)a)
 
-/* i2d_ASN1_TIME() is a function */
-/* d2i_ASN1_TIME() is a function */
-/* ASN1_TIME_set() is a function */
-/* ASN1_TIME_check() is a function */
-
-#define ASN1_GENERALSTRING_new()        (ASN1_GENERALSTRING *)\
+#define M_ASN1_GENERALSTRING_new()      (ASN1_GENERALSTRING *)\
                 ASN1_STRING_type_new(V_ASN1_GENERALSTRING)
-#define ASN1_GENERALSTRING_free(a)      ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_GENERALSTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_GENERALSTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_GENERALSTRING,\
                         V_ASN1_UNIVERSAL)
@@ -440,9 +466,9 @@ typedef struct asn1_header_st
                 (ASN1_GENERALSTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_GENERALSTRING)
 
-#define ASN1_UNIVERSALSTRING_new()      (ASN1_UNIVERSALSTRING *)\
+#define M_ASN1_UNIVERSALSTRING_new()    (ASN1_UNIVERSALSTRING *)\
                 ASN1_STRING_type_new(V_ASN1_UNIVERSALSTRING)
-#define ASN1_UNIVERSALSTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UNIVERSALSTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_UNIVERSALSTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_UNIVERSALSTRING,\
                         V_ASN1_UNIVERSAL)
@@ -450,9 +476,9 @@ typedef struct asn1_header_st
                 (ASN1_UNIVERSALSTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_UNIVERSALSTRING)
 
-#define ASN1_BMPSTRING_new()    (ASN1_BMPSTRING *)\
+#define M_ASN1_BMPSTRING_new()  (ASN1_BMPSTRING *)\
                 ASN1_STRING_type_new(V_ASN1_BMPSTRING)
-#define ASN1_BMPSTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_BMPSTRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_BMPSTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_BMPSTRING,\
                         V_ASN1_UNIVERSAL)
@@ -460,9 +486,9 @@ typedef struct asn1_header_st
                 (ASN1_BMPSTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_BMPSTRING)
 
-#define ASN1_VISIBLESTRING_new()        (ASN1_VISIBLESTRING *)\
+#define M_ASN1_VISIBLESTRING_new()      (ASN1_VISIBLESTRING *)\
                 ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
-#define ASN1_VISIBLESTRING_free(a)      ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_VISIBLESTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_VISIBLESTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_VISIBLESTRING,\
                         V_ASN1_UNIVERSAL)
@@ -470,9 +496,9 @@ typedef struct asn1_header_st
                 (ASN1_VISIBLESTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_VISIBLESTRING)
 
-#define ASN1_UTF8STRING_new()   (ASN1_UTF8STRING *)\
+#define M_ASN1_UTF8STRING_new() (ASN1_UTF8STRING *)\
                 ASN1_STRING_type_new(V_ASN1_UTF8STRING)
-#define ASN1_UTF8STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UTF8STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_UTF8STRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_UTF8STRING,\
                         V_ASN1_UNIVERSAL)
@@ -500,7 +526,7 @@ ASN1_OBJECT *	d2i_ASN1_OBJECT(ASN1_OBJECT **a,unsigned char **pp,
 DECLARE_STACK_OF(ASN1_OBJECT)
 DECLARE_ASN1_SET_OF(ASN1_OBJECT)
 
-ASN1_STRING *   ASN1_STRING_new(void );
+ASN1_STRING *   ASN1_STRING_new(void);
 void            ASN1_STRING_free(ASN1_STRING *a);
 ASN1_STRING *   ASN1_STRING_dup(ASN1_STRING *a);
 ASN1_STRING *   ASN1_STRING_type_new(int type );
@@ -508,23 +534,44 @@ int 		ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b);
   /* Since this is used to store all sorts of things, via macros, for now, make
      its data void * */
 int             ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
+int ASN1_STRING_length(ASN1_STRING *x);
+void ASN1_STRING_length_set(ASN1_STRING *x, int n);
+int ASN1_STRING_type(ASN1_STRING *x);
+unsigned char * ASN1_STRING_data(ASN1_STRING *x);
 
+ASN1_BIT_STRING *       ASN1_BIT_STRING_new(void);
+void            ASN1_BIT_STRING_free(ASN1_BIT_STRING *a);
 int             i2d_ASN1_BIT_STRING(ASN1_BIT_STRING *a,unsigned char **pp);
 ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,unsigned char **pp,
                         long length);
+int             ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d,
+                        int length );
 int             ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value);
 int             ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n);
 
+#ifdef HEADER_BIO_H
+int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
+                                BIT_STRING_BITNAME *tbl, int indent);
+#endif
+int ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl);
+int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
+                                BIT_STRING_BITNAME *tbl);
 
 int             i2d_ASN1_BOOLEAN(int a,unsigned char **pp);
 int             d2i_ASN1_BOOLEAN(int *a,unsigned char **pp,long length);
 
+ASN1_INTEGER *  ASN1_INTEGER_new(void);
+void            ASN1_INTEGER_free(ASN1_INTEGER *a);
 int             i2d_ASN1_INTEGER(ASN1_INTEGER *a,unsigned char **pp);
 ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a,unsigned char **pp,
                         long length);
 ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a,unsigned char **pp,
                         long length);
+ASN1_INTEGER *  ASN1_INTEGER_dup(ASN1_INTEGER *x);
+int ASN1_INTEGER_cmp(ASN1_INTEGER *x, ASN1_INTEGER *y);
 
+ASN1_ENUMERATED *       ASN1_ENUMERATED_new(void);
+void            ASN1_ENUMERATED_free(ASN1_ENUMERATED *a);
 int             i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a,unsigned char **pp);
 ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a,unsigned char **pp,
                         long length);
@@ -537,49 +584,88 @@ int ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *a);
 ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,time_t t);
 int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, char *str); 
 
+ASN1_OCTET_STRING *     ASN1_OCTET_STRING_new(void);
+void            ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *a);
 int             i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a,unsigned char **pp);
 ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,
                         unsigned char **pp,long length);
+ASN1_OCTET_STRING *     ASN1_OCTET_STRING_dup(ASN1_OCTET_STRING *a);
+int     ASN1_OCTET_STRING_cmp(ASN1_OCTET_STRING *a, ASN1_OCTET_STRING *b);
+int     ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, unsigned char *data, int len);
 
+ASN1_VISIBLESTRING *    ASN1_VISIBLESTRING_new(void);
+void            ASN1_VISIBLESTRING_free(ASN1_VISIBLESTRING *a);
 int     i2d_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING *a,unsigned char **pp);
 ASN1_VISIBLESTRING *d2i_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING **a,
                         unsigned char **pp,long length);
 
+ASN1_UTF8STRING *       ASN1_UTF8STRING_new(void);
+void            ASN1_UTF8STRING_free(ASN1_UTF8STRING *a);
 int             i2d_ASN1_UTF8STRING(ASN1_UTF8STRING *a,unsigned char **pp);
 ASN1_UTF8STRING *d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a,
                         unsigned char **pp,long length);
 
+ASN1_NULL *     ASN1_NULL_new(void);
+void            ASN1_NULL_free(ASN1_NULL *a);
+int             i2d_ASN1_NULL(ASN1_NULL *a,unsigned char **pp);
+ASN1_NULL *d2i_ASN1_NULL(ASN1_NULL **a, unsigned char **pp,long length);
+
+ASN1_BMPSTRING *        ASN1_BMPSTRING_new(void);
+void            ASN1_BMPSTRING_free(ASN1_BMPSTRING *a);
 int i2d_ASN1_BMPSTRING(ASN1_BMPSTRING *a, unsigned char **pp);
 ASN1_BMPSTRING *d2i_ASN1_BMPSTRING(ASN1_BMPSTRING **a, unsigned char **pp,
         long length);
 
+
+int UTF8_getc(const unsigned char *str, int len, unsigned long *val);
+int UTF8_putc(unsigned char *str, int len, unsigned long value);
+
 int i2d_ASN1_PRINTABLE(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_ASN1_PRINTABLE(ASN1_STRING **a,
         unsigned char **pp, long l);
+
+ASN1_PRINTABLESTRING *  ASN1_PRINTABLESTRING_new(void);
+void            ASN1_PRINTABLESTRING_free(ASN1_PRINTABLESTRING *a);
 ASN1_PRINTABLESTRING *d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a,
         unsigned char **pp, long l);
+int i2d_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING *a, unsigned char **pp);
 
+ASN1_STRING *   DIRECTORYSTRING_new(void);
+void            DIRECTORYSTRING_free(ASN1_STRING *a);
 int     i2d_DIRECTORYSTRING(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_DIRECTORYSTRING(ASN1_STRING **a, unsigned char **pp,
                                                                  long length);
 
+ASN1_STRING *   DISPLAYTEXT_new(void);
+void            DISPLAYTEXT_free(ASN1_STRING *a);
 int     i2d_DISPLAYTEXT(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_DISPLAYTEXT(ASN1_STRING **a, unsigned char **pp, long length);
 
+ASN1_T61STRING *        ASN1_T61STRING_new(void);
+void            ASN1_T61STRING_free(ASN1_IA5STRING *a);
 ASN1_T61STRING *d2i_ASN1_T61STRING(ASN1_T61STRING **a,
         unsigned char **pp, long l);
+
+ASN1_IA5STRING *        ASN1_IA5STRING_new(void);
+void            ASN1_IA5STRING_free(ASN1_IA5STRING *a);
 int i2d_ASN1_IA5STRING(ASN1_IA5STRING *a,unsigned char **pp);
 ASN1_IA5STRING *d2i_ASN1_IA5STRING(ASN1_IA5STRING **a,
         unsigned char **pp, long l);
 
+ASN1_UTCTIME *  ASN1_UTCTIME_new(void);
+void            ASN1_UTCTIME_free(ASN1_UTCTIME *a);
 int             i2d_ASN1_UTCTIME(ASN1_UTCTIME *a,unsigned char **pp);
 ASN1_UTCTIME *  d2i_ASN1_UTCTIME(ASN1_UTCTIME **a,unsigned char **pp,
                         long length);
 
+ASN1_GENERALIZEDTIME *  ASN1_GENERALIZEDTIME_new(void);
+void            ASN1_GENERALIZEDTIME_free(ASN1_GENERALIZEDTIME *a);
 int             i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a,unsigned char **pp);
 ASN1_GENERALIZEDTIME *  d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a,unsigned char **pp,
                         long length);
 
+ASN1_TIME *     ASN1_TIME_new(void);
+void            ASN1_TIME_free(ASN1_TIME *a);
 int             i2d_ASN1_TIME(ASN1_TIME *a,unsigned char **pp);
 ASN1_TIME *     d2i_ASN1_TIME(ASN1_TIME **a,unsigned char **pp, long length);
 ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s,time_t t);
@@ -654,6 +740,7 @@ int ASN1_TIME_print(BIO *fp,ASN1_TIME *a);
 int ASN1_STRING_print(BIO *bp,ASN1_STRING *v);
 int ASN1_parse(BIO *bp,unsigned char *pp,long len,int indent);
 #endif
+const char *ASN1_tag2str(int tag);
 
 /* Used to load and write netscape format cert/key */
 int i2d_ASN1_HEADER(ASN1_HEADER *a,unsigned char **pp);
@@ -687,6 +774,21 @@ unsigned char *ASN1_seq_pack(STACK *safes, int (*i2d)(), unsigned char **buf,
 void *ASN1_unpack_string(ASN1_STRING *oct, char *(*d2i)());
 ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 
+void ASN1_STRING_set_default_mask(unsigned long mask);
+int ASN1_STRING_set_default_mask_asc(char *p);
+unsigned long ASN1_STRING_get_default_mask(void);
+int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask);
+int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask, 
+                                        long minsize, long maxsize);
+
+ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, 
+                const unsigned char *in, int inlen, int inform, int nid);
+ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid);
+int ASN1_STRING_TABLE_add(int, long, long, unsigned long, unsigned long);
+void ASN1_STRING_TABLE_cleanup(void);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -699,6 +801,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_A2I_ASN1_ENUMERATED                       236
 #define ASN1_F_A2I_ASN1_INTEGER                          101
 #define ASN1_F_A2I_ASN1_STRING                           102
+#define ASN1_F_ACCESS_DESCRIPTION_NEW                    291
 #define ASN1_F_ASN1_COLLATE_PRIMITIVE                    103
 #define ASN1_F_ASN1_D2I_BIO                              104
 #define ASN1_F_ASN1_D2I_FP                               105
@@ -712,6 +815,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_ASN1_I2D_FP                               110
 #define ASN1_F_ASN1_INTEGER_SET                          111
 #define ASN1_F_ASN1_INTEGER_TO_BN                        112
+#define ASN1_F_ASN1_MBSTRING_COPY                        282
 #define ASN1_F_ASN1_OBJECT_NEW                           113
 #define ASN1_F_ASN1_PACK_STRING                          245
 #define ASN1_F_ASN1_PBE_SET                              253
@@ -719,6 +823,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_ASN1_SEQ_UNPACK                           247
 #define ASN1_F_ASN1_SIGN                                 114
 #define ASN1_F_ASN1_STRING_NEW                           115
+#define ASN1_F_ASN1_STRING_TABLE_ADD                     283
 #define ASN1_F_ASN1_STRING_TYPE_NEW                      116
 #define ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING             117
 #define ASN1_F_ASN1_TYPE_GET_OCTETSTRING                 118
@@ -730,6 +835,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_BASIC_CONSTRAINTS_NEW                     226
 #define ASN1_F_BN_TO_ASN1_ENUMERATED                     234
 #define ASN1_F_BN_TO_ASN1_INTEGER                        122
+#define ASN1_F_D2I_ACCESS_DESCRIPTION                    284
 #define ASN1_F_D2I_ASN1_BIT_STRING                       123
 #define ASN1_F_D2I_ASN1_BMPSTRING                        124
 #define ASN1_F_D2I_ASN1_BOOLEAN                          125
@@ -738,6 +844,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_ASN1_GENERALIZEDTIME                  223
 #define ASN1_F_D2I_ASN1_HEADER                           127
 #define ASN1_F_D2I_ASN1_INTEGER                          128
+#define ASN1_F_D2I_ASN1_NULL                             292
 #define ASN1_F_D2I_ASN1_OBJECT                           129
 #define ASN1_F_D2I_ASN1_OCTET_STRING                     130
 #define ASN1_F_D2I_ASN1_PRINT_TYPE                       131
@@ -765,6 +872,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_NETSCAPE_SPKAC                        143
 #define ASN1_F_D2I_NETSCAPE_SPKI                         144
 #define ASN1_F_D2I_NOTICEREF                             268
+#define ASN1_F_D2I_OTHERNAME                             287
 #define ASN1_F_D2I_PBE2PARAM                             262
 #define ASN1_F_D2I_PBEPARAM                              249
 #define ASN1_F_D2I_PBKDF2PARAM                           263
@@ -796,6 +904,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_X509                                  159
 #define ASN1_F_D2I_X509_ALGOR                            160
 #define ASN1_F_D2I_X509_ATTRIBUTE                        161
+#define ASN1_F_D2I_X509_CERT_AUX                         285
 #define ASN1_F_D2I_X509_CINF                             162
 #define ASN1_F_D2I_X509_CRL                              163
 #define ASN1_F_D2I_X509_CRL_INFO                         164
@@ -819,12 +928,14 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_I2D_DSAPARAMS                             178
 #define ASN1_F_I2D_DSAPRIVATEKEY                         179
 #define ASN1_F_I2D_DSAPUBLICKEY                          180
+#define ASN1_F_I2D_DSA_PUBKEY                            290
 #define ASN1_F_I2D_NETSCAPE_RSA                          181
 #define ASN1_F_I2D_PKCS7                                 182
 #define ASN1_F_I2D_PRIVATEKEY                            183
 #define ASN1_F_I2D_PUBLICKEY                             184
 #define ASN1_F_I2D_RSAPRIVATEKEY                         185
 #define ASN1_F_I2D_RSAPUBLICKEY                          186
+#define ASN1_F_I2D_RSA_PUBKEY                            289
 #define ASN1_F_I2D_X509_ATTRIBUTE                        187
 #define ASN1_F_I2T_ASN1_OBJECT                           188
 #define ASN1_F_NETSCAPE_CERT_SEQUENCE_NEW                229
@@ -832,6 +943,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_NETSCAPE_SPKAC_NEW                        190
 #define ASN1_F_NETSCAPE_SPKI_NEW                         191
 #define ASN1_F_NOTICEREF_NEW                             272
+#define ASN1_F_OTHERNAME_NEW                             288
 #define ASN1_F_PBE2PARAM_NEW                             264
 #define ASN1_F_PBEPARAM_NEW                              251
 #define ASN1_F_PBKDF2PARAM_NEW                           265
@@ -859,6 +971,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_USERNOTICE_NEW                            275
 #define ASN1_F_X509_ALGOR_NEW                            202
 #define ASN1_F_X509_ATTRIBUTE_NEW                        203
+#define ASN1_F_X509_CERT_AUX_NEW                         286
 #define ASN1_F_X509_CINF_NEW                             204
 #define ASN1_F_X509_CRL_INFO_NEW                         205
 #define ASN1_F_X509_CRL_NEW                              206
@@ -889,6 +1002,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_BN_LIB                                    107
 #define ASN1_R_BOOLEAN_IS_WRONG_LENGTH                   108
 #define ASN1_R_BUFFER_TOO_SMALL                          109
+#define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER           166
 #define ASN1_R_DATA_IS_WRONG                             110
 #define ASN1_R_DECODE_ERROR                              155
 #define ASN1_R_DECODING_ERROR                            111
@@ -902,24 +1016,31 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_EXPECTING_A_BIT_STRING                    116
 #define ASN1_R_EXPECTING_A_BOOLEAN                       117
 #define ASN1_R_EXPECTING_A_GENERALIZEDTIME               151
+#define ASN1_R_EXPECTING_A_NULL                          164
 #define ASN1_R_EXPECTING_A_TIME                          152
 #define ASN1_R_EXPECTING_A_UTCTIME                       118
 #define ASN1_R_FIRST_NUM_TOO_LARGE                       119
 #define ASN1_R_GENERALIZEDTIME_TOO_LONG                  153
 #define ASN1_R_HEADER_TOO_LONG                           120
+#define ASN1_R_ILLEGAL_CHARACTERS                        158
+#define ASN1_R_INVALID_BMPSTRING_LENGTH                  159
 #define ASN1_R_INVALID_DIGIT                             121
 #define ASN1_R_INVALID_SEPARATOR                         122
 #define ASN1_R_INVALID_TIME_FORMAT                       123
+#define ASN1_R_INVALID_UNIVERSALSTRING_LENGTH            160
+#define ASN1_R_INVALID_UTF8STRING                        161
 #define ASN1_R_IV_TOO_LARGE                              124
 #define ASN1_R_LENGTH_ERROR                              125
 #define ASN1_R_MISSING_SECOND_NUMBER                     126
 #define ASN1_R_NON_HEX_CHARACTERS                        127
 #define ASN1_R_NOT_ENOUGH_DATA                           128
+#define ASN1_R_NULL_IS_WRONG_LENGTH                      165
 #define ASN1_R_ODD_NUMBER_OF_CHARS                       129
 #define ASN1_R_PARSING                                   130
 #define ASN1_R_PRIVATE_KEY_HEADER_MISSING                131
 #define ASN1_R_SECOND_NUMBER_TOO_LARGE                   132
 #define ASN1_R_SHORT_LINE                                133
+#define ASN1_R_STRING_TOO_LONG                           163
 #define ASN1_R_STRING_TOO_SHORT                          134
 #define ASN1_R_TAG_VALUE_TOO_HIGH                        135
 #define ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 136
@@ -927,6 +1048,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_UNABLE_TO_DECODE_RSA_KEY                  138
 #define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY          139
 #define ASN1_R_UNKNOWN_ATTRIBUTE_TYPE                    140
+#define ASN1_R_UNKNOWN_FORMAT                            162
 #define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM          141
 #define ASN1_R_UNKNOWN_OBJECT_TYPE                       142
 #define ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE                   143
diff --git a/src/lib/libcrypto/asn1/asn1_err.c b/src/lib/libcrypto/asn1/asn1_err.c
index 16755a0b05..b183814242 100644
--- a/src/lib/libcrypto/asn1/asn1_err.c
+++ b/src/lib/libcrypto/asn1/asn1_err.c
@@ -69,19 +69,21 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_A2I_ASN1_ENUMERATED,0),      "a2i_ASN1_ENUMERATED"},
 {ERR_PACK(0,ASN1_F_A2I_ASN1_INTEGER,0), "a2i_ASN1_INTEGER"},
 {ERR_PACK(0,ASN1_F_A2I_ASN1_STRING,0),  "a2i_ASN1_STRING"},
+{ERR_PACK(0,ASN1_F_ACCESS_DESCRIPTION_NEW,0),   "ACCESS_DESCRIPTION_new"},
 {ERR_PACK(0,ASN1_F_ASN1_COLLATE_PRIMITIVE,0),   "ASN1_COLLATE_PRIMITIVE"},
 {ERR_PACK(0,ASN1_F_ASN1_D2I_BIO,0),     "ASN1_d2i_bio"},
 {ERR_PACK(0,ASN1_F_ASN1_D2I_FP,0),      "ASN1_d2i_fp"},
 {ERR_PACK(0,ASN1_F_ASN1_DUP,0), "ASN1_dup"},
 {ERR_PACK(0,ASN1_F_ASN1_ENUMERATED_SET,0),      "ASN1_ENUMERATED_set"},
 {ERR_PACK(0,ASN1_F_ASN1_ENUMERATED_TO_BN,0),    "ASN1_ENUMERATED_to_BN"},
-{ERR_PACK(0,ASN1_F_ASN1_GENERALIZEDTIME_NEW,0), "ASN1_GENERALIZEDTIME_NEW"},
+{ERR_PACK(0,ASN1_F_ASN1_GENERALIZEDTIME_NEW,0), "ASN1_GENERALIZEDTIME_new"},
 {ERR_PACK(0,ASN1_F_ASN1_GET_OBJECT,0),  "ASN1_get_object"},
 {ERR_PACK(0,ASN1_F_ASN1_HEADER_NEW,0),  "ASN1_HEADER_new"},
 {ERR_PACK(0,ASN1_F_ASN1_I2D_BIO,0),     "ASN1_i2d_bio"},
 {ERR_PACK(0,ASN1_F_ASN1_I2D_FP,0),      "ASN1_i2d_fp"},
 {ERR_PACK(0,ASN1_F_ASN1_INTEGER_SET,0), "ASN1_INTEGER_set"},
 {ERR_PACK(0,ASN1_F_ASN1_INTEGER_TO_BN,0),       "ASN1_INTEGER_to_BN"},
+{ERR_PACK(0,ASN1_F_ASN1_MBSTRING_COPY,0),       "ASN1_mbstring_copy"},
 {ERR_PACK(0,ASN1_F_ASN1_OBJECT_NEW,0),  "ASN1_OBJECT_new"},
 {ERR_PACK(0,ASN1_F_ASN1_PACK_STRING,0), "ASN1_pack_string"},
 {ERR_PACK(0,ASN1_F_ASN1_PBE_SET,0),     "ASN1_PBE_SET"},
@@ -89,17 +91,19 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_ASN1_SEQ_UNPACK,0),  "ASN1_seq_unpack"},
 {ERR_PACK(0,ASN1_F_ASN1_SIGN,0),        "ASN1_sign"},
 {ERR_PACK(0,ASN1_F_ASN1_STRING_NEW,0),  "ASN1_STRING_new"},
+{ERR_PACK(0,ASN1_F_ASN1_STRING_TABLE_ADD,0),    "ASN1_STRING_TABLE_add"},
 {ERR_PACK(0,ASN1_F_ASN1_STRING_TYPE_NEW,0),     "ASN1_STRING_type_new"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING,0),    "ASN1_TYPE_get_int_octetstring"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_GET_OCTETSTRING,0),        "ASN1_TYPE_get_octetstring"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_NEW,0),    "ASN1_TYPE_new"},
 {ERR_PACK(0,ASN1_F_ASN1_UNPACK_STRING,0),       "ASN1_unpack_string"},
-{ERR_PACK(0,ASN1_F_ASN1_UTCTIME_NEW,0), "ASN1_UTCTIME_NEW"},
+{ERR_PACK(0,ASN1_F_ASN1_UTCTIME_NEW,0), "ASN1_UTCTIME_new"},
 {ERR_PACK(0,ASN1_F_ASN1_VERIFY,0),      "ASN1_verify"},
 {ERR_PACK(0,ASN1_F_AUTHORITY_KEYID_NEW,0),      "AUTHORITY_KEYID_new"},
 {ERR_PACK(0,ASN1_F_BASIC_CONSTRAINTS_NEW,0),    "BASIC_CONSTRAINTS_new"},
 {ERR_PACK(0,ASN1_F_BN_TO_ASN1_ENUMERATED,0),    "BN_to_ASN1_ENUMERATED"},
 {ERR_PACK(0,ASN1_F_BN_TO_ASN1_INTEGER,0),       "BN_to_ASN1_INTEGER"},
+{ERR_PACK(0,ASN1_F_D2I_ACCESS_DESCRIPTION,0),   "d2i_ACCESS_DESCRIPTION"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BIT_STRING,0),      "d2i_ASN1_BIT_STRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BMPSTRING,0),       "d2i_ASN1_BMPSTRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BOOLEAN,0), "d2i_ASN1_BOOLEAN"},
@@ -108,6 +112,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_ASN1_GENERALIZEDTIME,0), "d2i_ASN1_GENERALIZEDTIME"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_HEADER,0),  "d2i_ASN1_HEADER"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_INTEGER,0), "d2i_ASN1_INTEGER"},
+{ERR_PACK(0,ASN1_F_D2I_ASN1_NULL,0),    "d2i_ASN1_NULL"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_OBJECT,0),  "d2i_ASN1_OBJECT"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_OCTET_STRING,0),    "d2i_ASN1_OCTET_STRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_PRINT_TYPE,0),      "D2I_ASN1_PRINT_TYPE"},
@@ -135,6 +140,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_NETSCAPE_SPKAC,0),       "d2i_NETSCAPE_SPKAC"},
 {ERR_PACK(0,ASN1_F_D2I_NETSCAPE_SPKI,0),        "d2i_NETSCAPE_SPKI"},
 {ERR_PACK(0,ASN1_F_D2I_NOTICEREF,0),    "d2i_NOTICEREF"},
+{ERR_PACK(0,ASN1_F_D2I_OTHERNAME,0),    "d2i_OTHERNAME"},
 {ERR_PACK(0,ASN1_F_D2I_PBE2PARAM,0),    "d2i_PBE2PARAM"},
 {ERR_PACK(0,ASN1_F_D2I_PBEPARAM,0),     "d2i_PBEPARAM"},
 {ERR_PACK(0,ASN1_F_D2I_PBKDF2PARAM,0),  "d2i_PBKDF2PARAM"},
@@ -166,6 +172,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_X509,0), "d2i_X509"},
 {ERR_PACK(0,ASN1_F_D2I_X509_ALGOR,0),   "d2i_X509_ALGOR"},
 {ERR_PACK(0,ASN1_F_D2I_X509_ATTRIBUTE,0),       "d2i_X509_ATTRIBUTE"},
+{ERR_PACK(0,ASN1_F_D2I_X509_CERT_AUX,0),        "d2i_X509_CERT_AUX"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CINF,0),    "d2i_X509_CINF"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CRL,0),     "d2i_X509_CRL"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CRL_INFO,0),        "d2i_X509_CRL_INFO"},
@@ -189,12 +196,14 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_I2D_DSAPARAMS,0),    "i2d_DSAparams"},
 {ERR_PACK(0,ASN1_F_I2D_DSAPRIVATEKEY,0),        "i2d_DSAPrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_DSAPUBLICKEY,0), "i2d_DSAPublicKey"},
+{ERR_PACK(0,ASN1_F_I2D_DSA_PUBKEY,0),   "i2d_DSA_PUBKEY"},
 {ERR_PACK(0,ASN1_F_I2D_NETSCAPE_RSA,0), "i2d_Netscape_RSA"},
 {ERR_PACK(0,ASN1_F_I2D_PKCS7,0),        "i2d_PKCS7"},
 {ERR_PACK(0,ASN1_F_I2D_PRIVATEKEY,0),   "i2d_PrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_PUBLICKEY,0),    "i2d_PublicKey"},
 {ERR_PACK(0,ASN1_F_I2D_RSAPRIVATEKEY,0),        "i2d_RSAPrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_RSAPUBLICKEY,0), "i2d_RSAPublicKey"},
+{ERR_PACK(0,ASN1_F_I2D_RSA_PUBKEY,0),   "i2d_RSA_PUBKEY"},
 {ERR_PACK(0,ASN1_F_I2D_X509_ATTRIBUTE,0),       "i2d_X509_ATTRIBUTE"},
 {ERR_PACK(0,ASN1_F_I2T_ASN1_OBJECT,0),  "i2t_ASN1_OBJECT"},
 {ERR_PACK(0,ASN1_F_NETSCAPE_CERT_SEQUENCE_NEW,0),       "NETSCAPE_CERT_SEQUENCE_new"},
@@ -202,6 +211,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_NETSCAPE_SPKAC_NEW,0),       "NETSCAPE_SPKAC_new"},
 {ERR_PACK(0,ASN1_F_NETSCAPE_SPKI_NEW,0),        "NETSCAPE_SPKI_new"},
 {ERR_PACK(0,ASN1_F_NOTICEREF_NEW,0),    "NOTICEREF_new"},
+{ERR_PACK(0,ASN1_F_OTHERNAME_NEW,0),    "OTHERNAME_new"},
 {ERR_PACK(0,ASN1_F_PBE2PARAM_NEW,0),    "PBE2PARAM_new"},
 {ERR_PACK(0,ASN1_F_PBEPARAM_NEW,0),     "PBEPARAM_new"},
 {ERR_PACK(0,ASN1_F_PBKDF2PARAM_NEW,0),  "PBKDF2PARAM_new"},
@@ -229,6 +239,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_USERNOTICE_NEW,0),   "USERNOTICE_new"},
 {ERR_PACK(0,ASN1_F_X509_ALGOR_NEW,0),   "X509_ALGOR_new"},
 {ERR_PACK(0,ASN1_F_X509_ATTRIBUTE_NEW,0),       "X509_ATTRIBUTE_new"},
+{ERR_PACK(0,ASN1_F_X509_CERT_AUX_NEW,0),        "X509_CERT_AUX_new"},
 {ERR_PACK(0,ASN1_F_X509_CINF_NEW,0),    "X509_CINF_new"},
 {ERR_PACK(0,ASN1_F_X509_CRL_INFO_NEW,0),        "X509_CRL_INFO_new"},
 {ERR_PACK(0,ASN1_F_X509_CRL_NEW,0),     "X509_CRL_new"},
@@ -262,6 +273,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_BN_LIB                           ,"bn lib"},
 {ASN1_R_BOOLEAN_IS_WRONG_LENGTH          ,"boolean is wrong length"},
 {ASN1_R_BUFFER_TOO_SMALL                 ,"buffer too small"},
+{ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER  ,"cipher has no object identifier"},
 {ASN1_R_DATA_IS_WRONG                    ,"data is wrong"},
 {ASN1_R_DECODE_ERROR                     ,"decode error"},
 {ASN1_R_DECODING_ERROR                   ,"decoding error"},
@@ -275,24 +287,31 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_EXPECTING_A_BIT_STRING           ,"expecting a bit string"},
 {ASN1_R_EXPECTING_A_BOOLEAN              ,"expecting a boolean"},
 {ASN1_R_EXPECTING_A_GENERALIZEDTIME      ,"expecting a generalizedtime"},
+{ASN1_R_EXPECTING_A_NULL                 ,"expecting a null"},
 {ASN1_R_EXPECTING_A_TIME                 ,"expecting a time"},
 {ASN1_R_EXPECTING_A_UTCTIME              ,"expecting a utctime"},
 {ASN1_R_FIRST_NUM_TOO_LARGE              ,"first num too large"},
 {ASN1_R_GENERALIZEDTIME_TOO_LONG         ,"generalizedtime too long"},
 {ASN1_R_HEADER_TOO_LONG                  ,"header too long"},
+{ASN1_R_ILLEGAL_CHARACTERS               ,"illegal characters"},
+{ASN1_R_INVALID_BMPSTRING_LENGTH         ,"invalid bmpstring length"},
 {ASN1_R_INVALID_DIGIT                    ,"invalid digit"},
 {ASN1_R_INVALID_SEPARATOR                ,"invalid separator"},
 {ASN1_R_INVALID_TIME_FORMAT              ,"invalid time format"},
+{ASN1_R_INVALID_UNIVERSALSTRING_LENGTH   ,"invalid universalstring length"},
+{ASN1_R_INVALID_UTF8STRING               ,"invalid utf8string"},
 {ASN1_R_IV_TOO_LARGE                     ,"iv too large"},
 {ASN1_R_LENGTH_ERROR                     ,"length error"},
 {ASN1_R_MISSING_SECOND_NUMBER            ,"missing second number"},
 {ASN1_R_NON_HEX_CHARACTERS               ,"non hex characters"},
 {ASN1_R_NOT_ENOUGH_DATA                  ,"not enough data"},
+{ASN1_R_NULL_IS_WRONG_LENGTH             ,"null is wrong length"},
 {ASN1_R_ODD_NUMBER_OF_CHARS              ,"odd number of chars"},
 {ASN1_R_PARSING                          ,"parsing"},
 {ASN1_R_PRIVATE_KEY_HEADER_MISSING       ,"private key header missing"},
 {ASN1_R_SECOND_NUMBER_TOO_LARGE          ,"second number too large"},
 {ASN1_R_SHORT_LINE                       ,"short line"},
+{ASN1_R_STRING_TOO_LONG                  ,"string too long"},
 {ASN1_R_STRING_TOO_SHORT                 ,"string too short"},
 {ASN1_R_TAG_VALUE_TOO_HIGH               ,"tag value too high"},
 {ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD,"the asn1 object identifier is not known for this md"},
@@ -300,6 +319,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_UNABLE_TO_DECODE_RSA_KEY         ,"unable to decode rsa key"},
 {ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY ,"unable to decode rsa private key"},
 {ASN1_R_UNKNOWN_ATTRIBUTE_TYPE           ,"unknown attribute type"},
+{ASN1_R_UNKNOWN_FORMAT                   ,"unknown format"},
 {ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM ,"unknown message digest algorithm"},
 {ASN1_R_UNKNOWN_OBJECT_TYPE              ,"unknown object type"},
 {ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE          ,"unknown public key type"},
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 95e54ed626..be8daa8688 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -176,7 +176,7 @@ static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
         }
 
 /* class 0 is constructed
- * constructed == 2 for indefinitle length constructed */
+ * constructed == 2 for indefinite length constructed */
 void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
              int xclass)
         {
@@ -349,7 +349,7 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
         if (data != NULL)
                 {
                 memcpy(str->data,data,len);
-                /* an alowance for strings :-) */
+                /* an allowance for strings :-) */
                 str->data[len]='\0';
                 }
         return(1);
@@ -381,8 +381,8 @@ ASN1_STRING *ASN1_STRING_type_new(int type)
 void ASN1_STRING_free(ASN1_STRING *a)
         {
         if (a == NULL) return;
-        if (a->data != NULL) Free((char *)a->data);
-        Free((char *)a);
+        if (a->data != NULL) Free(a->data);
+        Free(a);
         }
 
 int ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b)
@@ -411,3 +411,14 @@ void asn1_add_error(unsigned char *address, int offset)
         ERR_add_error_data(4,"address=",buf1," offset=",buf2);
         }
 
+int ASN1_STRING_length(ASN1_STRING *x)
+{ return M_ASN1_STRING_length(x); }
+
+void ASN1_STRING_length_set(ASN1_STRING *x, int len)
+{ M_ASN1_STRING_length_set(x, len); return; }
+
+int ASN1_STRING_type(ASN1_STRING *x)
+{ return M_ASN1_STRING_type(x); }
+
+unsigned char * ASN1_STRING_data(ASN1_STRING *x)
+{ return M_ASN1_STRING_data(x); }
diff --git a/src/lib/libcrypto/asn1/asn1_mac.h b/src/lib/libcrypto/asn1/asn1_mac.h
index 93f9c5193c..4f2a82d340 100644
--- a/src/lib/libcrypto/asn1/asn1_mac.h
+++ b/src/lib/libcrypto/asn1/asn1_mac.h
@@ -106,6 +106,20 @@ err:\
 #define M_ASN1_D2I_start_sequence() \
         if (!asn1_GetSequence(&c,&length)) \
                 { c.line=__LINE__; goto err; }
+/* Begin reading ASN1 without a surrounding sequence */
+#define M_ASN1_D2I_begin() \
+        c.slen = length;
+
+/* End reading ASN1 with no check on length */
+#define M_ASN1_D2I_Finish_nolen(a, func, e) \
+        *pp=c.p; \
+        if (a != NULL) (*a)=ret; \
+        return(ret); \
+err:\
+        ASN1_MAC_H_err((e),c.error,c.line); \
+        asn1_add_error(*pp,(int)(c.q- *pp)); \
+        if ((ret != NULL) && ((a == NULL) || (*a != ret))) func(ret); \
+        return(NULL)
 
 #define M_ASN1_D2I_end_sequence() \
         (((c.inf&1) == 0)?(c.slen <= 0): \
diff --git a/src/lib/libcrypto/asn1/asn1_par.c b/src/lib/libcrypto/asn1/asn1_par.c
index 86886606ef..d1e9816bad 100644
--- a/src/lib/libcrypto/asn1/asn1_par.c
+++ b/src/lib/libcrypto/asn1/asn1_par.c
@@ -93,55 +93,8 @@ static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
                 sprintf(str,"cont [ %d ]",tag);
         else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
                 sprintf(str,"appl [ %d ]",tag);
-        else if ((tag == V_ASN1_EOC) /* && (xclass == V_ASN1_UNIVERSAL) */)
-                p="EOC";
-        else if (tag == V_ASN1_BOOLEAN)
-                p="BOOLEAN";
-        else if (tag == V_ASN1_INTEGER)
-                p="INTEGER";
-        else if (tag == V_ASN1_ENUMERATED)
-                p="ENUMERATED";
-        else if (tag == V_ASN1_BIT_STRING)
-                p="BIT STRING";
-        else if (tag == V_ASN1_OCTET_STRING)
-                p="OCTET STRING";
-        else if (tag == V_ASN1_NULL)
-                p="NULL";
-        else if (tag == V_ASN1_OBJECT)
-                p="OBJECT";
-        else if (tag == V_ASN1_SEQUENCE)
-                p="SEQUENCE";
-        else if (tag == V_ASN1_SET)
-                p="SET";
-        else if (tag == V_ASN1_PRINTABLESTRING)
-                p="PRINTABLESTRING";
-        else if (tag == V_ASN1_T61STRING)
-                p="T61STRING";
-        else if (tag == V_ASN1_IA5STRING)
-                p="IA5STRING";
-        else if (tag == V_ASN1_UTCTIME)
-                p="UTCTIME";
+        else p = ASN1_tag2str(tag);
 
-        /* extras */
-        else if (tag == V_ASN1_NUMERICSTRING)
-                p="NUMERICSTRING";
-        else if (tag == V_ASN1_VIDEOTEXSTRING)
-                p="VIDEOTEXSTRING";
-        else if (tag == V_ASN1_GENERALIZEDTIME)
-                p="GENERALIZEDTIME";
-        else if (tag == V_ASN1_GRAPHICSTRING)
-                p="GRAPHICSTRING";
-        else if (tag == V_ASN1_VISIBLESTRING)
-                p="VISIBLESTRING";
-        else if (tag == V_ASN1_GENERALSTRING)
-                p="GENERALSTRING";
-        else if (tag == V_ASN1_UNIVERSALSTRING)
-                p="UNIVERSALSTRING";
-        else if (tag == V_ASN1_BMPSTRING)
-                p="BMPSTRING";
-        else
-                p2="(unknown)";
-                
         if (p2 != NULL)
                 {
                 if (BIO_printf(bp,fmt2,tag,p2) <= 0) goto err;
@@ -320,7 +273,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                                         os->length) <= 0)
                                                         goto end;
                                                 }
-                                        ASN1_OCTET_STRING_free(os);
+                                        M_ASN1_OCTET_STRING_free(os);
                                         os=NULL;
                                         }
                                 }
@@ -354,7 +307,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                         if (BIO_write(bp,"BAD INTEGER",11) <= 0)
                                                 goto end;
                                         }
-                                ASN1_INTEGER_free(bs);
+                                M_ASN1_INTEGER_free(bs);
                                 }
                         else if (tag == V_ASN1_ENUMERATED)
                                 {
@@ -386,7 +339,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                         if (BIO_write(bp,"BAD ENUMERATED",11) <= 0)
                                                 goto end;
                                         }
-                                ASN1_ENUMERATED_free(bs);
+                                M_ASN1_ENUMERATED_free(bs);
                                 }
 
                         if (!nl) 
@@ -405,7 +358,28 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
         ret=1;
 end:
         if (o != NULL) ASN1_OBJECT_free(o);
-        if (os != NULL) ASN1_OCTET_STRING_free(os);
+        if (os != NULL) M_ASN1_OCTET_STRING_free(os);
         *pp=p;
         return(ret);
         }
+
+const char *ASN1_tag2str(int tag)
+{
+        const static char *tag2str[] = {
+         "EOC", "BOOLEAN", "INTEGER", "BIT STRING", "OCTET STRING", /* 0-4 */
+         "NULL", "OBJECT", "OBJECT DESCRIPTOR", "EXTERNAL", "REAL", /* 5-9 */
+         "ENUMERATED", "<ASN1 11>", "UTF8STRING", "<ASN1 13>",      /* 10-13 */
+        "<ASN1 14>", "<ASN1 15>", "SEQUENCE", "SET",                /* 15-17 */
+        "NUMERICSTRING", "PRINTABLESTRING", "T61STRING",            /* 18-20 */
+        "VIDEOTEXSTRING", "IA5STRING", "UTCTIME","GENERALIZEDTIME", /* 21-24 */
+        "GRAPHICSTRING", "VISIBLESTRING", "GENERALSTRING",          /* 25-27 */
+        "UNIVERSALSTRING", "<ASN1 29>", "BMPSTRING"                 /* 28-30 */
+        };
+
+        if((tag == V_ASN1_NEG_INTEGER) || (tag == V_ASN1_NEG_ENUMERATED))
+                                                        tag &= ~0x100;
+
+        if(tag < 0 || tag > 30) return "(unknown)";
+        return tag2str[tag];
+}
+
diff --git a/src/lib/libcrypto/asn1/d2i_dhp.c b/src/lib/libcrypto/asn1/d2i_dhp.c
index a077211a4c..635ae829db 100644
--- a/src/lib/libcrypto/asn1/d2i_dhp.c
+++ b/src/lib/libcrypto/asn1/d2i_dhp.c
@@ -86,7 +86,7 @@ DH *d2i_DHparams(DH **a, unsigned char **pp, long length)
                 ret->length=(int)v;
                 }
 
-        ASN1_BIT_STRING_free(bs);
+        M_ASN1_BIT_STRING_free(bs);
 
         M_ASN1_D2I_Finish_2(a);
 
@@ -95,7 +95,7 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_DHPARAMS,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DH_free(ret);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
+        if (bs != NULL) M_ASN1_BIT_STRING_free(bs);
         return(NULL);
         }
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_dsap.c b/src/lib/libcrypto/asn1/d2i_dsap.c
index cdd7136f51..6d1c297133 100644
--- a/src/lib/libcrypto/asn1/d2i_dsap.c
+++ b/src/lib/libcrypto/asn1/d2i_dsap.c
@@ -83,7 +83,7 @@ DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
         M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
         if ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;
 
-        ASN1_BIT_STRING_free(bs);
+        M_ASN1_BIT_STRING_free(bs);
 
         M_ASN1_D2I_Finish_2(a);
 
@@ -92,7 +92,7 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_DSAPARAMS,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
+        if (bs != NULL) M_ASN1_BIT_STRING_free(bs);
         return(NULL);
         }
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_pr.c b/src/lib/libcrypto/asn1/d2i_pr.c
index f3d1aa6240..c92b8325d8 100644
--- a/src/lib/libcrypto/asn1/d2i_pr.c
+++ b/src/lib/libcrypto/asn1/d2i_pr.c
@@ -112,3 +112,26 @@ err:
         return(NULL);
         }
 
+/* This works like d2i_PrivateKey() except it automatically works out the type */
+
+EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, unsigned char **pp,
+             long length)
+{
+        STACK_OF(ASN1_TYPE) *inkey;
+        unsigned char *p;
+        int keytype;
+        p = *pp;
+        /* Dirty trick: read in the ASN1 data into a STACK_OF(ASN1_TYPE):
+         * by analyzing it we can determine the passed structure: this
+         * assumes the input is surrounded by an ASN1 SEQUENCE.
+         */
+        inkey = d2i_ASN1_SET_OF_ASN1_TYPE(NULL, &p, length, d2i_ASN1_TYPE, 
+                        ASN1_TYPE_free, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+        /* Since we only need to discern "traditional format" RSA and DSA
+         * keys we can just count the elements.
+         */
+        if(sk_ASN1_TYPE_num(inkey) == 6) keytype = EVP_PKEY_DSA;
+        else keytype = EVP_PKEY_RSA;
+        sk_ASN1_TYPE_pop_free(inkey, ASN1_TYPE_free);
+        return d2i_PrivateKey(keytype, a, pp, length);
+}
diff --git a/src/lib/libcrypto/asn1/d2i_r_pr.c b/src/lib/libcrypto/asn1/d2i_r_pr.c
index 18f11b6f5e..6c8a45f821 100644
--- a/src/lib/libcrypto/asn1/d2i_r_pr.c
+++ b/src/lib/libcrypto/asn1/d2i_r_pr.c
@@ -107,7 +107,7 @@ RSA *d2i_RSAPrivateKey(RSA **a, unsigned char **pp, long length)
         if ((ret->iqmp=BN_bin2bn(bs->data,bs->length,ret->iqmp)) == NULL)
                 goto err_bn;
 
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
 
         M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -115,7 +115,14 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_RSAPRIVATEKEY,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) RSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
+
         return(NULL);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_r_pu.c b/src/lib/libcrypto/asn1/d2i_r_pu.c
index c4ae58b594..d1289f160e 100644
--- a/src/lib/libcrypto/asn1/d2i_r_pu.c
+++ b/src/lib/libcrypto/asn1/d2i_r_pu.c
@@ -81,7 +81,7 @@ RSA *d2i_RSAPublicKey(RSA **a, unsigned char **pp, long length)
         M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
         if ((ret->e=BN_bin2bn(bs->data,bs->length,ret->e)) == NULL) goto err_bn;
 
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
         bs=NULL;
 
         M_ASN1_D2I_Finish_2(a);
@@ -91,7 +91,13 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_RSAPUBLICKEY,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) RSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
         return(NULL);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_s_pr.c b/src/lib/libcrypto/asn1/d2i_s_pr.c
index 050e1cc5fb..dec2a2ebd3 100644
--- a/src/lib/libcrypto/asn1/d2i_s_pr.c
+++ b/src/lib/libcrypto/asn1/d2i_s_pr.c
@@ -91,7 +91,7 @@ DSA *d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length)
         if ((ret->priv_key=BN_bin2bn(bs->data,bs->length,ret->priv_key))
                 == NULL) goto err_bn;
 
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
 
         M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -99,7 +99,7 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_DSAPRIVATEKEY,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
         return(NULL);
         }
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_s_pu.c b/src/lib/libcrypto/asn1/d2i_s_pu.c
index 94ea1c313b..e0adaa0393 100644
--- a/src/lib/libcrypto/asn1/d2i_s_pu.c
+++ b/src/lib/libcrypto/asn1/d2i_s_pu.c
@@ -107,7 +107,7 @@ DSA *d2i_DSAPublicKey(DSA **a, unsigned char **pp, long length)
                 ret->write_params=1;
                 }
 
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
         bs=NULL;
         M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -115,7 +115,7 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_DSAPUBLICKEY,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
         return(NULL);
         }
 #endif
diff --git a/src/lib/libcrypto/asn1/evp_asn1.c b/src/lib/libcrypto/asn1/evp_asn1.c
index 41ced49c19..3506005a71 100644
--- a/src/lib/libcrypto/asn1/evp_asn1.c
+++ b/src/lib/libcrypto/asn1/evp_asn1.c
@@ -65,8 +65,8 @@ int ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len)
         {
         ASN1_STRING *os;
 
-        if ((os=ASN1_OCTET_STRING_new()) == NULL) return(0);
-        if (!ASN1_OCTET_STRING_set(os,data,len)) return(0);
+        if ((os=M_ASN1_OCTET_STRING_new()) == NULL) return(0);
+        if (!M_ASN1_OCTET_STRING_set(os,data,len)) return(0);
         ASN1_TYPE_set(a,V_ASN1_OCTET_STRING,os);
         return(1);
         }
@@ -83,8 +83,8 @@ int ASN1_TYPE_get_octetstring(ASN1_TYPE *a, unsigned char *data,
                 ASN1err(ASN1_F_ASN1_TYPE_GET_OCTETSTRING,ASN1_R_DATA_IS_WRONG);
                 return(-1);
                 }
-        p=ASN1_STRING_data(a->value.octet_string);
-        ret=ASN1_STRING_length(a->value.octet_string);
+        p=M_ASN1_STRING_data(a->value.octet_string);
+        ret=M_ASN1_STRING_length(a->value.octet_string);
         if (ret < max_len)
                 num=ret;
         else
@@ -117,8 +117,8 @@ int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, unsigned char *data,
         /* Grow the 'string' */
         ASN1_STRING_set(osp,NULL,size);
 
-        ASN1_STRING_length(osp)=size;
-        p=ASN1_STRING_data(osp);
+        M_ASN1_STRING_length_set(osp, size);
+        p=M_ASN1_STRING_data(osp);
 
         ASN1_put_object(&p,1,n,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
           i2d_ASN1_INTEGER(&in,&p);
@@ -145,8 +145,8 @@ int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
                 {
                 goto err;
                 }
-        p=ASN1_STRING_data(a->value.sequence);
-        length=ASN1_STRING_length(a->value.sequence);
+        p=M_ASN1_STRING_data(a->value.sequence);
+        length=M_ASN1_STRING_length(a->value.sequence);
 
         c.pp= &p;
         c.p=p;
@@ -165,21 +165,21 @@ int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
         if (num != NULL)
                 *num=ASN1_INTEGER_get(ai);
 
-        ret=ASN1_STRING_length(os);
+        ret=M_ASN1_STRING_length(os);
         if (max_len > ret)
                 n=ret;
         else
                 n=max_len;
 
         if (data != NULL)
-                memcpy(data,ASN1_STRING_data(os),n);
+                memcpy(data,M_ASN1_STRING_data(os),n);
         if (0)
                 {
 err:
                 ASN1err(ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING,ASN1_R_DATA_IS_WRONG);
                 }
-        if (os != NULL) ASN1_OCTET_STRING_free(os);
-        if (ai != NULL) ASN1_INTEGER_free(ai);
+        if (os != NULL) M_ASN1_OCTET_STRING_free(os);
+        if (ai != NULL) M_ASN1_INTEGER_free(ai);
         return(ret);
         }
 
diff --git a/src/lib/libcrypto/asn1/f_enum.c b/src/lib/libcrypto/asn1/f_enum.c
index 3bcceecdb8..3d0b1107cb 100644
--- a/src/lib/libcrypto/asn1/f_enum.c
+++ b/src/lib/libcrypto/asn1/f_enum.c
@@ -161,7 +161,7 @@ int a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size)
                         if (sp == NULL)
                                 {
                                 ASN1err(ASN1_F_A2I_ASN1_ENUMERATED,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                 goto err;
                                 }
                         s=sp;
diff --git a/src/lib/libcrypto/asn1/f_int.c b/src/lib/libcrypto/asn1/f_int.c
index 55560dd814..cd57331c3f 100644
--- a/src/lib/libcrypto/asn1/f_int.c
+++ b/src/lib/libcrypto/asn1/f_int.c
@@ -168,7 +168,7 @@ int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
                         if (sp == NULL)
                                 {
                                 ASN1err(ASN1_F_A2I_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                 goto err;
                                 }
                         s=sp;
diff --git a/src/lib/libcrypto/asn1/f_string.c b/src/lib/libcrypto/asn1/f_string.c
index 5d0cf5a46d..088313689a 100644
--- a/src/lib/libcrypto/asn1/f_string.c
+++ b/src/lib/libcrypto/asn1/f_string.c
@@ -166,7 +166,7 @@ int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size)
                         if (sp == NULL)
                                 {
                                 ASN1err(ASN1_F_A2I_ASN1_STRING,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                 goto err;
                                 }
                         s=sp;
diff --git a/src/lib/libcrypto/asn1/i2d_dhp.c b/src/lib/libcrypto/asn1/i2d_dhp.c
index fdda4ec41b..61eeb646f9 100644
--- a/src/lib/libcrypto/asn1/i2d_dhp.c
+++ b/src/lib/libcrypto/asn1/i2d_dhp.c
@@ -118,7 +118,7 @@ int i2d_DHparams(DH *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         ret=t;
 err:
         if (num[2] != NULL) BN_free(num[2]);
diff --git a/src/lib/libcrypto/asn1/i2d_dsap.c b/src/lib/libcrypto/asn1/i2d_dsap.c
index f36f0da4e2..4021123ba3 100644
--- a/src/lib/libcrypto/asn1/i2d_dsap.c
+++ b/src/lib/libcrypto/asn1/i2d_dsap.c
@@ -107,7 +107,7 @@ int i2d_DSAparams(DSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         ret=t;
 err:
         *pp=p;
diff --git a/src/lib/libcrypto/asn1/i2d_r_pr.c b/src/lib/libcrypto/asn1/i2d_r_pr.c
index 27e6844a7f..1250fa4b2d 100644
--- a/src/lib/libcrypto/asn1/i2d_r_pr.c
+++ b/src/lib/libcrypto/asn1/i2d_r_pr.c
@@ -119,9 +119,15 @@ int i2d_RSAPrivateKey(RSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         *pp=p;
         return(t);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
 
diff --git a/src/lib/libcrypto/asn1/i2d_r_pu.c b/src/lib/libcrypto/asn1/i2d_r_pu.c
index 6d01bfa8b5..582b92ee4c 100644
--- a/src/lib/libcrypto/asn1/i2d_r_pu.c
+++ b/src/lib/libcrypto/asn1/i2d_r_pu.c
@@ -105,8 +105,14 @@ int i2d_RSAPublicKey(RSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         *pp=p;
         return(t);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libcrypto/asn1/i2d_s_pr.c b/src/lib/libcrypto/asn1/i2d_s_pr.c
index 5d3dcdf197..e399ceaeb9 100644
--- a/src/lib/libcrypto/asn1/i2d_s_pr.c
+++ b/src/lib/libcrypto/asn1/i2d_s_pr.c
@@ -116,7 +116,7 @@ int i2d_DSAPrivateKey(DSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         *pp=p;
         return(t);
         }
diff --git a/src/lib/libcrypto/asn1/i2d_s_pu.c b/src/lib/libcrypto/asn1/i2d_s_pu.c
index 18f790f746..ca7f251b71 100644
--- a/src/lib/libcrypto/asn1/i2d_s_pu.c
+++ b/src/lib/libcrypto/asn1/i2d_s_pu.c
@@ -121,7 +121,7 @@ int i2d_DSAPublicKey(DSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         *pp=p;
         if(all) return(t);
         else return(tot);
diff --git a/src/lib/libcrypto/asn1/n_pkey.c b/src/lib/libcrypto/asn1/n_pkey.c
index cdc0d8b7c4..d804986b73 100644
--- a/src/lib/libcrypto/asn1/n_pkey.c
+++ b/src/lib/libcrypto/asn1/n_pkey.c
@@ -139,7 +139,7 @@ int i2d_Netscape_RSA(RSA *a, unsigned char **pp, int (*cb)())
                 }
 
         if (pkey->private_key->data != NULL)
-                Free((char *)pkey->private_key->data);
+                Free(pkey->private_key->data);
         if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
                 {
                 ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);
@@ -205,10 +205,10 @@ RSA *d2i_Netscape_RSA(RSA **a, unsigned char **pp, long length, int (*cb)())
                 (char *)os->data,os->length) != 0))
                 {
                 ASN1err(ASN1_F_D2I_NETSCAPE_RSA,ASN1_R_PRIVATE_KEY_HEADER_MISSING);
-                ASN1_BIT_STRING_free(os);
+                M_ASN1_BIT_STRING_free(os);
                 goto err;
                 }
-        ASN1_BIT_STRING_free(os);
+        M_ASN1_BIT_STRING_free(os);
         c.q=c.p;
         if ((ret=d2i_Netscape_RSA_2(a,&c.p,c.slen,cb)) == NULL) goto err;
         c.slen-=(c.p-c.q);
@@ -279,7 +279,7 @@ RSA *d2i_Netscape_RSA_2(RSA **a, unsigned char **pp, long length,
         *pp=c.p;
 err:
         if (pkey != NULL) NETSCAPE_PKEY_free(pkey);
-        if (os != NULL) ASN1_BIT_STRING_free(os);
+        if (os != NULL) M_ASN1_BIT_STRING_free(os);
         if (alg != NULL) X509_ALGOR_free(alg);
         return(ret);
         }
@@ -321,9 +321,9 @@ static NETSCAPE_PKEY *NETSCAPE_PKEY_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,NETSCAPE_PKEY);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->private_key,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->private_key,M_ASN1_OCTET_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_NETSCAPE_PKEY_NEW);
         }
@@ -331,11 +331,18 @@ static NETSCAPE_PKEY *NETSCAPE_PKEY_new(void)
 static void NETSCAPE_PKEY_free(NETSCAPE_PKEY *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         X509_ALGOR_free(a->algor);
-        ASN1_OCTET_STRING_free(a->private_key);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->private_key);
+        Free(a);
         }
 
 #endif /* NO_RC4 */
+
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libcrypto/asn1/p5_pbe.c b/src/lib/libcrypto/asn1/p5_pbe.c
index b831836e7b..64e90237cc 100644
--- a/src/lib/libcrypto/asn1/p5_pbe.c
+++ b/src/lib/libcrypto/asn1/p5_pbe.c
@@ -82,8 +82,8 @@ PBEPARAM *PBEPARAM_new(void)
         PBEPARAM *ret=NULL;
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PBEPARAM);
-        M_ASN1_New(ret->iter,ASN1_INTEGER_new);
-        M_ASN1_New(ret->salt,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->iter,M_ASN1_INTEGER_new);
+        M_ASN1_New(ret->salt,M_ASN1_OCTET_STRING_new);
         return (ret);
         M_ASN1_New_Error(ASN1_F_PBEPARAM_NEW);
 }
@@ -101,9 +101,9 @@ PBEPARAM *d2i_PBEPARAM(PBEPARAM **a, unsigned char **pp, long length)
 void PBEPARAM_free (PBEPARAM *a)
 {
         if(a==NULL) return;
-        ASN1_OCTET_STRING_free(a->salt);
-        ASN1_INTEGER_free (a->iter);
-        Free ((char *)a);
+        M_ASN1_OCTET_STRING_free(a->salt);
+        M_ASN1_INTEGER_free (a->iter);
+        Free (a);
 }
 
 /* Return an algorithm identifier for a PKCS#5 PBE algorithm */
@@ -129,7 +129,8 @@ X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
         }
         pbe->salt->length = saltlen;
         if (salt) memcpy (pbe->salt->data, salt, saltlen);
-        else RAND_bytes (pbe->salt->data, saltlen);
+        else if (RAND_bytes (pbe->salt->data, saltlen) <= 0)
+                return NULL;
 
         if (!(astype = ASN1_TYPE_new())) {
                 ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libcrypto/asn1/p5_pbev2.c b/src/lib/libcrypto/asn1/p5_pbev2.c
index 09f4bf6112..4ce06a94ab 100644
--- a/src/lib/libcrypto/asn1/p5_pbev2.c
+++ b/src/lib/libcrypto/asn1/p5_pbev2.c
@@ -104,7 +104,7 @@ void PBE2PARAM_free (PBE2PARAM *a)
         if(a==NULL) return;
         X509_ALGOR_free(a->keyfunc);
         X509_ALGOR_free(a->encryption);
-        Free ((char *)a);
+        Free (a);
 }
 
 int i2d_PBKDF2PARAM(PBKDF2PARAM *a, unsigned char **pp)
@@ -131,7 +131,7 @@ PBKDF2PARAM *PBKDF2PARAM_new(void)
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PBKDF2PARAM);
         M_ASN1_New(ret->salt, ASN1_TYPE_new);
-        M_ASN1_New(ret->iter, ASN1_INTEGER_new);
+        M_ASN1_New(ret->iter, M_ASN1_INTEGER_new);
         ret->keylength = NULL;
         ret->prf = NULL;
         return (ret);
@@ -155,10 +155,10 @@ void PBKDF2PARAM_free (PBKDF2PARAM *a)
 {
         if(a==NULL) return;
         ASN1_TYPE_free(a->salt);
-        ASN1_INTEGER_free(a->iter);
-        ASN1_INTEGER_free(a->keylength);
+        M_ASN1_INTEGER_free(a->iter);
+        M_ASN1_INTEGER_free(a->keylength);
         X509_ALGOR_free(a->prf);
-        Free ((char *)a);
+        Free (a);
 }
 
 /* Return an algorithm identifier for a PKCS#5 v2.0 PBE algorithm:
@@ -175,19 +175,26 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         PBKDF2PARAM *kdf = NULL;
         PBE2PARAM *pbe2 = NULL;
         ASN1_OCTET_STRING *osalt = NULL;
+        ASN1_OBJECT *obj;
+
+        alg_nid = EVP_CIPHER_type(cipher);
+        if(alg_nid == NID_undef) {
+                ASN1err(ASN1_F_PKCS5_PBE2_SET,
+                                ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
+                goto err;
+        }
+        obj = OBJ_nid2obj(alg_nid);
 
         if(!(pbe2 = PBE2PARAM_new())) goto merr;
 
         /* Setup the AlgorithmIdentifier for the encryption scheme */
         scheme = pbe2->encryption;
 
-        alg_nid = EVP_CIPHER_type(cipher);
-
-        scheme->algorithm = OBJ_nid2obj(alg_nid);
+        scheme->algorithm = obj;
         if(!(scheme->parameter = ASN1_TYPE_new())) goto merr;
 
         /* Create random IV */
-        RAND_bytes(iv, EVP_CIPHER_iv_length(cipher));
+        RAND_pseudo_bytes(iv, EVP_CIPHER_iv_length(cipher));
 
         /* Dummy cipherinit to just setup the IV */
         EVP_CipherInit(&ctx, cipher, NULL, iv, 0);
@@ -199,13 +206,13 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         EVP_CIPHER_CTX_cleanup(&ctx);
 
         if(!(kdf = PBKDF2PARAM_new())) goto merr;
-        if(!(osalt = ASN1_OCTET_STRING_new())) goto merr;
+        if(!(osalt = M_ASN1_OCTET_STRING_new())) goto merr;
 
         if (!saltlen) saltlen = PKCS5_SALT_LEN;
         if (!(osalt->data = Malloc (saltlen))) goto merr;
         osalt->length = saltlen;
         if (salt) memcpy (osalt->data, salt, saltlen);
-        else RAND_bytes (osalt->data, saltlen);
+        else if (RAND_bytes (osalt->data, saltlen) <= 0) goto merr;
 
         if(iter <= 0) iter = PKCS5_DEFAULT_ITER;
         if(!ASN1_INTEGER_set(kdf->iter, iter)) goto merr;
@@ -218,7 +225,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         /* If its RC2 then we'd better setup the key length */
 
         if(alg_nid == NID_rc2_cbc) {
-                if(!(kdf->keylength = ASN1_INTEGER_new())) goto merr;
+                if(!(kdf->keylength = M_ASN1_INTEGER_new())) goto merr;
                 if(!ASN1_INTEGER_set (kdf->keylength,
                                  EVP_CIPHER_key_length(cipher))) goto merr;
         }
@@ -264,7 +271,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         err:
         PBE2PARAM_free(pbe2);
         /* Note 'scheme' is freed as part of pbe2 */
-        ASN1_OCTET_STRING_free(osalt);
+        M_ASN1_OCTET_STRING_free(osalt);
         PBKDF2PARAM_free(kdf);
         X509_ALGOR_free(kalg);
         X509_ALGOR_free(ret);
diff --git a/src/lib/libcrypto/asn1/p7_dgst.c b/src/lib/libcrypto/asn1/p7_dgst.c
index 62783a2b8d..cba90e94a1 100644
--- a/src/lib/libcrypto/asn1/p7_dgst.c
+++ b/src/lib/libcrypto/asn1/p7_dgst.c
@@ -101,10 +101,10 @@ PKCS7_DIGEST *PKCS7_DIGEST_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_DIGEST);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->md,X509_ALGOR_new);
         M_ASN1_New(ret->contents,PKCS7_new);
-        M_ASN1_New(ret->digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->digest,M_ASN1_OCTET_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS7_DIGEST_NEW);
         }
@@ -112,10 +112,10 @@ PKCS7_DIGEST *PKCS7_DIGEST_new(void)
 void PKCS7_DIGEST_free(PKCS7_DIGEST *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         X509_ALGOR_free(a->md);
         PKCS7_free(a->contents);
-        ASN1_OCTET_STRING_free(a->digest);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->digest);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/p7_enc.c b/src/lib/libcrypto/asn1/p7_enc.c
index 4741126587..83b0e15faa 100644
--- a/src/lib/libcrypto/asn1/p7_enc.c
+++ b/src/lib/libcrypto/asn1/p7_enc.c
@@ -95,7 +95,7 @@ PKCS7_ENCRYPT *PKCS7_ENCRYPT_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_ENCRYPT);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS7_ENCRYPT_NEW);
@@ -104,8 +104,8 @@ PKCS7_ENCRYPT *PKCS7_ENCRYPT_new(void)
 void PKCS7_ENCRYPT_free(PKCS7_ENCRYPT *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS7_ENC_CONTENT_free(a->enc_data);
-        Free((char *)a);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/p7_enc_c.c b/src/lib/libcrypto/asn1/p7_enc_c.c
index a832737a38..582cc78b06 100644
--- a/src/lib/libcrypto/asn1/p7_enc_c.c
+++ b/src/lib/libcrypto/asn1/p7_enc_c.c
@@ -101,7 +101,8 @@ PKCS7_ENC_CONTENT *PKCS7_ENC_CONTENT_new(void)
 
         M_ASN1_New_Malloc(ret,PKCS7_ENC_CONTENT);
         /* M_ASN1_New(ret->content_type,ASN1_OBJECT_new); */
-        ret->content_type=OBJ_nid2obj(NID_pkcs7_encrypted);
+        /* We will almost always want this: so make it the default */
+        ret->content_type=OBJ_nid2obj(NID_pkcs7_data);
         M_ASN1_New(ret->algorithm,X509_ALGOR_new);
         ret->enc_data=NULL;
         return(ret);
@@ -113,7 +114,7 @@ void PKCS7_ENC_CONTENT_free(PKCS7_ENC_CONTENT *a)
         if (a == NULL) return;
         ASN1_OBJECT_free(a->content_type);
         X509_ALGOR_free(a->algorithm);
-        ASN1_OCTET_STRING_free(a->enc_data);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->enc_data);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/p7_evp.c b/src/lib/libcrypto/asn1/p7_evp.c
index b2b3d50dcd..4e734fdd28 100644
--- a/src/lib/libcrypto/asn1/p7_evp.c
+++ b/src/lib/libcrypto/asn1/p7_evp.c
@@ -101,7 +101,7 @@ PKCS7_ENVELOPE *PKCS7_ENVELOPE_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_ENVELOPE);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->recipientinfo,sk_PKCS7_RECIP_INFO_new_null);
         M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
         return(ret);
@@ -111,9 +111,9 @@ PKCS7_ENVELOPE *PKCS7_ENVELOPE_new(void)
 void PKCS7_ENVELOPE_free(PKCS7_ENVELOPE *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         sk_PKCS7_RECIP_INFO_pop_free(a->recipientinfo,PKCS7_RECIP_INFO_free);
         PKCS7_ENC_CONTENT_free(a->enc_data);
-        Free((char *)a);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/p7_i_s.c b/src/lib/libcrypto/asn1/p7_i_s.c
index 7d4b457e01..d21f7ddb84 100644
--- a/src/lib/libcrypto/asn1/p7_i_s.c
+++ b/src/lib/libcrypto/asn1/p7_i_s.c
@@ -96,7 +96,7 @@ PKCS7_ISSUER_AND_SERIAL *PKCS7_ISSUER_AND_SERIAL_new(void)
 
         M_ASN1_New_Malloc(ret,PKCS7_ISSUER_AND_SERIAL);
         M_ASN1_New(ret->issuer,X509_NAME_new);
-        M_ASN1_New(ret->serial,ASN1_INTEGER_new);
+        M_ASN1_New(ret->serial,M_ASN1_INTEGER_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS7_ISSUER_AND_SERIAL_NEW);
         }
@@ -105,7 +105,7 @@ void PKCS7_ISSUER_AND_SERIAL_free(PKCS7_ISSUER_AND_SERIAL *a)
         {
         if (a == NULL) return;
         X509_NAME_free(a->issuer);
-        ASN1_INTEGER_free(a->serial);
-        Free((char *)a);
+        M_ASN1_INTEGER_free(a->serial);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/p7_lib.c b/src/lib/libcrypto/asn1/p7_lib.c
index 846be17158..86db82cfa1 100644
--- a/src/lib/libcrypto/asn1/p7_lib.c
+++ b/src/lib/libcrypto/asn1/p7_lib.c
@@ -152,7 +152,7 @@ PKCS7 *d2i_PKCS7(PKCS7 **a, unsigned char **pp, long length)
                 {
                 if ((*a)->asn1 != NULL)
                         {
-                        Free((char *)(*a)->asn1);
+                        Free((*a)->asn1);
                         (*a)->asn1=NULL;
                         }
                 (*a)->length=0;
@@ -251,7 +251,7 @@ void PKCS7_free(PKCS7 *a)
                 {
                 ASN1_OBJECT_free(a->type);
                 }
-        Free((char *)(char *)a);
+        Free(a);
         }
 
 void PKCS7_content_free(PKCS7 *a)
@@ -259,7 +259,7 @@ void PKCS7_content_free(PKCS7 *a)
         if(a == NULL)
             return;
 
-        if (a->asn1 != NULL) Free((char *)a->asn1);
+        if (a->asn1 != NULL) Free(a->asn1);
 
         if (a->d.ptr != NULL)
                 {
@@ -268,7 +268,7 @@ void PKCS7_content_free(PKCS7 *a)
                 switch (OBJ_obj2nid(a->type))
                         {
                 case NID_pkcs7_data:
-                        ASN1_OCTET_STRING_free(a->d.data);
+                        M_ASN1_OCTET_STRING_free(a->d.data);
                         break;
                 case NID_pkcs7_signed:
                         PKCS7_SIGNED_free(a->d.sign);
diff --git a/src/lib/libcrypto/asn1/p7_recip.c b/src/lib/libcrypto/asn1/p7_recip.c
index 9fda4f20d4..b1abfa3b8f 100644
--- a/src/lib/libcrypto/asn1/p7_recip.c
+++ b/src/lib/libcrypto/asn1/p7_recip.c
@@ -101,10 +101,10 @@ PKCS7_RECIP_INFO *PKCS7_RECIP_INFO_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_RECIP_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->issuer_and_serial,PKCS7_ISSUER_AND_SERIAL_new);
         M_ASN1_New(ret->key_enc_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_key,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_key,M_ASN1_OCTET_STRING_new);
         ret->cert=NULL;
         return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS7_RECIP_INFO_NEW);
@@ -113,10 +113,10 @@ PKCS7_RECIP_INFO *PKCS7_RECIP_INFO_new(void)
 void PKCS7_RECIP_INFO_free(PKCS7_RECIP_INFO *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS7_ISSUER_AND_SERIAL_free(a->issuer_and_serial);
         X509_ALGOR_free(a->key_enc_algor);
-        ASN1_OCTET_STRING_free(a->enc_key);
+        M_ASN1_OCTET_STRING_free(a->enc_key);
         if (a->cert != NULL) X509_free(a->cert);
         Free(a);
         }
diff --git a/src/lib/libcrypto/asn1/p7_s_e.c b/src/lib/libcrypto/asn1/p7_s_e.c
index 90946695c9..3d18fedf8e 100644
--- a/src/lib/libcrypto/asn1/p7_s_e.c
+++ b/src/lib/libcrypto/asn1/p7_s_e.c
@@ -119,7 +119,7 @@ PKCS7_SIGN_ENVELOPE *PKCS7_SIGN_ENVELOPE_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_SIGN_ENVELOPE);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->recipientinfo,sk_PKCS7_RECIP_INFO_new_null);
         M_ASN1_New(ret->md_algs,sk_X509_ALGOR_new_null);
         M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
@@ -133,7 +133,7 @@ PKCS7_SIGN_ENVELOPE *PKCS7_SIGN_ENVELOPE_new(void)
 void PKCS7_SIGN_ENVELOPE_free(PKCS7_SIGN_ENVELOPE *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         sk_PKCS7_RECIP_INFO_pop_free(a->recipientinfo,PKCS7_RECIP_INFO_free);
         sk_X509_ALGOR_pop_free(a->md_algs,X509_ALGOR_free);
         PKCS7_ENC_CONTENT_free(a->enc_data);
diff --git a/src/lib/libcrypto/asn1/p7_signd.c b/src/lib/libcrypto/asn1/p7_signd.c
index 74f0f522e1..f6f16a8715 100644
--- a/src/lib/libcrypto/asn1/p7_signd.c
+++ b/src/lib/libcrypto/asn1/p7_signd.c
@@ -112,7 +112,7 @@ PKCS7_SIGNED *PKCS7_SIGNED_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_SIGNED);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->md_algs,sk_X509_ALGOR_new_null);
         M_ASN1_New(ret->contents,PKCS7_new);
         ret->cert=NULL;
@@ -125,7 +125,7 @@ PKCS7_SIGNED *PKCS7_SIGNED_new(void)
 void PKCS7_SIGNED_free(PKCS7_SIGNED *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         sk_X509_ALGOR_pop_free(a->md_algs,X509_ALGOR_free);
         PKCS7_free(a->contents);
         sk_X509_pop_free(a->cert,X509_free);
diff --git a/src/lib/libcrypto/asn1/p7_signi.c b/src/lib/libcrypto/asn1/p7_signi.c
index 21132ef4dd..f74658ffe6 100644
--- a/src/lib/libcrypto/asn1/p7_signi.c
+++ b/src/lib/libcrypto/asn1/p7_signi.c
@@ -119,12 +119,12 @@ PKCS7_SIGNER_INFO *PKCS7_SIGNER_INFO_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_SIGNER_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->issuer_and_serial,PKCS7_ISSUER_AND_SERIAL_new);
         M_ASN1_New(ret->digest_alg,X509_ALGOR_new);
         ret->auth_attr=NULL;
         M_ASN1_New(ret->digest_enc_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_digest,M_ASN1_OCTET_STRING_new);
         ret->unauth_attr=NULL;
         ret->pkey=NULL;
         return(ret);
@@ -134,16 +134,16 @@ PKCS7_SIGNER_INFO *PKCS7_SIGNER_INFO_new(void)
 void PKCS7_SIGNER_INFO_free(PKCS7_SIGNER_INFO *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS7_ISSUER_AND_SERIAL_free(a->issuer_and_serial);
         X509_ALGOR_free(a->digest_alg);
         sk_X509_ATTRIBUTE_pop_free(a->auth_attr,X509_ATTRIBUTE_free);
         X509_ALGOR_free(a->digest_enc_alg);
-        ASN1_OCTET_STRING_free(a->enc_digest);
+        M_ASN1_OCTET_STRING_free(a->enc_digest);
         sk_X509_ATTRIBUTE_pop_free(a->unauth_attr,X509_ATTRIBUTE_free);
         if (a->pkey != NULL)
                 EVP_PKEY_free(a->pkey);
-        Free((char *)a);
+        Free(a);
         }
 
 IMPLEMENT_STACK_OF(PKCS7_SIGNER_INFO)
diff --git a/src/lib/libcrypto/asn1/p8_key.c b/src/lib/libcrypto/asn1/p8_key.c
new file mode 100644
index 0000000000..0b24374627
--- /dev/null
+++ b/src/lib/libcrypto/asn1/p8_key.c
@@ -0,0 +1,131 @@
+/* crypto/asn1/p8_key.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1_mac.h>
+#include <openssl/objects.h>
+
+int i2d_X509_KEY(X509 *a, unsigned char **pp)
+        {
+        M_ASN1_I2D_vars(a);
+
+        M_ASN1_I2D_len(a->cert_info,    i2d_X509_CINF);
+        M_ASN1_I2D_len(a->sig_alg,      i2d_X509_ALGOR);
+        M_ASN1_I2D_len(a->signature,    i2d_ASN1_BIT_STRING);
+
+        M_ASN1_I2D_seq_total();
+
+        M_ASN1_I2D_put(a->cert_info,    i2d_X509_CINF);
+        M_ASN1_I2D_put(a->sig_alg,      i2d_X509_ALGOR);
+        M_ASN1_I2D_put(a->signature,    i2d_ASN1_BIT_STRING);
+
+        M_ASN1_I2D_finish();
+        }
+
+X509 *d2i_X509_KEY(X509 **a, unsigned char **pp, long length)
+        {
+        M_ASN1_D2I_vars(a,X509 *,X509_new);
+
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+        M_ASN1_D2I_get(ret->cert_info,d2i_X509_CINF);
+        M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
+        M_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);
+        M_ASN1_D2I_Finish(a,X509_free,ASN1_F_D2I_X509);
+        }
+
+X509 *X509_KEY_new(void)
+        {
+        X509_KEY *ret=NULL;
+
+        M_ASN1_New_Malloc(ret,X509_KEY);
+        ret->references=1;
+        ret->type=NID
+        M_ASN1_New(ret->cert_info,X509_CINF_new);
+        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
+        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        return(ret);
+        M_ASN1_New_Error(ASN1_F_X509_NEW);
+        }
+
+void X509_KEY_free(X509 *a)
+        {
+        int i;
+
+        if (a == NULL) return;
+
+        i=CRYPTO_add_lock(&a->references,-1,CRYPTO_LOCK_X509_KEY);
+#ifdef REF_PRINT
+        REF_PRINT("X509_KEY",a);
+#endif
+        if (i > 0) return;
+#ifdef REF_CHECK
+        if (i < 0)
+                {
+                fprintf(stderr,"X509_KEY_free, bad reference count\n");
+                abort();
+                }
+#endif
+
+        X509_CINF_free(a->cert_info);
+        X509_ALGOR_free(a->sig_alg);
+        ASN1_BIT_STRING_free(a->signature);
+        Free(a);
+        }
+
diff --git a/src/lib/libcrypto/asn1/p8_pkey.c b/src/lib/libcrypto/asn1/p8_pkey.c
index aa9a4f6c96..59cfbe7f28 100644
--- a/src/lib/libcrypto/asn1/p8_pkey.c
+++ b/src/lib/libcrypto/asn1/p8_pkey.c
@@ -88,7 +88,7 @@ PKCS8_PRIV_KEY_INFO *PKCS8_PRIV_KEY_INFO_new(void)
         PKCS8_PRIV_KEY_INFO *ret=NULL;
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PKCS8_PRIV_KEY_INFO);
-        M_ASN1_New (ret->version, ASN1_INTEGER_new);
+        M_ASN1_New (ret->version, M_ASN1_INTEGER_new);
         M_ASN1_New (ret->pkeyalg, X509_ALGOR_new);
         M_ASN1_New (ret->pkey, ASN1_TYPE_new);
         ret->attributes = NULL;
@@ -109,15 +109,13 @@ PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO **a,
         M_ASN1_D2I_get_IMP_set_opt_type(X509_ATTRIBUTE, ret->attributes,
                                         d2i_X509_ATTRIBUTE,
                                         X509_ATTRIBUTE_free, 0);
-        if (ASN1_TYPE_get(ret->pkey) == V_ASN1_SEQUENCE) 
-                                                ret->broken = PKCS8_NO_OCTET;
         M_ASN1_D2I_Finish(a, PKCS8_PRIV_KEY_INFO_free, ASN1_F_D2I_PKCS8_PRIV_KEY_INFO);
 }
 
 void PKCS8_PRIV_KEY_INFO_free (PKCS8_PRIV_KEY_INFO *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free (a->version);
+        M_ASN1_INTEGER_free (a->version);
         X509_ALGOR_free(a->pkeyalg);
         /* Clear sensitive data */
         if (a->pkey->value.octet_string)
diff --git a/src/lib/libcrypto/asn1/pkcs8.c b/src/lib/libcrypto/asn1/pkcs8.c
index 29c4ea6a29..e69de29bb2 100644
--- a/src/lib/libcrypto/asn1/pkcs8.c
+++ b/src/lib/libcrypto/asn1/pkcs8.c
@@ -1,131 +0,0 @@
-/* crypto/asn1/pkcs8.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include <openssl/asn1_mac.h>
-#include <openssl/objects.h>
-
-int i2d_X509_KEY(X509 *a, unsigned char **pp)
-        {
-        M_ASN1_I2D_vars(a);
-
-        M_ASN1_I2D_len(a->cert_info,    i2d_X509_CINF);
-        M_ASN1_I2D_len(a->sig_alg,      i2d_X509_ALGOR);
-        M_ASN1_I2D_len(a->signature,    i2d_ASN1_BIT_STRING);
-
-        M_ASN1_I2D_seq_total();
-
-        M_ASN1_I2D_put(a->cert_info,    i2d_X509_CINF);
-        M_ASN1_I2D_put(a->sig_alg,      i2d_X509_ALGOR);
-        M_ASN1_I2D_put(a->signature,    i2d_ASN1_BIT_STRING);
-
-        M_ASN1_I2D_finish();
-        }
-
-X509 *d2i_X509_KEY(X509 **a, unsigned char **pp, long length)
-        {
-        M_ASN1_D2I_vars(a,X509 *,X509_new);
-
-        M_ASN1_D2I_Init();
-        M_ASN1_D2I_start_sequence();
-        M_ASN1_D2I_get(ret->cert_info,d2i_X509_CINF);
-        M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
-        M_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);
-        M_ASN1_D2I_Finish(a,X509_free,ASN1_F_D2I_X509);
-        }
-
-X509 *X509_KEY_new(void)
-        {
-        X509_KEY *ret=NULL;
-
-        M_ASN1_New_Malloc(ret,X509_KEY);
-        ret->references=1;
-        ret->type=NID
-        M_ASN1_New(ret->cert_info,X509_CINF_new);
-        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
-        return(ret);
-        M_ASN1_New_Error(ASN1_F_X509_NEW);
-        }
-
-void X509_KEY_free(X509 *a)
-        {
-        int i;
-
-        if (a == NULL) return;
-
-        i=CRYPTO_add_lock(&a->references,-1,CRYPTO_LOCK_X509_KEY);
-#ifdef REF_PRINT
-        REF_PRINT("X509_KEY",a);
-#endif
-        if (i > 0) return;
-#ifdef REF_CHECK
-        if (i < 0)
-                {
-                fprintf(stderr,"X509_KEY_free, bad reference count\n");
-                abort();
-                }
-#endif
-
-        X509_CINF_free(a->cert_info);
-        X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
-        }
-
diff --git a/src/lib/libcrypto/asn1/t_bitst.c b/src/lib/libcrypto/asn1/t_bitst.c
new file mode 100644
index 0000000000..8ee789f082
--- /dev/null
+++ b/src/lib/libcrypto/asn1/t_bitst.c
@@ -0,0 +1,99 @@
+/* t_bitst.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/conf.h>
+#include <openssl/x509v3.h>
+
+int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
+                                BIT_STRING_BITNAME *tbl, int indent)
+{
+        BIT_STRING_BITNAME *bnam;
+        char first = 1;
+        BIO_printf(out, "%*s", indent, "");
+        for(bnam = tbl; bnam->lname; bnam++) {
+                if(ASN1_BIT_STRING_get_bit(bs, bnam->bitnum)) {
+                        if(!first) BIO_puts(out, ", ");
+                        BIO_puts(out, bnam->lname);
+                        first = 0;
+                }
+        }
+        BIO_puts(out, "\n");
+        return 1;
+}
+
+int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
+                                BIT_STRING_BITNAME *tbl)
+{
+        int bitnum;
+        bitnum = ASN1_BIT_STRING_num_asc(name, tbl);
+        if(bitnum < 0) return 0;
+        if(bs) ASN1_BIT_STRING_set_bit(bs, bitnum, value);
+        return 1;
+}
+
+int ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl)
+{
+        BIT_STRING_BITNAME *bnam;
+        for(bnam = tbl; bnam->lname; bnam++) {
+                if(!strcmp(bnam->sname, name) ||
+                        !strcmp(bnam->lname, name) ) return bnam->bitnum;
+        }
+        return -1;
+}
diff --git a/src/lib/libcrypto/asn1/t_crl.c b/src/lib/libcrypto/asn1/t_crl.c
index c2e447ce6f..d78e4a8f88 100644
--- a/src/lib/libcrypto/asn1/t_crl.c
+++ b/src/lib/libcrypto/asn1/t_crl.c
@@ -160,7 +160,7 @@ static void ext_print(BIO *out, X509_EXTENSION *ex)
         BIO_printf(out, ": %s\n", j ? "critical":"","");
         if(!X509V3_EXT_print(out, ex, 0, 16)) {
                 BIO_printf(out, "%16s", "");
-                ASN1_OCTET_STRING_print(out,ex->value);
+                M_ASN1_OCTET_STRING_print(out,ex->value);
         }
         BIO_write(out,"\n",1);
 }
diff --git a/src/lib/libcrypto/asn1/t_pkey.c b/src/lib/libcrypto/asn1/t_pkey.c
index 0dc6e30c3d..e570ed1c47 100644
--- a/src/lib/libcrypto/asn1/t_pkey.c
+++ b/src/lib/libcrypto/asn1/t_pkey.c
@@ -133,7 +133,7 @@ int RSA_print(BIO *bp, RSA *x, int off)
         if (!print(bp,"coefficient:",x->iqmp,m,off)) goto err;
         ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         return(ret);
         }
 #endif /* NO_RSA */
@@ -204,7 +204,7 @@ int DSA_print(BIO *bp, DSA *x, int off)
         if ((x->g != NULL) && !print(bp,"G:   ",x->g,m,off)) goto err;
         ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         return(ret);
         }
 #endif /* !NO_DSA */
@@ -298,7 +298,7 @@ int DHparams_print(BIO *bp, DH *x)
         if (!print(bp,"generator:",x->g,m,4)) goto err;
         if (x->length != 0)
                 {
-                if (BIO_printf(bp,"    recomented-private-length: %d bits\n",
+                if (BIO_printf(bp,"    recommended-private-length: %d bits\n",
                         (int)x->length) <= 0) goto err;
                 }
         ret=1;
@@ -307,7 +307,7 @@ int DHparams_print(BIO *bp, DH *x)
 err:
                 DHerr(DH_F_DHPARAMS_PRINT,reason);
                 }
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         return(ret);
         }
 #endif
@@ -352,7 +352,7 @@ int DSAparams_print(BIO *bp, DSA *x)
         if (!print(bp,"g:",x->g,m,4)) goto err;
         ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         DSAerr(DSA_F_DSAPARAMS_PRINT,reason);
         return(ret);
         }
diff --git a/src/lib/libcrypto/asn1/t_req.c b/src/lib/libcrypto/asn1/t_req.c
index bdd749436a..81dd6355a8 100644
--- a/src/lib/libcrypto/asn1/t_req.c
+++ b/src/lib/libcrypto/asn1/t_req.c
@@ -62,6 +62,7 @@
 #include <openssl/bn.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 #ifndef NO_FP_API
 int X509_REQ_print_fp(FILE *fp, X509_REQ *x)
@@ -90,6 +91,7 @@ int X509_REQ_print(BIO *bp, X509_REQ *x)
         X509_REQ_INFO *ri;
         EVP_PKEY *pkey;
         STACK_OF(X509_ATTRIBUTE) *sk;
+        STACK_OF(X509_EXTENSION) *exts;
         char str[128];
 
         ri=x->req_info;
@@ -161,6 +163,8 @@ int X509_REQ_print(BIO *bp, X509_REQ *x)
                         int j,type=0,count=1,ii=0;
 
                         a=sk_X509_ATTRIBUTE_value(sk,i);
+                        if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
+                                                                continue;
                         sprintf(str,"%12s","");
                         if (BIO_puts(bp,str) <= 0) goto err;
                         if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
@@ -201,6 +205,29 @@ get_next:
                         }
                 }
 
+        exts = X509_REQ_get_extensions(x);
+        if(exts) {
+                BIO_printf(bp,"%8sRequested Extensions:\n","");
+                for (i=0; i<sk_X509_EXTENSION_num(exts); i++) {
+                        ASN1_OBJECT *obj;
+                        X509_EXTENSION *ex;
+                        int j;
+                        ex=sk_X509_EXTENSION_value(exts, i);
+                        if (BIO_printf(bp,"%12s","") <= 0) goto err;
+                        obj=X509_EXTENSION_get_object(ex);
+                        i2a_ASN1_OBJECT(bp,obj);
+                        j=X509_EXTENSION_get_critical(ex);
+                        if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
+                                goto err;
+                        if(!X509V3_EXT_print(bp, ex, 0, 16)) {
+                                BIO_printf(bp, "%16s", "");
+                                M_ASN1_OCTET_STRING_print(bp,ex->value);
+                        }
+                        if (BIO_write(bp,"\n",1) <= 0) goto err;
+                }
+                sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+        }
+
         i=OBJ_obj2nid(x->sig_alg->algorithm);
         sprintf(str,"%4sSignature Algorithm: %s","",
                 (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
diff --git a/src/lib/libcrypto/asn1/t_spki.c b/src/lib/libcrypto/asn1/t_spki.c
new file mode 100644
index 0000000000..d708434fca
--- /dev/null
+++ b/src/lib/libcrypto/asn1/t_spki.c
@@ -0,0 +1,116 @@
+/* t_spki.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/asn1_mac.h>
+
+/* Print out an SPKI */
+
+int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
+{
+        EVP_PKEY *pkey;
+        ASN1_IA5STRING *chal;
+        int i, n;
+        char *s;
+        BIO_printf(out, "Netscape SPKI:\n");
+        i=OBJ_obj2nid(spki->spkac->pubkey->algor->algorithm);
+        BIO_printf(out,"  Public Key Algorithm: %s\n",
+                                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
+        pkey = X509_PUBKEY_get(spki->spkac->pubkey);
+        if(!pkey) BIO_printf(out, "  Unable to load public key\n");
+        else {
+#ifndef NO_RSA
+                if (pkey->type == EVP_PKEY_RSA)
+                        {
+                        BIO_printf(out,"  RSA Public Key: (%d bit)\n",
+                                BN_num_bits(pkey->pkey.rsa->n));
+                        RSA_print(out,pkey->pkey.rsa,2);
+                        }
+                else 
+#endif
+#ifndef NO_DSA
+                if (pkey->type == EVP_PKEY_DSA)
+                {
+                BIO_printf(out,"  DSA Public Key:\n");
+                DSA_print(out,pkey->pkey.dsa,2);
+                }
+                else
+#endif
+                        BIO_printf(out,"  Unknown Public Key:\n");
+                EVP_PKEY_free(pkey);
+        }
+        chal = spki->spkac->challenge;
+        if(chal->length)
+                BIO_printf(out, "  Challenge String: %s\n", chal->data);
+        i=OBJ_obj2nid(spki->sig_algor->algorithm);
+        BIO_printf(out,"  Signature Algorithm: %s",
+                                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
+
+        n=spki->signature->length;
+        s=(char *)spki->signature->data;
+        for (i=0; i<n; i++)
+                {
+                if ((i%18) == 0) BIO_write(out,"\n      ",7);
+                BIO_printf(out,"%02x%s",(unsigned char)s[i],
+                                                ((i+1) == n)?"":":");
+                }
+        BIO_write(out,"\n",1);
+        return 1;
+}
diff --git a/src/lib/libcrypto/asn1/t_x509.c b/src/lib/libcrypto/asn1/t_x509.c
index 42f4d498cf..6ee1065ce9 100644
--- a/src/lib/libcrypto/asn1/t_x509.c
+++ b/src/lib/libcrypto/asn1/t_x509.c
@@ -188,11 +188,7 @@ int X509_print(BIO *bp, X509 *x)
                 BIO_printf(bp,"%8sX509v3 extensions:\n","");
                 for (i=0; i<n; i++)
                         {
-#if 0
-                        int data_type,pack_type;
-#endif
                         ASN1_OBJECT *obj;
-
                         ex=X509_get_ext(x,i);
                         if (BIO_printf(bp,"%12s","") <= 0) goto err;
                         obj=X509_EXTENSION_get_object(ex);
@@ -203,7 +199,7 @@ int X509_print(BIO *bp, X509 *x)
                         if(!X509V3_EXT_print(bp, ex, 0, 16))
                                 {
                                 BIO_printf(bp, "%16s", "");
-                                ASN1_OCTET_STRING_print(bp,ex->value);
+                                M_ASN1_OCTET_STRING_print(bp,ex->value);
                                 }
                         if (BIO_write(bp,"\n",1) <= 0) goto err;
                         }
@@ -223,10 +219,11 @@ int X509_print(BIO *bp, X509 *x)
                         ((i+1) == n)?"":":") <= 0) goto err;
                 }
         if (BIO_write(bp,"\n",1) != 1) goto err;
+        if (!X509_CERT_AUX_print(bp, x->aux, 0)) goto err;
         ret=1;
 err:
         if (str != NULL) ASN1_STRING_free(str);
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         return(ret);
         }
 
diff --git a/src/lib/libcrypto/asn1/t_x509a.c b/src/lib/libcrypto/asn1/t_x509a.c
new file mode 100644
index 0000000000..a18ebb586c
--- /dev/null
+++ b/src/lib/libcrypto/asn1/t_x509a.c
@@ -0,0 +1,102 @@
+/* t_x509a.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/asn1_mac.h>
+#include <openssl/x509.h>
+
+/* X509_CERT_AUX and string set routines
+ */
+
+int X509_CERT_AUX_print(BIO *out, X509_CERT_AUX *aux, int indent)
+{
+        char oidstr[80], first;
+        int i;
+        if(!aux) return 1;
+        if(aux->trust) {
+                first = 1;
+                BIO_printf(out, "%*sTrusted Uses:\n%*s",
+                                                indent, "", indent + 2, "");
+                for(i = 0; i < sk_ASN1_OBJECT_num(aux->trust); i++) {
+                        if(!first) BIO_puts(out, ", ");
+                        else first = 0;
+                        OBJ_obj2txt(oidstr, 80,
+                                sk_ASN1_OBJECT_value(aux->trust, i), 0);
+                        BIO_puts(out, oidstr);
+                }
+                BIO_puts(out, "\n");
+        } else BIO_printf(out, "%*sNo Trusted Uses.\n", indent, "");
+        if(aux->reject) {
+                first = 1;
+                BIO_printf(out, "%*sRejected Uses:\n%*s",
+                                                indent, "", indent + 2, "");
+                for(i = 0; i < sk_ASN1_OBJECT_num(aux->reject); i++) {
+                        if(!first) BIO_puts(out, ", ");
+                        else first = 0;
+                        OBJ_obj2txt(oidstr, 80,
+                                sk_ASN1_OBJECT_value(aux->reject, i), 0);
+                        BIO_puts(out, oidstr);
+                }
+                BIO_puts(out, "\n");
+        } else BIO_printf(out, "%*sNo Rejected Uses.\n", indent, "");
+        if(aux->alias) BIO_printf(out, "%*sAlias: %s\n", indent, "",
+                                                        aux->alias->data);
+        return 1;
+}
diff --git a/src/lib/libcrypto/asn1/x_algor.c b/src/lib/libcrypto/asn1/x_algor.c
index b2c20d139f..fe023842f8 100644
--- a/src/lib/libcrypto/asn1/x_algor.c
+++ b/src/lib/libcrypto/asn1/x_algor.c
@@ -111,7 +111,7 @@ void X509_ALGOR_free(X509_ALGOR *a)
         if (a == NULL) return;
         ASN1_OBJECT_free(a->algorithm);
         ASN1_TYPE_free(a->parameter);
-        Free((char *)a);
+        Free(a);
         }
 
 IMPLEMENT_STACK_OF(X509_ALGOR)
diff --git a/src/lib/libcrypto/asn1/x_attrib.c b/src/lib/libcrypto/asn1/x_attrib.c
index a1cbebf5a5..a874df79db 100644
--- a/src/lib/libcrypto/asn1/x_attrib.c
+++ b/src/lib/libcrypto/asn1/x_attrib.c
@@ -160,6 +160,6 @@ void X509_ATTRIBUTE_free(X509_ATTRIBUTE *a)
                 sk_ASN1_TYPE_pop_free(a->value.set,ASN1_TYPE_free);
         else
                 ASN1_TYPE_free(a->value.single);
-        Free((char *)a);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/x_cinf.c b/src/lib/libcrypto/asn1/x_cinf.c
index fe1b18a90f..b87c8fff17 100644
--- a/src/lib/libcrypto/asn1/x_cinf.c
+++ b/src/lib/libcrypto/asn1/x_cinf.c
@@ -115,7 +115,7 @@ X509_CINF *d2i_X509_CINF(X509_CINF **a, unsigned char **pp, long length)
                 {
                 if (ret->version != NULL)
                         {
-                        ASN1_INTEGER_free(ret->version);
+                        M_ASN1_INTEGER_free(ret->version);
                         ret->version=NULL;
                         }
                 }
@@ -129,12 +129,12 @@ X509_CINF *d2i_X509_CINF(X509_CINF **a, unsigned char **pp, long length)
                 {
                 if (ret->issuerUID != NULL)
                         {
-                        ASN1_BIT_STRING_free(ret->issuerUID);
+                        M_ASN1_BIT_STRING_free(ret->issuerUID);
                         ret->issuerUID=NULL;
                         }
                 if (ret->subjectUID != NULL)
                         {
-                        ASN1_BIT_STRING_free(ret->subjectUID);
+                        M_ASN1_BIT_STRING_free(ret->subjectUID);
                         ret->subjectUID=NULL;
                         }
                 M_ASN1_D2I_get_IMP_opt(ret->issuerUID,d2i_ASN1_BIT_STRING,  1,
@@ -170,7 +170,7 @@ X509_CINF *X509_CINF_new(void)
 
         M_ASN1_New_Malloc(ret,X509_CINF);
         ret->version=NULL;
-        M_ASN1_New(ret->serialNumber,ASN1_INTEGER_new);
+        M_ASN1_New(ret->serialNumber,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->signature,X509_ALGOR_new);
         M_ASN1_New(ret->issuer,X509_NAME_new);
         M_ASN1_New(ret->validity,X509_VAL_new);
@@ -186,15 +186,15 @@ X509_CINF *X509_CINF_new(void)
 void X509_CINF_free(X509_CINF *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
-        ASN1_INTEGER_free(a->serialNumber);
+        M_ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->serialNumber);
         X509_ALGOR_free(a->signature);
         X509_NAME_free(a->issuer);
         X509_VAL_free(a->validity);
         X509_NAME_free(a->subject);
         X509_PUBKEY_free(a->key);
-        ASN1_BIT_STRING_free(a->issuerUID);
-        ASN1_BIT_STRING_free(a->subjectUID);
+        M_ASN1_BIT_STRING_free(a->issuerUID);
+        M_ASN1_BIT_STRING_free(a->subjectUID);
         sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
         Free(a);
         }
diff --git a/src/lib/libcrypto/asn1/x_crl.c b/src/lib/libcrypto/asn1/x_crl.c
index cd46bbebc2..12a42d04c7 100644
--- a/src/lib/libcrypto/asn1/x_crl.c
+++ b/src/lib/libcrypto/asn1/x_crl.c
@@ -130,9 +130,9 @@ int i2d_X509_CRL_INFO(X509_CRL_INFO *a, unsigned char **pp)
                 }
         M_ASN1_I2D_put(a->sig_alg,i2d_X509_ALGOR);
         M_ASN1_I2D_put(a->issuer,i2d_X509_NAME);
-        M_ASN1_I2D_put(a->lastUpdate,i2d_ASN1_UTCTIME);
+        M_ASN1_I2D_put(a->lastUpdate,i2d_ASN1_TIME);
         if (a->nextUpdate != NULL)
-                { M_ASN1_I2D_put(a->nextUpdate,i2d_ASN1_UTCTIME); }
+                { M_ASN1_I2D_put(a->nextUpdate,i2d_ASN1_TIME); }
         M_ASN1_I2D_put_SEQUENCE_opt_type(X509_REVOKED,a->revoked,
                                          i2d_X509_REVOKED);
         M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION,a->extensions,
@@ -157,20 +157,16 @@ X509_CRL_INFO *d2i_X509_CRL_INFO(X509_CRL_INFO **a, unsigned char **pp,
         
         if ((ver == 0) && (ret->version != NULL))
                 {
-                ASN1_INTEGER_free(ret->version);
+                M_ASN1_INTEGER_free(ret->version);
                 ret->version=NULL;
                 }
         M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
         M_ASN1_D2I_get(ret->issuer,d2i_X509_NAME);
         M_ASN1_D2I_get(ret->lastUpdate,d2i_ASN1_TIME);
         /* Manually handle the OPTIONAL ASN1_TIME stuff */
-        if(c.slen != 0
-           && ( (M_ASN1_next & ~V_ASN1_CONSTRUCTED) ==
-                    (V_ASN1_UNIVERSAL|V_ASN1_UTCTIME)
-                || (M_ASN1_next & ~V_ASN1_CONSTRUCTED) ==
-                    (V_ASN1_UNIVERSAL|V_ASN1_GENERALIZEDTIME) ) ) {
-                M_ASN1_D2I_get(ret->nextUpdate,d2i_ASN1_TIME);
-        }
+        /* First try UTCTime */
+        M_ASN1_D2I_get_opt(ret->nextUpdate,d2i_ASN1_UTCTIME, V_ASN1_UTCTIME);
+        /* If that doesn't work try GeneralizedTime */
         if(!ret->nextUpdate) 
                 M_ASN1_D2I_get_opt(ret->nextUpdate,d2i_ASN1_GENERALIZEDTIME,
                                                         V_ASN1_GENERALIZEDTIME);
@@ -190,20 +186,17 @@ X509_CRL_INFO *d2i_X509_CRL_INFO(X509_CRL_INFO **a, unsigned char **pp,
                         }
                 }
 
-        if (ver >= 1)
+        if (ret->extensions != NULL)
                 {
-                if (ret->extensions != NULL)
-                        {
-                        while (sk_X509_EXTENSION_num(ret->extensions))
-                                X509_EXTENSION_free(
-                                sk_X509_EXTENSION_pop(ret->extensions));
-                        }
-                        
-                M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION,ret->extensions,
-                                                d2i_X509_EXTENSION,
-                                                X509_EXTENSION_free,0,
-                                                V_ASN1_SEQUENCE);
+                while (sk_X509_EXTENSION_num(ret->extensions))
+                        X509_EXTENSION_free(
+                        sk_X509_EXTENSION_pop(ret->extensions));
                 }
+                
+        M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION,ret->extensions,
+                                        d2i_X509_EXTENSION,
+                                        X509_EXTENSION_free,0,
+                                        V_ASN1_SEQUENCE);
 
         M_ASN1_D2I_Finish(a,X509_CRL_INFO_free,ASN1_F_D2I_X509_CRL_INFO);
         }
@@ -245,8 +238,8 @@ X509_REVOKED *X509_REVOKED_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,X509_REVOKED);
-        M_ASN1_New(ret->serialNumber,ASN1_INTEGER_new);
-        M_ASN1_New(ret->revocationDate,ASN1_UTCTIME_new);
+        M_ASN1_New(ret->serialNumber,M_ASN1_INTEGER_new);
+        M_ASN1_New(ret->revocationDate,M_ASN1_UTCTIME_new);
         ret->extensions=NULL;
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_REVOKED_NEW);
@@ -261,7 +254,7 @@ X509_CRL_INFO *X509_CRL_INFO_new(void)
         ret->version=NULL;
         M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
         M_ASN1_New(ret->issuer,X509_NAME_new);
-        M_ASN1_New(ret->lastUpdate,ASN1_UTCTIME_new);
+        M_ASN1_New(ret->lastUpdate,M_ASN1_UTCTIME_new);
         ret->nextUpdate=NULL;
         M_ASN1_New(ret->revoked,sk_X509_REVOKED_new_null);
         M_ASN1_New(ret->extensions,sk_X509_EXTENSION_new_null);
@@ -279,7 +272,7 @@ X509_CRL *X509_CRL_new(void)
         ret->references=1;
         M_ASN1_New(ret->crl,X509_CRL_INFO_new);
         M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_CRL_NEW);
         }
@@ -287,8 +280,8 @@ X509_CRL *X509_CRL_new(void)
 void X509_REVOKED_free(X509_REVOKED *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->serialNumber);
-        ASN1_UTCTIME_free(a->revocationDate);
+        M_ASN1_INTEGER_free(a->serialNumber);
+        M_ASN1_UTCTIME_free(a->revocationDate);
         sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
         Free(a);
         }
@@ -296,12 +289,12 @@ void X509_REVOKED_free(X509_REVOKED *a)
 void X509_CRL_INFO_free(X509_CRL_INFO *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         X509_ALGOR_free(a->sig_alg);
         X509_NAME_free(a->issuer);
-        ASN1_UTCTIME_free(a->lastUpdate);
+        M_ASN1_UTCTIME_free(a->lastUpdate);
         if (a->nextUpdate)
-                ASN1_UTCTIME_free(a->nextUpdate);
+                M_ASN1_UTCTIME_free(a->nextUpdate);
         sk_X509_REVOKED_pop_free(a->revoked,X509_REVOKED_free);
         sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
         Free(a);
@@ -328,7 +321,7 @@ void X509_CRL_free(X509_CRL *a)
 
         X509_CRL_INFO_free(a->crl);
         X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
+        M_ASN1_BIT_STRING_free(a->signature);
         Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/x_exten.c b/src/lib/libcrypto/asn1/x_exten.c
index d5f9e1df9e..185cbd78a0 100644
--- a/src/lib/libcrypto/asn1/x_exten.c
+++ b/src/lib/libcrypto/asn1/x_exten.c
@@ -100,10 +100,6 @@ X509_EXTENSION *d2i_X509_EXTENSION(X509_EXTENSION **a, unsigned char **pp,
         M_ASN1_D2I_start_sequence();
         M_ASN1_D2I_get(ret->object,d2i_ASN1_OBJECT);
 
-        if ((ret->argp != NULL) && (ret->ex_free != NULL))
-                ret->ex_free(ret);
-        ret->argl=0;
-        ret->argp=NULL;
         ret->netscape_hack=0;
         if ((c.slen != 0) &&
                 (M_ASN1_next == (V_ASN1_UNIVERSAL|V_ASN1_BOOLEAN)))
@@ -126,12 +122,9 @@ X509_EXTENSION *X509_EXTENSION_new(void)
 
         M_ASN1_New_Malloc(ret,X509_EXTENSION);
         ret->object=OBJ_nid2obj(NID_undef);
-        M_ASN1_New(ret->value,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->value,M_ASN1_OCTET_STRING_new);
         ret->critical=0;
         ret->netscape_hack=0;
-        ret->argl=0L;
-        ret->argp=NULL;
-        ret->ex_free=NULL;
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_EXTENSION_NEW);
         }
@@ -139,10 +132,8 @@ X509_EXTENSION *X509_EXTENSION_new(void)
 void X509_EXTENSION_free(X509_EXTENSION *a)
         {
         if (a == NULL) return;
-        if ((a->argp != NULL) && (a->ex_free != NULL))
-                a->ex_free(a);
         ASN1_OBJECT_free(a->object);
-        ASN1_OCTET_STRING_free(a->value);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->value);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/x_info.c b/src/lib/libcrypto/asn1/x_info.c
index 99ce011f07..7fdc6f9dc8 100644
--- a/src/lib/libcrypto/asn1/x_info.c
+++ b/src/lib/libcrypto/asn1/x_info.c
@@ -106,7 +106,8 @@ void X509_INFO_free(X509_INFO *x)
         if (x->x509 != NULL) X509_free(x->x509);
         if (x->crl != NULL) X509_CRL_free(x->crl);
         if (x->x_pkey != NULL) X509_PKEY_free(x->x_pkey);
-        Free((char *)x);
+        if (x->enc_data != NULL) Free(x->enc_data);
+        Free(x);
         }
 
 IMPLEMENT_STACK_OF(X509_INFO)
diff --git a/src/lib/libcrypto/asn1/x_name.c b/src/lib/libcrypto/asn1/x_name.c
index b09fba33fb..64baf5719d 100644
--- a/src/lib/libcrypto/asn1/x_name.c
+++ b/src/lib/libcrypto/asn1/x_name.c
@@ -253,7 +253,7 @@ void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
         {
         if (a == NULL) return;
         ASN1_OBJECT_free(a->object);
-        ASN1_BIT_STRING_free(a->value);
+        M_ASN1_BIT_STRING_free(a->value);
         Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/x_pkey.c b/src/lib/libcrypto/asn1/x_pkey.c
index b0057eb212..fe58919dbb 100644
--- a/src/lib/libcrypto/asn1/x_pkey.c
+++ b/src/lib/libcrypto/asn1/x_pkey.c
@@ -112,7 +112,7 @@ X509_PKEY *X509_PKEY_new(void)
         M_ASN1_New_Malloc(ret,X509_PKEY);
         ret->version=0;
         M_ASN1_New(ret->enc_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_pkey,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_pkey,M_ASN1_OCTET_STRING_new);
         ret->dec_pkey=NULL;
         ret->key_length=0;
         ret->key_data=NULL;
@@ -144,8 +144,8 @@ void X509_PKEY_free(X509_PKEY *x)
 #endif
 
         if (x->enc_algor != NULL) X509_ALGOR_free(x->enc_algor);
-        if (x->enc_pkey != NULL) ASN1_OCTET_STRING_free(x->enc_pkey);
+        if (x->enc_pkey != NULL) M_ASN1_OCTET_STRING_free(x->enc_pkey);
         if (x->dec_pkey != NULL)EVP_PKEY_free(x->dec_pkey);
-        if ((x->key_data != NULL) && (x->key_free)) Free((char *)x->key_data);
-        Free((char *)(char *)x);
+        if ((x->key_data != NULL) && (x->key_free)) Free(x->key_data);
+        Free(x);
         }
diff --git a/src/lib/libcrypto/asn1/x_pubkey.c b/src/lib/libcrypto/asn1/x_pubkey.c
index 4ac32c59dd..81e9815222 100644
--- a/src/lib/libcrypto/asn1/x_pubkey.c
+++ b/src/lib/libcrypto/asn1/x_pubkey.c
@@ -100,7 +100,7 @@ X509_PUBKEY *X509_PUBKEY_new(void)
 
         M_ASN1_New_Malloc(ret,X509_PUBKEY);
         M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->public_key,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->public_key,M_ASN1_BIT_STRING_new);
         ret->pkey=NULL;
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_PUBKEY_NEW);
@@ -110,9 +110,9 @@ void X509_PUBKEY_free(X509_PUBKEY *a)
         {
         if (a == NULL) return;
         X509_ALGOR_free(a->algor);
-        ASN1_BIT_STRING_free(a->public_key);
+        M_ASN1_BIT_STRING_free(a->public_key);
         if (a->pkey != NULL) EVP_PKEY_free(a->pkey);
-        Free((char *)a);
+        Free(a);
         }
 
 int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
@@ -176,7 +176,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
         if ((s=(unsigned char *)Malloc(i+1)) == NULL) goto err;
         p=s;
         i2d_PublicKey(pkey,&p);
-        if (!ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err;
+        if (!M_ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err;
         /* Set number of unused bits to zero */
         pk->public_key->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
         pk->public_key->flags|=ASN1_STRING_FLAG_BITS_LEFT;
@@ -252,3 +252,113 @@ err:
         return(NULL);
         }
 
+/* Now two pseudo ASN1 routines that take an EVP_PKEY structure
+ * and encode or decode as X509_PUBKEY
+ */
+
+EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, unsigned char **pp,
+             long length)
+{
+        X509_PUBKEY *xpk;
+        EVP_PKEY *pktmp;
+        xpk = d2i_X509_PUBKEY(NULL, pp, length);
+        if(!xpk) return NULL;
+        pktmp = X509_PUBKEY_get(xpk);
+        X509_PUBKEY_free(xpk);
+        if(!pktmp) return NULL;
+        if(a) {
+                EVP_PKEY_free(*a);
+                *a = pktmp;
+        }
+        return pktmp;
+}
+
+int i2d_PUBKEY(EVP_PKEY *a, unsigned char **pp)
+{
+        X509_PUBKEY *xpk=NULL;
+        int ret;
+        if(!a) return 0;
+        if(!X509_PUBKEY_set(&xpk, a)) return 0;
+        ret = i2d_X509_PUBKEY(xpk, pp);
+        X509_PUBKEY_free(xpk);
+        return ret;
+}
+
+/* The following are equivalents but which return RSA and DSA
+ * keys
+ */
+#ifndef NO_RSA
+RSA *d2i_RSA_PUBKEY(RSA **a, unsigned char **pp,
+             long length)
+{
+        EVP_PKEY *pkey;
+        RSA *key;
+        unsigned char *q;
+        q = *pp;
+        pkey = d2i_PUBKEY(NULL, &q, length);
+        if(!pkey) return NULL;
+        key = EVP_PKEY_get1_RSA(pkey);
+        EVP_PKEY_free(pkey);
+        if(!key) return NULL;
+        *pp = q;
+        if(a) {
+                RSA_free(*a);
+                *a = key;
+        }
+        return key;
+}
+
+int i2d_RSA_PUBKEY(RSA *a, unsigned char **pp)
+{
+        EVP_PKEY *pktmp;
+        int ret;
+        if(!a) return 0;
+        pktmp = EVP_PKEY_new();
+        if(!pktmp) {
+                ASN1err(ASN1_F_I2D_RSA_PUBKEY, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        EVP_PKEY_set1_RSA(pktmp, a);
+        ret = i2d_PUBKEY(pktmp, pp);
+        EVP_PKEY_free(pktmp);
+        return ret;
+}
+#endif
+
+#ifndef NO_DSA
+DSA *d2i_DSA_PUBKEY(DSA **a, unsigned char **pp,
+             long length)
+{
+        EVP_PKEY *pkey;
+        DSA *key;
+        unsigned char *q;
+        q = *pp;
+        pkey = d2i_PUBKEY(NULL, &q, length);
+        if(!pkey) return NULL;
+        key = EVP_PKEY_get1_DSA(pkey);
+        EVP_PKEY_free(pkey);
+        if(!key) return NULL;
+        *pp = q;
+        if(a) {
+                DSA_free(*a);
+                *a = key;
+        }
+        return key;
+}
+
+int i2d_DSA_PUBKEY(DSA *a, unsigned char **pp)
+{
+        EVP_PKEY *pktmp;
+        int ret;
+        if(!a) return 0;
+        pktmp = EVP_PKEY_new();
+        if(!pktmp) {
+                ASN1err(ASN1_F_I2D_DSA_PUBKEY, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        EVP_PKEY_set1_DSA(pktmp, a);
+        ret = i2d_PUBKEY(pktmp, pp);
+        EVP_PKEY_free(pktmp);
+        return ret;
+}
+#endif
diff --git a/src/lib/libcrypto/asn1/x_req.c b/src/lib/libcrypto/asn1/x_req.c
index 9b1d6abe64..0cd572ee73 100644
--- a/src/lib/libcrypto/asn1/x_req.c
+++ b/src/lib/libcrypto/asn1/x_req.c
@@ -73,7 +73,7 @@ int i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **pp)
          * allow some CA Software to accept the cert request.
          * It is not following the PKCS standards ...
          * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
          * NOTE: no OPTIONAL ... so it *must* be there
          */
         if (a->req_kludge) 
@@ -94,7 +94,7 @@ int i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **pp)
         /* this is a *nasty* hack reported to be required by some CA's.
          * It is not following the PKCS standards ...
          * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
          * NOTE: no OPTIONAL ... so it *must* be there
          */
         if (a->req_kludge)
@@ -126,7 +126,7 @@ X509_REQ_INFO *d2i_X509_REQ_INFO(X509_REQ_INFO **a, unsigned char **pp,
          * have been reported as requiring it.
          * It is not following the PKCS standards ...
          * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
          * NOTE: no OPTIONAL ... so it *must* be there
          */
         if (asn1_Finish(&c))
@@ -147,7 +147,7 @@ X509_REQ_INFO *X509_REQ_INFO_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,X509_REQ_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->subject,X509_NAME_new);
         M_ASN1_New(ret->pubkey,X509_PUBKEY_new);
         M_ASN1_New(ret->attributes,sk_X509_ATTRIBUTE_new_null);
@@ -159,11 +159,11 @@ X509_REQ_INFO *X509_REQ_INFO_new(void)
 void X509_REQ_INFO_free(X509_REQ_INFO *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         X509_NAME_free(a->subject);
         X509_PUBKEY_free(a->pubkey);
         sk_X509_ATTRIBUTE_pop_free(a->attributes,X509_ATTRIBUTE_free);
-        Free((char *)a);
+        Free(a);
         }
 
 int i2d_X509_REQ(X509_REQ *a, unsigned char **pp)
@@ -203,7 +203,7 @@ X509_REQ *X509_REQ_new(void)
         ret->references=1;
         M_ASN1_New(ret->req_info,X509_REQ_INFO_new);
         M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_REQ_NEW);
         }
@@ -229,8 +229,8 @@ void X509_REQ_free(X509_REQ *a)
 
         X509_REQ_INFO_free(a->req_info);
         X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
+        M_ASN1_BIT_STRING_free(a->signature);
+        Free(a);
         }
 
 
diff --git a/src/lib/libcrypto/asn1/x_sig.c b/src/lib/libcrypto/asn1/x_sig.c
index c2782d1b9c..3559bd5368 100644
--- a/src/lib/libcrypto/asn1/x_sig.c
+++ b/src/lib/libcrypto/asn1/x_sig.c
@@ -94,7 +94,7 @@ X509_SIG *X509_SIG_new(void)
 
         M_ASN1_New_Malloc(ret,X509_SIG);
         M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->digest,M_ASN1_OCTET_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_SIG_NEW);
         }
@@ -103,8 +103,8 @@ void X509_SIG_free(X509_SIG *a)
         {
         if (a == NULL) return;
         X509_ALGOR_free(a->algor);
-        ASN1_OCTET_STRING_free(a->digest);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->digest);
+        Free(a);
         }
 
 
diff --git a/src/lib/libcrypto/asn1/x_spki.c b/src/lib/libcrypto/asn1/x_spki.c
index 43e0023839..8f5e7e6380 100644
--- a/src/lib/libcrypto/asn1/x_spki.c
+++ b/src/lib/libcrypto/asn1/x_spki.c
@@ -57,7 +57,7 @@
  */
 
  /* This module was send to me my Pat Richards <patr@x509.com> who
-  * wrote it.  It is under my Copyright with his permision
+  * wrote it.  It is under my Copyright with his permission
   */
 
 #include <stdio.h>
@@ -99,7 +99,7 @@ NETSCAPE_SPKAC *NETSCAPE_SPKAC_new(void)
 
         M_ASN1_New_Malloc(ret,NETSCAPE_SPKAC);
         M_ASN1_New(ret->pubkey,X509_PUBKEY_new);
-        M_ASN1_New(ret->challenge,ASN1_IA5STRING_new);
+        M_ASN1_New(ret->challenge,M_ASN1_IA5STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_NETSCAPE_SPKAC_NEW);
         }
@@ -108,8 +108,8 @@ void NETSCAPE_SPKAC_free(NETSCAPE_SPKAC *a)
         {
         if (a == NULL) return;
         X509_PUBKEY_free(a->pubkey);
-        ASN1_IA5STRING_free(a->challenge);
-        Free((char *)a);
+        M_ASN1_IA5STRING_free(a->challenge);
+        Free(a);
         }
 
 int i2d_NETSCAPE_SPKI(NETSCAPE_SPKI *a, unsigned char **pp)
@@ -150,7 +150,7 @@ NETSCAPE_SPKI *NETSCAPE_SPKI_new(void)
         M_ASN1_New_Malloc(ret,NETSCAPE_SPKI);
         M_ASN1_New(ret->spkac,NETSCAPE_SPKAC_new);
         M_ASN1_New(ret->sig_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_NETSCAPE_SPKI_NEW);
         }
@@ -160,7 +160,7 @@ void NETSCAPE_SPKI_free(NETSCAPE_SPKI *a)
         if (a == NULL) return;
         NETSCAPE_SPKAC_free(a->spkac);
         X509_ALGOR_free(a->sig_algor);
-        ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
+        M_ASN1_BIT_STRING_free(a->signature);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/x_val.c b/src/lib/libcrypto/asn1/x_val.c
index 84d6f7ca4d..1a2f49ffdf 100644
--- a/src/lib/libcrypto/asn1/x_val.c
+++ b/src/lib/libcrypto/asn1/x_val.c
@@ -93,8 +93,8 @@ X509_VAL *X509_VAL_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,X509_VAL);
-        M_ASN1_New(ret->notBefore,ASN1_TIME_new);
-        M_ASN1_New(ret->notAfter,ASN1_TIME_new);
+        M_ASN1_New(ret->notBefore,M_ASN1_TIME_new);
+        M_ASN1_New(ret->notAfter,M_ASN1_TIME_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_VAL_NEW);
         }
@@ -102,8 +102,8 @@ X509_VAL *X509_VAL_new(void)
 void X509_VAL_free(X509_VAL *a)
         {
         if (a == NULL) return;
-        ASN1_TIME_free(a->notBefore);
-        ASN1_TIME_free(a->notAfter);
-        Free((char *)a);
+        M_ASN1_TIME_free(a->notBefore);
+        M_ASN1_TIME_free(a->notAfter);
+        Free(a);
         }
 
diff --git a/src/lib/libcrypto/asn1/x_x509.c b/src/lib/libcrypto/asn1/x_x509.c
index 7abf6b2a6b..11e564ea30 100644
--- a/src/lib/libcrypto/asn1/x_x509.c
+++ b/src/lib/libcrypto/asn1/x_x509.c
@@ -62,6 +62,9 @@
 #include <openssl/asn1_mac.h>
 #include <openssl/x509.h>
 
+static int x509_meth_num = 0;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_meth = NULL;
+
 static ASN1_METHOD meth={
         (int (*)())  i2d_X509,
         (char *(*)())d2i_X509,
@@ -113,10 +116,13 @@ X509 *X509_new(void)
         M_ASN1_New_Malloc(ret,X509);
         ret->references=1;
         ret->valid=0;
+        ret->ex_flags = 0;
         ret->name=NULL;
+        ret->aux=NULL;
         M_ASN1_New(ret->cert_info,X509_CINF_new);
         M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
+        CRYPTO_new_ex_data(x509_meth, ret, &ret->ex_data);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_NEW);
         }
@@ -140,12 +146,65 @@ void X509_free(X509 *a)
                 }
 #endif
 
-        /* CRYPTO_free_ex_data(bio_meth,(char *)a,&a->ex_data); */
+        CRYPTO_free_ex_data(x509_meth,a,&a->ex_data);
         X509_CINF_free(a->cert_info);
         X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
+        M_ASN1_BIT_STRING_free(a->signature);
+        X509_CERT_AUX_free(a->aux);
 
         if (a->name != NULL) Free(a->name);
-        Free((char *)a);
+        Free(a);
+        }
+
+int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        x509_meth_num++;
+        return(CRYPTO_get_ex_new_index(x509_meth_num-1,
+                &x509_meth,argl,argp,new_func,dup_func,free_func));
+        }
+
+int X509_set_ex_data(X509 *r, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
         }
 
+void *X509_get_ex_data(X509 *r, int idx)
+        {
+        return(CRYPTO_get_ex_data(&r->ex_data,idx));
+        }
+
+/* X509_AUX ASN1 routines. X509_AUX is the name given to
+ * a certificate with extra info tagged on the end. Since these
+ * functions set how a certificate is trusted they should only
+ * be used when the certificate comes from a reliable source
+ * such as local storage.
+ *
+ */
+
+X509 *d2i_X509_AUX(X509 **a, unsigned char **pp, long length)
+{
+        unsigned char *q;
+        X509 *ret;
+        /* Save start position */
+        q = *pp;
+        ret = d2i_X509(a, pp, length);
+        /* If certificate unreadable then forget it */
+        if(!ret) return NULL;
+        /* update length */
+        length -= *pp - q;
+        if(!length) return ret;
+        if(!d2i_X509_CERT_AUX(&ret->aux, pp, length)) goto err;
+        return ret;
+        err:
+        X509_free(ret);
+        return NULL;
+}
+
+int i2d_X509_AUX(X509 *a, unsigned char **pp)
+{
+        int length;
+        length = i2d_X509(a, pp);
+        if(a) length += i2d_X509_CERT_AUX(a->aux, pp);
+        return length;
+}
diff --git a/src/lib/libcrypto/asn1/x_x509a.c b/src/lib/libcrypto/asn1/x_x509a.c
new file mode 100644
index 0000000000..b9987ea968
--- /dev/null
+++ b/src/lib/libcrypto/asn1/x_x509a.c
@@ -0,0 +1,200 @@
+/* a_x509a.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/asn1_mac.h>
+#include <openssl/x509.h>
+
+/* X509_CERT_AUX routines. These are used to encode additional
+ * user modifiable data about a certificate. This data is
+ * appended to the X509 encoding when the *_X509_AUX routines
+ * are used. This means that the "traditional" X509 routines
+ * will simply ignore the extra data. 
+ */
+
+static X509_CERT_AUX *aux_get(X509 *x);
+
+X509_CERT_AUX *d2i_X509_CERT_AUX(X509_CERT_AUX **a, unsigned char **pp, long length)
+{
+        M_ASN1_D2I_vars(a, X509_CERT_AUX *, X509_CERT_AUX_new);
+        
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+
+        M_ASN1_D2I_get_seq_opt_type(ASN1_OBJECT, ret->trust,
+                                        d2i_ASN1_OBJECT, ASN1_OBJECT_free);
+        M_ASN1_D2I_get_IMP_set_opt_type(ASN1_OBJECT, ret->reject,
+                                        d2i_ASN1_OBJECT, ASN1_OBJECT_free, 0);
+        M_ASN1_D2I_get_opt(ret->alias, d2i_ASN1_UTF8STRING, V_ASN1_UTF8STRING);
+        M_ASN1_D2I_get_opt(ret->keyid, d2i_ASN1_OCTET_STRING, V_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_IMP_set_opt_type(X509_ALGOR, ret->other,
+                                        d2i_X509_ALGOR, X509_ALGOR_free, 1);
+
+        M_ASN1_D2I_Finish(a, X509_CERT_AUX_free, ASN1_F_D2I_X509_CERT_AUX);
+}
+
+X509_CERT_AUX *X509_CERT_AUX_new()
+{
+        X509_CERT_AUX *ret = NULL;
+        ASN1_CTX c;
+        M_ASN1_New_Malloc(ret, X509_CERT_AUX);
+        ret->trust = NULL;
+        ret->reject = NULL;
+        ret->alias = NULL;
+        ret->keyid = NULL;
+        ret->other = NULL;
+        return(ret);
+        M_ASN1_New_Error(ASN1_F_X509_CERT_AUX_NEW);
+}
+
+void X509_CERT_AUX_free(X509_CERT_AUX *a)
+{
+        if(a == NULL) return;
+        sk_ASN1_OBJECT_pop_free(a->trust, ASN1_OBJECT_free);
+        sk_ASN1_OBJECT_pop_free(a->reject, ASN1_OBJECT_free);
+        ASN1_UTF8STRING_free(a->alias);
+        ASN1_OCTET_STRING_free(a->keyid);
+        sk_X509_ALGOR_pop_free(a->other, X509_ALGOR_free);
+        Free(a);
+}
+
+int i2d_X509_CERT_AUX(X509_CERT_AUX *a, unsigned char **pp)
+{
+        M_ASN1_I2D_vars(a);
+
+        M_ASN1_I2D_len_SEQUENCE_opt_type(ASN1_OBJECT, a->trust, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_len_IMP_SEQUENCE_opt_type(ASN1_OBJECT, a->reject, i2d_ASN1_OBJECT, 0);
+
+        M_ASN1_I2D_len(a->alias, i2d_ASN1_UTF8STRING);
+        M_ASN1_I2D_len(a->keyid, i2d_ASN1_OCTET_STRING);
+        M_ASN1_I2D_len_IMP_SEQUENCE_opt_type(X509_ALGOR, a->other, i2d_X509_ALGOR, 1);
+
+        M_ASN1_I2D_seq_total();
+
+        M_ASN1_I2D_put_SEQUENCE_opt_type(ASN1_OBJECT, a->trust, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_put_IMP_SEQUENCE_opt_type(ASN1_OBJECT, a->reject, i2d_ASN1_OBJECT, 0);
+
+        M_ASN1_I2D_put(a->alias, i2d_ASN1_UTF8STRING);
+        M_ASN1_I2D_put(a->keyid, i2d_ASN1_OCTET_STRING);
+        M_ASN1_I2D_put_IMP_SEQUENCE_opt_type(X509_ALGOR, a->other, i2d_X509_ALGOR, 1);
+
+        M_ASN1_I2D_finish();
+}
+
+static X509_CERT_AUX *aux_get(X509 *x)
+{
+        if(!x) return NULL;
+        if(!x->aux && !(x->aux = X509_CERT_AUX_new())) return NULL;
+        return x->aux;
+}
+
+int X509_alias_set1(X509 *x, unsigned char *name, int len)
+{
+        X509_CERT_AUX *aux;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->alias && !(aux->alias = ASN1_UTF8STRING_new())) return 0;
+        return ASN1_STRING_set(aux->alias, name, len);
+}
+
+unsigned char *X509_alias_get0(X509 *x, int *len)
+{
+        if(!x->aux || !x->aux->alias) return NULL;
+        if(len) *len = x->aux->alias->length;
+        return x->aux->alias->data;
+}
+
+int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj)
+{
+        X509_CERT_AUX *aux;
+        ASN1_OBJECT *objtmp;
+        if(!(objtmp = OBJ_dup(obj))) return 0;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->trust
+                && !(aux->trust = sk_ASN1_OBJECT_new_null())) return 0;
+        return sk_ASN1_OBJECT_push(aux->trust, objtmp);
+}
+
+int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj)
+{
+        X509_CERT_AUX *aux;
+        ASN1_OBJECT *objtmp;
+        if(!(objtmp = OBJ_dup(obj))) return 0;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->reject
+                && !(aux->reject = sk_ASN1_OBJECT_new_null())) return 0;
+        return sk_ASN1_OBJECT_push(aux->reject, objtmp);
+}
+
+void X509_trust_clear(X509 *x)
+{
+        if(x->aux && x->aux->trust) {
+                sk_ASN1_OBJECT_pop_free(x->aux->trust, ASN1_OBJECT_free);
+                x->aux->trust = NULL;
+        }
+}
+
+void X509_reject_clear(X509 *x)
+{
+        if(x->aux && x->aux->reject) {
+                sk_ASN1_OBJECT_pop_free(x->aux->reject, ASN1_OBJECT_free);
+                x->aux->reject = NULL;
+        }
+}
+
diff --git a/src/lib/libcrypto/bf/bf_cbc.c b/src/lib/libcrypto/bf/bf_cbc.c
index 95d1cdcdf9..f949629dc6 100644
--- a/src/lib/libcrypto/bf/bf_cbc.c
+++ b/src/lib/libcrypto/bf/bf_cbc.c
@@ -59,8 +59,8 @@
 #include <openssl/blowfish.h>
 #include "bf_locl.h"
 
-void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
-             BF_KEY *ks, unsigned char *iv, int encrypt)
+void BF_cbc_encrypt(const unsigned char *in, unsigned char *out, long length,
+             const BF_KEY *schedule, unsigned char *ivec, int encrypt)
         {
         register BF_LONG tin0,tin1;
         register BF_LONG tout0,tout1,xor0,xor1;
@@ -69,9 +69,9 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
 
         if (encrypt)
                 {
-                n2l(iv,tout0);
-                n2l(iv,tout1);
-                iv-=8;
+                n2l(ivec,tout0);
+                n2l(ivec,tout1);
+                ivec-=8;
                 for (l-=8; l>=0; l-=8)
                         {
                         n2l(in,tin0);
@@ -80,7 +80,7 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         tin1^=tout1;
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_encrypt(tin,ks);
+                        BF_encrypt(tin,schedule);
                         tout0=tin[0];
                         tout1=tin[1];
                         l2n(tout0,out);
@@ -93,27 +93,27 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         tin1^=tout1;
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_encrypt(tin,ks);
+                        BF_encrypt(tin,schedule);
                         tout0=tin[0];
                         tout1=tin[1];
                         l2n(tout0,out);
                         l2n(tout1,out);
                         }
-                l2n(tout0,iv);
-                l2n(tout1,iv);
+                l2n(tout0,ivec);
+                l2n(tout1,ivec);
                 }
         else
                 {
-                n2l(iv,xor0);
-                n2l(iv,xor1);
-                iv-=8;
+                n2l(ivec,xor0);
+                n2l(ivec,xor1);
+                ivec-=8;
                 for (l-=8; l>=0; l-=8)
                         {
                         n2l(in,tin0);
                         n2l(in,tin1);
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_decrypt(tin,ks);
+                        BF_decrypt(tin,schedule);
                         tout0=tin[0]^xor0;
                         tout1=tin[1]^xor1;
                         l2n(tout0,out);
@@ -127,15 +127,15 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         n2l(in,tin1);
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_decrypt(tin,ks);
+                        BF_decrypt(tin,schedule);
                         tout0=tin[0]^xor0;
                         tout1=tin[1]^xor1;
                         l2nn(tout0,tout1,out,l+8);
                         xor0=tin0;
                         xor1=tin1;
                         }
-                l2n(xor0,iv);
-                l2n(xor1,iv);
+                l2n(xor0,ivec);
+                l2n(xor1,ivec);
                 }
         tin0=tin1=tout0=tout1=xor0=xor1=0;
         tin[0]=tin[1]=0;
diff --git a/src/lib/libcrypto/bf/bf_cfb64.c b/src/lib/libcrypto/bf/bf_cfb64.c
index 1fb8905f49..6451c8d407 100644
--- a/src/lib/libcrypto/bf/bf_cfb64.c
+++ b/src/lib/libcrypto/bf/bf_cfb64.c
@@ -64,8 +64,8 @@
  * 64bit block we have used is contained in *num;
  */
 
-void BF_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
-             BF_KEY *schedule, unsigned char *ivec, int *num, int encrypt)
+void BF_cfb64_encrypt(const unsigned char *in, unsigned char *out, long length,
+             const BF_KEY *schedule, unsigned char *ivec, int *num, int encrypt)
         {
         register BF_LONG v0,v1,t;
         register int n= *num;
diff --git a/src/lib/libcrypto/bf/bf_ecb.c b/src/lib/libcrypto/bf/bf_ecb.c
index 9f8a24cdff..341991636f 100644
--- a/src/lib/libcrypto/bf/bf_ecb.c
+++ b/src/lib/libcrypto/bf/bf_ecb.c
@@ -61,11 +61,11 @@
 #include <openssl/opensslv.h>
 
 /* Blowfish as implemented from 'Blowfish: Springer-Verlag paper'
- * (From LECTURE NOTES IN COIMPUTER SCIENCE 809, FAST SOFTWARE ENCRYPTION,
+ * (From LECTURE NOTES IN COMPUTER SCIENCE 809, FAST SOFTWARE ENCRYPTION,
  * CAMBRIDGE SECURITY WORKSHOP, CAMBRIDGE, U.K., DECEMBER 9-11, 1993)
  */
 
-const char *BF_version="BlowFish" OPENSSL_VERSION_PTEXT;
+const char *BF_version="Blowfish" OPENSSL_VERSION_PTEXT;
 
 const char *BF_options(void)
         {
@@ -78,17 +78,17 @@ const char *BF_options(void)
 #endif
         }
 
-void BF_ecb_encrypt(unsigned char *in, unsigned char *out, BF_KEY *ks,
-             int encrypt)
+void BF_ecb_encrypt(const unsigned char *in, unsigned char *out,
+             const BF_KEY *key, int encrypt)
         {
         BF_LONG l,d[2];
 
         n2l(in,l); d[0]=l;
         n2l(in,l); d[1]=l;
         if (encrypt)
-                BF_encrypt(d,ks);
+                BF_encrypt(d,key);
         else
-                BF_decrypt(d,ks);
+                BF_decrypt(d,key);
         l=d[0]; l2n(l,out);
         l=d[1]; l2n(l,out);
         l=d[0]=d[1]=0;
diff --git a/src/lib/libcrypto/bf/bf_enc.c b/src/lib/libcrypto/bf/bf_enc.c
index ee01834561..b380acf959 100644
--- a/src/lib/libcrypto/bf/bf_enc.c
+++ b/src/lib/libcrypto/bf/bf_enc.c
@@ -60,7 +60,7 @@
 #include "bf_locl.h"
 
 /* Blowfish as implemented from 'Blowfish: Springer-Verlag paper'
- * (From LECTURE NOTES IN COIMPUTER SCIENCE 809, FAST SOFTWARE ENCRYPTION,
+ * (From LECTURE NOTES IN COMPUTER SCIENCE 809, FAST SOFTWARE ENCRYPTION,
  * CAMBRIDGE SECURITY WORKSHOP, CAMBRIDGE, U.K., DECEMBER 9-11, 1993)
  */
 
@@ -69,10 +69,11 @@
 to modify the code.
 #endif
 
-void BF_encrypt(BF_LONG *data, BF_KEY *key)
+void BF_encrypt(BF_LONG *data, const BF_KEY *key)
         {
 #ifndef BF_PTR2
-        register BF_LONG l,r,*p,*s;
+        register BF_LONG l,r;
+    const register BF_LONG *p,*s;
 
         p=key->P;
         s= &(key->S[0]);
@@ -145,10 +146,11 @@ void BF_encrypt(BF_LONG *data, BF_KEY *key)
 
 #ifndef BF_DEFAULT_OPTIONS
 
-void BF_decrypt(BF_LONG *data, BF_KEY *key)
+void BF_decrypt(BF_LONG *data, const BF_KEY *key)
         {
 #ifndef BF_PTR2
-        register BF_LONG l,r,*p,*s;
+        register BF_LONG l,r;
+    const register BF_LONG *p,*s;
 
         p=key->P;
         s= &(key->S[0]);
@@ -219,8 +221,8 @@ void BF_decrypt(BF_LONG *data, BF_KEY *key)
 #endif
         }
 
-void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
-             BF_KEY *ks, unsigned char *iv, int encrypt)
+void BF_cbc_encrypt(const unsigned char *in, unsigned char *out, long length,
+             const BF_KEY *schedule, unsigned char *ivec, int encrypt)
         {
         register BF_LONG tin0,tin1;
         register BF_LONG tout0,tout1,xor0,xor1;
@@ -229,9 +231,9 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
 
         if (encrypt)
                 {
-                n2l(iv,tout0);
-                n2l(iv,tout1);
-                iv-=8;
+                n2l(ivec,tout0);
+                n2l(ivec,tout1);
+                ivec-=8;
                 for (l-=8; l>=0; l-=8)
                         {
                         n2l(in,tin0);
@@ -240,7 +242,7 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         tin1^=tout1;
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_encrypt(tin,ks);
+                        BF_encrypt(tin,schedule);
                         tout0=tin[0];
                         tout1=tin[1];
                         l2n(tout0,out);
@@ -253,27 +255,27 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         tin1^=tout1;
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_encrypt(tin,ks);
+                        BF_encrypt(tin,schedule);
                         tout0=tin[0];
                         tout1=tin[1];
                         l2n(tout0,out);
                         l2n(tout1,out);
                         }
-                l2n(tout0,iv);
-                l2n(tout1,iv);
+                l2n(tout0,ivec);
+                l2n(tout1,ivec);
                 }
         else
                 {
-                n2l(iv,xor0);
-                n2l(iv,xor1);
-                iv-=8;
+                n2l(ivec,xor0);
+                n2l(ivec,xor1);
+                ivec-=8;
                 for (l-=8; l>=0; l-=8)
                         {
                         n2l(in,tin0);
                         n2l(in,tin1);
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_decrypt(tin,ks);
+                        BF_decrypt(tin,schedule);
                         tout0=tin[0]^xor0;
                         tout1=tin[1]^xor1;
                         l2n(tout0,out);
@@ -287,15 +289,15 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         n2l(in,tin1);
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_decrypt(tin,ks);
+                        BF_decrypt(tin,schedule);
                         tout0=tin[0]^xor0;
                         tout1=tin[1]^xor1;
                         l2nn(tout0,tout1,out,l+8);
                         xor0=tin0;
                         xor1=tin1;
                         }
-                l2n(xor0,iv);
-                l2n(xor1,iv);
+                l2n(xor0,ivec);
+                l2n(xor1,ivec);
                 }
         tin0=tin1=tout0=tout1=xor0=xor1=0;
         tin[0]=tin[1]=0;
diff --git a/src/lib/libcrypto/bf/bf_locl.h b/src/lib/libcrypto/bf/bf_locl.h
index 05756b5d3b..cc7c3ec992 100644
--- a/src/lib/libcrypto/bf/bf_locl.h
+++ b/src/lib/libcrypto/bf/bf_locl.h
@@ -148,7 +148,7 @@
                          *((c)++)=(unsigned char)(((l)>> 8L)&0xff), \
                          *((c)++)=(unsigned char)(((l)     )&0xff))
 
-/* This is actually a big endian algorithm, the most significate byte
+/* This is actually a big endian algorithm, the most significant byte
  * is used to lookup array 0 */
 
 #if defined(BF_PTR2)
@@ -183,8 +183,8 @@
 
 /*
  * This is normally very good on RISC platforms where normally you
- * have to explicitely "multiplicate" array index by sizeof(BF_LONG)
- * in order to caclulate the effective address. This implementation
+ * have to explicitly "multiply" array index by sizeof(BF_LONG)
+ * in order to calculate the effective address. This implementation
  * excuses CPU from this extra work. Power[PC] uses should have most
  * fun as (R>>BF_i)&BF_M gets folded into a single instruction, namely
  * rlwinm. So let'em double-check if their compiler does it.
diff --git a/src/lib/libcrypto/bf/bf_ofb64.c b/src/lib/libcrypto/bf/bf_ofb64.c
index 8ceb8d9bda..f2a9ff6e41 100644
--- a/src/lib/libcrypto/bf/bf_ofb64.c
+++ b/src/lib/libcrypto/bf/bf_ofb64.c
@@ -63,8 +63,8 @@
  * used.  The extra state information to record how much of the
  * 64bit block we have used is contained in *num;
  */
-void BF_ofb64_encrypt(unsigned char *in, unsigned char *out, long length,
-             BF_KEY *schedule, unsigned char *ivec, int *num)
+void BF_ofb64_encrypt(const unsigned char *in, unsigned char *out, long length,
+             const BF_KEY *schedule, unsigned char *ivec, int *num)
         {
         register BF_LONG v0,v1,t;
         register int n= *num;
diff --git a/src/lib/libcrypto/bf/bf_opts.c b/src/lib/libcrypto/bf/bf_opts.c
index 5f330cc53c..bbe32b28c9 100644
--- a/src/lib/libcrypto/bf/bf_opts.c
+++ b/src/lib/libcrypto/bf/bf_opts.c
@@ -242,7 +242,7 @@ int main(int argc, char **argv)
                 }
 
 #ifndef TIMES
-        fprintf(stderr,"To get the most acurate results, try to run this\n");
+        fprintf(stderr,"To get the most accurate results, try to run this\n");
         fprintf(stderr,"program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libcrypto/bf/bf_pi.h b/src/lib/libcrypto/bf/bf_pi.h
index 417b935538..9949513c68 100644
--- a/src/lib/libcrypto/bf/bf_pi.h
+++ b/src/lib/libcrypto/bf/bf_pi.h
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
-static BF_KEY bf_init= {
+static const BF_KEY bf_init= {
         {
         0x243f6a88L, 0x85a308d3L, 0x13198a2eL, 0x03707344L,
         0xa4093822L, 0x299f31d0L, 0x082efa98L, 0xec4e6c89L,
diff --git a/src/lib/libcrypto/bf/bf_skey.c b/src/lib/libcrypto/bf/bf_skey.c
index eefa8e6f51..4d6a232fe0 100644
--- a/src/lib/libcrypto/bf/bf_skey.c
+++ b/src/lib/libcrypto/bf/bf_skey.c
@@ -62,11 +62,11 @@
 #include "bf_locl.h"
 #include "bf_pi.h"
 
-void BF_set_key(BF_KEY *key, int len, unsigned char *data)
+void BF_set_key(BF_KEY *key, int len, const unsigned char *data)
         {
         int i;
         BF_LONG *p,ri,in[2];
-        unsigned char *d,*end;
+        const unsigned char *d,*end;
 
 
         memcpy((char *)key,(char *)&bf_init,sizeof(BF_KEY));
diff --git a/src/lib/libcrypto/bf/bfspeed.c b/src/lib/libcrypto/bf/bfspeed.c
index 9b893e92cc..ecc9dff4e4 100644
--- a/src/lib/libcrypto/bf/bfspeed.c
+++ b/src/lib/libcrypto/bf/bfspeed.c
@@ -183,7 +183,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libcrypto/bf/bftest.c b/src/lib/libcrypto/bf/bftest.c
index 6ecd2609a9..5695250195 100644
--- a/src/lib/libcrypto/bf/bftest.c
+++ b/src/lib/libcrypto/bf/bftest.c
@@ -76,18 +76,18 @@ int main(int argc, char *argv[])
 #include <openssl/ebcdic.h>
 #endif
 
-char *bf_key[2]={
+static char *bf_key[2]={
         "abcdefghijklmnopqrstuvwxyz",
         "Who is John Galt?"
         };
 
 /* big endian */
-BF_LONG bf_plain[2][2]={
+static BF_LONG bf_plain[2][2]={
         {0x424c4f57L,0x46495348L},
         {0xfedcba98L,0x76543210L}
         };
 
-BF_LONG bf_cipher[2][2]={
+static BF_LONG bf_cipher[2][2]={
         {0x324ed0feL,0xf413a203L},
         {0xcc91732bL,0x8022f684L}
         };
@@ -228,16 +228,16 @@ static unsigned char ofb64_ok[]={
         0x63,0xC2,0xCF,0x80,0xDA};
 
 #define KEY_TEST_NUM    25
-unsigned char key_test[KEY_TEST_NUM]={
+static unsigned char key_test[KEY_TEST_NUM]={
         0xf0,0xe1,0xd2,0xc3,0xb4,0xa5,0x96,0x87,
         0x78,0x69,0x5a,0x4b,0x3c,0x2d,0x1e,0x0f,
         0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
         0x88};
 
-unsigned char key_data[8]=
+static unsigned char key_data[8]=
         {0xFE,0xDC,0xBA,0x98,0x76,0x54,0x32,0x10};
 
-unsigned char key_out[KEY_TEST_NUM][8]={
+static unsigned char key_out[KEY_TEST_NUM][8]={
         {0xF9,0xAD,0x59,0x7C,0x49,0xDB,0x00,0x5E},
         {0xE9,0x1D,0x21,0xC1,0xD9,0x61,0xA6,0xD6},
         {0xE9,0xC2,0xB7,0x0A,0x1B,0xC6,0x5C,0xF3},
diff --git a/src/lib/libcrypto/bf/blowfish.h b/src/lib/libcrypto/bf/blowfish.h
index 02f73b2f30..78acfd63b4 100644
--- a/src/lib/libcrypto/bf/blowfish.h
+++ b/src/lib/libcrypto/bf/blowfish.h
@@ -103,17 +103,19 @@ typedef struct bf_key_st
         } BF_KEY;
 
  
-void BF_set_key(BF_KEY *key, int len, unsigned char *data);
-void BF_ecb_encrypt(unsigned char *in,unsigned char *out,BF_KEY *key,
-        int enc);
-void BF_encrypt(BF_LONG *data,BF_KEY *key);
-void BF_decrypt(BF_LONG *data,BF_KEY *key);
-void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
-        BF_KEY *ks, unsigned char *iv, int enc);
-void BF_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
-        BF_KEY *schedule, unsigned char *ivec, int *num, int enc);
-void BF_ofb64_encrypt(unsigned char *in, unsigned char *out, long length,
-        BF_KEY *schedule, unsigned char *ivec, int *num);
+void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
+
+void BF_encrypt(BF_LONG *data,const BF_KEY *key);
+void BF_decrypt(BF_LONG *data,const BF_KEY *key);
+
+void BF_ecb_encrypt(const unsigned char *in, unsigned char *out,
+        const BF_KEY *key, int enc);
+void BF_cbc_encrypt(const unsigned char *in, unsigned char *out, long length,
+        const BF_KEY *schedule, unsigned char *ivec, int enc);
+void BF_cfb64_encrypt(const unsigned char *in, unsigned char *out, long length,
+        const BF_KEY *schedule, unsigned char *ivec, int *num, int enc);
+void BF_ofb64_encrypt(const unsigned char *in, unsigned char *out, long length,
+        const BF_KEY *schedule, unsigned char *ivec, int *num);
 const char *BF_options(void);
 
 #ifdef  __cplusplus
diff --git a/src/lib/libcrypto/bio/Makefile.ssl b/src/lib/libcrypto/bio/Makefile.ssl
index d9c381d263..2e7480ead9 100644
--- a/src/lib/libcrypto/bio/Makefile.ssl
+++ b/src/lib/libcrypto/bio/Makefile.ssl
@@ -90,17 +90,20 @@ b_dump.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 b_dump.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 b_dump.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 b_dump.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-b_dump.o: ../../include/openssl/stack.h ../cryptlib.h
+b_dump.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+b_dump.o: ../cryptlib.h
 b_print.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 b_print.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 b_print.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 b_print.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-b_print.o: ../../include/openssl/stack.h ../cryptlib.h
+b_print.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+b_print.o: ../cryptlib.h
 b_sock.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 b_sock.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 b_sock.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 b_sock.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-b_sock.o: ../../include/openssl/stack.h ../cryptlib.h
+b_sock.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+b_sock.o: ../cryptlib.h
 bf_buff.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 bf_buff.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 bf_buff.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -151,60 +154,65 @@ bio_cb.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bio_cb.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bio_cb.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bio_cb.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bio_cb.o: ../../include/openssl/stack.h ../cryptlib.h
+bio_cb.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bio_cb.o: ../cryptlib.h
 bio_err.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
 bio_err.o: ../../include/openssl/err.h ../../include/openssl/opensslv.h
-bio_err.o: ../../include/openssl/stack.h
+bio_err.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bio_lib.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bio_lib.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bio_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bio_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bio_lib.o: ../../include/openssl/stack.h ../cryptlib.h
+bio_lib.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bio_lib.o: ../cryptlib.h
 bss_acpt.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_acpt.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_acpt.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_acpt.o: ../../include/openssl/opensslconf.h
-bss_acpt.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_acpt.o: ../cryptlib.h
+bss_acpt.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_acpt.o: ../../include/openssl/stack.h ../cryptlib.h
 bss_bio.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
 bss_bio.o: ../../include/openssl/err.h ../../include/openssl/opensslv.h
-bss_bio.o: ../../include/openssl/stack.h
+bss_bio.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bss_conn.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_conn.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_conn.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_conn.o: ../../include/openssl/opensslconf.h
-bss_conn.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_conn.o: ../cryptlib.h
+bss_conn.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_conn.o: ../../include/openssl/stack.h ../cryptlib.h
 bss_fd.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_fd.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_fd.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_fd.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bss_fd.o: ../../include/openssl/stack.h ../cryptlib.h bss_sock.c
+bss_fd.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bss_fd.o: ../cryptlib.h bss_sock.c
 bss_file.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_file.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_file.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_file.o: ../../include/openssl/opensslconf.h
-bss_file.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_file.o: ../cryptlib.h
+bss_file.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_file.o: ../../include/openssl/stack.h ../cryptlib.h
 bss_log.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_log.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_log.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_log.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bss_log.o: ../../include/openssl/stack.h ../cryptlib.h
+bss_log.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bss_log.o: ../cryptlib.h
 bss_mem.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_mem.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_mem.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_mem.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bss_mem.o: ../../include/openssl/stack.h ../cryptlib.h
+bss_mem.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bss_mem.o: ../cryptlib.h
 bss_null.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_null.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_null.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_null.o: ../../include/openssl/opensslconf.h
-bss_null.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_null.o: ../cryptlib.h
+bss_null.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_null.o: ../../include/openssl/stack.h ../cryptlib.h
 bss_sock.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_sock.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_sock.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_sock.o: ../../include/openssl/opensslconf.h
-bss_sock.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_sock.o: ../cryptlib.h
+bss_sock.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_sock.o: ../../include/openssl/stack.h ../cryptlib.h
diff --git a/src/lib/libcrypto/bio/b_dump.c b/src/lib/libcrypto/bio/b_dump.c
index a7cd828978..f5aeb237f5 100644
--- a/src/lib/libcrypto/bio/b_dump.c
+++ b/src/lib/libcrypto/bio/b_dump.c
@@ -92,7 +92,7 @@ int BIO_dump(BIO *bio, const char *s, int len)
       if (((i*DUMP_WIDTH)+j)>=len) {
         strcat(buf,"   ");
       } else {
-        ch=((unsigned char)*((char *)(s)+i*DUMP_WIDTH+j)) & 0xff;
+        ch=((unsigned char)*(s+i*DUMP_WIDTH+j)) & 0xff;
         sprintf(tmp,"%02x%c",ch,j==7?'-':' ');
         strcat(buf,tmp);
       }
@@ -101,7 +101,7 @@ int BIO_dump(BIO *bio, const char *s, int len)
     for(j=0;j<DUMP_WIDTH;j++) {
       if (((i*DUMP_WIDTH)+j)>=len)
         break;
-      ch=((unsigned char)*((char *)(s)+i*DUMP_WIDTH+j)) & 0xff;
+      ch=((unsigned char)*(s+i*DUMP_WIDTH+j)) & 0xff;
 #ifndef CHARSET_EBCDIC
       sprintf(tmp,"%c",((ch>=' ')&&(ch<='~'))?ch:'.');
 #else
diff --git a/src/lib/libcrypto/bio/b_print.c b/src/lib/libcrypto/bio/b_print.c
index f448004298..2a5e8b58c9 100644
--- a/src/lib/libcrypto/bio/b_print.c
+++ b/src/lib/libcrypto/bio/b_print.c
@@ -62,26 +62,649 @@
 
 #include <stdio.h>
 #include <stdarg.h>
+#include <string.h>
+#include <ctype.h>
 #include "cryptlib.h"
+#ifndef NO_SYS_TYPES_H
+#include <sys/types.h>
+#endif
 #include <openssl/bio.h>
 
+#ifdef BN_LLONG
+# ifndef HAVE_LONG_LONG
+#  define HAVE_LONG_LONG
+# endif
+#endif
+
+static void dopr (char *buffer, size_t maxlen, size_t *retlen,
+        const char *format, va_list args);
+
 int BIO_printf (BIO *bio, ...)
         {
         va_list args;
         char *format;
         int ret;
+        size_t retlen;
         MS_STATIC char hugebuf[1024*2]; /* 10k in one chunk is the limit */
 
         va_start(args, bio);
         format=va_arg(args, char *);
 
         hugebuf[0]='\0';
-
-        vsprintf(hugebuf,format,args);
-
-        ret=BIO_write(bio,hugebuf,strlen(hugebuf));
+        dopr(hugebuf, sizeof(hugebuf), &retlen, format, args);
+        ret=BIO_write(bio, hugebuf, (int)retlen);
 
         va_end(args);
         return(ret);
         }
 
+/*
+ * Copyright Patrick Powell 1995
+ * This code is based on code written by Patrick Powell <papowell@astart.com>
+ * It may be used for any purpose as long as this notice remains intact
+ * on all source code distributions.
+ */
+
+/*
+ * This code contains numerious changes and enhancements which were
+ * made by lots of contributors over the last years to Patrick Powell's
+ * original code:
+ *
+ * o Patrick Powell <papowell@astart.com>      (1995)
+ * o Brandon Long <blong@fiction.net>          (1996, for Mutt)
+ * o Thomas Roessler <roessler@guug.de>        (1998, for Mutt)
+ * o Michael Elkins <me@cs.hmc.edu>            (1998, for Mutt)
+ * o Andrew Tridgell <tridge@samba.org>        (1998, for Samba)
+ * o Luke Mewburn <lukem@netbsd.org>           (1999, for LukemFTP)
+ * o Ralf S. Engelschall <rse@engelschall.com> (1999, for Pth)
+ */
+
+#if HAVE_LONG_DOUBLE
+#define LDOUBLE long double
+#else
+#define LDOUBLE double
+#endif
+
+#if HAVE_LONG_LONG
+#define LLONG long long
+#else
+#define LLONG long
+#endif
+
+static void fmtstr     (char *, size_t *, size_t, char *, int, int, int);
+static void fmtint     (char *, size_t *, size_t, LLONG, int, int, int, int);
+static void fmtfp      (char *, size_t *, size_t, LDOUBLE, int, int, int);
+static void dopr_outch (char *, size_t *, size_t, int);
+
+/* format read states */
+#define DP_S_DEFAULT    0
+#define DP_S_FLAGS      1
+#define DP_S_MIN        2
+#define DP_S_DOT        3
+#define DP_S_MAX        4
+#define DP_S_MOD        5
+#define DP_S_CONV       6
+#define DP_S_DONE       7
+
+/* format flags - Bits */
+#define DP_F_MINUS      (1 << 0)
+#define DP_F_PLUS       (1 << 1)
+#define DP_F_SPACE      (1 << 2)
+#define DP_F_NUM        (1 << 3)
+#define DP_F_ZERO       (1 << 4)
+#define DP_F_UP         (1 << 5)
+#define DP_F_UNSIGNED   (1 << 6)
+
+/* conversion flags */
+#define DP_C_SHORT      1
+#define DP_C_LONG       2
+#define DP_C_LDOUBLE    3
+#define DP_C_LLONG      4
+
+/* some handy macros */
+#define char_to_int(p) (p - '0')
+#define MAX(p,q) ((p >= q) ? p : q)
+
+static void
+dopr(
+    char *buffer,
+    size_t maxlen,
+    size_t *retlen,
+    const char *format,
+    va_list args)
+{
+    char ch;
+    LLONG value;
+    LDOUBLE fvalue;
+    char *strvalue;
+    int min;
+    int max;
+    int state;
+    int flags;
+    int cflags;
+    size_t currlen;
+
+    state = DP_S_DEFAULT;
+    flags = currlen = cflags = min = 0;
+    max = -1;
+    ch = *format++;
+
+    while (state != DP_S_DONE) {
+        if ((ch == '\0') || (currlen >= maxlen))
+            state = DP_S_DONE;
+
+        switch (state) {
+        case DP_S_DEFAULT:
+            if (ch == '%')
+                state = DP_S_FLAGS;
+            else
+                dopr_outch(buffer, &currlen, maxlen, ch);
+            ch = *format++;
+            break;
+        case DP_S_FLAGS:
+            switch (ch) {
+            case '-':
+                flags |= DP_F_MINUS;
+                ch = *format++;
+                break;
+            case '+':
+                flags |= DP_F_PLUS;
+                ch = *format++;
+                break;
+            case ' ':
+                flags |= DP_F_SPACE;
+                ch = *format++;
+                break;
+            case '#':
+                flags |= DP_F_NUM;
+                ch = *format++;
+                break;
+            case '0':
+                flags |= DP_F_ZERO;
+                ch = *format++;
+                break;
+            default:
+                state = DP_S_MIN;
+                break;
+            }
+            break;
+        case DP_S_MIN:
+            if (isdigit((unsigned char)ch)) {
+                min = 10 * min + char_to_int(ch);
+                ch = *format++;
+            } else if (ch == '*') {
+                min = va_arg(args, int);
+                ch = *format++;
+                state = DP_S_DOT;
+            } else
+                state = DP_S_DOT;
+            break;
+        case DP_S_DOT:
+            if (ch == '.') {
+                state = DP_S_MAX;
+                ch = *format++;
+            } else
+                state = DP_S_MOD;
+            break;
+        case DP_S_MAX:
+            if (isdigit((unsigned char)ch)) {
+                if (max < 0)
+                    max = 0;
+                max = 10 * max + char_to_int(ch);
+                ch = *format++;
+            } else if (ch == '*') {
+                max = va_arg(args, int);
+                ch = *format++;
+                state = DP_S_MOD;
+            } else
+                state = DP_S_MOD;
+            break;
+        case DP_S_MOD:
+            switch (ch) {
+            case 'h':
+                cflags = DP_C_SHORT;
+                ch = *format++;
+                break;
+            case 'l':
+                if (*format == 'l') {
+                    cflags = DP_C_LLONG;
+                    format++;
+                } else
+                    cflags = DP_C_LONG;
+                ch = *format++;
+                break;
+            case 'q':
+                cflags = DP_C_LLONG;
+                ch = *format++;
+                break;
+            case 'L':
+                cflags = DP_C_LDOUBLE;
+                ch = *format++;
+                break;
+            default:
+                break;
+            }
+            state = DP_S_CONV;
+            break;
+        case DP_S_CONV:
+            switch (ch) {
+            case 'd':
+            case 'i':
+                switch (cflags) {
+                case DP_C_SHORT:
+                    value = (short int)va_arg(args, int);
+                    break;
+                case DP_C_LONG:
+                    value = va_arg(args, long int);
+                    break;
+                case DP_C_LLONG:
+                    value = va_arg(args, LLONG);
+                    break;
+                default:
+                    value = va_arg(args, int);
+                    break;
+                }
+                fmtint(buffer, &currlen, maxlen, value, 10, min, max, flags);
+                break;
+            case 'X':
+                flags |= DP_F_UP;
+                /* FALLTHROUGH */
+            case 'x':
+            case 'o':
+            case 'u':
+                flags |= DP_F_UNSIGNED;
+                switch (cflags) {
+                case DP_C_SHORT:
+                    value = (unsigned short int)va_arg(args, unsigned int);
+                    break;
+                case DP_C_LONG:
+                    value = (LLONG) va_arg(args,
+                        unsigned long int);
+                    break;
+                case DP_C_LLONG:
+                    value = va_arg(args, unsigned LLONG);
+                    break;
+                default:
+                    value = (LLONG) va_arg(args,
+                        unsigned int);
+                    break;
+                }
+                fmtint(buffer, &currlen, maxlen, value,
+                       ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),
+                       min, max, flags);
+                break;
+            case 'f':
+                if (cflags == DP_C_LDOUBLE)
+                    fvalue = va_arg(args, LDOUBLE);
+                else
+                    fvalue = va_arg(args, double);
+                fmtfp(buffer, &currlen, maxlen, fvalue, min, max, flags);
+                break;
+            case 'E':
+                flags |= DP_F_UP;
+            case 'e':
+                if (cflags == DP_C_LDOUBLE)
+                    fvalue = va_arg(args, LDOUBLE);
+                else
+                    fvalue = va_arg(args, double);
+                break;
+            case 'G':
+                flags |= DP_F_UP;
+            case 'g':
+                if (cflags == DP_C_LDOUBLE)
+                    fvalue = va_arg(args, LDOUBLE);
+                else
+                    fvalue = va_arg(args, double);
+                break;
+            case 'c':
+                dopr_outch(buffer, &currlen, maxlen,
+                    va_arg(args, int));
+                break;
+            case 's':
+                strvalue = va_arg(args, char *);
+                if (max < 0)
+                    max = maxlen;
+                fmtstr(buffer, &currlen, maxlen, strvalue,
+                    flags, min, max);
+                break;
+            case 'p':
+                value = (long)va_arg(args, void *);
+                fmtint(buffer, &currlen, maxlen,
+                    value, 16, min, max, flags);
+                break;
+            case 'n': /* XXX */
+                if (cflags == DP_C_SHORT) {
+                    short int *num;
+                    num = va_arg(args, short int *);
+                    *num = currlen;
+                } else if (cflags == DP_C_LONG) { /* XXX */
+                    long int *num;
+                    num = va_arg(args, long int *);
+                    *num = (long int) currlen;
+                } else if (cflags == DP_C_LLONG) { /* XXX */
+                    LLONG *num;
+                    num = va_arg(args, LLONG *);
+                    *num = (LLONG) currlen;
+                } else {
+                    int    *num;
+                    num = va_arg(args, int *);
+                    *num = currlen;
+                }
+                break;
+            case '%':
+                dopr_outch(buffer, &currlen, maxlen, ch);
+                break;
+            case 'w':
+                /* not supported yet, treat as next char */
+                ch = *format++;
+                break;
+            default:
+                /* unknown, skip */
+                break;
+            }
+            ch = *format++;
+            state = DP_S_DEFAULT;
+            flags = cflags = min = 0;
+            max = -1;
+            break;
+        case DP_S_DONE:
+            break;
+        default:
+            break;
+        }
+    }
+    if (currlen >= maxlen - 1)
+        currlen = maxlen - 1;
+    buffer[currlen] = '\0';
+    *retlen = currlen;
+    return;
+}
+
+static void
+fmtstr(
+    char *buffer,
+    size_t *currlen,
+    size_t maxlen,
+    char *value,
+    int flags,
+    int min,
+    int max)
+{
+    int padlen, strln;
+    int cnt = 0;
+
+    if (value == 0)
+        value = "<NULL>";
+    for (strln = 0; value[strln]; ++strln)
+        ;
+    padlen = min - strln;
+    if (padlen < 0)
+        padlen = 0;
+    if (flags & DP_F_MINUS)
+        padlen = -padlen;
+
+    while ((padlen > 0) && (cnt < max)) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        --padlen;
+        ++cnt;
+    }
+    while (*value && (cnt < max)) {
+        dopr_outch(buffer, currlen, maxlen, *value++);
+        ++cnt;
+    }
+    while ((padlen < 0) && (cnt < max)) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        ++padlen;
+        ++cnt;
+    }
+}
+
+static void
+fmtint(
+    char *buffer,
+    size_t *currlen,
+    size_t maxlen,
+    LLONG value,
+    int base,
+    int min,
+    int max,
+    int flags)
+{
+    int signvalue = 0;
+    unsigned LLONG uvalue;
+    char convert[20];
+    int place = 0;
+    int spadlen = 0;
+    int zpadlen = 0;
+    int caps = 0;
+
+    if (max < 0)
+        max = 0;
+    uvalue = value;
+    if (!(flags & DP_F_UNSIGNED)) {
+        if (value < 0) {
+            signvalue = '-';
+            uvalue = -value;
+        } else if (flags & DP_F_PLUS)
+            signvalue = '+';
+        else if (flags & DP_F_SPACE)
+            signvalue = ' ';
+    }
+    if (flags & DP_F_UP)
+        caps = 1;
+    do {
+        convert[place++] =
+            (caps ? "0123456789ABCDEF" : "0123456789abcdef")
+            [uvalue % (unsigned) base];
+        uvalue = (uvalue / (unsigned) base);
+    } while (uvalue && (place < 20));
+    if (place == 20)
+        place--;
+    convert[place] = 0;
+
+    zpadlen = max - place;
+    spadlen = min - MAX(max, place) - (signvalue ? 1 : 0);
+    if (zpadlen < 0)
+        zpadlen = 0;
+    if (spadlen < 0)
+        spadlen = 0;
+    if (flags & DP_F_ZERO) {
+        zpadlen = MAX(zpadlen, spadlen);
+        spadlen = 0;
+    }
+    if (flags & DP_F_MINUS)
+        spadlen = -spadlen;
+
+    /* spaces */
+    while (spadlen > 0) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        --spadlen;
+    }
+
+    /* sign */
+    if (signvalue)
+        dopr_outch(buffer, currlen, maxlen, signvalue);
+
+    /* zeros */
+    if (zpadlen > 0) {
+        while (zpadlen > 0) {
+            dopr_outch(buffer, currlen, maxlen, '0');
+            --zpadlen;
+        }
+    }
+    /* digits */
+    while (place > 0)
+        dopr_outch(buffer, currlen, maxlen, convert[--place]);
+
+    /* left justified spaces */
+    while (spadlen < 0) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        ++spadlen;
+    }
+    return;
+}
+
+static LDOUBLE
+abs_val(LDOUBLE value)
+{
+    LDOUBLE result = value;
+    if (value < 0)
+        result = -value;
+    return result;
+}
+
+static LDOUBLE
+pow10(int exp)
+{
+    LDOUBLE result = 1;
+    while (exp) {
+        result *= 10;
+        exp--;
+    }
+    return result;
+}
+
+static long
+round(LDOUBLE value)
+{
+    long intpart;
+    intpart = (long) value;
+    value = value - intpart;
+    if (value >= 0.5)
+        intpart++;
+    return intpart;
+}
+
+static void
+fmtfp(
+    char *buffer,
+    size_t *currlen,
+    size_t maxlen,
+    LDOUBLE fvalue,
+    int min,
+    int max,
+    int flags)
+{
+    int signvalue = 0;
+    LDOUBLE ufvalue;
+    char iconvert[20];
+    char fconvert[20];
+    int iplace = 0;
+    int fplace = 0;
+    int padlen = 0;
+    int zpadlen = 0;
+    int caps = 0;
+    long intpart;
+    long fracpart;
+
+    if (max < 0)
+        max = 6;
+    ufvalue = abs_val(fvalue);
+    if (fvalue < 0)
+        signvalue = '-';
+    else if (flags & DP_F_PLUS)
+        signvalue = '+';
+    else if (flags & DP_F_SPACE)
+        signvalue = ' ';
+
+    intpart = (long)ufvalue;
+
+    /* sorry, we only support 9 digits past the decimal because of our
+       conversion method */
+    if (max > 9)
+        max = 9;
+
+    /* we "cheat" by converting the fractional part to integer by
+       multiplying by a factor of 10 */
+    fracpart = round((pow10(max)) * (ufvalue - intpart));
+
+    if (fracpart >= pow10(max)) {
+        intpart++;
+        fracpart -= (long)pow10(max);
+    }
+
+    /* convert integer part */
+    do {
+        iconvert[iplace++] =
+            (caps ? "0123456789ABCDEF"
+              : "0123456789abcdef")[intpart % 10];
+        intpart = (intpart / 10);
+    } while (intpart && (iplace < 20));
+    if (iplace == 20)
+        iplace--;
+    iconvert[iplace] = 0;
+
+    /* convert fractional part */
+    do {
+        fconvert[fplace++] =
+            (caps ? "0123456789ABCDEF"
+              : "0123456789abcdef")[fracpart % 10];
+        fracpart = (fracpart / 10);
+    } while (fracpart && (fplace < 20));
+    if (fplace == 20)
+        fplace--;
+    fconvert[fplace] = 0;
+
+    /* -1 for decimal point, another -1 if we are printing a sign */
+    padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0);
+    zpadlen = max - fplace;
+    if (zpadlen < 0)
+        zpadlen = 0;
+    if (padlen < 0)
+        padlen = 0;
+    if (flags & DP_F_MINUS)
+        padlen = -padlen;
+
+    if ((flags & DP_F_ZERO) && (padlen > 0)) {
+        if (signvalue) {
+            dopr_outch(buffer, currlen, maxlen, signvalue);
+            --padlen;
+            signvalue = 0;
+        }
+        while (padlen > 0) {
+            dopr_outch(buffer, currlen, maxlen, '0');
+            --padlen;
+        }
+    }
+    while (padlen > 0) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        --padlen;
+    }
+    if (signvalue)
+        dopr_outch(buffer, currlen, maxlen, signvalue);
+
+    while (iplace > 0)
+        dopr_outch(buffer, currlen, maxlen, iconvert[--iplace]);
+
+    /*
+     * Decimal point. This should probably use locale to find the correct
+     * char to print out.
+     */
+    if (max > 0) {
+        dopr_outch(buffer, currlen, maxlen, '.');
+
+        while (fplace > 0)
+            dopr_outch(buffer, currlen, maxlen, fconvert[--fplace]);
+    }
+    while (zpadlen > 0) {
+        dopr_outch(buffer, currlen, maxlen, '0');
+        --zpadlen;
+    }
+
+    while (padlen < 0) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        ++padlen;
+    }
+}
+
+static void
+dopr_outch(
+    char *buffer,
+    size_t *currlen,
+    size_t maxlen,
+    int c)
+{
+    if (*currlen < maxlen)
+        buffer[(*currlen)++] = (char)c;
+    return;
+}
diff --git a/src/lib/libcrypto/bio/b_sock.c b/src/lib/libcrypto/bio/b_sock.c
index d29b29ff8b..6409f98f57 100644
--- a/src/lib/libcrypto/bio/b_sock.c
+++ b/src/lib/libcrypto/bio/b_sock.c
@@ -163,7 +163,14 @@ int BIO_get_port(const char *str, unsigned short *port_ptr)
         else
                 {
                 CRYPTO_w_lock(CRYPTO_LOCK_GETSERVBYNAME);
-                s=getservbyname(str,"tcp");
+                /* Note: under VMS with SOCKETSHR, it seems like the first
+                 * parameter is 'char *', instead of 'const char *'
+                 */
+                s=getservbyname(
+#ifndef CONST_STRICT
+                    (char *)
+#endif
+                    str,"tcp");
                 if(s != NULL)
                         *port_ptr=ntohs((unsigned short)s->s_port);
                 CRYPTO_w_unlock(CRYPTO_LOCK_GETSERVBYNAME);
@@ -282,12 +289,12 @@ static struct hostent *ghbn_dup(struct hostent *a)
 
         j=strlen(a->h_name)+1;
         if ((ret->h_name=Malloc(j)) == NULL) goto err;
-        memcpy((char *)ret->h_name,a->h_name,j+1);
+        memcpy((char *)ret->h_name,a->h_name,j);
         for (i=0; a->h_aliases[i] != NULL; i++)
                 {
                 j=strlen(a->h_aliases[i])+1;
                 if ((ret->h_aliases[i]=Malloc(j)) == NULL) goto err;
-                memcpy(ret->h_aliases[i],a->h_aliases[i],j+1);
+                memcpy(ret->h_aliases[i],a->h_aliases[i],j);
                 }
         ret->h_length=a->h_length;
         ret->h_addrtype=a->h_addrtype;
@@ -327,7 +334,7 @@ static void ghbn_free(struct hostent *a)
                         Free(a->h_addr_list[i]);
                 Free(a->h_addr_list);
                 }
-        if (a->h_name != NULL) Free((char *)a->h_name);
+        if (a->h_name != NULL) Free(a->h_name);
         Free(a);
         }
 
@@ -368,7 +375,14 @@ struct hostent *BIO_gethostbyname(const char *name)
         if (i == GHBN_NUM) /* no hit*/
                 {
                 BIO_ghbn_miss++;
-                ret=gethostbyname(name);
+                /* Note: under VMS with SOCKETSHR, it seems like the first
+                 * parameter is 'char *', instead of 'const char *'
+                 */
+                ret=gethostbyname(
+#ifndef CONST_STRICT
+                    (char *)
+#endif
+                    name);
 
                 if (ret == NULL)
                         goto end;
diff --git a/src/lib/libcrypto/bio/bf_buff.c b/src/lib/libcrypto/bio/bf_buff.c
index acd8148138..ff0c9070ae 100644
--- a/src/lib/libcrypto/bio/bf_buff.c
+++ b/src/lib/libcrypto/bio/bf_buff.c
@@ -69,6 +69,7 @@ static int buffer_gets(BIO *h,char *str,int size);
 static long buffer_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int buffer_new(BIO *h);
 static int buffer_free(BIO *data);
+static long buffer_callback_ctrl(BIO *h,int cmd, void (*fp)());
 #define DEFAULT_BUFFER_SIZE     1024
 
 static BIO_METHOD methods_buffer=
@@ -82,6 +83,7 @@ static BIO_METHOD methods_buffer=
         buffer_ctrl,
         buffer_new,
         buffer_free,
+        buffer_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_buffer(void)
@@ -284,6 +286,7 @@ static long buffer_ctrl(BIO *b, int cmd, long num, char *ptr)
                 ctx->ibuf_len=0;
                 ctx->obuf_off=0;
                 ctx->obuf_len=0;
+                if (b->next_bio == NULL) return(0);
                 ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
                 break;
         case BIO_CTRL_INFO:
@@ -300,12 +303,18 @@ static long buffer_ctrl(BIO *b, int cmd, long num, char *ptr)
         case BIO_CTRL_WPENDING:
                 ret=(long)ctx->obuf_len;
                 if (ret == 0)
+                        {
+                        if (b->next_bio == NULL) return(0);
                         ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
+                        }
                 break;
         case BIO_CTRL_PENDING:
                 ret=(long)ctx->ibuf_len;
                 if (ret == 0)
+                        {
+                        if (b->next_bio == NULL) return(0);
                         ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
+                        }
                 break;
         case BIO_C_SET_BUFF_READ_DATA:
                 if (num > ctx->ibuf_size)
@@ -374,12 +383,14 @@ static long buffer_ctrl(BIO *b, int cmd, long num, char *ptr)
                         }
                 break;
         case BIO_C_DO_STATE_MACHINE:
+                if (b->next_bio == NULL) return(0);
                 BIO_clear_retry_flags(b);
                 ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
                 BIO_copy_next_retry(b);
                 break;
 
         case BIO_CTRL_FLUSH:
+                if (b->next_bio == NULL) return(0);
                 if (ctx->obuf_len <= 0)
                         {
                         ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
@@ -418,6 +429,7 @@ fprintf(stderr,"FLUSH [%3d] %3d -> %3d\n",ctx->obuf_off,ctx->obuf_len-ctx->obuf_
                         ret=0;
                 break;
         default:
+                if (b->next_bio == NULL) return(0);
                 ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
                 break;
                 }
@@ -427,6 +439,20 @@ malloc_error:
         return(0);
         }
 
+static long buffer_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int buffer_gets(BIO *b, char *buf, int size)
         {
         BIO_F_BUFFER_CTX *ctx;
diff --git a/src/lib/libcrypto/bio/bf_nbio.c b/src/lib/libcrypto/bio/bf_nbio.c
index cbec2bae29..5e574b7231 100644
--- a/src/lib/libcrypto/bio/bf_nbio.c
+++ b/src/lib/libcrypto/bio/bf_nbio.c
@@ -73,6 +73,7 @@ static int nbiof_gets(BIO *h,char *str,int size);
 static long nbiof_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int nbiof_new(BIO *h);
 static int nbiof_free(BIO *data);
+static long nbiof_callback_ctrl(BIO *h,int cmd,void (*fp)());
 typedef struct nbio_test_st
         {
         /* only set if we sent a 'should retry' error */
@@ -91,6 +92,7 @@ static BIO_METHOD methods_nbiof=
         nbiof_ctrl,
         nbiof_new,
         nbiof_free,
+        nbiof_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_nbio_test(void)
@@ -137,7 +139,7 @@ static int nbiof_read(BIO *b, char *out, int outl)
 
         BIO_clear_retry_flags(b);
 #if 0
-        RAND_bytes(&n,1);
+        RAND_pseudo_bytes(&n,1);
         num=(n&0x07);
 
         if (outl > num) outl=num;
@@ -178,7 +180,7 @@ static int nbiof_write(BIO *b, char *in, int inl)
                 }
         else
                 {
-                RAND_bytes(&n,1);
+                RAND_pseudo_bytes(&n,1);
                 num=(n&7);
                 }
 
@@ -224,6 +226,20 @@ static long nbiof_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long nbiof_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int nbiof_gets(BIO *bp, char *buf, int size)
         {
         if (bp->next_bio == NULL) return(0);
diff --git a/src/lib/libcrypto/bio/bf_null.c b/src/lib/libcrypto/bio/bf_null.c
index 3254a55dce..0d183a6d9a 100644
--- a/src/lib/libcrypto/bio/bf_null.c
+++ b/src/lib/libcrypto/bio/bf_null.c
@@ -72,6 +72,7 @@ static int nullf_gets(BIO *h,char *str,int size);
 static long nullf_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int nullf_new(BIO *h);
 static int nullf_free(BIO *data);
+static long nullf_callback_ctrl(BIO *h,int cmd,void (*fp)());
 static BIO_METHOD methods_nullf=
         {
         BIO_TYPE_NULL_FILTER,
@@ -83,6 +84,7 @@ static BIO_METHOD methods_nullf=
         nullf_ctrl,
         nullf_new,
         nullf_free,
+        nullf_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_null(void)
@@ -152,6 +154,20 @@ static long nullf_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long nullf_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int nullf_gets(BIO *bp, char *buf, int size)
         {
         if (bp->next_bio == NULL) return(0);
diff --git a/src/lib/libcrypto/bio/bio.h b/src/lib/libcrypto/bio/bio.h
index 54bf622a3b..bc08401eeb 100644
--- a/src/lib/libcrypto/bio/bio.h
+++ b/src/lib/libcrypto/bio/bio.h
@@ -76,7 +76,7 @@ extern "C" {
 #define BIO_TYPE_SOCKET         (5|0x0400|0x0100)
 #define BIO_TYPE_NULL           (6|0x0400)
 #define BIO_TYPE_SSL            (7|0x0200)
-#define BIO_TYPE_MD             (8|0x0200)              /* pasive filter */
+#define BIO_TYPE_MD             (8|0x0200)              /* passive filter */
 #define BIO_TYPE_BUFFER         (9|0x0200)              /* filter */
 #define BIO_TYPE_CIPHER         (10|0x0200)             /* filter */
 #define BIO_TYPE_BASE64         (11|0x0200)             /* filter */
@@ -147,6 +147,11 @@ extern "C" {
 
 #define BIO_FLAGS_BASE64_NO_NL  0x100
 
+/* This is used with memory BIOs: it means we shouldn't free up or change the
+ * data in any way.
+ */
+#define BIO_FLAGS_MEM_RDONLY    0x200
+
 #define BIO_set_flags(b,f) ((b)->flags|=(f))
 #define BIO_get_flags(b) ((b)->flags)
 #define BIO_set_retry_special(b) \
@@ -163,7 +168,7 @@ extern "C" {
 #define BIO_get_retry_flags(b) \
                 ((b)->flags&(BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY))
 
-/* These shouldbe used by the application to tell why we should retry */
+/* These should be used by the application to tell why we should retry */
 #define BIO_should_read(a)              ((a)->flags & BIO_FLAGS_READ)
 #define BIO_should_write(a)             ((a)->flags & BIO_FLAGS_WRITE)
 #define BIO_should_io_special(a)        ((a)->flags & BIO_FLAGS_IO_SPECIAL)
@@ -214,6 +219,7 @@ typedef struct bio_method_st
         long (*ctrl)();
         int (*create)();
         int (*destroy)();
+        long (*callback_ctrl)();
         } BIO_METHOD;
 #else
 typedef struct bio_method_st
@@ -227,6 +233,7 @@ typedef struct bio_method_st
         long (_far *ctrl)();
         int (_far *create)();
         int (_far *destroy)();
+        long (_fat *callback_ctrl)();
         } BIO_METHOD;
 #endif
 
@@ -278,9 +285,6 @@ typedef struct bio_f_buffer_ctx_struct
 #define BIO_CONN_S_NBIO                 8
 /*#define BIO_CONN_get_param_hostname   BIO_ctrl */
 
-#define BIO_number_read(b)      ((b)->num_read)
-#define BIO_number_written(b)   ((b)->num_write)
-
 #define BIO_C_SET_CONNECT                       100
 #define BIO_C_DO_STATE_MACHINE                  101
 #define BIO_C_SET_NBIO                          102
@@ -325,9 +329,14 @@ typedef struct bio_f_buffer_ctx_struct
 #define BIO_C_GET_WRITE_GUARANTEE               140
 #define BIO_C_GET_READ_REQUEST                  141
 #define BIO_C_SHUTDOWN_WR                       142
+#define BIO_C_NREAD0                            143
+#define BIO_C_NREAD                             144
+#define BIO_C_NWRITE0                           145
+#define BIO_C_NWRITE                            146
+#define BIO_C_RESET_READ_REQUEST                147
 
 
-#define BIO_set_app_data(s,arg)         BIO_set_ex_data(s,0,(char *)arg)
+#define BIO_set_app_data(s,arg)         BIO_set_ex_data(s,0,arg)
 #define BIO_get_app_data(s)             BIO_get_ex_data(s,0)
 
 /* BIO_s_connect() and BIO_s_socks4a_connect() */
@@ -366,7 +375,7 @@ typedef struct bio_f_buffer_ctx_struct
 /* BIO_set_nbio(b,n) */
 #define BIO_set_filter_bio(b,s) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,2,(char *)(s))
 /* BIO *BIO_get_filter_bio(BIO *bio); */
-#define BIO_set_proxy_cb(b,cb) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,3,(char *)(cb))
+#define BIO_set_proxy_cb(b,cb) BIO_callback_ctrl(b,BIO_C_SET_PROXY_PARAM,3,(void *(*cb)()))
 #define BIO_set_proxy_header(b,sk) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,4,(char *)sk)
 #define BIO_set_no_connect_return(b,bool) BIO_int_ctrl(b,BIO_C_SET_PROXY_PARAM,5,bool)
 
@@ -445,8 +454,8 @@ int BIO_read_filename(BIO *b,const char *name);
 size_t BIO_ctrl_pending(BIO *b);
 size_t BIO_ctrl_wpending(BIO *b);
 #define BIO_flush(b)            (int)BIO_ctrl(b,BIO_CTRL_FLUSH,0,NULL)
-#define BIO_get_info_callback(b,cbp) (int)BIO_ctrl(b,BIO_CTRL_GET_CALLBACK,0,(char *)cbp)
-#define BIO_set_info_callback(b,cb) (int)BIO_ctrl(b,BIO_CTRL_SET_CALLBACK,0,(char *)cb)
+#define BIO_get_info_callback(b,cbp) (int)BIO_ctrl(b,BIO_CTRL_GET_CALLBACK,0,(void (**)())(cbp))
+#define BIO_set_info_callback(b,cb) (int)BIO_callback_ctrl(b,BIO_CTRL_SET_CALLBACK,(void (*)())(cb))
 
 /* For the BIO_f_buffer() type */
 #define BIO_buffer_get_num_lines(b) BIO_ctrl(b,BIO_CTRL_GET,0,NULL)
@@ -461,8 +470,7 @@ size_t BIO_ctrl_wpending(BIO *b);
 #define BIO_get_read_request(b)    (int)BIO_ctrl(b,BIO_C_GET_READ_REQUEST,0,NULL)
 size_t BIO_ctrl_get_write_guarantee(BIO *b);
 size_t BIO_ctrl_get_read_request(BIO *b);
-
-
+int BIO_ctrl_reset_read_request(BIO *b);
 
 #ifdef NO_STDIO
 #define NO_FP_API
@@ -472,10 +480,12 @@ size_t BIO_ctrl_get_read_request(BIO *b);
 /* These two aren't currently implemented */
 /* int BIO_get_ex_num(BIO *bio); */
 /* void BIO_set_ex_free_func(BIO *bio,int idx,void (*cb)()); */
-int BIO_set_ex_data(BIO *bio,int idx,char *data);
-char *BIO_get_ex_data(BIO *bio,int idx);
-int BIO_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int BIO_set_ex_data(BIO *bio,int idx,void *data);
+void *BIO_get_ex_data(BIO *bio,int idx);
+int BIO_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+unsigned long BIO_number_read(BIO *bio);
+unsigned long BIO_number_written(BIO *bio);
 
 #  if defined(WIN16) && defined(_WINDLL)
 BIO_METHOD *BIO_s_file_internal(void);
@@ -500,6 +510,7 @@ int	BIO_gets(BIO *bp,char *buf, int size);
 int     BIO_write(BIO *b, const char *data, int len);
 int     BIO_puts(BIO *bp,const char *buf);
 long    BIO_ctrl(BIO *bp,int cmd,long larg,void *parg);
+long    BIO_callback_ctrl(BIO *bp,int cmd,void (*fp)());
 char *  BIO_ptr_ctrl(BIO *bp,int cmd,long larg);
 long    BIO_int_ctrl(BIO *bp,int cmd,long larg,int iarg);
 BIO *   BIO_push(BIO *b,BIO *append);
@@ -510,6 +521,11 @@ BIO *	BIO_get_retry_BIO(BIO *bio, int *reason);
 int     BIO_get_retry_reason(BIO *bio);
 BIO *   BIO_dup_chain(BIO *in);
 
+int BIO_nread0(BIO *bio, char **buf);
+int BIO_nread(BIO *bio, char **buf, int num);
+int BIO_nwrite0(BIO *bio, char **buf);
+int BIO_nwrite(BIO *bio, char **buf, int num);
+
 #ifndef WIN16
 long BIO_debug_callback(BIO *bio,int cmd,const char *argp,int argi,
         long argl,long ret);
@@ -519,6 +535,7 @@ long _far _loadds BIO_debug_callback(BIO *bio,int cmd,const char *argp,int argi,
 #endif
 
 BIO_METHOD *BIO_s_mem(void);
+BIO *BIO_new_mem_buf(void *buf, int len);
 BIO_METHOD *BIO_s_socket(void);
 BIO_METHOD *BIO_s_connect(void);
 BIO_METHOD *BIO_s_accept(void);
@@ -597,11 +614,17 @@ int BIO_printf(BIO *bio, ...);
 #define BIO_F_BIO_MAKE_PAIR                              121
 #define BIO_F_BIO_NEW                                    108
 #define BIO_F_BIO_NEW_FILE                               109
+#define BIO_F_BIO_NEW_MEM_BUF                            126
+#define BIO_F_BIO_NREAD                                  123
+#define BIO_F_BIO_NREAD0                                 124
+#define BIO_F_BIO_NWRITE                                 125
+#define BIO_F_BIO_NWRITE0                                122
 #define BIO_F_BIO_PUTS                                   110
 #define BIO_F_BIO_READ                                   111
 #define BIO_F_BIO_SOCK_INIT                              112
 #define BIO_F_BIO_WRITE                                  113
 #define BIO_F_BUFFER_CTRL                                114
+#define BIO_F_CONN_CTRL                                  127
 #define BIO_F_CONN_STATE                                 115
 #define BIO_F_FILE_CTRL                                  116
 #define BIO_F_MEM_WRITE                                  117
@@ -634,6 +657,7 @@ int BIO_printf(BIO *bio, ...);
 #define BIO_R_UNABLE_TO_LISTEN_SOCKET                    119
 #define BIO_R_UNINITIALIZED                              120
 #define BIO_R_UNSUPPORTED_METHOD                         121
+#define BIO_R_WRITE_TO_READ_ONLY_BIO                     126
 #define BIO_R_WSASTARTUP                                 122
 
 #ifdef  __cplusplus
diff --git a/src/lib/libcrypto/bio/bio_err.c b/src/lib/libcrypto/bio/bio_err.c
index 712d98a3a1..b5f07de5a0 100644
--- a/src/lib/libcrypto/bio/bio_err.c
+++ b/src/lib/libcrypto/bio/bio_err.c
@@ -77,11 +77,17 @@ static ERR_STRING_DATA BIO_str_functs[]=
 {ERR_PACK(0,BIO_F_BIO_MAKE_PAIR,0),     "BIO_MAKE_PAIR"},
 {ERR_PACK(0,BIO_F_BIO_NEW,0),   "BIO_new"},
 {ERR_PACK(0,BIO_F_BIO_NEW_FILE,0),      "BIO_new_file"},
+{ERR_PACK(0,BIO_F_BIO_NEW_MEM_BUF,0),   "BIO_new_mem_buf"},
+{ERR_PACK(0,BIO_F_BIO_NREAD,0), "BIO_nread"},
+{ERR_PACK(0,BIO_F_BIO_NREAD0,0),        "BIO_nread0"},
+{ERR_PACK(0,BIO_F_BIO_NWRITE,0),        "BIO_nwrite"},
+{ERR_PACK(0,BIO_F_BIO_NWRITE0,0),       "BIO_nwrite0"},
 {ERR_PACK(0,BIO_F_BIO_PUTS,0),  "BIO_puts"},
 {ERR_PACK(0,BIO_F_BIO_READ,0),  "BIO_read"},
 {ERR_PACK(0,BIO_F_BIO_SOCK_INIT,0),     "BIO_sock_init"},
 {ERR_PACK(0,BIO_F_BIO_WRITE,0), "BIO_write"},
 {ERR_PACK(0,BIO_F_BUFFER_CTRL,0),       "BUFFER_CTRL"},
+{ERR_PACK(0,BIO_F_CONN_CTRL,0), "CONN_CTRL"},
 {ERR_PACK(0,BIO_F_CONN_STATE,0),        "CONN_STATE"},
 {ERR_PACK(0,BIO_F_FILE_CTRL,0), "FILE_CTRL"},
 {ERR_PACK(0,BIO_F_MEM_WRITE,0), "MEM_WRITE"},
@@ -117,6 +123,7 @@ static ERR_STRING_DATA BIO_str_reasons[]=
 {BIO_R_UNABLE_TO_LISTEN_SOCKET           ,"unable to listen socket"},
 {BIO_R_UNINITIALIZED                     ,"uninitialized"},
 {BIO_R_UNSUPPORTED_METHOD                ,"unsupported method"},
+{BIO_R_WRITE_TO_READ_ONLY_BIO            ,"write to read only bio"},
 {BIO_R_WSASTARTUP                        ,"wsastartup"},
 {0,NULL}
         };
diff --git a/src/lib/libcrypto/bio/bio_lib.c b/src/lib/libcrypto/bio/bio_lib.c
index b72688ea90..cf8e6150fd 100644
--- a/src/lib/libcrypto/bio/bio_lib.c
+++ b/src/lib/libcrypto/bio/bio_lib.c
@@ -63,7 +63,7 @@
 #include <openssl/bio.h>
 #include <openssl/stack.h>
 
-static STACK *bio_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *bio_meth=NULL;
 static int bio_meth_num=0;
 
 BIO *BIO_new(BIO_METHOD *method)
@@ -100,7 +100,7 @@ int BIO_set(BIO *bio, BIO_METHOD *method)
         bio->references=1;
         bio->num_read=0L;
         bio->num_write=0L;
-        CRYPTO_new_ex_data(bio_meth,(char *)bio,&bio->ex_data);
+        CRYPTO_new_ex_data(bio_meth,bio,&bio->ex_data);
         if (method->create != NULL)
                 if (!method->create(bio))
                         return(0);
@@ -129,7 +129,7 @@ int BIO_free(BIO *a)
                 ((i=(int)a->callback(a,BIO_CB_FREE,NULL,0,0L,1L)) <= 0))
                         return(i);
 
-        CRYPTO_free_ex_data(bio_meth,(char *)a,&a->ex_data);
+        CRYPTO_free_ex_data(bio_meth,a,&a->ex_data);
 
         if ((a->method == NULL) || (a->method->destroy == NULL)) return(1);
         ret=a->method->destroy(a);
@@ -317,16 +317,43 @@ long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
         return(ret);
         }
 
+long BIO_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret;
+        long (*cb)();
+
+        if (b == NULL) return(0);
+
+        if ((b->method == NULL) || (b->method->callback_ctrl == NULL))
+                {
+                BIOerr(BIO_F_BIO_CTRL,BIO_R_UNSUPPORTED_METHOD);
+                return(-2);
+                }
+
+        cb=b->callback;
+
+        if ((cb != NULL) &&
+                ((ret=cb(b,BIO_CB_CTRL,(void *)&fp,cmd,0,1L)) <= 0))
+                return(ret);
+
+        ret=b->method->callback_ctrl(b,cmd,fp);
+
+        if (cb != NULL)
+                ret=cb(b,BIO_CB_CTRL|BIO_CB_RETURN,(void *)&fp,cmd,
+                        0,ret);
+        return(ret);
+        }
+
 /* It is unfortunate to duplicate in functions what the BIO_(w)pending macros
  * do; but those macros have inappropriate return type, and for interfacing
  * from other programming languages, C macros aren't much of a help anyway. */
 size_t BIO_ctrl_pending(BIO *bio)
-    {
+        {
         return BIO_ctrl(bio, BIO_CTRL_PENDING, 0, NULL);
         }
 
 size_t BIO_ctrl_wpending(BIO *bio)
-    {
+        {
         return BIO_ctrl(bio, BIO_CTRL_WPENDING, 0, NULL);
         }
 
@@ -476,21 +503,32 @@ void BIO_copy_next_retry(BIO *b)
         b->retry_reason=b->next_bio->retry_reason;
         }
 
-int BIO_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-             int (*dup_func)(), void (*free_func)())
+int BIO_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         bio_meth_num++;
         return(CRYPTO_get_ex_new_index(bio_meth_num-1,&bio_meth,
                 argl,argp,new_func,dup_func,free_func));
         }
 
-int BIO_set_ex_data(BIO *bio, int idx, char *data)
+int BIO_set_ex_data(BIO *bio, int idx, void *data)
         {
         return(CRYPTO_set_ex_data(&(bio->ex_data),idx,data));
         }
 
-char *BIO_get_ex_data(BIO *bio, int idx)
+void *BIO_get_ex_data(BIO *bio, int idx)
         {
         return(CRYPTO_get_ex_data(&(bio->ex_data),idx));
         }
 
+unsigned long BIO_number_read(BIO *bio)
+{
+        if(bio) return bio->num_read;
+        return 0;
+}
+
+unsigned long BIO_number_written(BIO *bio)
+{
+        if(bio) return bio->num_write;
+        return 0;
+}
diff --git a/src/lib/libcrypto/bio/bss_acpt.c b/src/lib/libcrypto/bio/bss_acpt.c
index 47af80f76d..9afa636406 100644
--- a/src/lib/libcrypto/bio/bss_acpt.c
+++ b/src/lib/libcrypto/bio/bss_acpt.c
@@ -118,6 +118,7 @@ static BIO_METHOD methods_acceptp=
         acpt_ctrl,
         acpt_new,
         acpt_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_accept(void)
diff --git a/src/lib/libcrypto/bio/bss_bio.c b/src/lib/libcrypto/bio/bss_bio.c
index 562e9d8de2..0d0f9356f7 100644
--- a/src/lib/libcrypto/bio/bss_bio.c
+++ b/src/lib/libcrypto/bio/bss_bio.c
@@ -13,6 +13,7 @@
 #endif
 
 #include <assert.h>
+#include <limits.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -40,7 +41,8 @@ static BIO_METHOD methods_biop =
         NULL /* no bio_gets */,
         bio_ctrl,
         bio_new,
-        bio_free
+        bio_free,
+        NULL /* no bio_callback_ctrl */
 };
 
 BIO_METHOD *BIO_s_bio(void)
@@ -64,7 +66,7 @@ struct bio_bio_st
 
         size_t request; /* valid iff peer != NULL; 0 if len != 0,
                          * otherwise set by peer to number of bytes
-                         * it (unsuccesfully) tried to read,
+                         * it (unsuccessfully) tried to read,
                          * never more than buffer space (size-len) warrants. */
 };
 
@@ -195,6 +197,81 @@ static int bio_read(BIO *bio, char *buf, int size_)
         return size;
         }
 
+/* non-copying interface: provide pointer to available data in buffer
+ *    bio_nread0:  return number of available bytes
+ *    bio_nread:   also advance index
+ * (example usage:  bio_nread0(), read from buffer, bio_nread()
+ *  or just         bio_nread(), read from buffer)
+ */
+/* WARNING: The non-copying interface is largely untested as of yet
+ * and may contain bugs. */
+static size_t bio_nread0(BIO *bio, char **buf)
+        {
+        struct bio_bio_st *b, *peer_b;
+        size_t num;
+        
+        BIO_clear_retry_flags(bio);
+
+        if (!bio->init)
+                return 0;
+        
+        b = bio->ptr;
+        assert(b != NULL);
+        assert(b->peer != NULL);
+        peer_b = b->peer->ptr;
+        assert(peer_b != NULL);
+        assert(peer_b->buf != NULL);
+        
+        peer_b->request = 0;
+        
+        if (peer_b->len == 0)
+                {
+                char dummy;
+                
+                /* avoid code duplication -- nothing available for reading */
+                return bio_read(bio, &dummy, 1); /* returns 0 or -1 */
+                }
+
+        num = peer_b->len;
+        if (peer_b->size < peer_b->offset + num)
+                /* no ring buffer wrap-around for non-copying interface */
+                num = peer_b->size - peer_b->offset;
+        assert(num > 0);
+
+        if (buf != NULL)
+                *buf = peer_b->buf + peer_b->offset;
+        return num;
+        }
+
+static size_t bio_nread(BIO *bio, char **buf, size_t num)
+        {
+        struct bio_bio_st *b, *peer_b;
+        size_t available;
+
+        available = bio_nread0(bio, buf);
+        if (num > available)
+                num = available;
+        if (num == 0)
+                return num;
+
+        b = bio->ptr;
+        peer_b = b->peer->ptr;
+
+        peer_b->len -= num;
+        if (peer_b->len) 
+                {
+                peer_b->offset += num;
+                assert(peer_b->offset <= peer_b->size);
+                if (peer_b->offset == peer_b->size)
+                        peer_b->offset = 0;
+                }
+        else
+                peer_b->offset = 0;
+
+        return num;
+        }
+
+
 static int bio_write(BIO *bio, char *buf, int num_)
         {
         size_t num = num_;
@@ -268,6 +345,78 @@ static int bio_write(BIO *bio, char *buf, int num_)
         return num;
         }
 
+/* non-copying interface: provide pointer to region to write to
+ *   bio_nwrite0:  check how much space is available
+ *   bio_nwrite:   also increase length
+ * (example usage:  bio_nwrite0(), write to buffer, bio_nwrite()
+ *  or just         bio_nwrite(), write to buffer)
+ */
+static size_t bio_nwrite0(BIO *bio, char **buf)
+        {
+        struct bio_bio_st *b;
+        size_t num;
+        size_t write_offset;
+
+        BIO_clear_retry_flags(bio);
+
+        if (!bio->init)
+                return 0;
+
+        b = bio->ptr;           
+        assert(b != NULL);
+        assert(b->peer != NULL);
+        assert(b->buf != NULL);
+
+        b->request = 0;
+        if (b->closed)
+                {
+                BIOerr(BIO_F_BIO_NWRITE0, BIO_R_BROKEN_PIPE);
+                return -1;
+                }
+
+        assert(b->len <= b->size);
+
+        if (b->len == b->size)
+                {
+                BIO_set_retry_write(bio);
+                return -1;
+                }
+
+        num = b->size - b->len;
+        write_offset = b->offset + b->len;
+        if (write_offset >= b->size)
+                write_offset -= b->size;
+        if (write_offset + num > b->size)
+                /* no ring buffer wrap-around for non-copying interface
+                 * (to fulfil the promise by BIO_ctrl_get_write_guarantee,
+                 * BIO_nwrite may have to be called twice) */
+                num = b->size - write_offset;
+
+        if (buf != NULL)
+                *buf = b->buf + write_offset;
+        assert(write_offset + num <= b->size);
+
+        return num;
+        }
+
+static size_t bio_nwrite(BIO *bio, char **buf, size_t num)
+        {
+        struct bio_bio_st *b;
+        size_t space;
+
+        space = bio_nwrite0(bio, buf);
+        if (num > space)
+                num = space;
+        if (num == 0)
+                return num;
+        b = bio->ptr;
+        assert(b != NULL);
+        b->len += num;
+        assert(b->len <= b->size);
+
+        return num;
+        }
+
 
 static long bio_ctrl(BIO *bio, int cmd, long num, void *ptr)
         {
@@ -331,7 +480,7 @@ static long bio_ctrl(BIO *bio, int cmd, long num, void *ptr)
 
         case BIO_C_GET_WRITE_GUARANTEE:
                 /* How many bytes can the caller feed to the next write
-                 * withouth having to keep any? */
+                 * without having to keep any? */
                 if (b->peer == NULL || b->closed)
                         ret = 0;
                 else
@@ -339,18 +488,42 @@ static long bio_ctrl(BIO *bio, int cmd, long num, void *ptr)
                 break;
 
         case BIO_C_GET_READ_REQUEST:
-                /* If the peer unsuccesfully tried to read, how many bytes
+                /* If the peer unsuccessfully tried to read, how many bytes
                  * were requested?  (As with BIO_CTRL_PENDING, that number
                  * can usually be treated as boolean.) */
                 ret = (long) b->request;
                 break;
 
+        case BIO_C_RESET_READ_REQUEST:
+                /* Reset request.  (Can be useful after read attempts
+                 * at the other side that are meant to be non-blocking,
+                 * e.g. when probing SSL_read to see if any data is
+                 * available.) */
+                b->request = 0;
+                ret = 1;
+                break;
+
         case BIO_C_SHUTDOWN_WR:
                 /* similar to shutdown(..., SHUT_WR) */
                 b->closed = 1;
                 ret = 1;
                 break;
 
+        case BIO_C_NREAD:
+                /* non-copying read */
+                ret = (long) bio_nread(bio, ptr, (size_t) num);
+                break;
+                
+        case BIO_C_NWRITE0:
+                /* prepare for non-copying write */
+                ret = (long) bio_nwrite0(bio, ptr);
+                break;
+
+        case BIO_C_NWRITE:
+                /* non-copying write */
+                ret = (long) bio_nwrite(bio, ptr, (size_t) num);
+                break;
+                
 
         /* standard CTRL codes follow */
 
@@ -586,3 +759,78 @@ size_t BIO_ctrl_get_read_request(BIO *bio)
         {
         return BIO_ctrl(bio, BIO_C_GET_READ_REQUEST, 0, NULL);
         }
+
+int BIO_ctrl_reset_read_request(BIO *bio)
+        {
+        return (BIO_ctrl(bio, BIO_C_RESET_READ_REQUEST, 0, NULL) != 0);
+        }
+
+
+/* BIO_nread0/nread/nwrite0/nwrite are available only for BIO pairs for now
+ * (conceivably some other BIOs could allow non-copying reads and writes too.)
+ */
+int BIO_nread0(BIO *bio, char **buf)
+        {
+        long ret;
+
+        if (!bio->init)
+                {
+                BIOerr(BIO_F_BIO_NREAD0, BIO_R_UNINITIALIZED);
+                return -2;
+                }
+
+        ret = BIO_ctrl(bio, BIO_C_NREAD0, 0, buf);
+        if (ret > INT_MAX)
+                return INT_MAX;
+        else
+                return (int) ret;
+        }
+
+int BIO_nread(BIO *bio, char **buf, int num)
+        {
+        int ret;
+
+        if (!bio->init)
+                {
+                BIOerr(BIO_F_BIO_NREAD, BIO_R_UNINITIALIZED);
+                return -2;
+                }
+
+        ret = (int) BIO_ctrl(bio, BIO_C_NREAD, num, buf);
+        if (ret > 0)
+                bio->num_read += ret;
+        return ret;
+        }
+
+int BIO_nwrite0(BIO *bio, char **buf)
+        {
+        long ret;
+
+        if (!bio->init)
+                {
+                BIOerr(BIO_F_BIO_NWRITE0, BIO_R_UNINITIALIZED);
+                return -2;
+                }
+
+        ret = BIO_ctrl(bio, BIO_C_NWRITE0, 0, buf);
+        if (ret > INT_MAX)
+                return INT_MAX;
+        else
+                return (int) ret;
+        }
+
+int BIO_nwrite(BIO *bio, char **buf, int num)
+        {
+        int ret;
+
+        if (!bio->init)
+                {
+                BIOerr(BIO_F_BIO_NWRITE, BIO_R_UNINITIALIZED);
+                return -2;
+                }
+
+        ret = BIO_ctrl(bio, BIO_C_NWRITE, num, buf);
+        if (ret > 0)
+                bio->num_read += ret;
+        return ret;
+        }
diff --git a/src/lib/libcrypto/bio/bss_conn.c b/src/lib/libcrypto/bio/bss_conn.c
index 68c46e3d69..22d00b369e 100644
--- a/src/lib/libcrypto/bio/bss_conn.c
+++ b/src/lib/libcrypto/bio/bss_conn.c
@@ -90,11 +90,11 @@ typedef struct bio_connect_st
         struct sockaddr_in them;
 
         /* int socket; this will be kept in bio->num so that it is
-         * compatable with the bss_sock bio */ 
+         * compatible with the bss_sock bio */ 
 
         /* called when the connection is initially made
          *  callback(BIO,state,ret);  The callback should return
-         * 'ret'.  state is for compatablity with the ssl info_callback */
+         * 'ret'.  state is for compatibility with the ssl info_callback */
         int (*info_callback)();
         } BIO_CONNECT;
 
@@ -104,6 +104,7 @@ static int conn_puts(BIO *h,char *str);
 static long conn_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int conn_new(BIO *h);
 static int conn_free(BIO *data);
+static long conn_callback_ctrl(BIO *h,int cmd,void *(*fp)());
 
 static int conn_state(BIO *b, BIO_CONNECT *c);
 static void conn_close_socket(BIO *data);
@@ -121,6 +122,7 @@ static BIO_METHOD methods_connectp=
         conn_ctrl,
         conn_new,
         conn_free,
+        conn_callback_ctrl,
         };
 
 static int conn_state(BIO *b, BIO_CONNECT *c)
@@ -494,7 +496,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, char *ptr)
                                 *((int *)ptr)=data->port;
                                 }
                         if ((!b->init) || (ptr == NULL))
-                                *pptr="not initalised";
+                                *pptr="not initialized";
                         ret=1;
                         }
                 break;
@@ -564,16 +566,25 @@ static long conn_ctrl(BIO *b, int cmd, long num, char *ptr)
         case BIO_CTRL_FLUSH:
                 break;
         case BIO_CTRL_DUP:
+                {
                 dbio=(BIO *)ptr;
                 if (data->param_port)
                         BIO_set_conn_port(dbio,data->param_port);
                 if (data->param_hostname)
                         BIO_set_conn_hostname(dbio,data->param_hostname);
                 BIO_set_nbio(dbio,data->nbio);
-                (void)BIO_set_info_callback(dbio,data->info_callback);
+                (void)BIO_set_info_callback(dbio,(void *(*)())(data->info_callback));
+                }
                 break;
         case BIO_CTRL_SET_CALLBACK:
-                data->info_callback=(int (*)())ptr;
+                {
+#if 0 /* FIXME: Should this be used?  -- Richard Levitte */
+                BIOerr(BIO_F_CONN_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ret = -1;
+#else
+                ret=0;
+#endif
+                }
                 break;
         case BIO_CTRL_GET_CALLBACK:
                 {
@@ -590,6 +601,27 @@ static long conn_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long conn_callback_ctrl(BIO *b, int cmd, void *(*fp)())
+        {
+        long ret=1;
+        BIO_CONNECT *data;
+
+        data=(BIO_CONNECT *)b->ptr;
+
+        switch (cmd)
+                {
+        case BIO_CTRL_SET_CALLBACK:
+                {
+                data->info_callback=(int (*)())fp;
+                }
+                break;
+        default:
+                ret=0;
+                break;
+                }
+        return(ret);
+        }
+
 static int conn_puts(BIO *bp, char *str)
         {
         int n,ret;
diff --git a/src/lib/libcrypto/bio/bss_file.c b/src/lib/libcrypto/bio/bss_file.c
index 52c0c39df0..0d44dc3889 100644
--- a/src/lib/libcrypto/bio/bss_file.c
+++ b/src/lib/libcrypto/bio/bss_file.c
@@ -91,6 +91,7 @@ static BIO_METHOD methods_filep=
         file_ctrl,
         file_new,
         file_free,
+        NULL,
         };
 
 BIO *BIO_new_file(const char *filename, const char *mode)
@@ -171,7 +172,7 @@ static int MS_CALLBACK file_write(BIO *b, char *in, int inl)
                 if (fwrite(in,(int)inl,1,(FILE *)b->ptr))
                         ret=inl;
                 /* ret=fwrite(in,1,(int)inl,(FILE *)b->ptr); */
-                /* acording to Tim Hudson <tjh@cryptsoft.com>, the commented
+                /* according to Tim Hudson <tjh@cryptsoft.com>, the commented
                  * out version above can cause 'inl' write calls under
                  * some stupid stdio implementations (VMS) */
                 }
diff --git a/src/lib/libcrypto/bio/bss_log.c b/src/lib/libcrypto/bio/bss_log.c
index db82e757e7..4308b19663 100644
--- a/src/lib/libcrypto/bio/bss_log.c
+++ b/src/lib/libcrypto/bio/bss_log.c
@@ -72,6 +72,8 @@
 #else
 #include <syslog.h>
 #endif
+#else
+#include <process.h>
 #endif
 
 #include "cryptlib.h"
@@ -98,6 +100,7 @@ static BIO_METHOD methods_slg=
         slg_ctrl,
         slg_new,
         slg_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_log(void)
@@ -131,8 +134,10 @@ static int MS_CALLBACK slg_write(BIO *b, char *in, int inl)
         char* buf= in;
         char* pp;
 #if defined(WIN32)
-        LPTSTR lpszStrings[1];
+        LPCSTR lpszStrings[2];
         WORD evtype= EVENTLOG_ERROR_TYPE;
+        int pid = _getpid();
+        char pidbuf[20];
 #else
         int priority;
 #endif
@@ -156,10 +161,13 @@ static int MS_CALLBACK slg_write(BIO *b, char *in, int inl)
                 evtype= EVENTLOG_ERROR_TYPE;
                 pp= buf;
         }
-        lpszStrings[0]= pp;
+
+        sprintf(pidbuf, "[%d] ", pid);
+        lpszStrings[0] = pidbuf;
+        lpszStrings[1] = pp;
 
         if(b->ptr)
-                ReportEvent(b->ptr, evtype, 0, 1024, NULL, 1, 0,
+                ReportEvent(b->ptr, evtype, 0, 1024, NULL, 2, 0,
                                 lpszStrings, NULL);
 #else
         if(strncmp(buf, "ERR ", 4) == 0){
diff --git a/src/lib/libcrypto/bio/bss_mem.c b/src/lib/libcrypto/bio/bss_mem.c
index 7e749a503e..41eab92415 100644
--- a/src/lib/libcrypto/bio/bss_mem.c
+++ b/src/lib/libcrypto/bio/bss_mem.c
@@ -79,6 +79,7 @@ static BIO_METHOD mem_method=
         mem_ctrl,
         mem_new,
         mem_free,
+        NULL,
         };
 
 /* bio->num is used to hold the value to return on 'empty', if it is
@@ -89,6 +90,26 @@ BIO_METHOD *BIO_s_mem(void)
         return(&mem_method);
         }
 
+BIO *BIO_new_mem_buf(void *buf, int len)
+{
+        BIO *ret;
+        BUF_MEM *b;
+        if (!buf) {
+                BIOerr(BIO_F_BIO_NEW_MEM_BUF,BIO_R_NULL_PARAMETER);
+                return NULL;
+        }
+        if(len == -1) len = strlen(buf);
+        if(!(ret = BIO_new(BIO_s_mem())) ) return NULL;
+        b = (BUF_MEM *)ret->ptr;
+        b->data = buf;
+        b->length = len;
+        b->max = len;
+        ret->flags |= BIO_FLAGS_MEM_RDONLY;
+        /* Since this is static data retrying wont help */
+        ret->num = 0;
+        return ret;
+}
+
 static int mem_new(BIO *bi)
         {
         BUF_MEM *b;
@@ -109,7 +130,10 @@ static int mem_free(BIO *a)
                 {
                 if ((a->init) && (a->ptr != NULL))
                         {
-                        BUF_MEM_free((BUF_MEM *)a->ptr);
+                        BUF_MEM *b;
+                        b = (BUF_MEM *)a->ptr;
+                        if(a->flags & BIO_FLAGS_MEM_RDONLY) b->data = NULL;
+                        BUF_MEM_free(b);
                         a->ptr=NULL;
                         }
                 }
@@ -126,17 +150,18 @@ static int mem_read(BIO *b, char *out, int outl)
         bm=(BUF_MEM *)b->ptr;
         BIO_clear_retry_flags(b);
         ret=(outl > bm->length)?bm->length:outl;
-        if ((out != NULL) && (ret > 0))
-                {
+        if ((out != NULL) && (ret > 0)) {
                 memcpy(out,bm->data,ret);
                 bm->length-=ret;
                 /* memmove(&(bm->data[0]),&(bm->data[ret]), bm->length); */
-                from=(char *)&(bm->data[ret]);
-                to=(char *)&(bm->data[0]);
-                for (i=0; i<bm->length; i++)
-                        to[i]=from[i];
+                if(b->flags & BIO_FLAGS_MEM_RDONLY) bm->data += ret;
+                else {
+                        from=(char *)&(bm->data[ret]);
+                        to=(char *)&(bm->data[0]);
+                        for (i=0; i<bm->length; i++)
+                                to[i]=from[i];
                 }
-        else if (bm->length == 0)
+        } else if (bm->length == 0)
                 {
                 if (b->num != 0)
                         BIO_set_retry_read(b);
@@ -158,6 +183,11 @@ static int mem_write(BIO *b, char *in, int inl)
                 goto end;
                 }
 
+        if(b->flags & BIO_FLAGS_MEM_RDONLY) {
+                BIOerr(BIO_F_MEM_WRITE,BIO_R_WRITE_TO_READ_ONLY_BIO);
+                goto end;
+        }
+
         BIO_clear_retry_flags(b);
         blen=bm->length;
         if (BUF_MEM_grow(bm,blen+inl) != (blen+inl))
@@ -178,9 +208,15 @@ static long mem_ctrl(BIO *b, int cmd, long num, char *ptr)
         switch (cmd)
                 {
         case BIO_CTRL_RESET:
-                if (bm->data != NULL)
-                        memset(bm->data,0,bm->max);
-                bm->length=0;
+                if (bm->data != NULL) {
+                        /* For read only case reset to the start again */
+                        if(b->flags & BIO_FLAGS_MEM_RDONLY) 
+                                        bm->data -= bm->max - bm->length;
+                        else {
+                                memset(bm->data,0,bm->max);
+                                bm->length=0;
+                        }
+                }
                 break;
         case BIO_CTRL_EOF:
                 ret=(long)(bm->length == 0);
diff --git a/src/lib/libcrypto/bio/bss_null.c b/src/lib/libcrypto/bio/bss_null.c
index d04be888e5..aee18e3ada 100644
--- a/src/lib/libcrypto/bio/bss_null.c
+++ b/src/lib/libcrypto/bio/bss_null.c
@@ -79,6 +79,7 @@ static BIO_METHOD null_method=
         null_ctrl,
         null_new,
         null_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_null(void)
diff --git a/src/lib/libcrypto/bio/bss_rtcp.c b/src/lib/libcrypto/bio/bss_rtcp.c
index 2ef040057e..4ad0739464 100644
--- a/src/lib/libcrypto/bio/bss_rtcp.c
+++ b/src/lib/libcrypto/bio/bss_rtcp.c
@@ -107,6 +107,7 @@ static BIO_METHOD rtcp_method=
         rtcp_ctrl,
         rtcp_new,
         rtcp_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_rtcp(void)
diff --git a/src/lib/libcrypto/bio/bss_sock.c b/src/lib/libcrypto/bio/bss_sock.c
index d336b99fe8..8ce80ef68d 100644
--- a/src/lib/libcrypto/bio/bss_sock.c
+++ b/src/lib/libcrypto/bio/bss_sock.c
@@ -95,6 +95,7 @@ static BIO_METHOD methods_sockp=
         sock_ctrl,
         sock_new,
         sock_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_socket(void)
@@ -112,6 +113,7 @@ static BIO_METHOD methods_fdp=
         fd_ctrl,
         fd_new,
         fd_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_fd(void)
@@ -163,8 +165,7 @@ static int fd_free(BIO *a)
                 if (a->init)
                         {
 #ifndef BIO_FD
-                        shutdown(a->num,2);
-                        closesocket(a->num);
+                        SHUTDOWN2(a->num);
 #else                   /* BIO_FD */
                         close(a->num);
 #endif
diff --git a/src/lib/libcrypto/bn/Makefile.ssl b/src/lib/libcrypto/bn/Makefile.ssl
index cf77869fab..fa23a43fa0 100644
--- a/src/lib/libcrypto/bn/Makefile.ssl
+++ b/src/lib/libcrypto/bn/Makefile.ssl
@@ -20,6 +20,13 @@ BN_ASM=		bn_asm.o
 #BN_ASM=        bn86-elf.o
 
 CFLAGS= $(INCLUDES) $(CFLAG)
+
+# We let the C compiler driver to take care of .s files. This is done in
+# order to be excused from maintaining a separate set of architecture
+# dependent assembler flags. E.g. if you throw -mcpu=ultrasparc at SPARC
+# gcc, then the driver will automatically translate it to -xarch=v8plus
+# and pass it down to assembler.
+AS=$(CC) -c
 ASFLAGS=$(CFLAGS)
 
 GENERAL=Makefile
@@ -27,12 +34,12 @@ TEST=bntest.c exptest.c
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC= bn_add.c bn_div.c bn_exp.c bn_lib.c bn_mul.c \
+LIBSRC= bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c \
         bn_print.c bn_rand.c bn_shift.c bn_word.c bn_blind.c \
         bn_gcd.c bn_prime.c bn_err.c bn_sqr.c bn_asm.c bn_recp.c bn_mont.c \
         bn_mpi.c bn_exp2.c
 
-LIBOBJ= bn_add.o bn_div.o bn_exp.o bn_lib.o bn_mul.o \
+LIBOBJ= bn_add.o bn_div.o bn_exp.o bn_lib.o bn_ctx.o bn_mul.o \
         bn_print.o bn_rand.o bn_shift.o bn_word.o bn_blind.o \
         bn_gcd.o bn_prime.o bn_err.o bn_sqr.o $(BN_ASM) bn_recp.o bn_mont.o \
         bn_mpi.o bn_exp2.o
@@ -49,12 +56,14 @@ top:
 
 all:    lib
 
-knuth: bn_knuth.c
-        cc -pg -I.. -I../../include bn_knuth.c -o knuth $(LIB) #../../../libefence.a
+bn_prime.h: bn_prime.pl
+        $(PERL) bn_prime.pl >bn_prime.h
 
-knuth.fast: bn_knuth.c
-        cc -pg -fast -I.. -I../../include bn_knuth.c -o knuth $(LIB) #../../../libefence.a
+divtest: divtest.c ../../libcrypto.a
+        cc -I../../include divtest.c -o divtest ../../libcrypto.a
 
+bnbug: bnbug.c ../../libcrypto.a top
+        cc -g -I../../include bnbug.c -o bnbug ../../libcrypto.a
 
 lib:    $(LIBOBJ)
         $(AR) $(LIB) $(LIBOBJ)
@@ -113,13 +122,6 @@ asm/sparcv8plus-gcc27.o: asm/sparcv8plus.S
         $(CC) $(ASFLAGS) -E asm/sparcv8plus.S | \
                 /usr/ccs/bin/as -xarch=v8plus - -o asm/sparcv8plus-gcc27.o
 
-# MIPS 64 bit assember 
-asm/mips3.o: asm/mips3.s
-
-# MIPS 32 bit assember
-asm/mips1.o: asm/mips1.s
-        /usr/bin/as -O2 -o asm/mips1.o asm/mips1.s
-
 files:
         $(PERL) $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO
 
@@ -168,109 +170,117 @@ bn_add.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_add.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_add.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_add.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_add.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_add.o: ../cryptlib.h bn_lcl.h
+bn_add.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_add.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_asm.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_asm.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_asm.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_asm.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_asm.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_asm.o: ../cryptlib.h bn_lcl.h
+bn_asm.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_asm.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_blind.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_blind.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_blind.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_blind.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_blind.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_blind.o: ../cryptlib.h bn_lcl.h
+bn_blind.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_blind.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
+bn_ctx.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
+bn_ctx.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+bn_ctx.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+bn_ctx.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
+bn_ctx.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_ctx.o: ../../include/openssl/stack.h ../cryptlib.h
 bn_div.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_div.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_div.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_div.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_div.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_div.o: ../cryptlib.h bn_lcl.h
+bn_div.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_div.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_err.o: ../../include/openssl/bn.h ../../include/openssl/err.h
 bn_err.o: ../../include/openssl/opensslconf.h
 bn_exp.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_exp.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_exp.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_exp.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_exp.o: ../cryptlib.h bn_lcl.h
+bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_exp.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_exp2.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_exp2.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_exp2.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_exp2.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_exp2.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_exp2.o: ../cryptlib.h bn_lcl.h
+bn_exp2.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_exp2.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_gcd.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_gcd.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_gcd.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_gcd.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_gcd.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_gcd.o: ../cryptlib.h bn_lcl.h
+bn_gcd.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_gcd.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_lib.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_lib.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_lib.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_lib.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_lib.o: ../cryptlib.h bn_lcl.h
+bn_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_lib.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_mont.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_mont.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_mont.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_mont.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_mont.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_mont.o: ../cryptlib.h bn_lcl.h
+bn_mont.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_mont.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_mpi.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_mpi.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_mpi.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_mpi.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_mpi.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_mpi.o: ../cryptlib.h bn_lcl.h
+bn_mpi.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_mpi.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_mul.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_mul.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_mul.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_mul.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_mul.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_mul.o: ../cryptlib.h bn_lcl.h
+bn_mul.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_mul.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_prime.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_prime.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_prime.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_prime.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 bn_prime.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-bn_prime.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h bn_prime.h
+bn_prime.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bn_prime.o: ../cryptlib.h bn_lcl.h bn_prime.h
 bn_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_print.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_print.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_print.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_print.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_print.o: ../cryptlib.h bn_lcl.h
+bn_print.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_print.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_rand.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_rand.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_rand.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_rand.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 bn_rand.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-bn_rand.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
+bn_rand.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bn_rand.o: ../cryptlib.h bn_lcl.h
 bn_recp.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_recp.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_recp.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_recp.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_recp.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_recp.o: ../cryptlib.h bn_lcl.h
+bn_recp.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_recp.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_shift.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_shift.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_shift.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_shift.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_shift.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_shift.o: ../cryptlib.h bn_lcl.h
+bn_shift.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_shift.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_sqr.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_sqr.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_sqr.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_sqr.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_sqr.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_sqr.o: ../cryptlib.h bn_lcl.h
+bn_sqr.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_sqr.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_word.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_word.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_word.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_word.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_word.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_word.o: ../cryptlib.h bn_lcl.h
+bn_word.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_word.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
diff --git a/src/lib/libcrypto/bn/asm/README b/src/lib/libcrypto/bn/asm/README
index d93fbff77f..86bf64cfc2 100644
--- a/src/lib/libcrypto/bn/asm/README
+++ b/src/lib/libcrypto/bn/asm/README
@@ -1,5 +1,5 @@
 All assember in this directory are just version of the file
-crypto/bn/bn_mulw.c.
+crypto/bn/bn_asm.c.
 
 Quite a few of these files are just the assember output from gcc since on 
 quite a few machines they are 2 times faster than the system compiler.
@@ -15,13 +15,6 @@ On the 2 alpha C compilers I had access to, it was not possible to do
 were 64 bits).  So the hand assember gives access to the 128 bit result and
 a 2 times speedup :-).
 
-The x86xxxx.obj files are the assembled version of x86xxxx.asm files.
-I had such a hard time finding a macro assember for Microsoft, I decided to
-include the object file to save others the hassle :-).
-
-I have also included uu encoded versions of the .obj incase they get
-trashed.
-
 There are 2 versions of assember for the HP PA-RISC.
 pa-risc.s is the origional one which works fine.
 pa-risc2.s is a new version that often generates warnings but if the
diff --git a/src/lib/libcrypto/bn/asm/alpha.s b/src/lib/libcrypto/bn/asm/alpha.s
index a351694ca2..555ff0b92d 100644
--- a/src/lib/libcrypto/bn/asm/alpha.s
+++ b/src/lib/libcrypto/bn/asm/alpha.s
@@ -694,567 +694,1868 @@ bn_mul_comba8:
 bn_mul_comba8..ng:
         .frame $30,0,$26,0
         .prologue 0
-
-        subq    $30,    16,     $30
-        ldq     $0,     0($17)
+        ldq     $1,     0($17)
+        ldq     $2,     0($18)
+        zapnot  $1,     15,     $7
+        srl     $2,     32,     $8
+        mulq    $8,     $7,     $22
+        srl     $1,     32,     $6
+        zapnot  $2,     15,     $5
+        mulq    $5,     $6,     $4
+        mulq    $7,     $5,     $24
+        addq    $22,    $4,     $22
+        cmpult  $22,    $4,     $1
+        mulq    $6,     $8,     $3
+        beq     $1,     $173
+        bis     $31,    1,      $1
+        sll     $1,     32,     $1
+        addq    $3,     $1,     $3
+$173:
+        sll     $22,    32,     $4
+        addq    $24,    $4,     $24
+        stq     $24,    0($16)
+        ldq     $2,     0($17)
+        ldq     $1,     8($18)
+        zapnot  $2,     15,     $7
+        srl     $1,     32,     $8
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $2,     32,     $6
+        mulq    $5,     $6,     $23
+        mulq    $6,     $8,     $6
+        srl     $22,    32,     $1
+        cmpult  $24,    $4,     $2
+        addq    $3,     $1,     $3
+        addq    $2,     $3,     $22
+        addq    $25,    $23,    $25
+        cmpult  $25,    $23,    $1
+        bis     $31,    1,      $2
+        beq     $1,     $177
+        sll     $2,     32,     $1
+        addq    $6,     $1,     $6
+$177:
+        sll     $25,    32,     $23
         ldq     $1,     0($18)
-        stq     $9,     0($30)
-        stq     $10,    8($30)
-        ldq     $2,     8($17)
-        ldq     $3,     8($18)
-        ldq     $4,     16($17)
-        ldq     $5,     16($18)
-        ldq     $6,     24($17)
-        ldq     $7,     24($18)
-        ldq     $8,     8($17)
-        ldq     $22,    8($18)
-        ldq     $23,    8($17)
-        ldq     $24,    8($18)
-        ldq     $25,    8($17)
-        ldq     $27,    8($18)
-        ldq     $28,    8($17)
-        ldq     $21,    8($18)
-        bis     $31,    $31,    $9
-        mulq    $0,     $1,     $20
-        umulh   $0,     $1,     $19
-        stq     $20,    0($16)
-        bis     $31,    $31,    $20
-        mulq    $0,     $3,     $10
-        umulh   $0,     $3,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $10
-        addq    $20,    $10,    $20
-        mulq    $2,     $1,     $18
-        umulh   $2,     $1,     $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        stq     $19,    8($16)
-        bis     $31,    $31,    $19
-        mulq    $0,     $5,     $10
-        umulh   $0,     $5,     $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        mulq    $2,     $3,     $18
-        umulh   $2,     $3,     $17
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $19,    $18,    $19
-        mulq    $4,     $1,     $10
-        umulh   $4,     $1,     $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        stq     $9,     16($16)
-        bis     $31,    $31,    $9
-        mulq    $0,     $7,     $18
-        umulh   $0,     $7,     $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $2,     $5,     $10
-        umulh   $2,     $5,     $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        mulq    $4,     $3,     $18
-        umulh   $4,     $3,     $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $6,     $1,     $10
-        umulh   $6,     $1,     $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        stq     $20,    24($16)
-        bis     $31,    $31,    $20
-        mulq    $0,     $22,    $18
-        umulh   $0,     $22,    $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        mulq    $2,     $7,     $10
-        umulh   $2,     $7,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $10
-        addq    $20,    $10,    $20
-        mulq    $4,     $5,     $18
-        umulh   $4,     $5,     $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        mulq    $6,     $3,     $10
-        umulh   $6,     $3,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $10
-        addq    $20,    $10,    $20
-        mulq    $8,     $1,     $18
-        umulh   $8,     $1,     $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        stq     $19,    32($16)
-        bis     $31,    $31,    $19
-        mulq    $0,     $24,    $10
-        umulh   $0,     $24,    $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        mulq    $2,     $22,    $18
-        umulh   $2,     $22,    $17
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $19,    $18,    $19
-        mulq    $4,     $7,     $10
-        umulh   $4,     $7,     $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        mulq    $6,     $5,     $18
-        umulh   $6,     $5,     $17
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $19,    $18,    $19
-        mulq    $8,     $3,     $10
-        umulh   $8,     $3,     $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        mulq    $23,    $1,     $18
-        umulh   $23,    $1,     $17
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $19,    $18,    $19
-        stq     $9,     40($16)
-        bis     $31,    $31,    $9
-        mulq    $0,     $27,    $10
-        umulh   $0,     $27,    $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        mulq    $2,     $24,    $18
-        umulh   $2,     $24,    $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $4,     $22,    $10
-        umulh   $4,     $22,    $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        mulq    $6,     $7,     $18
-        umulh   $6,     $7,     $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $8,     $5,     $10
-        umulh   $8,     $5,     $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        mulq    $23,    $3,     $18
-        umulh   $23,    $3,     $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $25,    $1,     $10
-        umulh   $25,    $1,     $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        stq     $20,    48($16)
-        bis     $31,    $31,    $20
-        mulq    $0,     $21,    $18
-        umulh   $0,     $21,    $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        mulq    $2,     $27,    $10
-        umulh   $2,     $27,    $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $0
-        addq    $20,    $0,     $20
-        mulq    $4,     $24,    $10
-        umulh   $4,     $24,    $18
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $17
-        addq    $17,    $18,    $18
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $0
-        addq    $20,    $0,     $20
-        mulq    $6,     $22,    $10
-        umulh   $6,     $22,    $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $0
-        addq    $20,    $0,     $20
-        mulq    $8,     $7,     $10
-        umulh   $8,     $7,     $18
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $17
-        addq    $17,    $18,    $18
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $0
-        addq    $20,    $0,     $20
-        mulq    $23,    $5,     $10
-        umulh   $23,    $5,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $0
-        addq    $20,    $0,     $20
-        mulq    $25,    $3,     $10
-        umulh   $25,    $3,     $18
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $17
-        addq    $17,    $18,    $18
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $0
-        addq    $20,    $0,     $20
-        mulq    $28,    $1,     $10
-        umulh   $28,    $1,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $0
-        addq    $20,    $0,     $20
-        stq     $19,    56($16)
-        bis     $31,    $31,    $19
-        mulq    $2,     $21,    $10
-        umulh   $2,     $21,    $18
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $17
-        addq    $17,    $18,    $18
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $0
-        addq    $19,    $0,     $19
-        mulq    $4,     $27,    $1
-        umulh   $4,     $27,    $10
-        addq    $9,     $1,     $9
-        cmpult  $9,     $1,     $17
-        addq    $17,    $10,    $10
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $19,    $18,    $19
-        mulq    $6,     $24,    $0
-        umulh   $6,     $24,    $2
-        addq    $9,     $0,     $9
-        cmpult  $9,     $0,     $1
-        addq    $1,     $2,     $2
-        addq    $20,    $2,     $20
-        cmpult  $20,    $2,     $17
-        addq    $19,    $17,    $19
-        mulq    $8,     $22,    $10
-        umulh   $8,     $22,    $18
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $0
-        addq    $0,     $18,    $18
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $1
-        addq    $19,    $1,     $19
-        mulq    $23,    $7,     $2
-        umulh   $23,    $7,     $17
-        addq    $9,     $2,     $9
-        cmpult  $9,     $2,     $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $0
-        addq    $19,    $0,     $19
-        mulq    $25,    $5,     $18
-        umulh   $25,    $5,     $1
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $2
-        addq    $2,     $1,     $1
-        addq    $20,    $1,     $20
-        cmpult  $20,    $1,     $10
-        addq    $19,    $10,    $19
-        mulq    $28,    $3,     $17
-        umulh   $28,    $3,     $0
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $18,    $0,     $0
-        addq    $20,    $0,     $20
-        cmpult  $20,    $0,     $2
-        addq    $19,    $2,     $19
-        stq     $9,     64($16)
-        bis     $31,    $31,    $9
-        mulq    $4,     $21,    $1
-        umulh   $4,     $21,    $10
-        addq    $20,    $1,     $20
-        cmpult  $20,    $1,     $17
-        addq    $17,    $10,    $10
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $9,     $18,    $9
-        mulq    $6,     $27,    $0
-        umulh   $6,     $27,    $2
-        addq    $20,    $0,     $20
-        cmpult  $20,    $0,     $3
-        addq    $3,     $2,     $2
-        addq    $19,    $2,     $19
-        cmpult  $19,    $2,     $1
-        addq    $9,     $1,     $9
-        mulq    $8,     $24,    $17
-        umulh   $8,     $24,    $10
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $18,    $10,    $10
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $4
-        addq    $9,     $4,     $9
-        mulq    $23,    $22,    $0
-        umulh   $23,    $22,    $3
-        addq    $20,    $0,     $20
-        cmpult  $20,    $0,     $2
-        addq    $2,     $3,     $3
-        addq    $19,    $3,     $19
-        cmpult  $19,    $3,     $1
-        addq    $9,     $1,     $9
-        mulq    $25,    $7,     $17
-        umulh   $25,    $7,     $18
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $10,    $18,    $18
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $4
-        addq    $9,     $4,     $9
-        mulq    $28,    $5,     $0
-        umulh   $28,    $5,     $2
-        addq    $20,    $0,     $20
-        cmpult  $20,    $0,     $3
-        addq    $3,     $2,     $2
-        addq    $19,    $2,     $19
-        cmpult  $19,    $2,     $1
-        addq    $9,     $1,     $9
-        stq     $20,    72($16)
-        bis     $31,    $31,    $20
-        mulq    $6,     $21,    $17
-        umulh   $6,     $21,    $10
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $18,    $10,    $10
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $4
-        addq    $20,    $4,     $20
-        mulq    $8,     $27,    $0
-        umulh   $8,     $27,    $3
-        addq    $19,    $0,     $19
-        cmpult  $19,    $0,     $2
-        addq    $2,     $3,     $3
-        addq    $9,     $3,     $9
-        cmpult  $9,     $3,     $1
-        addq    $20,    $1,     $20
-        mulq    $23,    $24,    $5
-        umulh   $23,    $24,    $17
-        addq    $19,    $5,     $19
-        cmpult  $19,    $5,     $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $10
-        addq    $20,    $10,    $20
-        mulq    $25,    $22,    $4
-        umulh   $25,    $22,    $6
-        addq    $19,    $4,     $19
-        cmpult  $19,    $4,     $0
-        addq    $0,     $6,     $6
-        addq    $9,     $6,     $9
-        cmpult  $9,     $6,     $2
-        addq    $20,    $2,     $20
-        mulq    $28,    $7,     $3
-        umulh   $28,    $7,     $1
-        addq    $19,    $3,     $19
-        cmpult  $19,    $3,     $5
-        addq    $5,     $1,     $1
-        addq    $9,     $1,     $9
-        cmpult  $9,     $1,     $18
-        addq    $20,    $18,    $20
-        stq     $19,    80($16)
-        bis     $31,    $31,    $19
-        mulq    $8,     $21,    $17
-        umulh   $8,     $21,    $10
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $4
-        addq    $4,     $10,    $10
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $0
-        addq    $19,    $0,     $19
-        mulq    $23,    $27,    $6
-        umulh   $23,    $27,    $2
-        addq    $9,     $6,     $9
-        cmpult  $9,     $6,     $3
-        addq    $3,     $2,     $2
+        addq    $0,     $23,    $0
+        bis     $0,     $0,     $7
+        ldq     $3,     8($17)
+        addq    $22,    $7,     $22
+        srl     $1,     32,     $8
+        cmpult  $22,    $7,     $4
+        zapnot  $3,     15,     $7
+        mulq    $8,     $7,     $28
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $25,    32,     $1
+        cmpult  $0,     $23,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $4,     $6,     $24
+        srl     $3,     32,     $6
+        mulq    $5,     $6,     $2
+        mulq    $6,     $8,     $6
+        addq    $28,    $2,     $28
+        cmpult  $28,    $2,     $1
+        bis     $31,    1,      $2
+        beq     $1,     $181
+        sll     $2,     32,     $1
+        addq    $6,     $1,     $6
+$181:
+        sll     $28,    32,     $2
+        addq    $21,    $2,     $21
+        bis     $21,    $21,    $7
+        addq    $22,    $7,     $22
+        stq     $22,    8($16)
+        ldq     $3,     16($17)
+        ldq     $1,     0($18)
+        cmpult  $22,    $7,     $4
+        zapnot  $3,     15,     $7
+        srl     $1,     32,     $8
+        mulq    $8,     $7,     $22
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $20
+        srl     $28,    32,     $1
+        cmpult  $21,    $2,     $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $4,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $3,     32,     $6
+        mulq    $5,     $6,     $2
+        mulq    $6,     $8,     $6
+        addq    $22,    $2,     $22
+        cmpult  $22,    $2,     $1
+        bis     $31,    1,      $2
+        beq     $1,     $185
+        sll     $2,     32,     $1
+        addq    $6,     $1,     $6
+$185:
+        sll     $22,    32,     $2
+        ldq     $1,     8($18)
         addq    $20,    $2,     $20
-        cmpult  $20,    $2,     $5
-        addq    $19,    $5,     $19
-        mulq    $25,    $24,    $1
-        umulh   $25,    $24,    $18
-        addq    $9,     $1,     $9
-        cmpult  $9,     $1,     $7
-        addq    $7,     $18,    $18
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $17
-        addq    $19,    $17,    $19
-        mulq    $28,    $22,    $4
-        umulh   $28,    $22,    $10
-        addq    $9,     $4,     $9
-        cmpult  $9,     $4,     $0
-        addq    $0,     $10,    $10
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $8
-        addq    $19,    $8,     $19
-        stq     $9,     88($16)
-        bis     $31,    $31,    $9
-        mulq    $23,    $21,    $6
-        umulh   $23,    $21,    $3
-        addq    $20,    $6,     $20
-        cmpult  $20,    $6,     $2
-        addq    $2,     $3,     $3
-        addq    $19,    $3,     $19
-        cmpult  $19,    $3,     $5
-        addq    $9,     $5,     $9
-        mulq    $25,    $27,    $1
-        umulh   $25,    $27,    $7
-        addq    $20,    $1,     $20
-        cmpult  $20,    $1,     $18
-        addq    $18,    $7,     $7
-        addq    $19,    $7,     $19
-        cmpult  $19,    $7,     $17
-        addq    $9,     $17,    $9
-        mulq    $28,    $24,    $4
-        umulh   $28,    $24,    $0
-        addq    $20,    $4,     $20
-        cmpult  $20,    $4,     $10
-        addq    $10,    $0,     $0
-        addq    $19,    $0,     $19
-        cmpult  $19,    $0,     $8
-        addq    $9,     $8,     $9
-        stq     $20,    96($16)
-        bis     $31,    $31,    $20
-        mulq    $25,    $21,    $22
-        umulh   $25,    $21,    $6
-        addq    $19,    $22,    $19
-        cmpult  $19,    $22,    $2
+        bis     $20,    $20,    $7
+        ldq     $4,     8($17)
+        addq    $24,    $7,     $24
+        srl     $1,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $22,    32,     $1
+        cmpult  $20,    $2,     $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $22
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $189
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$189:
+        sll     $25,    32,     $5
+        ldq     $2,     16($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     0($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $193
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$193:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        stq     $24,    16($16)
+        ldq     $4,     0($17)
+        ldq     $5,     24($18)
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $24
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $0,     $24,    $0
+        cmpult  $0,     $24,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $197
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$197:
+        sll     $0,     32,     $24
+        ldq     $1,     16($18)
+        addq    $2,     $24,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     8($17)
+        addq    $23,    $7,     $23
+        srl     $1,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $24,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $24
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $201
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$201:
+        sll     $25,    32,     $5
+        ldq     $2,     8($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     16($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $205
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$205:
+        sll     $28,    32,     $25
+        ldq     $2,     0($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $209
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$209:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $23,    $7,     $23
+        stq     $23,    24($16)
+        ldq     $4,     32($17)
+        ldq     $5,     0($18)
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $23
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $28,    $23,    $28
+        cmpult  $28,    $23,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $213
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$213:
+        sll     $28,    32,     $23
+        ldq     $1,     8($18)
+        addq    $2,     $23,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     24($17)
+        addq    $22,    $7,     $22
+        srl     $1,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $23,    $2
+        addq    $6,     $1,     $6
         addq    $2,     $6,     $6
-        addq    $9,     $6,     $9
-        cmpult  $9,     $6,     $3
-        addq    $20,    $3,     $20
-        mulq    $28,    $27,    $5
-        umulh   $28,    $27,    $23
-        addq    $19,    $5,     $19
-        cmpult  $19,    $5,     $1
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $217
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$217:
+        sll     $25,    32,     $5
+        ldq     $2,     16($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     16($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
         addq    $1,     $23,    $23
-        addq    $9,     $23,    $9
-        cmpult  $9,     $23,    $18
-        addq    $20,    $18,    $20
-        stq     $19,    104($16)
-        bis     $31,    $31,    $19
-        mulq    $28,    $21,    $7
-        umulh   $28,    $21,    $17
-        addq    $9,     $7,     $9
-        cmpult  $9,     $7,     $4
-        addq    $4,     $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        stq     $9,     112($16)
-        stq     $20,    120($16)
-        ldq     $9,     0($30)
-        ldq     $10,    8($30)
-        addq    $30,    16,     $30
-        ret     $31,($26),1
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $221
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$221:
+        sll     $28,    32,     $25
+        ldq     $2,     24($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     8($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $225
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$225:
+        sll     $0,     32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     0($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $229
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$229:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $22,    $7,     $22
+        stq     $22,    32($16)
+        ldq     $4,     0($17)
+        ldq     $5,     40($18)
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $22
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $0,     $22,    $0
+        cmpult  $0,     $22,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $233
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$233:
+        sll     $0,     32,     $22
+        ldq     $1,     32($18)
+        addq    $2,     $22,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     8($17)
+        addq    $24,    $7,     $24
+        srl     $1,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $22,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $22
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $237
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$237:
+        sll     $25,    32,     $5
+        ldq     $2,     24($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     16($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $241
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$241:
+        sll     $28,    32,     $25
+        ldq     $2,     16($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $245
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$245:
+        sll     $0,     32,     $25
+        ldq     $2,     8($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     32($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $249
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$249:
+        sll     $28,    32,     $25
+        ldq     $2,     0($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     40($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $253
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$253:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        stq     $24,    40($16)
+        ldq     $4,     48($17)
+        ldq     $5,     0($18)
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $24
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $28,    $24,    $28
+        cmpult  $28,    $24,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $257
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$257:
+        sll     $28,    32,     $24
+        ldq     $1,     8($18)
+        addq    $2,     $24,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     40($17)
+        addq    $23,    $7,     $23
+        srl     $1,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $24,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $24
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $261
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$261:
+        sll     $25,    32,     $5
+        ldq     $2,     16($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     32($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $265
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$265:
+        sll     $28,    32,     $25
+        ldq     $2,     24($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $269
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$269:
+        sll     $0,     32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     16($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $273
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$273:
+        sll     $28,    32,     $25
+        ldq     $2,     40($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     8($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $277
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$277:
+        sll     $0,     32,     $25
+        ldq     $2,     48($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     0($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $281
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$281:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $23,    $7,     $23
+        stq     $23,    48($16)
+        ldq     $4,     0($17)
+        ldq     $5,     56($18)
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $23
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $0,     $23,    $0
+        cmpult  $0,     $23,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $285
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$285:
+        sll     $0,     32,     $23
+        ldq     $1,     48($18)
+        addq    $2,     $23,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     8($17)
+        addq    $22,    $7,     $22
+        srl     $1,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $23,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $289
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$289:
+        sll     $25,    32,     $5
+        ldq     $2,     40($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     16($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $293
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$293:
+        sll     $28,    32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $297
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$297:
+        sll     $0,     32,     $25
+        ldq     $2,     24($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     32($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $301
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$301:
+        sll     $28,    32,     $25
+        ldq     $2,     16($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     40($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $305
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$305:
+        sll     $0,     32,     $25
+        ldq     $2,     8($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     48($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $309
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$309:
+        sll     $28,    32,     $25
+        ldq     $2,     0($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     56($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $313
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$313:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $22,    $7,     $22
+        stq     $22,    56($16)
+        ldq     $4,     56($17)
+        ldq     $5,     8($18)
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $22
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $28,    $22,    $28
+        cmpult  $28,    $22,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $317
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$317:
+        sll     $28,    32,     $22
+        ldq     $1,     16($18)
+        addq    $2,     $22,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     48($17)
+        addq    $24,    $7,     $24
+        srl     $1,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $22,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $22
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $321
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$321:
+        sll     $25,    32,     $5
+        ldq     $2,     24($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     40($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $325
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$325:
+        sll     $28,    32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     32($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $329
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$329:
+        sll     $0,     32,     $25
+        ldq     $2,     40($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $333
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$333:
+        sll     $28,    32,     $25
+        ldq     $2,     48($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     16($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $337
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$337:
+        sll     $0,     32,     $25
+        ldq     $2,     56($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     8($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $341
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$341:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        stq     $24,    64($16)
+        ldq     $4,     16($17)
+        ldq     $5,     56($18)
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $24
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $0,     $24,    $0
+        cmpult  $0,     $24,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $345
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$345:
+        sll     $0,     32,     $24
+        ldq     $1,     48($18)
+        addq    $2,     $24,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     24($17)
+        addq    $23,    $7,     $23
+        srl     $1,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $24,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $24
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $349
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$349:
+        sll     $25,    32,     $5
+        ldq     $2,     40($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     32($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $353
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$353:
+        sll     $28,    32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     40($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $357
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$357:
+        sll     $0,     32,     $25
+        ldq     $2,     24($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     48($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $361
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$361:
+        sll     $28,    32,     $25
+        ldq     $2,     16($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     56($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $365
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$365:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $23,    $7,     $23
+        stq     $23,    72($16)
+        ldq     $4,     56($17)
+        ldq     $5,     24($18)
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $23
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $28,    $23,    $28
+        cmpult  $28,    $23,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $369
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$369:
+        sll     $28,    32,     $23
+        ldq     $1,     32($18)
+        addq    $2,     $23,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     48($17)
+        addq    $22,    $7,     $22
+        srl     $1,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $23,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $373
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$373:
+        sll     $25,    32,     $5
+        ldq     $2,     40($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     40($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $377
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$377:
+        sll     $28,    32,     $25
+        ldq     $2,     48($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     32($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $381
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$381:
+        sll     $0,     32,     $25
+        ldq     $2,     56($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $385
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$385:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $22,    $7,     $22
+        stq     $22,    80($16)
+        ldq     $4,     32($17)
+        ldq     $5,     56($18)
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $22
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $0,     $22,    $0
+        cmpult  $0,     $22,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $389
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$389:
+        sll     $0,     32,     $22
+        ldq     $1,     48($18)
+        addq    $2,     $22,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     40($17)
+        addq    $24,    $7,     $24
+        srl     $1,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $22,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $22
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $393
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$393:
+        sll     $25,    32,     $5
+        ldq     $2,     40($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     48($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $397
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$397:
+        sll     $28,    32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     56($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $21
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $21,    $25,    $21
+        cmpult  $21,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $401
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$401:
+        sll     $21,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        stq     $24,    88($16)
+        ldq     $4,     56($17)
+        ldq     $5,     40($18)
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $21,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $24
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $0,     $24,    $0
+        cmpult  $0,     $24,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $405
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$405:
+        sll     $0,     32,     $24
+        ldq     $2,     48($18)
+        addq    $5,     $24,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     48($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $24,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $24
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $409
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$409:
+        sll     $28,    32,     $25
+        ldq     $2,     56($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     40($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $413
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$413:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $23,    $7,     $23
+        stq     $23,    96($16)
+        ldq     $4,     48($17)
+        ldq     $5,     56($18)
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $23
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $23,    $28
+        cmpult  $28,    $23,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $417
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$417:
+        sll     $28,    32,     $23
+        ldq     $2,     48($18)
+        addq    $5,     $23,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     56($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $23,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $421
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$421:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $22,    $7,     $22
+        stq     $22,    104($16)
+        ldq     $4,     56($17)
+        ldq     $5,     56($18)
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $22
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $28,    $22,    $28
+        cmpult  $28,    $22,    $1
+        mulq    $6,     $8,     $3
+        beq     $1,     $425
+        sll     $20,    32,     $1
+        addq    $3,     $1,     $3
+$425:
+        sll     $28,    32,     $22
+        srl     $28,    32,     $1
+        addq    $2,     $22,    $2
+        addq    $3,     $1,     $3
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        cmpult  $7,     $22,    $1
+        cmpult  $24,    $7,     $2
+        addq    $1,     $3,     $6
+        addq    $2,     $6,     $6
+        stq     $24,    112($16)
+        addq    $23,    $6,     $23
+        stq     $23,    120($16)
+        ret     $31,    ($26),  1
         .end bn_mul_comba8
         .text
         .align 3
diff --git a/src/lib/libcrypto/bn/asm/mips3.s b/src/lib/libcrypto/bn/asm/mips3.s
index 191345d920..2df4dcd4b0 100644
--- a/src/lib/libcrypto/bn/asm/mips3.s
+++ b/src/lib/libcrypto/bn/asm/mips3.s
@@ -395,32 +395,32 @@ LEAF(bn_add_words)
 
 .L_bn_add_words_loop:
         ld      ta0,0(a2)
+        subu    a3,4
         ld      t1,8(a1)
-        ld      ta1,8(a2)
+        and     AT,a3,MINUS4
         ld      t2,16(a1)
-        ld      ta2,16(a2)
+        PTR_ADD a2,32
         ld      t3,24(a1)
-        ld      ta3,24(a2)
+        PTR_ADD a0,32
+        ld      ta1,-24(a2)
+        PTR_ADD a1,32
+        ld      ta2,-16(a2)
+        ld      ta3,-8(a2)
         daddu   ta0,t0
-        subu    a3,4
         sltu    t8,ta0,t0
         daddu   t0,ta0,v0
-        PTR_ADD a0,32
         sltu    v0,t0,ta0
         sd      t0,-32(a0)
         daddu   v0,t8
 
         daddu   ta1,t1
-        PTR_ADD a1,32
         sltu    t9,ta1,t1
         daddu   t1,ta1,v0
-        PTR_ADD a2,32
         sltu    v0,t1,ta1
         sd      t1,-24(a0)
         daddu   v0,t9
 
         daddu   ta2,t2
-        and     AT,a3,MINUS4
         sltu    t8,ta2,t2
         daddu   t2,ta2,v0
         sltu    v0,t2,ta2
@@ -495,25 +495,26 @@ LEAF(bn_sub_words)
 
 .L_bn_sub_words_loop:
         ld      ta0,0(a2)
+        subu    a3,4
         ld      t1,8(a1)
-        ld      ta1,8(a2)
+        and     AT,a3,MINUS4
         ld      t2,16(a1)
-        ld      ta2,16(a2)
+        PTR_ADD a2,32
         ld      t3,24(a1)
-        ld      ta3,24(a2)
+        PTR_ADD a0,32
+        ld      ta1,-24(a2)
+        PTR_ADD a1,32
+        ld      ta2,-16(a2)
+        ld      ta3,-8(a2)
         sltu    t8,t0,ta0
         dsubu   t0,ta0
-        subu    a3,4
         dsubu   ta0,t0,v0
-        and     AT,a3,MINUS4
-        sd      ta0,0(a0)
+        sd      ta0,-32(a0)
         MOVNZ   (t0,v0,t8)
 
         sltu    t9,t1,ta1
         dsubu   t1,ta1
-        PTR_ADD a0,32
         dsubu   ta1,t1,v0
-        PTR_ADD a1,32
         sd      ta1,-24(a0)
         MOVNZ   (t1,v0,t9)
 
@@ -521,7 +522,6 @@ LEAF(bn_sub_words)
         sltu    t8,t2,ta2
         dsubu   t2,ta2
         dsubu   ta2,t2,v0
-        PTR_ADD a2,32
         sd      ta2,-16(a0)
         MOVNZ   (t2,v0,t8)
 
@@ -574,6 +574,51 @@ END(bn_sub_words)
 
 #undef  MINUS4
 
+.align 5
+LEAF(bn_div_3_words)
+        .set    reorder
+        move    a3,a0           /* we know that bn_div_words doesn't
+                                 * touch a3, ta2, ta3 and preserves a2
+                                 * so that we can save two arguments
+                                 * and return address in registers
+                                 * instead of stack:-)
+                                 */
+        ld      a0,(a3)
+        move    ta2,a1
+        ld      a1,-8(a3)
+        move    ta3,ra
+        move    v1,zero
+        li      v0,-1
+        beq     a0,a2,.L_bn_div_3_words_skip_div
+        bal     bn_div_words
+        move    ra,ta3
+.L_bn_div_3_words_skip_div:
+        dmultu  ta2,v0
+        ld      t2,-16(a3)
+        move    ta0,zero
+        mfhi    t1
+        mflo    t0
+        sltu    t8,t1,v1
+.L_bn_div_3_words_inner_loop:
+        bnez    t8,.L_bn_div_3_words_inner_loop_done
+        sgeu    AT,t2,t0
+        seq     t9,t1,v1
+        and     AT,t9
+        sltu    t3,t0,ta2
+        daddu   v1,a2
+        dsubu   t1,t3
+        dsubu   t0,ta2
+        sltu    t8,t1,v1
+        sltu    ta0,v1,a2
+        or      t8,ta0
+        .set    noreorder
+        beqzl   AT,.L_bn_div_3_words_inner_loop
+        dsubu   v0,1
+        .set    reorder
+.L_bn_div_3_words_inner_loop_done:
+        jr      ra
+END(bn_div_3_words)
+
 .align  5
 LEAF(bn_div_words)
         .set    noreorder
@@ -633,16 +678,16 @@ LEAF(bn_div_words)
         seq     t8,HH,t1
         sltu    AT,HH,t1
         and     t2,t8
+        sltu    v0,t0,a2
         or      AT,t2
         .set    noreorder
         beqz    AT,.L_bn_div_words_inner_loop1_done
-        sltu    t2,t0,a2
-        .set    reorder
-        dsubu   QT,1
+        dsubu   t1,v0
         dsubu   t0,a2
-        dsubu   t1,t2
         b       .L_bn_div_words_inner_loop1
-.L_bn_div_words_inner_loop1_done:       
+        dsubu   QT,1
+        .set    reorder
+.L_bn_div_words_inner_loop1_done:
 
         dsll    a1,32
         dsubu   a0,t3,t0
@@ -655,6 +700,7 @@ LEAF(bn_div_words)
         ddivu   zero,a0,DH
         mflo    QT
 .L_bn_div_words_skip_div2:
+#undef  DH
         dmultu  a2,QT
         dsll    t3,a0,32
         dsrl    AT,a1,32
@@ -666,69 +712,26 @@ LEAF(bn_div_words)
         seq     t8,HH,t1
         sltu    AT,HH,t1
         and     t2,t8
+        sltu    v1,t0,a2
         or      AT,t2
         .set    noreorder
         beqz    AT,.L_bn_div_words_inner_loop2_done
-        sltu    t2,t0,a2
-        .set    reorder
-        dsubu   QT,1
+        dsubu   t1,v1
         dsubu   t0,a2
-        dsubu   t1,t2
         b       .L_bn_div_words_inner_loop2
+        dsubu   QT,1
+        .set    reorder
 .L_bn_div_words_inner_loop2_done:       
+#undef  HH
 
         dsubu   a0,t3,t0
         or      v0,QT
         dsrl    v1,a0,t9        /* v1 contains remainder if anybody wants it */
         dsrl    a2,t9           /* restore a2 */
         jr      ra
-#undef  HH
-#undef  DH
 #undef  QT
 END(bn_div_words)
 
-.align 5
-LEAF(bn_div_3_words)
-        .set    reorder
-        move    a3,a0           /* we know that bn_div_words doesn't
-                                 * touch a3, ta2, ta3 and preserves a2
-                                 * so that we can save two arguments
-                                 * and return address in registers
-                                 * instead of stack:-)
-                                 */
-        ld      a0,(a3)
-        move    ta2,a2
-        move    a2,a1
-        ld      a1,-8(a3)
-        move    ta3,ra
-        move    v1,zero
-        li      v0,-1
-        beq     a0,a2,.L_bn_div_3_words_skip_div
-        jal     bn_div_words
-        move    ra,ta3
-.L_bn_div_3_words_skip_div:
-        dmultu  ta2,v0
-        ld      t2,-16(a3)
-        mflo    t0
-        mfhi    t1
-.L_bn_div_3_words_inner_loop:
-        sgeu    AT,t2,t0
-        seq     t9,t1,v1
-        sltu    t8,t1,v1
-        and     AT,t9
-        or      AT,t8
-        bnez    AT,.L_bn_div_3_words_inner_loop_done
-        daddu   v1,a2
-        sltu    t3,t0,ta2
-        sltu    AT,v1,a2
-        dsubu   v0,1
-        dsubu   t0,ta2
-        dsubu   t1,t3
-        beqz    AT,.L_bn_div_3_words_inner_loop
-.L_bn_div_3_words_inner_loop_done:
-        jr      ra
-END(bn_div_3_words)
-
 #define a_0     t0
 #define a_1     t1
 #define a_2     t2
diff --git a/src/lib/libcrypto/bn/bn.h b/src/lib/libcrypto/bn/bn.h
index f935e1ca79..d8822610df 100644
--- a/src/lib/libcrypto/bn/bn.h
+++ b/src/lib/libcrypto/bn/bn.h
@@ -83,12 +83,12 @@ extern "C" {
  * The reason for this flag is that when the particular C compiler
  * library routine is used, and the library is linked with a different
  * compiler, the library is missing.  This mostly happens when the
- * library is built with gcc and then linked using nornal cc.  This would
- * be a common occurance because gcc normally produces code that is
+ * library is built with gcc and then linked using normal cc.  This would
+ * be a common occurrence because gcc normally produces code that is
  * 2 times faster than system compilers for the big number stuff.
  * For machines with only one compiler (or shared libraries), this should
  * be on.  Again this in only really a problem on machines
- * using "long long's", are 32bit, and are not using my assember code. */
+ * using "long long's", are 32bit, and are not using my assembler code. */
 #if defined(MSDOS) || defined(WINDOWS) || defined(linux)
 #define BN_DIV2W
 #endif
@@ -118,8 +118,8 @@ extern "C" {
 
 /* This is where the long long data type is 64 bits, but long is 32.
  * For machines where there are 64bit registers, this is the mode to use.
- * IRIX, on R4000 and above should use this mode, along with the relevent
- * assember code :-).  Do NOT define BN_LLONG.
+ * IRIX, on R4000 and above should use this mode, along with the relevant
+ * assembler code :-).  Do NOT define BN_LLONG.
  */
 #ifdef SIXTY_FOUR_BIT
 #undef BN_LLONG
@@ -240,11 +240,15 @@ typedef struct bignum_st
 
 /* Used for temp variables */
 #define BN_CTX_NUM      12
+#define BN_CTX_NUM_POS  12
 typedef struct bignum_ctx
         {
         int tos;
-        BIGNUM bn[BN_CTX_NUM+1];
+        BIGNUM bn[BN_CTX_NUM];
         int flags;
+        int depth;
+        int pos[BN_CTX_NUM_POS];
+        int too_many;
         } BN_CTX;
 
 typedef struct bn_blinding_st
@@ -257,16 +261,15 @@ typedef struct bn_blinding_st
 
 /* Used for montgomery multiplication */
 typedef struct bn_mont_ctx_st
-        {
-        int use_word;   /* 0 for word form, 1 for long form */
-        int ri;         /* number of bits in R */
-        BIGNUM RR;     /* used to convert to montgomery form */
-        BIGNUM N;      /* The modulus */
-        BIGNUM Ni;     /* The inverse of N */
-        BN_ULONG n0;    /* word form of inverse, normally only one of
-                         * Ni or n0 is defined */
+        {
+        int ri;        /* number of bits in R */
+        BIGNUM RR;     /* used to convert to montgomery form */
+        BIGNUM N;      /* The modulus */
+        BIGNUM Ni;     /* R*(1/R mod N) - N*Ni = 1
+                        * (Ni is only stored for bignum algorithm) */
+        BN_ULONG n0;   /* least significant word of Ni */
         int flags;
-        } BN_MONT_CTX;
+        } BN_MONT_CTX;
 
 /* Used for reciprocal division/mod functions
  * It cannot be shared between threads
@@ -283,7 +286,26 @@ typedef struct bn_recp_ctx_st
 #define BN_to_montgomery(r,a,mont,ctx)  BN_mod_mul_montgomery(\
         r,a,&((mont)->RR),(mont),ctx)
 
-#define BN_prime_checks         (5)
+#define BN_prime_checks 0 /* default: select number of iterations
+                             based on the size of the number */
+
+/* number of Miller-Rabin iterations for an error rate  of less than 2^-80
+ * for random 'b'-bit input, b >= 100 (taken from table 4.4 in the Handbook
+ * of Applied Cryptography [Menezes, van Oorschot, Vanstone; CRC Press 1996];
+ * original paper: Damgaard, Landrock, Pomerance: Average case error estimates
+ * for the strong probable prime test. -- Math. Comp. 61 (1993) 177-194) */
+#define BN_prime_checks_for_size(b) ((b) >= 1300 ?  2 : \
+                                (b) >=  850 ?  3 : \
+                                (b) >=  650 ?  4 : \
+                                (b) >=  550 ?  5 : \
+                                (b) >=  450 ?  6 : \
+                                (b) >=  400 ?  7 : \
+                                (b) >=  350 ?  8 : \
+                                (b) >=  300 ?  9 : \
+                                (b) >=  250 ? 12 : \
+                                (b) >=  200 ? 15 : \
+                                (b) >=  150 ? 18 : \
+                                /* b >= 100 */ 27)
 
 #define BN_num_bytes(a) ((BN_num_bits(a)+7)/8)
 #define BN_is_word(a,w) (((a)->top == 1) && ((a)->d[0] == (BN_ULONG)(w)))
@@ -296,26 +318,16 @@ typedef struct bn_recp_ctx_st
 /*#define BN_ascii2bn(a)        BN_hex2bn(a) */
 /*#define BN_bn2ascii(a)        BN_bn2hex(a) */
 
-#define bn_expand(n,b) ((((((b+BN_BITS2-1))/BN_BITS2)) <= (n)->max)?\
-        (n):bn_expand2((n),(b)/BN_BITS2+1))
-#define bn_wexpand(n,b) (((b) <= (n)->max)?(n):bn_expand2((n),(b)))
-
-#define bn_fix_top(a) \
-        { \
-        BN_ULONG *ftl; \
-        if ((a)->top > 0) \
-                { \
-                for (ftl= &((a)->d[(a)->top-1]); (a)->top > 0; (a)->top--) \
-                if (*(ftl--)) break; \
-                } \
-        }
-
 BIGNUM *BN_value_one(void);
 char *  BN_options(void);
 BN_CTX *BN_CTX_new(void);
 void    BN_CTX_init(BN_CTX *c);
 void    BN_CTX_free(BN_CTX *c);
+void    BN_CTX_start(BN_CTX *ctx);
+BIGNUM *BN_CTX_get(BN_CTX *ctx);
+void    BN_CTX_end(BN_CTX *ctx);
 int     BN_rand(BIGNUM *rnd, int bits, int top,int bottom);
+int     BN_pseudo_rand(BIGNUM *rnd, int bits, int top,int bottom);
 int     BN_num_bits(const BIGNUM *a);
 int     BN_num_bits_word(BN_ULONG);
 BIGNUM *BN_new(void);
@@ -329,13 +341,13 @@ int	BN_bn2mpi(const BIGNUM *a, unsigned char *to);
 int     BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int     BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int     BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
-int     BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b);
+int     BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int     BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx);
 int     BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
                BN_CTX *ctx);
-int     BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b,BN_CTX *ctx);
+int     BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
 int     BN_sqr(BIGNUM *r, BIGNUM *a,BN_CTX *ctx);
-BN_ULONG BN_mod_word(BIGNUM *a, BN_ULONG w);
+BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w);
 BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w);
 int     BN_mul_word(BIGNUM *a, BN_ULONG w);
 int     BN_add_word(BIGNUM *a, BN_ULONG w);
@@ -358,19 +370,18 @@ int	BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p,
         BIGNUM *m,BN_CTX *ctx);
 int     BN_mask_bits(BIGNUM *a,int n);
 int     BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx);
-#ifndef WIN16
-int     BN_print_fp(FILE *fp, BIGNUM *a);
+#ifndef NO_FP_API
+int     BN_print_fp(FILE *fp, const BIGNUM *a);
 #endif
 #ifdef HEADER_BIO_H
 int     BN_print(BIO *fp, const BIGNUM *a);
 #else
-int     BN_print(char *fp, const BIGNUM *a);
+int     BN_print(void *fp, const BIGNUM *a);
 #endif
 int     BN_reciprocal(BIGNUM *r, BIGNUM *m, int len, BN_CTX *ctx);
 int     BN_rshift(BIGNUM *r, BIGNUM *a, int n);
 int     BN_rshift1(BIGNUM *r, BIGNUM *a);
 void    BN_clear(BIGNUM *a);
-BIGNUM *bn_expand2(BIGNUM *b, int bits);
 BIGNUM *BN_dup(const BIGNUM *a);
 int     BN_ucmp(const BIGNUM *a, const BIGNUM *b);
 int     BN_set_bit(BIGNUM *a, int n);
@@ -381,19 +392,16 @@ int 	BN_hex2bn(BIGNUM **a, const char *str);
 int     BN_dec2bn(BIGNUM **a, const char *str);
 int     BN_gcd(BIGNUM *r,BIGNUM *in_a,BIGNUM *in_b,BN_CTX *ctx);
 BIGNUM *BN_mod_inverse(BIGNUM *ret,BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);
-BIGNUM *BN_generate_prime(BIGNUM *ret,int bits,int strong,BIGNUM *add,
+BIGNUM *BN_generate_prime(BIGNUM *ret,int bits,int safe,BIGNUM *add,
                 BIGNUM *rem,void (*callback)(int,int,void *),void *cb_arg);
-int     BN_is_prime(BIGNUM *p,int nchecks,void (*callback)(int,int,void *),
+int     BN_is_prime(const BIGNUM *p,int nchecks,
+                void (*callback)(int,int,void *),
                 BN_CTX *ctx,void *cb_arg);
+int     BN_is_prime_fasttest(const BIGNUM *p,int nchecks,
+                void (*callback)(int,int,void *),BN_CTX *ctx,void *cb_arg,
+                int do_trial_division);
 void    ERR_load_BN_strings(void );
 
-BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
-BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
-void     bn_sqr_words(BN_ULONG *rp, BN_ULONG *ap, int num);
-BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d);
-BN_ULONG bn_add_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
-BN_ULONG bn_sub_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
-
 BN_MONT_CTX *BN_MONT_CTX_new(void );
 void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
 int BN_mod_mul_montgomery(BIGNUM *r,BIGNUM *a,BIGNUM *b,BN_MONT_CTX *mont,
@@ -423,6 +431,39 @@ int	BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 int     BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m,
                 BN_RECP_CTX *recp, BN_CTX *ctx);
 
+/* library internal functions */
+
+#define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->max)?\
+        (a):bn_expand2((a),(bits)/BN_BITS2+1))
+#define bn_wexpand(a,words) (((words) <= (a)->max)?(a):bn_expand2((a),(words)))
+BIGNUM *bn_expand2(BIGNUM *a, int words);
+
+#define bn_fix_top(a) \
+        { \
+        BN_ULONG *ftl; \
+        if ((a)->top > 0) \
+                { \
+                for (ftl= &((a)->d[(a)->top-1]); (a)->top > 0; (a)->top--) \
+                if (*(ftl--)) break; \
+                } \
+        }
+
+BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
+BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
+void     bn_sqr_words(BN_ULONG *rp, BN_ULONG *ap, int num);
+BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d);
+BN_ULONG bn_add_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
+BN_ULONG bn_sub_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
+
+#ifdef BN_DEBUG
+  void bn_dump1(FILE *o, const char *a, BN_ULONG *b,int n);
+# define bn_print(a) {fprintf(stderr, #a "="); BN_print_fp(stderr,a); \
+   fprintf(stderr,"\n");}
+# define bn_dump(a,n) bn_dump1(stderr,#a,a,n);
+#else
+# define bn_print(a)
+# define bn_dump(a,b)
+#endif
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -438,6 +479,7 @@ int	BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m,
 #define BN_F_BN_BLINDING_UPDATE                          103
 #define BN_F_BN_BN2DEC                                   104
 #define BN_F_BN_BN2HEX                                   105
+#define BN_F_BN_CTX_GET                                  116
 #define BN_F_BN_CTX_NEW                                  106
 #define BN_F_BN_DIV                                      107
 #define BN_F_BN_EXPAND2                                  108
@@ -459,6 +501,7 @@ int	BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m,
 #define BN_R_INVALID_LENGTH                              106
 #define BN_R_NOT_INITIALIZED                             107
 #define BN_R_NO_INVERSE                                  108
+#define BN_R_TOO_MANY_TEMPORARY_VARIABLES                109
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libcrypto/bn/bn_add.c b/src/lib/libcrypto/bn/bn_add.c
index c5ab066c9e..5d24691233 100644
--- a/src/lib/libcrypto/bn/bn_add.c
+++ b/src/lib/libcrypto/bn/bn_add.c
@@ -61,9 +61,9 @@
 #include "bn_lcl.h"
 
 /* r can == a or b */
-int BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b)
+int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         {
-        BIGNUM *tmp;
+        const BIGNUM *tmp;
 
         bn_check_top(a);
         bn_check_top(b);
diff --git a/src/lib/libcrypto/bn/bn_asm.c b/src/lib/libcrypto/bn/bn_asm.c
index 4d3da16a0c..3329cc18e6 100644
--- a/src/lib/libcrypto/bn/bn_asm.c
+++ b/src/lib/libcrypto/bn/bn_asm.c
@@ -56,31 +56,38 @@
  * [including the GNU Public Licence.]
  */
 
+#ifndef BN_DEBUG
+# undef NDEBUG /* avoid conflicting definitions */
+# define NDEBUG
+#endif
+
 #include <stdio.h>
+#include <assert.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-#ifdef BN_LLONG 
+#if defined(BN_LLONG) || defined(BN_UMULT_HIGH)
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
         {
         BN_ULONG c1=0;
 
-        bn_check_num(num);
+        assert(num >= 0);
         if (num <= 0) return(c1);
 
-        for (;;)
+        while (num&~3)
                 {
                 mul_add(rp[0],ap[0],w,c1);
-                if (--num == 0) break;
                 mul_add(rp[1],ap[1],w,c1);
-                if (--num == 0) break;
                 mul_add(rp[2],ap[2],w,c1);
-                if (--num == 0) break;
                 mul_add(rp[3],ap[3],w,c1);
-                if (--num == 0) break;
-                ap+=4;
-                rp+=4;
+                ap+=4; rp+=4; num-=4;
+                }
+        if (num)
+                {
+                mul_add(rp[0],ap[0],w,c1); if (--num==0) return c1;
+                mul_add(rp[1],ap[1],w,c1); if (--num==0) return c1;
+                mul_add(rp[2],ap[2],w,c1); return c1;
                 }
         
         return(c1);
@@ -90,63 +97,54 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
         {
         BN_ULONG c1=0;
 
-        bn_check_num(num);
+        assert(num >= 0);
         if (num <= 0) return(c1);
 
-        /* for (;;) */
-        while (1) /* circumvent egcs-1.1.2 bug */
+        while (num&~3)
                 {
                 mul(rp[0],ap[0],w,c1);
-                if (--num == 0) break;
                 mul(rp[1],ap[1],w,c1);
-                if (--num == 0) break;
                 mul(rp[2],ap[2],w,c1);
-                if (--num == 0) break;
                 mul(rp[3],ap[3],w,c1);
-                if (--num == 0) break;
-                ap+=4;
-                rp+=4;
+                ap+=4; rp+=4; num-=4;
+                }
+        if (num)
+                {
+                mul(rp[0],ap[0],w,c1); if (--num == 0) return c1;
+                mul(rp[1],ap[1],w,c1); if (--num == 0) return c1;
+                mul(rp[2],ap[2],w,c1);
                 }
         return(c1);
         } 
 
 void bn_sqr_words(BN_ULONG *r, BN_ULONG *a, int n)
         {
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return;
-        for (;;)
+        while (n&~3)
                 {
-                BN_ULLONG t;
-
-                t=(BN_ULLONG)(a[0])*(a[0]);
-                r[0]=Lw(t); r[1]=Hw(t);
-                if (--n == 0) break;
-
-                t=(BN_ULLONG)(a[1])*(a[1]);
-                r[2]=Lw(t); r[3]=Hw(t);
-                if (--n == 0) break;
-
-                t=(BN_ULLONG)(a[2])*(a[2]);
-                r[4]=Lw(t); r[5]=Hw(t);
-                if (--n == 0) break;
-
-                t=(BN_ULLONG)(a[3])*(a[3]);
-                r[6]=Lw(t); r[7]=Hw(t);
-                if (--n == 0) break;
-
-                a+=4;
-                r+=8;
+                sqr(r[0],r[1],a[0]);
+                sqr(r[2],r[3],a[1]);
+                sqr(r[4],r[5],a[2]);
+                sqr(r[6],r[7],a[3]);
+                a+=4; r+=8; n-=4;
+                }
+        if (n)
+                {
+                sqr(r[0],r[1],a[0]); if (--n == 0) return;
+                sqr(r[2],r[3],a[1]); if (--n == 0) return;
+                sqr(r[4],r[5],a[2]);
                 }
         }
 
-#else
+#else /* !(defined(BN_LLONG) || defined(BN_UMULT_HIGH)) */
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
         {
         BN_ULONG c=0;
         BN_ULONG bl,bh;
 
-        bn_check_num(num);
+        assert(num >= 0);
         if (num <= 0) return((BN_ULONG)0);
 
         bl=LBITS(w);
@@ -173,7 +171,7 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
         BN_ULONG carry=0;
         BN_ULONG bl,bh;
 
-        bn_check_num(num);
+        assert(num >= 0);
         if (num <= 0) return((BN_ULONG)0);
 
         bl=LBITS(w);
@@ -197,7 +195,7 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
 
 void bn_sqr_words(BN_ULONG *r, BN_ULONG *a, int n)
         {
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return;
         for (;;)
                 {
@@ -218,7 +216,7 @@ void bn_sqr_words(BN_ULONG *r, BN_ULONG *a, int n)
                 }
         }
 
-#endif
+#endif /* !(defined(BN_LLONG) || defined(BN_UMULT_HIGH)) */
 
 #if defined(BN_LLONG) && defined(BN_DIV2W)
 
@@ -300,14 +298,14 @@ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
         ret|=q;
         return(ret);
         }
-#endif
+#endif /* !defined(BN_LLONG) && defined(BN_DIV2W) */
 
 #ifdef BN_LLONG
 BN_ULONG bn_add_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
         BN_ULLONG ll=0;
 
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return((BN_ULONG)0);
 
         for (;;)
@@ -338,12 +336,12 @@ BN_ULONG bn_add_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
                 }
         return((BN_ULONG)ll);
         }
-#else
+#else /* !BN_LLONG */
 BN_ULONG bn_add_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
         BN_ULONG c,l,t;
 
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return((BN_ULONG)0);
 
         c=0;
@@ -387,14 +385,14 @@ BN_ULONG bn_add_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
                 }
         return((BN_ULONG)c);
         }
-#endif
+#endif /* !BN_LLONG */
 
 BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
         BN_ULONG t1,t2;
         int c=0;
 
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return((BN_ULONG)0);
 
         for (;;)
@@ -433,6 +431,11 @@ BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
 #undef bn_sqr_comba8
 #undef bn_sqr_comba4
 
+/* mul_add_c(a,b,c0,c1,c2)  -- c+=a*b for three word number c=(c2,c1,c0) */
+/* mul_add_c2(a,b,c0,c1,c2) -- c+=2*a*b for three word number c=(c2,c1,c0) */
+/* sqr_add_c(a,i,c0,c1,c2)  -- c+=a[i]^2 for three word number c=(c2,c1,c0) */
+/* sqr_add_c2(a,i,c0,c1,c2) -- c+=2*a[i]*a[j] for three word number c=(c2,c1,c0) */
+
 #ifdef BN_LLONG
 #define mul_add_c(a,b,c0,c1,c2) \
         t=(BN_ULLONG)a*b; \
@@ -460,7 +463,39 @@ BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
 
 #define sqr_add_c2(a,i,j,c0,c1,c2) \
         mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#else
+
+#elif defined(BN_UMULT_HIGH)
+
+#define mul_add_c(a,b,c0,c1,c2) {       \
+        BN_ULONG ta=(a),tb=(b);         \
+        t1 = ta * tb;                   \
+        t2 = BN_UMULT_HIGH(ta,tb);      \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define mul_add_c2(a,b,c0,c1,c2) {      \
+        BN_ULONG ta=(a),tb=(b),t0;      \
+        t1 = BN_UMULT_HIGH(ta,tb);      \
+        t0 = ta * tb;                   \
+        t2 = t1+t1; c2 += (t2<t1)?1:0;  \
+        t1 = t0+t0; t2 += (t1<t0)?1:0;  \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define sqr_add_c(a,i,c0,c1,c2) {       \
+        BN_ULONG ta=(a)[i];             \
+        t1 = ta * ta;                   \
+        t2 = BN_UMULT_HIGH(ta,ta);      \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define sqr_add_c2(a,i,j,c0,c1,c2)      \
+        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
+
+#else /* !BN_LLONG */
 #define mul_add_c(a,b,c0,c1,c2) \
         t1=LBITS(a); t2=HBITS(a); \
         bl=LBITS(b); bh=HBITS(b); \
@@ -487,7 +522,7 @@ BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
 
 #define sqr_add_c2(a,i,j,c0,c1,c2) \
         mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#endif
+#endif /* !BN_LLONG */
 
 void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
         {
@@ -762,7 +797,7 @@ void bn_sqr_comba4(BN_ULONG *r, BN_ULONG *a)
         r[6]=c1;
         r[7]=c2;
         }
-#else
+#else /* !BN_MUL_COMBA */
 
 /* hmm... is it faster just to do a multiply? */
 #undef bn_sqr_comba4
@@ -799,4 +834,4 @@ void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
         r[15]=bn_mul_add_words(&(r[7]),a,8,b[7]);
         }
 
-#endif /* BN_COMBA */
+#endif /* !BN_MUL_COMBA */
diff --git a/src/lib/libcrypto/bn/bn_comba.c b/src/lib/libcrypto/bn/bn_comba.c
index 7ad09b4a6d..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/bn_comba.c
+++ b/src/lib/libcrypto/bn/bn_comba.c
@@ -1,345 +0,0 @@
-/* crypto/bn/bn_comba.c */
-#include <stdio.h>
-#include "bn_lcl.h"
-/* Auto generated from crypto/bn/comba.pl
- */
-
-#undef bn_mul_comba8
-#undef bn_mul_comba4
-#undef bn_sqr_comba8
-#undef bn_sqr_comba4
-
-#ifdef BN_LLONG
-#define mul_add_c(a,b,c0,c1,c2) \
-        t=(BN_ULLONG)a*b; \
-        t1=(BN_ULONG)Lw(t); \
-        t2=(BN_ULONG)Hw(t); \
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define mul_add_c2(a,b,c0,c1,c2) \
-        t=(BN_ULLONG)a*b; \
-        tt=(t+t)&BN_MASK; \
-        if (tt < t) c2++; \
-        t1=(BN_ULONG)Lw(tt); \
-        t2=(BN_ULONG)Hw(tt); \
-        c0=(c0+t1)&BN_MASK2;  \
-        if ((c0 < t1) && (((++t2)&BN_MASK2) == 0)) c2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c(a,i,c0,c1,c2) \
-        t=(BN_ULLONG)a[i]*a[i]; \
-        t1=(BN_ULONG)Lw(t); \
-        t2=(BN_ULONG)Hw(t); \
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c2(a,i,j,c0,c1,c2) \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#else
-#define mul_add_c(a,b,c0,c1,c2) \
-        t1=LBITS(a); t2=HBITS(a); \
-        bl=LBITS(b); bh=HBITS(b); \
-        mul64(t1,t2,bl,bh); \
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define mul_add_c2(a,b,c0,c1,c2) \
-        t1=LBITS(a); t2=HBITS(a); \
-        bl=LBITS(b); bh=HBITS(b); \
-        mul64(t1,t2,bl,bh); \
-        if (t2 & BN_TBIT) c2++; \
-        t2=(t2+t2)&BN_MASK2; \
-        if (t1 & BN_TBIT) t2++; \
-        t1=(t1+t1)&BN_MASK2; \
-        c0=(c0+t1)&BN_MASK2;  \
-        if ((c0 < t1) && (((++t2)&BN_MASK2) == 0)) c2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c(a,i,c0,c1,c2) \
-        sqr64(t1,t2,(a)[i]); \
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c2(a,i,j,c0,c1,c2) \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#endif
-
-void bn_mul_comba88(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
-void bn_mul_comba44(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
-void bn_sqr_comba88(BN_ULONG *r,BN_ULONG *a);
-void bn_sqr_comba44(BN_ULONG *r,BN_ULONG *a);
-
-void bn_mul_comba88(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-        c1=0;
-        c2=0;
-        c3=0;
-        mul_add_c(a[0],b[0],c1,c2,c3);
-        r[0]=c1;
-        c1=0;
-        mul_add_c(a[0],b[1],c2,c3,c1);
-        mul_add_c(a[1],b[0],c2,c3,c1);
-        r[1]=c2;
-        c2=0;
-        mul_add_c(a[2],b[0],c3,c1,c2);
-        mul_add_c(a[1],b[1],c3,c1,c2);
-        mul_add_c(a[0],b[2],c3,c1,c2);
-        r[2]=c3;
-        c3=0;
-        mul_add_c(a[0],b[3],c1,c2,c3);
-        mul_add_c(a[1],b[2],c1,c2,c3);
-        mul_add_c(a[2],b[1],c1,c2,c3);
-        mul_add_c(a[3],b[0],c1,c2,c3);
-        r[3]=c1;
-        c1=0;
-        mul_add_c(a[4],b[0],c2,c3,c1);
-        mul_add_c(a[3],b[1],c2,c3,c1);
-        mul_add_c(a[2],b[2],c2,c3,c1);
-        mul_add_c(a[1],b[3],c2,c3,c1);
-        mul_add_c(a[0],b[4],c2,c3,c1);
-        r[4]=c2;
-        c2=0;
-        mul_add_c(a[0],b[5],c3,c1,c2);
-        mul_add_c(a[1],b[4],c3,c1,c2);
-        mul_add_c(a[2],b[3],c3,c1,c2);
-        mul_add_c(a[3],b[2],c3,c1,c2);
-        mul_add_c(a[4],b[1],c3,c1,c2);
-        mul_add_c(a[5],b[0],c3,c1,c2);
-        r[5]=c3;
-        c3=0;
-        mul_add_c(a[6],b[0],c1,c2,c3);
-        mul_add_c(a[5],b[1],c1,c2,c3);
-        mul_add_c(a[4],b[2],c1,c2,c3);
-        mul_add_c(a[3],b[3],c1,c2,c3);
-        mul_add_c(a[2],b[4],c1,c2,c3);
-        mul_add_c(a[1],b[5],c1,c2,c3);
-        mul_add_c(a[0],b[6],c1,c2,c3);
-        r[6]=c1;
-        c1=0;
-        mul_add_c(a[0],b[7],c2,c3,c1);
-        mul_add_c(a[1],b[6],c2,c3,c1);
-        mul_add_c(a[2],b[5],c2,c3,c1);
-        mul_add_c(a[3],b[4],c2,c3,c1);
-        mul_add_c(a[4],b[3],c2,c3,c1);
-        mul_add_c(a[5],b[2],c2,c3,c1);
-        mul_add_c(a[6],b[1],c2,c3,c1);
-        mul_add_c(a[7],b[0],c2,c3,c1);
-        r[7]=c2;
-        c2=0;
-        mul_add_c(a[7],b[1],c3,c1,c2);
-        mul_add_c(a[6],b[2],c3,c1,c2);
-        mul_add_c(a[5],b[3],c3,c1,c2);
-        mul_add_c(a[4],b[4],c3,c1,c2);
-        mul_add_c(a[3],b[5],c3,c1,c2);
-        mul_add_c(a[2],b[6],c3,c1,c2);
-        mul_add_c(a[1],b[7],c3,c1,c2);
-        r[8]=c3;
-        c3=0;
-        mul_add_c(a[2],b[7],c1,c2,c3);
-        mul_add_c(a[3],b[6],c1,c2,c3);
-        mul_add_c(a[4],b[5],c1,c2,c3);
-        mul_add_c(a[5],b[4],c1,c2,c3);
-        mul_add_c(a[6],b[3],c1,c2,c3);
-        mul_add_c(a[7],b[2],c1,c2,c3);
-        r[9]=c1;
-        c1=0;
-        mul_add_c(a[7],b[3],c2,c3,c1);
-        mul_add_c(a[6],b[4],c2,c3,c1);
-        mul_add_c(a[5],b[5],c2,c3,c1);
-        mul_add_c(a[4],b[6],c2,c3,c1);
-        mul_add_c(a[3],b[7],c2,c3,c1);
-        r[10]=c2;
-        c2=0;
-        mul_add_c(a[4],b[7],c3,c1,c2);
-        mul_add_c(a[5],b[6],c3,c1,c2);
-        mul_add_c(a[6],b[5],c3,c1,c2);
-        mul_add_c(a[7],b[4],c3,c1,c2);
-        r[11]=c3;
-        c3=0;
-        mul_add_c(a[7],b[5],c1,c2,c3);
-        mul_add_c(a[6],b[6],c1,c2,c3);
-        mul_add_c(a[5],b[7],c1,c2,c3);
-        r[12]=c1;
-        c1=0;
-        mul_add_c(a[6],b[7],c2,c3,c1);
-        mul_add_c(a[7],b[6],c2,c3,c1);
-        r[13]=c2;
-        c2=0;
-        mul_add_c(a[7],b[7],c3,c1,c2);
-        r[14]=c3;
-        r[15]=c1;
-        }
-
-void bn_mul_comba44(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-        c1=0;
-        c2=0;
-        c3=0;
-        mul_add_c(a[0],b[0],c1,c2,c3);
-        r[0]=c1;
-        c1=0;
-        mul_add_c(a[0],b[1],c2,c3,c1);
-        mul_add_c(a[1],b[0],c2,c3,c1);
-        r[1]=c2;
-        c2=0;
-        mul_add_c(a[2],b[0],c3,c1,c2);
-        mul_add_c(a[1],b[1],c3,c1,c2);
-        mul_add_c(a[0],b[2],c3,c1,c2);
-        r[2]=c3;
-        c3=0;
-        mul_add_c(a[0],b[3],c1,c2,c3);
-        mul_add_c(a[1],b[2],c1,c2,c3);
-        mul_add_c(a[2],b[1],c1,c2,c3);
-        mul_add_c(a[3],b[0],c1,c2,c3);
-        r[3]=c1;
-        c1=0;
-        mul_add_c(a[3],b[1],c2,c3,c1);
-        mul_add_c(a[2],b[2],c2,c3,c1);
-        mul_add_c(a[1],b[3],c2,c3,c1);
-        r[4]=c2;
-        c2=0;
-        mul_add_c(a[2],b[3],c3,c1,c2);
-        mul_add_c(a[3],b[2],c3,c1,c2);
-        r[5]=c3;
-        c3=0;
-        mul_add_c(a[3],b[3],c1,c2,c3);
-        r[6]=c1;
-        r[7]=c2;
-        }
-
-void bn_sqr_comba88(BN_ULONG *r, BN_ULONG *a)
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t,tt;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-        c1=0;
-        c2=0;
-        c3=0;
-        sqr_add_c(a,0,c1,c2,c3);
-        r[0]=c1;
-        c1=0;
-        sqr_add_c2(a,1,0,c2,c3,c1);
-        r[1]=c2;
-        c2=0;
-        sqr_add_c(a,1,c3,c1,c2);
-        sqr_add_c2(a,2,0,c3,c1,c2);
-        r[2]=c3;
-        c3=0;
-        sqr_add_c2(a,3,0,c1,c2,c3);
-        sqr_add_c2(a,2,1,c1,c2,c3);
-        r[3]=c1;
-        c1=0;
-        sqr_add_c(a,2,c2,c3,c1);
-        sqr_add_c2(a,3,1,c2,c3,c1);
-        sqr_add_c2(a,4,0,c2,c3,c1);
-        r[4]=c2;
-        c2=0;
-        sqr_add_c2(a,5,0,c3,c1,c2);
-        sqr_add_c2(a,4,1,c3,c1,c2);
-        sqr_add_c2(a,3,2,c3,c1,c2);
-        r[5]=c3;
-        c3=0;
-        sqr_add_c(a,3,c1,c2,c3);
-        sqr_add_c2(a,4,2,c1,c2,c3);
-        sqr_add_c2(a,5,1,c1,c2,c3);
-        sqr_add_c2(a,6,0,c1,c2,c3);
-        r[6]=c1;
-        c1=0;
-        sqr_add_c2(a,7,0,c2,c3,c1);
-        sqr_add_c2(a,6,1,c2,c3,c1);
-        sqr_add_c2(a,5,2,c2,c3,c1);
-        sqr_add_c2(a,4,3,c2,c3,c1);
-        r[7]=c2;
-        c2=0;
-        sqr_add_c(a,4,c3,c1,c2);
-        sqr_add_c2(a,5,3,c3,c1,c2);
-        sqr_add_c2(a,6,2,c3,c1,c2);
-        sqr_add_c2(a,7,1,c3,c1,c2);
-        r[8]=c3;
-        c3=0;
-        sqr_add_c2(a,7,2,c1,c2,c3);
-        sqr_add_c2(a,6,3,c1,c2,c3);
-        sqr_add_c2(a,5,4,c1,c2,c3);
-        r[9]=c1;
-        c1=0;
-        sqr_add_c(a,5,c2,c3,c1);
-        sqr_add_c2(a,6,4,c2,c3,c1);
-        sqr_add_c2(a,7,3,c2,c3,c1);
-        r[10]=c2;
-        c2=0;
-        sqr_add_c2(a,7,4,c3,c1,c2);
-        sqr_add_c2(a,6,5,c3,c1,c2);
-        r[11]=c3;
-        c3=0;
-        sqr_add_c(a,6,c1,c2,c3);
-        sqr_add_c2(a,7,5,c1,c2,c3);
-        r[12]=c1;
-        c1=0;
-        sqr_add_c2(a,7,6,c2,c3,c1);
-        r[13]=c2;
-        c2=0;
-        sqr_add_c(a,7,c3,c1,c2);
-        r[14]=c3;
-        r[15]=c1;
-        }
-
-void bn_sqr_comba44(BN_ULONG *r, BN_ULONG *a)
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t,tt;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-        c1=0;
-        c2=0;
-        c3=0;
-        sqr_add_c(a,0,c1,c2,c3);
-        r[0]=c1;
-        c1=0;
-        sqr_add_c2(a,1,0,c2,c3,c1);
-        r[1]=c2;
-        c2=0;
-        sqr_add_c(a,1,c3,c1,c2);
-        sqr_add_c2(a,2,0,c3,c1,c2);
-        r[2]=c3;
-        c3=0;
-        sqr_add_c2(a,3,0,c1,c2,c3);
-        sqr_add_c2(a,2,1,c1,c2,c3);
-        r[3]=c1;
-        c1=0;
-        sqr_add_c(a,2,c2,c3,c1);
-        sqr_add_c2(a,3,1,c2,c3,c1);
-        r[4]=c2;
-        c2=0;
-        sqr_add_c2(a,3,2,c3,c1,c2);
-        r[5]=c3;
-        c3=0;
-        sqr_add_c(a,3,c1,c2,c3);
-        r[6]=c1;
-        r[7]=c2;
-        }
diff --git a/src/lib/libcrypto/bn/bn_ctx.c b/src/lib/libcrypto/bn/bn_ctx.c
new file mode 100644
index 0000000000..46132fd180
--- /dev/null
+++ b/src/lib/libcrypto/bn/bn_ctx.c
@@ -0,0 +1,144 @@
+/* crypto/bn/bn_ctx.c */
+/* Written by Ulf Moeller for the OpenSSL project. */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef BN_CTX_DEBUG
+# undef NDEBUG /* avoid conflicting definitions */
+# define NDEBUG
+#endif
+
+#include <stdio.h>
+#include <assert.h>
+#include "cryptlib.h"
+#include <openssl/bn.h>
+
+
+BN_CTX *BN_CTX_new(void)
+        {
+        BN_CTX *ret;
+
+        ret=(BN_CTX *)Malloc(sizeof(BN_CTX));
+        if (ret == NULL)
+                {
+                BNerr(BN_F_BN_CTX_NEW,ERR_R_MALLOC_FAILURE);
+                return(NULL);
+                }
+
+        BN_CTX_init(ret);
+        ret->flags=BN_FLG_MALLOCED;
+        return(ret);
+        }
+
+void BN_CTX_init(BN_CTX *ctx)
+        {
+        int i;
+        ctx->tos = 0;
+        ctx->flags = 0;
+        ctx->depth = 0;
+        ctx->too_many = 0;
+        for (i = 0; i < BN_CTX_NUM; i++)
+                BN_init(&(ctx->bn[i]));
+        }
+
+void BN_CTX_free(BN_CTX *ctx)
+        {
+        int i;
+
+        if (ctx == NULL) return;
+        assert(ctx->depth == 0);
+
+        for (i=0; i < BN_CTX_NUM; i++)
+                BN_clear_free(&(ctx->bn[i]));
+        if (ctx->flags & BN_FLG_MALLOCED)
+                Free(ctx);
+        }
+
+void BN_CTX_start(BN_CTX *ctx)
+        {
+        if (ctx->depth < BN_CTX_NUM_POS)
+                ctx->pos[ctx->depth] = ctx->tos;
+        ctx->depth++;
+        }
+
+BIGNUM *BN_CTX_get(BN_CTX *ctx)
+        {
+        if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
+                {
+                if (!ctx->too_many)
+                        {
+                        BNerr(BN_F_BN_CTX_GET,BN_R_TOO_MANY_TEMPORARY_VARIABLES);
+                        /* disable error code until BN_CTX_end is called: */
+                        ctx->too_many = 1;
+                        }
+                return NULL;
+                }
+        return (&(ctx->bn[ctx->tos++]));
+        }
+
+void BN_CTX_end(BN_CTX *ctx)
+        {
+        if (ctx == NULL) return;
+        assert(ctx->depth > 0);
+        if (ctx->depth == 0)
+                /* should never happen, but we can tolerate it if not in
+                 * debug mode (could be a 'goto err' in the calling function
+                 * before BN_CTX_start was reached) */
+                BN_CTX_start(ctx);
+
+        ctx->too_many = 0;
+        ctx->depth--;
+        if (ctx->depth < BN_CTX_NUM_POS)
+                ctx->tos = ctx->pos[ctx->depth];
+        }
diff --git a/src/lib/libcrypto/bn/bn_div.c b/src/lib/libcrypto/bn/bn_div.c
index 150dd289a5..07af1d3b44 100644
--- a/src/lib/libcrypto/bn/bn_div.c
+++ b/src/lib/libcrypto/bn/bn_div.c
@@ -63,9 +63,11 @@
 
 /* The old slow way */
 #if 0
-int BN_div(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx)
+int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
+           BN_CTX *ctx)
         {
         int i,nm,nd;
+        int ret = 0;
         BIGNUM *D;
 
         bn_check_top(m);
@@ -84,14 +86,17 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx)
                 return(1);
                 }
 
-        D= &(ctx->bn[ctx->tos]);
-        if (dv == NULL) dv= &(ctx->bn[ctx->tos+1]);
-        if (rem == NULL) rem= &(ctx->bn[ctx->tos+2]);
+        BN_CTX_start(ctx);
+        D = BN_CTX_get(ctx);
+        if (dv == NULL) dv = BN_CTX_get(ctx);
+        if (rem == NULL) rem = BN_CTX_get(ctx);
+        if (D == NULL || dv == NULL || rem == NULL)
+                goto end;
 
         nd=BN_num_bits(d);
         nm=BN_num_bits(m);
-        if (BN_copy(D,d) == NULL) return(0);
-        if (BN_copy(rem,m) == NULL) return(0);
+        if (BN_copy(D,d) == NULL) goto end;
+        if (BN_copy(rem,m) == NULL) goto end;
 
         /* The next 2 are needed so we can do a dv->d[0]|=1 later
          * since BN_lshift1 will only work once there is a value :-) */
@@ -99,25 +104,54 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx)
         bn_wexpand(dv,1);
         dv->top=1;
 
-        if (!BN_lshift(D,D,nm-nd)) return(0);
+        if (!BN_lshift(D,D,nm-nd)) goto end;
         for (i=nm-nd; i>=0; i--)
                 {
-                if (!BN_lshift1(dv,dv)) return(0);
+                if (!BN_lshift1(dv,dv)) goto end;
                 if (BN_ucmp(rem,D) >= 0)
                         {
                         dv->d[0]|=1;
-                        if (!BN_usub(rem,rem,D)) return(0);
+                        if (!BN_usub(rem,rem,D)) goto end;
                         }
 /* CAN IMPROVE (and have now :=) */
-                if (!BN_rshift1(D,D)) return(0);
+                if (!BN_rshift1(D,D)) goto end;
                 }
         rem->neg=BN_is_zero(rem)?0:m->neg;
         dv->neg=m->neg^d->neg;
-        return(1);
+        ret = 1;
+ end:
+        BN_CTX_end(ctx);
+        return(ret);
         }
 
 #else
 
+#if !defined(NO_ASM) && !defined(NO_INLINE_ASM) && !defined(PEDANTIC) && !defined(BN_DIV3W)
+# if defined(__GNUC__) && __GNUC__>=2
+#  if defined(__i386)
+   /*
+    * There were two reasons for implementing this template:
+    * - GNU C generates a call to a function (__udivdi3 to be exact)
+    *   in reply to ((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0 (I fail to
+    *   understand why...);
+    * - divl doesn't only calculate quotient, but also leaves
+    *   remainder in %edx which we can definitely use here:-)
+    *
+    *                                   <appro@fy.chalmers.se>
+    */
+#  define bn_div_words(n0,n1,d0)                \
+        ({  asm volatile (                      \
+                "divl   %4"                     \
+                : "=a"(q), "=d"(rem)            \
+                : "a"(n1), "d"(n0), "g"(d0)     \
+                : "cc");                        \
+            q;                                  \
+        })
+#  define REMAINDER_IS_ALREADY_CALCULATED
+#  endif /* __<cpu> */
+# endif /* __GNUC__ */
+#endif /* NO_ASM */
+
 int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
            BN_CTX *ctx)
         {
@@ -144,13 +178,15 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 return(1);
                 }
 
-        tmp= &(ctx->bn[ctx->tos]);
+        BN_CTX_start(ctx);
+        tmp=BN_CTX_get(ctx);
         tmp->neg=0;
-        snum= &(ctx->bn[ctx->tos+1]);
-        sdiv= &(ctx->bn[ctx->tos+2]);
+        snum=BN_CTX_get(ctx);
+        sdiv=BN_CTX_get(ctx);
         if (dv == NULL)
-                res= &(ctx->bn[ctx->tos+3]);
+                res=BN_CTX_get(ctx);
         else    res=dv;
+        if (res == NULL) goto err;
 
         /* First we normalise the numbers */
         norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
@@ -202,97 +238,76 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 {
                 BN_ULONG q,l0;
 #ifdef BN_DIV3W
-                q=bn_div_3_words(wnump,d0,d1);
+                q=bn_div_3_words(wnump,d1,d0);
 #else
-
-#if !defined(NO_ASM) && !defined(PEDANTIC)
-# if defined(__GNUC__) && __GNUC__>=2
-#  if defined(__i386)
-   /*
-    * There were two reasons for implementing this template:
-    * - GNU C generates a call to a function (__udivdi3 to be exact)
-    *   in reply to ((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0 (I fail to
-    *   understand why...);
-    * - divl doesn't only calculate quotient, but also leaves
-    *   remainder in %edx which we can definitely use here:-)
-    *
-    *                                   <appro@fy.chalmers.se>
-    */
-#  define bn_div_words(n0,n1,d0)                \
-        ({  asm volatile (                      \
-                "divl   %4"                     \
-                : "=a"(q), "=d"(rem)            \
-                : "a"(n1), "d"(n0), "g"(d0)     \
-                : "cc");                        \
-            q;                                  \
-        })
-#  define REMINDER_IS_ALREADY_CALCULATED
-#  endif /* __<cpu> */
-# endif /* __GNUC__ */
-#endif /* NO_ASM */
                 BN_ULONG n0,n1,rem=0;
 
                 n0=wnump[0];
                 n1=wnump[-1];
                 if (n0 == d0)
                         q=BN_MASK2;
-                else
+                else                    /* n0 < d0 */
+                        {
+#ifdef BN_LLONG
+                        BN_ULLONG t2;
+
 #if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
-                        q=((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0;
+                        q=(BN_ULONG)(((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0);
 #else
                         q=bn_div_words(n0,n1,d0);
 #endif
-                {
-#ifdef BN_LLONG
-                BN_ULLONG t2;
-
-#ifndef REMINDER_IS_ALREADY_CALCULATED
-                /*
-                 * rem doesn't have to be BN_ULLONG. The least we
-                 * know it's less that d0, isn't it?
-                 */
-                rem=(n1-q*d0)&BN_MASK2;
+
+#ifndef REMAINDER_IS_ALREADY_CALCULATED
+                        /*
+                         * rem doesn't have to be BN_ULLONG. The least we
+                         * know it's less that d0, isn't it?
+                         */
+                        rem=(n1-q*d0)&BN_MASK2;
 #endif
-                t2=(BN_ULLONG)d1*q;
+                        t2=(BN_ULLONG)d1*q;
+
+                        for (;;)
+                                {
+                                if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))
+                                        break;
+                                q--;
+                                rem += d0;
+                                if (rem < d0) break; /* don't let rem overflow */
+                                t2 -= d1;
+                                }
+#else /* !BN_LLONG */
+                        BN_ULONG t2l,t2h,ql,qh;
 
-                for (;;)
-                        {
-                        if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))
-                                break;
-                        q--;
-                        rem += d0;
-                        if (rem < d0) break; /* don't let rem overflow */
-                        t2 -= d1;
-                        }
+                        q=bn_div_words(n0,n1,d0);
+#ifndef REMAINDER_IS_ALREADY_CALCULATED
+                        rem=(n1-q*d0)&BN_MASK2;
+#endif
+
+#ifdef BN_UMULT_HIGH
+                        t2l = d1 * q;
+                        t2h = BN_UMULT_HIGH(d1,q);
 #else
-                BN_ULONG t2l,t2h,ql,qh;
-
-#ifndef REMINDER_IS_ALREADY_CALCULATED
-                /*
-                 * It's more than enough with the only multiplication.
-                 * See the comment above in BN_LLONG section...
-                 */
-                rem=(n1-q*d0)&BN_MASK2;
+                        t2l=LBITS(d1); t2h=HBITS(d1);
+                        ql =LBITS(q);  qh =HBITS(q);
+                        mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1*q; */
 #endif
-                t2l=LBITS(d1); t2h=HBITS(d1);
-                ql =LBITS(q);  qh =HBITS(q);
-                mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1*q; */
 
-                for (;;)
-                        {
-                        if ((t2h < rem) ||
-                                ((t2h == rem) && (t2l <= wnump[-2])))
-                                break;
-                        q--;
-                        rem += d0;
-                        if (rem < d0) break; /* don't let rem overflow */
-                        if (t2l < d1) t2h--; t2l -= d1;
+                        for (;;)
+                                {
+                                if ((t2h < rem) ||
+                                        ((t2h == rem) && (t2l <= wnump[-2])))
+                                        break;
+                                q--;
+                                rem += d0;
+                                if (rem < d0) break; /* don't let rem overflow */
+                                if (t2l < d1) t2h--; t2l -= d1;
+                                }
+#endif /* !BN_LLONG */
                         }
-#endif
-                }
 #endif /* !BN_DIV3W */
-                wnum.d--; wnum.top++;
+
                 l0=bn_mul_words(tmp->d,sdiv->d,div_n,q);
+                wnum.d--; wnum.top++;
                 tmp->d[div_n]=l0;
                 for (j=div_n+1; j>0; j--)
                         if (tmp->d[j-1]) break;
@@ -318,8 +333,10 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 BN_rshift(rm,snum,norm_shift);
                 rm->neg=num->neg;
                 }
+        BN_CTX_end(ctx);
         return(1);
 err:
+        BN_CTX_end(ctx);
         return(0);
         }
 
@@ -335,22 +352,27 @@ int BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
         if (BN_ucmp(m,d) < 0)
                 return((BN_copy(rem,m) == NULL)?0:1);
 
-        dv= &(ctx->bn[ctx->tos]);
+        BN_CTX_start(ctx);
+        dv=BN_CTX_get(ctx);
 
-        if (!BN_copy(rem,m)) return(0);
+        if (!BN_copy(rem,m)) goto err;
 
         nm=BN_num_bits(rem);
         nd=BN_num_bits(d);
-        if (!BN_lshift(dv,d,nm-nd)) return(0);
+        if (!BN_lshift(dv,d,nm-nd)) goto err;
         for (i=nm-nd; i>=0; i--)
                 {
                 if (BN_cmp(rem,dv) >= 0)
                         {
-                        if (!BN_sub(rem,rem,dv)) return(0);
+                        if (!BN_sub(rem,rem,dv)) goto err;
                         }
-                if (!BN_rshift1(dv,dv)) return(0);
+                if (!BN_rshift1(dv,dv)) goto err;
                 }
+        BN_CTX_end(ctx);
         return(1);
+ err:
+        BN_CTX_end(ctx);
+        return(0);
 #else
         return(BN_div(NULL,rem,m,d,ctx));
 #endif
diff --git a/src/lib/libcrypto/bn/bn_err.c b/src/lib/libcrypto/bn/bn_err.c
index 73e80774e5..f3b9497dca 100644
--- a/src/lib/libcrypto/bn/bn_err.c
+++ b/src/lib/libcrypto/bn/bn_err.c
@@ -71,6 +71,7 @@ static ERR_STRING_DATA BN_str_functs[]=
 {ERR_PACK(0,BN_F_BN_BLINDING_UPDATE,0), "BN_BLINDING_update"},
 {ERR_PACK(0,BN_F_BN_BN2DEC,0),  "BN_bn2dec"},
 {ERR_PACK(0,BN_F_BN_BN2HEX,0),  "BN_bn2hex"},
+{ERR_PACK(0,BN_F_BN_CTX_GET,0), "BN_CTX_get"},
 {ERR_PACK(0,BN_F_BN_CTX_NEW,0), "BN_CTX_new"},
 {ERR_PACK(0,BN_F_BN_DIV,0),     "BN_div"},
 {ERR_PACK(0,BN_F_BN_EXPAND2,0), "bn_expand2"},
@@ -95,6 +96,7 @@ static ERR_STRING_DATA BN_str_reasons[]=
 {BN_R_INVALID_LENGTH                     ,"invalid length"},
 {BN_R_NOT_INITIALIZED                    ,"not initialized"},
 {BN_R_NO_INVERSE                         ,"no inverse"},
+{BN_R_TOO_MANY_TEMPORARY_VARIABLES       ,"too many temporary variables"},
 {0,NULL}
         };
 
diff --git a/src/lib/libcrypto/bn/bn_exp.c b/src/lib/libcrypto/bn/bn_exp.c
index 2df1614ada..0c11601675 100644
--- a/src/lib/libcrypto/bn/bn_exp.c
+++ b/src/lib/libcrypto/bn/bn_exp.c
@@ -59,6 +59,12 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
+#ifdef ATALLA
+# include <alloca.h>
+# include <atasi.h>
+# include <assert.h>
+# include <dlfcn.h>
+#endif
 
 #define TABLE_SIZE      16
 
@@ -72,7 +78,8 @@ int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx)
         bn_check_top(b);
         bn_check_top(m);
 
-        t= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        if ((t = BN_CTX_get(ctx)) == NULL) goto err;
         if (a == b)
                 { if (!BN_sqr(t,a,ctx)) goto err; }
         else
@@ -80,7 +87,7 @@ int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx)
         if (!BN_mod(ret,t,m,ctx)) goto err;
         r=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         return(r);
         }
 
@@ -91,8 +98,10 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
         int i,bits,ret=0;
         BIGNUM *v,*tmp;
 
-        v= &(ctx->bn[ctx->tos++]);
-        tmp= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        v = BN_CTX_get(ctx);
+        tmp = BN_CTX_get(ctx);
+        if (v == NULL || tmp == NULL) goto err;
 
         if (BN_copy(v,a) == NULL) goto err;
         bits=BN_num_bits(p);
@@ -113,7 +122,7 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
                 }
         ret=1;
 err:
-        ctx->tos-=2;
+        BN_CTX_end(ctx);
         return(ret);
         }
 
@@ -122,15 +131,15 @@ err:
 /* this one works - simple but works */
 int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx)
         {
-        int i,bits,ret=0,tos;
+        int i,bits,ret=0;
         BIGNUM *v,*rr;
 
-        tos=ctx->tos;
-        v= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
         if ((r == a) || (r == p))
-                rr= &(ctx->bn[ctx->tos++]);
+                rr = BN_CTX_get(ctx);
         else
-                rr=r;
+                rr = r;
+        if ((v = BN_CTX_get(ctx)) == NULL) goto err;
 
         if (BN_copy(v,a) == NULL) goto err;
         bits=BN_num_bits(p);
@@ -149,11 +158,178 @@ int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx)
                 }
         ret=1;
 err:
-        ctx->tos=tos;
         if (r != rr) BN_copy(r,rr);
+        BN_CTX_end(ctx);
         return(ret);
         }
 
+#ifdef ATALLA
+
+/*
+ * This routine will dynamically check for the existance of an Atalla AXL-200
+ * SSL accelerator module.  If one is found, the variable
+ * asi_accelerator_present is set to 1 and the function pointers
+ * ptr_ASI_xxxxxx above will be initialized to corresponding ASI API calls.
+ */
+typedef int tfnASI_GetPerformanceStatistics(int reset_flag,
+                                            unsigned int *ret_buf);
+typedef int tfnASI_GetHardwareConfig(long card_num, unsigned int *ret_buf);
+typedef int tfnASI_RSAPrivateKeyOpFn(RSAPrivateKey * rsaKey,
+                                     unsigned char *output,
+                                     unsigned char *input,
+                                     unsigned int modulus_len);
+
+static tfnASI_GetHardwareConfig *ptr_ASI_GetHardwareConfig;
+static tfnASI_RSAPrivateKeyOpFn *ptr_ASI_RSAPrivateKeyOpFn;
+static tfnASI_GetPerformanceStatistics *ptr_ASI_GetPerformanceStatistics;
+static int asi_accelerator_present;
+static int tried_atalla;
+
+void atalla_initialize_accelerator_handle(void)
+        {
+        void *dl_handle;
+        int status;
+        unsigned int config_buf[1024]; 
+        static int tested;
+
+        if(tested)
+                return;
+
+        tested=1;
+
+        bzero((void *)config_buf, 1024);
+
+        /*
+         * Check to see if the library is present on the system
+         */
+        dl_handle = dlopen("atasi.so", RTLD_NOW);
+        if (dl_handle == (void *) NULL)
+                {
+/*              printf("atasi.so library is not present on the system\n");
+                printf("No HW acceleration available\n");*/
+                return;
+                }
+
+        /*
+         * The library is present.  Now we'll check to insure that the
+         * LDM is up and running. First we'll get the address of the
+         * function in the atasi library that we need to see if the
+         * LDM is operating.
+         */
+
+        ptr_ASI_GetHardwareConfig =
+          (tfnASI_GetHardwareConfig *)dlsym(dl_handle,"ASI_GetHardwareConfig");
+
+        if (ptr_ASI_GetHardwareConfig)
+                {
+                /*
+                 * We found the call, now we'll get our config
+                 * status.  If we get a non 0 result, the LDM is not
+                 * running and we cannot use the Atalla ASI *
+                 * library.
+                 */
+                status = (*ptr_ASI_GetHardwareConfig)(0L, config_buf);
+                if (status != 0)
+                        {
+                        printf("atasi.so library is present but not initialized\n");
+                        printf("No HW acceleration available\n");
+                        return;
+                        }    
+                }
+        else
+                {
+/*              printf("We found the library, but not the function. Very Strange!\n");*/
+                return ;
+                }
+
+        /* 
+         * It looks like we have acceleration capabilities.  Load up the
+         * pointers to our ASI API calls.
+         */
+        ptr_ASI_RSAPrivateKeyOpFn=
+          (tfnASI_RSAPrivateKeyOpFn *)dlsym(dl_handle, "ASI_RSAPrivateKeyOpFn");
+        if (ptr_ASI_RSAPrivateKeyOpFn == NULL)
+                {
+/*              printf("We found the library, but no RSA function. Very Strange!\n");*/
+                return;
+                }
+
+        ptr_ASI_GetPerformanceStatistics =
+          (tfnASI_GetPerformanceStatistics *)dlsym(dl_handle, "ASI_GetPerformanceStatistics");
+        if (ptr_ASI_GetPerformanceStatistics == NULL)
+                {
+/*              printf("We found the library, but no stat function. Very Strange!\n");*/
+                return;
+              }
+
+        /*
+         * Indicate that acceleration is available
+         */
+        asi_accelerator_present = 1;
+
+/*      printf("This system has acceleration!\n");*/
+
+        return;
+        }
+
+/* make sure this only gets called once when bn_mod_exp calls bn_mod_exp_mont */
+int BN_mod_exp_atalla(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m)
+        {
+        unsigned char *abin;
+        unsigned char *pbin;
+        unsigned char *mbin;
+        unsigned char *rbin;
+        int an,pn,mn,ret;
+        RSAPrivateKey keydata;
+
+        atalla_initialize_accelerator_handle();
+        if(!asi_accelerator_present)
+                return 0;
+
+
+/* We should be able to run without size testing */
+# define ASIZE  128
+        an=BN_num_bytes(a);
+        pn=BN_num_bytes(p);
+        mn=BN_num_bytes(m);
+
+        if(an <= ASIZE && pn <= ASIZE && mn <= ASIZE)
+            {
+            int size=mn;
+
+            assert(an <= mn);
+            abin=alloca(size);
+            memset(abin,'\0',mn);
+            BN_bn2bin(a,abin+size-an);
+
+            pbin=alloca(pn);
+            BN_bn2bin(p,pbin);
+
+            mbin=alloca(size);
+            memset(mbin,'\0',mn);
+            BN_bn2bin(m,mbin+size-mn);
+
+            rbin=alloca(size);
+
+            memset(&keydata,'\0',sizeof keydata);
+            keydata.privateExponent.data=pbin;
+            keydata.privateExponent.len=pn;
+            keydata.modulus.data=mbin;
+            keydata.modulus.len=size;
+
+            ret=(*ptr_ASI_RSAPrivateKeyOpFn)(&keydata,rbin,abin,keydata.modulus.len);
+/*fprintf(stderr,"!%s\n",BN_bn2hex(a));*/
+            if(!ret)
+                {
+                BN_bin2bn(rbin,keydata.modulus.len,r);
+/*fprintf(stderr,"?%s\n",BN_bn2hex(r));*/
+                return 1;
+                }
+            }
+        return 0;
+        }
+#endif /* def ATALLA */
+
 int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
                BN_CTX *ctx)
         {
@@ -163,6 +339,13 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
         bn_check_top(p);
         bn_check_top(m);
 
+#ifdef ATALLA
+        if(BN_mod_exp_atalla(r,a,p,m))
+            return 1;
+/* If it fails, try the other methods (but don't try atalla again) */
+        tried_atalla=1;
+#endif
+
 #ifdef MONT_MUL_MOD
         /* I have finally been able to take out this pre-condition of
          * the top bit being set.  It was caused by an error in BN_div
@@ -180,6 +363,10 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
                 { ret=BN_mod_exp_simple(r,a,p,m,ctx); }
 #endif
 
+#ifdef ATALLA
+        tried_atalla=0;
+#endif
+
         return(ret);
         }
 
@@ -193,7 +380,6 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
         BIGNUM val[TABLE_SIZE];
         BN_RECP_CTX recp;
 
-        aa= &(ctx->bn[ctx->tos++]);
         bits=BN_num_bits(p);
 
         if (bits == 0)
@@ -201,6 +387,10 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                 BN_one(r);
                 return(1);
                 }
+
+        BN_CTX_start(ctx);
+        if ((aa = BN_CTX_get(ctx)) == NULL) goto err;
+
         BN_RECP_CTX_init(&recp);
         if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
 
@@ -289,7 +479,7 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                 }
         ret=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         for (i=0; i<ts; i++)
                 BN_clear_free(&(val[i]));
         BN_RECP_CTX_free(&recp);
@@ -312,19 +502,27 @@ int BN_mod_exp_mont(BIGNUM *rr, BIGNUM *a, const BIGNUM *p,
         bn_check_top(p);
         bn_check_top(m);
 
+#ifdef ATALLA
+        if(!tried_atalla && BN_mod_exp_atalla(rr,a,p,m))
+            return 1;
+/* If it fails, try the other methods */
+#endif
+
         if (!(m->d[0] & 1))
                 {
                 BNerr(BN_F_BN_MOD_EXP_MONT,BN_R_CALLED_WITH_EVEN_MODULUS);
                 return(0);
                 }
-        d= &(ctx->bn[ctx->tos++]);
-        r= &(ctx->bn[ctx->tos++]);
         bits=BN_num_bits(p);
         if (bits == 0)
                 {
-                BN_one(r);
+                BN_one(rr);
                 return(1);
                 }
+        BN_CTX_start(ctx);
+        d = BN_CTX_get(ctx);
+        r = BN_CTX_get(ctx);
+        if (d == NULL || r == NULL) goto err;
 
         /* If this is not done, things will break in the montgomery
          * part */
@@ -432,7 +630,7 @@ int BN_mod_exp_mont(BIGNUM *rr, BIGNUM *a, const BIGNUM *p,
         ret=1;
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
-        ctx->tos-=2;
+        BN_CTX_end(ctx);
         for (i=0; i<ts; i++)
                 BN_clear_free(&(val[i]));
         return(ret);
@@ -448,7 +646,6 @@ int BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,
         BIGNUM *d;
         BIGNUM val[TABLE_SIZE];
 
-        d= &(ctx->bn[ctx->tos++]);
         bits=BN_num_bits(p);
 
         if (bits == 0)
@@ -457,6 +654,9 @@ int BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,
                 return(1);
                 }
 
+        BN_CTX_start(ctx);
+        if ((d = BN_CTX_get(ctx)) == NULL) goto err;
+
         BN_init(&(val[0]));
         ts=1;
         if (!BN_mod(&(val[0]),a,m,ctx)) goto err;               /* 1 */
@@ -541,7 +741,7 @@ int BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,
                 }
         ret=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         for (i=0; i<ts; i++)
                 BN_clear_free(&(val[i]));
         return(ret);
diff --git a/src/lib/libcrypto/bn/bn_exp2.c b/src/lib/libcrypto/bn/bn_exp2.c
index 1132d53365..4f4e9e3299 100644
--- a/src/lib/libcrypto/bn/bn_exp2.c
+++ b/src/lib/libcrypto/bn/bn_exp2.c
@@ -9,7 +9,7 @@
  * bits=1  75.4%  79.4%
  * bits=2  61.2%  62.4%
  * bits=3  61.3%  59.3%
- * The lack of speed improvment is also a function of the pre-calculation
+ * The lack of speed improvement is also a function of the pre-calculation
  * which could be removed.
  */
 #define EXP2_TABLE_BITS 2 /* 1  2  3  4  5  */
@@ -35,15 +35,19 @@ int BN_mod_exp2_mont(BIGNUM *rr, BIGNUM *a1, BIGNUM *p1, BIGNUM *a2,
                 BNerr(BN_F_BN_MOD_EXP_MONT,BN_R_CALLED_WITH_EVEN_MODULUS);
                 return(0);
                 }
-        d= &(ctx->bn[ctx->tos++]);
-        r= &(ctx->bn[ctx->tos++]);
         bits1=BN_num_bits(p1);
         bits2=BN_num_bits(p2);
         if ((bits1 == 0) && (bits2 == 0))
                 {
-                BN_one(r);
+                BN_one(rr);
                 return(1);
                 }
+
+        BN_CTX_start(ctx);
+        d = BN_CTX_get(ctx);
+        r = BN_CTX_get(ctx);
+        if (d == NULL || r == NULL) goto err;
+
         bits=(bits1 > bits2)?bits1:bits2;
 
         /* If this is not done, things will break in the montgomery
@@ -183,7 +187,7 @@ int BN_mod_exp2_mont(BIGNUM *rr, BIGNUM *a1, BIGNUM *p1, BIGNUM *a2,
         ret=1;
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
-        ctx->tos-=2;
+        BN_CTX_end(ctx);
         for (i=0; i<ts; i++)
                 {
                 for (j=0; j<ts; j++)
diff --git a/src/lib/libcrypto/bn/bn_gcd.c b/src/lib/libcrypto/bn/bn_gcd.c
index 64a76f4498..398207196b 100644
--- a/src/lib/libcrypto/bn/bn_gcd.c
+++ b/src/lib/libcrypto/bn/bn_gcd.c
@@ -61,6 +61,7 @@
 #include "bn_lcl.h"
 
 static BIGNUM *euclid(BIGNUM *a, BIGNUM *b);
+
 int BN_gcd(BIGNUM *r, BIGNUM *in_a, BIGNUM *in_b, BN_CTX *ctx)
         {
         BIGNUM *a,*b,*t;
@@ -69,8 +70,10 @@ int BN_gcd(BIGNUM *r, BIGNUM *in_a, BIGNUM *in_b, BN_CTX *ctx)
         bn_check_top(in_a);
         bn_check_top(in_b);
 
-        a= &(ctx->bn[ctx->tos]);
-        b= &(ctx->bn[ctx->tos+1]);
+        BN_CTX_start(ctx);
+        a = BN_CTX_get(ctx);
+        b = BN_CTX_get(ctx);
+        if (a == NULL || b == NULL) goto err;
 
         if (BN_copy(a,in_a) == NULL) goto err;
         if (BN_copy(b,in_b) == NULL) goto err;
@@ -82,6 +85,7 @@ int BN_gcd(BIGNUM *r, BIGNUM *in_a, BIGNUM *in_b, BN_CTX *ctx)
         if (BN_copy(r,t) == NULL) goto err;
         ret=1;
 err:
+        BN_CTX_end(ctx);
         return(ret);
         }
 
@@ -142,20 +146,22 @@ err:
 /* solves ax == 1 (mod n) */
 BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
         {
-        BIGNUM *A,*B,*X,*Y,*M,*D,*R;
+        BIGNUM *A,*B,*X,*Y,*M,*D,*R=NULL;
         BIGNUM *T,*ret=NULL;
         int sign;
 
         bn_check_top(a);
         bn_check_top(n);
 
-        A= &(ctx->bn[ctx->tos]);
-        B= &(ctx->bn[ctx->tos+1]);
-        X= &(ctx->bn[ctx->tos+2]);
-        D= &(ctx->bn[ctx->tos+3]);
-        M= &(ctx->bn[ctx->tos+4]);
-        Y= &(ctx->bn[ctx->tos+5]);
-        ctx->tos+=6;
+        BN_CTX_start(ctx);
+        A = BN_CTX_get(ctx);
+        B = BN_CTX_get(ctx);
+        X = BN_CTX_get(ctx);
+        D = BN_CTX_get(ctx);
+        M = BN_CTX_get(ctx);
+        Y = BN_CTX_get(ctx);
+        if (Y == NULL) goto err;
+
         if (in == NULL)
                 R=BN_new();
         else
@@ -198,7 +204,7 @@ BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
         ret=R;
 err:
         if ((ret == NULL) && (in == NULL)) BN_free(R);
-        ctx->tos-=6;
+        BN_CTX_end(ctx);
         return(ret);
         }
 
diff --git a/src/lib/libcrypto/bn/bn_lcl.h b/src/lib/libcrypto/bn/bn_lcl.h
index 85a372695b..e36ccbc4c2 100644
--- a/src/lib/libcrypto/bn/bn_lcl.h
+++ b/src/lib/libcrypto/bn/bn_lcl.h
@@ -73,18 +73,53 @@ extern "C" {
 #define BN_MUL_LOW_RECURSIVE_SIZE_NORMAL        (32) /* 32 */
 #define BN_MONT_CTX_SET_SIZE_WORD               (64) /* 32 */
 
-#if 0
-#ifndef BN_MUL_COMBA
-/* #define bn_mul_comba8(r,a,b) bn_mul_normal(r,a,8,b,8) */
-/* #define bn_mul_comba4(r,a,b) bn_mul_normal(r,a,4,b,4) */
-#endif
-
-#ifndef BN_SQR_COMBA
-/* This is probably faster than using the C code - I need to check */
-#define bn_sqr_comba8(r,a)      bn_mul_normal(r,a,8,a,8)
-#define bn_sqr_comba4(r,a)      bn_mul_normal(r,a,4,a,4)
-#endif
-#endif
+#if !defined(NO_ASM) && !defined(NO_INLINE_ASM) && !defined(PEDANTIC)
+/*
+ * BN_UMULT_HIGH section.
+ *
+ * No, I'm not trying to overwhelm you when stating that the
+ * product of N-bit numbers is 2*N bits wide:-) No, I don't expect
+ * you to be impressed when I say that if the compiler doesn't
+ * support 2*N integer type, then you have to replace every N*N
+ * multiplication with 4 (N/2)*(N/2) accompanied by some shifts
+ * and additions which unavoidably results in severe performance
+ * penalties. Of course provided that the hardware is capable of
+ * producing 2*N result... That's when you normally start
+ * considering assembler implementation. However! It should be
+ * pointed out that some CPUs (most notably Alpha, PowerPC and
+ * upcoming IA-64 family:-) provide *separate* instruction
+ * calculating the upper half of the product placing the result
+ * into a general purpose register. Now *if* the compiler supports
+ * inline assembler, then it's not impossible to implement the
+ * "bignum" routines (and have the compiler optimize 'em)
+ * exhibiting "native" performance in C. That's what BN_UMULT_HIGH
+ * macro is about:-)
+ *
+ *                                      <appro@fy.chalmers.se>
+ */
+# if defined(__alpha) && (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT))
+#  if defined(__DECC)
+#   include <c_asm.h>
+#   define BN_UMULT_HIGH(a,b)   (BN_ULONG)asm("umulh %a0,%a1,%v0",(a),(b))
+#  elif defined(__GNUC__)
+#   define BN_UMULT_HIGH(a,b)   ({      \
+        register BN_ULONG ret;          \
+        asm ("umulh     %1,%2,%0"       \
+             : "=r"(ret)                \
+             : "r"(a), "r"(b));         \
+        ret;                    })
+#  endif        /* compiler */
+# elif defined(_ARCH_PPC) && defined(__64BIT__) && defined(SIXTY_FOUR_BIT_LONG)
+#  if defined(__GNUC__)
+#   define BN_UMULT_HIGH(a,b)   ({      \
+        register BN_ULONG ret;          \
+        asm ("mulhdu    %0,%1,%2"       \
+             : "=r"(ret)                \
+             : "r"(a), "r"(b));         \
+        ret;                    })
+#  endif        /* compiler */
+# endif         /* cpu */
+#endif          /* NO_ASM */
 
 /*************************************************************
  * Using the long long type
@@ -92,15 +127,12 @@ extern "C" {
 #define Lw(t)    (((BN_ULONG)(t))&BN_MASK2)
 #define Hw(t)    (((BN_ULONG)((t)>>BN_BITS2))&BN_MASK2)
 
-/* These are used for internal error checking and are not normally used */
+/* This is used for internal error checking and is not normally used */
 #ifdef BN_DEBUG
-#define bn_check_top(a) \
-        { if (((a)->top < 0) || ((a)->top > (a)->max)) \
-                { char *nullp=NULL; *nullp='z'; } }
-#define bn_check_num(a) if ((a) < 0) { char *nullp=NULL; *nullp='z'; }
+# include <assert.h>
+# define bn_check_top(a) assert ((a)->top >= 0 && (a)->top <= (a)->max);
 #else
-#define bn_check_top(a)
-#define bn_check_num(a)
+# define bn_check_top(a)
 #endif
 
 /* This macro is to add extra stuff for development checking */
@@ -134,8 +166,6 @@ extern "C" {
         bn_set_max(r); \
         }
 
-/* #define bn_expand(n,b) ((((b)/BN_BITS2) <= (n)->max)?(n):bn_expand2((n),(b))) */
-
 #ifdef BN_LLONG
 #define mul_add(r,a,w,c) { \
         BN_ULLONG t; \
@@ -151,6 +181,43 @@ extern "C" {
         (c)= Hw(t); \
         }
 
+#define sqr(r0,r1,a) { \
+        BN_ULLONG t; \
+        t=(BN_ULLONG)(a)*(a); \
+        (r0)=Lw(t); \
+        (r1)=Hw(t); \
+        }
+
+#elif defined(BN_UMULT_HIGH)
+#define mul_add(r,a,w,c) {              \
+        BN_ULONG high,low,ret,tmp=(a);  \
+        ret =  (r);                     \
+        high=  BN_UMULT_HIGH(w,tmp);    \
+        ret += (c);                     \
+        low =  (w) * tmp;               \
+        (c) =  (ret<(c))?1:0;           \
+        (c) += high;                    \
+        ret += low;                     \
+        (c) += (ret<low)?1:0;           \
+        (r) =  ret;                     \
+        }
+
+#define mul(r,a,w,c)    {               \
+        BN_ULONG high,low,ret,ta=(a);   \
+        low =  (w) * ta;                \
+        high=  BN_UMULT_HIGH(w,ta);     \
+        ret =  low + (c);               \
+        (c) =  high;                    \
+        (c) += (ret<low)?1:0;           \
+        (r) =  ret;                     \
+        }
+
+#define sqr(r0,r1,a)    {               \
+        BN_ULONG tmp=(a);               \
+        (r0) = tmp * tmp;               \
+        (r1) = BN_UMULT_HIGH(tmp,tmp);  \
+        }
+
 #else
 /*************************************************************
  * No long long type
@@ -228,21 +295,7 @@ extern "C" {
         (c)=h&BN_MASK2; \
         (r)=l&BN_MASK2; \
         }
-
-#endif
-
-OPENSSL_EXTERN int bn_limit_bits;
-OPENSSL_EXTERN int bn_limit_num;        /* (1<<bn_limit_bits) */
-/* Recursive 'low' limit */
-OPENSSL_EXTERN int bn_limit_bits_low;
-OPENSSL_EXTERN int bn_limit_num_low;    /* (1<<bn_limit_bits_low) */
-/* Do modified 'high' part calculation' */
-OPENSSL_EXTERN int bn_limit_bits_high;
-OPENSSL_EXTERN int bn_limit_num_high;   /* (1<<bn_limit_bits_high) */
-OPENSSL_EXTERN int bn_limit_bits_mont;
-OPENSSL_EXTERN int bn_limit_num_mont;   /* (1<<bn_limit_bits_mont) */
-
-BIGNUM *bn_expand2(BIGNUM *b, int bits);
+#endif /* !BN_LLONG */
 
 void bn_mul_normal(BN_ULONG *r,BN_ULONG *a,int na,BN_ULONG *b,int nb);
 void bn_mul_comba8(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
diff --git a/src/lib/libcrypto/bn/bn_lib.c b/src/lib/libcrypto/bn/bn_lib.c
index 5d62d88e8b..0e6b12d9c3 100644
--- a/src/lib/libcrypto/bn/bn_lib.c
+++ b/src/lib/libcrypto/bn/bn_lib.c
@@ -71,14 +71,14 @@ const char *BN_version="Big Number" OPENSSL_VERSION_PTEXT;
  * 7 - 128 == 4096
  * 8 - 256 == 8192
  */
-OPENSSL_GLOBAL int bn_limit_bits=0;
-OPENSSL_GLOBAL int bn_limit_num=8;        /* (1<<bn_limit_bits) */
-OPENSSL_GLOBAL int bn_limit_bits_low=0;
-OPENSSL_GLOBAL int bn_limit_num_low=8;    /* (1<<bn_limit_bits_low) */
-OPENSSL_GLOBAL int bn_limit_bits_high=0;
-OPENSSL_GLOBAL int bn_limit_num_high=8;   /* (1<<bn_limit_bits_high) */
-OPENSSL_GLOBAL int bn_limit_bits_mont=0;
-OPENSSL_GLOBAL int bn_limit_num_mont=8;   /* (1<<bn_limit_bits_mont) */
+static int bn_limit_bits=0;
+static int bn_limit_num=8;        /* (1<<bn_limit_bits) */
+static int bn_limit_bits_low=0;
+static int bn_limit_num_low=8;    /* (1<<bn_limit_bits_low) */
+static int bn_limit_bits_high=0;
+static int bn_limit_num_high=8;   /* (1<<bn_limit_bits_high) */
+static int bn_limit_bits_mont=0;
+static int bn_limit_num_mont=8;   /* (1<<bn_limit_bits_mont) */
 
 void BN_set_params(int mult, int high, int low, int mont)
         {
@@ -304,42 +304,10 @@ BIGNUM *BN_new(void)
         return(ret);
         }
 
-
-BN_CTX *BN_CTX_new(void)
-        {
-        BN_CTX *ret;
-
-        ret=(BN_CTX *)Malloc(sizeof(BN_CTX));
-        if (ret == NULL)
-                {
-                BNerr(BN_F_BN_CTX_NEW,ERR_R_MALLOC_FAILURE);
-                return(NULL);
-                }
-
-        BN_CTX_init(ret);
-        ret->flags=BN_FLG_MALLOCED;
-        return(ret);
-        }
-
-void BN_CTX_init(BN_CTX *ctx)
-        {
-        memset(ctx,0,sizeof(BN_CTX));
-        ctx->tos=0;
-        ctx->flags=0;
-        }
-
-void BN_CTX_free(BN_CTX *c)
-        {
-        int i;
-
-        if(c == NULL)
-            return;
-
-        for (i=0; i<BN_CTX_NUM; i++)
-                BN_clear_free(&(c->bn[i]));
-        if (c->flags & BN_FLG_MALLOCED)
-                Free(c);
-        }
+/* This is an internal function that should not be used in applications.
+ * It ensures that 'b' has enough room for a 'words' word number number.
+ * It is mostly used by the various BIGNUM routines. If there is an error,
+ * NULL is returned. If not, 'b' is returned. */
 
 BIGNUM *bn_expand2(BIGNUM *b, int words)
         {
@@ -389,7 +357,7 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)
  * if A and B happen to share same cache line such code is going to
  * cause severe cache trashing. Both factors have severe impact on
  * performance of modern CPUs and this is the reason why this
- * particulare piece of code is #ifdefed away and replaced by more
+ * particular piece of code is #ifdefed away and replaced by more
  * "friendly" version found in #else section below. This comment
  * also applies to BN_copy function.
  *
@@ -420,7 +388,7 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)
                                 A[0]=B[0];
                         case 0:
                                 /* I need the 'case 0' entry for utrix cc.
-                                 * If the optimiser is turned on, it does the
+                                 * If the optimizer is turned on, it does the
                                  * switch table by doing
                                  * a=top&7
                                  * a--;
diff --git a/src/lib/libcrypto/bn/bn_mont.c b/src/lib/libcrypto/bn/bn_mont.c
index ee0f410c22..7bb0b91223 100644
--- a/src/lib/libcrypto/bn/bn_mont.c
+++ b/src/lib/libcrypto/bn/bn_mont.c
@@ -57,25 +57,27 @@
  */
 
 /*
- * Details about Montgomery multiplication algorithms can be found at:
- * http://www.ece.orst.edu/ISL/Publications.html
- * http://www.ece.orst.edu/ISL/Koc/papers/j37acmon.pdf
+ * Details about Montgomery multiplication algorithms can be found at
+ * http://security.ece.orst.edu/publications.html, e.g.
+ * http://security.ece.orst.edu/koc/papers/j37acmon.pdf and
+ * sections 3.8 and 4.2 in http://security.ece.orst.edu/koc/papers/r01rsasw.pdf
  */
 
 #include <stdio.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-#define MONT_WORD
+#define MONT_WORD /* use the faster word-based algorithm */
 
 int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
                           BN_MONT_CTX *mont, BN_CTX *ctx)
         {
         BIGNUM *tmp,*tmp2;
 
-        tmp= &(ctx->bn[ctx->tos]);
-        tmp2= &(ctx->bn[ctx->tos]);
-        ctx->tos+=2;
+        BN_CTX_start(ctx);
+        tmp = BN_CTX_get(ctx);
+        tmp2 = BN_CTX_get(ctx);
+        if (tmp == NULL || tmp2 == NULL) goto err;
 
         bn_check_top(tmp);
         bn_check_top(tmp2);
@@ -99,7 +101,7 @@ int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
                 }
         /* reduce from aRR to aR */
         if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
-        ctx->tos-=2;
+        BN_CTX_end(ctx);
         return(1);
 err:
         return(0);
@@ -108,160 +110,123 @@ err:
 int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont,
              BN_CTX *ctx)
         {
-#ifdef BN_RECURSION_MONT
-        if (mont->use_word)
-#endif
-                {
-                BIGNUM *n,*r;
-                BN_ULONG *ap,*np,*rp,n0,v,*nrp;
-                int al,nl,max,i,x,ri;
-                int retn=0;
+        int retn=0;
 
-                r= &(ctx->bn[ctx->tos]);
+#ifdef MONT_WORD
+        BIGNUM *n,*r;
+        BN_ULONG *ap,*np,*rp,n0,v,*nrp;
+        int al,nl,max,i,x,ri;
 
-                if (!BN_copy(r,a)) goto err1;
-                n= &(mont->N);
+        BN_CTX_start(ctx);
+        if ((r = BN_CTX_get(ctx)) == NULL) goto err;
 
-                ap=a->d;
-                /* mont->ri is the size of mont->N in bits/words */
-                al=ri=mont->ri/BN_BITS2;
+        if (!BN_copy(r,a)) goto err;
+        n= &(mont->N);
 
-                nl=n->top;
-                if ((al == 0) || (nl == 0)) { r->top=0; return(1); }
+        ap=a->d;
+        /* mont->ri is the size of mont->N in bits (rounded up
+           to the word size) */
+        al=ri=mont->ri/BN_BITS2;
+        
+        nl=n->top;
+        if ((al == 0) || (nl == 0)) { r->top=0; return(1); }
 
-                max=(nl+al+1); /* allow for overflow (no?) XXX */
-                if (bn_wexpand(r,max) == NULL) goto err1;
-                if (bn_wexpand(ret,max) == NULL) goto err1;
+        max=(nl+al+1); /* allow for overflow (no?) XXX */
+        if (bn_wexpand(r,max) == NULL) goto err;
+        if (bn_wexpand(ret,max) == NULL) goto err;
 
-                r->neg=a->neg^n->neg;
-                np=n->d;
-                rp=r->d;
-                nrp= &(r->d[nl]);
+        r->neg=a->neg^n->neg;
+        np=n->d;
+        rp=r->d;
+        nrp= &(r->d[nl]);
 
-                /* clear the top words of T */
+        /* clear the top words of T */
 #if 1
-                for (i=r->top; i<max; i++) /* memset? XXX */
-                        r->d[i]=0;
+        for (i=r->top; i<max; i++) /* memset? XXX */
+                r->d[i]=0;
 #else
-                memset(&(r->d[r->top]),0,(max-r->top)*sizeof(BN_ULONG)); 
+        memset(&(r->d[r->top]),0,(max-r->top)*sizeof(BN_ULONG)); 
 #endif
 
-                r->top=max;
-                n0=mont->n0;
+        r->top=max;
+        n0=mont->n0;
 
 #ifdef BN_COUNT
-printf("word BN_from_montgomery %d * %d\n",nl,nl);
+        printf("word BN_from_montgomery %d * %d\n",nl,nl);
 #endif
-                for (i=0; i<nl; i++)
-                        {
-                        v=bn_mul_add_words(rp,np,nl,(rp[0]*n0)&BN_MASK2);
-                        nrp++;
-                        rp++;
-                        if (((nrp[-1]+=v)&BN_MASK2) >= v)
-                                continue;
-                        else
-                                {
-                                if (((++nrp[0])&BN_MASK2) != 0) continue;
-                                if (((++nrp[1])&BN_MASK2) != 0) continue;
-                                for (x=2; (((++nrp[x])&BN_MASK2) == 0); x++) ;
-                                }
-                        }
-                bn_fix_top(r);
-
-                /* mont->ri will be a multiple of the word size */
-#if 0
-                BN_rshift(ret,r,mont->ri);
-#else
-                x=ri;
-                rp=ret->d;
-                ap= &(r->d[x]);
-                if (r->top < x)
-                        al=0;
+        for (i=0; i<nl; i++)
+                {
+                v=bn_mul_add_words(rp,np,nl,(rp[0]*n0)&BN_MASK2);
+                nrp++;
+                rp++;
+                if (((nrp[-1]+=v)&BN_MASK2) >= v)
+                        continue;
                 else
-                        al=r->top-x;
-                ret->top=al;
-                al-=4;
-                for (i=0; i<al; i+=4)
                         {
-                        BN_ULONG t1,t2,t3,t4;
-
-                        t1=ap[i+0];
-                        t2=ap[i+1];
-                        t3=ap[i+2];
-                        t4=ap[i+3];
-                        rp[i+0]=t1;
-                        rp[i+1]=t2;
-                        rp[i+2]=t3;
-                        rp[i+3]=t4;
+                        if (((++nrp[0])&BN_MASK2) != 0) continue;
+                        if (((++nrp[1])&BN_MASK2) != 0) continue;
+                        for (x=2; (((++nrp[x])&BN_MASK2) == 0); x++) ;
                         }
-                al+=4;
-                for (; i<al; i++)
-                        rp[i]=ap[i];
-#endif
-
-                if (BN_ucmp(ret, &(mont->N)) >= 0)
-                        {
-                        BN_usub(ret,ret,&(mont->N)); /* XXX */
-                        }
-                retn=1;
-err1:
-                return(retn);
                 }
-#ifdef BN_RECURSION_MONT
-        else /* bignum version */ 
+        bn_fix_top(r);
+        
+        /* mont->ri will be a multiple of the word size */
+#if 0
+        BN_rshift(ret,r,mont->ri);
+#else
+        x=ri;
+        rp=ret->d;
+        ap= &(r->d[x]);
+        if (r->top < x)
+                al=0;
+        else
+                al=r->top-x;
+        ret->top=al;
+        al-=4;
+        for (i=0; i<al; i+=4)
                 {
-                BIGNUM *t1,*t2,*t3;
-                int j,i;
-
-#ifdef BN_COUNT
-printf("number BN_from_montgomery\n");
-#endif
-
-                t1= &(ctx->bn[ctx->tos]);
-                t2= &(ctx->bn[ctx->tos+1]);
-                t3= &(ctx->bn[ctx->tos+2]);
-
-                i=mont->Ni.top;
-                bn_wexpand(ret,i); /* perhaps only i*2 */
-                bn_wexpand(t1,i*4); /* perhaps only i*2 */
-                bn_wexpand(t2,i*2); /* perhaps only i   */
-
-                bn_mul_low_recursive(t2->d,a->d,mont->Ni.d,i,t1->d);
-
-                BN_zero(t3);
-                BN_set_bit(t3,mont->N.top*BN_BITS2);
-                bn_sub_words(t3->d,t3->d,a->d,i);
-                bn_mul_high(ret->d,t2->d,mont->N.d,t3->d,i,t1->d);
-
-                /* hmm... if a is between i and 2*i, things are bad */
-                if (a->top > i)
-                        {
-                        j=(int)(bn_add_words(ret->d,ret->d,&(a->d[i]),i));
-                        if (j) /* overflow */
-                                bn_sub_words(ret->d,ret->d,mont->N.d,i);
-                        }
-                ret->top=i;
-                bn_fix_top(ret);
-                if (a->d[0])
-                        BN_add_word(ret,1); /* Always? */
-                else    /* Very very rare */
-                        {
-                        for (i=1; i<mont->N.top-1; i++)
-                                {
-                                if (a->d[i])
-                                        {
-                                        BN_add_word(ret,1); /* Always? */
-                                        break;
-                                        }
-                                }
-                        }
-
-                if (BN_ucmp(ret,&(mont->N)) >= 0)
-                        BN_usub(ret,ret,&(mont->N));
-
-                return(1);
+                BN_ULONG t1,t2,t3,t4;
+                
+                t1=ap[i+0];
+                t2=ap[i+1];
+                t3=ap[i+2];
+                t4=ap[i+3];
+                rp[i+0]=t1;
+                rp[i+1]=t2;
+                rp[i+2]=t3;
+                rp[i+3]=t4;
                 }
+        al+=4;
+        for (; i<al; i++)
+                rp[i]=ap[i];
 #endif
+#else /* !MONT_WORD */ 
+        BIGNUM *t1,*t2;
+
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        t2 = BN_CTX_get(ctx);
+        if (t1 == NULL || t2 == NULL) goto err;
+        
+        if (!BN_copy(t1,a)) goto err;
+        BN_mask_bits(t1,mont->ri);
+
+        if (!BN_mul(t2,t1,&mont->Ni,ctx)) goto err;
+        BN_mask_bits(t2,mont->ri);
+
+        if (!BN_mul(t1,t2,&mont->N,ctx)) goto err;
+        if (!BN_add(t2,a,t1)) goto err;
+        BN_rshift(ret,t2,mont->ri);
+#endif /* MONT_WORD */
+
+        if (BN_ucmp(ret, &(mont->N)) >= 0)
+                {
+                BN_usub(ret,ret,&(mont->N));
+                }
+        retn=1;
+ err:
+        BN_CTX_end(ctx);
+        return(retn);
         }
 
 BN_MONT_CTX *BN_MONT_CTX_new(void)
@@ -278,7 +243,6 @@ BN_MONT_CTX *BN_MONT_CTX_new(void)
 
 void BN_MONT_CTX_init(BN_MONT_CTX *ctx)
         {
-        ctx->use_word=0;
         ctx->ri=0;
         BN_init(&(ctx->RR));
         BN_init(&(ctx->N));
@@ -306,85 +270,53 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
         R= &(mont->RR);                                 /* grab RR as a temp */
         BN_copy(&(mont->N),mod);                        /* Set N */
 
-#ifdef BN_RECURSION_MONT
-        if (mont->N.top < BN_MONT_CTX_SET_SIZE_WORD)
-#endif
+#ifdef MONT_WORD
                 {
                 BIGNUM tmod;
                 BN_ULONG buf[2];
 
-                mont->use_word=1;
-
                 mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
                 BN_zero(R);
-                BN_set_bit(R,BN_BITS2);
-                /* I was bad, this modification of a passed variable was
-                 * breaking the multithreaded stuff :-(
-                 * z=mod->top;
-                 * mod->top=1; */
+                BN_set_bit(R,BN_BITS2);                 /* R */
 
-                buf[0]=mod->d[0];
+                buf[0]=mod->d[0]; /* tmod = N mod word size */
                 buf[1]=0;
                 tmod.d=buf;
                 tmod.top=1;
-                tmod.max=mod->max;
+                tmod.max=2;
                 tmod.neg=mod->neg;
-
+                                                        /* Ri = R^-1 mod N*/
                 if ((BN_mod_inverse(&Ri,R,&tmod,ctx)) == NULL)
                         goto err;
-                BN_lshift(&Ri,&Ri,BN_BITS2);                    /* R*Ri */
+                BN_lshift(&Ri,&Ri,BN_BITS2);            /* R*Ri */
                 if (!BN_is_zero(&Ri))
-                        {
-#if 1
                         BN_sub_word(&Ri,1);
-#else
-                        BN_usub(&Ri,&Ri,BN_value_one());        /* R*Ri - 1 */
-#endif
-                        }
-                else
-                        {
-                        /* This is not common..., 1 in BN_MASK2,
-                         * It happens when buf[0] was == 1.  So for 8 bit,
-                         * this is 1/256, 16bit, 1 in 2^16 etc.
-                         */
-                        BN_set_word(&Ri,BN_MASK2);
-                        }
-                BN_div(&Ri,NULL,&Ri,&tmod,ctx);
+                else /* if N mod word size == 1 */
+                        BN_set_word(&Ri,BN_MASK2);  /* Ri-- (mod word size) */
+                BN_div(&Ri,NULL,&Ri,&tmod,ctx); /* Ni = (R*Ri-1)/N,
+                                                 * keep only least significant word: */
                 mont->n0=Ri.d[0];
                 BN_free(&Ri);
-                /* mod->top=z; */
                 }
-#ifdef BN_RECURSION_MONT
-        else
-                {
-                mont->use_word=0;
-                mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
-#if 1
+#else /* !MONT_WORD */
+                { /* bignum version */
+                mont->ri=BN_num_bits(mod);
                 BN_zero(R);
-                BN_set_bit(R,mont->ri);
-#else
-                BN_lshift(R,BN_value_one(),mont->ri);   /* R */
-#endif
+                BN_set_bit(R,mont->ri);                 /* R = 2^ri */
+                                                        /* Ri = R^-1 mod N*/
                 if ((BN_mod_inverse(&Ri,R,mod,ctx)) == NULL)
                         goto err;
                 BN_lshift(&Ri,&Ri,mont->ri);            /* R*Ri */
-#if 1
                 BN_sub_word(&Ri,1);
-#else
-                BN_usub(&Ri,&Ri,BN_value_one());        /* R*Ri - 1 */
-#endif
+                                                        /* Ni = (R*Ri-1) / N */
                 BN_div(&(mont->Ni),NULL,&Ri,mod,ctx);
                 BN_free(&Ri);
                 }
 #endif
 
         /* setup RR for conversions */
-#if 1
         BN_zero(&(mont->RR));
         BN_set_bit(&(mont->RR),mont->ri*2);
-#else
-        BN_lshift(mont->RR,BN_value_one(),mont->ri*2);
-#endif
         BN_mod(&(mont->RR),&(mont->RR),&(mont->N),ctx);
 
         return(1);
@@ -399,7 +331,6 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
         BN_copy(&(to->RR),&(from->RR));
         BN_copy(&(to->N),&(from->N));
         BN_copy(&(to->Ni),&(from->Ni));
-        to->use_word=from->use_word;
         to->ri=from->ri;
         to->n0=from->n0;
         return(to);
diff --git a/src/lib/libcrypto/bn/bn_mul.c b/src/lib/libcrypto/bn/bn_mul.c
index 38c47f3d1f..eb007e19e9 100644
--- a/src/lib/libcrypto/bn/bn_mul.c
+++ b/src/lib/libcrypto/bn/bn_mul.c
@@ -66,7 +66,7 @@
  * n2 must be a power of 2.
  * We multiply and return the result.
  * t must be 2*n2 words in size
- * We calulate
+ * We calculate
  * a[0]*b[0]
  * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
  * a[1]*b[1]
@@ -78,21 +78,23 @@ void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
         unsigned int neg,zero;
         BN_ULONG ln,lo,*p;
 
-#ifdef BN_COUNT
-printf(" bn_mul_recursive %d * %d\n",n2,n2);
-#endif
-#ifdef BN_MUL_COMBA
-/*      if (n2 == 4)
+# ifdef BN_COUNT
+        printf(" bn_mul_recursive %d * %d\n",n2,n2);
+# endif
+# ifdef BN_MUL_COMBA
+#  if 0
+        if (n2 == 4)
                 {
                 bn_mul_comba4(r,a,b);
                 return;
                 }
-        else */ if (n2 == 8)
+#  endif
+        if (n2 == 8)
                 {
                 bn_mul_comba8(r,a,b);
                 return; 
                 }
-#endif
+# endif /* BN_MUL_COMBA */
         if (n2 < BN_MUL_RECURSIVE_SIZE_NORMAL)
                 {
                 /* This should not happen */
@@ -136,7 +138,7 @@ printf(" bn_mul_recursive %d * %d\n",n2,n2);
                 break;
                 }
 
-#ifdef BN_MUL_COMBA
+# ifdef BN_MUL_COMBA
         if (n == 4)
                 {
                 if (!zero)
@@ -158,7 +160,7 @@ printf(" bn_mul_recursive %d * %d\n",n2,n2);
                 bn_mul_comba8(&(r[n2]),&(a[n]),&(b[n]));
                 }
         else
-#endif
+# endif /* BN_MUL_COMBA */
                 {
                 p= &(t[n2*2]);
                 if (!zero)
@@ -219,12 +221,12 @@ void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
              int n, BN_ULONG *t)
         {
         int i,j,n2=n*2;
-        unsigned int c1;
+        unsigned int c1,c2,neg,zero;
         BN_ULONG ln,lo,*p;
 
-#ifdef BN_COUNT
-printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
-#endif
+# ifdef BN_COUNT
+        printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
+# endif
         if (n < 8)
                 {
                 i=tn+n;
@@ -233,17 +235,54 @@ printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
                 }
 
         /* r=(a[0]-a[1])*(b[1]-b[0]) */
-        bn_sub_words(t,      a,      &(a[n]),n); /* + */
-        bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
-
-/*      if (n == 4)
+        c1=bn_cmp_words(a,&(a[n]),n);
+        c2=bn_cmp_words(&(b[n]),b,n);
+        zero=neg=0;
+        switch (c1*3+c2)
+                {
+        case -4:
+                bn_sub_words(t,      &(a[n]),a,      n); /* - */
+                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
+                break;
+        case -3:
+                zero=1;
+                /* break; */
+        case -2:
+                bn_sub_words(t,      &(a[n]),a,      n); /* - */
+                bn_sub_words(&(t[n]),&(b[n]),b,      n); /* + */
+                neg=1;
+                break;
+        case -1:
+        case 0:
+        case 1:
+                zero=1;
+                /* break; */
+        case 2:
+                bn_sub_words(t,      a,      &(a[n]),n); /* + */
+                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
+                neg=1;
+                break;
+        case 3:
+                zero=1;
+                /* break; */
+        case 4:
+                bn_sub_words(t,      a,      &(a[n]),n);
+                bn_sub_words(&(t[n]),&(b[n]),b,      n);
+                break;
+                }
+                /* The zero case isn't yet implemented here. The speedup
+                   would probably be negligible. */
+# if 0
+        if (n == 4)
                 {
                 bn_mul_comba4(&(t[n2]),t,&(t[n]));
                 bn_mul_comba4(r,a,b);
                 bn_mul_normal(&(r[n2]),&(a[n]),tn,&(b[n]),tn);
                 memset(&(r[n2+tn*2]),0,sizeof(BN_ULONG)*(n2-tn*2));
                 }
-        else */ if (n == 8)
+        else
+# endif
+        if (n == 8)
                 {
                 bn_mul_comba8(&(t[n2]),t,&(t[n]));
                 bn_mul_comba8(r,a,b);
@@ -308,7 +347,16 @@ printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
          */
 
         c1=(int)(bn_add_words(t,r,&(r[n2]),n2));
-        c1-=(int)(bn_sub_words(&(t[n2]),t,&(t[n2]),n2));
+
+        if (neg) /* if t[32] is negative */
+                {
+                c1-=(int)(bn_sub_words(&(t[n2]),t,&(t[n2]),n2));
+                }
+        else
+                {
+                /* Might have a carry */
+                c1+=(int)(bn_add_words(&(t[n2]),&(t[n2]),t,n2));
+                }
 
         /* t[32] holds (a[0]-a[1])*(b[1]-b[0])+(a[0]*b[0])+(a[1]*b[1])
          * r[10] holds (a[0]*b[0])
@@ -345,9 +393,9 @@ void bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
         {
         int n=n2/2;
 
-#ifdef BN_COUNT
-printf(" bn_mul_low_recursive %d * %d\n",n2,n2);
-#endif
+# ifdef BN_COUNT
+        printf(" bn_mul_low_recursive %d * %d\n",n2,n2);
+# endif
 
         bn_mul_recursive(r,a,b,n,&(t[0]));
         if (n >= BN_MUL_LOW_RECURSIVE_SIZE_NORMAL)
@@ -379,9 +427,9 @@ void bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2,
         int neg,oneg,zero;
         BN_ULONG ll,lc,*lp,*mp;
 
-#ifdef BN_COUNT
-printf(" bn_mul_high %d * %d\n",n2,n2);
-#endif
+# ifdef BN_COUNT
+        printf(" bn_mul_high %d * %d\n",n2,n2);
+# endif
         n=n2/2;
 
         /* Calculate (al-ah)*(bh-bl) */
@@ -424,14 +472,14 @@ printf(" bn_mul_high %d * %d\n",n2,n2);
         oneg=neg;
         /* t[10] = (a[0]-a[1])*(b[1]-b[0]) */
         /* r[10] = (a[1]*b[1]) */
-#ifdef BN_MUL_COMBA
+# ifdef BN_MUL_COMBA
         if (n == 8)
                 {
                 bn_mul_comba8(&(t[0]),&(r[0]),&(r[n]));
                 bn_mul_comba8(r,&(a[n]),&(b[n]));
                 }
         else
-#endif
+# endif
                 {
                 bn_mul_recursive(&(t[0]),&(r[0]),&(r[n]),n,&(t[n2]));
                 bn_mul_recursive(r,&(a[n]),&(b[n]),n,&(t[n2]));
@@ -555,19 +603,23 @@ printf(" bn_mul_high %d * %d\n",n2,n2);
                         }
                 }
         }
-#endif
+#endif /* BN_RECURSION */
 
 int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
         {
         int top,al,bl;
         BIGNUM *rr;
+        int ret = 0;
+#if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
+        int i;
+#endif
 #ifdef BN_RECURSION
         BIGNUM *t;
-        int i,j,k;
+        int j,k;
 #endif
 
 #ifdef BN_COUNT
-printf("BN_mul %d * %d\n",a->top,b->top);
+        printf("BN_mul %d * %d\n",a->top,b->top);
 #endif
 
         bn_check_top(a);
@@ -585,115 +637,99 @@ printf("BN_mul %d * %d\n",a->top,b->top);
                 }
         top=al+bl;
 
+        BN_CTX_start(ctx);
         if ((r == a) || (r == b))
-                rr= &(ctx->bn[ctx->tos+1]);
+                {
+                if ((rr = BN_CTX_get(ctx)) == NULL) goto err;
+                }
         else
-                rr=r;
+                rr = r;
 
 #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
-        if (al == bl)
+        i = al-bl;
+#endif
+#ifdef BN_MUL_COMBA
+        if (i == 0)
                 {
-#  ifdef BN_MUL_COMBA
-/*              if (al == 4)
+# if 0
+                if (al == 4)
                         {
-                        if (bn_wexpand(rr,8) == NULL) return(0);
+                        if (bn_wexpand(rr,8) == NULL) goto err;
                         rr->top=8;
                         bn_mul_comba4(rr->d,a->d,b->d);
                         goto end;
                         }
-                else */ if (al == 8)
+# endif
+                if (al == 8)
                         {
-                        if (bn_wexpand(rr,16) == NULL) return(0);
+                        if (bn_wexpand(rr,16) == NULL) goto err;
                         rr->top=16;
                         bn_mul_comba8(rr->d,a->d,b->d);
                         goto end;
                         }
-                else
-#  endif
-#ifdef BN_RECURSION
-                if (al < BN_MULL_SIZE_NORMAL)
-#endif
-                        {
-                        if (bn_wexpand(rr,top) == NULL) return(0);
-                        rr->top=top;
-                        bn_mul_normal(rr->d,a->d,al,b->d,bl);
-                        goto end;
-                        }
-#  ifdef BN_RECURSION
-                goto symetric;
-#  endif
                 }
-#endif
+#endif /* BN_MUL_COMBA */
 #ifdef BN_RECURSION
-        else if ((al < BN_MULL_SIZE_NORMAL) || (bl < BN_MULL_SIZE_NORMAL))
+        if ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))
                 {
-                if (bn_wexpand(rr,top) == NULL) return(0);
-                rr->top=top;
-                bn_mul_normal(rr->d,a->d,al,b->d,bl);
-                goto end;
-                }
-        else
-                {
-                i=(al-bl);
-                if ((i ==  1) && !BN_get_flags(b,BN_FLG_STATIC_DATA))
+                if (i == 1 && !BN_get_flags(b,BN_FLG_STATIC_DATA))
                         {
                         bn_wexpand(b,al);
                         b->d[bl]=0;
                         bl++;
-                        goto symetric;
+                        i--;
                         }
-                else if ((i ==  -1) && !BN_get_flags(a,BN_FLG_STATIC_DATA))
+                else if (i == -1 && !BN_get_flags(a,BN_FLG_STATIC_DATA))
                         {
                         bn_wexpand(a,bl);
                         a->d[al]=0;
                         al++;
-                        goto symetric;
+                        i++;
+                        }
+                if (i == 0)
+                        {
+                        /* symmetric and > 4 */
+                        /* 16 or larger */
+                        j=BN_num_bits_word((BN_ULONG)al);
+                        j=1<<(j-1);
+                        k=j+j;
+                        t = BN_CTX_get(ctx);
+                        if (al == j) /* exact multiple */
+                                {
+                                bn_wexpand(t,k*2);
+                                bn_wexpand(rr,k*2);
+                                bn_mul_recursive(rr->d,a->d,b->d,al,t->d);
+                                }
+                        else
+                                {
+                                bn_wexpand(a,k);
+                                bn_wexpand(b,k);
+                                bn_wexpand(t,k*4);
+                                bn_wexpand(rr,k*4);
+                                for (i=a->top; i<k; i++)
+                                        a->d[i]=0;
+                                for (i=b->top; i<k; i++)
+                                        b->d[i]=0;
+                                bn_mul_part_recursive(rr->d,a->d,b->d,al-j,j,t->d);
+                                }
+                        rr->top=top;
+                        goto end;
                         }
                 }
-#endif
-
-        /* asymetric and >= 4 */ 
-        if (bn_wexpand(rr,top) == NULL) return(0);
+#endif /* BN_RECURSION */
+        if (bn_wexpand(rr,top) == NULL) goto err;
         rr->top=top;
         bn_mul_normal(rr->d,a->d,al,b->d,bl);
 
-#ifdef BN_RECURSION
-        if (0)
-                {
-symetric:
-                /* symetric and > 4 */
-                /* 16 or larger */
-                j=BN_num_bits_word((BN_ULONG)al);
-                j=1<<(j-1);
-                k=j+j;
-                t= &(ctx->bn[ctx->tos]);
-                if (al == j) /* exact multiple */
-                        {
-                        bn_wexpand(t,k*2);
-                        bn_wexpand(rr,k*2);
-                        bn_mul_recursive(rr->d,a->d,b->d,al,t->d);
-                        }
-                else
-                        {
-                        bn_wexpand(a,k);
-                        bn_wexpand(b,k);
-                        bn_wexpand(t,k*4);
-                        bn_wexpand(rr,k*4);
-                        for (i=a->top; i<k; i++)
-                                a->d[i]=0;
-                        for (i=b->top; i<k; i++)
-                                b->d[i]=0;
-                        bn_mul_part_recursive(rr->d,a->d,b->d,al-j,j,t->d);
-                        }
-                rr->top=top;
-                }
-#endif
 #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
 end:
 #endif
         bn_fix_top(rr);
         if (r != rr) BN_copy(r,rr);
-        return(1);
+        ret=1;
+err:
+        BN_CTX_end(ctx);
+        return(ret);
         }
 
 void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
@@ -701,7 +737,7 @@ void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
         BN_ULONG *rr;
 
 #ifdef BN_COUNT
-printf(" bn_mul_normal %d * %d\n",na,nb);
+        printf(" bn_mul_normal %d * %d\n",na,nb);
 #endif
 
         if (na < nb)
@@ -735,7 +771,7 @@ printf(" bn_mul_normal %d * %d\n",na,nb);
 void bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
 #ifdef BN_COUNT
-printf(" bn_mul_low_normal %d * %d\n",n,n);
+        printf(" bn_mul_low_normal %d * %d\n",n,n);
 #endif
         bn_mul_words(r,a,n,b[0]);
 
@@ -753,4 +789,3 @@ printf(" bn_mul_low_normal %d * %d\n",n,n);
                 b+=4;
                 }
         }
-
diff --git a/src/lib/libcrypto/bn/bn_opts.c b/src/lib/libcrypto/bn/bn_opts.c
index 381be529b2..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/bn_opts.c
+++ b/src/lib/libcrypto/bn/bn_opts.c
@@ -1,324 +0,0 @@
-/* crypto/bn/expspeed.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-/* most of this code has been pilfered from my libdes speed.c program */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <signal.h>
-#include <string.h>
-#include <openssl/crypto.h>
-#include <openssl/tmdiff.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-
-#define DEFAULT_SIZE    512
-#define DEFAULT_TIME    3
-
-int verbose=1;
-
-typedef struct parms_st
-        {
-        char *name;
-        void (*func)();
-        BIGNUM r;
-        BIGNUM a;
-        BIGNUM b;
-        BIGNUM c;
-        BIGNUM low;
-        BN_CTX *ctx;
-        BN_MONT_CTX *mont;
-        int w;
-        } PARMS;
-
-void do_mul_exp(int num,PARMS *p);
-void do_mul(int num,PARMS *p);
-void do_sqr(int num,PARMS *p);
-void do_mul_low(int num,PARMS *p);
-void do_mul_high(int num,PARMS *p);
-void do_from_montgomery(int num,PARMS *p);
-int time_it(int sec, PARMS *p);
-void do_it(int sec, PARMS *p);
-
-#define P_EXP   1
-#define P_MUL   2
-#define P_SQR   3
-#define P_MULL  4
-#define P_MULH  5
-#define P_MRED  6
-
-int main(int argc, char **argv)
-        {
-        PARMS p;
-        BN_MONT_CTX *mont;
-        int size=0,num;
-        char *name;
-        int type=P_EXP;
-
-        mont=BN_MONT_CTX_new();
-        p.mont=NULL;
-        p.ctx=BN_CTX_new();
-        BN_init(&p.r);
-        BN_init(&p.a);
-        BN_init(&p.b);
-        BN_init(&p.c);
-        BN_init(&p.low);
-        p.w=0;
-
-        for (;;)
-                {
-                if (argc > 1)
-                        {
-                        if (argv[1][0] == '-')
-                                {
-                                switch(argv[1][1])
-                                        {
-                                case 'e': type=P_EXP; break;
-                                case 'm': type=P_MUL; break;
-                                case 's': type=P_SQR; break;
-                                case 'l': type=P_MULL; break;
-                                case 'h': type=P_MULH; break;
-                                case 'r': type=P_MRED; break;
-                                default:
-                                        fprintf(stderr,"options: -[emslhr]\n");
-                                        exit(1);
-                                        }
-                                }
-                        else
-                                {
-                                size=atoi(argv[1]);
-                                }
-                        argc--;
-                        argv++;
-                        }
-                else
-                        break;
-                }
-        if (size == 0)
-                size=DEFAULT_SIZE;
-
-        printf("bit size:%5d\n",size);
-
-        BN_rand(&p.a,size,1,0);
-        BN_rand(&p.b,size,1,0);
-        BN_rand(&p.c,size,1,1);
-        BN_mod(&p.a,&p.a,&p.c,p.ctx);
-        BN_mod(&p.b,&p.b,&p.c,p.ctx);
-        p.w=(p.a.top+1)/2;
-
-        BN_mul(&p.low,&p.a,&p.b,p.ctx);
-        p.low.top=p.a.top;
-        
-        switch(type)
-                {
-        case P_EXP:
-                p.name="r=a^b%c";
-                p.func=do_mul_exp;
-                p.mont=mont;
-                break;
-        case P_MUL:
-                p.name="r=a*b";
-                p.func=do_mul;
-                break;
-        case P_SQR:
-                p.name="r=a*a";
-                p.func=do_sqr;
-                break;
-        case P_MULL:
-                p.name="r=low(a*b)";
-                p.func=do_mul_low;
-                break;
-        case P_MULH:
-                p.name="r=high(a*b)";
-                p.func=do_mul_high;
-                break;
-        case P_MRED:
-                p.name="r=montgomery_reduction(a)";
-                p.func=do_from_montgomery;
-                p.mont=mont;
-                break;
-        default:
-                fprintf(stderr,"options: -[emslhr]\n");
-                exit(1);
-                }
-
-        num=time_it(DEFAULT_TIME,&p);
-        do_it(num,&p);
-        }
-
-void do_it(int num, PARMS *p)
-        {
-        char *start,*end;
-        int i,j,number;
-        double d;
-
-        start=ms_time_new();
-        end=ms_time_new();
-
-        number=BN_num_bits_word((BN_ULONG)BN_num_bits(&(p->c)))-
-                BN_num_bits_word(BN_BITS2)+2;
-        for (i=number-1; i >=0; i--)
-                {
-                if (i == 1) continue;
-                BN_set_params(i,i,i,1);
-                if (p->mont != NULL)
-                        BN_MONT_CTX_set(p->mont,&(p->c),p->ctx);
-
-                printf("Timing %5d (%2d bit) %2d %2d %2d %2d :",
-                        (1<<i)*BN_BITS2,i,
-                                BN_get_params(0),
-                                BN_get_params(1),
-                                BN_get_params(2),
-                                BN_get_params(3));
-                fflush(stdout);
-
-                ms_time_get(start);
-                p->func(num,p);
-                ms_time_get(end);
-                d=ms_time_diff(start,end);
-                printf("%6.6f sec, or %d in %.4f seconds\n",
-                        (double)d/num,num,d);
-                }
-        }
-
-int time_it(int sec, PARMS *p)
-        {
-        char *start,*end;
-        int i,j;
-        double d;
-
-        if (p->mont != NULL)
-                BN_MONT_CTX_set(p->mont,&(p->c),p->ctx);
-
-        start=ms_time_new();
-        end=ms_time_new();
-
-        i=1;
-        for (;;)
-                {
-                if (verbose)
-                        printf("timing %s for %d interations\n",p->name,i);
-
-                ms_time_get(start);
-                p->func(i,p);
-                ms_time_get(end);
-                d=ms_time_diff(start,end);
-
-                if      (d < 0.01) i*=100;
-                else if (d < 0.1 ) i*=10;
-                else if (d > (double)sec) break;
-                else
-                        {
-                        i=(int)(1.0*i*sec/d);
-                        break;
-                        }
-                }
-        if (verbose)
-                printf("using %d interations\n",i);
-        return(i);
-        }
-
-void do_mul_exp(int num, PARMS *p)
-        {
-        int i;
-
-        for (i=0; i<num; i++)
-                BN_mod_exp_mont(&(p->r),&(p->a),&(p->b),&(p->c),
-                        p->ctx,p->mont);
-        }
-
-void do_mul(int num, PARMS *p)
-        {
-        int i;
-
-        for (i=0; i<num; i++)
-                BN_mul(&(p->r),&(p->a),&(p->b),p->ctx);
-        }
-
-void do_sqr(int num, PARMS *p)
-        {
-        int i;
-
-        for (i=0; i<num; i++)
-                        BN_sqr(&(p->r),&(p->a),p->ctx);
-        }
-
-void do_mul_low(int num, PARMS *p)
-        {
-        int i;
-        
-        for (i=0; i<num; i++)
-                BN_mul_low(&(p->r),&(p->a),&(p->b),p->w,p->ctx);
-        }
-
-void do_mul_high(int num, PARMS *p)
-        {
-        int i;
-
-        for (i=0; i<num; i++)
-                BN_mul_low(&(p->r),&(p->a),&(p->b),&(p->low),p->w,p->ctx);
-        }
-
-void do_from_montgomery(int num, PARMS *p)
-        {
-        int i;
-        
-        for (i=0; i<num; i++)
-                BN_from_montgomery(&(p->r),&(p->a),p->mont,p->ctx);
-        }
-
diff --git a/src/lib/libcrypto/bn/bn_prime.c b/src/lib/libcrypto/bn/bn_prime.c
index 6fa0f9be1e..a5f01b92eb 100644
--- a/src/lib/libcrypto/bn/bn_prime.c
+++ b/src/lib/libcrypto/bn/bn_prime.c
@@ -55,6 +55,59 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
 #include <stdio.h>
 #include <time.h>
@@ -62,26 +115,29 @@
 #include "bn_lcl.h"
 #include <openssl/rand.h>
 
-/* The quick seive algorithm approach to weeding out primes is
+/* The quick sieve algorithm approach to weeding out primes is
  * Philip Zimmermann's, as implemented in PGP.  I have had a read of
  * his comments and implemented my own version.
  */
 #include "bn_prime.h"
 
-static int witness(BIGNUM *a, BIGNUM *n, BN_CTX *ctx,BN_CTX *ctx2,
-        BN_MONT_CTX *mont);
+static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1,
+        const BIGNUM *a1_odd, int k, BN_CTX *ctx, BN_MONT_CTX *mont);
 static int probable_prime(BIGNUM *rnd, int bits);
 static int probable_prime_dh(BIGNUM *rnd, int bits,
         BIGNUM *add, BIGNUM *rem, BN_CTX *ctx);
-static int probable_prime_dh_strong(BIGNUM *rnd, int bits,
+static int probable_prime_dh_safe(BIGNUM *rnd, int bits,
         BIGNUM *add, BIGNUM *rem, BN_CTX *ctx);
-BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int strong, BIGNUM *add,
+
+BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe, BIGNUM *add,
              BIGNUM *rem, void (*callback)(int,int,void *), void *cb_arg)
         {
         BIGNUM *rnd=NULL;
         BIGNUM t;
+        int found=0;
         int i,j,c1=0;
         BN_CTX *ctx;
+        int checks = BN_prime_checks_for_size(bits);
 
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
@@ -100,9 +156,9 @@ loop:
                 }
         else
                 {
-                if (strong)
+                if (safe)
                         {
-                        if (!probable_prime_dh_strong(rnd,bits,add,rem,ctx))
+                        if (!probable_prime_dh_safe(rnd,bits,add,rem,ctx))
                                  goto err;
                         }
                 else
@@ -114,160 +170,185 @@ loop:
         /* if (BN_mod_word(rnd,(BN_ULONG)3) == 1) goto loop; */
         if (callback != NULL) callback(0,c1++,cb_arg);
 
-        if (!strong)
+        if (!safe)
                 {
-                i=BN_is_prime(rnd,BN_prime_checks,callback,ctx,cb_arg);
+                i=BN_is_prime_fasttest(rnd,checks,callback,ctx,cb_arg,0);
                 if (i == -1) goto err;
                 if (i == 0) goto loop;
                 }
         else
                 {
-                /* for a strong prime generation,
+                /* for "safe prime" generation,
                  * check that (p-1)/2 is prime.
                  * Since a prime is odd, We just
                  * need to divide by 2 */
                 if (!BN_rshift1(&t,rnd)) goto err;
 
-                for (i=0; i<BN_prime_checks; i++)
+                for (i=0; i<checks; i++)
                         {
-                        j=BN_is_prime(rnd,1,callback,ctx,cb_arg);
+                        j=BN_is_prime_fasttest(rnd,1,callback,ctx,cb_arg,0);
                         if (j == -1) goto err;
                         if (j == 0) goto loop;
 
-                        j=BN_is_prime(&t,1,callback,ctx,cb_arg);
+                        j=BN_is_prime_fasttest(&t,1,callback,ctx,cb_arg,0);
                         if (j == -1) goto err;
                         if (j == 0) goto loop;
 
                         if (callback != NULL) callback(2,c1-1,cb_arg);
-                        /* We have a strong prime test pass */
+                        /* We have a safe prime test pass */
                         }
                 }
         /* we have a prime :-) */
-        ret=rnd;
+        found = 1;
 err:
-        if ((ret == NULL) && (rnd != NULL)) BN_free(rnd);
+        if (!found && (ret == NULL) && (rnd != NULL)) BN_free(rnd);
         BN_free(&t);
         if (ctx != NULL) BN_CTX_free(ctx);
-        return(ret);
+        return(found ? rnd : NULL);
         }
 
-int BN_is_prime(BIGNUM *a, int checks, void (*callback)(int,int,void *),
-             BN_CTX *ctx_passed, void *cb_arg)
+int BN_is_prime(const BIGNUM *a, int checks, void (*callback)(int,int,void *),
+        BN_CTX *ctx_passed, void *cb_arg)
         {
-        int i,j,c2=0,ret= -1;
-        BIGNUM *check;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
-        BN_MONT_CTX *mont=NULL;
+        return BN_is_prime_fasttest(a, checks, callback, ctx_passed, cb_arg, 0);
+        }
 
+int BN_is_prime_fasttest(const BIGNUM *a, int checks,
+                void (*callback)(int,int,void *),
+                BN_CTX *ctx_passed, void *cb_arg,
+                int do_trial_division)
+        {
+        int i, j, ret = -1;
+        int k;
+        BN_CTX *ctx = NULL;
+        BIGNUM *A1, *A1_odd, *check; /* taken from ctx */
+        BN_MONT_CTX *mont = NULL;
+        const BIGNUM *A = NULL;
+
+        if (checks == BN_prime_checks)
+                checks = BN_prime_checks_for_size(BN_num_bits(a));
+
+        /* first look for small factors */
         if (!BN_is_odd(a))
                 return(0);
+        if (do_trial_division)
+                {
+                for (i = 1; i < NUMPRIMES; i++)
+                        if (BN_mod_word(a, primes[i]) == 0) 
+                                return 0;
+                if (callback != NULL) callback(1, -1, cb_arg);
+                }
+
         if (ctx_passed != NULL)
-                ctx=ctx_passed;
+                ctx = ctx_passed;
         else
-                if ((ctx=BN_CTX_new()) == NULL) goto err;
-
-        if ((ctx2=BN_CTX_new()) == NULL) goto err;
-        if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
-
-        check= &(ctx->bn[ctx->tos++]);
+                if ((ctx=BN_CTX_new()) == NULL)
+                        goto err;
+        BN_CTX_start(ctx);
 
-        /* Setup the montgomery structure */
-        if (!BN_MONT_CTX_set(mont,a,ctx2)) goto err;
+        /* A := abs(a) */
+        if (a->neg)
+                {
+                BIGNUM *t;
+                if ((t = BN_CTX_get(ctx)) == NULL) goto err;
+                BN_copy(t, a);
+                t->neg = 0;
+                A = t;
+                }
+        else
+                A = a;
+        A1 = BN_CTX_get(ctx);
+        A1_odd = BN_CTX_get(ctx);
+        check = BN_CTX_get(ctx);
+        if (check == NULL) goto err;
+
+        /* compute A1 := A - 1 */
+        if (!BN_copy(A1, A))
+                goto err;
+        if (!BN_sub_word(A1, 1))
+                goto err;
+        if (BN_is_zero(A1))
+                {
+                ret = 0;
+                goto err;
+                }
 
-        for (i=0; i<checks; i++)
+        /* write  A1  as  A1_odd * 2^k */
+        k = 1;
+        while (!BN_is_bit_set(A1, k))
+                k++;
+        if (!BN_rshift(A1_odd, A1, k))
+                goto err;
+
+        /* Montgomery setup for computations mod A */
+        mont = BN_MONT_CTX_new();
+        if (mont == NULL)
+                goto err;
+        if (!BN_MONT_CTX_set(mont, A, ctx))
+                goto err;
+        
+        for (i = 0; i < checks; i++)
                 {
-                if (!BN_rand(check,BN_num_bits(a)-1,0,0)) goto err;
-                j=witness(check,a,ctx,ctx2,mont);
+                if (!BN_pseudo_rand(check, BN_num_bits(A1), 0, 0))
+                        goto err;
+                if (BN_cmp(check, A1) >= 0)
+                        if (!BN_sub(check, check, A1))
+                                goto err;
+                if (!BN_add_word(check, 1))
+                        goto err;
+                /* now 1 <= check < A */
+
+                j = witness(check, A, A1, A1_odd, k, ctx, mont);
                 if (j == -1) goto err;
                 if (j)
                         {
                         ret=0;
                         goto err;
                         }
-                if (callback != NULL) callback(1,c2++,cb_arg);
+                if (callback != NULL) callback(1,i,cb_arg);
                 }
         ret=1;
 err:
-        ctx->tos--;
-        if ((ctx_passed == NULL) && (ctx != NULL))
-                BN_CTX_free(ctx);
-        if (ctx2 != NULL)
-                BN_CTX_free(ctx2);
-        if (mont != NULL) BN_MONT_CTX_free(mont);
-                
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                if (ctx_passed == NULL)
+                        BN_CTX_free(ctx);
+                }
+        if (mont != NULL)
+                BN_MONT_CTX_free(mont);
+
         return(ret);
         }
 
-#define RECP_MUL_MOD
-
-static int witness(BIGNUM *a, BIGNUM *n, BN_CTX *ctx, BN_CTX *ctx2,
-             BN_MONT_CTX *mont)
+static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1,
+        const BIGNUM *a1_odd, int k, BN_CTX *ctx, BN_MONT_CTX *mont)
         {
-        int k,i,ret= -1,good;
-        BIGNUM *d,*dd,*tmp,*d1,*d2,*n1;
-        BIGNUM *mont_one,*mont_n1,*mont_a;
-
-        d1= &(ctx->bn[ctx->tos]);
-        d2= &(ctx->bn[ctx->tos+1]);
-        n1= &(ctx->bn[ctx->tos+2]);
-        ctx->tos+=3;
-
-        mont_one= &(ctx2->bn[ctx2->tos]);
-        mont_n1= &(ctx2->bn[ctx2->tos+1]);
-        mont_a= &(ctx2->bn[ctx2->tos+2]);
-        ctx2->tos+=3;
-
-        d=d1;
-        dd=d2;
-        if (!BN_one(d)) goto err;
-        if (!BN_sub(n1,n,d)) goto err; /* n1=n-1; */
-        k=BN_num_bits(n1);
-
-        if (!BN_to_montgomery(mont_one,BN_value_one(),mont,ctx2)) goto err;
-        if (!BN_to_montgomery(mont_n1,n1,mont,ctx2)) goto err;
-        if (!BN_to_montgomery(mont_a,a,mont,ctx2)) goto err;
-
-        BN_copy(d,mont_one);
-        for (i=k-1; i>=0; i--)
+        if (!BN_mod_exp_mont(w, w, a1_odd, a, ctx, mont)) /* w := w^a1_odd mod a */
+                return -1;
+        if (BN_is_one(w))
+                return 0; /* probably prime */
+        if (BN_cmp(w, a1) == 0)
+                return 0; /* w == -1 (mod a),  'a' is probably prime */
+        while (--k)
                 {
-                if (    (BN_cmp(d,mont_one) != 0) &&
-                        (BN_cmp(d,mont_n1) != 0))
-                        good=1;
-                else
-                        good=0;
-
-                BN_mod_mul_montgomery(dd,d,d,mont,ctx2);
-
-                if (good && (BN_cmp(dd,mont_one) == 0))
-                        {
-                        ret=1;
-                        goto err;
-                        }
-                if (BN_is_bit_set(n1,i))
-                        {
-                        BN_mod_mul_montgomery(d,dd,mont_a,mont,ctx2);
-                        }
-                else
-                        {
-                        tmp=d;
-                        d=dd;
-                        dd=tmp;
-                        }
+                if (!BN_mod_mul(w, w, w, a, ctx)) /* w := w^2 mod a */
+                        return -1;
+                if (BN_is_one(w))
+                        return 1; /* 'a' is composite, otherwise a previous 'w' would
+                                   * have been == -1 (mod 'a') */
+                if (BN_cmp(w, a1) == 0)
+                        return 0; /* w == -1 (mod a), 'a' is probably prime */
                 }
-        if (BN_cmp(d,mont_one) == 0)
-                i=0;
-        else    i=1;
-        ret=i;
-err:
-        ctx->tos-=3;
-        ctx2->tos-=3;
-        return(ret);
+        /* If we get here, 'w' is the (a-1)/2-th power of the original 'w',
+         * and it is neither -1 nor +1 -- so 'a' cannot be prime */
+        return 1;
         }
 
 static int probable_prime(BIGNUM *rnd, int bits)
         {
         int i;
-        MS_STATIC BN_ULONG mods[NUMPRIMES];
+        BN_ULONG mods[NUMPRIMES];
         BN_ULONG delta,d;
 
 again:
@@ -285,7 +366,7 @@ again:
                         d=delta;
                         delta+=2;
                         /* perhaps need to check for overflow of
-                         * delta (but delta can be upto 2^32)
+                         * delta (but delta can be up to 2^32)
                          * 21-May-98 eay - added overflow check */
                         if (delta < d) goto again;
                         goto loop;
@@ -301,7 +382,8 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, BIGNUM *add, BIGNUM *rem,
         int i,ret=0;
         BIGNUM *t1;
 
-        t1= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        if ((t1 = BN_CTX_get(ctx)) == NULL) goto err;
 
         if (!BN_rand(rnd,bits,0,1)) goto err;
 
@@ -327,20 +409,22 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, BIGNUM *add, BIGNUM *rem,
                 }
         ret=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         return(ret);
         }
 
-static int probable_prime_dh_strong(BIGNUM *p, int bits, BIGNUM *padd,
+static int probable_prime_dh_safe(BIGNUM *p, int bits, BIGNUM *padd,
              BIGNUM *rem, BN_CTX *ctx)
         {
         int i,ret=0;
-        BIGNUM *t1,*qadd=NULL,*q=NULL;
+        BIGNUM *t1,*qadd,*q;
 
         bits--;
-        t1= &(ctx->bn[ctx->tos++]);
-        q= &(ctx->bn[ctx->tos++]);
-        qadd= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        q = BN_CTX_get(ctx);
+        qadd = BN_CTX_get(ctx);
+        if (qadd == NULL) goto err;
 
         if (!BN_rshift1(qadd,padd)) goto err;
                 
@@ -376,72 +460,6 @@ static int probable_prime_dh_strong(BIGNUM *p, int bits, BIGNUM *padd,
                 }
         ret=1;
 err:
-        ctx->tos-=3;
-        return(ret);
-        }
-
-#if 0
-static int witness(BIGNUM *a, BIGNUM *n, BN_CTX *ctx)
-        {
-        int k,i,nb,ret= -1;
-        BIGNUM *d,*dd,*tmp;
-        BIGNUM *d1,*d2,*x,*n1,*inv;
-
-        d1= &(ctx->bn[ctx->tos]);
-        d2= &(ctx->bn[ctx->tos+1]);
-        x=  &(ctx->bn[ctx->tos+2]);
-        n1= &(ctx->bn[ctx->tos+3]);
-        inv=&(ctx->bn[ctx->tos+4]);
-        ctx->tos+=5;
-
-        d=d1;
-        dd=d2;
-        if (!BN_one(d)) goto err;
-        if (!BN_sub(n1,n,d)) goto err; /* n1=n-1; */
-        k=BN_num_bits(n1);
-
-        /* i=BN_num_bits(n); */
-#ifdef RECP_MUL_MOD
-        nb=BN_reciprocal(inv,n,ctx); /**/
-        if (nb == -1) goto err;
-#endif
-
-        for (i=k-1; i>=0; i--)
-                {
-                if (BN_copy(x,d) == NULL) goto err;
-#ifndef RECP_MUL_MOD
-                if (!BN_mod_mul(dd,d,d,n,ctx)) goto err;
-#else
-                if (!BN_mod_mul_reciprocal(dd,d,d,n,inv,nb,ctx)) goto err;
-#endif
-                if (    BN_is_one(dd) &&
-                        !BN_is_one(x) &&
-                        (BN_cmp(x,n1) != 0))
-                        {
-                        ret=1;
-                        goto err;
-                        }
-                if (BN_is_bit_set(n1,i))
-                        {
-#ifndef RECP_MUL_MOD
-                        if (!BN_mod_mul(d,dd,a,n,ctx)) goto err;
-#else
-                        if (!BN_mod_mul_reciprocal(d,dd,a,n,inv,nb,ctx)) goto err; 
-#endif
-                        }
-                else
-                        {
-                        tmp=d;
-                        d=dd;
-                        dd=tmp;
-                        }
-                }
-        if (BN_is_one(d))
-                i=0;
-        else    i=1;
-        ret=i;
-err:
-        ctx->tos-=5;
+        BN_CTX_end(ctx);
         return(ret);
         }
-#endif
diff --git a/src/lib/libcrypto/bn/bn_prime.h b/src/lib/libcrypto/bn/bn_prime.h
index 6fce0210cd..b7cf9a9bfe 100644
--- a/src/lib/libcrypto/bn/bn_prime.h
+++ b/src/lib/libcrypto/bn/bn_prime.h
@@ -1,4 +1,4 @@
-/* crypto/bn/bn_prime.h */
+/* Auto generated by bn_prime.pl */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -61,7 +61,7 @@
 #else
 #define NUMPRIMES 54
 #endif
-static unsigned int primes[NUMPRIMES]=
+static const unsigned int primes[NUMPRIMES]=
         {
            2,   3,   5,   7,  11,  13,  17,  19,
           23,  29,  31,  37,  41,  43,  47,  53,
diff --git a/src/lib/libcrypto/bn/bn_prime.pl b/src/lib/libcrypto/bn/bn_prime.pl
index 979385a334..9fc3765486 100644
--- a/src/lib/libcrypto/bn/bn_prime.pl
+++ b/src/lib/libcrypto/bn/bn_prime.pl
@@ -18,13 +18,74 @@ loop: while ($#primes < $num-1)
         push(@primes,$p);
         }
 
-print <<"EOF";
+# print <<"EOF";
+# /* Auto generated by bn_prime.pl */
+# /* Copyright (C) 1995-1997 Eric Young (eay\@mincom.oz.au).
+#  * All rights reserved.
+#  * Copyright remains Eric Young's, and as such any Copyright notices in
+#  * the code are not to be removed.
+#  * See the COPYRIGHT file in the SSLeay distribution for more details.
+#  */
+# 
+# EOF
+
+print <<\EOF;
 /* Auto generated by bn_prime.pl */
-/* Copyright (C) 1995-1997 Eric Young (eay\@mincom.oz.au).
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
  * Copyright remains Eric Young's, and as such any Copyright notices in
  * the code are not to be removed.
- * See the COPYRIGHT file in the SSLeay distribution for more details.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
  */
 
 EOF
@@ -43,7 +104,7 @@ printf "#define NUMPRIMES %d\n",$num;
 printf "#else\n";
 printf "#define NUMPRIMES %d\n",$eight;
 printf "#endif\n";
-print "static unsigned int primes[NUMPRIMES]=\n\t{\n\t";
+print "static const unsigned int primes[NUMPRIMES]=\n\t{\n\t";
 $init=0;
 for ($i=0; $i <= $#primes; $i++)
         {
diff --git a/src/lib/libcrypto/bn/bn_print.c b/src/lib/libcrypto/bn/bn_print.c
index 2f5ab2617b..782a96e7e0 100644
--- a/src/lib/libcrypto/bn/bn_print.c
+++ b/src/lib/libcrypto/bn/bn_print.c
@@ -137,7 +137,7 @@ char *BN_bn2dec(const BIGNUM *a)
                         }
                 lp--;
                 /* We now have a series of blocks, BN_DEC_NUM chars
-                 * in length, where the last one needs trucation.
+                 * in length, where the last one needs truncation.
                  * The blocks need to be reversed in order. */
                 sprintf(p,BN_DEC_FMT1,*lp);
                 while (*p) p++;
@@ -171,7 +171,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a)
         num=i+neg;
         if (bn == NULL) return(num);
 
-        /* a is the start of the hex digets, and it is 'i' long */
+        /* a is the start of the hex digits, and it is 'i' long */
         if (*bn == NULL)
                 {
                 if ((ret=BN_new()) == NULL) return(0);
@@ -185,7 +185,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a)
         /* i is the number of hex digests; */
         if (bn_expand(ret,i*4) == NULL) goto err;
 
-        j=i; /* least significate 'hex' */
+        j=i; /* least significant 'hex' */
         m=0;
         h=0;
         while (j > 0)
@@ -236,8 +236,8 @@ int BN_dec2bn(BIGNUM **bn, const char *a)
         num=i+neg;
         if (bn == NULL) return(num);
 
-        /* a is the start of the digets, and it is 'i' long.
-         * We chop it into BN_DEC_NUM digets at a time */
+        /* a is the start of the digits, and it is 'i' long.
+         * We chop it into BN_DEC_NUM digits at a time */
         if (*bn == NULL)
                 {
                 if ((ret=BN_new()) == NULL) return(0);
@@ -278,9 +278,8 @@ err:
         }
 
 #ifndef NO_BIO
-
 #ifndef NO_FP_API
-int BN_print_fp(FILE *fp, BIGNUM *a)
+int BN_print_fp(FILE *fp, const BIGNUM *a)
         {
         BIO *b;
         int ret;
@@ -319,5 +318,15 @@ int BN_print(BIO *bp, const BIGNUM *a)
 end:
         return(ret);
         }
+#endif
 
+#ifdef BN_DEBUG
+void bn_dump1(FILE *o, const char *a, BN_ULONG *b,int n)
+        {
+        int i;
+        fprintf(o, "%s=", a);
+        for (i=n-1;i>=0;i--)
+                fprintf(o, "%08lX", b[i]); /* assumes 32-bit BN_ULONG */
+        fprintf(o, "\n");
+        }
 #endif
diff --git a/src/lib/libcrypto/bn/bn_rand.c b/src/lib/libcrypto/bn/bn_rand.c
index 91b8e34ae6..943712c15b 100644
--- a/src/lib/libcrypto/bn/bn_rand.c
+++ b/src/lib/libcrypto/bn/bn_rand.c
@@ -62,7 +62,7 @@
 #include "bn_lcl.h"
 #include <openssl/rand.h>
 
-int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
+static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
         {
         unsigned char *buf=NULL;
         int ret=0,bit,bytes,mask;
@@ -81,9 +81,19 @@ int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
 
         /* make a random number and set the top and bottom bits */
         time(&tim);
-        RAND_seed(&tim,sizeof(tim));
+        RAND_add(&tim,sizeof(tim),0);
+
+        if (pseudorand)
+                {
+                if (RAND_pseudo_bytes(buf, bytes) == -1)
+                        goto err;
+                }
+        else
+                {
+                if (RAND_bytes(buf, bytes) <= 0)
+                        goto err;
+                }
 
-        RAND_bytes(buf,(int)bytes);
         if (top)
                 {
                 if (bit == 0)
@@ -115,3 +125,12 @@ err:
         return(ret);
         }
 
+int     BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
+        {
+        return bnrand(0, rnd, bits, top, bottom);
+        }
+
+int     BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)
+        {
+        return bnrand(1, rnd, bits, top, bottom);
+        }
diff --git a/src/lib/libcrypto/bn/bn_recp.c b/src/lib/libcrypto/bn/bn_recp.c
index c1b0e230ea..a8796bd0aa 100644
--- a/src/lib/libcrypto/bn/bn_recp.c
+++ b/src/lib/libcrypto/bn/bn_recp.c
@@ -106,7 +106,8 @@ int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_RECP_CTX *recp,
         int ret=0;
         BIGNUM *a;
 
-        a= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        if ((a = BN_CTX_get(ctx)) == NULL) goto err;
         if (y != NULL)
                 {
                 if (x == y)
@@ -120,33 +121,34 @@ int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_RECP_CTX *recp,
         BN_div_recp(NULL,r,a,recp,ctx);
         ret=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         return(ret);
         }
 
 int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
              BN_CTX *ctx)
         {
-        int i,j,tos,ret=0,ex;
+        int i,j,ret=0;
         BIGNUM *a,*b,*d,*r;
 
-        tos=ctx->tos;
-        a= &(ctx->bn[ctx->tos++]);
-        b= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        a=BN_CTX_get(ctx);
+        b=BN_CTX_get(ctx);
         if (dv != NULL)
                 d=dv;
         else
-                d= &(ctx->bn[ctx->tos++]);
+                d=BN_CTX_get(ctx);
         if (rem != NULL)
                 r=rem;
         else
-                r= &(ctx->bn[ctx->tos++]);
+                r=BN_CTX_get(ctx);
+        if (a == NULL || b == NULL || d == NULL || r == NULL) goto err;
 
         if (BN_ucmp(m,&(recp->N)) < 0)
                 {
                 BN_zero(d);
                 BN_copy(r,m);
-                ctx->tos=tos;
+                BN_CTX_end(ctx);
                 return(1);
                 }
 
@@ -157,33 +159,24 @@ int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
          */
         i=BN_num_bits(m);
 
-        j=recp->num_bits*2;
-        if (j > i)
-                {
-                i=j;
-                ex=0;
-                }
-        else
-                {
-                ex=(i-j)/2;
-                }
-
-        j=i/2;
+        j=recp->num_bits<<1;
+        if (j>i) i=j;
+        j>>=1;
 
         if (i != recp->shift)
                 recp->shift=BN_reciprocal(&(recp->Nr),&(recp->N),
                         i,ctx);
 
-        if (!BN_rshift(a,m,j-ex)) goto err;
+        if (!BN_rshift(a,m,j)) goto err;
         if (!BN_mul(b,a,&(recp->Nr),ctx)) goto err;
-        if (!BN_rshift(d,b,j+ex)) goto err;
+        if (!BN_rshift(d,b,i-j)) goto err;
         d->neg=0;
         if (!BN_mul(b,&(recp->N),d,ctx)) goto err;
         if (!BN_usub(r,m,b)) goto err;
         r->neg=0;
 
-        j=0;
 #if 1
+        j=0;
         while (BN_ucmp(r,&(recp->N)) >= 0)
                 {
                 if (j++ > 2)
@@ -200,7 +193,7 @@ int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
         d->neg=m->neg^recp->N.neg;
         ret=1;
 err:
-        ctx->tos=tos;
+        BN_CTX_end(ctx);
         return(ret);
         } 
 
diff --git a/src/lib/libcrypto/bn/bn_sqr.c b/src/lib/libcrypto/bn/bn_sqr.c
index 12cce4d7ce..fe00c5f69a 100644
--- a/src/lib/libcrypto/bn/bn_sqr.c
+++ b/src/lib/libcrypto/bn/bn_sqr.c
@@ -65,14 +65,13 @@
 int BN_sqr(BIGNUM *r, BIGNUM *a, BN_CTX *ctx)
         {
         int max,al;
+        int ret = 0;
         BIGNUM *tmp,*rr;
 
 #ifdef BN_COUNT
 printf("BN_sqr %d * %d\n",a->top,a->top);
 #endif
         bn_check_top(a);
-        tmp= &(ctx->bn[ctx->tos]);
-        rr=(a != r)?r: (&ctx->bn[ctx->tos+1]);
 
         al=a->top;
         if (al <= 0)
@@ -81,8 +80,13 @@ printf("BN_sqr %d * %d\n",a->top,a->top);
                 return(1);
                 }
 
+        BN_CTX_start(ctx);
+        rr=(a != r) ? r : BN_CTX_get(ctx);
+        tmp=BN_CTX_get(ctx);
+        if (tmp == NULL) goto err;
+
         max=(al+al);
-        if (bn_wexpand(rr,max+1) == NULL) return(0);
+        if (bn_wexpand(rr,max+1) == NULL) goto err;
 
         r->neg=0;
         if (al == 4)
@@ -120,18 +124,18 @@ printf("BN_sqr %d * %d\n",a->top,a->top);
                         k=j+j;
                         if (al == j)
                                 {
-                                if (bn_wexpand(a,k*2) == NULL) return(0);
-                                if (bn_wexpand(tmp,k*2) == NULL) return(0);
+                                if (bn_wexpand(a,k*2) == NULL) goto err;
+                                if (bn_wexpand(tmp,k*2) == NULL) goto err;
                                 bn_sqr_recursive(rr->d,a->d,al,tmp->d);
                                 }
                         else
                                 {
-                                if (bn_wexpand(tmp,max) == NULL) return(0);
+                                if (bn_wexpand(tmp,max) == NULL) goto err;
                                 bn_sqr_normal(rr->d,a->d,al,tmp->d);
                                 }
                         }
 #else
-                if (bn_wexpand(tmp,max) == NULL) return(0);
+                if (bn_wexpand(tmp,max) == NULL) goto err;
                 bn_sqr_normal(rr->d,a->d,al,tmp->d);
 #endif
                 }
@@ -139,7 +143,10 @@ printf("BN_sqr %d * %d\n",a->top,a->top);
         rr->top=max;
         if ((max > 0) && (rr->d[max-1] == 0)) rr->top--;
         if (rr != r) BN_copy(r,rr);
-        return(1);
+        ret = 1;
+ err:
+        BN_CTX_end(ctx);
+        return(ret);
         }
 
 /* tmp must have 2*n words */
@@ -185,7 +192,7 @@ void bn_sqr_normal(BN_ULONG *r, BN_ULONG *a, int n, BN_ULONG *tmp)
  * n must be a power of 2.
  * We multiply and return the result.
  * t must be 2*n words in size
- * We calulate
+ * We calculate
  * a[0]*b[0]
  * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
  * a[1]*b[1]
diff --git a/src/lib/libcrypto/bn/bn_word.c b/src/lib/libcrypto/bn/bn_word.c
index c0cfbc6797..73157a7d43 100644
--- a/src/lib/libcrypto/bn/bn_word.c
+++ b/src/lib/libcrypto/bn/bn_word.c
@@ -60,7 +60,7 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-BN_ULONG BN_mod_word(BIGNUM *a, BN_ULONG w)
+BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w)
         {
 #ifndef BN_LLONG
         BN_ULONG ret=0;
diff --git a/src/lib/libcrypto/bn/bnspeed.c b/src/lib/libcrypto/bn/bnspeed.c
index 0922aa3e16..20fc7e08ff 100644
--- a/src/lib/libcrypto/bn/bnspeed.c
+++ b/src/lib/libcrypto/bn/bnspeed.c
@@ -1,3 +1,5 @@
+/* unused */
+
 /* crypto/bn/bnspeed.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
diff --git a/src/lib/libcrypto/bn/bntest.c b/src/lib/libcrypto/bn/bntest.c
index df4b81f5b2..41c22f5954 100644
--- a/src/lib/libcrypto/bn/bntest.c
+++ b/src/lib/libcrypto/bn/bntest.c
@@ -72,6 +72,10 @@
 #include "../bio/bss_file.c"
 #endif
 
+const int num0 = 100; /* number of tests */
+const int num1 = 50;  /* additional tests for some functions */
+const int num2 = 5;   /* number of tests for slow functions */
+
 int test_add(BIO *bp);
 int test_sub(BIO *bp);
 int test_lshift1(BIO *bp);
@@ -95,15 +99,33 @@ static int results=0;
 #include "bss_file.c"
 #endif
 
-static unsigned char lst1[]="\xC6\x4F\x43\x04\x2A\xEA\xCA\x6E\x58\x36\x80\x5B\xE8\xC9"
+static unsigned char lst[]="\xC6\x4F\x43\x04\x2A\xEA\xCA\x6E\x58\x36\x80\x5B\xE8\xC9"
 "\x9B\x04\x5D\x48\x36\xC2\xFD\x16\xC9\x64\xF0";
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
+static void message(BIO *out, char *m)
+        {
+        fprintf(stderr, "test %s\n", m);
+#if defined(linux) || defined(__FreeBSD__) /* can we use GNU bc features? */
+        BIO_puts(out, "print \"test ");
+        BIO_puts(out, m);
+        BIO_puts(out, "\\n\"\n");
+#endif
+        }
+
 int main(int argc, char *argv[])
         {
         BN_CTX *ctx;
         BIO *out;
         char *outfile=NULL;
 
+        results = 0;
+
+        RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_rand may fail, and we don't
+                                               * even check its return value
+                                               * (which we should) */
+
         argc--;
         argv++;
         while (argc >= 1)
@@ -141,78 +163,81 @@ int main(int argc, char *argv[])
         if (!results)
                 BIO_puts(out,"obase=16\nibase=16\n");
 
-        fprintf(stderr,"test BN_add\n");
+        message(out,"BN_add");
         if (!test_add(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_sub\n");
+        message(out,"BN_sub");
         if (!test_sub(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_lshift1\n");
+        message(out,"BN_lshift1");
         if (!test_lshift1(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_lshift (fixed)\n");
-        if (!test_lshift(out,ctx,BN_bin2bn(lst1,sizeof(lst1)-1,NULL)))
+        message(out,"BN_lshift (fixed)");
+        if (!test_lshift(out,ctx,BN_bin2bn(lst,sizeof(lst)-1,NULL)))
             goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_lshift\n");
+        message(out,"BN_lshift");
         if (!test_lshift(out,ctx,NULL)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_rshift1\n");
+        message(out,"BN_rshift1");
         if (!test_rshift1(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_rshift\n");
+        message(out,"BN_rshift");
         if (!test_rshift(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_sqr\n");
+        message(out,"BN_sqr");
         if (!test_sqr(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_mul\n");
+        message(out,"BN_mul");
         if (!test_mul(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_div\n");
+        message(out,"BN_div");
         if (!test_div(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_div_recp\n");
+        message(out,"BN_div_recp");
         if (!test_div_recp(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_mod\n");
+        message(out,"BN_mod");
         if (!test_mod(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_mod_mul\n");
+        message(out,"BN_mod_mul");
         if (!test_mod_mul(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-/*
-        fprintf(stderr,"test BN_mont\n");
+        message(out,"BN_mont");
         if (!test_mont(out,ctx)) goto err;
-        fflush(stdout);
-*/
-        fprintf(stderr,"test BN_mod_exp\n");
+        BIO_flush(out);
+
+        message(out,"BN_mod_exp");
         if (!test_mod_exp(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_exp\n");
+        message(out,"BN_exp");
         if (!test_exp(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
+
+        BN_CTX_free(ctx);
+        BIO_free(out);
 
 /**/
         exit(0);
 err:
         BIO_puts(out,"1\n"); /* make sure bc fails if we are piping to it */
+        BIO_flush(out);
         ERR_load_crypto_strings();
-        ERR_print_errors(out);
+        ERR_print_errors_fp(stderr);
         exit(1);
         return(1);
         }
@@ -228,7 +253,7 @@ int test_add(BIO *bp)
         BN_init(&c);
 
         BN_rand(&a,512,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rand(&b,450+i,0,0);
                 a.neg=rand_neg();
@@ -255,7 +280,7 @@ int test_add(BIO *bp)
                 BN_add(&c,&c,&a);
                 if(!BN_is_zero(&c))
                     {
-                    BIO_puts(bp,"Add test failed!\n");
+                    fprintf(stderr,"Add test failed!\n");
                     return 0;
                     }
                 }
@@ -275,12 +300,21 @@ int test_sub(BIO *bp)
         BN_init(&b);
         BN_init(&c);
 
-        BN_rand(&a,512,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0+num1; i++)
                 {
-                BN_rand(&b,400+i,0,0);
-                a.neg=rand_neg();
-                b.neg=rand_neg();
+                if (i < num1)
+                        {
+                        BN_rand(&a,512,0,0);
+                        BN_copy(&b,&a);
+                        if (BN_set_bit(&a,i)==0) return(0);
+                        BN_add_word(&b,i);
+                        }
+                else
+                        {
+                        BN_rand(&b,400+i-num1,0,0);
+                        a.neg=rand_neg();
+                        b.neg=rand_neg();
+                        }
                 if (bp == NULL)
                         for (j=0; j<10000; j++)
                                 BN_sub(&c,&a,&b);
@@ -301,7 +335,7 @@ int test_sub(BIO *bp)
                 BN_sub(&c,&c,&a);
                 if(!BN_is_zero(&c))
                     {
-                    BIO_puts(bp,"Subtract test failed!\n");
+                    fprintf(stderr,"Subtract test failed!\n");
                     return 0;
                     }
                 }
@@ -323,10 +357,17 @@ int test_div(BIO *bp, BN_CTX *ctx)
         BN_init(&d);
         BN_init(&e);
 
-        BN_rand(&a,400,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0+num1; i++)
                 {
-                BN_rand(&b,50+i,0,0);
+                if (i < num1)
+                        {
+                        BN_rand(&a,400,0,0);
+                        BN_copy(&b,&a);
+                        BN_lshift(&a,&a,i);
+                        BN_add_word(&a,i);
+                        }
+                else
+                        BN_rand(&b,50+3*(i-num1),0,0);
                 a.neg=rand_neg();
                 b.neg=rand_neg();
                 if (bp == NULL)
@@ -360,7 +401,7 @@ int test_div(BIO *bp, BN_CTX *ctx)
                 BN_sub(&d,&d,&a);
                 if(!BN_is_zero(&d))
                     {
-                    BIO_puts(bp,"Division test failed!\n");
+                    fprintf(stderr,"Division test failed!\n");
                     return 0;
                     }
                 }
@@ -386,10 +427,17 @@ int test_div_recp(BIO *bp, BN_CTX *ctx)
         BN_init(&d);
         BN_init(&e);
 
-        BN_rand(&a,400,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0+num1; i++)
                 {
-                BN_rand(&b,50+i,0,0);
+                if (i < num1)
+                        {
+                        BN_rand(&a,400,0,0);
+                        BN_copy(&b,&a);
+                        BN_lshift(&a,&a,i);
+                        BN_add_word(&a,i);
+                        }
+                else
+                        BN_rand(&b,50+3*(i-num1),0,0);
                 a.neg=rand_neg();
                 b.neg=rand_neg();
                 BN_RECP_CTX_set(&recp,&b,ctx);
@@ -424,7 +472,12 @@ int test_div_recp(BIO *bp, BN_CTX *ctx)
                 BN_sub(&d,&d,&a);
                 if(!BN_is_zero(&d))
                     {
-                    BIO_puts(bp,"Reciprocal division test failed!\n");
+                    fprintf(stderr,"Reciprocal division test failed!\n");
+                    fprintf(stderr,"a=");
+                    BN_print_fp(stderr,&a);
+                    fprintf(stderr,"\nb=");
+                    BN_print_fp(stderr,&b);
+                    fprintf(stderr,"\n");
                     return 0;
                     }
                 }
@@ -451,11 +504,15 @@ int test_mul(BIO *bp)
         BN_init(&d);
         BN_init(&e);
 
-        BN_rand(&a,200,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0+num1; i++)
                 {
-                BN_rand(&b,250+i,0,0);
-                BN_rand(&b,200,0,0);
+                if (i <= num1)
+                        {
+                        BN_rand(&a,100,0,0);
+                        BN_rand(&b,100,0,0);
+                        }
+                else
+                        BN_rand(&b,i-num1,0,0);
                 a.neg=rand_neg();
                 b.neg=rand_neg();
                 if (bp == NULL)
@@ -478,7 +535,7 @@ int test_mul(BIO *bp)
                 BN_sub(&d,&d,&b);
                 if(!BN_is_zero(&d) || !BN_is_zero(&e))
                     {
-                    BIO_puts(bp,"Multiplication test failed!\n");
+                    fprintf(stderr,"Multiplication test failed!\n");
                     return 0;
                     }
                 }
@@ -502,7 +559,7 @@ int test_sqr(BIO *bp, BN_CTX *ctx)
         BN_init(&d);
         BN_init(&e);
 
-        for (i=0; i<40; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rand(&a,40+i*10,0,0);
                 a.neg=rand_neg();
@@ -526,7 +583,7 @@ int test_sqr(BIO *bp, BN_CTX *ctx)
                 BN_sub(&d,&d,&a);
                 if(!BN_is_zero(&d) || !BN_is_zero(&e))
                     {
-                    BIO_puts(bp,"Square test failed!\n");
+                    fprintf(stderr,"Square test failed!\n");
                     return 0;
                     }
                 }
@@ -557,9 +614,13 @@ int test_mont(BIO *bp, BN_CTX *ctx)
 
         BN_rand(&a,100,0,0); /**/
         BN_rand(&b,100,0,0); /**/
-        for (i=0; i<10; i++)
+        for (i=0; i<num2; i++)
                 {
-                BN_rand(&n,(100%BN_BITS2+1)*BN_BITS2*i*BN_BITS2,0,1); /**/
+                int bits = (200*(i+1))/num2;
+
+                if (bits == 0)
+                        continue;
+                BN_rand(&n,bits,0,1);
                 BN_MONT_CTX_set(mont,&n,ctx);
 
                 BN_to_montgomery(&A,&a,mont,ctx);
@@ -594,7 +655,7 @@ BN_num_bits(mont->N));
                 BN_sub(&d,&d,&A);
                 if(!BN_is_zero(&d))
                     {
-                    BIO_puts(bp,"Montgomery multiplication test failed!\n");
+                    fprintf(stderr,"Montgomery multiplication test failed!\n");
                     return 0;
                     }
                 }
@@ -622,7 +683,7 @@ int test_mod(BIO *bp, BN_CTX *ctx)
         e=BN_new();
 
         BN_rand(a,1024,0,0); /**/
-        for (i=0; i<20; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rand(b,450+i*10,0,0); /**/
                 a->neg=rand_neg();
@@ -647,7 +708,7 @@ int test_mod(BIO *bp, BN_CTX *ctx)
                 BN_sub(e,e,c);
                 if(!BN_is_zero(e))
                     {
-                    BIO_puts(bp,"Modulo test failed!\n");
+                    fprintf(stderr,"Modulo test failed!\n");
                     return 0;
                     }
                 }
@@ -671,10 +732,10 @@ int test_mod_mul(BIO *bp, BN_CTX *ctx)
         e=BN_new();
 
         BN_rand(c,1024,0,0); /**/
-        for (i=0; i<10; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rand(a,475+i*10,0,0); /**/
-                BN_rand(b,425+i*10,0,0); /**/
+                BN_rand(b,425+i*11,0,0); /**/
                 a->neg=rand_neg();
                 b->neg=rand_neg();
         /*      if (bp == NULL)
@@ -709,7 +770,7 @@ int test_mod_mul(BIO *bp, BN_CTX *ctx)
                 BN_div(a,b,d,c,ctx);
                 if(!BN_is_zero(b))
                     {
-                    BIO_puts(bp,"Modulo multiply test failed!\n");
+                    fprintf(stderr,"Modulo multiply test failed!\n");
                     return 0;
                     }
                 }
@@ -733,7 +794,7 @@ int test_mod_exp(BIO *bp, BN_CTX *ctx)
         e=BN_new();
 
         BN_rand(c,30,0,1); /* must be odd for montgomery */
-        for (i=0; i<6; i++)
+        for (i=0; i<num2; i++)
                 {
                 BN_rand(a,20+i*5,0,0); /**/
                 BN_rand(b,2+i,0,0); /**/
@@ -760,7 +821,7 @@ int test_mod_exp(BIO *bp, BN_CTX *ctx)
                 BN_div(a,b,e,c,ctx);
                 if(!BN_is_zero(b))
                     {
-                    BIO_puts(bp,"Modulo exponentiation test failed!\n");
+                    fprintf(stderr,"Modulo exponentiation test failed!\n");
                     return 0;
                     }
                 }
@@ -784,7 +845,7 @@ int test_exp(BIO *bp, BN_CTX *ctx)
         one=BN_new();
         BN_one(one);
 
-        for (i=0; i<6; i++)
+        for (i=0; i<num2; i++)
                 {
                 BN_rand(a,20+i*5,0,0); /**/
                 BN_rand(b,2+i,0,0); /**/
@@ -810,7 +871,7 @@ int test_exp(BIO *bp, BN_CTX *ctx)
                 BN_sub(e,e,d);
                 if(!BN_is_zero(e))
                     {
-                    BIO_puts(bp,"Exponentiation test failed!\n");
+                    fprintf(stderr,"Exponentiation test failed!\n");
                     return 0;
                     }
                 }
@@ -840,7 +901,7 @@ int test_lshift(BIO *bp,BN_CTX *ctx,BIGNUM *a_)
             BN_rand(a,200,0,0); /**/
             a->neg=rand_neg();
             }
-        for (i=0; i<70; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_lshift(b,a,i+1);
                 BN_add(c,c,c);
@@ -860,16 +921,16 @@ int test_lshift(BIO *bp,BN_CTX *ctx,BIGNUM *a_)
                 BN_sub(d,d,b);
                 if(!BN_is_zero(d))
                     {
-                    BIO_puts(bp,"Left shift test failed!\n");
-                    BIO_puts(bp,"a=");
-                    BN_print(bp,a);
-                    BIO_puts(bp,"\nb=");
-                    BN_print(bp,b);
-                    BIO_puts(bp,"\nc=");
-                    BN_print(bp,c);
-                    BIO_puts(bp,"\nd=");
-                    BN_print(bp,d);
-                    BIO_puts(bp,"\n");
+                    fprintf(stderr,"Left shift test failed!\n");
+                    fprintf(stderr,"a=");
+                    BN_print_fp(stderr,a);
+                    fprintf(stderr,"\nb=");
+                    BN_print_fp(stderr,b);
+                    fprintf(stderr,"\nc=");
+                    BN_print_fp(stderr,c);
+                    fprintf(stderr,"\nd=");
+                    BN_print_fp(stderr,d);
+                    fprintf(stderr,"\n");
                     return 0;
                     }
                 }
@@ -891,7 +952,7 @@ int test_lshift1(BIO *bp)
 
         BN_rand(a,200,0,0); /**/
         a->neg=rand_neg();
-        for (i=0; i<70; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_lshift1(b,a);
                 if (bp != NULL)
@@ -909,7 +970,7 @@ int test_lshift1(BIO *bp)
                 BN_sub(a,b,c);
                 if(!BN_is_zero(a))
                     {
-                    BIO_puts(bp,"Left shift one test failed!\n");
+                    fprintf(stderr,"Left shift one test failed!\n");
                     return 0;
                     }
                 
@@ -935,7 +996,7 @@ int test_rshift(BIO *bp,BN_CTX *ctx)
 
         BN_rand(a,200,0,0); /**/
         a->neg=rand_neg();
-        for (i=0; i<70; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rshift(b,a,i+1);
                 BN_add(c,c,c);
@@ -955,7 +1016,7 @@ int test_rshift(BIO *bp,BN_CTX *ctx)
                 BN_sub(d,d,b);
                 if(!BN_is_zero(d))
                     {
-                    BIO_puts(bp,"Right shift test failed!\n");
+                    fprintf(stderr,"Right shift test failed!\n");
                     return 0;
                     }
                 }
@@ -978,7 +1039,7 @@ int test_rshift1(BIO *bp)
 
         BN_rand(a,200,0,0); /**/
         a->neg=rand_neg();
-        for (i=0; i<70; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rshift1(b,a);
                 if (bp != NULL)
@@ -996,7 +1057,7 @@ int test_rshift1(BIO *bp)
                 BN_sub(c,c,b);
                 if(!BN_is_zero(c) && !BN_is_one(c))
                     {
-                    BIO_puts(bp,"Right shift one test failed!\n");
+                    fprintf(stderr,"Right shift one test failed!\n");
                     return 0;
                     }
                 BN_copy(a,b);
diff --git a/src/lib/libcrypto/bn/comba.pl b/src/lib/libcrypto/bn/comba.pl
index 211a8b45c7..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/comba.pl
+++ b/src/lib/libcrypto/bn/comba.pl
@@ -1,285 +0,0 @@
-#!/usr/local/bin/perl
-
-$num=8;
-$num2=8/2;
-
-print <<"EOF";
-/* crypto/bn/bn_comba.c */
-#include <stdio.h>
-#include "bn_lcl.h"
-/* Auto generated from crypto/bn/comba.pl
- */
-
-#undef bn_mul_comba8
-#undef bn_mul_comba4
-#undef bn_sqr_comba8
-#undef bn_sqr_comba4
-
-#ifdef BN_LLONG
-#define mul_add_c(a,b,c0,c1,c2) \\
-        t=(BN_ULLONG)a*b; \\
-        t1=(BN_ULONG)Lw(t); \\
-        t2=(BN_ULONG)Hw(t); \\
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define mul_add_c2(a,b,c0,c1,c2) \\
-        t=(BN_ULLONG)a*b; \\
-        tt=(t+t)&BN_MASK; \\
-        if (tt < t) c2++; \\
-        t1=(BN_ULONG)Lw(tt); \\
-        t2=(BN_ULONG)Hw(tt); \\
-        c0=(c0+t1)&BN_MASK2;  \\
-        if ((c0 < t1) && (((++t2)&BN_MASK2) == 0)) c2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c(a,i,c0,c1,c2) \\
-        t=(BN_ULLONG)a[i]*a[i]; \\
-        t1=(BN_ULONG)Lw(t); \\
-        t2=(BN_ULONG)Hw(t); \\
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c2(a,i,j,c0,c1,c2) \\
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#else
-#define mul_add_c(a,b,c0,c1,c2) \\
-        t1=LBITS(a); t2=HBITS(a); \\
-        bl=LBITS(b); bh=HBITS(b); \\
-        mul64(t1,t2,bl,bh); \\
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define mul_add_c2(a,b,c0,c1,c2) \\
-        t1=LBITS(a); t2=HBITS(a); \\
-        bl=LBITS(b); bh=HBITS(b); \\
-        mul64(t1,t2,bl,bh); \\
-        if (t2 & BN_TBIT) c2++; \\
-        t2=(t2+t2)&BN_MASK2; \\
-        if (t1 & BN_TBIT) t2++; \\
-        t1=(t1+t1)&BN_MASK2; \\
-        c0=(c0+t1)&BN_MASK2;  \\
-        if ((c0 < t1) && (((++t2)&BN_MASK2) == 0)) c2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c(a,i,c0,c1,c2) \\
-        sqr64(t1,t2,(a)[i]); \\
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c2(a,i,j,c0,c1,c2) \\
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#endif
-
-void bn_mul_comba${num}(r,a,b)
-BN_ULONG *r,*a,*b;
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-EOF
-$ret=&combas_mul("r","a","b",$num,"c1","c2","c3");
-printf <<"EOF";
-        }
-
-void bn_mul_comba${num2}(r,a,b)
-BN_ULONG *r,*a,*b;
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-EOF
-$ret=&combas_mul("r","a","b",$num2,"c1","c2","c3");
-printf <<"EOF";
-        }
-
-void bn_sqr_comba${num}(r,a)
-BN_ULONG *r,*a;
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t,tt;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-EOF
-$ret=&combas_sqr("r","a",$num,"c1","c2","c3");
-printf <<"EOF";
-        }
-
-void bn_sqr_comba${num2}(r,a)
-BN_ULONG *r,*a;
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t,tt;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-EOF
-$ret=&combas_sqr("r","a",$num2,"c1","c2","c3");
-printf <<"EOF";
-        }
-EOF
-
-sub bn_str
-        {
-        local($var,$val)=@_;
-        print "\t$var=$val;\n";
-        }
-
-sub bn_ary
-        {
-        local($var,$idx)=@_;
-        return("${var}[$idx]");
-        }
-
-sub bn_clr
-        {
-        local($var)=@_;
-
-        print "\t$var=0;\n";
-        }
-
-sub bn_mad
-        {
-        local($a,$b,$c0,$c1,$c2,$num)=@_;
-
-        if ($num == 2)
-                { printf("\tmul_add_c2($a,$b,$c0,$c1,$c2);\n"); }
-        else
-                { printf("\tmul_add_c($a,$b,$c0,$c1,$c2);\n"); }
-        }
-
-sub bn_sad
-        {
-        local($a,$i,$j,$c0,$c1,$c2,$num)=@_;
-
-        if ($num == 2)
-                { printf("\tsqr_add_c2($a,$i,$j,$c0,$c1,$c2);\n"); }
-        else
-                { printf("\tsqr_add_c($a,$i,$c0,$c1,$c2);\n"); }
-        }
-
-sub combas_mul
-        {
-        local($r,$a,$b,$num,$c0,$c1,$c2)=@_;
-        local($i,$as,$ae,$bs,$be,$ai,$bi);
-        local($tot,$end);
-
-        $as=0;
-        $ae=0;
-        $bs=0;
-        $be=0;
-        $tot=$num+$num-1;
-        &bn_clr($c0);
-        &bn_clr($c1);
-        for ($i=0; $i<$tot; $i++)
-                {
-                $ai=$as;
-                $bi=$bs;
-                $end=$be+1;
-                @numa=@numb=();
-
-#print "($as $ae) ($bs $be) $bs -> $end [$i $num]\n";
-                for ($j=$bs; $j<$end; $j++)
-                        {
-                        push(@numa,$ai);
-                        push(@numb,$bi);
-                        $ai--;
-                        $bi++;
-                        }
-
-                if ($i & 1)
-                        {
-                        @numa=reverse(@numa);
-                        @numb=reverse(@numb);
-                        }
-
-                &bn_clr($c2);
-                for ($j=0; $j<=$#numa; $j++)
-                        {
-                        &bn_mad(&bn_ary($a,$numa[$j]),
-                                &bn_ary($b,$numb[$j]),$c0,$c1,$c2,1);
-                        }
-                &bn_str(&bn_ary($r,$i),$c0);
-                ($c0,$c1,$c2)=($c1,$c2,$c0);
-
-                $as++ if ($i < ($num-1));
-                $ae++ if ($i >= ($num-1));
-
-                $bs++ if ($i >= ($num-1));
-                $be++ if ($i < ($num-1));
-                }
-        &bn_str(&bn_ary($r,$i),$c0);
-        }
-
-sub combas_sqr
-        {
-        local($r,$a,$num,$c0,$c1,$c2)=@_;
-        local($i,$as,$ae,$bs,$be,$ai,$bi);
-        local($b,$tot,$end,$half);
-
-        $b=$a;
-        $as=0;
-        $ae=0;
-        $bs=0;
-        $be=0;
-        $tot=$num+$num-1;
-        &bn_clr($c0);
-        &bn_clr($c1);
-        for ($i=0; $i<$tot; $i++)
-                {
-                $ai=$as;
-                $bi=$bs;
-                $end=$be+1;
-                @numa=@numb=();
-
-#print "($as $ae) ($bs $be) $bs -> $end [$i $num]\n";
-                for ($j=$bs; $j<$end; $j++)
-                        {
-                        push(@numa,$ai);
-                        push(@numb,$bi);
-                        $ai--;
-                        $bi++;
-                        last if ($ai < $bi);
-                        }
-                if (!($i & 1))
-                        {
-                        @numa=reverse(@numa);
-                        @numb=reverse(@numb);
-                        }
-
-                &bn_clr($c2);
-                for ($j=0; $j <= $#numa; $j++)
-                        {
-                        if ($numa[$j] == $numb[$j])
-                                {&bn_sad($a,$numa[$j],$numb[$j],$c0,$c1,$c2,1);}
-                        else
-                                {&bn_sad($a,$numa[$j],$numb[$j],$c0,$c1,$c2,2);}
-                        }
-                &bn_str(&bn_ary($r,$i),$c0);
-                ($c0,$c1,$c2)=($c1,$c2,$c0);
-
-                $as++ if ($i < ($num-1));
-                $ae++ if ($i >= ($num-1));
-
-                $bs++ if ($i >= ($num-1));
-                $be++ if ($i < ($num-1));
-                }
-        &bn_str(&bn_ary($r,$i),$c0);
-        }
diff --git a/src/lib/libcrypto/bn/d.c b/src/lib/libcrypto/bn/d.c
index ced2291b25..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/d.c
+++ b/src/lib/libcrypto/bn/d.c
@@ -1,72 +0,0 @@
-#include <stdio.h>
-#include <openssl/bio.h>
-#include "bn_lcl.h"
-
-#define SIZE_A (100*4+4)
-#define SIZE_B (13*4)
-
-main(argc,argv)
-int argc;
-char *argv[];
-        {
-        BN_CTX ctx;
-        BN_RECP_CTX recp;
-        BIGNUM a,b,dd,d,r,rr,t,l;
-        int i;
-
-        MemCheck_start();
-        MemCheck_on();
-        BN_CTX_init(&ctx);
-        BN_RECP_CTX_init(&recp);
-
-        BN_init(&r);
-        BN_init(&rr);
-        BN_init(&d);
-        BN_init(&dd);
-        BN_init(&a);
-        BN_init(&b);
-
-        {
-        BN_rand(&a,SIZE_A,0,0);
-        BN_rand(&b,SIZE_B,0,0);
-
-        a.neg=1;
-        BN_RECP_CTX_set(&recp,&b,&ctx);
-
-        BN_print_fp(stdout,&a); printf(" a\n");
-        BN_print_fp(stdout,&b); printf(" b\n");
-
-        BN_print_fp(stdout,&recp.N); printf(" N\n");
-        BN_print_fp(stdout,&recp.Nr); printf(" Nr num_bits=%d\n",recp.num_bits);
-
-        BN_div_recp(&r,&d,&a,&recp,&ctx);
-
-for (i=0; i<300; i++)
-        BN_div(&rr,&dd,&a,&b,&ctx);
-
-        BN_print_fp(stdout,&r); printf(" div recp\n");
-        BN_print_fp(stdout,&rr); printf(" div\n");
-        BN_print_fp(stdout,&d); printf(" rem recp\n");
-        BN_print_fp(stdout,&dd); printf(" rem\n");
-        }
-        BN_CTX_free(&ctx);
-        BN_RECP_CTX_free(&recp);
-
-        BN_free(&r);
-        BN_free(&rr);
-        BN_free(&d);
-        BN_free(&dd);
-        BN_free(&a);
-        BN_free(&b);
-
-        {
-        BIO *out;
-
-        if ((out=BIO_new(BIO_s_file())) != NULL)
-                BIO_set_fp(out,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
-
-        CRYPTO_mem_leaks(out);
-        BIO_free(out);
-        }
-
-        }
diff --git a/src/lib/libcrypto/bn/divtest.c b/src/lib/libcrypto/bn/divtest.c
new file mode 100644
index 0000000000..13ba86e3c4
--- /dev/null
+++ b/src/lib/libcrypto/bn/divtest.c
@@ -0,0 +1,41 @@
+#include <openssl/bn.h>
+#include <openssl/rand.h>
+
+static int rand(n)
+{
+    unsigned char x[2];
+    RAND_pseudo_bytes(x,2);
+    return (x[0] + 2*x[1]);
+}
+
+static void bug(char *m, BIGNUM *a, BIGNUM *b)
+{
+    printf("%s!\na=",m);
+    BN_print_fp(stdout, a);
+    printf("\nb=");
+    BN_print_fp(stdout, b);
+    printf("\n");
+    fflush(stdout);
+}
+
+main()
+{
+    BIGNUM *a=BN_new(), *b=BN_new(), *c=BN_new(), *d=BN_new(),
+        *C=BN_new(), *D=BN_new();
+    BN_RECP_CTX *recp=BN_RECP_CTX_new();
+    BN_CTX *ctx=BN_CTX_new();
+
+    for(;;) {
+        BN_pseudo_rand(a,rand(),0,0);
+        BN_pseudo_rand(b,rand(),0,0);
+        if (BN_is_zero(b)) continue;
+
+        BN_RECP_CTX_set(recp,b,ctx);
+        if (BN_div(C,D,a,b,ctx) != 1)
+            bug("BN_div failed",a,b);
+        if (BN_div_recp(c,d,a,recp,ctx) != 1)
+            bug("BN_div_recp failed",a,b);
+        else if (BN_cmp(c,C) != 0 || BN_cmp(c,C) != 0)
+            bug("mismatch",a,b);
+    }
+}
diff --git a/src/lib/libcrypto/bn/exp.c b/src/lib/libcrypto/bn/exp.c
index ec443459d8..4865b0ef74 100644
--- a/src/lib/libcrypto/bn/exp.c
+++ b/src/lib/libcrypto/bn/exp.c
@@ -1,3 +1,5 @@
+/* unused */
+
 #include <stdio.h>
 #include <openssl/tmdiff.h>
 #include "bn_lcl.h"
diff --git a/src/lib/libcrypto/bn/expspeed.c b/src/lib/libcrypto/bn/expspeed.c
index 3656d5bb4c..2044ab9bff 100644
--- a/src/lib/libcrypto/bn/expspeed.c
+++ b/src/lib/libcrypto/bn/expspeed.c
@@ -1,3 +1,5 @@
+/* unused */
+
 /* crypto/bn/expspeed.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
diff --git a/src/lib/libcrypto/bn/exptest.c b/src/lib/libcrypto/bn/exptest.c
index 9e4ae91d20..3e86f2ea0e 100644
--- a/src/lib/libcrypto/bn/exptest.c
+++ b/src/lib/libcrypto/bn/exptest.c
@@ -69,6 +69,8 @@
 
 #define NUM_BITS        (BN_BITS*2)
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
 int main(int argc, char *argv[])
         {
         BN_CTX *ctx;
@@ -77,6 +79,10 @@ int main(int argc, char *argv[])
         unsigned char c;
         BIGNUM *r_mont,*r_recp,*r_simple,*a,*b,*m;
 
+        RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_rand may fail, and we don't
+                                               * even check its return value
+                                               * (which we should) */
+
         ERR_load_BN_strings();
 
         ctx=BN_CTX_new();
@@ -160,7 +166,16 @@ int main(int argc, char *argv[])
                         exit(1);
                         }
                 }
+        BN_free(r_mont);
+        BN_free(r_recp);
+        BN_free(r_simple);
+        BN_free(a);
+        BN_free(b);
+        BN_free(m);
+        BN_CTX_free(ctx);
+        ERR_remove_state(0);
         CRYPTO_mem_leaks(out);
+        BIO_free(out);
         printf(" done\n");
         exit(0);
 err:
diff --git a/src/lib/libcrypto/bn/new b/src/lib/libcrypto/bn/new
index 285d506f19..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/new
+++ b/src/lib/libcrypto/bn/new
@@ -1,23 +0,0 @@
-void BN_RECP_CTX_init(BN_RECP_CTX *recp);
-BN_RECP_CTX *BN_RECP_CTX_new();
-void BN_RECP_CTX_free(BN_RECP_CTX *recp);
-int BN_RECP_CTX_set(BN_RECP_CTX *recp,BIGNUM *div,BN_CTX *ctx);
-
-int BN_mod_exp_recp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,
-        BN_RECP_CTX *recp,BN_CTX *ctx);
-
-int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d,
-        BN_RECP_CTX *recp, BN_CTX *ctx);
-int BN_mod_recp(BIGNUM *rem, BIGNUM *m, BIGNUM *d,
-        BN_RECP_CTX *recp, BN_CTX *ctx);
-int BN_mod_mul_recp(BIGNUM *ret,BIGNUM *a,BIGNUM *b,BIGNUM *m
-
-int BN_mod_exp_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *p,
-        BN_MONT_CTX *m_ctx,BN_CTX *ctx);
-int BN_mod_exp2_montgomery(BIGNUM *r, BIGNUM *a1, BIGNUM *p1,BIGNUM *a2,
-                BIGNUM *p2,BN_MONT_CTX *m_ctx,BN_CTX *ctx);
-
-
-bn_div64 -> bn_div_words
-
-
diff --git a/src/lib/libcrypto/bn/old/b_sqr.c b/src/lib/libcrypto/bn/old/b_sqr.c
index 715cb1c8ab..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/b_sqr.c
+++ b/src/lib/libcrypto/bn/old/b_sqr.c
@@ -1,199 +0,0 @@
-/* crypto/bn/bn_mul.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-static int bn_mm(BIGNUM *m,BIGNUM *A,BIGNUM *B, BIGNUM *sk,BN_CTX *ctx);
-
-/* r must be different to a and b */
-/* int BN_mmul(r, a, b) */
-int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b)
-        {
-        BN_ULONG *ap,*bp,*rp;
-        BIGNUM *sk;
-        int i,n,ret;
-        int max,al,bl;
-        BN_CTX ctx;
-
-        bn_check_top(a);
-        bn_check_top(b);
-
-        al=a->top;
-        bl=b->top;
-        if ((al == 0) || (bl == 0))
-                {
-                r->top=0;
-                return(1);
-                }
-#ifdef BN_MUL_DEBUG
-printf("BN_mul(%d,%d)\n",a->top,b->top);
-#endif
-
-        if (    (bn_limit_bits > 0) &&
-                (bl > bn_limit_num) && (al > bn_limit_num))
-                {
-                n=(BN_num_bits_word(al|bl)-bn_limit_bits);
-                n*=2;
-                sk=(BIGNUM *)Malloc(sizeof(BIGNUM)*n);
-                memset(sk,0,sizeof(BIGNUM)*n);
-                memset(&ctx,0,sizeof(ctx));
-
-                ret=bn_mm(r,a,b,&(sk[0]),&ctx);
-                for (i=0; i<n; i+=2)
-                        {
-                        BN_clear_free(&sk[i]);
-                        BN_clear_free(&sk[i+1]);
-                        }
-                Free(sk);
-                return(ret);
-                }
-
-        max=(al+bl);
-        if (bn_wexpand(r,max) == NULL) return(0);
-        r->top=max;
-        r->neg=a->neg^b->neg;
-        ap=a->d;
-        bp=b->d;
-        rp=r->d;
-
-        rp[al]=bn_mul_words(rp,ap,al,*(bp++));
-        rp++;
-        for (i=1; i<bl; i++)
-                {
-                rp[al]=bn_mul_add_words(rp,ap,al,*(bp++));
-                rp++;
-                }
-        if ((max > 0) && (r->d[max-1] == 0)) r->top--;
-        return(1);
-        }
-
-
-#define ahal    (sk[0])
-#define blbh    (sk[1])
-
-/* r must be different to a and b */
-int bn_mm(BIGNUM *m, BIGNUM *A, BIGNUM *B, BIGNUM *sk, BN_CTX *ctx)
-        {
-        int n,num,sqr=0;
-        int an,bn;
-        BIGNUM ah,al,bh,bl;
-
-        an=A->top;
-        bn=B->top;
-#ifdef BN_MUL_DEBUG
-printf("bn_mm(%d,%d)\n",A->top,B->top);
-#endif
-
-        if (A == B) sqr=1;
-        num=(an>bn)?an:bn;
-        n=(num+1)/2;
-        /* Are going to now chop things into 'num' word chunks. */
-
-        BN_init(&ah);
-        BN_init(&al);
-        BN_init(&bh);
-        BN_init(&bl);
-
-        bn_set_low (&al,A,n);
-        bn_set_high(&ah,A,n);
-        bn_set_low (&bl,B,n);
-        bn_set_high(&bh,B,n);
-
-        BN_sub(&ahal,&ah,&al);
-        BN_sub(&blbh,&bl,&bh);
-
-        if (num <= (bn_limit_num+bn_limit_num))
-                {
-                BN_mul(m,&ahal,&blbh);
-                if (sqr)
-                        {
-                        BN_sqr(&ahal,&al,ctx);
-                        BN_sqr(&blbh,&ah,ctx);
-                        }
-                else
-                        {
-                        BN_mul(&ahal,&al,&bl);
-                        BN_mul(&blbh,&ah,&bh);
-                        }
-                }
-        else
-                {
-                bn_mm(m,&ahal,&blbh,&(sk[2]),ctx);
-                bn_mm(&ahal,&al,&bl,&(sk[2]),ctx);
-                bn_mm(&blbh,&ah,&bh,&(sk[2]),ctx);
-                }
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        BN_lshift(m,m,n*BN_BITS2);
-        BN_lshift(&blbh,&blbh,n*BN_BITS2*2);
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        m->neg=A->neg^B->neg;
-        return(1);
-        }
-#undef ahal     (sk[0])
-#undef blbh     (sk[1])
-
-#include "bn_low.c"
-#include "bn_high.c"
diff --git a/src/lib/libcrypto/bn/old/bn_com.c b/src/lib/libcrypto/bn/old/bn_com.c
index 7666b2304c..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/bn_com.c
+++ b/src/lib/libcrypto/bn/old/bn_com.c
@@ -1,90 +0,0 @@
-/* crypto/bn/bn_mulw.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-#ifdef BN_LLONG 
-
-ab
-12
-   a2 b2
-a1 b1
-
-abc
-123
-      a3 b3 c3
-   a2 b2 c2
-a1 b1 c1
-
-abcd
-1234
-         a4 b4 c4 d4
-      a3 b3 c3 d3
-   a2 b2 c2 d2
-a1 b1 c1 d1
-
-abcde
-01234
-               a5 b5 c5 d5 e5
-            a4 b4 c4 d4 e4
-         a3 b3 c3 d3 e3
-      a2 b2 c2 d2 e2
-   a1 b1 c1 d1 e1
-a0 b0 c0 d0 e0
diff --git a/src/lib/libcrypto/bn/old/bn_high.c b/src/lib/libcrypto/bn/old/bn_high.c
index 763bcb605b..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/bn_high.c
+++ b/src/lib/libcrypto/bn/old/bn_high.c
@@ -1,135 +0,0 @@
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-#undef BN_MUL_HIGH_DEBUG
-
-#ifdef BN_MUL_HIGH_DEBUG
-#define debug_BN_print(a,b,c) BN_print_fp(a,b); printf(c);
-#else
-#define debug_BN_print(a,b,c)
-#endif
-
-int BN_mul_high(BIGNUM *r,BIGNUM *a,BIGNUM *b,BIGNUM *low, int words);
-
-#undef t1
-#undef t2
-
-int BN_mul_high(BIGNUM *r, BIGNUM *a, BIGNUM *b, BIGNUM *low, int words)
-        {
-        int w2,borrow=0,full=0;
-        BIGNUM t1,t2,t3,h,ah,al,bh,bl,m,s0,s1;
-        BN_ULONG ul1,ul2;
-        
-        BN_mul(r,a,b);
-        BN_rshift(r,r,words*BN_BITS2);
-        return(1);
-
-        w2=(words+1)/2;
-
-#ifdef BN_MUL_HIGH_DEBUG
-fprintf(stdout,"words=%d w2=%d\n",words,w2);
-#endif
-debug_BN_print(stdout,a," a\n");
-debug_BN_print(stdout,b," b\n");
-debug_BN_print(stdout,low," low\n");
-        BN_init(&al); BN_init(&ah);
-        BN_init(&bl); BN_init(&bh);
-        BN_init(&t1); BN_init(&t2); BN_init(&t3);
-        BN_init(&s0); BN_init(&s1);
-        BN_init(&h); BN_init(&m);
-
-        bn_set_low (&al,a,w2);
-        bn_set_high(&ah,a,w2);
-        bn_set_low (&bl,b,w2);
-        bn_set_high(&bh,b,w2);
-
-        bn_set_low(&s0,low,w2);
-        bn_set_high(&s1,low,w2);
-
-debug_BN_print(stdout,&al," al\n");
-debug_BN_print(stdout,&ah," ah\n");
-debug_BN_print(stdout,&bl," bl\n");
-debug_BN_print(stdout,&bh," bh\n");
-debug_BN_print(stdout,&s0," s0\n");
-debug_BN_print(stdout,&s1," s1\n");
-
-        /* Calculate (al-ah)*(bh-bl) */
-        BN_sub(&t1,&al,&ah);
-        BN_sub(&t2,&bh,&bl);
-        BN_mul(&m,&t1,&t2);
-
-        /* Calculate ah*bh */
-        BN_mul(&h,&ah,&bh);
-
-        /* s0 == low(al*bl)
-         * s1 == low(ah*bh)+low((al-ah)*(bh-bl))+low(al*bl)+high(al*bl)
-         * We know s0 and s1 so the only unknown is high(al*bl)
-         * high(al*bl) == s1 - low(ah*bh+(al-ah)*(bh-bl)+s0)
-         */
-        BN_add(&m,&m,&h);
-        BN_add(&t2,&m,&s0);
-
-debug_BN_print(stdout,&t2," middle value\n");
-
-        /* Quick and dirty mask off of high words */
-        if (w2 < t2.top) t2.top=w2;
-#if 0
-        bn_set_low(&t3,&t2,w2);
-#endif
-
-debug_BN_print(stdout,&t2," low middle value\n");
-        BN_sub(&t1,&s1,&t2);
-
-        if (t1.neg)
-                {
-debug_BN_print(stdout,&t1," before\n");
-                BN_zero(&t2);
-                BN_set_bit(&t2,w2*BN_BITS2);
-                BN_add(&t1,&t2,&t1);
-                /* BN_mask_bits(&t1,w2*BN_BITS2); */
-                /* if (words < t1.top) t1.top=words; */
-debug_BN_print(stdout,&t1," after\n");
-                borrow=1;
-                }
-
-/* XXXXX SPEED THIS UP */
-        /* al*bl == high(al*bl)<<words+s0 */
-        BN_lshift(&t1,&t1,w2*BN_BITS2);
-        BN_add(&t1,&t1,&s0);
-        if (w2*2 < t1.top) t1.top=w2*2; /* This should not happen? */
-        
-        /* We now have
-         * al*bl                        - t1
-         * (al-ah)*(bh-bl)+ah*bh        - m
-         * ah*bh                        - h
-         */
-#if 0
-        BN_add(&m,&m,&t1);
-debug_BN_print(stdout,&t1," s10\n");
-debug_BN_print(stdout,&m," s21\n");
-debug_BN_print(stdout,&h," s32\n");
-        BN_lshift(&m,&m,w2*BN_BITS2);
-        BN_lshift(&h,&h,w2*2*BN_BITS2);
-        BN_add(r,&m,&t1);
-        BN_add(r,r,&h);
-        BN_rshift(r,r,w2*2*BN_BITS2);
-#else
-        BN_add(&m,&m,&t1);              /* Do a cmp then +1 if needed? */
-        bn_set_high(&t3,&t1,w2);
-        BN_add(&m,&m,&t3);
-        bn_set_high(&t3,&m,w2);
-        BN_add(r,&h,&t3);
-#endif
-
-#ifdef BN_MUL_HIGH_DEBUG
-printf("carry=%d\n",borrow);
-#endif
-debug_BN_print(stdout,r," ret\n");
-        BN_free(&t1); BN_free(&t2);
-        BN_free(&m); BN_free(&h);
-        return(1);
-        }
-
-
-
diff --git a/src/lib/libcrypto/bn/old/bn_ka.c b/src/lib/libcrypto/bn/old/bn_ka.c
index 378c94dc5a..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/bn_ka.c
+++ b/src/lib/libcrypto/bn/old/bn_ka.c
@@ -1,567 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <strings.h>
-#include "bn_lcl.h"
-
-/* r is 2*n2 words in size,
- * a and b are both n2 words in size.
- * n2 must be a power of 2.
- * We multiply and return the result.
- * t must be 2*n2 words in size
- * We calulate
- * a[0]*b[0]
- * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
- * a[1]*b[1]
- */
-void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
-             BN_ULONG *t)
-        {
-        int n=n2/2;
-        int neg,zero,c1,c2;
-        BN_ULONG ln,lo,*p;
-
-#ifdef BN_COUNT
-printf(" bn_mul_recursive %d * %d\n",n2,n2);
-#endif
-        if (n2 <= 8)
-                {
-                if (n2 == 8)
-                        bn_mul_comba8(r,a,b);
-                else
-                        bn_mul_normal(r,a,n2,b,n2);
-                return;
-                }
-
-        if (n2 < BN_MUL_RECURSIVE_SIZE_NORMAL)
-                {
-                /* This should not happen */
-                /*abort(); */
-                bn_mul_normal(r,a,n2,b,n2);
-                return;
-                }
-        /* r=(a[0]-a[1])*(b[1]-b[0]) */
-        c1=bn_cmp_words(a,&(a[n]),n);
-        c2=bn_cmp_words(&(b[n]),b,n);
-        zero=neg=0;
-        switch (c1*3+c2)
-                {
-        case -4:
-                bn_sub_words(t,      &(a[n]),a,      n); /* - */
-                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
-                break;
-        case -3:
-                zero=1;
-                break;
-        case -2:
-                bn_sub_words(t,      &(a[n]),a,      n); /* - */
-                bn_sub_words(&(t[n]),&(b[n]),b,      n); /* + */
-                neg=1;
-                break;
-        case -1:
-        case 0:
-        case 1:
-                zero=1;
-                break;
-        case 2:
-                bn_sub_words(t,      a,      &(a[n]),n); /* + */
-                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
-                neg=1;
-                break;
-        case 3:
-                zero=1;
-                break;
-        case 4:
-                bn_sub_words(t,      a,      &(a[n]),n);
-                bn_sub_words(&(t[n]),&(b[n]),b,      n);
-                break;
-                }
-
-        if (n == 8)
-                {
-                if (!zero)
-                        bn_mul_comba8(&(t[n2]),t,&(t[n]));
-                else
-                        memset(&(t[n2]),0,8*sizeof(BN_ULONG));
-                
-                bn_mul_comba8(r,a,b);
-                bn_mul_comba8(&(r[n2]),&(a[n]),&(b[n]));
-                }
-        else
-                {
-                p= &(t[n2*2]);
-                if (!zero)
-                        bn_mul_recursive(&(t[n2]),t,&(t[n]),n,p);
-                else
-                        memset(&(t[n2]),0,n*sizeof(BN_ULONG));
-                bn_mul_recursive(r,a,b,n,p);
-                bn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),n,p);
-                }
-
-        /* t[32] holds (a[0]-a[1])*(b[1]-b[0]), c1 is the sign
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         */
-
-        c1=bn_add_words(t,r,&(r[n2]),n2);
-
-        if (neg) /* if t[32] is negative */
-                {
-                c1-=bn_sub_words(&(t[n2]),t,&(t[n2]),n2);
-                }
-        else
-                {
-                /* Might have a carry */
-                c1+=bn_add_words(&(t[n2]),&(t[n2]),t,n2);
-                }
-
-        /* t[32] holds (a[0]-a[1])*(b[1]-b[0])+(a[0]*b[0])+(a[1]*b[1])
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         * c1 holds the carry bits
-         */
-        c1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);
-        if (c1)
-                {
-                p= &(r[n+n2]);
-                lo= *p;
-                ln=(lo+c1)&BN_MASK2;
-                *p=ln;
-
-                /* The overflow will stop before we over write
-                 * words we should not overwrite */
-                if (ln < c1)
-                        {
-                        do      {
-                                p++;
-                                lo= *p;
-                                ln=(lo+1)&BN_MASK2;
-                                *p=ln;
-                                } while (ln == 0);
-                        }
-                }
-        }
-
-/* n+tn is the word length
- * t needs to be n*4 is size, as does r */
-void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
-             int n, BN_ULONG *t)
-        {
-        int n2=n*2,i,j;
-        int c1;
-        BN_ULONG ln,lo,*p;
-
-#ifdef BN_COUNT
-printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
-#endif
-        if (n < 8)
-                {
-                i=tn+n;
-                bn_mul_normal(r,a,i,b,i);
-                return;
-                }
-
-        /* r=(a[0]-a[1])*(b[1]-b[0]) */
-        bn_sub_words(t,      a,      &(a[n]),n); /* + */
-        bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
-
-        if (n == 8)
-                {
-                bn_mul_comba8(&(t[n2]),t,&(t[n]));
-                bn_mul_comba8(r,a,b);
-                bn_mul_normal(&(r[n2]),&(a[n]),tn,&(b[n]),tn);
-                memset(&(r[n2+tn*2]),0,sizeof(BN_ULONG)*(n2-tn*2));
-                }
-        else
-                {
-                p= &(t[n2*2]);
-                bn_mul_recursive(&(t[n2]),t,&(t[n]),n,p);
-                bn_mul_recursive(r,a,b,n,p);
-                i=n/2;
-                /* If there is only a bottom half to the number,
-                 * just do it */
-                j=tn-i;
-                if (j == 0)
-                        {
-                        bn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),i,p);
-                        memset(&(r[n2+i*2]),0,sizeof(BN_ULONG)*(n2-i*2));
-                        }
-                else if (j > 0) /* eg, n == 16, i == 8 and tn == 11 */
-                                {
-                                bn_mul_part_recursive(&(r[n2]),&(a[n]),&(b[n]),
-                                        j,i,p);
-                                memset(&(r[n2+tn*2]),0,
-                                        sizeof(BN_ULONG)*(n2-tn*2));
-                                }
-                else /* (j < 0) eg, n == 16, i == 8 and tn == 5 */
-                        {
-                        memset(&(r[n2]),0,sizeof(BN_ULONG)*(tn*2));
-                        for (;;)
-                                {
-                                i/=2;
-                                if (i < tn)
-                                        {
-                                        bn_mul_part_recursive(&(r[n2]),
-                                                &(a[n]),&(b[n]),
-                                                tn-i,i,p);
-                                        break;
-                                        }
-                                else if (i == tn)
-                                        {
-                                        bn_mul_recursive(&(r[n2]),
-                                                &(a[n]),&(b[n]),
-                                                i,p);
-                                        break;
-                                        }
-                                }
-                        }
-                }
-
-        /* t[32] holds (a[0]-a[1])*(b[1]-b[0]), c1 is the sign
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         */
-
-        c1=bn_add_words(t,r,&(r[n2]),n2);
-        c1-=bn_sub_words(&(t[n2]),t,&(t[n2]),n2);
-
-        /* t[32] holds (a[0]-a[1])*(b[1]-b[0])+(a[0]*b[0])+(a[1]*b[1])
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         * c1 holds the carry bits
-         */
-        c1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);
-        if (c1)
-                {
-                p= &(r[n+n2]);
-                lo= *p;
-                ln=(lo+c1)&BN_MASK2;
-                *p=ln;
-
-                /* The overflow will stop before we over write
-                 * words we should not overwrite */
-                if (ln < c1)
-                        {
-                        do      {
-                                p++;
-                                lo= *p;
-                                ln=(lo+1)&BN_MASK2;
-                                *p=ln;
-                                } while (ln == 0);
-                        }
-                }
-        }
-
-/* r is 2*n words in size,
- * a and b are both n words in size.
- * n must be a power of 2.
- * We multiply and return the result.
- * t must be 2*n words in size
- * We calulate
- * a[0]*b[0]
- * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
- * a[1]*b[1]
- */
-void bn_sqr_recursive(BN_ULONG *r, BN_ULONG *a, int n2, BN_ULONG *t)
-        {
-        int n=n2/2;
-        int zero,c1;
-        BN_ULONG ln,lo,*p;
-
-#ifdef BN_COUNT
-printf(" bn_sqr_recursive %d * %d\n",n2,n2);
-#endif
-        if (n2 == 4)
-                {
-                bn_sqr_comba4(r,a);
-                return;
-                }
-        else if (n2 == 8)
-                {
-                bn_sqr_comba8(r,a);
-                return;
-                }
-        if (n2 < BN_SQR_RECURSIVE_SIZE_NORMAL)
-                {
-                bn_sqr_normal(r,a,n2,t);
-                return;
-                abort();
-                }
-        /* r=(a[0]-a[1])*(a[1]-a[0]) */
-        c1=bn_cmp_words(a,&(a[n]),n);
-        zero=0;
-        if (c1 > 0)
-                bn_sub_words(t,a,&(a[n]),n);
-        else if (c1 < 0)
-                bn_sub_words(t,&(a[n]),a,n);
-        else
-                zero=1;
-
-        /* The result will always be negative unless it is zero */
-
-        if (n == 8)
-                {
-                if (!zero)
-                        bn_sqr_comba8(&(t[n2]),t);
-                else
-                        memset(&(t[n2]),0,8*sizeof(BN_ULONG));
-                
-                bn_sqr_comba8(r,a);
-                bn_sqr_comba8(&(r[n2]),&(a[n]));
-                }
-        else
-                {
-                p= &(t[n2*2]);
-                if (!zero)
-                        bn_sqr_recursive(&(t[n2]),t,n,p);
-                else
-                        memset(&(t[n2]),0,n*sizeof(BN_ULONG));
-                bn_sqr_recursive(r,a,n,p);
-                bn_sqr_recursive(&(r[n2]),&(a[n]),n,p);
-                }
-
-        /* t[32] holds (a[0]-a[1])*(a[1]-a[0]), it is negative or zero
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         */
-
-        c1=bn_add_words(t,r,&(r[n2]),n2);
-
-        /* t[32] is negative */
-        c1-=bn_sub_words(&(t[n2]),t,&(t[n2]),n2);
-
-        /* t[32] holds (a[0]-a[1])*(a[1]-a[0])+(a[0]*a[0])+(a[1]*a[1])
-         * r[10] holds (a[0]*a[0])
-         * r[32] holds (a[1]*a[1])
-         * c1 holds the carry bits
-         */
-        c1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);
-        if (c1)
-                {
-                p= &(r[n+n2]);
-                lo= *p;
-                ln=(lo+c1)&BN_MASK2;
-                *p=ln;
-
-                /* The overflow will stop before we over write
-                 * words we should not overwrite */
-                if (ln < c1)
-                        {
-                        do      {
-                                p++;
-                                lo= *p;
-                                ln=(lo+1)&BN_MASK2;
-                                *p=ln;
-                                } while (ln == 0);
-                        }
-                }
-        }
-
-#if 1
-/* a and b must be the same size, which is n2.
- * r needs to be n2 words and t needs to be n2*2
- */
-void bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
-             BN_ULONG *t)
-        {
-        int n=n2/2;
-
-#ifdef BN_COUNT
-printf(" bn_mul_low_recursive %d * %d\n",n2,n2);
-#endif
-
-        bn_mul_recursive(r,a,b,n,&(t[0]));
-        if (n > BN_MUL_LOW_RECURSIVE_SIZE_NORMAL)
-                {
-                bn_mul_low_recursive(&(t[0]),&(a[0]),&(b[n]),n,&(t[n2]));
-                bn_add_words(&(r[n]),&(r[n]),&(t[0]),n);
-                bn_mul_low_recursive(&(t[0]),&(a[n]),&(b[0]),n,&(t[n2]));
-                bn_add_words(&(r[n]),&(r[n]),&(t[0]),n);
-                }
-        else
-                {
-                bn_mul_low_normal(&(t[0]),&(a[0]),&(b[n]),n);
-                bn_mul_low_normal(&(t[n]),&(a[n]),&(b[0]),n);
-                bn_add_words(&(r[n]),&(r[n]),&(t[0]),n);
-                bn_add_words(&(r[n]),&(r[n]),&(t[n]),n);
-                }
-        }
-
-/* a and b must be the same size, which is n2.
- * r needs to be n2 words and t needs to be n2*2
- * l is the low words of the output.
- * t needs to be n2*3
- */
-void bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2,
-             BN_ULONG *t)
-        {
-        int j,i,n,c1,c2;
-        int neg,oneg,zero;
-        BN_ULONG ll,lc,*lp,*mp;
-
-#ifdef BN_COUNT
-printf(" bn_mul_high %d * %d\n",n2,n2);
-#endif
-        n=(n2+1)/2;
-
-        /* Calculate (al-ah)*(bh-bl) */
-        neg=zero=0;
-        c1=bn_cmp_words(&(a[0]),&(a[n]),n);
-        c2=bn_cmp_words(&(b[n]),&(b[0]),n);
-        switch (c1*3+c2)
-                {
-        case -4:
-                bn_sub_words(&(r[0]),&(a[n]),&(a[0]),n);
-                bn_sub_words(&(r[n]),&(b[0]),&(b[n]),n);
-                break;
-        case -3:
-                zero=1;
-                break;
-        case -2:
-                bn_sub_words(&(r[0]),&(a[n]),&(a[0]),n);
-                bn_sub_words(&(r[n]),&(b[n]),&(b[0]),n);
-                neg=1;
-                break;
-        case -1:
-        case 0:
-        case 1:
-                zero=1;
-                break;
-        case 2:
-                bn_sub_words(&(r[0]),&(a[0]),&(a[n]),n);
-                bn_sub_words(&(r[n]),&(b[0]),&(b[n]),n);
-                neg=1;
-                break;
-        case 3:
-                zero=1;
-                break;
-        case 4:
-                bn_sub_words(&(r[0]),&(a[0]),&(a[n]),n);
-                bn_sub_words(&(r[n]),&(b[n]),&(b[0]),n);
-                break;
-                }
-                
-        oneg=neg;
-        /* t[10] = (a[0]-a[1])*(b[1]-b[0]) */
-        bn_mul_recursive(&(t[0]),&(r[0]),&(r[n]),n,&(t[n2]));
-        /* r[10] = (a[1]*b[1]) */
-        bn_mul_recursive(r,&(a[n]),&(b[n]),n,&(t[n2]));
-
-        /* s0 == low(al*bl)
-         * s1 == low(ah*bh)+low((al-ah)*(bh-bl))+low(al*bl)+high(al*bl)
-         * We know s0 and s1 so the only unknown is high(al*bl)
-         * high(al*bl) == s1 - low(ah*bh+s0+(al-ah)*(bh-bl))
-         * high(al*bl) == s1 - (r[0]+l[0]+t[0])
-         */
-        if (l != NULL)
-                {
-                lp= &(t[n2+n]);
-                c1=bn_add_words(lp,&(r[0]),&(l[0]),n);
-                }
-        else
-                {
-                c1=0;
-                lp= &(r[0]);
-                }
-
-        if (neg)
-                neg=bn_sub_words(&(t[n2]),lp,&(t[0]),n);
-        else
-                {
-                bn_add_words(&(t[n2]),lp,&(t[0]),n);
-                neg=0;
-                }
-
-        if (l != NULL)
-                {
-                bn_sub_words(&(t[n2+n]),&(l[n]),&(t[n2]),n);
-                }
-        else
-                {
-                lp= &(t[n2+n]);
-                mp= &(t[n2]);
-                for (i=0; i<n; i++)
-                        lp[i]=((~mp[i])+1)&BN_MASK2;
-                }
-
-        /* s[0] = low(al*bl)
-         * t[3] = high(al*bl)
-         * t[10] = (a[0]-a[1])*(b[1]-b[0]) neg is the sign
-         * r[10] = (a[1]*b[1])
-         */
-        /* R[10] = al*bl
-         * R[21] = al*bl + ah*bh + (a[0]-a[1])*(b[1]-b[0])
-         * R[32] = ah*bh
-         */
-        /* R[1]=t[3]+l[0]+r[0](+-)t[0] (have carry/borrow)
-         * R[2]=r[0]+t[3]+r[1](+-)t[1] (have carry/borrow)
-         * R[3]=r[1]+(carry/borrow)
-         */
-        if (l != NULL)
-                {
-                lp= &(t[n2]);
-                c1= bn_add_words(lp,&(t[n2+n]),&(l[0]),n);
-                }
-        else
-                {
-                lp= &(t[n2+n]);
-                c1=0;
-                }
-        c1+=bn_add_words(&(t[n2]),lp,  &(r[0]),n);
-        if (oneg)
-                c1-=bn_sub_words(&(t[n2]),&(t[n2]),&(t[0]),n);
-        else
-                c1+=bn_add_words(&(t[n2]),&(t[n2]),&(t[0]),n);
-
-        c2 =bn_add_words(&(r[0]),&(r[0]),&(t[n2+n]),n);
-        c2+=bn_add_words(&(r[0]),&(r[0]),&(r[n]),n);
-        if (oneg)
-                c2-=bn_sub_words(&(r[0]),&(r[0]),&(t[n]),n);
-        else
-                c2+=bn_add_words(&(r[0]),&(r[0]),&(t[n]),n);
-        
-        if (c1 != 0) /* Add starting at r[0], could be +ve or -ve */
-                {
-                i=0;
-                if (c1 > 0)
-                        {
-                        lc=c1;
-                        do      {
-                                ll=(r[i]+lc)&BN_MASK2;
-                                r[i++]=ll;
-                                lc=(lc > ll);
-                                } while (lc);
-                        }
-                else
-                        {
-                        lc= -c1;
-                        do      {
-                                ll=r[i];
-                                r[i++]=(ll-lc)&BN_MASK2;
-                                lc=(lc > ll);
-                                } while (lc);
-                        }
-                }
-        if (c2 != 0) /* Add starting at r[1] */
-                {
-                i=n;
-                if (c2 > 0)
-                        {
-                        lc=c2;
-                        do      {
-                                ll=(r[i]+lc)&BN_MASK2;
-                                r[i++]=ll;
-                                lc=(lc > ll);
-                                } while (lc);
-                        }
-                else
-                        {
-                        lc= -c2;
-                        do      {
-                                ll=r[i];
-                                r[i++]=(ll-lc)&BN_MASK2;
-                                lc=(lc > ll);
-                                } while (lc);
-                        }
-                }
-        }
-#endif
diff --git a/src/lib/libcrypto/bn/old/bn_low.c b/src/lib/libcrypto/bn/old/bn_low.c
index cbc406751c..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/bn_low.c
+++ b/src/lib/libcrypto/bn/old/bn_low.c
@@ -1,194 +0,0 @@
-/* crypto/bn/bn_mul.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-static int bn_mm_low(BIGNUM *m,BIGNUM *A,BIGNUM *B, int num,
-                BIGNUM *sk,BN_CTX *ctx);
-int BN_mul_low(BIGNUM *r, BIGNUM *a, BIGNUM *b,int words);
-
-/* r must be different to a and b */
-int BN_mul_low(BIGNUM *r, BIGNUM *a, BIGNUM *b, int num)
-        {
-        BN_ULONG *ap,*bp,*rp;
-        BIGNUM *sk;
-        int j,i,n,ret;
-        int max,al,bl;
-        BN_CTX ctx;
-
-        bn_check_top(a);
-        bn_check_top(b);
-
-#ifdef BN_MUL_DEBUG
-printf("BN_mul_low(%d,%d,%d)\n",a->top,b->top,num);
-#endif
-
-        al=a->top;
-        bl=b->top;
-        if ((al == 0) || (bl == 0))
-                {
-                r->top=0;
-                return(1);
-                }
-
-        if ((bn_limit_bits_low > 0) && (num > bn_limit_num_low))
-                {
-                n=BN_num_bits_word(num*2)-bn_limit_bits_low;
-                n*=2;
-                sk=(BIGNUM *)Malloc(sizeof(BIGNUM)*n);
-                memset(sk,0,sizeof(BIGNUM)*n);
-                memset(&ctx,0,sizeof(ctx));
-
-                ret=bn_mm_low(r,a,b,num,&(sk[0]),&ctx);
-                for (i=0; i<n; i+=2)
-                        {
-                        BN_clear_free(&sk[i]);
-                        BN_clear_free(&sk[i+1]);
-                        }
-                Free(sk);
-                return(ret);
-                }
-
-        max=(al+bl);
-        if (bn_wexpand(r,max) == NULL) return(0);
-        r->neg=a->neg^b->neg;
-        ap=a->d;
-        bp=b->d;
-        rp=r->d;
-        r->top=(max > num)?num:max;
-
-        rp[al]=bn_mul_words(rp,ap,al,*(bp++));
-        rp++;
-        j=bl;
-        for (i=1; i<j; i++)
-                {
-                if (al >= num--)
-                        {
-                        al--;
-                        if (al <= 0) break;
-                        }
-                rp[al]=bn_mul_add_words(rp,ap,al,*(bp++));
-                rp++;
-                }
-        
-        while ((r->top > 0) && (r->d[r->top-1] == 0))
-                r->top--;
-        return(1);
-        }
-
-
-#define t1      (sk[0])
-#define t2      (sk[1])
-
-/* r must be different to a and b */
-int bn_mm_low(BIGNUM *m, BIGNUM *A, BIGNUM *B, int num, BIGNUM *sk,
-             BN_CTX *ctx)
-        {
-        int n; /* ,sqr=0; */
-        int an,bn;
-        BIGNUM ah,al,bh,bl;
-
-        bn_wexpand(m,num+3);
-        an=A->top;
-        bn=B->top;
-
-#ifdef BN_MUL_DEBUG
-printf("bn_mm_low(%d,%d,%d)\n",A->top,B->top,num);
-#endif
-
-        n=(num+1)/2;
-
-        BN_init(&ah); BN_init(&al); BN_init(&bh); BN_init(&bl);
-
-        bn_set_low( &al,A,n);
-        bn_set_high(&ah,A,n);
-        bn_set_low( &bl,B,n);
-        bn_set_high(&bh,B,n);
-
-        if (num <= (bn_limit_num_low+bn_limit_num_low))
-                {
-                BN_mul(m,&al,&bl);
-                BN_mul_low(&t1,&al,&bh,n);
-                BN_mul_low(&t2,&ah,&bl,n);
-                }
-        else
-                {
-                bn_mm(m  ,&al,&bl,&(sk[2]),ctx);
-                bn_mm_low(&t1,&al,&bh,n,&(sk[2]),ctx);
-                bn_mm_low(&t2,&ah,&bl,n,&(sk[2]),ctx);
-                }
-
-        BN_add(&t1,&t1,&t2);
-
-        /* We will now do an evil hack instead of
-         * BN_lshift(&t1,&t1,n*BN_BITS2);
-         * BN_add(m,m,&t1);
-         * BN_mask_bits(m,num*BN_BITS2);
-         */
-        bn_set_high(&ah,m,n); ah.max=num+2;
-        BN_add(&ah,&ah,&t1);
-        m->top=num;
-
-        m->neg=A->neg^B->neg;
-        return(1);
-        }
-
-#undef t1       (sk[0])
-#undef t2       (sk[1])
diff --git a/src/lib/libcrypto/bn/old/bn_m.c b/src/lib/libcrypto/bn/old/bn_m.c
index 522beb02bc..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/bn_m.c
+++ b/src/lib/libcrypto/bn/old/bn_m.c
@@ -1,139 +0,0 @@
-/* crypto/bn/bn_m.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-/*#include "cryptlib.h"*/
-#include "bn_lcl.h"
-
-#define limit_bits 5                    /* 2^5, or 32 words */
-#define limit_num (1<<limit_bits)
-
-int BN_m(BIGNUM *r, BIGNUM *a, BIGNUM *b)
-        {
-        BIGNUM *sk;
-        int i,n;
-
-        n=(BN_num_bits_word(a->top|b->top)-limit_bits);
-        n*=2;
-        sk=(BIGNUM *)malloc(sizeof(BIGNUM)*n);
-        for (i=0; i<n; i++)
-                BN_init(&(sk[i]));
-
-        return(BN_mm(r,a,b,&(sk[0])));
-        }
-
-#define ahal    (sk[0])
-#define blbh    (sk[1])
-
-/* r must be different to a and b */
-int BN_mm(BIGNUM *m, BIGNUM *A, BIGNUM *B, BIGNUM *sk)
-        {
-        int i,num,anum,bnum;
-        int an,bn;
-        BIGNUM ah,al,bh,bl;
-
-        an=A->top;
-        bn=B->top;
-        if ((an <= limit_num) || (bn <= limit_num))
-                {
-                return(BN_mul(m,A,B));
-                }
-
-        anum=(an>bn)?an:bn;
-        num=(anum)/2;
-
-        /* Are going to now chop things into 'num' word chunks. */
-        bnum=num*BN_BITS2;
-
-        BN_init(&ahal);
-        BN_init(&blbh);
-        BN_init(&ah);
-        BN_init(&al);
-        BN_init(&bh);
-        BN_init(&bl);
-
-        al.top=num;
-        al.d=A->d;
-        ah.top=A->top-num;
-        ah.d= &(A->d[num]);
-
-        bl.top=num;
-        bl.d=B->d;
-        bh.top=B->top-num;
-        bh.d= &(B->d[num]);
-
-        BN_sub(&ahal,&ah,&al);
-        BN_sub(&blbh,&bl,&bh);
-
-        BN_mm(m,&ahal,&blbh,&(sk[2]));
-        BN_mm(&ahal,&al,&bl,&(sk[2]));
-        BN_mm(&blbh,&ah,&bh,&(sk[2]));
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        BN_lshift(m,m,bnum);
-        BN_add(m,m,&ahal);
-
-        BN_lshift(&blbh,&blbh,bnum*2);
-        BN_add(m,m,&blbh);
-
-        m->neg=A->neg^B->neg;
-        return(1);
-        }
-
diff --git a/src/lib/libcrypto/bn/old/bn_mul.c.works b/src/lib/libcrypto/bn/old/bn_mul.c.works
index 6d565d44a2..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/bn_mul.c.works
+++ b/src/lib/libcrypto/bn/old/bn_mul.c.works
@@ -1,219 +0,0 @@
-/* crypto/bn/bn_mul.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-int bn_mm(BIGNUM *m,BIGNUM *A,BIGNUM *B, BIGNUM *sk,BN_CTX *ctx);
-
-/* r must be different to a and b */
-int BN_mul(r, a, b)
-BIGNUM *r;
-BIGNUM *a;
-BIGNUM *b;
-        {
-        BN_ULONG *ap,*bp,*rp;
-        BIGNUM *sk;
-        int i,n,ret;
-        int max,al,bl;
-        BN_CTX ctx;
-
-        bn_check_top(a);
-        bn_check_top(b);
-
-        al=a->top;
-        bl=b->top;
-        if ((al == 0) || (bl == 0))
-                {
-                r->top=0;
-                return(1);
-                }
-#ifdef BN_MUL_DEBUG
-printf("BN_mul(%d,%d)\n",a->top,b->top);
-#endif
-
-#ifdef BN_RECURSION
-        if (    (bn_limit_bits > 0) &&
-                (bl > bn_limit_num) && (al > bn_limit_num))
-                {
-                n=(BN_num_bits_word(al|bl)-bn_limit_bits);
-                n*=2;
-                sk=(BIGNUM *)Malloc(sizeof(BIGNUM)*n);
-                memset(sk,0,sizeof(BIGNUM)*n);
-                memset(&ctx,0,sizeof(ctx));
-
-                ret=bn_mm(r,a,b,&(sk[0]),&ctx);
-                for (i=0; i<n; i+=2)
-                        {
-                        BN_clear_free(&sk[i]);
-                        BN_clear_free(&sk[i+1]);
-                        }
-                Free(sk);
-                return(ret);
-                }
-#endif
-
-        max=(al+bl);
-        if (bn_wexpand(r,max) == NULL) return(0);
-        r->top=max;
-        r->neg=a->neg^b->neg;
-        ap=a->d;
-        bp=b->d;
-        rp=r->d;
-
-#ifdef BN_RECURSION
-        if ((al == bl) && (al == 8))
-                {
-                bn_mul_comba8(rp,ap,bp);
-                }
-        else
-#endif
-                {
-                rp[al]=bn_mul_words(rp,ap,al,*(bp++));
-                rp++;
-                for (i=1; i<bl; i++)
-                        {
-                        rp[al]=bn_mul_add_words(rp,ap,al,*(bp++));
-                        rp++;
-                        }
-                }
-        if ((max > 0) && (r->d[max-1] == 0)) r->top--;
-        return(1);
-        }
-
-#ifdef BN_RECURSION
-
-#define ahal    (sk[0])
-#define blbh    (sk[1])
-
-/* r must be different to a and b */
-int bn_mm(m, A, B, sk,ctx)
-BIGNUM *m,*A,*B;
-BIGNUM *sk;
-BN_CTX *ctx;
-        {
-        int n,num,sqr=0;
-        int an,bn;
-        BIGNUM ah,al,bh,bl;
-
-        an=A->top;
-        bn=B->top;
-#ifdef BN_MUL_DEBUG
-printf("bn_mm(%d,%d)\n",A->top,B->top);
-#endif
-
-        if (A == B) sqr=1;
-        num=(an>bn)?an:bn;
-        n=(num+1)/2;
-        /* Are going to now chop things into 'num' word chunks. */
-
-        BN_init(&ah);
-        BN_init(&al);
-        BN_init(&bh);
-        BN_init(&bl);
-
-        bn_set_low (&al,A,n);
-        bn_set_high(&ah,A,n);
-        bn_set_low (&bl,B,n);
-        bn_set_high(&bh,B,n);
-
-        BN_sub(&ahal,&ah,&al);
-        BN_sub(&blbh,&bl,&bh);
-
-        if (num <= (bn_limit_num+bn_limit_num))
-                {
-                BN_mul(m,&ahal,&blbh);
-                if (sqr)
-                        {
-                        BN_sqr(&ahal,&al,ctx);
-                        BN_sqr(&blbh,&ah,ctx);
-                        }
-                else
-                        {
-                        BN_mul(&ahal,&al,&bl);
-                        BN_mul(&blbh,&ah,&bh);
-                        }
-                }
-        else
-                {
-                bn_mm(m,&ahal,&blbh,&(sk[2]),ctx);
-                bn_mm(&ahal,&al,&bl,&(sk[2]),ctx);
-                bn_mm(&blbh,&ah,&bh,&(sk[2]),ctx);
-                }
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        BN_lshift(m,m,n*BN_BITS2);
-        BN_lshift(&blbh,&blbh,n*BN_BITS2*2);
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        m->neg=A->neg^B->neg;
-        return(1);
-        }
-#undef ahal     (sk[0])
-#undef blbh     (sk[1])
-
-#include "bn_low.c"
-#include "bn_high.c"
-#include "f.c"
-
-#endif
diff --git a/src/lib/libcrypto/bn/old/bn_wmul.c b/src/lib/libcrypto/bn/old/bn_wmul.c
index a467b2f17a..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/bn_wmul.c
+++ b/src/lib/libcrypto/bn/old/bn_wmul.c
@@ -1,173 +0,0 @@
-#include <stdio.h>
-#include "bn_lcl.h"
-
-#if 1
-
-int bn_mull(BIGNUM *r,BIGNUM *a,BIGNUM *b, BN_CTX *ctx);
-
-int bn_mull(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
-        {
-        int top,i,j,k,al,bl;
-        BIGNUM *t;
-
-#ifdef BN_COUNT
-printf("bn_mull %d * %d\n",a->top,b->top);
-#endif
-
-        bn_check_top(a);
-        bn_check_top(b);
-        bn_check_top(r);
-
-        al=a->top;
-        bl=b->top;
-        r->neg=a->neg^b->neg;
-
-        top=al+bl;
-        if ((al < 4) || (bl < 4))
-                {
-                if (bn_wexpand(r,top) == NULL) return(0);
-                r->top=top;
-                bn_mul_normal(r->d,a->d,al,b->d,bl);
-                goto end;
-                }
-        else if (al == bl) /* A good start, they are the same size */
-                goto symetric;
-        else
-                {
-                i=(al-bl);
-                if ((i ==  1) && !BN_get_flags(b,BN_FLG_STATIC_DATA))
-                        {
-                        bn_wexpand(b,al);
-                        b->d[bl]=0;
-                        bl++;
-                        goto symetric;
-                        }
-                else if ((i ==  -1) && !BN_get_flags(a,BN_FLG_STATIC_DATA))
-                        {
-                        bn_wexpand(a,bl);
-                        a->d[al]=0;
-                        al++;
-                        goto symetric;
-                        }
-                }
-
-        /* asymetric and >= 4 */ 
-        if (bn_wexpand(r,top) == NULL) return(0);
-        r->top=top;
-        bn_mul_normal(r->d,a->d,al,b->d,bl);
-
-        if (0)
-                {
-                /* symetric and > 4 */
-symetric:
-                if (al == 4)
-                        {
-                        if (bn_wexpand(r,al*2) == NULL) return(0);
-                        r->top=top;
-                        bn_mul_comba4(r->d,a->d,b->d);
-                        goto end;
-                        }
-                if (al == 8)
-                        {
-                        if (bn_wexpand(r,al*2) == NULL) return(0);
-                        r->top=top;
-                        bn_mul_comba8(r->d,a->d,b->d);
-                        goto end;
-                        }
-                if (al <= BN_MULL_NORMAL_SIZE)
-                        {
-                        if (bn_wexpand(r,al*2) == NULL) return(0);
-                        r->top=top;
-                        bn_mul_normal(r->d,a->d,al,b->d,bl);
-                        goto end;
-                        }
-                /* 16 or larger */
-                j=BN_num_bits_word((BN_ULONG)al);
-                j=1<<(j-1);
-                k=j+j;
-                t= &(ctx->bn[ctx->tos]);
-                if (al == j) /* exact multiple */
-                        {
-                        bn_wexpand(t,k*2);
-                        bn_wexpand(r,k*2);
-                        bn_mul_recursive(r->d,a->d,b->d,al,t->d);
-                        }
-                else
-                        {
-                        bn_wexpand(a,k);
-                        bn_wexpand(b,k);
-                        bn_wexpand(t,k*4);
-                        bn_wexpand(r,k*4);
-                        for (i=a->top; i<k; i++)
-                                a->d[i]=0;
-                        for (i=b->top; i<k; i++)
-                                b->d[i]=0;
-                        bn_mul_part_recursive(r->d,a->d,b->d,al-j,j,t->d);
-                        }
-                r->top=top;
-                }
-end:
-        bn_fix_top(r);
-        return(1);
-        }
-#endif
-
-void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
-        {
-        BN_ULONG *rr;
-
-#ifdef BN_COUNT
-printf(" bn_mul_normal %d * %d\n",na,nb);
-#endif
-
-        if (na < nb)
-                {
-                int itmp;
-                BN_ULONG *ltmp;
-
-                itmp=na; na=nb; nb=itmp;
-                ltmp=a;   a=b;   b=ltmp;
-
-                }
-        rr= &(r[na]);
-        rr[0]=bn_mul_words(r,a,na,b[0]);
-
-        for (;;)
-                {
-                if (--nb <= 0) return;
-                rr[1]=bn_mul_add_words(&(r[1]),a,na,b[1]);
-                if (--nb <= 0) return;
-                rr[2]=bn_mul_add_words(&(r[2]),a,na,b[2]);
-                if (--nb <= 0) return;
-                rr[3]=bn_mul_add_words(&(r[3]),a,na,b[3]);
-                if (--nb <= 0) return;
-                rr[4]=bn_mul_add_words(&(r[4]),a,na,b[4]);
-                rr+=4;
-                r+=4;
-                b+=4;
-                }
-        }
-
-#if 1
-void bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
-        {
-#ifdef BN_COUNT
-printf(" bn_mul_low_normal %d * %d\n",n,n);
-#endif
-        bn_mul_words(r,a,n,b[0]);
-
-        for (;;)
-                {
-                if (--n <= 0) return;
-                bn_mul_add_words(&(r[1]),a,n,b[1]);
-                if (--n <= 0) return;
-                bn_mul_add_words(&(r[2]),a,n,b[2]);
-                if (--n <= 0) return;
-                bn_mul_add_words(&(r[3]),a,n,b[3]);
-                if (--n <= 0) return;
-                bn_mul_add_words(&(r[4]),a,n,b[4]);
-                r+=4;
-                b+=4;
-                }
-        }
-#endif
diff --git a/src/lib/libcrypto/bn/old/build b/src/lib/libcrypto/bn/old/build
index 8cd99e5f17..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/build
+++ b/src/lib/libcrypto/bn/old/build
@@ -1,3 +0,0 @@
-#!/bin/sh -x
-
-gcc -g -I../../include test.c -L../.. -lcrypto
diff --git a/src/lib/libcrypto/bn/old/info b/src/lib/libcrypto/bn/old/info
index 5ac99c3b23..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/info
+++ b/src/lib/libcrypto/bn/old/info
@@ -1,22 +0,0 @@
-Given A1A0 * B1B0 == S3S2S1S0
-
-S0=     low(A0*B0)
-S1=     low( (A1-A0)*(B0-B1)) +low( A1*B1) +high(A0*B0)
-S2=     high((A1-A0)*(B0-B1)) +high(A1*B1) +low( A1*B1)
-S3=     high(A1*B1);
-
-Assume we know S1 and S0, and can calulate A1*B1 and high((A1-A0)*(B0-B1))
-
-k0=     S0 == low(A0*B0)
-k1=     S1
-k2=     low( A1*B1)
-k3=     high(A1*B1)
-k4=     high((A1-A0)*(B0-B1))
-
-k1=     low((A1-A0)*(B0-B1)) +k2 +high(A0*B0)
-S2=     k4 +k3 +k2
-S3=     k3
-
-S1-k2= low((A1-A0)*(B0-B1)) +high(A0*B0)
-
-We potentially have a carry or a borrow from S1
diff --git a/src/lib/libcrypto/bn/old/test.works b/src/lib/libcrypto/bn/old/test.works
index 127c7b415d..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/old/test.works
+++ b/src/lib/libcrypto/bn/old/test.works
@@ -1,205 +0,0 @@
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-#define SIZE    128
-
-#define BN_MONT_CTX_set         bn_mcs
-#define BN_from_montgomery      bn_fm
-#define BN_mod_mul_montgomery   bn_mmm
-#undef BN_to_montgomery
-#define BN_to_montgomery(r,a,mont,ctx)  bn_mmm(\
-        r,a,(mont)->RR,(mont),ctx)
-
-main()
-        {
-        BIGNUM prime,a,b,r,A,B,R;
-        BN_MONT_CTX *mont;
-        BN_CTX *ctx;
-        int i;
-
-        ctx=BN_CTX_new();
-        BN_init(&prime);
-        BN_init(&a); BN_init(&b); BN_init(&r);
-        BN_init(&A); BN_init(&B); BN_init(&R);
-
-        BN_generate_prime(&prime,SIZE,0,NULL,NULL,NULL,NULL);
-        BN_rand(&A,SIZE,1,0);
-        BN_rand(&B,SIZE,1,0);
-        BN_mod(&A,&A,&prime,ctx);
-        BN_mod(&B,&B,&prime,ctx);
-
-        mont=BN_MONT_CTX_new();
-        BN_MONT_CTX_set(mont,&prime,ctx);
-
-        BN_to_montgomery(&a,&A,mont,ctx);
-        BN_to_montgomery(&b,&B,mont,ctx);
-
-        BN_mul(&r,&a,&b);
-        BN_print_fp(stdout,&r); printf("\n");
-        BN_from_montgomery(&r,&r,mont,ctx);
-        BN_print_fp(stdout,&r); printf("\n");
-        BN_from_montgomery(&r,&r,mont,ctx);
-        BN_print_fp(stdout,&r); printf("\n");
-
-        BN_mod_mul(&R,&A,&B,&prime,ctx);
-
-        BN_print_fp(stdout,&a); printf("\n");
-        BN_print_fp(stdout,&b); printf("\n");
-        BN_print_fp(stdout,&prime); printf("\n");
-        BN_print_fp(stdout,&r); printf("\n\n");
-
-        BN_print_fp(stdout,&A); printf("\n");
-        BN_print_fp(stdout,&B); printf("\n");
-        BN_print_fp(stdout,&prime); printf("\n");
-        BN_print_fp(stdout,&R); printf("\n\n");
-
-        BN_mul(&r,&a,&b);
-        BN_print_fp(stdout,&r); printf(" <- BA*DC\n");
-        BN_copy(&A,&r);
-        i=SIZE/2;
-        BN_mask_bits(&A,i*2);
-//      BN_print_fp(stdout,&A); printf(" <- low(BA*DC)\n");
-        bn_do_lower(&r,&a,&b,&A,i);
-//      BN_print_fp(stdout,&r); printf(" <- low(BA*DC)\n");
-        }
-
-int bn_mul_low(r,a,b,low,i)
-BIGNUM *r,*a,*b,*low;
-int i;
-        {
-        int w;
-        BIGNUM Kh,Km,t1,t2,h,ah,al,bh,bl,l,m,s0,s1;
-
-        BN_init(&Kh); BN_init(&Km); BN_init(&t1); BN_init(&t2); BN_init(&l);
-        BN_init(&ah); BN_init(&al); BN_init(&bh); BN_init(&bl); BN_init(&h);
-        BN_init(&m); BN_init(&s0); BN_init(&s1);
-
-        BN_copy(&al,a); BN_mask_bits(&al,i); BN_rshift(&ah,a,i);
-        BN_copy(&bl,b); BN_mask_bits(&bl,i); BN_rshift(&bh,b,i);
-
-
-        BN_sub(&t1,&al,&ah);
-        BN_sub(&t2,&bh,&bl);
-        BN_mul(&m,&t1,&t2);
-        BN_mul(&h,&ah,&bh);
-
-        BN_copy(&s0,low); BN_mask_bits(&s0,i);
-        BN_rshift(&s1,low,i);
-
-        BN_add(&t1,&h,&m);
-        BN_add(&t1,&t1,&s0);
-
-        BN_copy(&t2,&t1); BN_mask_bits(&t2,i);
-        BN_sub(&t1,&s1,&t2);
-        BN_lshift(&t1,&t1,i);
-        BN_add(&t1,&t1,&s0);
-        if (t1.neg)
-                {
-                BN_lshift(&t2,BN_value_one(),i*2);
-                BN_add(&t1,&t2,&t1);
-                BN_mask_bits(&t1,i*2);
-                }
-        
-        BN_free(&Kh); BN_free(&Km); BN_free(&t1); BN_free(&t2);
-        BN_free(&ah); BN_free(&al); BN_free(&bh); BN_free(&bl);
-        }
-
-int BN_mod_mul_montgomery(r,a,b,mont,ctx)
-BIGNUM *r,*a,*b;
-BN_MONT_CTX *mont;
-BN_CTX *ctx;
-        {
-        BIGNUM *tmp;
-
-        tmp= &(ctx->bn[ctx->tos++]);
-
-        if (a == b)
-                {
-                if (!BN_sqr(tmp,a,ctx)) goto err;
-                }
-        else
-                {
-                if (!BN_mul(tmp,a,b)) goto err;
-                }
-        /* reduce from aRR to aR */
-        if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
-        ctx->tos--;
-        return(1);
-err:
-        return(0);
-        }
-
-int BN_from_montgomery(r,a,mont,ctx)
-BIGNUM *r;
-BIGNUM *a;
-BN_MONT_CTX *mont;
-BN_CTX *ctx;
-        {
-        BIGNUM z1;
-        BIGNUM *t1,*t2;
-        BN_ULONG *ap,*bp,*rp;
-        int j,i,bl,al;
-
-        BN_init(&z1);
-        t1= &(ctx->bn[ctx->tos]);
-        t2= &(ctx->bn[ctx->tos+1]);
-
-        if (!BN_copy(t1,a)) goto err;
-        /* can cheat */
-        BN_mask_bits(t1,mont->ri);
-        if (!BN_mul(t2,t1,mont->Ni)) goto err;
-        BN_mask_bits(t2,mont->ri);
-
-        if (!BN_mul(t1,t2,mont->N)) goto err;
-        if (!BN_add(t2,t1,a)) goto err;
-
-        /* At this point, t2 has the bottom ri bits set to zero.
-         * This means that the bottom ri bits == the 1^ri minus the bottom
-         * ri bits of a.
-         * This means that only the bits above 'ri' in a need to be added,
-         * and XXXXXXXXXXXXXXXXXXXXXXXX
-         */
-BN_print_fp(stdout,t2); printf("\n");
-        BN_rshift(r,t2,mont->ri);
-
-        if (BN_ucmp(r,mont->N) >= 0)
-                bn_qsub(r,r,mont->N);
-
-        return(1);
-err:
-        return(0);
-        }
-
-int BN_MONT_CTX_set(mont,mod,ctx)
-BN_MONT_CTX *mont;
-BIGNUM *mod;
-BN_CTX *ctx;
-        {
-        BIGNUM *Ri=NULL,*R=NULL;
-
-        if (mont->RR == NULL) mont->RR=BN_new();
-        if (mont->N == NULL)  mont->N=BN_new();
-
-        R=mont->RR;                                     /* grab RR as a temp */
-        BN_copy(mont->N,mod);                           /* Set N */
-
-        mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
-        BN_lshift(R,BN_value_one(),mont->ri);                   /* R */
-        if ((Ri=BN_mod_inverse(NULL,R,mod,ctx)) == NULL) goto err;/* Ri */
-        BN_lshift(Ri,Ri,mont->ri);                              /* R*Ri */
-        bn_qsub(Ri,Ri,BN_value_one());                          /* R*Ri - 1 */
-        BN_div(Ri,NULL,Ri,mod,ctx);
-        if (mont->Ni != NULL) BN_free(mont->Ni);
-        mont->Ni=Ri;                                    /* Ni=(R*Ri-1)/N */
-
-        /* setup RR for conversions */
-        BN_lshift(mont->RR,BN_value_one(),mont->ri*2);
-        BN_mod(mont->RR,mont->RR,mont->N,ctx);
-
-        return(1);
-err:
-        return(0);
-        }
-
-
diff --git a/src/lib/libcrypto/bn/test.c b/src/lib/libcrypto/bn/test.c
index a048b9f878..e69de29bb2 100644
--- a/src/lib/libcrypto/bn/test.c
+++ b/src/lib/libcrypto/bn/test.c
@@ -1,241 +0,0 @@
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-#define SIZE    32
-
-#define BN_MONT_CTX_set         bn_mcs
-#define BN_from_montgomery      bn_fm
-#define BN_mod_mul_montgomery   bn_mmm
-#undef BN_to_montgomery
-#define BN_to_montgomery(r,a,mont,ctx)  bn_mmm(\
-        r,a,(mont)->RR,(mont),ctx)
-
-main()
-        {
-        BIGNUM prime,a,b,r,A,B,R;
-        BN_MONT_CTX *mont;
-        BN_CTX *ctx;
-        int i;
-
-        ctx=BN_CTX_new();
-        BN_init(&prime);
-        BN_init(&a); BN_init(&b); BN_init(&r);
-        BN_init(&A); BN_init(&B); BN_init(&R);
-
-        BN_generate_prime(&prime,SIZE,0,NULL,NULL,NULL,NULL);
-        BN_rand(&A,SIZE,1,0);
-        BN_rand(&B,SIZE,1,0);
-        BN_mod(&A,&A,&prime,ctx);
-        BN_mod(&B,&B,&prime,ctx);
-
-        i=A.top;
-        BN_mul(&R,&A,&B,ctx);
-        BN_mask_bits(&R,i*BN_BITS2);
-
-
-        BN_print_fp(stdout,&A); printf(" <- a\n");
-        BN_print_fp(stdout,&B); printf(" <- b\n");
-        BN_mul_high(&r,&A,&B,&R,i);
-        BN_print_fp(stdout,&r); printf(" <- high(BA*DC)\n");
-
-        BN_mask_bits(&A,i*32);
-        BN_mask_bits(&B,i*32);
-
-        BN_mul(&R,&A,&B);
-        BN_rshift(&R,&R,i*32);
-        BN_print_fp(stdout,&R); printf(" <- norm BA*DC\n");
-        BN_sub(&R,&R,&r);
-        BN_print_fp(stdout,&R); printf(" <- diff\n");
-        }
-
-#if 0
-int bn_mul_high(BIGNUM *r, BIGNUM *a, BIGNUM *b, BIGNUM *low, int words)
-        {
-        int i;
-        BIGNUM t1,t2,t3,h,ah,al,bh,bl,m,s0,s1;
-
-        BN_init(&al); BN_init(&ah);
-        BN_init(&bl); BN_init(&bh);
-        BN_init(&t1); BN_init(&t2); BN_init(&t3);
-        BN_init(&s0); BN_init(&s1);
-        BN_init(&h); BN_init(&m);
-
-        i=a->top;
-        if (i >= words)
-                {
-                al.top=words;
-                ah.top=a->top-words;
-                ah.d= &(a->d[ah.top]);
-                }
-        else
-                al.top=i;
-        al.d=a->d;
-
-        i=b->top;
-        if (i >= words)
-                {
-                bl.top=words;
-                bh.top=i-words;
-                bh.d= &(b->d[bh.top]);
-                }
-        else
-                bl.top=i;
-        bl.d=b->d;
-
-        i=low->top;
-        if (i >= words)
-                {
-                s0.top=words;
-                s1.top=i-words;
-                s1.d= &(low->d[s1.top]);
-                }
-        else
-                s0.top=i;
-        s0.d=low->d;
-
-al.max=al.top; ah.max=ah.top;
-bl.max=bl.top; bh.max=bh.top;
-s0.max=bl.top; s1.max=bh.top;
-
-        /* Calculate (al-ah)*(bh-bl) */
-        BN_sub(&t1,&al,&ah);
-        BN_sub(&t2,&bh,&bl);
-        BN_mul(&m,&t1,&t2);
-
-        /* Calculate ah*bh */
-        BN_mul(&h,&ah,&bh);
-
-        /* s0 == low(al*bl)
-         * s1 == low(ah*bh)+low((al-ah)*(bh-bl))+low(al*bl)+high(al*bl)
-         * We know s0 and s1 so the only unknown is high(al*bl)
-         * high(al*bl) == s1 - low(ah*bh+(al-ah)*(bh-bl)+s0)
-         */
-        BN_add(&m,&m,&h);
-        BN_add(&t2,&m,&s0);
-        /* Quick and dirty mask off of high words */
-        t3.d=t2.d;
-        t3.top=(t2.top > words)?words:t2.top;
-        t3.neg=t2.neg;
-t3.max=t3.top;
-/* BN_print_fp(stdout,&s1); printf(" s1\n"); */
-/* BN_print_fp(stdout,&t2); printf(" middle value\n"); */
-/* BN_print_fp(stdout,&t3); printf(" low middle value\n"); */
-        BN_sub(&t1,&s1,&t3);
-
-        if (t1.neg)
-                {
-/*printf("neg fixup\n"); BN_print_fp(stdout,&t1); printf(" before\n"); */
-                BN_lshift(&t2,BN_value_one(),words*32);
-                BN_add(&t1,&t2,&t1);
-                BN_mask_bits(&t1,words*32);
-/* BN_print_fp(stdout,&t1); printf(" after\n"); */
-                }
-        /* al*bl == high(al*bl)<<words+s0 */
-        BN_lshift(&t1,&t1,words*32);
-        BN_add(&t1,&t1,&s0);
-        
-        /* We now have
-         * al*bl                        - t1
-         * (al-ah)*(bh-bl)+ah*bh        - m
-         * ah*bh                        - h
-         */
-        BN_copy(r,&t1);
-        BN_mask_bits(r,words*32*2);
-
-        /*BN_lshift(&m,&m,words*/
-
-        BN_free(&t1); BN_free(&t2);
-        BN_free(&m); BN_free(&h);
-        }
-
-int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_MONT_CTX *mont,
-             BN_CTX *ctx)
-        {
-        BIGNUM *tmp;
-
-        tmp= &(ctx->bn[ctx->tos++]);
-
-        if (a == b)
-                {
-                if (!BN_sqr(tmp,a,ctx)) goto err;
-                }
-        else
-                {
-                if (!BN_mul(tmp,a,b)) goto err;
-                }
-        /* reduce from aRR to aR */
-        if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
-        ctx->tos--;
-        return(1);
-err:
-        return(0);
-        }
-
-int BN_from_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont, BN_CTX *ctx)
-        {
-        BIGNUM z1;
-        BIGNUM *t1,*t2;
-        BN_ULONG *ap,*bp,*rp;
-        int j,i,bl,al;
-
-        BN_init(&z1);
-        t1= &(ctx->bn[ctx->tos]);
-        t2= &(ctx->bn[ctx->tos+1]);
-
-        if (!BN_copy(t1,a)) goto err;
-        /* can cheat */
-        BN_mask_bits(t1,mont->ri);
-        if (!BN_mul(t2,t1,mont->Ni)) goto err;
-        BN_mask_bits(t2,mont->ri);
-
-        if (!BN_mul(t1,t2,mont->N)) goto err;
-        if (!BN_add(t2,t1,a)) goto err;
-
-        /* At this point, t2 has the bottom ri bits set to zero.
-         * This means that the bottom ri bits == the 1^ri minus the bottom
-         * ri bits of a.
-         * This means that only the bits above 'ri' in a need to be added,
-         * and XXXXXXXXXXXXXXXXXXXXXXXX
-         */
-BN_print_fp(stdout,t2); printf("\n");
-        BN_rshift(r,t2,mont->ri);
-
-        if (BN_ucmp(r,mont->N) >= 0)
-                BN_usub(r,r,mont->N);
-
-        return(1);
-err:
-        return(0);
-        }
-
-int BN_MONT_CTX_set(BN_MONT_CTX *mont, BIGNUM *mod, BN_CTX *ctx)
-        {
-        BIGNUM *Ri=NULL,*R=NULL;
-
-        if (mont->RR == NULL) mont->RR=BN_new();
-        if (mont->N == NULL)  mont->N=BN_new();
-
-        R=mont->RR;                                     /* grab RR as a temp */
-        BN_copy(mont->N,mod);                           /* Set N */
-
-        mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
-        BN_lshift(R,BN_value_one(),mont->ri);                   /* R */
-        if ((Ri=BN_mod_inverse(NULL,R,mod,ctx)) == NULL) goto err;/* Ri */
-        BN_lshift(Ri,Ri,mont->ri);                              /* R*Ri */
-        BN_usub(Ri,Ri,BN_value_one());                          /* R*Ri - 1 */
-        BN_div(Ri,NULL,Ri,mod,ctx);
-        if (mont->Ni != NULL) BN_free(mont->Ni);
-        mont->Ni=Ri;                                    /* Ni=(R*Ri-1)/N */
-
-        /* setup RR for conversions */
-        BN_lshift(mont->RR,BN_value_one(),mont->ri*2);
-        BN_mod(mont->RR,mont->RR,mont->N,ctx);
-
-        return(1);
-err:
-        return(0);
-        }
-
-
-#endif
diff --git a/src/lib/libcrypto/buffer/Makefile.ssl b/src/lib/libcrypto/buffer/Makefile.ssl
index f23de89e33..506708c37f 100644
--- a/src/lib/libcrypto/buffer/Makefile.ssl
+++ b/src/lib/libcrypto/buffer/Makefile.ssl
@@ -83,4 +83,5 @@ buffer.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 buffer.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 buffer.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 buffer.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-buffer.o: ../../include/openssl/stack.h ../cryptlib.h
+buffer.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+buffer.o: ../cryptlib.h
diff --git a/src/lib/libcrypto/cast/c_ecb.c b/src/lib/libcrypto/cast/c_ecb.c
index 33182f2b71..0b3da9ad87 100644
--- a/src/lib/libcrypto/cast/c_ecb.c
+++ b/src/lib/libcrypto/cast/c_ecb.c
@@ -60,7 +60,7 @@
 #include "cast_lcl.h"
 #include <openssl/opensslv.h>
 
-char *CAST_version="CAST" OPENSSL_VERSION_PTEXT;
+const char *CAST_version="CAST" OPENSSL_VERSION_PTEXT;
 
 void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out,
                       CAST_KEY *ks, int enc)
diff --git a/src/lib/libcrypto/cast/cast_lcl.h b/src/lib/libcrypto/cast/cast_lcl.h
index 83cf382a91..cfe3842e91 100644
--- a/src/lib/libcrypto/cast/cast_lcl.h
+++ b/src/lib/libcrypto/cast/cast_lcl.h
@@ -216,11 +216,11 @@
         }
 #endif
 
-OPENSSL_EXTERN CAST_LONG CAST_S_table0[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table1[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table2[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table3[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table4[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table5[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table6[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table7[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table0[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table1[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table2[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table3[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table4[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table5[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table6[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table7[256];
diff --git a/src/lib/libcrypto/cast/cast_s.h b/src/lib/libcrypto/cast/cast_s.h
index 9af28972c5..c483fd5e43 100644
--- a/src/lib/libcrypto/cast/cast_s.h
+++ b/src/lib/libcrypto/cast/cast_s.h
@@ -55,7 +55,7 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
-OPENSSL_GLOBAL CAST_LONG CAST_S_table0[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table0[256]={
         0x30fb40d4,0x9fa0ff0b,0x6beccd2f,0x3f258c7a,
         0x1e213f2f,0x9c004dd3,0x6003e540,0xcf9fc949,
         0xbfd4af27,0x88bbbdb5,0xe2034090,0x98d09675,
@@ -121,7 +121,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table0[256]={
         0x1a69e783,0x02cc4843,0xa2f7c579,0x429ef47d,
         0x427b169c,0x5ac9f049,0xdd8f0f00,0x5c8165bf,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table1[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table1[256]={
         0x1f201094,0xef0ba75b,0x69e3cf7e,0x393f4380,
         0xfe61cf7a,0xeec5207a,0x55889c94,0x72fc0651,
         0xada7ef79,0x4e1d7235,0xd55a63ce,0xde0436ba,
@@ -187,7 +187,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table1[256]={
         0x43d79572,0x7e6dd07c,0x06dfdf1e,0x6c6cc4ef,
         0x7160a539,0x73bfbe70,0x83877605,0x4523ecf1,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table2[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table2[256]={
         0x8defc240,0x25fa5d9f,0xeb903dbf,0xe810c907,
         0x47607fff,0x369fe44b,0x8c1fc644,0xaececa90,
         0xbeb1f9bf,0xeefbcaea,0xe8cf1950,0x51df07ae,
@@ -253,7 +253,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table2[256]={
         0xf7baefd5,0x4142ed9c,0xa4315c11,0x83323ec5,
         0xdfef4636,0xa133c501,0xe9d3531c,0xee353783,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table3[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table3[256]={
         0x9db30420,0x1fb6e9de,0xa7be7bef,0xd273a298,
         0x4a4f7bdb,0x64ad8c57,0x85510443,0xfa020ed1,
         0x7e287aff,0xe60fb663,0x095f35a1,0x79ebf120,
@@ -319,7 +319,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table3[256]={
         0x7ae5290c,0x3cb9536b,0x851e20fe,0x9833557e,
         0x13ecf0b0,0xd3ffb372,0x3f85c5c1,0x0aef7ed2,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table4[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table4[256]={
         0x7ec90c04,0x2c6e74b9,0x9b0e66df,0xa6337911,
         0xb86a7fff,0x1dd358f5,0x44dd9d44,0x1731167f,
         0x08fbf1fa,0xe7f511cc,0xd2051b00,0x735aba00,
@@ -385,7 +385,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table4[256]={
         0xe822fe15,0x88570983,0x750e6249,0xda627e55,
         0x5e76ffa8,0xb1534546,0x6d47de08,0xefe9e7d4,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table5[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table5[256]={
         0xf6fa8f9d,0x2cac6ce1,0x4ca34867,0xe2337f7c,
         0x95db08e7,0x016843b4,0xeced5cbc,0x325553ac,
         0xbf9f0960,0xdfa1e2ed,0x83f0579d,0x63ed86b9,
@@ -451,7 +451,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table5[256]={
         0xa2d762cf,0x49c92f54,0x38b5f331,0x7128a454,
         0x48392905,0xa65b1db8,0x851c97bd,0xd675cf2f,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table6[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table6[256]={
         0x85e04019,0x332bf567,0x662dbfff,0xcfc65693,
         0x2a8d7f6f,0xab9bc912,0xde6008a1,0x2028da1f,
         0x0227bce7,0x4d642916,0x18fac300,0x50f18b82,
@@ -517,7 +517,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table6[256]={
         0x518f36b2,0x84b1d370,0x0fedce83,0x878ddada,
         0xf2a279c7,0x94e01be8,0x90716f4b,0x954b8aa3,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table7[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table7[256]={
         0xe216300d,0xbbddfffc,0xa7ebdabd,0x35648095,
         0x7789f8b7,0xe6c1121b,0x0e241600,0x052ce8b5,
         0x11a9cfb0,0xe5952f11,0xece7990a,0x9386d174,
diff --git a/src/lib/libcrypto/cast/cast_spd.c b/src/lib/libcrypto/cast/cast_spd.c
index c0726906c2..0af915cf20 100644
--- a/src/lib/libcrypto/cast/cast_spd.c
+++ b/src/lib/libcrypto/cast/cast_spd.c
@@ -183,7 +183,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libcrypto/cast/castopts.c b/src/lib/libcrypto/cast/castopts.c
index 642e9725af..c783796610 100644
--- a/src/lib/libcrypto/cast/castopts.c
+++ b/src/lib/libcrypto/cast/castopts.c
@@ -252,7 +252,7 @@ int main(int argc, char **argv)
                 }
 
 #ifndef TIMES
-        fprintf(stderr,"To get the most acurate results, try to run this\n");
+        fprintf(stderr,"To get the most accurate results, try to run this\n");
         fprintf(stderr,"program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libcrypto/cast/casttest.c b/src/lib/libcrypto/cast/casttest.c
index 3244b119e9..ab2aeac606 100644
--- a/src/lib/libcrypto/cast/casttest.c
+++ b/src/lib/libcrypto/cast/casttest.c
@@ -71,32 +71,32 @@ int main(int argc, char *argv[])
 
 #define FULL_TEST
 
-unsigned char k[16]={
+static unsigned char k[16]={
         0x01,0x23,0x45,0x67,0x12,0x34,0x56,0x78,
         0x23,0x45,0x67,0x89,0x34,0x56,0x78,0x9A
         };
 
-unsigned char in[8]={ 0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF};
+static unsigned char in[8]={ 0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF};
 
-int k_len[3]={16,10,5};
-unsigned char c[3][8]={
+static int k_len[3]={16,10,5};
+static unsigned char c[3][8]={
         {0x23,0x8B,0x4F,0xE5,0x84,0x7E,0x44,0xB2},
         {0xEB,0x6A,0x71,0x1A,0x2C,0x02,0x27,0x1B},
         {0x7A,0xC8,0x16,0xD1,0x6E,0x9B,0x30,0x2E},
         };
-unsigned char out[80];
+static unsigned char out[80];
 
-unsigned char in_a[16]={
+static unsigned char in_a[16]={
         0x01,0x23,0x45,0x67,0x12,0x34,0x56,0x78,
         0x23,0x45,0x67,0x89,0x34,0x56,0x78,0x9A};
-unsigned char in_b[16]={
+static unsigned char in_b[16]={
         0x01,0x23,0x45,0x67,0x12,0x34,0x56,0x78,
         0x23,0x45,0x67,0x89,0x34,0x56,0x78,0x9A};
 
-unsigned char c_a[16]={
+static unsigned char c_a[16]={
         0xEE,0xA9,0xD0,0xA2,0x49,0xFD,0x3B,0xA6,
         0xB3,0x43,0x6F,0xB8,0x9D,0x6D,0xCA,0x92};
-unsigned char c_b[16]={
+static unsigned char c_b[16]={
         0xB2,0xC9,0x5E,0xB0,0x0C,0x31,0xAD,0x71,
         0x80,0xAC,0x05,0xB8,0xE8,0x3D,0x69,0x6E};
 
diff --git a/src/lib/libcrypto/comp/comp.h b/src/lib/libcrypto/comp/comp.h
index 93bd9c34c8..811cb5833d 100644
--- a/src/lib/libcrypto/comp/comp.h
+++ b/src/lib/libcrypto/comp/comp.h
@@ -17,6 +17,7 @@ typedef struct comp_method_st
         int (*compress)();
         int (*expand)();
         long (*ctrl)();
+        long (*callback_ctrl)();
         } COMP_METHOD;
 
 typedef struct comp_ctx_st
diff --git a/src/lib/libcrypto/conf/conf.c b/src/lib/libcrypto/conf/conf.c
index 7d8b89168a..3031fa3b44 100644
--- a/src/lib/libcrypto/conf/conf.c
+++ b/src/lib/libcrypto/conf/conf.c
@@ -86,28 +86,25 @@ const char *CONF_version="CONF" OPENSSL_VERSION_PTEXT;
 LHASH *CONF_load(LHASH *h, const char *file, long *line)
         {
         LHASH *ltmp;
-        FILE *in=NULL;
+        BIO *in=NULL;
 
 #ifdef VMS
-        in=fopen(file,"r");
+        in=BIO_new_file(file, "r");
 #else
-        in=fopen(file,"rb");
+        in=BIO_new_file(file, "rb");
 #endif
         if (in == NULL)
                 {
-                SYSerr(SYS_F_FOPEN,get_last_sys_error());
-                ERR_set_error_data(BUF_strdup(file),
-                        ERR_TXT_MALLOCED|ERR_TXT_STRING);
                 CONFerr(CONF_F_CONF_LOAD,ERR_R_SYS_LIB);
                 return NULL;
                 }
 
-        ltmp = CONF_load_fp(h, in, line);
-        fclose(in);
+        ltmp = CONF_load_bio(h, in, line);
+        BIO_free(in);
 
         return ltmp;
 }
-
+#ifndef NO_FP_API
 LHASH *CONF_load_fp(LHASH *h, FILE *in, long *line)
 {
         BIO *btmp;
@@ -120,6 +117,7 @@ LHASH *CONF_load_fp(LHASH *h, FILE *in, long *line)
         BIO_free(btmp);
         return ltmp;
 }
+#endif
 
 LHASH *CONF_load_bio(LHASH *h, BIO *in, long *line)
         {
@@ -338,7 +336,7 @@ again:
                                                         ERR_R_MALLOC_FAILURE);
                                 goto err;
                                 }
-                        vv=(CONF_VALUE *)lh_insert(ret,(char *)v);
+                        vv=(CONF_VALUE *)lh_insert(ret,v);
                         if (vv != NULL)
                                 {
                                 sk_CONF_VALUE_delete_ptr(ts,vv);
@@ -380,7 +378,7 @@ char *CONF_get_string(LHASH *conf, char *section, char *name)
                         {
                         vv.name=name;
                         vv.section=section;
-                        v=(CONF_VALUE *)lh_retrieve(conf,(char *)&vv);
+                        v=(CONF_VALUE *)lh_retrieve(conf,&vv);
                         if (v != NULL) return(v->value);
                         if (strcmp(section,"ENV") == 0)
                                 {
@@ -390,7 +388,7 @@ char *CONF_get_string(LHASH *conf, char *section, char *name)
                         }
                 vv.section="default";
                 vv.name=name;
-                v=(CONF_VALUE *)lh_retrieve(conf,(char *)&vv);
+                v=(CONF_VALUE *)lh_retrieve(conf,&vv);
                 if (v != NULL)
                         return(v->value);
                 else
@@ -407,7 +405,7 @@ static CONF_VALUE *get_section(LHASH *conf, char *section)
         if ((conf == NULL) || (section == NULL)) return(NULL);
         vv.name=NULL;
         vv.section=section;
-        v=(CONF_VALUE *)lh_retrieve(conf,(char *)&vv);
+        v=(CONF_VALUE *)lh_retrieve(conf,&vv);
         return(v);
         }
 
@@ -445,12 +443,12 @@ void CONF_free(LHASH *conf)
 
         conf->down_load=0;      /* evil thing to make sure the 'Free()'
                                  * works as expected */
-        lh_doall_arg(conf,(void (*)())value_free_hash,(char *)conf);
+        lh_doall_arg(conf,(void (*)())value_free_hash,conf);
 
         /* We now have only 'section' entries in the hash table.
          * Due to problems with */
 
-        lh_doall_arg(conf,(void (*)())value_free_stack,(char *)conf);
+        lh_doall_arg(conf,(void (*)())value_free_stack,conf);
         lh_free(conf);
         }
 
@@ -458,7 +456,7 @@ static void value_free_hash(CONF_VALUE *a, LHASH *conf)
         {
         if (a->name != NULL)
                 {
-                a=(CONF_VALUE *)lh_delete(conf,(char *)a);
+                a=(CONF_VALUE *)lh_delete(conf,a);
                 }
         }
 
@@ -710,7 +708,7 @@ static CONF_VALUE *new_section(LHASH *conf, char *section)
         v->name=NULL;
         v->value=(char *)sk;
         
-        vv=(CONF_VALUE *)lh_insert(conf,(char *)v);
+        vv=(CONF_VALUE *)lh_insert(conf,v);
         if (vv != NULL)
                 {
 #if !defined(NO_STDIO) && !defined(WIN16)
diff --git a/src/lib/libcrypto/conf/conf.h b/src/lib/libcrypto/conf/conf.h
index e7c5150097..21831a92a3 100644
--- a/src/lib/libcrypto/conf/conf.h
+++ b/src/lib/libcrypto/conf/conf.h
@@ -78,7 +78,9 @@ typedef struct
 DECLARE_STACK_OF(CONF_VALUE)
 
 LHASH *CONF_load(LHASH *conf,const char *file,long *eline);
+#ifndef NO_FP_API
 LHASH *CONF_load_fp(LHASH *conf, FILE *fp,long *eline);
+#endif
 LHASH *CONF_load_bio(LHASH *conf, BIO *bp,long *eline);
 STACK_OF(CONF_VALUE) *CONF_get_section(LHASH *conf,char *section);
 char *CONF_get_string(LHASH *conf,char *group,char *name);
diff --git a/src/lib/libcrypto/cryptlib.c b/src/lib/libcrypto/cryptlib.c
index 356c476a99..a8f29f1e65 100644
--- a/src/lib/libcrypto/cryptlib.c
+++ b/src/lib/libcrypto/cryptlib.c
@@ -92,7 +92,9 @@ static const char* lock_names[CRYPTO_NUM_LOCKS] =
         "getservbyname",
         "readdir",
         "RSA_blinding",
-#if CRYPTO_NUM_LOCKS != 24
+        "dh",
+        "debug_malloc2",
+#if CRYPTO_NUM_LOCKS != 26
 # error "Inconsistency between crypto.h and cryptlib.c"
 #endif
         };
@@ -181,7 +183,7 @@ unsigned long CRYPTO_thread_id(void)
                 ret=(unsigned long)GetCurrentTask();
 #elif defined(WIN32)
                 ret=(unsigned long)GetCurrentThreadId();
-#elif defined(MSDOS)
+#elif defined(GETPID_IS_MEANINGLESS)
                 ret=1L;
 #else
                 ret=(unsigned long)getpid();
diff --git a/src/lib/libcrypto/crypto-lib.com b/src/lib/libcrypto/crypto-lib.com
index bf916528eb..79d86771e8 100644
--- a/src/lib/libcrypto/crypto-lib.com
+++ b/src/lib/libcrypto/crypto-lib.com
@@ -14,7 +14,14 @@ $!
 $!  It was re-written so it would try to determine what "C" compiler to use 
 $!  or you can specify which "C" compiler to use.
 $!
-$!  Specify RSAREF as P1 to compile with the RSAREF library instead of
+$!  Specify the following as P1 to build just that part or ALL to just
+$!  build everything.
+$!
+$!              LIBRARY    To just compile the [.xxx.EXE.CRYPTO]LIBCRYPTO.OLB Library.
+$!              APPS       To just compile the [.xxx.EXE.CRYPTO]*.EXE
+$!              ALL        To do both LIBRARY and APPS
+$!
+$!  Specify RSAREF as P2 to compile with the RSAREF library instead of
 $!  the regular one.  If you specify NORSAREF it will compile with the
 $!  regular RSAREF routines.  (Note: If you are in the United States
 $!  you MUST compile with RSAREF unless you have a license from RSA).
@@ -26,10 +33,10 @@ $!        directory structure stored.  You have to extract the file
 $!        into the [.RSAREF] directory under the root directory as that
 $!        is where the scripts will look for the files.
 $!
-$!  Specify DEBUG or NODEBUG as P2 to compile with or without debugger
+$!  Specify DEBUG or NODEBUG as P3 to compile with or without debugger
 $!  information.
 $!
-$!  Specify which compiler at P3 to try to compile under.
+$!  Specify which compiler at P4 to try to compile under.
 $!
 $!         VAXC  For VAX C.
 $!         DECC  For DEC C.
@@ -38,15 +45,15 @@ $!
 $!  If you don't speficy a compiler, it will try to determine which
 $!  "C" compiler to use.
 $!
-$!  P4, if defined, sets a TCP/IP library to use, through one of the following
+$!  P5, if defined, sets a TCP/IP library to use, through one of the following
 $!  keywords:
 $!
 $!      UCX             for UCX
 $!      SOCKETSHR       for SOCKETSHR+NETLIB
 $!
-$!  P5, if defined, sets a compiler thread NOT needed on OpenVMS 7.1 (and up)
+$!  P6, if defined, sets a compiler thread NOT needed on OpenVMS 7.1 (and up)
 $!
-$!  P6, if defined, sets a choice of crypto methods to compile.
+$!  P7, if defined, sets a choice of crypto methods to compile.
 $!  WARNING: this should only be done to recompile some part of an already
 $!  fully compiled library.
 $!
@@ -79,12 +86,13 @@ $ ENDIF
 $!
 $! Define The Different Encryption Types.
 $!
-$ ENCRYPT_TYPES = ",MD2,MD5,SHA,MDC2,HMAC,RIPEMD,"+ -
+$ ENCRYPT_TYPES = "Basic,MD2,MD5,SHA,MDC2,HMAC,RIPEMD,"+ -
                   "DES,RC2,RC4,RC5,IDEA,BF,CAST,"+ -
                   "BN,RSA,DSA,DH,"+ -
                   "BUFFER,BIO,STACK,LHASH,RAND,ERR,OBJECTS,"+ -
                   "EVP,EVP_2,ASN1,ASN1_2,PEM,X509,X509V3,"+ -
                   "CONF,TXT_DB,PKCS7,PKCS12,COMP"
+$ ENCRYPT_PROGRAMS = "DES,PKCS7"
 $!
 $! Check To Make Sure We Have Valid Command Line Parameters.
 $!
@@ -136,6 +144,14 @@ $! Define The Library Name.
 $!
 $ LIB_NAME := 'EXE_DIR'LIBCRYPTO.OLB
 $!
+$! Define The CRYPTO-LIB We Are To Use.
+$!
+$ CRYPTO_LIB := 'EXE_DIR'LIBCRYPTO.OLB
+$!
+$! Define The RSAREF-LIB We Are To Use.
+$!
+$ RSAREF_LIB := SYS$DISK:[-.'ARCH'.EXE.RSAREF]LIBRSAGLUE.OLB
+$!
 $! Check To See If We Already Have A "[.xxx.EXE.CRYPTO]LIBCRYPTO.OLB" Library...
 $!
 $ IF (F$SEARCH(LIB_NAME).EQS."")
@@ -149,9 +165,16 @@ $! End The Library Check.
 $!
 $ ENDIF
 $!
+$! Build our options file for the application
+$!
+$ GOSUB CHECK_OPT_FILE
+$!
 $! Define The Different Encryption "library" Strings.
 $!
-$ LIB_ = "cryptlib,mem,cversion,ex_data,tmdiff,cpt_err"
+$ APPS_DES = "DES/DES,CBC3_ENC"
+$ APPS_PKCS7 = "ENC/ENC;DEC/DEC;SIGN/SIGN;VERIFY/VERIFY,EXAMPLE"
+$
+$ LIB_ = "cryptlib,mem,mem_dbg,cversion,ex_data,tmdiff,cpt_err"
 $ LIB_MD2 = "md2_dgst,md2_one"
 $ LIB_MD5 = "md5_dgst,md5_one"
 $ LIB_SHA = "sha_dgst,sha1dgst,sha_one,sha1_one"
@@ -171,14 +194,14 @@ $ LIB_IDEA = "i_cbc,i_cfb64,i_ofb64,i_ecb,i_skey"
 $ LIB_BF = "bf_skey,bf_ecb,bf_enc,bf_cfb64,bf_ofb64"
 $ LIB_CAST = "c_skey,c_ecb,c_enc,c_cfb64,c_ofb64"
 $ LIB_BN_ASM = "[.asm]vms.mar,vms-helper"
-$ IF F$TRNLNM("OPENSSL_NO_ASM") .NES. "" THEN LIB_BN_ASM = "bn_asm"
-$ LIB_BN = "bn_add,bn_div,bn_exp,bn_lib,bn_mul,"+ -
+$ IF F$TRNLNM("OPENSSL_NO_ASM").OR.ARCH.EQS."AXP" THEN LIB_BN_ASM = "bn_asm"
+$ LIB_BN = "bn_add,bn_div,bn_exp,bn_lib,bn_ctx,bn_mul,"+ -
         "bn_print,bn_rand,bn_shift,bn_word,bn_blind,"+ -
         "bn_gcd,bn_prime,bn_err,bn_sqr,"+LIB_BN_ASM+",bn_recp,bn_mont,"+ -
         "bn_mpi,bn_exp2"
 $ LIB_RSA = "rsa_eay,rsa_gen,rsa_lib,rsa_sign,rsa_saos,rsa_err,"+ -
-        "rsa_pk1,rsa_ssl,rsa_none,rsa_oaep,rsa_chk"
-$ LIB_DSA = "dsa_gen,dsa_key,dsa_lib,dsa_asn1,dsa_vrf,dsa_sign,dsa_err"
+        "rsa_pk1,rsa_ssl,rsa_none,rsa_oaep,rsa_chk,rsa_null"
+$ LIB_DSA = "dsa_gen,dsa_key,dsa_lib,dsa_asn1,dsa_vrf,dsa_sign,dsa_err,dsa_ossl"
 $ LIB_DH = "dh_gen,dh_key,dh_lib,dh_check,dh_err"
 $ LIB_BUFFER = "buffer,buf_err"
 $ LIB_BIO = "bio_lib,bio_cb,bio_err,"+ -
@@ -188,7 +211,7 @@ $ LIB_BIO = "bio_lib,bio_cb,bio_err,"+ -
         "b_sock,bss_acpt,bf_nbio,bss_rtcp,bss_bio" ! + ",bss_log" for syslog
 $ LIB_STACK = "stack"
 $ LIB_LHASH = "lhash,lh_stats"
-$ LIB_RAND = "md_rand,randfile,rand_lib"
+$ LIB_RAND = "md_rand,randfile,rand_lib,rand_err,rand_egd"
 $ LIB_ERR = "err,err_all,err_prn"
 $ LIB_OBJECTS = "o_names,obj_dat,obj_lib,obj_err"
 $ LIB_EVP = "encode,digest,evp_enc,evp_key,"+ -
@@ -204,38 +227,39 @@ $ LIB_EVP_2 = "e_ecb_c,e_cbc_c,e_cfb_c,e_ofb_c,"+ -
         "m_ripemd,"+ -
         "p_open,p_seal,p_sign,p_verify,p_lib,p_enc,p_dec,"+ -
         "bio_md,bio_b64,bio_enc,evp_err,e_null,"+ -
-        "c_all,evp_lib,bio_ok,evp_pkey,evp_pbe,p5_crpt,p5_crpt2"
+        "c_all,c_allc,c_alld,evp_lib,bio_ok,"+-
+        "evp_pkey,evp_pbe,p5_crpt,p5_crpt2"
 $ LIB_ASN1 = "a_object,a_bitstr,a_utctm,a_gentm,a_time,a_int,a_octet,"+ -
-        "a_print,a_type,a_set,a_dup,a_d2i_fp,a_i2d_fp,a_bmp,"+ -
-        "a_enum,a_vis,a_utf8,a_sign,a_digest,a_verify,"+ -
+        "a_null,a_print,a_type,a_set,a_dup,a_d2i_fp,a_i2d_fp,a_bmp,"+ -
+        "a_enum,a_vis,a_utf8,a_sign,a_digest,a_verify,a_mbstr,"+ -
         "x_algor,x_val,x_pubkey,x_sig,x_req,x_attrib,"+ -
-        "x_name,x_cinf,x_x509,x_crl,x_info,x_spki,nsseq,"+ -
+        "x_name,x_cinf,x_x509,x_x509a,x_crl,x_info,x_spki,nsseq,"+ -
         "d2i_r_pr,i2d_r_pr,d2i_r_pu,i2d_r_pu,"+ -
         "d2i_s_pr,i2d_s_pr,d2i_s_pu,i2d_s_pu,"+ -
         "d2i_pu,d2i_pr,i2d_pu,i2d_pr"
-$ LIB_ASN1_2 = "t_req,t_x509,t_crl,t_pkey,"+ -
+$ LIB_ASN1_2 = "t_req,t_x509,t_x509a,t_crl,t_pkey,t_spki,t_bitst,"+ -
         "p7_i_s,p7_signi,p7_signd,p7_recip,p7_enc_c,p7_evp,"+ -
         "p7_dgst,p7_s_e,p7_enc,p7_lib,"+ -
         "f_int,f_string,i2d_dhp,i2d_dsap,d2i_dhp,d2i_dsap,n_pkey,"+ -
         "f_enum,a_hdr,x_pkey,a_bool,x_exten,"+ -
-        "asn1_par,asn1_lib,asn1_err,a_meth,a_bytes,"+ -
+        "asn1_par,asn1_lib,asn1_err,a_meth,a_bytes,a_strnid,"+ -
         "evp_asn1,asn_pack,p5_pbe,p5_pbev2,p8_pkey"
 $ LIB_PEM = "pem_sign,pem_seal,pem_info,pem_lib,pem_all,pem_err"
 $ LIB_X509 = "x509_def,x509_d2,x509_r2x,x509_cmp,"+ -
-        "x509_obj,x509_req,x509_vfy,"+ -
+        "x509_obj,x509_req,x509spki,x509_vfy,"+ -
         "x509_set,x509rset,x509_err,"+ -
-        "x509name,x509_v3,x509_ext,"+ -
+        "x509name,x509_v3,x509_ext,x509_att,"+ -
         "x509type,x509_lu,x_all,x509_txt,"+ -
-        "by_file,by_dir"
+        "x509_trs,by_file,by_dir"
 $ LIB_X509V3 = "v3_bcons,v3_bitst,v3_conf,v3_extku,v3_ia5,v3_lib,"+ -
         "v3_prn,v3_utl,v3err,v3_genn,v3_alt,v3_skey,v3_akey,v3_pku,"+ -
-        "v3_int,v3_enum,v3_sxnet,v3_cpols,v3_crld"
+        "v3_int,v3_enum,v3_sxnet,v3_cpols,v3_crld,v3_purp,v3_info"
 $ LIB_CONF = "conf,conf_err"
 $ LIB_TXT_DB = "txt_db"
-$ LIB_PKCS7 = "pk7_lib,pkcs7err,pk7_doit"
+$ LIB_PKCS7 = "pk7_lib,pkcs7err,pk7_doit,pk7_smime,pk7_attr,pk7_mime"
 $ LIB_PKCS12 = "p12_add,p12_attr,p12_bags,p12_crpt,p12_crt,p12_decr,"+ -
         "p12_init,p12_key,p12_kiss,p12_lib,p12_mac,p12_mutl,"+ -
-        "p12_sbag,p12_utl,pk12err"
+        "p12_sbag,p12_utl,p12_npas,pk12err"
 $ LIB_COMP = "comp_lib,"+ -
         "c_rle,c_zlib"
 $!
@@ -248,7 +272,8 @@ $ COMPILEWITH_CC5 = ",md2_dgst,md5_dgst,mdc2dgst,sha_dgst,sha1dgst," + -
 $!
 $! Check To See If We Are Going To Use RSAREF.
 $!
-$ IF (RSAREF.EQS."TRUE" .AND. ENCRYPT_TYPES - "RSA".NES.ENCRYPT_TYPES)
+$ IF (RSAREF.EQS."TRUE" .AND. ENCRYPT_TYPES - "RSA".NES.ENCRYPT_TYPES -
+      .AND. (BUILDALL .EQS. "TRUE" .OR. BUILDALL .EQS. "LIBRARY"))
 $ THEN
 $!
 $!  Check To See If The File [-.RSAREF]RSAREF.C Is Actually There.
@@ -340,6 +365,8 @@ $!
 $! Extract The Module Name From The Encryption List.
 $!
 $ MODULE_NAME = F$ELEMENT(MODULE_COUNTER,",",ENCRYPT_TYPES)
+$ IF MODULE_NAME.EQS."Basic" THEN MODULE_NAME = ""
+$ MODULE_NAME1 = MODULE_NAME
 $!
 $! Check To See If We Are At The End Of The Module List.
 $!
@@ -358,20 +385,10 @@ $! Increment The Moudle Counter.
 $!
 $ MODULE_COUNTER = MODULE_COUNTER + 1
 $!
-$! Tell The User What Module We Are Building.
-$!
-$ IF (MODULE_NAME.NES."") 
-$ THEN
-$   WRITE SYS$OUTPUT "Compiling The ",MODULE_NAME," Files."
-$ ENDIF
-$!
-$!  Define A File Counter And Set It To "0".
-$!
-$ FILE_COUNTER = 0
-$!
-$! Create The Library Module Name.
+$! Create The Library and Apps Module Names.
 $!
 $ LIB_MODULE = "LIB_" + MODULE_NAME
+$ APPS_MODULE = "APPS_" + MODULE_NAME
 $ IF (MODULE_NAME.EQS."ASN1_2")
 $ THEN
 $   MODULE_NAME = "ASN1"
@@ -381,6 +398,11 @@ $ THEN
 $   MODULE_NAME = "EVP"
 $ ENDIF
 $!
+$! Set state (can be LIB and APPS)
+$!
+$ STATE = "LIB"
+$ IF BUILDALL .EQS. "APPS" THEN STATE = "APPS"
+$!
 $! Check if the library module name actually is defined
 $!
 $ IF F$TYPE('LIB_MODULE') .EQS. ""
@@ -391,22 +413,92 @@ $   WRITE SYS$ERROR ""
 $   GOTO MODULE_NEXT
 $ ENDIF
 $!
+$! Top Of The Module Loop.
+$!
+$ MODULE_AGAIN:
+$!
+$! Tell The User What Module We Are Building.
+$!
+$ IF (MODULE_NAME1.NES."") 
+$ THEN
+$   IF STATE .EQS. "LIB"
+$   THEN
+$     WRITE SYS$OUTPUT "Compiling The ",MODULE_NAME1," Library Files. (",BUILDALL,",",STATE,")"
+$   ELSE IF F$TYPE('APPS_MODULE') .NES. ""
+$     THEN
+$       WRITE SYS$OUTPUT "Compiling The ",MODULE_NAME1," Applications. (",BUILDALL,",",STATE,")"
+$     ENDIF
+$   ENDIF
+$ ENDIF
+$!
+$!  Define A File Counter And Set It To "0".
+$!
+$ FILE_COUNTER = 0
+$ APPLICATION = ""
+$ APPLICATION_COUNTER = 0
+$!
 $! Top Of The File Loop.
 $!
 $ NEXT_FILE:
 $!
-$! O.K, Extract The File Name From The File List.
+$! Look in the LIB_MODULE is we're in state LIB
+$!
+$ IF STATE .EQS. "LIB"
+$ THEN
+$!
+$!   O.K, Extract The File Name From The File List.
+$!
+$   FILE_NAME = F$ELEMENT(FILE_COUNTER,",",'LIB_MODULE')
+$!
+$!   else
+$!
+$ ELSE
+$   FILE_NAME = ","
+$!
+$   IF F$TYPE('APPS_MODULE') .NES. ""
+$   THEN
+$!
+$!     Extract The File Name From The File List.
+$!     This part is a bit more complicated.
 $!
-$ FILE_NAME = F$ELEMENT(FILE_COUNTER,",",'LIB_MODULE')
+$     IF APPLICATION .EQS. ""
+$     THEN
+$       APPLICATION = F$ELEMENT(APPLICATION_COUNTER,";",'APPS_MODULE')
+$       APPLICATION_COUNTER = APPLICATION_COUNTER + 1
+$       APPLICATION_OBJECTS = F$ELEMENT(1,"/",APPLICATION)
+$       APPLICATION = F$ELEMENT(0,"/",APPLICATION)
+$       FILE_COUNTER = 0
+$     ENDIF
+$
+$!     WRITE SYS$OUTPUT "DEBUG: SHOW SYMBOL APPLICATION*"
+$!     SHOW SYMBOL APPLICATION*
+$!
+$     IF APPLICATION .NES. ";"
+$     THEN
+$       FILE_NAME = F$ELEMENT(FILE_COUNTER,",",APPLICATION_OBJECTS)
+$       IF FILE_NAME .EQS. ","
+$       THEN
+$         APPLICATION = ""
+$         GOTO NEXT_FILE
+$       ENDIF
+$     ENDIF
+$   ENDIF
+$ ENDIF
 $!
 $! Check To See If We Are At The End Of The File List.
 $!
 $ IF (FILE_NAME.EQS.",") 
 $ THEN 
 $!
-$!  We Are At The End Of The File List, Goto FILE_DONE.
+$!  We Are At The End Of The File List, Change State Or Goto FILE_DONE.
 $!
-$   GOTO FILE_DONE
+$   IF STATE .EQS. "LIB" .AND. BUILDALL .NES. "LIBRARY"
+$   THEN
+$     STATE = "APPS"
+$     GOTO MODULE_AGAIN
+$   ELSE
+$     GOTO FILE_DONE
+$   ENDIF
 $!
 $! End The File List Check.
 $!
@@ -458,7 +550,7 @@ $! Tell The User We Are Compiling The File.
 $!
 $ IF (MODULE_NAME.EQS."")
 $ THEN
-     WRITE SYS$OUTPUT "Compiling The ",FILE_NAME," File."
+$   WRITE SYS$OUTPUT "Compiling The ",FILE_NAME," File.  (",BUILDALL,",",STATE,")"
 $ ENDIF
 $ IF (MODULE_NAME.NES."")
 $ THEN 
@@ -490,14 +582,17 @@ $       ENDIF
 $     ENDIF
 $   ENDIF
 $ ENDIF
+$ IF STATE .EQS. "LIB"
+$ THEN 
 $!
-$! Add It To The Library.
+$!   Add It To The Library.
 $!
-$ LIBRARY/REPLACE 'LIB_NAME' 'OBJECT_FILE'
+$   LIBRARY/REPLACE 'LIB_NAME' 'OBJECT_FILE'
 $!
-$! Time To Clean Up The Object File.
+$!   Time To Clean Up The Object File.
 $!
-$ DELETE 'OBJECT_FILE';*
+$   DELETE 'OBJECT_FILE';*
+$ ENDIF
 $!
 $! Go Back And Do It Again.
 $!
@@ -507,6 +602,99 @@ $! All Done With This Library Part.
 $!
 $ FILE_DONE:
 $!
+$! Time To Build Some Applications
+$!
+$ IF F$TYPE('APPS_MODULE') .NES. "" .AND. BUILDALL .NES. "LIBRARY"
+$ THEN
+$   APPLICATION_COUNTER = 0
+$ NEXT_APPLICATION:
+$   APPLICATION = F$ELEMENT(APPLICATION_COUNTER,";",'APPS_MODULE')
+$   IF APPLICATION .EQS. ";" THEN GOTO APPLICATION_DONE
+$
+$   APPLICATION_COUNTER = APPLICATION_COUNTER + 1
+$   APPLICATION_OBJECTS = F$ELEMENT(1,"/",APPLICATION)
+$   APPLICATION = F$ELEMENT(0,"/",APPLICATION)
+$
+$!   WRITE SYS$OUTPUT "DEBUG: SHOW SYMBOL APPLICATION*"
+$!   SHOW SYMBOL APPLICATION*
+$!
+$! Tell the user what happens
+$!
+$   WRITE SYS$OUTPUT "  ",APPLICATION,".exe"
+$!
+$! Link The Program, Check To See If We Need To Link With RSAREF Or Not.
+$!
+$   IF (RSAREF.EQS."TRUE")
+$   THEN
+$!
+$!  Check To See If We Are To Link With A Specific TCP/IP Library.
+$!
+$     IF (TCPIP_LIB.NES."")
+$     THEN
+$!
+$!    Link With The RSAREF Library And A Specific TCP/IP Library.
+$!
+$       LINK/'DEBUGGER'/'TRACEBACK'/EXE='EXE_DIR''APPLICATION'.EXE -
+            'OBJ_DIR''APPLICATION_OBJECTS', -
+            'CRYPTO_LIB'/LIBRARY,'RSAREF_LIB'/LIBRARY, -
+            'TCPIP_LIB','OPT_FILE'/OPTION
+$!
+$!    Else...
+$!
+$     ELSE
+$!
+$!      Link With The RSAREF Library And NO TCP/IP Library.
+$!
+$       LINK/'DEBUGGER'/'TRACEBACK'/EXE='EXE_DIR''APPLICATION'.EXE -
+            'OBJ_DIR''APPLICATION_OBJECTS', -
+            'CRYPTO_LIB'/LIBRARY,'RSAREF_LIB'/LIBRARY, -
+            'OPT_FILE'/OPTION
+$!
+$!    End The TCP/IP Library Check.
+$!
+$     ENDIF
+$!
+$!   Else...
+$!
+$   ELSE
+$!
+$!    Don't Link With The RSAREF Routines.
+$!
+$!
+$!    Check To See If We Are To Link With A Specific TCP/IP Library.
+$!
+$     IF (TCPIP_LIB.NES."")
+$     THEN
+$!
+$!      Don't Link With The RSAREF Routines And TCP/IP Library.
+$!
+$       LINK/'DEBUGGER'/'TRACEBACK'/EXE='EXE_DIR''APPLICATION'.EXE -
+            'OBJ_DIR''APPLICATION_OBJECTS', -
+            'CRYPTO_LIB'/LIBRARY, -
+            'TCPIP_LIB','OPT_FILE'/OPTION
+$!
+$!    Else...
+$!
+$     ELSE
+$!
+$!      Don't Link With The RSAREF Routines And Link With A TCP/IP Library.
+$!
+$       LINK/'DEBUGGER'/'TRACEBACK'/EXE='EXE_DIR''APPLICATION'.EXE -
+            'OBJ_DIR''APPLICATION_OBJECTS',-
+            'CRYPTO_LIB'/LIBRARY, -
+            'OPT_FILE'/OPTION
+$!
+$!    End The TCP/IP Library Check.
+$!
+$     ENDIF
+$!
+$!   End The RSAREF Link Check.
+$!
+$   ENDIF
+$   GOTO NEXT_APPLICATION
+$  APPLICATION_DONE:
+$ ENDIF
+$!
 $! Go Back And Get The Next Module.
 $!
 $ GOTO MODULE_NEXT
@@ -653,17 +841,70 @@ $ CHECK_OPTIONS:
 $!
 $! Check To See If P1 Is Blank.
 $!
-$ IF (P1.EQS."NORSAREF")
+$ IF (P1.EQS."ALL")
 $ THEN
 $!
-$!   P1 Is NORSAREF, So Compile With The Regular RSA Libraries.
+$!   P1 Is Blank, So Build Everything.
+$!
+$    BUILDALL = "TRUE"
+$!
+$! Else...
+$!
+$ ELSE
+$!
+$!  Else, Check To See If P1 Has A Valid Arguement.
+$!
+$   IF (P1.EQS."LIBRARY").OR.(P1.EQS."APPS")
+$   THEN
+$!
+$!    A Valid Arguement.
+$!
+$     BUILDALL = P1
+$!
+$!  Else...
+$!
+$   ELSE
+$!
+$!    Tell The User We Don't Know What They Want.
+$!
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "The Option ",P1," Is Invalid.  The Valid Options Are:"
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "    ALL      :  Just Build Everything."
+$     WRITE SYS$OUTPUT "    LIBRARY  :  To Compile Just The [.xxx.EXE.SSL]LIBCRYPTO.OLB Library."
+$     WRITE SYS$OUTPUT "    APPS     :  To Compile Just The [.xxx.EXE.SSL]*.EXE Programs."
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT " Where 'xxx' Stands For:"
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "        AXP  :  Alpha Architecture."
+$     WRITE SYS$OUTPUT "        VAX  :  VAX Architecture."
+$     WRITE SYS$OUTPUT ""
+$!
+$!    Time To EXIT.
+$!
+$     EXIT
+$!
+$!  End The Valid Arguement Check.
+$!
+$   ENDIF
+$!
+$! End The P1 Check.
+$!
+$ ENDIF
+$!
+$! Check To See If P2 Is Blank.
+$!
+$ IF (P2.EQS."NORSAREF")
+$ THEN
+$!
+$!   P2 Is NORSAREF, So Compile With The Regular RSA Libraries.
 $!
 $    RSAREF = "FALSE"
 $ ELSE
 $!
 $!  Check To See If We Are To Use The RSAREF Library.
 $!
-$   IF (P1.EQS."RSAREF")
+$   IF (P2.EQS."RSAREF")
 $   THEN
 $!
 $!    Check To Make Sure We Have The RSAREF Source Code Directory.
@@ -697,7 +938,7 @@ $!
 $!    They Entered An Invalid Option..
 $!
 $     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT "The Option ",P1," Is Invalid.  The Valid Options Are:"
+$     WRITE SYS$OUTPUT "The Option ",P2," Is Invalid.  The Valid Options Are:"
 $     WRITE SYS$OUTPUT ""
 $     WRITE SYS$OUTPUT "     RSAREF   :  Compile With The RSAREF Library."
 $     WRITE SYS$OUTPUT "     NORSAREF :  Compile With The Regular RSA Library."
@@ -711,16 +952,16 @@ $!  End The Valid Arguement Check.
 $!
 $   ENDIF
 $!
-$! End The P1 Check.
+$! End The P2 Check.
 $!
 $ ENDIF
 $!
-$! Check To See If P2 Is Blank.
+$! Check To See If P3 Is Blank.
 $!
-$ IF (P2.EQS."NODEBUG")
+$ IF (P3.EQS."NODEBUG")
 $ THEN
 $!
-$!   P2 Is NODEBUG, So Compile Without The Debugger Information.
+$!   P3 Is NODEBUG, So Compile Without The Debugger Information.
 $!
 $    DEBUGGER = "NODEBUG"
 $    TRACEBACK = "NOTRACEBACK" 
@@ -733,7 +974,7 @@ $ ELSE
 $!
 $!  Check To See If We Are To Compile With Debugger Information.
 $!
-$   IF (P2.EQS."DEBUG")
+$   IF (P3.EQS."DEBUG")
 $   THEN
 $!
 $!    Compile With Debugger Information.
@@ -750,7 +991,7 @@ $!
 $!    They Entered An Invalid Option..
 $!
 $     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT "The Option ",P2," Is Invalid.  The Valid Options Are:"
+$     WRITE SYS$OUTPUT "The Option ",P3," Is Invalid.  The Valid Options Are:"
 $     WRITE SYS$OUTPUT ""
 $     WRITE SYS$OUTPUT "     DEBUG   :  Compile With The Debugger Information."
 $     WRITE SYS$OUTPUT "     NODEBUG :  Compile Without The Debugger Information."
@@ -764,7 +1005,7 @@ $!  End The Valid Arguement Check.
 $!
 $   ENDIF
 $!
-$! End The P2 Check.
+$! End The P3 Check.
 $!
 $ ENDIF
 $!
@@ -774,9 +1015,9 @@ $! Written By:  Richard Levitte
 $!              richard@levitte.org
 $!
 $!
-$! Check To See If We Have A Option For P5.
+$! Check To See If We Have A Option For P6.
 $!
-$ IF (P5.EQS."")
+$ IF (P6.EQS."")
 $ THEN
 $!
 $!  Get The Version Of VMS We Are Using.
@@ -798,13 +1039,13 @@ $!  End The VMS Version Check.
 $!
 $   ENDIF
 $!
-$! End The P5 Check.
+$! End The P6 Check.
 $!
 $ ENDIF
 $!
-$! Check To See If P3 Is Blank.
+$! Check To See If P4 Is Blank.
 $!
-$ IF (P3.EQS."")
+$ IF (P4.EQS."")
 $ THEN
 $!
 $!  O.K., The User Didn't Specify A Compiler, Let's Try To
@@ -817,7 +1058,7 @@ $   THEN
 $!
 $!    Looks Like GNUC, Set To Use GNUC.
 $!
-$     P3 = "GNUC"
+$     P4 = "GNUC"
 $!
 $!  Else...
 $!
@@ -830,7 +1071,7 @@ $     THEN
 $!
 $!      Looks Like DECC, Set To Use DECC.
 $!
-$       P3 = "DECC"
+$       P4 = "DECC"
 $!
 $!    Else...
 $!
@@ -838,7 +1079,7 @@ $     ELSE
 $!
 $!      Looks Like VAXC, Set To Use VAXC.
 $!
-$       P3 = "VAXC"
+$       P4 = "VAXC"
 $!
 $!    End The VAXC Compiler Check.
 $!
@@ -852,9 +1093,9 @@ $!  End The Compiler Check.
 $!
 $ ENDIF
 $!
-$! Check To See If We Have A Option For P4.
+$! Check To See If We Have A Option For P5.
 $!
-$ IF (P4.EQS."")
+$ IF (P5.EQS."")
 $ THEN
 $!
 $!  Find out what socket library we have available
@@ -864,7 +1105,7 @@ $   THEN
 $!
 $!    We have SOCKETSHR, and it is my opinion that it's the best to use.
 $!
-$     P4 = "SOCKETSHR"
+$     P5 = "SOCKETSHR"
 $!
 $!    Tell the user
 $!
@@ -884,7 +1125,7 @@ $     THEN
 $!
 $!      Last resort: a UCX or UCX-compatible library
 $!
-$       P4 = "UCX"
+$       P5 = "UCX"
 $!
 $!      Tell the user
 $!
@@ -898,22 +1139,46 @@ $ ENDIF
 $!
 $! Set Up Initial CC Definitions, Possibly With User Ones
 $!
-$ CCDEFS = "VMS=1,TCPIP_TYPE_''P4'"
+$ CCDEFS = "VMS=1,TCPIP_TYPE_''P5'"
+$ IF F$TRNLNM("OPENSSL_NO_ASM") THEN CCDEFS = CCDEFS + ",NO_ASM"
+$ IF F$TRNLNM("OPENSSL_NO_RSA") THEN CCDEFS = CCDEFS + ",NO_RSA"
+$ IF F$TRNLNM("OPENSSL_NO_DSA") THEN CCDEFS = CCDEFS + ",NO_DSA"
+$ IF F$TRNLNM("OPENSSL_NO_DH") THEN CCDEFS = CCDEFS + ",NO_DH"
+$ IF F$TRNLNM("OPENSSL_NO_MD2") THEN CCDEFS = CCDEFS + ",NO_MD2"
+$ IF F$TRNLNM("OPENSSL_NO_MD5") THEN CCDEFS = CCDEFS + ",NO_MD5"
+$ IF F$TRNLNM("OPENSSL_NO_RIPEMD") THEN CCDEFS = CCDEFS + ",NO_RIPEMD"
+$ IF F$TRNLNM("OPENSSL_NO_SHA") THEN CCDEFS = CCDEFS + ",NO_SHA"
+$ IF F$TRNLNM("OPENSSL_NO_SHA0") THEN CCDEFS = CCDEFS + ",NO_SHA0"
+$ IF F$TRNLNM("OPENSSL_NO_SHA1") THEN CCDEFS = CCDEFS + ",NO_SHA1"
+$ IF F$TRNLNM("OPENSSL_NO_DES")
+$ THEN
+$   CCDEFS = CCDEFS + ",NO_DES,NO_MDC2"
+$ ELSE
+$   IF F$TRNLNM("OPENSSL_NO_MDC2") THEN CCDEFS = CCDEFS + ",NO_MDC2"
+$ ENDIF
+$ IF F$TRNLNM("OPENSSL_NO_RC2") THEN CCDEFS = CCDEFS + ",NO_RC2"
+$ IF F$TRNLNM("OPENSSL_NO_RC4") THEN CCDEFS = CCDEFS + ",NO_RC4"
+$ IF F$TRNLNM("OPENSSL_NO_RC5") THEN CCDEFS = CCDEFS + ",NO_RC5"
+$ IF F$TRNLNM("OPENSSL_NO_IDEA") THEN CCDEFS = CCDEFS + ",NO_IDEA"
+$ IF F$TRNLNM("OPENSSL_NO_BF") THEN CCDEFS = CCDEFS + ",NO_BF"
+$ IF F$TRNLNM("OPENSSL_NO_CAST") THEN CCDEFS = CCDEFS + ",NO_CAST"
+$ IF F$TRNLNM("OPENSSL_NO_HMAC") THEN CCDEFS = CCDEFS + ",NO_HMAC"
+$ IF F$TRNLNM("OPENSSL_NO_SSL2") THEN CCDEFS = CCDEFS + ",NO_SSL2"
 $ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS
 $ CCEXTRAFLAGS = ""
 $ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS
-$ CCDISABLEWARNINGS = ""
+$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"
 $ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -
-        CCDISABLEWARNINGS = USER_CCDISABLEWARNINGS
+        CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS
 $!
 $!  Check To See If The User Entered A Valid Paramter.
 $!
-$ IF (P3.EQS."VAXC").OR.(P3.EQS."DECC").OR.(P3.EQS."GNUC")
+$ IF (P4.EQS."VAXC").OR.(P4.EQS."DECC").OR.(P4.EQS."GNUC")
 $ THEN
 $!
 $!    Check To See If The User Wanted DECC.
 $!
-$   IF (P3.EQS."DECC")
+$   IF (P4.EQS."DECC")
 $   THEN
 $!
 $!    Looks Like DECC, Set To Use DECC.
@@ -942,7 +1207,7 @@ $   ENDIF
 $!
 $!  Check To See If We Are To Use VAXC.
 $!
-$   IF (P3.EQS."VAXC")
+$   IF (P4.EQS."VAXC")
 $   THEN
 $!
 $!    Looks Like VAXC, Set To Use VAXC.
@@ -980,7 +1245,7 @@ $   ENDIF
 $!
 $!  Check To See If We Are To Use GNU C.
 $!
-$   IF (P3.EQS."GNUC")
+$   IF (P4.EQS."GNUC")
 $   THEN
 $!
 $!    Looks Like GNUC, Set To Use GNUC.
@@ -1051,7 +1316,7 @@ $     CC4DISABLEWARNINGS = ""
 $   ENDIF
 $   CC3 = CC + "/DEFINE=(" + CCDEFS + ISSEVEN + ")" + CCDISABLEWARNINGS
 $   CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS
-$   IF ARCH .EQS. "VAX" .AND. COMPILER .EQS. "DECC" .AND. P2 .NES. "DEBUG"
+$   IF ARCH .EQS. "VAX" .AND. COMPILER .EQS. "DECC" .AND. P3 .NES. "DEBUG"
 $   THEN
 $     CC5 = CC + "/OPTIMIZE=NODISJOINT"
 $   ELSE
@@ -1070,7 +1335,7 @@ $!
 $!  Tell The User We Don't Know What They Want.
 $!
 $   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "The Option ",P3," Is Invalid.  The Valid Options Are:"
+$   WRITE SYS$OUTPUT "The Option ",P4," Is Invalid.  The Valid Options Are:"
 $   WRITE SYS$OUTPUT ""
 $   WRITE SYS$OUTPUT "    VAXC  :  To Compile With VAX C."
 $   WRITE SYS$OUTPUT "    DECC  :  To Compile With DEC C."
@@ -1096,12 +1361,12 @@ $   WRITE SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO
 $!
 $! Time to check the contents, and to make sure we get the correct library.
 $!
-$ IF P4.EQS."SOCKETSHR" .OR. P4.EQS."MULTINET" .OR. P4.EQS."UCX"
+$ IF P5.EQS."SOCKETSHR" .OR. P5.EQS."MULTINET" .OR. P5.EQS."UCX"
 $ THEN
 $!
 $!  Check to see if SOCKETSHR was chosen
 $!
-$   IF P4.EQS."SOCKETSHR"
+$   IF P5.EQS."SOCKETSHR"
 $   THEN
 $!
 $!    Set the library to use SOCKETSHR
@@ -1114,12 +1379,12 @@ $   ENDIF
 $!
 $!  Check to see if MULTINET was chosen
 $!
-$   IF P4.EQS."MULTINET"
+$   IF P5.EQS."MULTINET"
 $   THEN
 $!
 $!    Set the library to use UCX emulation.
 $!
-$     P4 = "UCX"
+$     P5 = "UCX"
 $!
 $!    Done with MULTINET
 $!
@@ -1127,7 +1392,7 @@ $   ENDIF
 $!
 $!  Check to see if UCX was chosen
 $!
-$   IF P4.EQS."UCX"
+$   IF P5.EQS."UCX"
 $   THEN
 $!
 $!    Set the library to use UCX.
@@ -1156,7 +1421,7 @@ $!
 $!  Tell The User We Don't Know What They Want.
 $!
 $   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "The Option ",P4," Is Invalid.  The Valid Options Are:"
+$   WRITE SYS$OUTPUT "The Option ",P5," Is Invalid.  The Valid Options Are:"
 $   WRITE SYS$OUTPUT ""
 $   WRITE SYS$OUTPUT "    SOCKETSHR  :  To link with SOCKETSHR TCP/IP library."
 $   WRITE SYS$OUTPUT "    UCX        :  To link with UCX TCP/IP library."
@@ -1173,9 +1438,9 @@ $!
 $! Check if the user wanted to compile just a subset of all the encryption
 $! methods.
 $!
-$ IF P6 .NES. ""
+$ IF P7 .NES. ""
 $ THEN
-$   ENCRYPT_TYPES = P6
+$   ENCRYPT_TYPES = P7
 $ ENDIF
 $!
 $!  Time To RETURN...
diff --git a/src/lib/libcrypto/crypto.h b/src/lib/libcrypto/crypto.h
index 8ad8c25e5a..41c937966e 100644
--- a/src/lib/libcrypto/crypto.h
+++ b/src/lib/libcrypto/crypto.h
@@ -63,17 +63,25 @@
 extern "C" {
 #endif
 
+#include <stdlib.h>
+
 #ifndef NO_FP_API
 #include <stdio.h>
 #endif
 
 #include <openssl/stack.h>
+#include <openssl/safestack.h>
 #include <openssl/opensslv.h>
 
 #ifdef CHARSET_EBCDIC
 #include <openssl/ebcdic.h>
 #endif
 
+#if defined(VMS) || defined(__VMS)
+#include "vms_idhacks.h"
+#endif
+
+
 /* Backward compatibility to SSLeay */
 /* This is more to be used to check the correct DLL is being used
  * in the MS world. */
@@ -111,7 +119,9 @@ extern "C" {
 #define CRYPTO_LOCK_GETSERVBYNAME       21
 #define CRYPTO_LOCK_READDIR             22
 #define CRYPTO_LOCK_RSA_BLINDING        23
-#define CRYPTO_NUM_LOCKS                24
+#define CRYPTO_LOCK_DH                  24
+#define CRYPTO_LOCK_MALLOC2             25
+#define CRYPTO_NUM_LOCKS                26
 
 #define CRYPTO_LOCK             1
 #define CRYPTO_UNLOCK           2
@@ -147,14 +157,16 @@ extern "C" {
 #define CRYPTO_MEM_CHECK_ENABLE 0x2     /* a bit */
 #define CRYPTO_MEM_CHECK_DISABLE 0x3    /* an enume */
 
-/*
-typedef struct crypto_mem_st
-        {
-        char *(*malloc_func)();
-        char *(*realloc_func)();
-        void (*free_func)();
-        } CRYPTO_MEM_FUNC;
-*/
+/* The following are bit values to turn on or off options connected to the
+ * malloc checking functionality */
+
+/* Adds time to the memory checking information */
+#define V_CRYPTO_MDEBUG_TIME    0x1 /* a bit */
+/* Adds thread number to the memory checking information */
+#define V_CRYPTO_MDEBUG_THREAD  0x2 /* a bit */
+
+#define V_CRYPTO_MDEBUG_ALL (V_CRYPTO_MDEBUG_TIME | V_CRYPTO_MDEBUG_THREAD)
+
 
 /* predec of the BIO type */
 typedef struct bio_st BIO_dummy;
@@ -165,24 +177,30 @@ typedef struct crypto_ex_data_st
         int dummy; /* gcc is screwing up this data structure :-( */
         } CRYPTO_EX_DATA;
 
+/* Called when a new object is created */
+typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+/* Called when an object is free()ed */
+typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+/* Called when we need to dup an object */
+typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d, 
+                                        int idx, long argl, void *argp);
+
 /* This stuff is basically class callback functions
- * The current classes are SSL_CTX, SSL, SSL_SESION, and a few more */
+ * The current classes are SSL_CTX, SSL, SSL_SESSION, and a few more */
+
 typedef struct crypto_ex_data_func_st
         {
         long argl;      /* Arbitary long */
-        char *argp;     /* Arbitary char * */
-        /* Called when a new object is created */
-        int (*new_func)(/*char *obj,
-                        char *item,int index,long argl,char *argp*/);
-        /* Called when this object is free()ed */
-        void (*free_func)(/*char *obj,
-                        char *item,int index,long argl,char *argp*/);
-
-        /* Called when we need to dup this one */
-        int (*dup_func)(/*char *obj_to,char *obj_from,
-                        char **new,int index,long argl,char *argp*/);
+        void *argp;     /* Arbitary void * */
+        CRYPTO_EX_new *new_func;
+        CRYPTO_EX_free *free_func;
+        CRYPTO_EX_dup *dup_func;
         } CRYPTO_EX_DATA_FUNCS;
 
+DECLARE_STACK_OF(CRYPTO_EX_DATA_FUNCS)
+
 /* Per class, we have a STACK of CRYPTO_EX_DATA_FUNCS for each CRYPTO_EX_DATA
  * entry.
  */
@@ -194,63 +212,54 @@ typedef struct crypto_ex_data_func_st
 #define CRYPTO_EX_INDEX_X509_STORE      4
 #define CRYPTO_EX_INDEX_X509_STORE_CTX  5
 
-/* Use this for win32 DLL's */
-#define CRYPTO_malloc_init()    CRYPTO_set_mem_functions(\
-        (char *(*)())malloc,\
-        (char *(*)())realloc,\
-        (void (*)())free)
 
-#ifdef CRYPTO_MDEBUG_ALL
-# ifndef CRYPTO_MDEBUG_TIME
-#  define CRYPTO_MDEBUG_TIME
-# endif
-# ifndef CRYPTO_MDEBUG_THREAD
-#  define CRYPTO_MDEBUG_THREAD
-# endif
-#endif
+/* This is the default callbacks, but we can have others as well:
+ * this is needed in Win32 where the application malloc and the
+ * library malloc may not be the same.
+ */
+#define CRYPTO_malloc_init()    CRYPTO_set_mem_functions(\
+        malloc, realloc, free)
 
-#if defined CRYPTO_MDEBUG_TIME || defined CRYPTO_MDEBUG_THREAD
+#if defined CRYPTO_MDEBUG_ALL || defined CRYPTO_MDEBUG_TIME || defined CRYPTO_MDEBUG_THREAD
 # ifndef CRYPTO_MDEBUG /* avoid duplicate #define */
 #  define CRYPTO_MDEBUG
 # endif
 #endif
 
-#ifdef CRYPTO_MDEBUG
+/* Set standard debugging functions (not done by default
+ * unless CRYPTO_MDEBUG is defined) */
+#define CRYPTO_malloc_debug_init()      do {\
+        CRYPTO_set_mem_debug_functions(\
+                (void (*)())CRYPTO_dbg_malloc,\
+                (void (*)())CRYPTO_dbg_realloc,\
+                (void (*)())CRYPTO_dbg_free,\
+                (void (*)())CRYPTO_dbg_set_options,\
+                (long (*)())CRYPTO_dbg_get_options);\
+        } while(0)
+
+int CRYPTO_mem_ctrl(int mode);
+int CRYPTO_is_mem_check_on(void);
+
+/* for applications */
 #define MemCheck_start() CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON)
 #define MemCheck_stop() CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_OFF)
+
+/* for library-internal use */
 #define MemCheck_on()   CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE)
 #define MemCheck_off()  CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE)
-#define Malloc(num)     CRYPTO_dbg_malloc((int)num,__FILE__,__LINE__)
+#define is_MemCheck_on() CRYPTO_is_mem_check_on()
+
+#define Malloc(num)     CRYPTO_malloc((int)num,__FILE__,__LINE__)
 #define Realloc(addr,num) \
-        CRYPTO_dbg_realloc((char *)addr,(int)num,__FILE__,__LINE__)
+        CRYPTO_realloc((char *)addr,(int)num,__FILE__,__LINE__)
 #define Remalloc(addr,num) \
-        CRYPTO_dbg_remalloc((char **)addr,(int)num,__FILE__,__LINE__)
-#define FreeFunc        CRYPTO_dbg_free
-#define Free(addr)      CRYPTO_dbg_free(addr)
-#define Malloc_locked(num) CRYPTO_malloc_locked((int)num)
-#define Free_locked(addr) CRYPTO_free_locked(addr)
-#else
-#define MemCheck_start()
-#define MemCheck_stop()
-#define MemCheck_on()
-#define MemCheck_off()
-#define Remalloc        CRYPTO_remalloc
-#if defined(WIN32) || defined(MFUNC)
-#define Malloc          CRYPTO_malloc
-#define Realloc(a,n)    CRYPTO_realloc(a,(n))
+        CRYPTO_remalloc((char **)addr,(int)num,__FILE__,__LINE__)
 #define FreeFunc        CRYPTO_free
 #define Free(addr)      CRYPTO_free(addr)
-#define Malloc_locked   CRYPTO_malloc_locked
+
+#define Malloc_locked(num) CRYPTO_malloc_locked((int)num,__FILE__,__LINE__)
 #define Free_locked(addr) CRYPTO_free_locked(addr)
-#else
-#define Malloc          malloc
-#define Realloc         realloc
-#define FreeFunc        free
-#define Free(addr)      free(addr)
-#define Malloc_locked   malloc
-#define Free_locked(addr) free(addr)
-#endif /* WIN32 || MFUNC */
-#endif /* MDEBUG */
+
 
 /* Case insensiteve linking causes problems.... */
 #if defined(WIN16) || defined(VMS)
@@ -261,15 +270,15 @@ typedef struct crypto_ex_data_func_st
 const char *SSLeay_version(int type);
 unsigned long SSLeay(void);
 
-int CRYPTO_get_ex_new_index(int idx,STACK **sk,long argl,char *argp,
-        int (*new_func)(),int (*dup_func)(),void (*free_func)());
-int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad,int idx,char *val);
-char *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad,int idx);
-int CRYPTO_dup_ex_data(STACK *meth,CRYPTO_EX_DATA *from,CRYPTO_EX_DATA *to);
-void CRYPTO_free_ex_data(STACK *meth,char *obj,CRYPTO_EX_DATA *ad);
-void CRYPTO_new_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad);
+int CRYPTO_get_ex_new_index(int idx, STACK_OF(CRYPTO_EX_DATA_FUNCS) **skp, long argl, void *argp,
+             CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val);
+void *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad,int idx);
+int CRYPTO_dup_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, CRYPTO_EX_DATA *to,
+             CRYPTO_EX_DATA *from);
+void CRYPTO_free_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, void *obj, CRYPTO_EX_DATA *ad);
+void CRYPTO_new_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, void *obj, CRYPTO_EX_DATA *ad);
 
-int CRYPTO_mem_ctrl(int mode);
 int CRYPTO_get_new_lockid(char *name);
 
 int CRYPTO_num_locks(void); /* return CRYPTO_NUM_LOCKS (shared libs!) */
@@ -289,22 +298,51 @@ const char *CRYPTO_get_lock_name(int type);
 int CRYPTO_add_lock(int *pointer,int amount,int type, const char *file,
                     int line);
 
-void CRYPTO_set_mem_functions(char *(*m)(),char *(*r)(), void (*free_func)());
-void CRYPTO_get_mem_functions(char *(**m)(),char *(**r)(), void (**f)());
-void CRYPTO_set_locked_mem_functions(char *(*m)(), void (*free_func)());
-void CRYPTO_get_locked_mem_functions(char *(**m)(), void (**f)());
+/* CRYPTO_set_mem_functions includes CRYPTO_set_locked_mem_functions --
+ * call the latter last if you need different functions */
+int CRYPTO_set_mem_functions(void *(*m)(size_t),void *(*r)(void *,size_t), void (*f)(void *));
+int CRYPTO_set_locked_mem_functions(void *(*m)(size_t), void (*free_func)(void *));
+int CRYPTO_set_mem_debug_functions(void (*m)(),void (*r)(),void (*f)(),void (*so)(),long (*go)());
+void CRYPTO_get_mem_functions(void *(**m)(size_t),void *(**r)(void *, size_t), void (**f)(void *));
+void CRYPTO_get_locked_mem_functions(void *(**m)(size_t), void (**f)(void *));
+void CRYPTO_get_mem_debug_functions(void (**m)(),void (**r)(),void (**f)(),void (**so)(),long (**go)());
 
-void *CRYPTO_malloc_locked(int num);
+void *CRYPTO_malloc_locked(int num, const char *file, int line);
 void CRYPTO_free_locked(void *);
-void *CRYPTO_malloc(int num);
+void *CRYPTO_malloc(int num, const char *file, int line);
 void CRYPTO_free(void *);
-void *CRYPTO_realloc(void *addr,int num);
-void *CRYPTO_remalloc(void *addr,int num);
+void *CRYPTO_realloc(void *addr,int num, const char *file, int line);
+void *CRYPTO_remalloc(void *addr,int num, const char *file, int line);
+
+void CRYPTO_set_mem_debug_options(long bits);
+long CRYPTO_get_mem_debug_options(void);
+
+#define CRYPTO_push_info(info) \
+        CRYPTO_push_info_(info, __FILE__, __LINE__);
+int CRYPTO_push_info_(const char *info, const char *file, int line);
+int CRYPTO_pop_info(void);
+int CRYPTO_remove_all_info(void);
+
+/* The last argument has the following significance:
+ *
+ * 0:   called before the actual memory allocation has taken place
+ * 1:   called after the actual memory allocation has taken place
+ */
+void CRYPTO_dbg_malloc(void *addr,int num,const char *file,int line,int before_p);
+void CRYPTO_dbg_realloc(void *addr1,void *addr2,int num,const char *file,int line,int before_p);
+void CRYPTO_dbg_free(void *addr,int before_p);
+
+/* Tell the debugging code about options.  By default, the following values
+ * apply:
+ *
+ * 0:   Clear all options.
+ * 1:   Set the "Show Time" option.
+ * 2:   Set the "Show Thread Number" option.
+ * 3:   1 + 2
+ */
+void CRYPTO_dbg_set_options(long bits);
+long CRYPTO_dbg_get_options(void);
 
-void *CRYPTO_dbg_malloc(int num,const char *file,int line);
-void *CRYPTO_dbg_realloc(void *addr,int num,const char *file,int line);
-void CRYPTO_dbg_free(void *);
-void *CRYPTO_dbg_remalloc(void *addr,int num,const char *file,int line);
 #ifndef NO_FP_API
 void CRYPTO_mem_leaks_fp(FILE *);
 #endif
@@ -312,7 +350,7 @@ void CRYPTO_mem_leaks(struct bio_st *bio);
 /* unsigned long order, char *file, int line, int num_bytes, char *addr */
 void CRYPTO_mem_leaks_cb(void (*cb)());
 
-void ERR_load_CRYPTO_strings(void );
+void ERR_load_CRYPTO_strings(void);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
diff --git a/src/lib/libcrypto/des/Makefile.ssl b/src/lib/libcrypto/des/Makefile.ssl
index 7f9600cf02..41976655e9 100644
--- a/src/lib/libcrypto/des/Makefile.ssl
+++ b/src/lib/libcrypto/des/Makefile.ssl
@@ -15,6 +15,7 @@ MAKE=		make -f Makefile.ssl
 MAKEDEPEND=     $(TOP)/util/domd $(TOP)
 MAKEFILE=       Makefile.ssl
 AR=             ar r
+RANLIB=         ranlib
 DES_ENC=        des_enc.o fcrypt_b.o
 # or use
 #DES_ENC=       dx86-elf.o yx86-elf.o
@@ -162,14 +163,15 @@ enc_read.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 enc_read.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 enc_read.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 enc_read.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-enc_read.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-enc_read.o: ../cryptlib.h des_locl.h
+enc_read.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+enc_read.o: ../../include/openssl/stack.h ../cryptlib.h des_locl.h
 enc_writ.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 enc_writ.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 enc_writ.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 enc_writ.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 enc_writ.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-enc_writ.o: ../../include/openssl/stack.h ../cryptlib.h des_locl.h
+enc_writ.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+enc_writ.o: ../cryptlib.h des_locl.h
 fcrypt.o: ../../include/openssl/des.h ../../include/openssl/des.h
 fcrypt.o: ../../include/openssl/e_os2.h ../../include/openssl/e_os2.h
 fcrypt.o: ../../include/openssl/opensslconf.h
@@ -187,15 +189,15 @@ pcbc_enc.o: ../../include/openssl/opensslconf.h des_locl.h
 qud_cksm.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
 qud_cksm.o: ../../include/openssl/opensslconf.h des_locl.h
 rand_key.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
-rand_key.o: ../../include/openssl/opensslconf.h des_locl.h
+rand_key.o: ../../include/openssl/opensslconf.h ../../include/openssl/rand.h
 read2pwd.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
 read2pwd.o: ../../include/openssl/opensslconf.h des_locl.h
 read_pwd.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 read_pwd.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 read_pwd.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 read_pwd.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-read_pwd.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-read_pwd.o: ../cryptlib.h des_locl.h
+read_pwd.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+read_pwd.o: ../../include/openssl/stack.h ../cryptlib.h des_locl.h
 rpc_enc.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
 rpc_enc.o: ../../include/openssl/opensslconf.h des_locl.h des_ver.h rpc_des.h
 set_key.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
diff --git a/src/lib/libcrypto/des/cbc3_enc.c b/src/lib/libcrypto/des/cbc3_enc.c
index 3863a676d4..527e74f3de 100644
--- a/src/lib/libcrypto/des/cbc3_enc.c
+++ b/src/lib/libcrypto/des/cbc3_enc.c
@@ -58,7 +58,7 @@
 
 #include "des_locl.h"
 
-/* HAS BUGS? DON'T USE - this is only present for use in des.c */
+/* HAS BUGS! DON'T USE - this is only present for use in des.c */
 void des_3cbc_encrypt(des_cblock *input, des_cblock *output, long length,
              des_key_schedule ks1, des_key_schedule ks2, des_cblock *iv1,
              des_cblock *iv2, int enc)
@@ -69,11 +69,14 @@ void des_3cbc_encrypt(des_cblock *input, des_cblock *output, long length,
 
         if (enc == DES_ENCRYPT)
                 {
-                des_cbc_encrypt(input,output,length,ks1,iv1,enc);
+                des_cbc_encrypt((unsigned char*)input,
+                                (unsigned char*)output,length,ks1,iv1,enc);
                 if (length >= sizeof(des_cblock))
                         memcpy(niv1,output[off],sizeof(des_cblock));
-                des_cbc_encrypt(output,output,l8,ks2,iv1,!enc);
-                des_cbc_encrypt(output,output,l8,ks1,iv2, enc);
+                des_cbc_encrypt((unsigned char*)output,
+                                (unsigned char*)output,l8,ks2,iv1,!enc);
+                des_cbc_encrypt((unsigned char*)output,
+                                (unsigned char*)output,l8,ks1,iv2,enc);
                 if (length >= sizeof(des_cblock))
                         memcpy(niv2,output[off],sizeof(des_cblock));
                 }
@@ -81,11 +84,14 @@ void des_3cbc_encrypt(des_cblock *input, des_cblock *output, long length,
                 {
                 if (length >= sizeof(des_cblock))
                         memcpy(niv2,input[off],sizeof(des_cblock));
-                des_cbc_encrypt(input,output,l8,ks1,iv2,enc);
-                des_cbc_encrypt(output,output,l8,ks2,iv1,!enc);
+                des_cbc_encrypt((unsigned char*)input,
+                                (unsigned char*)output,l8,ks1,iv2,enc);
+                des_cbc_encrypt((unsigned char*)output,
+                                (unsigned char*)output,l8,ks2,iv1,!enc);
                 if (length >= sizeof(des_cblock))
                         memcpy(niv1,output[off],sizeof(des_cblock));
-                des_cbc_encrypt(output,output,length,ks1,iv1, enc);
+                des_cbc_encrypt((unsigned char*)output,
+                                (unsigned char*)output,length,ks1,iv1,enc);
                 }
         memcpy(*iv1,niv1,sizeof(des_cblock));
         memcpy(*iv2,niv2,sizeof(des_cblock));
diff --git a/src/lib/libcrypto/des/des.c b/src/lib/libcrypto/des/des.c
index b2d7f0da78..91d7153b34 100644
--- a/src/lib/libcrypto/des/des.c
+++ b/src/lib/libcrypto/des/des.c
@@ -325,25 +325,25 @@ void usage(void)
 "des <options> [input-file [output-file]]",
 "options:",
 "-v         : des(1) version number",
-"-e         : encrypt using sunOS compatible user key to DES key conversion.",
+"-e         : encrypt using SunOS compatible user key to DES key conversion.",
 "-E         : encrypt ",
-"-d         : decrypt using sunOS compatible user key to DES key conversion.",
+"-d         : decrypt using SunOS compatible user key to DES key conversion.",
 "-D         : decrypt ",
-"-c[ckname] : generate a cbc_cksum using sunOS compatible user key to",
+"-c[ckname] : generate a cbc_cksum using SunOS compatible user key to",
 "             DES key conversion and output to ckname (stdout default,",
 "             stderr if data being output on stdout).  The checksum is",
 "             generated before encryption and after decryption if used",
 "             in conjunction with -[eEdD].",
 "-C[ckname] : generate a cbc_cksum as for -c but compatible with -[ED].",
 "-k key     : use key 'key'",
-"-h         : the key that is entered will be a hexidecimal number",
+"-h         : the key that is entered will be a hexadecimal number",
 "             that is used directly as the des key",
 "-u[uuname] : input file is uudecoded if -[dD] or output uuencoded data if -[eE]",
 "             (uuname is the filename to put in the uuencode header).",
-"-b         : encrypt using DES in ecb encryption mode, the defaut is cbc mode.",
-"-3         : encrypt using tripple DES encryption.  This uses 2 keys",
+"-b         : encrypt using DES in ecb encryption mode, the default is cbc mode.",
+"-3         : encrypt using triple DES encryption.  This uses 2 keys",
 "             generated from the input key.  If the input key is less",
-"             than 8 characters long, this is equivelent to normal",
+"             than 8 characters long, this is equivalent to normal",
 "             encryption.  Default is triple cbc, -b makes it triple ecb.",
 NULL
 };
@@ -425,7 +425,7 @@ void doencryption(void)
                         else
                                 k2[i-8]=k;
                         }
-                des_set_key(&k2,ks2);
+                des_set_key_unchecked(&k2,ks2);
                 memset(k2,0,sizeof(k2));
                 }
         else if (longk || flag3)
@@ -433,7 +433,7 @@ void doencryption(void)
                 if (flag3)
                         {
                         des_string_to_2keys(key,&kk,&k2);
-                        des_set_key(&k2,ks2);
+                        des_set_key_unchecked(&k2,ks2);
                         memset(k2,0,sizeof(k2));
                         }
                 else
@@ -455,7 +455,7 @@ void doencryption(void)
                                 kk[i]=key[i]|0x80;
                         }
 
-        des_set_key(&kk,ks);
+        des_set_key_unchecked(&kk,ks);
         memset(key,0,sizeof(key));
         memset(kk,0,sizeof(kk));
         /* woops - A bug that does not showup under unix :-( */
@@ -484,7 +484,7 @@ void doencryption(void)
                         if (feof(DES_IN))
                                 {
                                 for (i=7-rem; i>0; i--)
-                                        RAND_bytes(buf + l++, 1);
+                                        RAND_pseudo_bytes(buf + l++, 1);
                                 buf[l++]=rem;
                                 ex=1;
                                 len+=rem;
diff --git a/src/lib/libcrypto/des/des.h b/src/lib/libcrypto/des/des.h
index 67f90aaf17..98a9c4127c 100644
--- a/src/lib/libcrypto/des/des.h
+++ b/src/lib/libcrypto/des/des.h
@@ -186,15 +186,20 @@ void des_pcbc_encrypt(const unsigned char *input,unsigned char *output,
 DES_LONG des_quad_cksum(const unsigned char *input,des_cblock output[],
                         long length,int out_count,des_cblock *seed);
 void des_random_seed(des_cblock *key);
-void des_random_key(des_cblock *ret);
+int des_random_key(des_cblock *ret);
 int des_read_password(des_cblock *key,const char *prompt,int verify);
 int des_read_2passwords(des_cblock *key1,des_cblock *key2,
                         const char *prompt,int verify);
 int des_read_pw_string(char *buf,int length,const char *prompt,int verify);
 void des_set_odd_parity(des_cblock *key);
 int des_is_weak_key(const_des_cblock *key);
+/* des_set_key (= set_key = des_key_sched = key_sched) calls
+ * des_set_key_checked if global variable des_check_key is set,
+ * des_set_key_unchecked otherwise. */
 int des_set_key(const_des_cblock *key,des_key_schedule schedule);
 int des_key_sched(const_des_cblock *key,des_key_schedule schedule);
+int des_set_key_checked(const_des_cblock *key,des_key_schedule schedule);
+void des_set_key_unchecked(const_des_cblock *key,des_key_schedule schedule);
 void des_string_to_key(const char *str,des_cblock *key);
 void des_string_to_2keys(const char *str,des_cblock *key1,des_cblock *key2);
 void des_cfb64_encrypt(const unsigned char *in,unsigned char *out,long length,
diff --git a/src/lib/libcrypto/des/des_locl.h b/src/lib/libcrypto/des/des_locl.h
index d6ea17cb68..4dfed199a7 100644
--- a/src/lib/libcrypto/des/des_locl.h
+++ b/src/lib/libcrypto/des/des_locl.h
@@ -72,7 +72,11 @@
 
 #ifndef MSDOS
 #if !defined(VMS) || defined(__DECC)
-#include OPENSSL_UNISTD
+#ifdef OPENSSL_UNISTD
+# include OPENSSL_UNISTD
+#else
+# include <unistd.h>
+#endif
 #include <math.h>
 #endif
 #endif
@@ -178,14 +182,14 @@
 #endif
 
 /* The changes to this macro may help or hinder, depending on the
- * compiler and the achitecture.  gcc2 always seems to do well :-).
+ * compiler and the architecture.  gcc2 always seems to do well :-).
  * Inspired by Dana How <how@isl.stanford.edu>
  * DO NOT use the alternative version on machines with 8 byte longs.
  * It does not seem to work on the Alpha, even when DES_LONG is 4
  * bytes, probably an issue of accessing non-word aligned objects :-( */
 #ifdef DES_PTR
 
-/* It recently occured to me that 0^0^0^0^0^0^0 == 0, so there
+/* It recently occurred to me that 0^0^0^0^0^0^0 == 0, so there
  * is no reason to not xor all the sub items together.  This potentially
  * saves a register since things can be xored directly into L */
 
diff --git a/src/lib/libcrypto/des/des_opts.c b/src/lib/libcrypto/des/des_opts.c
index 746c456f8f..b2ca7ac31d 100644
--- a/src/lib/libcrypto/des/des_opts.c
+++ b/src/lib/libcrypto/des/des_opts.c
@@ -434,17 +434,17 @@ int main(int argc, char **argv)
                 }
 
 #ifndef TIMES
-        fprintf(stderr,"To get the most acurate results, try to run this\n");
+        fprintf(stderr,"To get the most accurate results, try to run this\n");
         fprintf(stderr,"program when this computer is idle.\n");
 #endif
 
-        des_set_key(&key,sch);
-        des_set_key(&key2,sch2);
-        des_set_key(&key3,sch3);
+        des_set_key_unchecked(&key,sch);
+        des_set_key_unchecked(&key2,sch2);
+        des_set_key_unchecked(&key3,sch3);
 
 #ifndef SIGALRM
         fprintf(stderr,"First we calculate the approximate speed ...\n");
-        des_set_key(&key,sch);
+        des_set_key_unchecked(&key,sch);
         count=10;
         do      {
                 long i;
diff --git a/src/lib/libcrypto/des/destest.c b/src/lib/libcrypto/des/destest.c
index 5a04fc9298..9ad4ecb072 100644
--- a/src/lib/libcrypto/des/destest.c
+++ b/src/lib/libcrypto/des/destest.c
@@ -234,7 +234,7 @@ static unsigned char cipher_ecb2[NUM_TESTS-1][8]={
         {0x08,0xD7,0xB4,0xFB,0x62,0x9D,0x08,0x85}};
 
 static unsigned char cbc_key [8]={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
-static unsigned char cbc2_key[8]={0xf0,0xe1,0xd2,0xc3,0xb4,0xa5,0x96,0x87};
+static unsigned char cbc2_key[8]={0xf1,0xe0,0xd3,0xc2,0xb5,0xa4,0x97,0x86};
 static unsigned char cbc3_key[8]={0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10};
 static unsigned char cbc_iv  [8]={0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10};
 /* Changed the following text constant to binary so it will work on ebcdic
@@ -254,12 +254,24 @@ static unsigned char cbc_ok[32]={
         0x46,0x8e,0x91,0x15,0x78,0x88,0xba,0x68,
         0x1d,0x26,0x93,0x97,0xf7,0xfe,0x62,0xb4};
 
+#ifdef SCREW_THE_PARITY
+#error "SCREW_THE_PARITY is not ment to be defined."
+#error "Original vectors are preserved for reference only."
+static unsigned char cbc2_key[8]={0xf0,0xe1,0xd2,0xc3,0xb4,0xa5,0x96,0x87};
 static unsigned char xcbc_ok[32]={
         0x86,0x74,0x81,0x0D,0x61,0xA4,0xA5,0x48,
         0xB9,0x93,0x03,0xE1,0xB8,0xBB,0xBD,0xBD,
         0x64,0x30,0x0B,0xB9,0x06,0x65,0x81,0x76,
         0x04,0x1D,0x77,0x62,0x17,0xCA,0x2B,0xD2,
         };
+#else
+static unsigned char xcbc_ok[32]={
+        0x84,0x6B,0x29,0x14,0x85,0x1E,0x9A,0x29,
+        0x54,0x73,0x2F,0x8A,0xA0,0xA6,0x11,0xC1,
+        0x15,0xCD,0xC2,0xD7,0x95,0x1B,0x10,0x53,
+        0xA6,0x3C,0x5E,0x03,0xB2,0x1A,0xA3,0xC4,
+        };
+#endif
 
 static unsigned char cbc3_ok[32]={
         0x3F,0xE3,0x01,0xC9,0x62,0xAC,0x01,0xD0,
@@ -309,8 +321,8 @@ static unsigned char ofb_cipher[24]=
         0x3d,0x6d,0x5b,0xe3,0x25,0x5a,0xf8,0xc3
         };
 
-DES_LONG cbc_cksum_ret=0xB462FEF7L;
-unsigned char cbc_cksum_data[8]={0x1D,0x26,0x93,0x97,0xf7,0xfe,0x62,0xb4};
+static DES_LONG cbc_cksum_ret=0xB462FEF7L;
+static unsigned char cbc_cksum_data[8]={0x1D,0x26,0x93,0x97,0xf7,0xfe,0x62,0xb4};
 
 static char *pt(unsigned char *p);
 static int cfb_test(int bits, unsigned char *cfb_cipher);
@@ -331,17 +343,17 @@ int main(int argc, char *argv[])
 
 #ifndef NO_DESCBCM
         printf("Doing cbcm\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
                 }
-        if ((j=des_key_sched(&cbc2_key,ks2)) != 0)
+        if ((j=des_set_key_checked(&cbc2_key,ks2)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
                 }
-        if ((j=des_key_sched(&cbc3_key,ks3)) != 0)
+        if ((j=des_set_key_checked(&cbc3_key,ks3)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -385,11 +397,7 @@ int main(int argc, char *argv[])
         printf("Doing ecb\n");
         for (i=0; i<NUM_TESTS; i++)
                 {
-                if ((j=des_key_sched(&key_data[i],ks)) != 0)
-                        {
-                        printf("Key error %2d:%d\n",i+1,j);
-                        err=1;
-                        }
+                des_set_key_unchecked(&key_data[i],ks);
                 memcpy(in,plain_data[i],8);
                 memset(out,0,8);
                 memset(outin,0,8);
@@ -415,21 +423,9 @@ int main(int argc, char *argv[])
         printf("Doing ede ecb\n");
         for (i=0; i<(NUM_TESTS-1); i++)
                 {
-                if ((j=des_key_sched(&key_data[i],ks)) != 0)
-                        {
-                        err=1;
-                        printf("Key error %2d:%d\n",i+1,j);
-                        }
-                if ((j=des_key_sched(&key_data[i+1],ks2)) != 0)
-                        {
-                        printf("Key error %2d:%d\n",i+2,j);
-                        err=1;
-                        }
-                if ((j=des_key_sched(&key_data[i+2],ks3)) != 0)
-                        {
-                        printf("Key error %2d:%d\n",i+3,j);
-                        err=1;
-                        }
+                des_set_key_unchecked(&key_data[i],ks);
+                des_set_key_unchecked(&key_data[i+1],ks2);
+                des_set_key_unchecked(&key_data[i+2],ks3);
                 memcpy(in,plain_data[i],8);
                 memset(out,0,8);
                 memset(outin,0,8);
@@ -453,7 +449,7 @@ int main(int argc, char *argv[])
 #endif
 
         printf("Doing cbc\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -464,7 +460,10 @@ int main(int argc, char *argv[])
         des_ncbc_encrypt(cbc_data,cbc_out,strlen((char *)cbc_data)+1,ks,
                          &iv3,DES_ENCRYPT);
         if (memcmp(cbc_out,cbc_ok,32) != 0)
+                {
                 printf("cbc_encrypt encrypt error\n");
+                err=1;
+                }
 
         memcpy(iv3,cbc_iv,sizeof(cbc_iv));
         des_ncbc_encrypt(cbc_out,cbc_in,strlen((char *)cbc_data)+1,ks,
@@ -477,7 +476,7 @@ int main(int argc, char *argv[])
 
 #ifndef LIBDES_LIT
         printf("Doing desx cbc\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -490,6 +489,7 @@ int main(int argc, char *argv[])
         if (memcmp(cbc_out,xcbc_ok,32) != 0)
                 {
                 printf("des_xcbc_encrypt encrypt error\n");
+                err=1;
                 }
         memcpy(iv3,cbc_iv,sizeof(cbc_iv));
         des_xcbc_encrypt(cbc_out,cbc_in,strlen((char *)cbc_data)+1,ks,
@@ -502,17 +502,17 @@ int main(int argc, char *argv[])
 #endif
 
         printf("Doing ede cbc\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
                 }
-        if ((j=des_key_sched(&cbc2_key,ks2)) != 0)
+        if ((j=des_set_key_checked(&cbc2_key,ks2)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
                 }
-        if ((j=des_key_sched(&cbc3_key,ks3)) != 0)
+        if ((j=des_set_key_checked(&cbc3_key,ks3)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -543,7 +543,7 @@ int main(int argc, char *argv[])
 
 #ifndef LIBDES_LIT
         printf("Doing pcbc\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -606,7 +606,7 @@ int main(int argc, char *argv[])
         printf("done\n");
 
         printf("Doing ofb\n");
-        des_key_sched(&ofb_key,ks);
+        des_set_key_checked(&ofb_key,ks);
         memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
         des_ofb_encrypt(plain,ofb_buf1,64,sizeof(plain)/8,ks,&ofb_tmp);
         if (memcmp(ofb_cipher,ofb_buf1,sizeof(ofb_buf1)) != 0)
@@ -635,7 +635,7 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 }
 
         printf("Doing ofb64\n");
-        des_key_sched(&ofb_key,ks);
+        des_set_key_checked(&ofb_key,ks);
         memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
         memset(ofb_buf1,0,sizeof(ofb_buf1));
         memset(ofb_buf2,0,sizeof(ofb_buf1));
@@ -660,7 +660,7 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 }
 
         printf("Doing ede_ofb64\n");
-        des_key_sched(&ofb_key,ks);
+        des_set_key_checked(&ofb_key,ks);
         memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
         memset(ofb_buf1,0,sizeof(ofb_buf1));
         memset(ofb_buf2,0,sizeof(ofb_buf1));
@@ -686,7 +686,7 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 }
 
         printf("Doing cbc_cksum\n");
-        des_key_sched(&cbc_key,ks);
+        des_set_key_checked(&cbc_key,ks);
         cs=des_cbc_cksum(cbc_data,&cret,strlen((char *)cbc_data),ks,&cbc_iv);
         if (cs != cbc_cksum_ret)
                 {
@@ -795,8 +795,7 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 err=1;
                 }
         printf("\n");
-        exit(err);
-        return(0);
+        return(err);
         }
 
 static char *pt(unsigned char *p)
@@ -825,7 +824,7 @@ static int cfb_test(int bits, unsigned char *cfb_cipher)
         des_key_schedule ks;
         int i,err=0;
 
-        des_key_sched(&cfb_key,ks);
+        des_set_key_checked(&cfb_key,ks);
         memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
         des_cfb_encrypt(plain,cfb_buf1,bits,sizeof(plain),ks,&cfb_tmp,
                         DES_ENCRYPT);
@@ -854,7 +853,7 @@ static int cfb64_test(unsigned char *cfb_cipher)
         des_key_schedule ks;
         int err=0,i,n;
 
-        des_key_sched(&cfb_key,ks);
+        des_set_key_checked(&cfb_key,ks);
         memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
         n=0;
         des_cfb64_encrypt(plain,cfb_buf1,12,ks,&cfb_tmp,&n,DES_ENCRYPT);
@@ -887,7 +886,7 @@ static int ede_cfb64_test(unsigned char *cfb_cipher)
         des_key_schedule ks;
         int err=0,i,n;
 
-        des_key_sched(&cfb_key,ks);
+        des_set_key_checked(&cfb_key,ks);
         memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
         n=0;
         des_ede3_cfb64_encrypt(plain,cfb_buf1,12,ks,ks,ks,&cfb_tmp,&n,
diff --git a/src/lib/libcrypto/des/enc_read.c b/src/lib/libcrypto/des/enc_read.c
index 694970ccd2..7399ff7269 100644
--- a/src/lib/libcrypto/des/enc_read.c
+++ b/src/lib/libcrypto/des/enc_read.c
@@ -147,7 +147,7 @@ int des_enc_read(int fd, void *buf, int len, des_key_schedule sched,
         /* first - get the length */
         while (net_num < HDRSIZE) 
                 {
-                i=read(fd,&(net[net_num]),HDRSIZE-net_num);
+                i=read(fd,(void *)&(net[net_num]),HDRSIZE-net_num);
 #ifdef EINTR
                 if ((i == -1) && (errno == EINTR)) continue;
 #endif
@@ -169,7 +169,7 @@ int des_enc_read(int fd, void *buf, int len, des_key_schedule sched,
         net_num=0;
         while (net_num < rnum)
                 {
-                i=read(fd,&(net[net_num]),rnum-net_num);
+                i=read(fd,(void *)&(net[net_num]),rnum-net_num);
 #ifdef EINTR
                 if ((i == -1) && (errno == EINTR)) continue;
 #endif
diff --git a/src/lib/libcrypto/des/enc_writ.c b/src/lib/libcrypto/des/enc_writ.c
index ba3f0822ef..4d3452724e 100644
--- a/src/lib/libcrypto/des/enc_writ.c
+++ b/src/lib/libcrypto/des/enc_writ.c
@@ -130,12 +130,12 @@ int des_enc_write(int fd, const void *_buf, int len,
                 {
                 cp=shortbuf;
                 memcpy(shortbuf,buf,len);
-                RAND_bytes(shortbuf+len, 8-len);
+                RAND_pseudo_bytes(shortbuf+len, 8-len);
                 rnum=8;
                 }
         else
                 {
-                cp=(unsigned char*)buf;
+                cp=buf;
                 rnum=((len+7)/8*8); /* round up to nearest eight */
                 }
 
@@ -152,13 +152,16 @@ int des_enc_write(int fd, const void *_buf, int len,
         for (j=0; j<outnum; j+=i)
                 {
                 /* eay 26/08/92 I was not doing writing from where we
-                 * got upto. */
-                i=write(fd,&(outbuf[j]),outnum-j);
+                 * got up to. */
+                i=write(fd,(void *)&(outbuf[j]),outnum-j);
                 if (i == -1)
                         {
+#ifdef EINTR
                         if (errno == EINTR)
                                 i=0;
-                        else    /* This is really a bad error - very bad
+                        else
+#endif
+                                /* This is really a bad error - very bad
                                  * It will stuff-up both ends. */
                                 return(-1);
                         }
diff --git a/src/lib/libcrypto/des/fcrypt.c b/src/lib/libcrypto/des/fcrypt.c
index f36746b376..fa1b8aa34a 100644
--- a/src/lib/libcrypto/des/fcrypt.c
+++ b/src/lib/libcrypto/des/fcrypt.c
@@ -1,7 +1,7 @@
 /* NOCW */
 #include <stdio.h>
 
-/* This version of crypt has been developed from my MIT compatable
+/* This version of crypt has been developed from my MIT compatible
  * DES library.
  * The library is available at pub/Crypto/DES at ftp.psy.uq.oz.au
  * Eric Young (eay@cryptsoft.com)
@@ -11,7 +11,7 @@
  * I have included directive PARA for shared memory computers.
  * I have included a directive LONGCRYPT to using this routine to cipher
  * passwords with more then 8 bytes like HP-UX 10.x it used. The MAXPLEN
- * definition is the maximum of lenght of password and can changed. I have
+ * definition is the maximum of length of password and can changed. I have
  * defined 24.
  */
 
@@ -103,8 +103,8 @@ char *ret;
          * returns *\0XXXXXXXXX
          * The \0 makes the string look like * so the pwd "*" would
          * crypt to "*".  This was found when replacing the crypt in
-         * our shared libraries.  People found that the disbled
-         * accounts effectivly had no passwd :-(. */
+         * our shared libraries.  People found that the disabled
+         * accounts effectively had no passwd :-(. */
         x=ret[0]=((salt[0] == '\0')?'A':salt[0]);
         Eswap0=con_salt[x]<<2;
         x=ret[1]=((salt[1] == '\0')?'A':salt[1]);
@@ -123,7 +123,7 @@ r=(r+7)/8;
         for (; i<8; i++)
                 key[i]=0;
 
-        des_set_key((des_cblock *)(key),ks);
+        des_set_key_unchecked(&key,ks);
         fcrypt_body(&(out[0]),ks,Eswap0,Eswap1);
 
         ll=out[0]; l2c(ll,b);
diff --git a/src/lib/libcrypto/des/fcrypt_b.c b/src/lib/libcrypto/des/fcrypt_b.c
index 9cbea97c1f..83c94054e3 100644
--- a/src/lib/libcrypto/des/fcrypt_b.c
+++ b/src/lib/libcrypto/des/fcrypt_b.c
@@ -58,7 +58,7 @@
 
 #include <stdio.h>
 
-/* This version of crypt has been developed from my MIT compatable
+/* This version of crypt has been developed from my MIT compatible
  * DES library.
  * The library is available at pub/Crypto/DES at ftp.psy.uq.oz.au
  * Eric Young (eay@cryptsoft.com)
diff --git a/src/lib/libcrypto/des/rand_key.c b/src/lib/libcrypto/des/rand_key.c
index fc11792cda..7816a8f25c 100644
--- a/src/lib/libcrypto/des/rand_key.c
+++ b/src/lib/libcrypto/des/rand_key.c
@@ -1,114 +1,69 @@
 /* crypto/des/rand_key.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
  * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
  */
 
-#include "des_locl.h"
-#include <time.h>
-
-static int seed=0;
-static des_cblock init;
+#include <openssl/des.h>
+#include <openssl/rand.h>
 
 void des_random_seed(des_cblock *key)
         {
-        memcpy(&init,key,sizeof(des_cblock));
-        seed=1;
+        RAND_seed(key, sizeof(des_cblock));
         }
 
-void des_random_key(des_cblock *ret)
+int des_random_key(des_cblock *ret)
         {
-        des_key_schedule ks;
-        static DES_LONG c=0;
-        static unsigned short pid=0;
-        static des_cblock data={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
-        des_cblock key;
-        unsigned char *p;
-        DES_LONG t;
-        int i;
-
-#ifdef MSDOS
-        pid=1;
-#else
-        if (!pid) pid=getpid();
-#endif
-        p=key;
-        if (seed)
-                {
-                for (i=0; i<8; i++)
-                        {
-                        data[i] ^= init[i];
-                        init[i]=0;
-                        }
-                seed=0;
-                }
-        t=(DES_LONG)time(NULL);
-        l2c(t,p);
-        t=(DES_LONG)((pid)|((c++)<<16));
-        l2c(t,p);
-
-        des_set_odd_parity(&data);
-        des_set_key(&data,ks);
-        des_cbc_cksum(key,&key,sizeof(key),ks,&data);
-
-        des_set_odd_parity(&key);
-        des_set_key(&key,ks);
-        des_cbc_cksum(key,&data,sizeof(key),ks,&key);
-
-        memcpy(ret,data,sizeof(key));
-        memset(key,0,sizeof(key));
-        memset(ks,0,sizeof(ks));
-        t=0;
+        int r = RAND_bytes((unsigned char *)ret, sizeof(des_cblock));
+        des_set_odd_parity(ret);
+        return r;
         }
diff --git a/src/lib/libcrypto/des/read_pwd.c b/src/lib/libcrypto/des/read_pwd.c
index fed49652c0..fa2d67da64 100644
--- a/src/lib/libcrypto/des/read_pwd.c
+++ b/src/lib/libcrypto/des/read_pwd.c
@@ -58,7 +58,11 @@
 
 #if !defined(MSDOS) && !defined(VMS) && !defined(WIN32)
 #include <openssl/opensslconf.h>
-#include OPENSSL_UNISTD
+#ifdef OPENSSL_UNISTD
+# include OPENSSL_UNISTD
+#else
+# include <unistd.h>
+#endif
 /* If unistd.h defines _POSIX_VERSION, we conclude that we
  * are on a POSIX system and have sigaction and termios. */
 #if defined(_POSIX_VERSION)
@@ -123,7 +127,7 @@
 #undef  SGTTY
 #endif
 
-#if !defined(TERMIO) && !defined(TERMIOS) && !defined(VMS) && !defined(MSDOS)
+#if !defined(TERMIO) && !defined(TERMIOS) && !defined(VMS) && !defined(MSDOS) && !defined(MAC_OS_pre_X) && !defined(MAC_OS_GUSI_SOURCE)
 #undef  TERMIOS
 #undef  TERMIO
 #define SGTTY
@@ -153,7 +157,7 @@
 #define TTY_set(tty,data)       ioctl(tty,TIOCSETP,data)
 #endif
 
-#if !defined(_LIBC) && !defined(MSDOS) && !defined(VMS)
+#if !defined(_LIBC) && !defined(MSDOS) && !defined(VMS) && !defined(MAC_OS_pre_X)
 #include <sys/ioctl.h>
 #endif
 
@@ -174,6 +178,15 @@ struct IOSB {
         };
 #endif
 
+#if defined(MAC_OS_pre_X) || defined(MAC_OS_GUSI_SOURCE)
+/*
+ * This one needs work. As a matter of fact the code is unoperational
+ * and this is only a trick to get it compiled.
+ *                                      <appro@fy.chalmers.se>
+ */
+#define TTY_STRUCT int
+#endif
+
 #ifndef NX509_SIG
 #define NX509_SIG 32
 #endif
diff --git a/src/lib/libcrypto/des/rpc_enc.c b/src/lib/libcrypto/des/rpc_enc.c
index c96c204147..32d96d5cae 100644
--- a/src/lib/libcrypto/des/rpc_enc.c
+++ b/src/lib/libcrypto/des/rpc_enc.c
@@ -66,7 +66,7 @@ int _des_crypt(char *buf, int len, struct desparams *desp)
         des_key_schedule ks;
         int enc;
 
-        des_set_key(&desp->des_key,ks);
+        des_set_key_unchecked(&desp->des_key,ks);
         enc=(desp->des_dir == ENCRYPT)?DES_ENCRYPT:DES_DECRYPT;
 
         if (desp->des_mode == CBC)
diff --git a/src/lib/libcrypto/des/set_key.c b/src/lib/libcrypto/des/set_key.c
index 52553a4c16..bbdc71ba6b 100644
--- a/src/lib/libcrypto/des/set_key.c
+++ b/src/lib/libcrypto/des/set_key.c
@@ -125,7 +125,7 @@ int des_is_weak_key(const_des_cblock *key)
         int i;
 
         for (i=0; i<NUM_WEAK_KEY; i++)
-                /* Added == 0 to comparision, I obviously don't run
+                /* Added == 0 to comparison, I obviously don't run
                  * this section very often :-(, thanks to
                  * engineering@MorningStar.Com for the fix
                  * eay 93/06/29
@@ -145,11 +145,34 @@ int des_is_weak_key(const_des_cblock *key)
 #define HPERM_OP(a,t,n,m) ((t)=((((a)<<(16-(n)))^(a))&(m)),\
         (a)=(a)^(t)^(t>>(16-(n))))
 
+int des_set_key(const_des_cblock *key, des_key_schedule schedule)
+        {
+        if (des_check_key)
+                {
+                return des_set_key_checked(key, schedule);
+                }
+        else
+                {
+                des_set_key_unchecked(key, schedule);
+                return 0;
+                }
+        }
+
 /* return 0 if key parity is odd (correct),
  * return -1 if key parity error,
  * return -2 if illegal weak key.
  */
-int des_set_key(const_des_cblock *key, des_key_schedule schedule)
+int des_set_key_checked(const_des_cblock *key, des_key_schedule schedule)
+        {
+        if (!check_parity(key))
+                return(-1);
+        if (des_is_weak_key(key))
+                return(-2);
+        des_set_key_unchecked(key, schedule);
+        return 0;
+        }
+
+void des_set_key_unchecked(const_des_cblock *key, des_key_schedule schedule)
         {
         static int shifts2[16]={0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0};
         register DES_LONG c,d,t,s,t2;
@@ -157,15 +180,6 @@ int des_set_key(const_des_cblock *key, des_key_schedule schedule)
         register DES_LONG *k;
         register int i;
 
-        if (des_check_key)
-                {
-                if (!check_parity(key))
-                        return(-1);
-
-                if (des_is_weak_key(key))
-                        return(-2);
-                }
-
         k = &schedule->ks.deslong[0];
         in = &(*key)[0];
 
@@ -225,7 +239,6 @@ int des_set_key(const_des_cblock *key, des_key_schedule schedule)
                 t2=((s>>16L)|(t&0xffff0000L));
                 *(k++)=ROTATE(t2,26)&0xffffffffL;
                 }
-        return(0);
         }
 
 int des_key_sched(const_des_cblock *key, des_key_schedule schedule)
diff --git a/src/lib/libcrypto/des/speed.c b/src/lib/libcrypto/des/speed.c
index da41abcb03..814b86f4ae 100644
--- a/src/lib/libcrypto/des/speed.c
+++ b/src/lib/libcrypto/des/speed.c
@@ -186,16 +186,16 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
-        des_set_key(&key2,sch2);
-        des_set_key(&key3,sch3);
+        des_set_key_unchecked(&key2,sch2);
+        des_set_key_unchecked(&key3,sch3);
 
 #ifndef SIGALRM
         printf("First we calculate the approximate speed ...\n");
-        des_set_key(&key,sch);
+        des_set_key_unchecked(&key,sch);
         count=10;
         do      {
                 long i;
@@ -225,7 +225,7 @@ int main(int argc, char **argv)
 
         Time_F(START);
         for (count=0,run=1; COND(ca); count++)
-                des_set_key(&key,sch);
+                des_set_key_unchecked(&key,sch);
         d=Time_F(STOP);
         printf("%ld set_key's in %.2f seconds\n",count,d);
         a=((double)COUNT(ca))/d;
diff --git a/src/lib/libcrypto/des/str2key.c b/src/lib/libcrypto/des/str2key.c
index 24841452f1..c6abb87201 100644
--- a/src/lib/libcrypto/des/str2key.c
+++ b/src/lib/libcrypto/des/str2key.c
@@ -58,8 +58,6 @@
 
 #include "des_locl.h"
 
-OPENSSL_EXTERN int des_check_key;
-
 void des_string_to_key(const char *str, des_cblock *key)
         {
         des_key_schedule ks;
@@ -88,11 +86,8 @@ void des_string_to_key(const char *str, des_cblock *key)
                 }
 #endif
         des_set_odd_parity(key);
-        i=des_check_key;
-        des_check_key=0;
-        des_set_key(key,ks);
-        des_check_key=i;
-        des_cbc_cksum((unsigned char*)str,key,length,ks,key);
+        des_set_key_unchecked(key,ks);
+        des_cbc_cksum((const unsigned char*)str,key,length,ks,key);
         memset(ks,0,sizeof(ks));
         des_set_odd_parity(key);
         }
@@ -150,13 +145,10 @@ void des_string_to_2keys(const char *str, des_cblock *key1, des_cblock *key2)
 #endif
         des_set_odd_parity(key1);
         des_set_odd_parity(key2);
-        i=des_check_key;
-        des_check_key=0;
-        des_set_key(key1,ks);
-        des_cbc_cksum((unsigned char*)str,key1,length,ks,key1);
-        des_set_key(key2,ks);
-        des_cbc_cksum((unsigned char*)str,key2,length,ks,key2);
-        des_check_key=i;
+        des_set_key_unchecked(key1,ks);
+        des_cbc_cksum((const unsigned char*)str,key1,length,ks,key1);
+        des_set_key_unchecked(key2,ks);
+        des_cbc_cksum((const unsigned char*)str,key2,length,ks,key2);
         memset(ks,0,sizeof(ks));
         des_set_odd_parity(key1);
         des_set_odd_parity(key2);
diff --git a/src/lib/libcrypto/dh/Makefile.ssl b/src/lib/libcrypto/dh/Makefile.ssl
index 3b5ec0e115..8df60872ef 100644
--- a/src/lib/libcrypto/dh/Makefile.ssl
+++ b/src/lib/libcrypto/dh/Makefile.ssl
@@ -83,26 +83,30 @@ dh_check.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dh_check.o: ../../include/openssl/dh.h ../../include/openssl/e_os.h
 dh_check.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dh_check.o: ../../include/openssl/opensslconf.h
-dh_check.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-dh_check.o: ../cryptlib.h
-dh_err.o: ../../include/openssl/bn.h ../../include/openssl/dh.h
-dh_err.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
+dh_check.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+dh_check.o: ../../include/openssl/stack.h ../cryptlib.h
+dh_err.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
+dh_err.o: ../../include/openssl/dh.h ../../include/openssl/err.h
+dh_err.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+dh_err.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 dh_gen.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dh_gen.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dh_gen.o: ../../include/openssl/dh.h ../../include/openssl/e_os.h
 dh_gen.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dh_gen.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-dh_gen.o: ../../include/openssl/stack.h ../cryptlib.h
+dh_gen.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+dh_gen.o: ../cryptlib.h
 dh_key.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dh_key.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dh_key.o: ../../include/openssl/dh.h ../../include/openssl/e_os.h
 dh_key.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dh_key.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-dh_key.o: ../../include/openssl/rand.h ../../include/openssl/stack.h
-dh_key.o: ../cryptlib.h
+dh_key.o: ../../include/openssl/rand.h ../../include/openssl/safestack.h
+dh_key.o: ../../include/openssl/stack.h ../cryptlib.h
 dh_lib.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dh_lib.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dh_lib.o: ../../include/openssl/dh.h ../../include/openssl/e_os.h
 dh_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dh_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-dh_lib.o: ../../include/openssl/stack.h ../cryptlib.h
+dh_lib.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+dh_lib.o: ../cryptlib.h
diff --git a/src/lib/libcrypto/dh/dh.h b/src/lib/libcrypto/dh/dh.h
index 2cc3797a94..c15b2ad483 100644
--- a/src/lib/libcrypto/dh/dh.h
+++ b/src/lib/libcrypto/dh/dh.h
@@ -68,10 +68,28 @@ extern "C" {
 #endif
 
 #include <openssl/bn.h>
+#include <openssl/crypto.h>
         
 #define DH_FLAG_CACHE_MONT_P    0x01
 
-typedef struct dh_st
+typedef struct dh_st DH;
+
+typedef struct dh_method {
+        const char *name;
+        /* Methods here */
+        int (*generate_key)(DH *dh);
+        int (*compute_key)(unsigned char *key,BIGNUM *pub_key,DH *dh);
+        int (*bn_mod_exp)(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx); /* Can be null */
+
+        int (*init)(DH *dh);
+        int (*finish)(DH *dh);
+        int flags;
+        char *app_data;
+} DH_METHOD;
+
+struct dh_st
         {
         /* This first argument is used to pick up errors when
          * a DH is passed instead of a EVP_PKEY */
@@ -80,12 +98,22 @@ typedef struct dh_st
         BIGNUM *p;
         BIGNUM *g;
         int length; /* optional */
-        BIGNUM *pub_key;        /* y */
+        BIGNUM *pub_key;        /* g^x */
         BIGNUM *priv_key;       /* x */
 
         int flags;
         char *method_mont_p;
-        } DH;
+        /* Place holders if we want to do X9.42 DH */
+        BIGNUM *q;
+        BIGNUM *j;
+        unsigned char *seed;
+        int seedlen;
+        BIGNUM *counter;
+
+        int references;
+        CRYPTO_EX_DATA ex_data;
+        DH_METHOD *meth;
+        };
 
 #define DH_GENERATOR_2          2
 /* #define DH_GENERATOR_3       3 */
@@ -93,10 +121,14 @@ typedef struct dh_st
 
 /* DH_check error codes */
 #define DH_CHECK_P_NOT_PRIME            0x01
-#define DH_CHECK_P_NOT_STRONG_PRIME     0x02
+#define DH_CHECK_P_NOT_SAFE_PRIME       0x02
 #define DH_UNABLE_TO_CHECK_GENERATOR    0x04
 #define DH_NOT_SUITABLE_GENERATOR       0x08
 
+/* primes p where (p-1)/2 is prime too are called "safe"; we define
+   this for backward compatibility: */
+#define DH_CHECK_P_NOT_STRONG_PRIME     DH_CHECK_P_NOT_SAFE_PRIME
+
 #define DHparams_dup(x) (DH *)ASN1_dup((int (*)())i2d_DHparams, \
                 (char *(*)())d2i_DHparams,(char *)(x))
 #define d2i_DHparams_fp(fp,x) (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
@@ -113,9 +145,20 @@ typedef struct dh_st
                 (unsigned char *)(x))
 #endif
 
+DH_METHOD *DH_OpenSSL(void);
+
+void DH_set_default_method(DH_METHOD *meth);
+DH_METHOD *DH_get_default_method(void);
+DH_METHOD *DH_set_method(DH *dh, DH_METHOD *meth);
+DH *DH_new_method(DH_METHOD *meth);
+
 DH *    DH_new(void);
 void    DH_free(DH *dh);
 int     DH_size(DH *dh);
+int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int DH_set_ex_data(DH *d, int idx, void *arg);
+void *DH_get_ex_data(DH *d, int idx);
 DH *    DH_generate_parameters(int prime_len,int generator,
                 void (*callback)(int,int,void *),void *cb_arg);
 int     DH_check(DH *dh,int *codes);
diff --git a/src/lib/libcrypto/dh/dh_check.c b/src/lib/libcrypto/dh/dh_check.c
index 95ce9cfad0..7e5cfd8bfc 100644
--- a/src/lib/libcrypto/dh/dh_check.c
+++ b/src/lib/libcrypto/dh/dh_check.c
@@ -61,7 +61,7 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
-/* Check that p is a strong prime and
+/* Check that p is a safe prime and
  * if g is 2, 3 or 5, check that is is a suitable generator
  * where
  * for 2, p mod 24 == 11
@@ -88,11 +88,13 @@ int DH_check(DH *dh, int *ret)
                 l=BN_mod_word(dh->p,24);
                 if (l != 11) *ret|=DH_NOT_SUITABLE_GENERATOR;
                 }
-/*      else if (BN_is_word(dh->g,DH_GENERATOR_3))
+#if 0
+        else if (BN_is_word(dh->g,DH_GENERATOR_3))
                 {
                 l=BN_mod_word(dh->p,12);
                 if (l != 5) *ret|=DH_NOT_SUITABLE_GENERATOR;
-                }*/
+                }
+#endif
         else if (BN_is_word(dh->g,DH_GENERATOR_5))
                 {
                 l=BN_mod_word(dh->p,10);
@@ -108,7 +110,7 @@ int DH_check(DH *dh, int *ret)
                 {
                 if (!BN_rshift1(q,dh->p)) goto err;
                 if (!BN_is_prime(q,BN_prime_checks,NULL,ctx,NULL))
-                        *ret|=DH_CHECK_P_NOT_STRONG_PRIME;
+                        *ret|=DH_CHECK_P_NOT_SAFE_PRIME;
                 }
         ok=1;
 err:
diff --git a/src/lib/libcrypto/dh/dh_gen.c b/src/lib/libcrypto/dh/dh_gen.c
index b7bcd2c7a4..7a6a38fbb4 100644
--- a/src/lib/libcrypto/dh/dh_gen.c
+++ b/src/lib/libcrypto/dh/dh_gen.c
@@ -72,14 +72,14 @@
  * Having said all that,
  * there is another special case method for the generators 2, 3 and 5.
  * for 2, p mod 24 == 11
- * for 3, p mod 12 == 5  <<<<< does not work for strong primes.
+ * for 3, p mod 12 == 5  <<<<< does not work for safe primes.
  * for 5, p mod 10 == 3 or 7
  *
  * Thanks to Phil Karn <karn@qualcomm.com> for the pointers about the
  * special generators and for answering some of my questions.
  *
  * I've implemented the second simple method :-).
- * Since DH should be using a strong prime (both p and q are prime),
+ * Since DH should be using a safe prime (both p and q are prime),
  * this generator function can take a very very long time to run.
  */
 
@@ -95,9 +95,10 @@ DH *DH_generate_parameters(int prime_len, int generator,
         if (ret == NULL) goto err;
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
-        t1= &(ctx->bn[0]);
-        t2= &(ctx->bn[1]);
-        ctx->tos=2;
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        t2 = BN_CTX_get(ctx);
+        if (t1 == NULL || t2 == NULL) goto err;
         
         if (generator == DH_GENERATOR_2)
                 {
@@ -105,7 +106,7 @@ DH *DH_generate_parameters(int prime_len, int generator,
                 BN_set_word(t2,11);
                 g=2;
                 }
-#ifdef undef  /* does not work for strong primes */
+#ifdef undef  /* does not work for safe primes */
         else if (generator == DH_GENERATOR_3)
                 {
                 BN_set_word(t1,12);
@@ -138,7 +139,11 @@ err:
                 ok=0;
                 }
 
-        if (ctx != NULL) BN_CTX_free(ctx);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
         if (!ok && (ret != NULL))
                 {
                 DH_free(ret);
diff --git a/src/lib/libcrypto/dh/dh_key.c b/src/lib/libcrypto/dh/dh_key.c
index cede53bfc1..0c7eeaf260 100644
--- a/src/lib/libcrypto/dh/dh_key.c
+++ b/src/lib/libcrypto/dh/dh_key.c
@@ -62,8 +62,42 @@
 #include <openssl/rand.h>
 #include <openssl/dh.h>
 
+static int generate_key(DH *dh);
+static int compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh);
+static int dh_bn_mod_exp(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *m, BN_CTX *ctx,
+                        BN_MONT_CTX *m_ctx);
+static int dh_init(DH *dh);
+static int dh_finish(DH *dh);
+
 int DH_generate_key(DH *dh)
         {
+        return dh->meth->generate_key(dh);
+        }
+
+int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
+        {
+        return dh->meth->compute_key(key, pub_key, dh);
+        }
+
+static DH_METHOD dh_ossl = {
+"OpenSSL DH Method",
+generate_key,
+compute_key,
+dh_bn_mod_exp,
+dh_init,
+dh_finish,
+0,
+NULL
+};
+
+DH_METHOD *DH_OpenSSL(void)
+{
+        return &dh_ossl;
+}
+
+static int generate_key(DH *dh)
+        {
         int ok=0;
         unsigned int i;
         BN_CTX ctx;
@@ -103,7 +137,8 @@ int DH_generate_key(DH *dh)
                 }
         mont=(BN_MONT_CTX *)dh->method_mont_p;
 
-        if (!BN_mod_exp_mont(pub_key,dh->g,priv_key,dh->p,&ctx,mont)) goto err;
+        if (!dh->meth->bn_mod_exp(dh, pub_key,dh->g,priv_key,dh->p,&ctx,mont))
+                                                                goto err;
                 
         dh->pub_key=pub_key;
         dh->priv_key=priv_key;
@@ -118,7 +153,7 @@ err:
         return(ok);
         }
 
-int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
+static int compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
         {
         BN_CTX ctx;
         BN_MONT_CTX *mont;
@@ -126,7 +161,8 @@ int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
         int ret= -1;
 
         BN_CTX_init(&ctx);
-        tmp= &(ctx.bn[ctx.tos++]);
+        BN_CTX_start(&ctx);
+        tmp = BN_CTX_get(&ctx);
         
         if (dh->priv_key == NULL)
                 {
@@ -141,7 +177,7 @@ int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
                 }
 
         mont=(BN_MONT_CTX *)dh->method_mont_p;
-        if (!BN_mod_exp_mont(tmp,pub_key,dh->priv_key,dh->p,&ctx,mont))
+        if (!dh->meth->bn_mod_exp(dh, tmp,pub_key,dh->priv_key,dh->p,&ctx,mont))
                 {
                 DHerr(DH_F_DH_COMPUTE_KEY,ERR_R_BN_LIB);
                 goto err;
@@ -149,6 +185,27 @@ int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
 
         ret=BN_bn2bin(tmp,key);
 err:
+        BN_CTX_end(&ctx);
         BN_CTX_free(&ctx);
         return(ret);
         }
+
+static int dh_bn_mod_exp(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *m, BN_CTX *ctx,
+                        BN_MONT_CTX *m_ctx)
+{
+        return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx);
+}
+
+static int dh_init(DH *dh)
+{
+        dh->flags |= DH_FLAG_CACHE_MONT_P;
+        return(1);
+}
+
+static int dh_finish(DH *dh)
+{
+        if(dh->method_mont_p)
+                BN_MONT_CTX_free((BN_MONT_CTX *)dh->method_mont_p);
+        return(1);
+}
diff --git a/src/lib/libcrypto/dh/dh_lib.c b/src/lib/libcrypto/dh/dh_lib.c
index 61e0720e8a..6c21463028 100644
--- a/src/lib/libcrypto/dh/dh_lib.c
+++ b/src/lib/libcrypto/dh/dh_lib.c
@@ -63,16 +63,49 @@
 
 const char *DH_version="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
 
+static DH_METHOD *default_DH_method;
+static int dh_meth_num = 0;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *dh_meth = NULL;
+
+void DH_set_default_method(DH_METHOD *meth)
+{
+        default_DH_method = meth;
+}
+
+DH_METHOD *DH_get_default_method(void)
+{
+        if(!default_DH_method) default_DH_method = DH_OpenSSL();
+        return default_DH_method;
+}
+
+DH_METHOD *DH_set_method(DH *dh, DH_METHOD *meth)
+{
+        DH_METHOD *mtmp;
+        mtmp = dh->meth;
+        if (mtmp->finish) mtmp->finish(dh);
+        dh->meth = meth;
+        if (meth->init) meth->init(dh);
+        return mtmp;
+}
+
 DH *DH_new(void)
+{
+        return DH_new_method(NULL);
+}
+
+DH *DH_new_method(DH_METHOD *meth)
         {
         DH *ret;
-
         ret=(DH *)Malloc(sizeof(DH));
+
         if (ret == NULL)
                 {
                 DHerr(DH_F_DH_NEW,ERR_R_MALLOC_FAILURE);
                 return(NULL);
                 }
+        if(!default_DH_method) default_DH_method = DH_OpenSSL();
+        if(meth) ret->meth = meth;
+        else ret->meth = default_DH_method;
         ret->pad=0;
         ret->version=0;
         ret->p=NULL;
@@ -80,23 +113,74 @@ DH *DH_new(void)
         ret->length=0;
         ret->pub_key=NULL;
         ret->priv_key=NULL;
-        ret->flags=DH_FLAG_CACHE_MONT_P;
+        ret->q=NULL;
+        ret->j=NULL;
+        ret->seed = NULL;
+        ret->seedlen = 0;
+        ret->counter = NULL;
         ret->method_mont_p=NULL;
+        ret->references = 1;
+        ret->flags=ret->meth->flags;
+        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
+                {
+                Free(ret);
+                ret=NULL;
+                }
+        else
+                CRYPTO_new_ex_data(dh_meth,ret,&ret->ex_data);
         return(ret);
         }
 
 void DH_free(DH *r)
         {
+        int i;
         if(r == NULL) return;
+        i = CRYPTO_add(&r->references, -1, CRYPTO_LOCK_DH);
+#ifdef REF_PRINT
+        REF_PRINT("DH",r);
+#endif
+        if (i > 0) return;
+#ifdef REF_CHECK
+        if (i < 0)
+                {
+                fprintf(stderr,"DH_free, bad reference count\n");
+                abort();
+        }
+#endif
+
+        CRYPTO_free_ex_data(dh_meth, r, &r->ex_data);
+
+        if(r->meth->finish) r->meth->finish(r);
+
         if (r->p != NULL) BN_clear_free(r->p);
         if (r->g != NULL) BN_clear_free(r->g);
+        if (r->q != NULL) BN_clear_free(r->q);
+        if (r->j != NULL) BN_clear_free(r->j);
+        if (r->seed) Free(r->seed);
+        if (r->counter != NULL) BN_clear_free(r->counter);
         if (r->pub_key != NULL) BN_clear_free(r->pub_key);
         if (r->priv_key != NULL) BN_clear_free(r->priv_key);
-        if (r->method_mont_p != NULL)
-                BN_MONT_CTX_free((BN_MONT_CTX *)r->method_mont_p);
         Free(r);
         }
 
+int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        dh_meth_num++;
+        return(CRYPTO_get_ex_new_index(dh_meth_num-1,
+                &dh_meth,argl,argp,new_func,dup_func,free_func));
+        }
+
+int DH_set_ex_data(DH *d, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&d->ex_data,idx,arg));
+        }
+
+void *DH_get_ex_data(DH *d, int idx)
+        {
+        return(CRYPTO_get_ex_data(&d->ex_data,idx));
+        }
+
 int DH_size(DH *dh)
         {
         return(BN_num_bytes(dh->p));
diff --git a/src/lib/libcrypto/dh/dhtest.c b/src/lib/libcrypto/dh/dhtest.c
index 770331971f..d66c28455e 100644
--- a/src/lib/libcrypto/dh/dhtest.c
+++ b/src/lib/libcrypto/dh/dhtest.c
@@ -65,6 +65,7 @@
 #include <openssl/crypto.h>
 #include <openssl/bio.h>
 #include <openssl/bn.h>
+#include <openssl/rand.h>
 
 #ifdef NO_DH
 int main(int argc, char *argv[])
@@ -87,19 +88,23 @@ static void MS_CALLBACK cb(int p, int n, void *arg);
 #include "bss_file.c"
 #endif
 
-BIO *out=NULL;
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 
 int main(int argc, char *argv[])
         {
-        DH *a,*b;
+        DH *a;
+        DH *b=NULL;
         char buf[12];
         unsigned char *abuf=NULL,*bbuf=NULL;
         int i,alen,blen,aout,bout,ret=1;
+        BIO *out;
 
 #ifdef WIN32
         CRYPTO_malloc_init();
 #endif
 
+        RAND_seed(rnd_seed, sizeof rnd_seed);
+
         out=BIO_new(BIO_s_file());
         if (out == NULL) exit(1);
         BIO_set_fp(out,stdout,BIO_NOCLOSE);
@@ -167,6 +172,9 @@ int main(int argc, char *argv[])
 err:
         if (abuf != NULL) Free(abuf);
         if (bbuf != NULL) Free(bbuf);
+        if(b != NULL) DH_free(b);
+        if(a != NULL) DH_free(a);
+        BIO_free(out);
         exit(ret);
         return(ret);
         }
diff --git a/src/lib/libcrypto/doc/DH_generate_key.pod b/src/lib/libcrypto/doc/DH_generate_key.pod
new file mode 100644
index 0000000000..920995b2e5
--- /dev/null
+++ b/src/lib/libcrypto/doc/DH_generate_key.pod
@@ -0,0 +1,50 @@
+=pod
+
+=head1 NAME
+
+DH_generate_key, DH_compute_key - perform Diffie-Hellman key exchange
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ int DH_generate_key(DH *dh);
+
+ int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh);
+
+=head1 DESCRIPTION
+
+DH_generate_key() performs the first step of a Diffie-Hellman key
+exchange by generating private and public DH values. By calling
+DH_compute_key(), these are combined with the other party's public
+value to compute the shared key.
+
+DH_generate_key() expects B<dh> to contain the shared parameters
+B<dh-E<gt>p> and B<dh-E<gt>g>. It generates a random private DH value
+unless B<dh-E<gt>priv_key> is already set, and computes the
+corresponding public value B<dh-E<gt>pub_key>, which can then be
+published.
+
+DH_compute_key() computes the shared secret from the private DH value
+in B<dh> and the other party's public value in B<pub_key> and stores
+it in B<key>. B<key> must point to B<DH_size(dh)> bytes of memory.
+
+=head1 RETURN VALUES
+
+DH_generate_key() returns 1 on success, 0 otherwise.
+
+DH_compute_key() returns the size of the shared secret on success, -1
+on error.
+
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<DH_size(3)|DH_size(3)>
+
+=head1 HISTORY
+
+DH_generate_key() and DH_compute_key() are available in all versions
+of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DH_generate_parameters.pod b/src/lib/libcrypto/doc/DH_generate_parameters.pod
new file mode 100644
index 0000000000..a7d0c75f0c
--- /dev/null
+++ b/src/lib/libcrypto/doc/DH_generate_parameters.pod
@@ -0,0 +1,72 @@
+=pod
+
+=head1 NAME
+
+DH_generate_parameters, DH_check - generate and check Diffie-Hellman parameters
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ DH *DH_generate_parameters(int prime_len, int generator,
+     void (*callback)(int, int, void *), void *cb_arg);
+
+ int DH_check(DH *dh, int *codes);
+
+=head1 DESCRIPTION
+
+DH_generate_parameters() generates Diffie-Hellman parameters that can
+be shared among a group of users, and returns them in a newly
+allocated B<DH> structure. The pseudo-random number generator must be
+seeded prior to calling DH_generate_parameters().
+
+B<prime_len> is the length in bits of the safe prime to be generated.
+B<generator> is a small number E<gt> 1, typically 2 or 5. 
+
+A callback function may be used to provide feedback about the progress
+of the key generation. If B<callback> is not B<NULL>, it will be
+called as described in L<BN_generate_prime(3)|BN_generate_prime(3)> while a random prime
+number is generated, and when a prime has been found, B<callback(3,
+0, cb_arg)> is called.
+
+DH_check() validates Diffie-Hellman parameters. It checks that B<p> is
+a safe prime, and that B<g> is a suitable generator. In the case of an
+error, the bit flags DH_CHECK_P_NOT_SAFE_PRIME or
+DH_NOT_SUITABLE_GENERATOR are set in B<*codes>.
+DH_UNABLE_TO_CHECK_GENERATOR is set if the generator cannot be
+checked, i.e. it does not equal 2 or 5.
+
+=head1 RETURN VALUES
+
+DH_generate_parameters() returns a pointer to the DH structure, or
+NULL if the parameter generation fails. The error codes can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+DH_check() returns 1 if the check could be performed, 0 otherwise.
+
+=head1 NOTES
+
+DH_generate_parameters() may run for several hours before finding a
+suitable prime.
+
+The parameters generated by DH_generate_parameters() are not to be
+used in signature schemes.
+
+=head1 BUGS
+
+If B<generator> is not 2 or 5, B<dh-E<gt>g>=B<generator> is not
+a usable generator.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<DH_free(3)|DH_free(3)>
+
+=head1 HISTORY
+
+DH_check() is available in all versions of SSLeay and OpenSSL.
+The B<cb_arg> argument to DH_generate_parameters() was added in SSLeay 0.9.0.
+
+In versions before OpenSSL 0.9.5, DH_CHECK_P_NOT_STRONG_PRIME is used
+instead of DH_CHECK_P_NOT_SAFE_PRIME.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DH_get_ex_new_index.pod b/src/lib/libcrypto/doc/DH_get_ex_new_index.pod
new file mode 100644
index 0000000000..82e2548bcd
--- /dev/null
+++ b/src/lib/libcrypto/doc/DH_get_ex_new_index.pod
@@ -0,0 +1,36 @@
+=pod
+
+=head1 NAME
+
+DH_get_ex_new_index, DH_set_ex_data, DH_get_ex_data - add application specific data to DH structures
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ int DH_get_ex_new_index(long argl, void *argp,
+                CRYPTO_EX_new *new_func,
+                CRYPTO_EX_dup *dup_func,
+                CRYPTO_EX_free *free_func);
+
+ int DH_set_ex_data(DH *d, int idx, void *arg);
+
+ char *DH_get_ex_data(DH *d, int idx);
+
+=head1 DESCRIPTION
+
+These functions handle application specific data in DH
+structures. Their usage is identical to that of
+RSA_get_ex_new_index(), RSA_set_ex_data() and RSA_get_ex_data()
+as described in L<RSA_get_ex_new_index(3)>.
+
+=head1 SEE ALSO
+
+L<RSA_get_ex_new_index()|RSA_get_ex_new_index()>, L<dh(3)|dh(3)>
+
+=head1 HISTORY
+
+DH_get_ex_new_index(), DH_set_ex_data() and DH_get_ex_data() are
+available since OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DH_new.pod b/src/lib/libcrypto/doc/DH_new.pod
new file mode 100644
index 0000000000..64624b9d15
--- /dev/null
+++ b/src/lib/libcrypto/doc/DH_new.pod
@@ -0,0 +1,40 @@
+=pod
+
+=head1 NAME
+
+DH_new, DH_free - allocate and free DH objects
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ DH* DH_new(void);
+
+ void DH_free(DH *dh);
+
+=head1 DESCRIPTION
+
+DH_new() allocates and initializes a B<DH> structure.
+
+DH_free() frees the B<DH> structure and its components. The values are
+erased before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+If the allocation fails, DH_new() returns B<NULL> and sets an error
+code that can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>. Otherwise it returns
+a pointer to the newly allocated structure.
+
+DH_free() returns no value.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<err(3)|err(3)>,
+L<DH_generate_parameters(3)|DH_generate_parameters(3)>,
+L<DH_generate_key(3)|DH_generate_key(3)>
+
+=head1 HISTORY
+
+DH_new() and DH_free() are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DH_set_method.pod b/src/lib/libcrypto/doc/DH_set_method.pod
new file mode 100644
index 0000000000..dca41d8dbc
--- /dev/null
+++ b/src/lib/libcrypto/doc/DH_set_method.pod
@@ -0,0 +1,99 @@
+=pod
+
+=head1 NAME
+
+DH_set_default_method, DH_get_default_method, DH_set_method,
+DH_new_method, DH_OpenSSL - select DH method
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ void DH_set_default_method(DH_METHOD *meth);
+
+ DH_METHOD *DH_get_default_method(void);
+
+ DH_METHOD *DH_set_method(DH *dh, DH_METHOD *meth);
+
+ DH *DH_new_method(DH_METHOD *meth);
+
+ DH_METHOD *DH_OpenSSL(void);
+
+=head1 DESCRIPTION
+
+A B<DH_METHOD> specifies the functions that OpenSSL uses for Diffie-Hellman
+operations. By modifying the method, alternative implementations
+such as hardware accelerators may be used.
+
+Initially, the default is to use the OpenSSL internal implementation.
+DH_OpenSSL() returns a pointer to that method.
+
+DH_set_default_method() makes B<meth> the default method for all B<DH>
+structures created later.
+
+DH_get_default_method() returns a pointer to the current default
+method.
+
+DH_set_method() selects B<meth> for all operations using the structure B<dh>.
+
+DH_get_method() returns a pointer to the method currently selected
+for B<dh>.
+
+DH_new_method() allocates and initializes a B<DH> structure so that
+B<method> will be used for the DH operations. If B<method> is B<NULL>,
+the default method is used.
+
+=head1 THE DH_METHOD STRUCTURE
+
+ typedef struct dh_meth_st
+ {
+     /* name of the implementation */
+        const char *name;
+
+     /* generate private and public DH values for key agreement */
+        int (*generate_key)(DH *dh);
+
+     /* compute shared secret */
+        int (*compute_key)(unsigned char *key, BIGNUM *pub_key, DH *dh);
+
+     /* compute r = a ^ p mod m. May be NULL */
+        int (*bn_mod_exp)(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx);
+
+     /* called at DH_new */
+        int (*init)(DH *dh);
+
+     /* called at DH_free */
+        int (*finish)(DH *dh);
+
+        int flags;
+
+        char *app_data; /* ?? */
+
+ } DH_METHOD;
+
+=head1 RETURN VALUES
+
+DH_OpenSSL(), DH_get_default_method() and DH_get_method() return
+pointers to the respective B<DH_METHOD>s.
+
+DH_set_default_method() returns no value.
+
+DH_set_method() returns a pointer to the B<DH_METHOD> previously
+associated with B<dh>.
+
+DH_new_method() returns B<NULL> and sets an error code that can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise it
+returns a pointer to the newly allocated structure.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<DH_new(3)|DH_new(3)>
+
+=head1 HISTORY
+
+DH_set_default_method(), DH_get_default_method(), DH_set_method(),
+DH_new_method() and DH_OpenSSL() were added in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DH_size.pod b/src/lib/libcrypto/doc/DH_size.pod
new file mode 100644
index 0000000000..97f26fda78
--- /dev/null
+++ b/src/lib/libcrypto/doc/DH_size.pod
@@ -0,0 +1,33 @@
+=pod
+
+=head1 NAME
+
+DH_size - get Diffie-Hellman prime size
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ int DH_size(DH *dh);
+
+=head1 DESCRIPTION
+
+This function returns the Diffie-Hellman size in bytes. It can be used
+to determine how much memory must be allocated for the shared secret
+computed by DH_compute_key().
+
+B<dh-E<gt>p> must not be B<NULL>.
+
+=head1 RETURN VALUE
+
+The size in bytes.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<DH_generate_key(3)|DH_generate_key(3)>
+
+=head1 HISTORY
+
+DH_size() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_SIG_new.pod b/src/lib/libcrypto/doc/DSA_SIG_new.pod
new file mode 100644
index 0000000000..671655554a
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_SIG_new.pod
@@ -0,0 +1,39 @@
+=pod
+
+=head1 NAME
+
+DSA_SIG_new, DSA_SIG_free - allocate and free DSA signature objects
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA_SIG *DSA_SIG_new(void);
+
+ void   DSA_SIG_free(DSA_SIG *a);
+
+=head1 DESCRIPTION
+
+DSA_SIG_new() allocates and initializes a B<DSA_SIG> structure.
+
+DSA_SIG_free() frees the B<DSA_SIG> structure and its components. The
+values are erased before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+If the allocation fails, DSA_SIG_new() returns B<NULL> and sets an
+error code that can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>. Otherwise it returns a pointer
+to the newly allocated structure.
+
+DSA_SIG_free() returns no value.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<DSA_do_sign(3)|DSA_do_sign(3)>
+
+=head1 HISTORY
+
+DSA_SIG_new() and DSA_SIG_free() were added in OpenSSL 0.9.3.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_do_sign.pod b/src/lib/libcrypto/doc/DSA_do_sign.pod
new file mode 100644
index 0000000000..a24fd5714e
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_do_sign.pod
@@ -0,0 +1,47 @@
+=pod
+
+=head1 NAME
+
+DSA_do_sign, DSA_do_verify - raw DSA signature operations
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA_SIG *DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+
+ int DSA_do_verify(const unsigned char *dgst, int dgst_len,
+             DSA_SIG *sig, DSA *dsa);
+
+=head1 DESCRIPTION
+
+DSA_do_sign() computes a digital signature on the B<len> byte message
+digest B<dgst> using the private key B<dsa> and returns it in a
+newly allocated B<DSA_SIG> structure.
+
+L<DSA_sign_setup(3)|DSA_sign_setup(3)> may be used to precompute part
+of the signing operation in case signature generation is
+time-critical.
+
+DSA_do_verify() verifies that the signature B<sig> matches a given
+message digest B<dgst> of size B<len>.  B<dsa> is the signer's public
+key.
+
+=head1 RETURN VALUES
+
+DSA_do_sign() returns the signature, NULL on error.  DSA_do_verify()
+returns 1 for a valid signature, 0 for an incorrect signature and -1
+on error. The error codes can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<DSA_SIG_new(3)|DSA_SIG_new(3)>,
+L<DSA_sign(3)|DSA_sign(3)>
+
+=head1 HISTORY
+
+DSA_do_sign() and DSA_do_verify() were added in OpenSSL 0.9.3.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_dup_DH.pod b/src/lib/libcrypto/doc/DSA_dup_DH.pod
new file mode 100644
index 0000000000..29cb1075d1
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_dup_DH.pod
@@ -0,0 +1,36 @@
+=pod
+
+=head1 NAME
+
+DSA_dup_DH - create a DH structure out of DSA structure
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DH * DSA_dup_DH(DSA *r);
+
+=head1 DESCRIPTION
+
+DSA_dup_DH() duplicates DSA parameters/keys as DH parameters/keys. q
+is lost during that conversion, but the resulting DH parameters
+contain its length.
+
+=head1 RETURN VALUE
+
+DSA_dup_DH() returns the new B<DH> structure, and NULL on error. The
+error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 NOTE
+
+Be careful to avoid small subgroup attacks when using this.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<dsa(3)|dsa(3)>, L<err(3)|err(3)>
+
+=head1 HISTORY
+
+DSA_dup_DH() was added in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_generate_key.pod b/src/lib/libcrypto/doc/DSA_generate_key.pod
new file mode 100644
index 0000000000..52890db5be
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_generate_key.pod
@@ -0,0 +1,33 @@
+=pod
+
+=head1 NAME
+
+DSA_generate_key - generate DSA key pair
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ int DSA_generate_key(DSA *a);
+
+=head1 DESCRIPTION
+
+DSA_generate_key() expects B<a> to contain DSA parameters. It generates
+a new key pair and stores it in B<a-E<gt>pub_key> and B<a-E<gt>priv_key>.
+
+The PRNG must be seeded prior to calling DSA_generate_key().
+
+=head1 RETURN VALUE
+
+DSA_generate_key() returns 1 on success, 0 otherwise.
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>
+
+=head1 HISTORY
+
+DSA_generate_key() is available since SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_generate_parameters.pod b/src/lib/libcrypto/doc/DSA_generate_parameters.pod
new file mode 100644
index 0000000000..43f60b0eb9
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_generate_parameters.pod
@@ -0,0 +1,105 @@
+=pod
+
+=head1 NAME
+
+DSA_generate_parameters - generate DSA parameters
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA *DSA_generate_parameters(int bits, unsigned char *seed,
+                int seed_len, int *counter_ret, unsigned long *h_ret,
+                void (*callback)(int, int, void *), void *cb_arg);
+
+=head1 DESCRIPTION
+
+DSA_generate_parameters() generates primes p and q and a generator g
+for use in the DSA.
+
+B<bits> is the length of the prime to be generated; the DSS allows a
+maximum of 1024 bits.
+
+If B<seed> is B<NULL> or B<seed_len> E<lt> 20, the primes will be
+generated at random. Otherwise, the seed is used to generate
+them. If the given seed does not yield a prime q, a new random
+seed is chosen and placed at B<seed>.
+
+DSA_generate_parameters() places the iteration count in
+*B<counter_ret> and a counter used for finding a generator in
+*B<h_ret>, unless these are B<NULL>.
+
+A callback function may be used to provide feedback about the progress
+of the key generation. If B<callback> is not B<NULL>, it will be
+called as follows:
+
+=over 4
+
+=item *
+
+When a candidate for q is generated, B<callback(0, m++, cb_arg)> is called
+(m is 0 for the first candidate).
+
+=item *
+
+When a candidate for q has passed a test by trial division,
+B<callback(1, -1, cb_arg)> is called.
+While a candidate for q is tested by Miller-Rabin primality tests,
+B<callback(1, i, cb_arg)> is called in the outer loop
+(once for each witness that confirms that the candidate may be prime);
+i is the loop counter (starting at 0).
+
+=item *
+
+When a prime q has been found, B<callback(2, 0, cb_arg)> and
+B<callback(3, 0, cb_arg)> are called.
+
+=item *
+
+Before a candidate for p (other than the first) is generated and tested,
+B<callback(0, counter, cb_arg)> is called.
+
+=item *
+
+When a candidate for p has passed the test by trial division,
+B<callback(1, -1, cb_arg)> is called.
+While it is tested by the Miller-Rabin primality test,
+B<callback(1, i, cb_arg)> is called in the outer loop
+(once for each witness that confirms that the candidate may be prime).
+i is the loop counter (starting at 0).
+
+=item *
+
+When p has been found, B<callback(2, 1, cb_arg)> is called.
+
+=item *
+
+When the generator has been found, B<callback(3, 1, cb_arg)> is called.
+
+=back
+
+=head1 RETURN VALUE
+
+DSA_generate_parameters() returns a pointer to the DSA structure, or
+B<NULL> if the parameter generation fails. The error codes can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+Seed lengths E<gt> 20 are not supported.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<DSA_free(3)|DSA_free(3)>
+
+=head1 HISTORY
+
+DSA_generate_parameters() appeared in SSLeay 0.8. The B<cb_arg>
+argument was added in SSLeay 0.9.0.
+In versions up to OpenSSL 0.9.4, B<callback(1, ...)> was called
+in the inner loop of the Miller-Rabin test whenever it reached the
+squaring step (the parameters to B<callback> did not reveal how many
+witnesses had been tested); since OpenSSL 0.9.5, B<callback(1, ...)>
+is called as in BN_is_prime(3), i.e. once for each witness.
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_get_ex_new_index.pod b/src/lib/libcrypto/doc/DSA_get_ex_new_index.pod
new file mode 100644
index 0000000000..4612e708ec
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_get_ex_new_index.pod
@@ -0,0 +1,36 @@
+=pod
+
+=head1 NAME
+
+DSA_get_ex_new_index, DSA_set_ex_data, DSA_get_ex_data - add application specific data to DSA structures
+
+=head1 SYNOPSIS
+
+ #include <openssl/DSA.h>
+
+ int DSA_get_ex_new_index(long argl, void *argp,
+                CRYPTO_EX_new *new_func,
+                CRYPTO_EX_dup *dup_func,
+                CRYPTO_EX_free *free_func);
+
+ int DSA_set_ex_data(DSA *d, int idx, void *arg);
+
+ char *DSA_get_ex_data(DSA *d, int idx);
+
+=head1 DESCRIPTION
+
+These functions handle application specific data in DSA
+structures. Their usage is identical to that of
+RSA_get_ex_new_index(), RSA_set_ex_data() and RSA_get_ex_data()
+as described in L<RSA_get_ex_new_index(3)>.
+
+=head1 SEE ALSO
+
+L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>, L<dsa(3)|dsa(3)>
+
+=head1 HISTORY
+
+DSA_get_ex_new_index(), DSA_set_ex_data() and DSA_get_ex_data() are
+available since OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_new.pod b/src/lib/libcrypto/doc/DSA_new.pod
new file mode 100644
index 0000000000..7dde54445b
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_new.pod
@@ -0,0 +1,41 @@
+=pod
+
+=head1 NAME
+
+DSA_new, DSA_free - allocate and free DSA objects
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA* DSA_new(void);
+
+ void DSA_free(DSA *dsa);
+
+=head1 DESCRIPTION
+
+DSA_new() allocates and initializes a B<DSA> structure.
+
+DSA_free() frees the B<DSA> structure and its components. The values are
+erased before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+If the allocation fails, DSA_new() returns B<NULL> and sets an error
+code that can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>. Otherwise it returns a pointer
+to the newly allocated structure.
+
+DSA_free() returns no value.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>,
+L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>,
+L<DSA_generate_key(3)|DSA_generate_key(3)>
+
+=head1 HISTORY
+
+DSA_new() and DSA_free() are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_set_method.pod b/src/lib/libcrypto/doc/DSA_set_method.pod
new file mode 100644
index 0000000000..0b13ec9237
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_set_method.pod
@@ -0,0 +1,111 @@
+=pod
+
+=head1 NAME
+
+DSA_set_default_method, DSA_get_default_method, DSA_set_method,
+DSA_new_method, DSA_OpenSSL - select RSA method
+
+=head1 SYNOPSIS
+
+ #include <openssl/DSA.h>
+
+ void DSA_set_default_method(DSA_METHOD *meth);
+
+ DSA_METHOD *DSA_get_default_method(void);
+
+ DSA_METHOD *DSA_set_method(DSA *dsa, DSA_METHOD *meth);
+
+ DSA *DSA_new_method(DSA_METHOD *meth);
+
+ DSA_METHOD *DSA_OpenSSL(void);
+
+=head1 DESCRIPTION
+
+A B<DSA_METHOD> specifies the functions that OpenSSL uses for DSA
+operations. By modifying the method, alternative implementations
+such as hardware accelerators may be used.
+
+Initially, the default is to use the OpenSSL internal implementation.
+DSA_OpenSSL() returns a pointer to that method.
+
+DSA_set_default_method() makes B<meth> the default method for all B<DSA>
+structures created later.
+
+DSA_get_default_method() returns a pointer to the current default
+method.
+
+DSA_set_method() selects B<meth> for all operations using the structure B<DSA>.
+
+DSA_get_method() returns a pointer to the method currently selected
+for B<DSA>.
+
+DSA_new_method() allocates and initializes a B<DSA> structure so that
+B<method> will be used for the DSA operations. If B<method> is B<NULL>,
+the default method is used.
+
+=head1 THE DSA_METHOD STRUCTURE
+
+struct
+ {
+     /* name of the implementation */
+        const char *name;
+
+     /* sign */
+        DSA_SIG *(*dsa_do_sign)(const unsigned char *dgst, int dlen,
+                                 DSA *dsa);
+
+     /* pre-compute k^-1 and r */
+        int (*dsa_sign_setup)(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
+                                 BIGNUM **rp);
+
+     /* verify */
+        int (*dsa_do_verify)(const unsigned char *dgst, int dgst_len,
+                                 DSA_SIG *sig, DSA *dsa);
+
+     /* compute rr = a1^p1 * a2^p2 mod m. May be NULL */
+        int (*dsa_mod_exp)(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
+                                 BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                                 BN_CTX *ctx, BN_MONT_CTX *in_mont);
+
+     /* compute r = a ^ p mod m. May be NULL */
+        int (*bn_mod_exp)(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                                 const BIGNUM *p, const BIGNUM *m,
+                                 BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+
+     /* called at DSA_new */
+        int (*init)(DSA *DSA);
+
+     /* called at DSA_free */
+        int (*finish)(DSA *DSA);
+
+        int flags;
+
+        char *app_data; /* ?? */
+
+ } DSA_METHOD;
+
+=head1 RETURN VALUES
+
+DSA_OpenSSL(), DSA_get_default_method() and DSA_get_method() return
+pointers to the respective B<DSA_METHOD>s.
+
+DSA_set_default_method() returns no value.
+
+DSA_set_method() returns a pointer to the B<DSA_METHOD> previously
+associated with B<dsa>.
+
+DSA_new_method() returns B<NULL> and sets an error code that can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation
+fails. Otherwise it returns a pointer to the newly allocated
+structure.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<DSA_new(3)|DSA_new(3)>
+
+=head1 HISTORY
+
+DSA_set_default_method(), DSA_get_default_method(), DSA_set_method(),
+DSA_new_method() and DSA_OpenSSL() were added in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_sign.pod b/src/lib/libcrypto/doc/DSA_sign.pod
new file mode 100644
index 0000000000..f6e60a8ca3
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_sign.pod
@@ -0,0 +1,66 @@
+=pod
+
+=head1 NAME
+
+DSA_sign, DSA_sign_setup, DSA_verify - DSA signatures
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ int    DSA_sign(int type, const unsigned char *dgst, int len,
+                unsigned char *sigret, unsigned int *siglen, DSA *dsa);
+
+ int    DSA_sign_setup(DSA *dsa, BN_CTX *ctx, BIGNUM **kinvp,
+                BIGNUM **rp);
+
+ int    DSA_verify(int type, const unsigned char *dgst, int len,
+                unsigned char *sigbuf, int siglen, DSA *dsa);
+
+=head1 DESCRIPTION
+
+DSA_sign() computes a digital signature on the B<len> byte message
+digest B<dgst> using the private key B<dsa> and places its ASN.1 DER
+encoding at B<sigret>. The length of the signature is places in
+*B<siglen>. B<sigret> must point to DSA_size(B<dsa>) bytes of memory.
+
+DSA_sign_setup() may be used to precompute part of the signing
+operation in case signature generation is time-critical. It expects
+B<dsa> to contain DSA parameters. It places the precomputed values
+in newly allocated B<BIGNUM>s at *B<kinvp> and *B<rp>, after freeing
+the old ones unless *B<kinvp> and *B<rp> are NULL. These values may
+be passed to DSA_sign() in B<dsa-E<gt>kinv> and B<dsa-E<gt>r>.
+B<ctx> is a pre-allocated B<BN_CTX> or NULL.
+
+DSA_verify() verifies that the signature B<sigbuf> of size B<siglen>
+matches a given message digest B<dgst> of size B<len>.
+B<dsa> is the signer's public key.
+
+The B<type> parameter is ignored.
+
+The PRNG must be seeded before DSA_sign() (or DSA_sign_setup())
+is called.
+
+=head1 RETURN VALUES
+
+DSA_sign() and DSA_sign_setup() return 1 on success, 0 on error.
+DSA_verify() returns 1 for a valid signature, 0 for an incorrect
+signature and -1 on error. The error codes can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 CONFORMING TO
+
+US Federal Information Processing Standard FIPS 186 (Digital Signature
+Standard, DSS), ANSI X9.30
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<DSA_do_sign(3)|DSA_do_sign(3)>
+
+=head1 HISTORY
+
+DSA_sign() and DSA_verify() are available in all versions of SSLeay.
+DSA_sign_setup() was added in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libcrypto/doc/DSA_size.pod b/src/lib/libcrypto/doc/DSA_size.pod
new file mode 100644
index 0000000000..23b6320a4d
--- /dev/null
+++ b/src/lib/libcrypto/doc/DSA_size.pod
@@ -0,0 +1,33 @@
+=pod
+
+=head1 NAME
+
+DSA_size - get DSA signature size
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ int DSA_size(DSA *dsa);
+
+=head1 DESCRIPTION
+
+This function returns the size of an ASN.1 encoded DSA signature in
+bytes. It can be used to determine how much memory must be allocated
+for a DSA signature.
+
+B<dsa-E<gt>q> must not be B<NULL>.
+
+=head1 RETURN VALUE
+
+The size in bytes.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<DSA_sign(3)|DSA_sign(3)>
+
+=head1 HISTORY
+
+DSA_size() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_GET_LIB.pod b/src/lib/libcrypto/doc/ERR_GET_LIB.pod
new file mode 100644
index 0000000000..2a129da036
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_GET_LIB.pod
@@ -0,0 +1,51 @@
+=pod
+
+=head1 NAME
+
+ERR_GET_LIB, ERR_GET_FUNC, ERR_GET_REASON - get library, function and
+reason code
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ int ERR_GET_LIB(unsigned long e);
+
+ int ERR_GET_FUNC(unsigned long e);
+
+ int ERR_GET_REASON(unsigned long e);
+
+=head1 DESCRIPTION
+
+The error code returned by ERR_get_error() consists of a library
+number, function code and reason code. ERR_GET_LIB(), ERR_GET_FUNC()
+and ERR_GET_REASON() can be used to extract these.
+
+The library number and function code describe where the error
+occurred, the reason code is the information about what went wrong.
+
+Each sub-library of OpenSSL has a unique library number; function and
+reason codes are unique within each sub-library.  Note that different
+libraries may use the same value to signal different functions and
+reasons.
+
+B<ERR_R_...> reason codes such as B<ERR_R_MALLOC_FAILURE> are globally
+unique. However, when checking for sub-library specific reason codes,
+be sure to also compare the library number.
+
+ERR_GET_LIB(), ERR_GET_FUNC() and ERR_GET_REASON() are macros.
+
+=head1 RETURN VALUES
+
+The library number, function code and reason code respectively.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>
+
+=head1 HISTORY
+
+ERR_GET_LIB(), ERR_GET_FUNC() and ERR_GET_REASON() are available in
+all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_clear_error.pod b/src/lib/libcrypto/doc/ERR_clear_error.pod
new file mode 100644
index 0000000000..566e1f4e31
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_clear_error.pod
@@ -0,0 +1,29 @@
+=pod
+
+=head1 NAME
+
+ERR_clear_error - clear the error queue
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_clear_error(void);
+
+=head1 DESCRIPTION
+
+ERR_clear_error() empties the current thread's error queue.
+
+=head1 RETURN VALUES
+
+ERR_clear_error() has no return value.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>
+
+=head1 HISTORY
+
+ERR_clear_error() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_error_string.pod b/src/lib/libcrypto/doc/ERR_error_string.pod
new file mode 100644
index 0000000000..0d2417599c
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_error_string.pod
@@ -0,0 +1,65 @@
+=pod
+
+=head1 NAME
+
+ERR_error_string - obtain human-readable error message
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ char *ERR_error_string(unsigned long e, char *buf);
+
+ const char *ERR_lib_error_string(unsigned long e);
+ const char *ERR_func_error_string(unsigned long e);
+ const char *ERR_reason_error_string(unsigned long e);
+
+=head1 DESCRIPTION
+
+ERR_error_string() generates a human-readable string representing the
+error code B<e>, and places it at B<buf>. B<buf> must be at least 120
+bytes long. If B<buf> is B<NULL>, the error string is placed in a
+static buffer.
+
+The string will have the following format:
+
+ error:[error code]:[library name]:[function name]:[reason string]
+
+I<error code> is an 8 digit hexadecimal number, I<library name>,
+I<function name> and I<reason string> are ASCII text.
+
+ERR_lib_error_string(), ERR_func_error_string() and
+ERR_reason_error_string() return the library name, function
+name and reason string respectively.
+
+The OpenSSL error strings should be loaded by calling
+L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)> or, for SSL
+applications, L<SSL_load_error_strings(3)|SSL_load_error_strings(3)>
+first.
+If there is no text string registered for the given error code,
+the error string will contain the numeric code.
+
+L<ERR_print_errors(3)|ERR_print_errors(3)> can be used to print
+all error codes currently in the queue.
+
+=head1 RETURN VALUES
+
+ERR_error_string() returns a pointer to a static buffer containing the
+string if B<buf == NULL>, B<buf> otherwise.
+
+ERR_lib_error_string(), ERR_func_error_string() and
+ERR_reason_error_string() return the strings, and B<NULL> if
+none is registered for the error code.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>,
+L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>,
+L<SSL_load_error_strings(3)|SSL_load_error_strings(3)>
+L<ERR_print_errors(3)|ERR_print_errors(3)>
+
+=head1 HISTORY
+
+ERR_error_string() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_get_error.pod b/src/lib/libcrypto/doc/ERR_get_error.pod
new file mode 100644
index 0000000000..75ece00d97
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_get_error.pod
@@ -0,0 +1,62 @@
+=pod
+
+=head1 NAME
+
+ERR_get_error, ERR_peek_error - obtain error code
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ unsigned long ERR_get_error(void);
+ unsigned long ERR_peek_error(void);
+
+ unsigned long ERR_get_error_line(const char **file, int *line);
+ unsigned long ERR_peek_error_line(const char **file, int *line);
+
+ unsigned long ERR_get_error_line_data(const char **file, int *line,
+         const char **data, int *flags);
+ unsigned long ERR_peek_error_line_data(const char **file, int *line,
+         const char **data, int *flags);
+
+=head1 DESCRIPTION
+
+ERR_get_error() returns the last error code from the thread's error
+queue and removes the entry. This function can be called repeatedly
+until there are no more error codes to return.
+
+ERR_peek_error() returns the last error code from the thread's
+error queue without modifying it.
+
+See L<ERR_GET_LIB(3)|ERR_GET_LIB(3)> for obtaining information about
+location and reason of the error, and
+L<ERR_error_string(3)|ERR_error_string(3)> for human-readable error
+messages.
+
+ERR_get_error_line() and ERR_peek_error_line() are the same as the
+above, but they additionally store the file name and line number where
+the error occurred in *B<file> and *B<line>, unless these are B<NULL>.
+
+ERR_get_error_line_data() and ERR_peek_error_line_data() store
+additional data and flags associated with the error code in *B<data>
+and *B<flags>, unless these are B<NULL>. *B<data> contains a string
+if *B<flags>&B<ERR_TXT_STRING>. If it has been allocated by Malloc(),
+*B<flags>&B<ERR_TXT_MALLOCED> is true.
+
+=head1 RETURN VALUES
+
+The error code, or 0 if there is no error in the queue.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>,
+L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>
+
+=head1 HISTORY
+
+ERR_get_error(), ERR_peek_error(), ERR_get_error_line() and
+ERR_peek_error_line() are available in all versions of SSLeay and
+OpenSSL. ERR_get_error_line_data() and ERR_peek_error_line_data()
+were added in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_load_crypto_strings.pod b/src/lib/libcrypto/doc/ERR_load_crypto_strings.pod
new file mode 100644
index 0000000000..9bdec75a46
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_load_crypto_strings.pod
@@ -0,0 +1,46 @@
+=pod
+
+=head1 NAME
+
+ERR_load_crypto_strings, SSL_load_error_strings, ERR_free_strings -
+load and free error strings
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_load_crypto_strings(void);
+ void ERR_free_strings(void);
+
+ #include <openssl/ssl.h>
+
+ void SSL_load_error_strings(void);
+
+=head1 DESCRIPTION
+
+ERR_load_crypto_strings() registers the error strings for all
+B<libcrypto> functions. SSL_load_error_strings() does the same,
+but also registers the B<libssl> error strings.
+
+One of these functions should be called before generating
+textual error messages. However, this is not required when memory
+usage is an issue.
+
+ERR_free_strings() frees all previously loaded error strings.
+
+=head1 RETURN VALUES
+
+ERR_load_crypto_strings(), SSL_load_error_strings() and
+ERR_free_strings() return no values.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>
+
+=head1 HISTORY
+
+ERR_load_error_strings(), SSL_load_error_strings() and
+ERR_free_strings() are available in all versions of SSLeay and
+OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_load_strings.pod b/src/lib/libcrypto/doc/ERR_load_strings.pod
new file mode 100644
index 0000000000..5acdd0edbc
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_load_strings.pod
@@ -0,0 +1,54 @@
+=pod
+
+=head1 NAME
+
+ERR_load_strings, ERR_PACK, ERR_get_next_error_library - load
+arbitrary error strings
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_load_strings(int lib, ERR_STRING_DATA str[]);
+
+ int ERR_get_next_error_library(void);
+
+ unsigned long ERR_PACK(int lib, int func, int reason);
+
+=head1 DESCRIPTION
+
+ERR_load_strings() registers error strings for library number B<lib>.
+
+B<str> is an array of error string data:
+
+ typedef struct ERR_string_data_st
+ {
+        unsigned long error;
+        char *string;
+ } ERR_STRING_DATA;
+
+The error code is generated from the library number and a function and
+reason code: B<error> = ERR_PACK(B<lib>, B<func>, B<reason>).
+ERR_PACK() is a macro.
+
+The last entry in the array is {0,0}.
+
+ERR_get_next_error_library() can be used to assign library numbers
+to user libraries at runtime.
+
+=head1 RETURN VALUE
+
+ERR_load_strings() returns no value. ERR_PACK() return the error code.
+ERR_get_next_error_library() returns a new library number.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)>
+
+=head1 HISTORY
+
+ERR_load_error_strings() and ERR_PACK() are available in all versions
+of SSLeay and OpenSSL. ERR_get_next_error_library() was added in
+SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_print_errors.pod b/src/lib/libcrypto/doc/ERR_print_errors.pod
new file mode 100644
index 0000000000..b100a5fa2b
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_print_errors.pod
@@ -0,0 +1,51 @@
+=pod
+
+=head1 NAME
+
+ERR_print_errors, ERR_print_errors_fp - print error messages
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_print_errors(BIO *bp);
+ void ERR_print_errors_fp(FILE *fp);
+
+=head1 DESCRIPTION
+
+ERR_print_errors() is a convenience function that prints the error
+strings for all errors that OpenSSL has recorded to B<bp>, thus
+emptying the error queue.
+
+ERR_print_errors_fp() is the same, except that the output goes to a
+B<FILE>.
+
+
+The error strings will have the following format:
+
+ [pid]:error:[error code]:[library name]:[function name]:[reason string]:[file name]:[line]:[optional text message]
+
+I<error code> is an 8 digit hexadecimal number. I<library name>,
+I<function name> and I<reason string> are ASCII text, as is I<optional
+text message> if one was set for the respective error code.
+
+If there is no text string registered for the given error code,
+the error string will contain the numeric code.
+
+=head1 RETURN VALUES
+
+ERR_print_errors() and ERR_print_errors_fp() return no values.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>,
+L<ERR_get_error(3)|ERR_get_error(3)>,
+L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>,
+L<SSL_load_error_strings(3)|SSL_load_error_strings(3)>
+
+=head1 HISTORY
+
+ERR_print_errors() and ERR_print_errors_fp()
+are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_put_error.pod b/src/lib/libcrypto/doc/ERR_put_error.pod
new file mode 100644
index 0000000000..acd241fbe4
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_put_error.pod
@@ -0,0 +1,44 @@
+=pod
+
+=head1 NAME
+
+ERR_put_error, ERR_add_error_data - record an error
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_put_error(int lib, int func, int reason, const char *file,
+         int line);
+
+ void ERR_add_error_data(int num, ...);
+
+=head1 DESCRIPTION
+
+ERR_put_error() adds an error code to the thread's error queue. It
+signals that the error of reason code B<reason> occurred in function
+B<func> of library B<lib>, in line number B<line> of B<file>.
+This function is usually called by a macro.
+
+ERR_add_error_data() associates the concatenation of its B<num> string
+arguments with the error code added last.
+
+L<ERR_load_strings(3)|ERR_load_strings(3)> can be used to register
+error strings so that the application can a generate human-readable
+error messages for the error code.
+
+=head1 RETURN VALUES
+
+ERR_put_error() and ERR_add_error_data() return
+no values.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)>
+
+=head1 HISTORY
+
+ERR_put_error() is available in all versions of SSLeay and OpenSSL.
+ERR_add_error_data() was added in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libcrypto/doc/ERR_remove_state.pod b/src/lib/libcrypto/doc/ERR_remove_state.pod
new file mode 100644
index 0000000000..ebcdc0f5a5
--- /dev/null
+++ b/src/lib/libcrypto/doc/ERR_remove_state.pod
@@ -0,0 +1,34 @@
+=pod
+
+=head1 NAME
+
+ERR_remove_state - free a thread's error queue
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_remove_state(unsigned long pid);
+
+=head1 DESCRIPTION
+
+ERR_remove_state() frees the error queue associated with thread B<pid>.
+If B<pid> == 0, the current thread will have its error queue removed.
+
+Since error queue data structures are allocated automatically for new
+threads, they must be freed when threads are terminated in oder to
+avoid memory leaks.
+
+=head1 RETURN VALUE
+
+ERR_remove_state() returns no value.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>
+
+=head1 HISTORY
+
+ERR_remove_state() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/EVP_DigestInit.pod b/src/lib/libcrypto/doc/EVP_DigestInit.pod
new file mode 100644
index 0000000000..345b1ddfa7
--- /dev/null
+++ b/src/lib/libcrypto/doc/EVP_DigestInit.pod
@@ -0,0 +1,197 @@
+=pod
+
+=head1 NAME
+
+EVP_DigestInit, EVP_DigestUpdate, EVP_DigestFinal - EVP digest routines
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ void EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type);
+ void EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, unsigned int cnt);
+ void EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md,
+        unsigned int *s);
+
+ #define EVP_MAX_MD_SIZE (16+20) /* The SSLv3 md5+sha1 type */
+
+ int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in);  
+
+ #define EVP_MD_type(e)                 ((e)->type)
+ #define EVP_MD_pkey_type(e)            ((e)->pkey_type)
+ #define EVP_MD_size(e)                 ((e)->md_size)
+ #define EVP_MD_block_size(e)           ((e)->block_size)
+
+ #define EVP_MD_CTX_md(e)               (e)->digest)
+ #define EVP_MD_CTX_size(e)             EVP_MD_size((e)->digest)
+ #define EVP_MD_CTX_block_size(e)       EVP_MD_block_size((e)->digest)
+ #define EVP_MD_CTX_type(e)             EVP_MD_type((e)->digest)
+
+ EVP_MD *EVP_md_null(void);
+ EVP_MD *EVP_md2(void);
+ EVP_MD *EVP_md5(void);
+ EVP_MD *EVP_sha(void);
+ EVP_MD *EVP_sha1(void);
+ EVP_MD *EVP_dss(void);
+ EVP_MD *EVP_dss1(void);
+ EVP_MD *EVP_mdc2(void);
+ EVP_MD *EVP_ripemd160(void);
+
+ const EVP_MD *EVP_get_digestbyname(const char *name);
+ #define EVP_get_digestbynid(a) EVP_get_digestbyname(OBJ_nid2sn(a))
+ #define EVP_get_digestbyobj(a) EVP_get_digestbynid(OBJ_obj2nid(a))
+
+=head1 DESCRIPTION
+
+The EVP digest routines are a high level interface to message digests.
+
+EVP_DigestInit() initialises a digest context B<ctx> to use a digest
+B<type>: this will typically be supplied by a function such as
+EVP_sha1().
+
+EVP_DigestUpdate() hashes B<cnt> bytes of data at B<d> into the
+digest context B<ctx>. This funtion can be called several times on the
+same B<ctx> to hash additional data.
+
+EVP_DigestFinal() retrieves the digest value from B<ctx> and places
+it in B<md>. If the B<s> parameter is not NULL then the number of
+bytes of data written (i.e. the length of the digest) will be written
+to the integer at B<s>, at most B<EVP_MAX_MD_SIZE> bytes will be written.
+After calling EVP_DigestFinal() no additional calls to EVP_DigestUpdate()
+can be made, but EVP_DigestInit() can be called to initialiase a new
+digest operation.
+
+EVP_MD_CTX_copy() can be used to copy the message digest state from
+B<in> to B<out>. This is useful if large amounts of data are to be
+hashed which only differ in the last few bytes.
+
+EVP_MD_size() and EVP_MD_CTX_size() return the size of the message digest
+when passed an B<EVP_MD> or an B<EVP_MD_CTX> structure, i.e. the size of the
+hash.
+
+EVP_MD_block_size() and EVP_MD_CTX_block_size() return the block size of the
+message digest when passed an B<EVP_MD> or an B<EVP_MD_CTX> structure.
+
+EVP_MD_type() and EVP_MD_CTX_type() return the NID of the OBJECT IDENTIFIER
+representing the given message digest when passed an B<EVP_MD> structure.
+For example EVP_MD_type(EVP_sha1()) returns B<NID_sha1>. This function is
+normally used when setting ASN1 OIDs.
+
+EVP_MD_CTX_md() returns the B<EVP_MD> structure corresponding to the passed
+B<EVP_MD_CTX>.
+
+EVP_MD_pkey_type() returns the NID of the public key signing algorithm associated
+with this digest. For example EVP_sha1() is associated with RSA so this will
+return B<NID_sha1WithRSAEncryption>. This "link" between digests and signature
+algorithms may not be retained in future versions of OpenSSL.
+
+EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_mdc2() and EVP_ripemd160()
+return B<EVP_MD> structures for the MD2, MD5, SHA, SHA1, MDC2 and RIPEMD160 digest
+algorithms respectively. The associated signature algorithm is RSA in each case.
+
+EVP_dss() and EVP_dss1() return B<EVP_MD> structures for SHA and SHA1 digest
+algorithms but using DSS (DSA) for the signature algorithm.
+
+EVP_md_null() is a "null" message digest that does nothing: i.e. the hash it
+returns is of zero length.
+
+EVP_get_digestbyname(), EVP_get_digestbynid() and EVP_get_digestbyobj()
+return an B<EVP_MD> structure when passed a digest name, a digest NID or
+an ASN1_OBJECT structure respectively. The digest table must be initialised
+using, for example, OpenSSL_add_all_digests() for these functions to work.
+
+=head1 RETURN VALUES
+
+EVP_DigestInit(), EVP_DigestUpdate() and EVP_DigestFinal() do not return values.
+
+EVP_MD_CTX_copy() returns 1 if successful or 0 for failure.
+
+EVP_MD_type(), EVP_MD_pkey_type() and EVP_MD_type() return the NID of the
+corresponding OBJECT IDENTIFIER or NID_undef if none exists.
+
+EVP_MD_size(), EVP_MD_block_size(), EVP_MD_CTX_size(e), EVP_MD_size(),
+EVP_MD_CTX_block_size() and EVP_MD_block_size() return the digest or block
+size in bytes.
+
+EVP_md_null(), EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_dss(),
+EVP_dss1(), EVP_mdc2() and EVP_ripemd160() return pointers to the
+corresponding EVP_MD structures.
+
+EVP_get_digestbyname(), EVP_get_digestbynid() and EVP_get_digestbyobj()
+return either an B<EVP_MD> structure or NULL if an error occurs.
+
+=head1 NOTES
+
+The B<EVP> interface to message digests should almost always be used in
+preference to the low level interfaces. This is because the code then becomes
+transparent to the digest used and much more flexible.
+
+SHA1 is the digest of choice for new applications. The other digest algorithms
+are still in common use.
+
+=head1 EXAMPLE
+
+This example digests the data "Test Message\n" and "Hello World\n", using the
+digest name passed on the command line.
+
+ #include <stdio.h>
+ #include <openssl/evp.h>
+
+ main(int argc, char *argv[])
+ {
+ EVP_MD_CTX mdctx;
+ const EVP_MD *md;
+ char mess1[] = "Test Message\n";
+ char mess2[] = "Hello World\n";
+ unsigned char md_value[EVP_MAX_MD_SIZE];
+ int md_len, i;
+
+ OpenSSL_add_all_digests();
+
+ if(!argv[1]) {
+        printf("Usage: mdtest digestname\n");
+        exit(1);
+ }
+
+ md = EVP_get_digestbyname(argv[1]);
+
+ if(!md) {
+        printf("Unknown message digest %s\n", argv[1]);
+        exit(1);
+ }
+
+ EVP_DigestInit(&mdctx, md);
+ EVP_DigestUpdate(&mdctx, mess1, strlen(mess1));
+ EVP_DigestUpdate(&mdctx, mess2, strlen(mess2));
+ EVP_DigestFinal(&mdctx, md_value, &md_len);
+
+ printf("Digest is: ");
+ for(i = 0; i < md_len; i++) printf("%02x", md_value[i]);
+ printf("\n");
+ }
+
+=head1 BUGS
+
+Several of the functions do not return values: maybe they should. Although the
+internal digest operations will never fail some future hardware based operations
+might.
+
+The link between digests and signing algorithms results in a situation where
+EVP_sha1() must be used with RSA and EVP_dss1() must be used with DSS
+even though they are identical digests.
+
+The size of an B<EVP_MD_CTX> structure is determined at compile time: this results
+in code that must be recompiled if the size of B<EVP_MD_CTX> increases.
+
+=head1 SEE ALSO
+
+L<evp(3)|evp(3)>, L<hmac(3)|hmac(3)>, L<md2(3)|md2(3)>,
+L<md5(3)|md5(3)>, L<mdc2(3)|mdc2(3)>, L<ripemd(3)|ripemd(3)>,
+L<sha(3)|sha(3)>, L<digest(1)|digest(1)>
+
+=head1 HISTORY
+
+EVP_DigestInit(), EVP_DigestUpdate() and EVP_DigestFinal() are
+available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/EVP_EncryptInit.pod b/src/lib/libcrypto/doc/EVP_EncryptInit.pod
new file mode 100644
index 0000000000..77ed4ccdba
--- /dev/null
+++ b/src/lib/libcrypto/doc/EVP_EncryptInit.pod
@@ -0,0 +1,224 @@
+=pod
+
+=head1 NAME
+
+EVP_EncryptInit, EVP_EncryptUpdate, EVP_EncryptFinal - EVP cipher routines
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ void EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+         unsigned char *key, unsigned char *iv);
+ void EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         int *outl, unsigned char *in, int inl);
+ void EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         int *outl);
+
+ void EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+         unsigned char *key, unsigned char *iv);
+ void EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         int *outl, unsigned char *in, int inl);
+ int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm,
+         int *outl);
+
+ void EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+         unsigned char *key, unsigned char *iv, int enc);
+ void EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         int *outl, unsigned char *in, int inl);
+ int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm,
+         int *outl);
+
+ void EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *a);
+
+ const EVP_CIPHER *EVP_get_cipherbyname(const char *name);
+ #define EVP_get_cipherbynid(a) EVP_get_cipherbyname(OBJ_nid2sn(a))
+ #define EVP_get_cipherbyobj(a) EVP_get_cipherbynid(OBJ_obj2nid(a))
+
+ #define EVP_CIPHER_nid(e)              ((e)->nid)
+ #define EVP_CIPHER_block_size(e)       ((e)->block_size)
+ #define EVP_CIPHER_key_length(e)       ((e)->key_len)
+ #define EVP_CIPHER_iv_length(e)        ((e)->iv_len)
+
+ int EVP_CIPHER_type(const EVP_CIPHER *ctx);
+ #define EVP_CIPHER_CTX_cipher(e)       ((e)->cipher)
+ #define EVP_CIPHER_CTX_nid(e)          ((e)->cipher->nid)
+ #define EVP_CIPHER_CTX_block_size(e)   ((e)->cipher->block_size)
+ #define EVP_CIPHER_CTX_key_length(e)   ((e)->cipher->key_len)
+ #define EVP_CIPHER_CTX_iv_length(e)    ((e)->cipher->iv_len)
+ #define EVP_CIPHER_CTX_type(c)         EVP_CIPHER_type(EVP_CIPHER_CTX_cipher(c))
+
+ int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
+ int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
+
+=head1 DESCRIPTION
+
+The EVP cipher routines are a high level interface to certain
+symmetric ciphers.
+
+EVP_EncryptInit() initialises a cipher context B<ctx> for encryption
+with cipher B<type>. B<type> is normally supplied by a function such
+as EVP_des_cbc() . B<key> is the symmetric key to use and B<iv> is the
+IV to use (if necessary), the actual number of bytes used for the
+key and IV depends on the cipher. It is possible to set all parameters
+to NULL except B<type> in an initial call and supply the remaining
+parameters in subsequent calls. This is normally done when the 
+EVP_CIPHER_asn1_to_param() function is called to set the cipher
+parameters from an ASN1 AlgorithmIdentifier and the key from a
+different source.
+
+EVP_EncryptUpdate() encrypts B<inl> bytes from the buffer B<in> and
+writes the encrypted version to B<out>. This function can be called
+multiple times to encrypt successive blocks of data. The amount
+of data written depends on the block alignment of the encrypted data:
+as a result the amount of data written may be anything from zero bytes
+to (inl + cipher_block_size - 1) so B<outl> should contain sufficient
+room.  The actual number of bytes written is placed in B<outl>.
+
+EVP_EncryptFinal() encrypts the "final" data, that is any data that
+remains in a partial block. It uses L<standard block padding|/NOTES> (aka PKCS
+padding). The encrypted final data is written to B<out> which should
+have sufficient space for one cipher block. The number of bytes written
+is placed in B<outl>. After this function is called the encryption operation
+is finished and no further calls to EVP_EncryptUpdate() should be made.
+
+EVP_DecryptInit(), EVP_DecryptUpdate() and EVP_DecryptFinal() are the
+corresponding decryption operations. EVP_DecryptFinal() will return an
+error code if the final block is not correctly formatted. The parameters
+and restrictions are identical to the encryption operations except that
+the decrypted data buffer B<out> passed to EVP_DecryptUpdate() should
+have sufficient room for (B<inl> + cipher_block_size) bytes unless the
+cipher block size is 1 in which case B<inl> bytes is sufficient.
+
+EVP_CipherInit(), EVP_CipherUpdate() and EVP_CipherFinal() are functions
+that can be used for decryption or encryption. The operation performed
+depends on the value of the B<enc> parameter. It should be set to 1 for
+encryption and 0 for decryption.
+
+EVP_CIPHER_CTX_cleanup() clears all information from a cipher context.
+It should be called after all operations using a cipher are complete
+so sensitive information does not remain in memory.
+
+EVP_get_cipherbyname(), EVP_get_cipherbynid() and EVP_get_cipherbyobj()
+return an EVP_CIPHER structure when passed a cipher name, a NID or an
+ASN1_OBJECT structure.
+
+EVP_CIPHER_nid() and EVP_CIPHER_CTX_nid() return the NID of a cipher when
+passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX> structure.  The actual NID
+value is an internal value which may not have a corresponding OBJECT
+IDENTIFIER.
+
+EVP_CIPHER_key_length() and EVP_CIPHER_CTX_key_length() return the key
+length of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>
+structure. The constant B<EVP_MAX_KEY_LENGTH> is the maximum key length
+for all ciphers.
+
+EVP_CIPHER_iv_length() and EVP_CIPHER_CTX_iv_length() return the IV
+length of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>.
+It will return zero if the cipher does not use an IV.  The constant
+B<EVP_MAX_IV_LENGTH> is the maximum IV length for all ciphers.
+
+EVP_CIPHER_block_size() and EVP_CIPHER_CTX_block_size() return the block
+size of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>
+structure. The constant B<EVP_MAX_IV_LENGTH> is also the maximum block
+length for all ciphers.
+
+EVP_CIPHER_type() and EVP_CIPHER_CTX_type() return the type of the passed
+cipher or context. This "type" is the actual NID of the cipher OBJECT
+IDENTIFIER as such it ignores the cipher parameters and 40 bit RC2 and
+128 bit RC2 have the same NID. If the cipher does not have an object
+identifier or does not have ASN1 support this function will return
+B<NID_undef>.
+
+EVP_CIPHER_CTX_cipher() returns the B<EVP_CIPHER> structure when passed
+an B<EVP_CIPHER_CTX> structure.
+
+EVP_CIPHER_param_to_asn1() sets the AlgorithmIdentifier "parameter" based
+on the passed cipher. This will typically include any parameters and an
+IV. The cipher IV (if any) must be set when this call is made. This call
+should be made before the cipher is actually "used" (before any
+EVP_EncryptUpdate(), EVP_DecryptUpdate() calls for example). This function
+may fail if the cipher does not have any ASN1 support.
+
+EVP_CIPHER_asn1_to_param() sets the cipher parameters based on an ASN1
+AlgorithmIdentifier "parameter". The precise effect depends on the cipher
+In the case of RC2, for example, it will set the IV and effective key length.
+This function should be called after the base cipher type is set but before
+the key is set. For example EVP_CipherInit() will be called with the IV and
+key set to NULL, EVP_CIPHER_asn1_to_param() will be called and finally
+EVP_CipherInit() again with all parameters except the key set to NULL. It is
+possible for this function to fail if the cipher does not have any ASN1 support
+or the parameters cannot be set (for example the RC2 effective key length
+does not have an B<EVP_CIPHER> structure).
+
+=head1 RETURN VALUES
+
+EVP_EncryptInit(), EVP_EncryptUpdate() and EVP_EncryptFinal() do not return
+values.
+
+EVP_DecryptInit() and EVP_DecryptUpdate() do not return values.
+EVP_DecryptFinal() returns 0 if the decrypt failed or 1 for success.
+
+EVP_CipherInit() and EVP_CipherUpdate() do not return values.
+EVP_CipherFinal() returns 1 for a decryption failure or 1 for success, if
+the operation is encryption then it always returns 1.
+
+EVP_CIPHER_CTX_cleanup() does not return a value.
+
+EVP_get_cipherbyname(), EVP_get_cipherbynid() and EVP_get_cipherbyobj()
+return an B<EVP_CIPHER> structure or NULL on error.
+
+EVP_CIPHER_nid() and EVP_CIPHER_CTX_nid() return a NID.
+
+EVP_CIPHER_block_size() and EVP_CIPHER_CTX_block_size() return the block
+size.
+
+EVP_CIPHER_key_length() and EVP_CIPHER_CTX_key_length() return the key
+length.
+
+EVP_CIPHER_iv_length() and EVP_CIPHER_CTX_iv_length() return the IV
+length or zero if the cipher does not use an IV.
+
+EVP_CIPHER_type() and EVP_CIPHER_CTX_type() return the NID of the cipher's
+OBJECT IDENTIFIER or NID_undef if it has no defined OBJECT IDENTIFIER.
+
+EVP_CIPHER_CTX_cipher() returns an B<EVP_CIPHER> structure.
+
+EVP_CIPHER_param_to_asn1() and EVP_CIPHER_asn1_to_param() return 1 for 
+success or zero for failure.
+
+=head1 NOTES
+
+Where possible the B<EVP> interface to symmetric ciphers should be used in
+preference to the low level interfaces. This is because the code then becomes
+transparent to the cipher used and much more flexible.
+
+PKCS padding works by adding B<n> padding bytes of value B<n> to make the total 
+length of the encrypted data a multiple of the block size. Padding is always
+added so if the data is already a multiple of the block size B<n> will equal
+the block size. For example if the block size is 8 and 11 bytes are to be
+encrypted then 5 padding bytes of value 5 will be added.
+
+When decrypting the final block is checked to see if it has the correct form.
+
+Although the decryption operation can produce an error, it is not a strong
+test that the input data or key is correct. A random block has better than
+1 in 256 chance of being of the correct format and problems with the
+input data earlier on will not produce a final decrypt error.
+
+=head1 BUGS
+
+The current B<EVP> cipher interface is not as flexible as it should be. Only
+certain "spot" encryption algorithms can be used for ciphers which have various
+parameters associated with them (RC2, RC5 for example) this is inadequate.
+
+Several of the functions do not return error codes because the software versions
+can never fail. This is not true of hardware versions.
+
+=head1 SEE ALSO
+
+L<evp(3)|evp(3)>
+
+=head1 HISTORY
+
+=cut
diff --git a/src/lib/libcrypto/doc/OPENSSL_VERSION_NUMBER.pod b/src/lib/libcrypto/doc/OPENSSL_VERSION_NUMBER.pod
new file mode 100644
index 0000000000..b0b1058d19
--- /dev/null
+++ b/src/lib/libcrypto/doc/OPENSSL_VERSION_NUMBER.pod
@@ -0,0 +1,46 @@
+=pod
+
+=head1 NAME
+
+OPENSSL_VERSION_NUMBER, SSLeay - get OpenSSL version number
+
+=head1 SYNOPSIS
+
+ #include <openssl/opensslv.h>
+ #define OPENSSL_VERSION_NUMBER 0xnnnnnnnnnL
+
+ #include <openssl/crypto.h>
+ long SSLeay(void);
+
+=head1 DESCRIPTION
+
+OPENSSL_VERSION_NUMBER is a numeric release version identifier:
+
+ MMNNFFRBB major minor fix final beta/patch
+
+for example
+
+ 0x000904100 == 0.9.4 release
+ 0x000905000 == 0.9.5 dev
+
+Versions prior to 0.9.3 have identifiers E<lt> 0x0930.
+For backward compatibility, SSLEAY_VERSION_NUMBER is also defined.
+
+SSLeay() returns this number. The return value can be compared to the
+macro to make sure that the correct version of the library has been
+loaded, especially when using DLLs on Windows systems.
+
+=head1 RETURN VALUE
+
+The version number.
+
+=head1 SEE ALSO
+
+L<crypto(3)|crypto(3)>
+
+=head1 HISTORY
+
+SSLeay() and SSLEAY_VERSION_NUMBER are available in all versions of SSLeay and OpenSSL.
+OPENSSL_VERSION_NUMBER is available in all versions of OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/OpenSSL_add_all_algorithms.pod b/src/lib/libcrypto/doc/OpenSSL_add_all_algorithms.pod
new file mode 100644
index 0000000000..1300fe190c
--- /dev/null
+++ b/src/lib/libcrypto/doc/OpenSSL_add_all_algorithms.pod
@@ -0,0 +1,65 @@
+=pod
+
+=head1 NAME
+
+OpenSSL_add_all_algorithms() - add algorithms to internal table
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ void OpenSSL_add_all_algorithms(void);
+ void OpenSSL_add_all_ciphers(void);
+ void OpenSSL_add_all_digests(void);
+
+ void EVP_cleanup(void);
+
+=head1 DESCRIPTION
+
+OpenSSL keeps an internal table of digest algorithms and ciphers. It uses
+this table to lookup ciphers via functions such as EVP_get_cipher_byname().
+
+OpenSSL_add_all_digests() adds all digest algorithms to the table.
+
+OpenSSL_add_all_algorithms() adds all algorithms to the table (digests and
+ciphers).
+
+OpenSSL_add_all_ciphers() adds all encryption algorithms to the table including
+password based encryption algorithms.
+
+EVP_cleanup() removes all ciphers and digests from the table.
+
+=head1 RETURN VALUES
+
+None of the functions return a value.
+
+=head1 NOTES
+
+A typical application will will call OpenSSL_add_all_algorithms() initially and
+EVP_cleanup() before exiting.
+
+An application does not need to add algorithms to use them explicitly, for example
+by EVP_sha1(). It just needs to add them if it (or any of the functions it calls)
+needs to lookup algorithms.
+
+The cipher and digest lookup functions are used in many parts of the library. If
+the table is not initialised several functions will misbehave and complain they
+cannot find algorithms. This includes the PEM, PKCS#12, SSL and S/MIME libraries.
+This is a common query in the OpenSSL mailing lists.
+
+Calling OpenSSL_add_all_algorithms() links in all algorithms: as a result a
+statically linked executable can be quite large. If this is important it is possible
+to just add the required ciphers and digests.
+
+=head1 BUGS
+
+Although the functions do not return error codes it is possible for them to fail.
+This will only happen as a result of a memory allocation failure so this is not
+too much of a problem in practice.
+
+=head1 SEE ALSO
+
+L<evp(3)|evp(3)>, L<EVP_DigestInit(3)|EVP_DigestInit(3)>,
+L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>
+
+=cut
diff --git a/src/lib/libcrypto/doc/RAND_add.pod b/src/lib/libcrypto/doc/RAND_add.pod
new file mode 100644
index 0000000000..0a13ec2a92
--- /dev/null
+++ b/src/lib/libcrypto/doc/RAND_add.pod
@@ -0,0 +1,68 @@
+=pod
+
+=head1 NAME
+
+RAND_add, RAND_seed, RAND_screen - add entropy to the PRNG
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ void RAND_seed(const void *buf, int num);
+
+ void RAND_add(const void *buf, int num, double entropy);
+
+ int  RAND_status(void);
+
+ void RAND_screen(void);
+
+=head1 DESCRIPTION
+
+RAND_add() mixes the B<num> bytes at B<buf> into the PRNG state. Thus,
+if the data at B<buf> are unpredictable to an adversary, this
+increases the uncertainty about the state and makes the PRNG output
+less predictable. Suitable input comes from user interaction (random
+key presses, mouse movements) and certain hardware events. The
+B<entropy> argument is (the lower bound of) an estimate of how much
+randomness is contained in B<buf>, measured in bytes. Details about
+sources of randomness and how to estimate their entropy can be found
+in the literature, e.g. RFC 1750.
+
+RAND_add() may be called with sensitive data such as user entered
+passwords. The seed values cannot be recovered from the PRNG output.
+
+OpenSSL makes sure that the PRNG state is unique for each thread. On
+systems that provide C</dev/urandom>, the randomness device is used
+to seed the PRNG transparently. However, on all other systems, the
+application is responsible for seeding the PRNG by calling RAND_add(),
+L<RAND_egd(3)|RAND_egd(3)>
+or L<RAND_load_file(3)|RAND_load_file(3)>.
+
+RAND_seed() is equivalent to RAND_add() when B<num == entropy>.
+
+The RAND_screen() function is available for the convenience of Windows
+programmers. It adds the current contents of the screen to the PRNG.
+For applications that can catch Windows events, seeding the PRNG with
+the parameters of B<WM_MOUSEMOVE> events is a significantly better
+source of randomness. It should be noted that both methods cannot be
+used on servers that run without user interaction.
+
+=head1 RETURN VALUES
+
+RAND_status() returns 1 if the PRNG has been seeded with enough data,
+0 otherwise.
+
+The other functions do not return values.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>, L<RAND_egd(3)|RAND_egd(3)>,
+L<RAND_load_file(3)|RAND_load_file(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)>
+
+=head1 HISTORY
+
+RAND_seed() and RAND_screen() are available in all versions of SSLeay
+and OpenSSL. RAND_add() and RAND_status() have been added in OpenSSL
+0.9.5.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RAND_bytes.pod b/src/lib/libcrypto/doc/RAND_bytes.pod
new file mode 100644
index 0000000000..b6ebd50527
--- /dev/null
+++ b/src/lib/libcrypto/doc/RAND_bytes.pod
@@ -0,0 +1,46 @@
+=pod
+
+=head1 NAME
+
+RAND_bytes, RAND_pseudo_bytes - generate random data
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ int RAND_bytes(unsigned char *buf, int num);
+
+ int RAND_pseudo_bytes(unsigned char *buf, int num);
+
+=head1 DESCRIPTION
+
+RAND_bytes() puts B<num> cryptographically strong pseudo-random bytes
+into B<buf>. An error occurs if the PRNG has not been seeded with
+enough randomness to ensure an unpredictable byte sequence.
+
+RAND_pseudo_bytes() puts B<num> pseudo-random bytes into B<buf>.
+Pseudo-random byte sequences generated by RAND_pseudo_bytes() will be
+unique if they are of sufficient length, but are not necessarily
+unpredictable. They can be used for non-cryptographic purposes and for
+certain purposes in cryptographic protocols, but usually not for key
+generation etc.
+
+=head1 RETURN VALUES
+
+RAND_bytes() returns 1 on success, 0 otherwise. The error code can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>. RAND_pseudo_bytes() returns 1 if the
+bytes generated are cryptographically strong, 0 otherwise. Both
+functions return -1 if they are not supported by the current RAND
+method.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>, L<err(3)|err(3)>, L<RAND_add(3)|RAND_add(3)>
+
+=head1 HISTORY
+
+RAND_bytes() is available in all versions of SSLeay and OpenSSL.  It
+has a return value since OpenSSL 0.9.5. RAND_pseudo_bytes() was added
+in OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RAND_cleanup.pod b/src/lib/libcrypto/doc/RAND_cleanup.pod
new file mode 100644
index 0000000000..3a8f0749a8
--- /dev/null
+++ b/src/lib/libcrypto/doc/RAND_cleanup.pod
@@ -0,0 +1,29 @@
+=pod
+
+=head1 NAME
+
+RAND_cleanup - erase the PRNG state
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ void RAND_cleanup(void);
+
+=head1 DESCRIPTION
+
+RAND_cleanup() erases the memory used by the PRNG.
+
+=head1 RETURN VALUE
+
+RAND_cleanup() returns no value.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>
+
+=head1 HISTORY
+
+RAND_cleanup() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RAND_load_file.pod b/src/lib/libcrypto/doc/RAND_load_file.pod
new file mode 100644
index 0000000000..8dd700ca3d
--- /dev/null
+++ b/src/lib/libcrypto/doc/RAND_load_file.pod
@@ -0,0 +1,53 @@
+=pod
+
+=head1 NAME
+
+RAND_load_file, RAND_write_file, RAND_file_name - PRNG seed file
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ const char *RAND_file_name(char *buf, int num);
+
+ int RAND_load_file(const char *filename, long max_bytes);
+
+ int RAND_write_file(const char *filename);
+
+=head1 DESCRIPTION
+
+RAND_file_name() generates a default path for the random seed
+file. B<buf> points to a buffer of size B<num> in which to store the
+filename. The seed file is $RANDFILE if that environment variable is
+set, $HOME/.rnd otherwise. If $HOME is not set either, or B<num> is
+too small for the path name, an error occurs.
+
+RAND_load_file() reads a number of bytes from file B<filename> and
+adds them to the PRNG. If B<max_bytes> is non-negative,
+up to to B<max_bytes> are read; starting with OpenSSL 0.9.5,
+if B<max_bytes> is -1, the complete file is read.
+
+RAND_write_file() writes a number of random bytes (currently 1024) to
+file B<filename> which can be used to initialize the PRNG by calling
+RAND_load_file() in a later session.
+
+=head1 RETURN VALUES
+
+RAND_load_file() returns the number of bytes read.
+
+RAND_write_file() returns the number of bytes written, and -1 if the
+bytes written were generated without appropriate seed.
+
+RAND_file_name() returns a pointer to B<buf> on success, and NULL on
+error.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>, L<RAND_add(3)|RAND_add(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)>
+
+=head1 HISTORY
+
+RAND_load_file(), RAND_write_file() and RAND_file_name() are available in
+all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RAND_set_rand_method.pod b/src/lib/libcrypto/doc/RAND_set_rand_method.pod
new file mode 100644
index 0000000000..466e9b8767
--- /dev/null
+++ b/src/lib/libcrypto/doc/RAND_set_rand_method.pod
@@ -0,0 +1,57 @@
+=pod
+
+=head1 NAME
+
+RAND_set_rand_method, RAND_get_rand_method, RAND_SSLeay - select RAND method
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ void RAND_set_rand_method(RAND_METHOD *meth);
+
+ RAND_METHOD *RAND_get_rand_method(void);
+
+ RAND_METHOD *RAND_SSLeay(void);
+
+=head1 DESCRIPTION
+
+A B<RAND_METHOD> specifies the functions that OpenSSL uses for random
+number generation. By modifying the method, alternative
+implementations such as hardware RNGs may be used.  Initially, the
+default is to use the OpenSSL internal implementation. RAND_SSLeay()
+returns a pointer to that method.
+
+RAND_set_rand_method() sets the RAND method to B<meth>.
+RAND_get_rand_method() returns a pointer to the current method.
+
+=head1 THE RAND_METHOD STRUCTURE
+
+ typedef struct rand_meth_st
+ {
+        void (*seed)(const void *buf, int num);
+        int (*bytes)(unsigned char *buf, int num);
+        void (*cleanup)(void);
+        void (*add)(const void *buf, int num, int entropy);
+        int (*pseudorand)(unsigned char *buf, int num);
+ } RAND_METHOD;
+
+The components point to the implementation of RAND_seed(),
+RAND_bytes(), RAND_cleanup(), RAND_add() and RAND_pseudo_rand().
+Each component may be NULL if the function is not implemented.
+
+=head1 RETURN VALUES
+
+RAND_set_rand_method() returns no value. RAND_get_rand_method() and
+RAND_SSLeay() return pointers to the respective methods.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>
+
+=head1 HISTORY
+
+RAND_set_rand_method(), RAND_get_rand_method() and RAND_SSLeay() are
+available in all versions of OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_blinding_on.pod b/src/lib/libcrypto/doc/RSA_blinding_on.pod
new file mode 100644
index 0000000000..fd2c69abd8
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_blinding_on.pod
@@ -0,0 +1,43 @@
+=pod
+
+=head1 NAME
+
+RSA_blinding_on, RSA_blinding_off - protect the RSA operation from timing attacks
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_blinding_on(RSA *rsa, BN_CTX *ctx);
+
+ void RSA_blinding_off(RSA *rsa);
+
+=head1 DESCRIPTION
+
+RSA is vulnerable to timing attacks. In a setup where attackers can
+measure the time of RSA decryption or signature operations, blinding
+must be used to protect the RSA operation from that attack.
+
+RSA_blinding_on() turns blinding on for key B<rsa> and generates a
+random blinding factor. B<ctx> is B<NULL> or a pre-allocated and
+initialized B<BN_CTX>. The random number generator must be seeded
+prior to calling RSA_blinding_on().
+
+RSA_blinding_off() turns blinding off and frees the memory used for
+the blinding factor.
+
+=head1 RETURN VALUES
+
+RSA_blinding_on() returns 1 on success, and 0 if an error occurred.
+
+RSA_blinding_off() returns no value.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<rand(3)|rand(3)>
+
+=head1 HISTORY
+
+RSA_blinding_on() and RSA_blinding_off() appeared in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_check_key.pod b/src/lib/libcrypto/doc/RSA_check_key.pod
new file mode 100644
index 0000000000..79fed753ad
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_check_key.pod
@@ -0,0 +1,39 @@
+=pod
+
+=head1 NAME
+
+RSA_check_key - validate private RSA keys
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_check_key(RSA *rsa);
+
+=head1 DESCRIPTION
+
+This function validates RSA keys. It checks that B<p> and B<q> are
+in fact prime, and that B<n = p*q>.
+
+It also checks that B<d*e = 1 mod (p-1*q-1)>,
+and that B<dmp1>, B<dmq1> and B<iqmp> are set correctly or are B<NULL>.
+
+The key's public components may not be B<NULL>.
+
+=head1 RETURN VALUE
+
+RSA_check_key() returns 1 if B<rsa> is a valid RSA key, and 0 otherwise.
+-1 is returned if an error occurs while checking the key.
+
+If the key is invalid or an error occurred, the reason code can be
+obtained using L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<err(3)|err(3)>
+
+=head1 HISTORY
+
+RSA_check() appeared in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_generate_key.pod b/src/lib/libcrypto/doc/RSA_generate_key.pod
new file mode 100644
index 0000000000..fdaddbcb13
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_generate_key.pod
@@ -0,0 +1,68 @@
+=pod
+
+=head1 NAME
+
+RSA_generate_key - generate RSA key pair
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ RSA *RSA_generate_key(int num, unsigned long e,
+    void (*callback)(int,int,void *), void *cb_arg);
+
+=head1 DESCRIPTION
+
+RSA_generate_key() generates a key pair and returns it in a newly
+allocated B<RSA> structure. The pseudo-random number generator must
+be seeded prior to calling RSA_generate_key().
+
+The modulus size will be B<num> bits, and the public exponent will be
+B<e>. Key sizes with B<num> E<lt> 1024 should be considered insecure.
+The exponent is an odd number, typically 3 or 65535.
+
+A callback function may be used to provide feedback about the
+progress of the key generation. If B<callback> is not B<NULL>, it
+will be called as follows:
+
+=over 4
+
+=item *
+
+While a random prime number is generated, it is called as
+described in L<BN_generate_prime(3)|BN_generate_prime(3)>.
+
+=item *
+
+When the n-th randomly generated prime is rejected as not
+suitable for the key, B<callback(2, n, cb_arg)> is called.
+
+=item *
+
+When a random p has been found with p-1 relatively prime to B<e>,
+it is called as B<callback(3, 0, cb_arg)>.
+
+=back
+
+The process is then repeated for prime q with B<callback(3, 1, cb_arg)>.
+
+=head1 RETURN VALUE
+
+If key generation fails, RSA_generate_key() returns B<NULL>; the
+error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+B<callback(2, x, cb_arg)> is used with two different meanings.
+
+RSA_generate_key() goes into an infinite loop for illegal input values.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<RSA_free(3)|RSA_free(3)>
+
+=head1 HISTORY
+
+The B<cb_arg> argument was added in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_get_ex_new_index.pod b/src/lib/libcrypto/doc/RSA_get_ex_new_index.pod
new file mode 100644
index 0000000000..920dc76325
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_get_ex_new_index.pod
@@ -0,0 +1,122 @@
+=pod
+
+=head1 NAME
+
+RSA_get_ex_new_index, RSA_set_ex_data, RSA_get_ex_data - add application specific data to RSA structures
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_get_ex_new_index(long argl, void *argp,
+                CRYPTO_EX_new *new_func,
+                CRYPTO_EX_dup *dup_func,
+                CRYPTO_EX_free *free_func);
+
+ int RSA_set_ex_data(RSA *r, int idx, void *arg);
+
+ void *RSA_get_ex_data(RSA *r, int idx);
+
+ int new_func(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+
+ void free_func(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+
+ int dup_func(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d, 
+                                        int idx, long argl, void *argp);
+
+=head1 DESCRIPTION
+
+Several OpenSSL structures can have application specific data attached to them.
+This has several potential uses, it can be used to cache data associated with
+a structure (for example the hash of some part of the structure) or some
+additional data (for example a handle to the data in an external library).
+
+Since the application data can be anything at all it is passed and retrieved
+as a B<void *> type.
+
+The B<RSA_get_ex_new_index()> function is initially called to "register" some
+new application specific data. It takes three optional function pointers which
+are called when the parent structure (in this case an RSA structure) is
+initially created, when it is copied and when it is freed up. If any or all of
+these function pointer arguments are not used they should be set to NULL. The
+precise manner in which these function pointers are called is described in more
+detail below. B<RSA_get_ex_new_index()> also takes additional long and pointer
+parameters which will be passed to the supplied functions but which otherwise
+have no special meaning. It returns an B<index> which should be stored
+(typically in a static variable) and passed used in the B<idx> parameter in
+the remaining functions. Each successful call to B<RSA_get_ex_new_index()>
+will return an index greater than any previously returned, this is important
+because the optional functions are called in order of increasing index value.
+
+B<RSA_set_ex_data()> is used to set application specific data, the data is
+supplied in the B<arg> parameter and its precise meaning is up to the
+application.
+
+B<RSA_get_ex_data()> is used to retrieve application specific data. The data
+is returned to the application, this will be the same value as supplied to
+a previous B<RSA_set_ex_data()> call.
+
+B<new_func()> is called when a structure is initially allocated (for example
+with B<RSA_new()>. The parent structure members will not have any meaningful
+values at this point. This function will typically be used to allocate any
+application specific structure.
+
+B<free_func()> is called when a structure is being freed up. The dynamic parent
+structure members should not be accessed because they will be freed up when
+this function is called.
+
+B<new_func()> and B<free_func()> take the same parameters. B<parent> is a
+pointer to the parent RSA structure. B<ptr> is a the application specific data
+(this wont be of much use in B<new_func()>. B<ad> is a pointer to the
+B<CRYPTO_EX_DATA> structure from the parent RSA structure: the functions
+B<CRYPTO_get_ex_data()> and B<CRYPTO_set_ex_data()> can be called to manipulate
+it. The B<idx> parameter is the index: this will be the same value returned by
+B<RSA_get_ex_new_index()> when the functions were initially registered. Finally
+the B<argl> and B<argp> parameters are the values originally passed to the same
+corresponding parameters when B<RSA_get_ex_new_index()> was called.
+
+B<dup_func()> is called when a structure is being copied. Pointers to the
+destination and source B<CRYPTO_EX_DATA> structures are passed in the B<to> and
+B<from> parameters respectively. The B<from_d> parameter is passed a pointer to
+the source application data when the function is called, when the function returns
+the value is copied to the destination: the application can thus modify the data
+pointed to by B<from_d> and have different values in the source and destination.
+The B<idx>, B<argl> and B<argp> parameters are the same as those in B<new_func()>
+and B<free_func()>.
+
+=head1 RETURN VALUES
+
+B<RSA_get_ex_new_index()> returns a new index or -1 on failure (note 0 is a valid
+index value).
+
+B<RSA_set_ex_data()> returns 1 on success or 0 on failure.
+
+B<RSA_get_ex_data()> returns the application data or 0 on failure. 0 may also
+be valid application data but currently it can only fail if given an invalid B<idx>
+parameter.
+
+B<new_func()> and B<dup_func()> should return 0 for failure and 1 for success.
+
+On failure an error code can be obtained from L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+B<dup_func()> is currently never called.
+
+The return value of B<new_func()> is ignored.
+
+The B<new_func()> function isn't very useful because no meaningful values are
+present in the parent RSA structure when it is called.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<CRYPTO_set_ex_data(3)|CRYPTO_set_ex_data(3)>
+
+=head1 HISTORY
+
+RSA_get_ex_new_index(), RSA_set_ex_data() and RSA_get_ex_data() are
+available since SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_new.pod b/src/lib/libcrypto/doc/RSA_new.pod
new file mode 100644
index 0000000000..f16490ea6a
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_new.pod
@@ -0,0 +1,38 @@
+=pod
+
+=head1 NAME
+
+RSA_new, RSA_free - allocate and free RSA objects
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ RSA * RSA_new(void);
+
+ void RSA_free(RSA *rsa);
+
+=head1 DESCRIPTION
+
+RSA_new() allocates and initializes an B<RSA> structure.
+
+RSA_free() frees the B<RSA> structure and its components. The key is
+erased before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+If the allocation fails, RSA_new() returns B<NULL> and sets an error
+code that can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>. Otherwise it returns
+a pointer to the newly allocated structure.
+
+RSA_free() returns no value.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<rsa(3)|rsa(3)>, L<RSA_generate_key(3)|RSA_generate_key(3)>
+
+=head1 HISTORY
+
+RSA_new() and RSA_free() are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_padding_add_PKCS1_type_1.pod b/src/lib/libcrypto/doc/RSA_padding_add_PKCS1_type_1.pod
new file mode 100644
index 0000000000..b8f678fe72
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_padding_add_PKCS1_type_1.pod
@@ -0,0 +1,124 @@
+=pod
+
+=head1 NAME
+
+RSA_padding_add_PKCS1_type_1, RSA_padding_check_PKCS1_type_1,
+RSA_padding_add_PKCS1_type_2, RSA_padding_check_PKCS1_type_2,
+RSA_padding_add_PKCS1_OAEP, RSA_padding_check_PKCS1_OAEP,
+RSA_padding_add_SSLv23, RSA_padding_check_SSLv23,
+RSA_padding_add_none, RSA_padding_check_none - asymmetric encryption
+padding
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
+    unsigned char *f, int fl);
+
+ int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len);
+
+ int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
+    unsigned char *f, int fl);
+
+ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len);
+
+ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
+    unsigned char *f, int fl, unsigned char *p, int pl);
+
+ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len, unsigned char *p, int pl);
+
+ int RSA_padding_add_SSLv23(unsigned char *to, int tlen,
+    unsigned char *f, int fl);
+
+ int RSA_padding_check_SSLv23(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len);
+
+ int RSA_padding_add_none(unsigned char *to, int tlen,
+    unsigned char *f, int fl);
+
+ int RSA_padding_check_none(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len);
+
+=head1 DESCRIPTION
+
+The RSA_padding_xxx_xxx() functions are called from the RSA encrypt,
+decrypt, sign and verify functions. Normally they should not be called
+from application programs.
+
+However, they can also be called directly to implement padding for other
+asymmetric ciphers. RSA_padding_add_PKCS1_OAEP() and
+RSA_padding_check_PKCS1_OAEP() may be used in an application combined
+with B<RSA_NO_PADDING> in order to implement OAEP with an encoding
+parameter.
+
+RSA_padding_add_xxx() encodes B<fl> bytes from B<f> so as to fit into
+B<tlen> bytes and stores the result at B<to>. An error occurs if B<fl>
+does not meet the size requirements of the encoding method.
+
+The following encoding methods are implemented:
+
+=over 4
+
+=item PKCS1_type_1
+
+PKCS #1 v2.0 EMSA-PKCS1-v1_5 (PKCS #1 v1.5 block type 1); used for signatures
+
+=item PKCS1_type_2
+
+PKCS #1 v2.0 EME-PKCS1-v1_5 (PKCS #1 v1.5 block type 2)
+
+=item PKCS1_OAEP
+
+PKCS #1 v2.0 EME-OAEP
+
+=item SSLv23
+
+PKCS #1 EME-PKCS1-v1_5 with SSL-specific modification
+
+=item none
+
+simply copy the data
+
+=back
+
+The random number generator must be seeded prior to calling
+RSA_padding_add_xxx().
+
+RSA_padding_check_xxx() verifies that the B<fl> bytes at B<f> contain
+a valid encoding for a B<rsa_len> byte RSA key in the respective
+encoding method and stores the recovered data of at most B<tlen> bytes
+(for B<RSA_NO_PADDING>: of size B<tlen>)
+at B<to>.
+
+For RSA_padding_xxx_OAEP(), B<p> points to the encoding parameter
+of length B<pl>. B<p> may be B<NULL> if B<pl> is 0.
+
+=head1 RETURN VALUES
+
+The RSA_padding_add_xxx() functions return 1 on success, 0 on error.
+The RSA_padding_check_xxx() functions return the length of the
+recovered data, -1 on error. Error codes can be obtained by calling
+L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<RSA_public_encrypt(3)|RSA_public_encrypt(3)>,
+L<RSA_private_decrypt(3)|RSA_private_decrypt(3)>,
+L<RSA_sign(3)|RSA_sign(3)>, L<RSA_verify(3)|RSA_verify(3)>
+
+=head1 HISTORY
+
+RSA_padding_add_PKCS1_type_1(), RSA_padding_check_PKCS1_type_1(),
+RSA_padding_add_PKCS1_type_2(), RSA_padding_check_PKCS1_type_2(),
+RSA_padding_add_SSLv23(), RSA_padding_check_SSLv23(),
+RSA_padding_add_none() and RSA_padding_check_none() appeared in
+SSLeay 0.9.0.
+
+RSA_padding_add_PKCS1_OAEP() and RSA_padding_check_PKCS1_OAEP() were
+added in OpenSSL 0.9.2b.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_print.pod b/src/lib/libcrypto/doc/RSA_print.pod
new file mode 100644
index 0000000000..dd968a5274
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_print.pod
@@ -0,0 +1,48 @@
+=pod
+
+=head1 NAME
+
+RSA_print, RSA_print_fp, DHparams_print, DHparams_print_fp - print
+cryptographic parameters
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_print(BIO *bp, RSA *x, int offset);
+ int RSA_print_fp(FILE *fp, RSA *x, int offset);
+
+ #include <openssl/dsa.h>
+
+ int DSAparams_print(BIO *bp, DSA *x);
+ int DSAparams_print_fp(FILE *fp, DSA *x);
+ int DSA_print(BIO *bp, DSA *x, int offset);
+ int DSA_print_fp(FILE *fp, DSA *x, int offset);
+
+ #include <openssl/dh.h>
+
+ int DHparams_print(BIO *bp, DH *x);
+ int DHparams_print_fp(FILE *fp, DH *x);
+
+=head1 DESCRIPTION
+
+A human-readable hexadecimal output of the components of the RSA
+key, DSA parameters or key or DH parameters is printed to B<bp> or B<fp>.
+
+The output lines are indented by B<offset> spaces.
+
+=head1 RETURN VALUES
+
+These functions return 1 on success, 0 on error.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<dsa(3)|dsa(3)>, L<rsa(3)|rsa(3)>, L<BN_bn2bin(3)|BN_bn2bin(3)>
+
+=head1 HISTORY
+
+RSA_print(), RSA_print_fp(), DSA_print(), DSA_print_fp(), DH_print(),
+DH_print_fp() are available in all versions of SSLeay and OpenSSL.
+DSAparams_print() and DSAparams_print_pf() were added in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_private_encrypt.pod b/src/lib/libcrypto/doc/RSA_private_encrypt.pod
new file mode 100644
index 0000000000..6861a98a10
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_private_encrypt.pod
@@ -0,0 +1,69 @@
+=pod
+
+=head1 NAME
+
+RSA_private_encrypt, RSA_public_decrypt - low level signature operations
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_private_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa, int padding);
+
+ int RSA_public_decrypt(int flen, unsigned char *from, 
+    unsigned char *to, RSA *rsa, int padding);
+
+=head1 DESCRIPTION
+
+These functions handle RSA signatures at a low level.
+
+RSA_private_encrypt() signs the B<flen> bytes at B<from> (usually a
+message digest with an algorithm identifier) using the private key
+B<rsa> and stores the signature in B<to>. B<to> must point to
+B<RSA_size(rsa)> bytes of memory.
+
+B<padding> denotes one of the following modes:
+
+=over 4
+
+=item RSA_PKCS1_PADDING
+
+PKCS #1 v1.5 padding. This function does not handle the
+B<algorithmIdentifier> specified in PKCS #1. When generating or
+verifying PKCS #1 signatures, L<RSA_sign(3)|RSA_sign(3)> and L<RSA_verify(3)|RSA_verify(3)> should be
+used.
+
+=item RSA_NO_PADDING
+
+Raw RSA signature. This mode should I<only> be used to implement
+cryptographically sound padding modes in the application code.
+Signing user data directly with RSA is insecure.
+
+=back
+
+RSA_public_decrypt() recovers the message digest from the B<flen>
+bytes long signature at B<from> using the signer's public key
+B<rsa>. B<to> must point to a memory section large enough to hold the
+message digest (which is smaller than B<RSA_size(rsa) -
+11>). B<padding> is the padding mode that was used to sign the data.
+
+=head1 RETURN VALUES
+
+RSA_private_encrypt() returns the size of the signature (i.e.,
+RSA_size(rsa)). RSA_public_decrypt() returns the size of the
+recovered message digest.
+
+On error, -1 is returned; the error codes can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<rsa(3)|rsa(3)>, L<RSA_sign(3)|RSA_sign(3)>, L<RSA_verify(3)|RSA_verify(3)>
+
+=head1 HISTORY
+
+The B<padding> argument was added in SSLeay 0.8. RSA_NO_PADDING is
+available since SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_public_encrypt.pod b/src/lib/libcrypto/doc/RSA_public_encrypt.pod
new file mode 100644
index 0000000000..910c4752b8
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_public_encrypt.pod
@@ -0,0 +1,86 @@
+=pod
+
+=head1 NAME
+
+RSA_public_encrypt, RSA_private_decrypt - RSA public key cryptography
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_public_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa, int padding);
+
+ int RSA_private_decrypt(int flen, unsigned char *from,
+     unsigned char *to, RSA *rsa, int padding);
+
+=head1 DESCRIPTION
+
+RSA_public_encrypt() encrypts the B<flen> bytes at B<from> (usually a
+session key) using the public key B<rsa> and stores the ciphertext in
+B<to>. B<to> must point to RSA_size(B<rsa>) bytes of memory.
+
+B<padding> denotes one of the following modes:
+
+=over 4
+
+=item RSA_PKCS1_PADDING
+
+PKCS #1 v1.5 padding. This currently is the most widely used mode.
+
+=item RSA_PKCS1_OAEP_PADDING
+
+EME-OAEP as defined in PKCS #1 v2.0 with SHA-1, MGF1 and an empty
+encoding parameter. This mode is recommended for all new applications.
+
+=item RSA_SSLV23_PADDING
+
+PKCS #1 v1.5 padding with an SSL-specific modification that denotes
+that the server is SSL3 capable.
+
+=item RSA_NO_PADDING
+
+Raw RSA encryption. This mode should I<only> be used to implement
+cryptographically sound padding modes in the application code.
+Encrypting user data directly with RSA is insecure.
+
+=back
+
+B<flen> must be less than RSA_size(B<rsa>) - 11 for the PKCS #1 v1.5
+based padding modes, and less than RSA_size(B<rsa>) - 21 for
+RSA_PKCS1_OAEP_PADDING. The random number generator must be seeded
+prior to calling RSA_public_encrypt().
+
+RSA_private_decrypt() decrypts the B<flen> bytes at B<from> using the
+private key B<rsa> and stores the plaintext in B<to>. B<to> must point
+to a memory section large enough to hold the decrypted data (which is
+smaller than RSA_size(B<rsa>)). B<padding> is the padding mode that
+was used to encrypt the data.
+
+=head1 RETURN VALUES
+
+RSA_public_encrypt() returns the size of the encrypted data (i.e.,
+RSA_size(B<rsa>)). RSA_private_decrypt() returns the size of the
+recovered plaintext.
+
+On error, -1 is returned; the error codes can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 CONFORMING TO
+
+SSL, PKCS #1 v2.0
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<RSA_size(3)|RSA_size(3)>
+
+=head1 NOTES
+
+The L<RSA_PKCS1_RSAref(3)|RSA_PKCS1_RSAref(3)> method supports only the RSA_PKCS1_PADDING mode.
+
+=head1 HISTORY
+
+The B<padding> argument was added in SSLeay 0.8. RSA_NO_PADDING is
+available since SSLeay 0.9.0, OAEP was added in OpenSSL 0.9.2b.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_set_method.pod b/src/lib/libcrypto/doc/RSA_set_method.pod
new file mode 100644
index 0000000000..deb1183a23
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_set_method.pod
@@ -0,0 +1,153 @@
+=pod
+
+=head1 NAME
+
+RSA_set_default_method, RSA_get_default_method, RSA_set_method,
+RSA_get_method, RSA_PKCS1_SSLeay, RSA_PKCS1_RSAref,
+RSA_PKCS1_null_method, RSA_flags, RSA_new_method - select RSA method
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ void RSA_set_default_method(RSA_METHOD *meth);
+
+ RSA_METHOD *RSA_get_default_method(void);
+
+ RSA_METHOD *RSA_set_method(RSA *rsa, RSA_METHOD *meth);
+
+ RSA_METHOD *RSA_get_method(RSA *rsa);
+
+ RSA_METHOD *RSA_PKCS1_SSLeay(void);
+
+ RSA_METHOD *RSA_PKCS1_RSAref(void);
+
+ RSA_METHOD *RSA_null_method(void);
+
+ int RSA_flags(RSA *rsa);
+
+ RSA *RSA_new_method(RSA_METHOD *method);
+
+=head1 DESCRIPTION
+
+An B<RSA_METHOD> specifies the functions that OpenSSL uses for RSA
+operations. By modifying the method, alternative implementations
+such as hardware accelerators may be used.
+
+Initially, the default is to use the OpenSSL internal implementation,
+unless OpenSSL was configured with the C<rsaref> or C<-DRSA_NULL>
+options. RSA_PKCS1_SSLeay() returns a pointer to that method.
+
+RSA_PKCS1_RSAref() returns a pointer to a method that uses the RSAref
+library. This is the default method in the C<rsaref> configuration;
+the function is not available in other configurations.
+RSA_null_method() returns a pointer to a method that does not support
+the RSA transformation. It is the default if OpenSSL is compiled with
+C<-DRSA_NULL>. These methods may be useful in the USA because of a
+patent on the RSA cryptosystem.
+
+RSA_set_default_method() makes B<meth> the default method for all B<RSA>
+structures created later.
+
+RSA_get_default_method() returns a pointer to the current default
+method.
+
+RSA_set_method() selects B<meth> for all operations using the key
+B<rsa>.
+
+RSA_get_method() returns a pointer to the method currently selected
+for B<rsa>.
+
+RSA_flags() returns the B<flags> that are set for B<rsa>'s current method.
+
+RSA_new_method() allocates and initializes an B<RSA> structure so that
+B<method> will be used for the RSA operations. If B<method> is B<NULL>,
+the default method is used.
+
+=head1 THE RSA_METHOD STRUCTURE
+
+ typedef struct rsa_meth_st
+ {
+     /* name of the implementation */
+        const char *name;
+
+     /* encrypt */
+        int (*rsa_pub_enc)(int flen, unsigned char *from,
+          unsigned char *to, RSA *rsa, int padding);
+
+     /* verify arbitrary data */
+        int (*rsa_pub_dec)(int flen, unsigned char *from,
+          unsigned char *to, RSA *rsa, int padding);
+
+     /* sign arbitrary data */
+        int (*rsa_priv_enc)(int flen, unsigned char *from,
+          unsigned char *to, RSA *rsa, int padding);
+
+     /* decrypt */
+        int (*rsa_priv_dec)(int flen, unsigned char *from,
+          unsigned char *to, RSA *rsa, int padding);
+
+     /* compute r0 = r0 ^ I mod rsa->n. May be NULL */
+        int (*rsa_mod_exp)(BIGNUM *r0, BIGNUM *I, RSA *rsa);
+
+     /* compute r = a ^ p mod m. May be NULL */
+        int (*bn_mod_exp)(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+
+     /* called at RSA_new */
+        int (*init)(RSA *rsa);
+
+     /* called at RSA_free */
+        int (*finish)(RSA *rsa);
+
+     /* RSA_FLAG_EXT_PKEY        - rsa_mod_exp is called for private key
+      *                            operations, even if p,q,dmp1,dmq1,iqmp
+      *                            are NULL
+      * RSA_FLAG_SIGN_VER        - enable rsa_sign and rsa_verify
+      * RSA_METHOD_FLAG_NO_CHECK - don't check pub/private match
+      */
+        int flags;
+
+        char *app_data; /* ?? */
+
+     /* sign. For backward compatibility, this is used only
+      * if (flags & RSA_FLAG_SIGN_VER)
+      */
+        int (*rsa_sign)(int type, unsigned char *m, unsigned int m_len,
+           unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+
+     /* verify. For backward compatibility, this is used only
+      * if (flags & RSA_FLAG_SIGN_VER)
+      */
+        int (*rsa_verify)(int type, unsigned char *m, unsigned int m_len,
+           unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+
+ } RSA_METHOD;
+
+=head1 RETURN VALUES
+
+RSA_PKCS1_SSLeay(), RSA_PKCS1_RSAref(), RSA_PKCS1_null_method(),
+RSA_get_default_method() and RSA_get_method() return pointers to the
+respective B<RSA_METHOD>s.
+
+RSA_set_default_method() returns no value.
+
+RSA_set_method() returns a pointer to the B<RSA_METHOD> previously
+associated with B<rsa>.
+
+RSA_new_method() returns B<NULL> and sets an error code that can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise it
+returns a pointer to the newly allocated structure.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<RSA_new(3)|RSA_new(3)>
+
+=head1 HISTORY
+
+RSA_new_method() and RSA_set_default_method() appeared in SSLeay 0.8.
+RSA_get_default_method(), RSA_set_method() and RSA_get_method() as
+well as the rsa_sign and rsa_verify components of RSA_METHOD were
+added in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_sign.pod b/src/lib/libcrypto/doc/RSA_sign.pod
new file mode 100644
index 0000000000..f0bf6eea1b
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_sign.pod
@@ -0,0 +1,62 @@
+=pod
+
+=head1 NAME
+
+RSA_sign, RSA_verify - RSA signatures
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_sign(int type, unsigned char *m, unsigned int m_len,
+    unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+
+ int RSA_verify(int type, unsigned char *m, unsigned int m_len,
+    unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+
+=head1 DESCRIPTION
+
+RSA_sign() signs the message digest B<m> of size B<m_len> using the
+private key B<rsa> as specified in PKCS #1 v2.0. It stores the
+signature in B<sigret> and the signature size in B<siglen>. B<sigret>
+must point to RSA_size(B<rsa>) bytes of memory.
+
+B<type> denotes the message digest algorithm that was used to generate
+B<m>. It usually is one of B<NID_sha1>, B<NID_ripemd160> and B<NID_md5>;
+see L<objects(3)|objects(3)> for details. If B<type> is B<NID_md5_sha1>,
+an SSL signature (MD5 and SHA1 message digests with PKCS #1 padding
+and no algorithm identifier) is created.
+
+RSA_verify() verifies that the signature B<sigbuf> of size B<siglen>
+matches a given message digest B<m> of size B<m_len>. B<type> denotes
+the message digest algorithm that was used to generate the signature.
+B<rsa> is the signer's public key.
+
+=head1 RETURN VALUES
+
+RSA_sign() returns 1 on success, 0 otherwise.  RSA_verify() returns 1
+on successful verification, 0 otherwise.
+
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+Certain signatures with an improper algorithm identifier are accepted
+for compatibility with SSLeay 0.4.5 :-)
+
+=head1 CONFORMING TO
+
+SSL, PKCS #1 v2.0
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<objects(3)|objects(3)>, L<rsa(3)|rsa(3)>,
+L<RSA_private_encrypt(3)|RSA_private_encrypt(3)>,
+L<RSA_public_decrypt(3)|RSA_public_decrypt(3)> 
+
+=head1 HISTORY
+
+RSA_sign() and RSA_verify() are available in all versions of SSLeay
+and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_sign_ASN1_OCTET_STRING.pod b/src/lib/libcrypto/doc/RSA_sign_ASN1_OCTET_STRING.pod
new file mode 100644
index 0000000000..df9ceb339a
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_sign_ASN1_OCTET_STRING.pod
@@ -0,0 +1,59 @@
+=pod
+
+=head1 NAME
+
+RSA_sign_ASN1_OCTET_STRING, RSA_verify_ASN1_OCTET_STRING - RSA signatures
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_sign_ASN1_OCTET_STRING(int dummy, unsigned char *m,
+    unsigned int m_len, unsigned char *sigret, unsigned int *siglen,
+    RSA *rsa);
+
+ int RSA_verify_ASN1_OCTET_STRING(int dummy, unsigned char *m,
+    unsigned int m_len, unsigned char *sigbuf, unsigned int siglen,
+    RSA *rsa);
+
+=head1 DESCRIPTION
+
+RSA_sign_ASN1_OCTET_STRING() signs the octet string B<m> of size
+B<m_len> using the private key B<rsa> represented in DER using PKCS #1
+padding. It stores the signature in B<sigret> and the signature size
+in B<siglen>. B<sigret> must point to B<RSA_size(rsa)> bytes of
+memory.
+
+B<dummy> is ignored.
+
+The random number generator must be seeded prior to calling RSA_sign_ASN1_OCTET_STRING().
+
+RSA_verify_ASN1_OCTET_STRING() verifies that the signature B<sigbuf>
+of size B<siglen> is the DER representation of a given octet string
+B<m> of size B<m_len>. B<dummy> is ignored. B<rsa> is the signer's
+public key.
+
+=head1 RETURN VALUES
+
+RSA_sign_ASN1_OCTET_STRING() returns 1 on success, 0 otherwise.
+RSA_verify_ASN1_OCTET_STRING() returns 1 on successful verification, 0
+otherwise.
+
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+These functions serve no recognizable purpose.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<objects(3)|objects(3)>, L<rand(3)|rand(3)>,
+L<rsa(3)|rsa(3)>, L<RSA_sign(3)|RSA_sign(3)>,
+L<RSA_verify(3)|RSA_verify(3)>
+
+=head1 HISTORY
+
+RSA_sign_ASN1_OCTET_STRING() and RSA_verify_ASN1_OCTET_STRING() were
+added in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libcrypto/doc/RSA_size.pod b/src/lib/libcrypto/doc/RSA_size.pod
new file mode 100644
index 0000000000..b36b4d58d5
--- /dev/null
+++ b/src/lib/libcrypto/doc/RSA_size.pod
@@ -0,0 +1,33 @@
+=pod
+
+=head1 NAME
+
+RSA_size - get RSA modulus size
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_size(RSA *rsa);
+
+=head1 DESCRIPTION
+
+This function returns the RSA modulus size in bytes. It can be used to
+determine how much memory must be allocated for an RSA encrypted
+value.
+
+B<rsa-E<gt>n> must not be B<NULL>.
+
+=head1 RETURN VALUE
+
+The size in bytes.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>
+
+=head1 HISTORY
+
+RSA_size() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libcrypto/doc/bn.pod b/src/lib/libcrypto/doc/bn.pod
new file mode 100644
index 0000000000..1504a1c92d
--- /dev/null
+++ b/src/lib/libcrypto/doc/bn.pod
@@ -0,0 +1,148 @@
+=pod
+
+=head1 NAME
+
+bn - multiprecision integer arithmetics
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BIGNUM *BN_new(void);
+ void BN_free(BIGNUM *a);
+ void BN_init(BIGNUM *);
+ void BN_clear(BIGNUM *a);
+ void BN_clear_free(BIGNUM *a);
+
+ BN_CTX *BN_CTX_new(void);
+ void BN_CTX_init(BN_CTX *c);
+ void BN_CTX_free(BN_CTX *c);
+
+ BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b);
+ BIGNUM *BN_dup(const BIGNUM *a);
+
+ int BN_num_bytes(const BIGNUM *a);
+ int BN_num_bits(const BIGNUM *a);
+ int BN_num_bits_word(BN_ULONG w);
+
+ int BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b);
+ int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
+ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
+ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *a, const BIGNUM *d,
+         BN_CTX *ctx);
+ int BN_sqr(BIGNUM *r, BIGNUM *a, BN_CTX *ctx);
+ int BN_mod(BIGNUM *rem, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
+ int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m,
+         BN_CTX *ctx);
+ int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx);
+ int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+         const BIGNUM *m, BN_CTX *ctx);
+ int BN_gcd(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
+
+ int BN_add_word(BIGNUM *a, BN_ULONG w);
+ int BN_sub_word(BIGNUM *a, BN_ULONG w);
+ int BN_mul_word(BIGNUM *a, BN_ULONG w);
+ BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w);
+ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w);
+
+ int BN_cmp(BIGNUM *a, BIGNUM *b);
+ int BN_ucmp(BIGNUM *a, BIGNUM *b);
+ int BN_is_zero(BIGNUM *a);
+ int BN_is_one(BIGNUM *a);
+ int BN_is_word(BIGNUM *a, BN_ULONG w);
+ int BN_is_odd(BIGNUM *a);
+
+ int BN_zero(BIGNUM *a);
+ int BN_one(BIGNUM *a);
+ BIGNUM *BN_value_one(void);
+ int BN_set_word(BIGNUM *a, unsigned long w);
+ unsigned long BN_get_word(BIGNUM *a);
+
+ int BN_rand(BIGNUM *rnd, int bits, int top, int bottom);
+ int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom);
+
+ BIGNUM *BN_generate_prime(BIGNUM *ret, int bits,int safe, BIGNUM *add,
+         BIGNUM *rem, void (*callback)(int, int, void *), void *cb_arg);
+ int BN_is_prime(const BIGNUM *p, int nchecks,
+         void (*callback)(int, int, void *), BN_CTX *ctx, void *cb_arg);
+
+ int BN_set_bit(BIGNUM *a, int n);
+ int BN_clear_bit(BIGNUM *a, int n);
+ int BN_is_bit_set(const BIGNUM *a, int n);
+ int BN_mask_bits(BIGNUM *a, int n);
+ int BN_lshift(BIGNUM *r, const BIGNUM *a, int n);
+ int BN_lshift1(BIGNUM *r, BIGNUM *a);
+ int BN_rshift(BIGNUM *r, BIGNUM *a, int n);
+ int BN_rshift1(BIGNUM *r, BIGNUM *a);
+
+ int BN_bn2bin(const BIGNUM *a, unsigned char *to);
+ BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret);
+ char *BN_bn2hex(const BIGNUM *a);
+ char *BN_bn2dec(const BIGNUM *a);
+ int BN_hex2bn(BIGNUM **a, const char *str);
+ int BN_dec2bn(BIGNUM **a, const char *str);
+ int BN_print(BIO *fp, const BIGNUM *a);
+ int BN_print_fp(FILE *fp, const BIGNUM *a);
+ int BN_bn2mpi(const BIGNUM *a, unsigned char *to);
+ BIGNUM *BN_mpi2bn(unsigned char *s, int len, BIGNUM *ret);
+
+ BIGNUM *BN_mod_inverse(BIGNUM *r, BIGNUM *a, const BIGNUM *n,
+     BN_CTX *ctx);
+
+ BN_RECP_CTX *BN_RECP_CTX_new(void);
+ void BN_RECP_CTX_init(BN_RECP_CTX *recp);
+ void BN_RECP_CTX_free(BN_RECP_CTX *recp);
+ int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *m, BN_CTX *ctx);
+ int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *a, BIGNUM *b,
+        BN_RECP_CTX *recp, BN_CTX *ctx);
+
+ BN_MONT_CTX *BN_MONT_CTX_new(void);
+ void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
+ void BN_MONT_CTX_free(BN_MONT_CTX *mont);
+ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *m, BN_CTX *ctx);
+ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from);
+ int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
+         BN_MONT_CTX *mont, BN_CTX *ctx);
+ int BN_from_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
+         BN_CTX *ctx);
+ int BN_to_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
+         BN_CTX *ctx);
+
+
+=head1 DESCRIPTION
+
+This library performs arithmetic operations on integers of arbitrary
+size. It was written for use in public key cryptography, such as RSA
+and Diffie-Hellman.
+
+It uses dynamic memory allocation for storing its data structures.
+That means that there is no limit on the size of the numbers
+manipulated by these functions, but return values must always be
+checked in case a memory allocation error has occurred.
+
+The basic object in this library is a B<BIGNUM>. It is used to hold a
+single large integer. This type should be considered opaque and fields
+should not be modified or accessed directly.
+
+The creation of B<BIGNUM> objects is described in L<BN_new(3)|BN_new(3)>;
+L<BN_add(3)|BN_add(3)> describes most of the arithmetic operations.
+Comparison is described in L<BN_cmp(3)|BN_cmp(3)>; L<BN_zero(3)|BN_zero(3)>
+describes certain assignments, L<BN_rand(3)|BN_rand(3)> the generation of
+random numbers, L<BN_generate_prime(3)|BN_generate_prime(3)> deals with prime
+numbers and L<BN_set_bit(3)|BN_set_bit(3)> with bit operations. The conversion
+of B<BIGNUM>s to external formats is described in L<BN_bn2bin(3)|BN_bn2bin(3)>.
+
+=head1 SEE ALSO
+
+L<bn_internal(3)|bn_internal(3)>,
+L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>,
+L<BN_new(3)|BN_new(3)>, L<BN_CTX_new(3)|BN_CTX_new(3)>,
+L<BN_copy(3)|BN_copy(3)>, L<BN_num_bytes(3)|BN_num_bytes(3)>,
+L<BN_add(3)|BN_add(3)>, L<BN_add_word(3)|BN_add_word(3)>,
+L<BN_cmp(3)|BN_cmp(3)>, L<BN_zero(3)|BN_zero(3)>, L<BN_rand(3)|BN_rand(3)>,
+L<BN_generate_prime(3)|BN_generate_prime(3)>, L<BN_set_bit(3)|BN_set_bit(3)>,
+L<BN_bn2bin(3)|BN_bn2bin(3)>, L<BN_mod_inverse(3)|BN_mod_inverse(3)>,
+L<BN_mod_mul_reciprocal(3)|BN_mod_mul_reciprocal(3)>,
+L<BN_mod_mul_montgomery(3)|BN_mod_mul_montgomery(3)> 
+
+=cut
diff --git a/src/lib/libcrypto/doc/d2i_DHparams.pod b/src/lib/libcrypto/doc/d2i_DHparams.pod
new file mode 100644
index 0000000000..a6d1743d39
--- /dev/null
+++ b/src/lib/libcrypto/doc/d2i_DHparams.pod
@@ -0,0 +1,30 @@
+=pod
+
+=head1 NAME
+
+d2i_DHparams, i2d_DHparams - ...
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ DH *d2i_DHparams(DH **a, unsigned char **pp, long length);
+ int i2d_DHparams(DH *a, unsigned char **pp);
+
+=head1 DESCRIPTION
+
+...
+
+=head1 RETURN VALUES
+
+...
+
+=head1 SEE ALSO
+
+...
+
+=head1 HISTORY
+
+...
+
+=cut
diff --git a/src/lib/libcrypto/doc/d2i_RSAPublicKey.pod b/src/lib/libcrypto/doc/d2i_RSAPublicKey.pod
new file mode 100644
index 0000000000..ff4d0d57db
--- /dev/null
+++ b/src/lib/libcrypto/doc/d2i_RSAPublicKey.pod
@@ -0,0 +1,39 @@
+=pod
+
+=head1 NAME
+
+d2i_RSAPublicKey, i2d_RSAPublicKey, d2i_RSAPrivateKey, i2d_RSAPrivateKey, i2d_Netscape_RSA, d2i_Netscape_RSA - ...
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ RSA * d2i_RSAPublicKey(RSA **a, unsigned char **pp, long length);
+
+ int i2d_RSAPublicKey(RSA *a, unsigned char **pp);
+
+ RSA * d2i_RSAPrivateKey(RSA **a, unsigned char **pp, long length);
+
+ int i2d_RSAPrivateKey(RSA *a, unsigned char **pp);
+
+ int i2d_Netscape_RSA(RSA *a, unsigned char **pp, int (*cb)());
+
+ RSA * d2i_Netscape_RSA(RSA **a, unsigned char **pp, long length, int (*cb)());
+
+=head1 DESCRIPTION
+
+...
+
+=head1 RETURN VALUES
+
+...
+
+=head1 SEE ALSO
+
+...
+
+=head1 HISTORY
+
+...
+
+=cut
diff --git a/src/lib/libcrypto/doc/dh.pod b/src/lib/libcrypto/doc/dh.pod
new file mode 100644
index 0000000000..0a9b7c03a2
--- /dev/null
+++ b/src/lib/libcrypto/doc/dh.pod
@@ -0,0 +1,68 @@
+=pod
+
+=head1 NAME
+
+dh - Diffie-Hellman key agreement
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ DH *   DH_new(void);
+ void   DH_free(DH *dh);
+
+ int    DH_size(DH *dh);
+
+ DH *   DH_generate_parameters(int prime_len, int generator,
+                void (*callback)(int, int, void *), void *cb_arg);
+ int    DH_check(DH *dh, int *codes);
+
+ int    DH_generate_key(DH *dh);
+ int    DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh);
+
+ void DH_set_default_method(DH_METHOD *meth);
+ DH_METHOD *DH_get_default_method(void);
+ DH_METHOD *DH_set_method(DH *dh, DH_METHOD *meth);
+ DH *DH_new_method(DH_METHOD *meth);
+ DH_METHOD *DH_OpenSSL(void);
+
+ int DH_get_ex_new_index(long argl, char *argp, int (*new_func)(),
+             int (*dup_func)(), void (*free_func)());
+ int DH_set_ex_data(DH *d, int idx, char *arg);
+ char *DH_get_ex_data(DH *d, int idx);
+
+ DH *   d2i_DHparams(DH **a, unsigned char **pp, long length);
+ int    i2d_DHparams(DH *a, unsigned char **pp);
+
+ int    DHparams_print_fp(FILE *fp, DH *x);
+ int    DHparams_print(BIO *bp, DH *x);
+
+=head1 DESCRIPTION
+
+These functions implement the Diffie-Hellman key agreement protocol.
+The generation of shared DH parameters is described in
+L<DH_generate_parameters(3)|DH_generate_parameters(3)>; L<DH_generate_key(3)|DH_generate_key(3)> describes how
+to perform a key agreement.
+
+The B<DH> structure consists of several BIGNUM components.
+
+ struct
+        {
+        BIGNUM *p;              // prime number (shared)
+        BIGNUM *g;              // generator of Z_p (shared)
+        BIGNUM *priv_key;       // private DH value x
+        BIGNUM *pub_key;        // public DH value g^x
+        // ...
+        };
+ DH
+
+=head1 SEE ALSO
+
+L<dhparam(1)|dhparam(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<err(3)|err(3)>,
+L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<DH_set_method(3)|DH_set_method(3)>,
+L<DH_new(3)|DH_new(3)>, L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>,
+L<DH_generate_parameters(3)|DH_generate_parameters(3)>,
+L<DH_compute_key(3)|DH_compute_key(3)>, L<d2i_DHparams(3)|d2i_DHparams(3)>,
+L<RSA_print(3)|RSA_print(3)> 
+
+=cut
diff --git a/src/lib/libcrypto/doc/dsa.pod b/src/lib/libcrypto/doc/dsa.pod
new file mode 100644
index 0000000000..2c09244899
--- /dev/null
+++ b/src/lib/libcrypto/doc/dsa.pod
@@ -0,0 +1,104 @@
+=pod
+
+=head1 NAME
+
+dsa - Digital Signature Algorithm
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA *  DSA_new(void);
+ void   DSA_free(DSA *dsa);
+
+ int    DSA_size(DSA *dsa);
+
+ DSA *  DSA_generate_parameters(int bits, unsigned char *seed,
+                int seed_len, int *counter_ret, unsigned long *h_ret,
+                void (*callback)(int, int, void *), void *cb_arg);
+
+ DH *   DSA_dup_DH(DSA *r);
+
+ int    DSA_generate_key(DSA *dsa);
+
+ int    DSA_sign(int dummy, const unsigned char *dgst, int len,
+                unsigned char *sigret, unsigned int *siglen, DSA *dsa);
+ int    DSA_sign_setup(DSA *dsa, BN_CTX *ctx, BIGNUM **kinvp,
+                BIGNUM **rp);
+ int    DSA_verify(int dummy, const unsigned char *dgst, int len,
+                unsigned char *sigbuf, int siglen, DSA *dsa);
+
+ void DSA_set_default_method(DSA_METHOD *meth);
+ DSA_METHOD *DSA_get_default_method(void);
+ DSA_METHOD *DSA_set_method(DSA *dsa, DSA_METHOD *meth);
+ DSA *DSA_new_method(DSA_METHOD *meth);
+ DSA_METHOD *DSA_OpenSSL(void);
+
+ int DSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
+             int (*dup_func)(), void (*free_func)());
+ int DSA_set_ex_data(DSA *d, int idx, char *arg);
+ char *DSA_get_ex_data(DSA *d, int idx);
+
+ DSA_SIG *DSA_SIG_new(void);
+ void   DSA_SIG_free(DSA_SIG *a);
+ int    i2d_DSA_SIG(DSA_SIG *a, unsigned char **pp);
+ DSA_SIG *d2i_DSA_SIG(DSA_SIG **v, unsigned char **pp, long length);
+
+ DSA_SIG *DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+ int    DSA_do_verify(const unsigned char *dgst, int dgst_len,
+             DSA_SIG *sig, DSA *dsa);
+
+ DSA *  d2i_DSAPublicKey(DSA **a, unsigned char **pp, long length);
+ DSA *  d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length);
+ DSA *  d2i_DSAparams(DSA **a, unsigned char **pp, long length);
+ int    i2d_DSAPublicKey(DSA *a, unsigned char **pp);
+ int    i2d_DSAPrivateKey(DSA *a, unsigned char **pp);
+ int    i2d_DSAparams(DSA *a,unsigned char **pp);
+
+ int    DSAparams_print(BIO *bp, DSA *x);
+ int    DSAparams_print_fp(FILE *fp, DSA *x);
+ int    DSA_print(BIO *bp, DSA *x, int off);
+ int    DSA_print_fp(FILE *bp, DSA *x, int off);
+
+=head1 DESCRIPTION
+
+These functions implement the Digital Signature Algorithm (DSA).  The
+generation of shared DSA parameters is described in
+L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>;
+L<DSA_generate_key(3)|DSA_generate_key(3)> describes how to
+generate a signature key. Signature generation and verification are
+described in L<DSA_sign(3)|DSA_sign(3)>.
+
+The B<DSA> structure consists of several BIGNUM components.
+
+ struct
+        {
+        BIGNUM *p;              // prime number (public)
+        BIGNUM *q;              // 160-bit subprime, q | p-1 (public)
+        BIGNUM *g;              // generator of subgroup (public)
+        BIGNUM *priv_key;       // private key x
+        BIGNUM *pub_key;        // public key y = g^x
+        // ...
+        }
+ DSA;
+
+In public keys, B<priv_key> is NULL.
+
+=head1 CONFORMING TO
+
+US Federal Information Processing Standard FIPS 186 (Digital Signature
+Standard, DSS), ANSI X9.30
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<rsa(3)|rsa(3)>, L<sha(3)|sha(3)>, L<DSA_new(3)|DSA_new(3)>,
+L<DSA_size(3)|DSA_size(3)>,
+L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>,
+L<DSA_dup_DH(3)|DSA_dup_DH(3)>,
+L<DSA_generate_key(3)|DSA_generate_key(3)>,
+L<DSA_sign(3)|DSA_sign(3)>, L<DSA_set_method(3)|DSA_set_method(3)>,
+L<DSA_get_ex_new_index(3)|DSA_get_ex_new_index(3)>,
+L<RSA_print(3)|RSA_print(3)>
+
+=cut
diff --git a/src/lib/libcrypto/doc/lh_stats.pod b/src/lib/libcrypto/doc/lh_stats.pod
new file mode 100644
index 0000000000..3eeaa72e52
--- /dev/null
+++ b/src/lib/libcrypto/doc/lh_stats.pod
@@ -0,0 +1,60 @@
+=pod
+
+=head1 NAME
+
+lh_stats, lh_node_stats, lh_node_usage_stats, lh_stats_bio,
+lh_node_stats_bio, lh_node_usage_stats_bio - LHASH statistics
+
+=head1 SYNOPSIS
+
+ #include <openssl/lhash.h>
+
+ void lh_stats(LHASH *table, FILE *out);
+ void lh_node_stats(LHASH *table, FILE *out);
+ void lh_node_usage_stats(LHASH *table, FILE *out);
+
+ void lh_stats_bio(LHASH *table, BIO *out);
+ void lh_node_stats_bio(LHASH *table, BIO *out);
+ void lh_node_usage_stats_bio(LHASH *table, BIO *out);
+
+=head1 DESCRIPTION
+
+The B<LHASH> structure records statistics about most aspects of
+accessing the hash table.  This is mostly a legacy of Eric Young
+writing this library for the reasons of implementing what looked like
+a nice algorithm rather than for a particular software product.
+
+lh_stats() prints out statistics on the size of the hash table, how
+many entries are in it, and the number and result of calls to the
+routines in this library.
+
+lh_node_stats() prints the number of entries for each 'bucket' in the
+hash table.
+
+lh_node_usage_stats() prints out a short summary of the state of the
+hash table.  It prints the 'load' and the 'actual load'.  The load is
+the average number of data items per 'bucket' in the hash table.  The
+'actual load' is the average number of items per 'bucket', but only
+for buckets which contain entries.  So the 'actual load' is the
+average number of searches that will need to find an item in the hash
+table, while the 'load' is the average number that will be done to
+record a miss.
+
+lh_stats_bio(), lh_node_stats_bio() and lh_node_usage_stats_bio()
+are the same as the above, except that the output goes to a B<BIO>.
+
+=head1 RETURN VALUES
+
+These functions do not return values.
+
+=head1 SEE ALSO
+
+L<bio(3)|bio(3)>, L<lhash(3)|lhash(3)>
+
+=head1 HISTORY
+
+These functions are available in all versions of SSLeay and OpenSSL.
+
+This manpage is derived from the SSLeay documentation.
+
+=cut
diff --git a/src/lib/libcrypto/doc/rsa.pod b/src/lib/libcrypto/doc/rsa.pod
new file mode 100644
index 0000000000..0486c044a6
--- /dev/null
+++ b/src/lib/libcrypto/doc/rsa.pod
@@ -0,0 +1,115 @@
+=pod
+
+=head1 NAME
+
+rsa - RSA public key cryptosystem
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ RSA * RSA_new(void);
+ void RSA_free(RSA *rsa);
+
+ int RSA_public_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa, int padding);
+ int RSA_private_decrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa, int padding);
+
+ int RSA_sign(int type, unsigned char *m, unsigned int m_len,
+    unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+ int RSA_verify(int type, unsigned char *m, unsigned int m_len,
+    unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+
+ int RSA_size(RSA *rsa);
+
+ RSA *RSA_generate_key(int num, unsigned long e,
+    void (*callback)(int,int,void *), void *cb_arg);
+
+ int RSA_check_key(RSA *rsa);
+
+ int RSA_blinding_on(RSA *rsa, BN_CTX *ctx);
+ void RSA_blinding_off(RSA *rsa);
+
+ void RSA_set_default_method(RSA_METHOD *meth);
+ RSA_METHOD *RSA_get_default_method(void);
+ RSA_METHOD *RSA_set_method(RSA *rsa, RSA_METHOD *meth);
+ RSA_METHOD *RSA_get_method(RSA *rsa);
+ RSA_METHOD *RSA_PKCS1_SSLeay(void);
+ RSA_METHOD *RSA_PKCS1_RSAref(void);
+ RSA_METHOD *RSA_null_method(void);
+ int RSA_flags(RSA *rsa);
+ RSA *RSA_new_method(RSA_METHOD *method);
+
+ int RSA_print(BIO *bp, RSA *x, int offset);
+ int RSA_print_fp(FILE *fp, RSA *x, int offset);
+
+ int RSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
+    int (*dup_func)(), void (*free_func)());
+ int RSA_set_ex_data(RSA *r,int idx,char *arg);
+ char *RSA_get_ex_data(RSA *r, int idx);
+
+ int RSA_private_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa,int padding);
+ int RSA_public_decrypt(int flen, unsigned char *from, 
+    unsigned char *to, RSA *rsa,int padding);
+
+ int RSA_sign_ASN1_OCTET_STRING(int dummy, unsigned char *m,
+    unsigned int m_len, unsigned char *sigret, unsigned int *siglen,
+    RSA *rsa);
+ int RSA_verify_ASN1_OCTET_STRING(int dummy, unsigned char *m,
+    unsigned int m_len, unsigned char *sigbuf, unsigned int siglen,
+    RSA *rsa);
+
+=head1 DESCRIPTION
+
+These functions implement RSA public key encryption and signatures
+as defined in PKCS #1 v2.0 [RFC 2437].
+
+The B<RSA> structure consists of several BIGNUM components. It can
+contain public as well as private RSA keys:
+
+ struct
+        {
+        BIGNUM *n;              // public modulus
+        BIGNUM *e;              // public exponent
+        BIGNUM *d;              // private exponent
+        BIGNUM *p;              // secret prime factor
+        BIGNUM *q;              // secret prime factor
+        BIGNUM *dmp1;           // d mod (p-1)
+        BIGNUM *dmq1;           // d mod (q-1)
+        BIGNUM *iqmp;           // q^-1 mod p
+        // ...
+        };
+ RSA
+
+In public keys, the private exponent and the related secret values are
+B<NULL>.
+
+B<dmp1>, B<dmq1> and B<iqmp> may be B<NULL> in private keys, but the
+RSA operations are much faster when these values are available.
+
+=head1 CONFORMING TO
+
+SSL, PKCS #1 v2.0
+
+=head1 PATENTS
+
+RSA is covered by a US patent which expires in September 2000.
+
+=head1 SEE ALSO
+
+L<rsa(1)|rsa(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>,
+L<rand(3)|rand(3)>, L<RSA_new(3)|RSA_new(3)>,
+L<RSA_public_encrypt(3)|RSA_public_encrypt(3)>,
+L<RSA_sign(3)|RSA_sign(3)>, L<RSA_size(3)|RSA_size(3)>,
+L<RSA_generate_key(3)|RSA_generate_key(3)>,
+L<RSA_check_key(3)|RSA_check_key(3)>,
+L<RSA_blinding_on(3)|RSA_blinding_on(3)>,
+L<RSA_set_method(3)|RSA_set_method(3)>, L<RSA_print(3)|RSA_print(3)>,
+L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>,
+L<RSA_private_encrypt(3)|RSA_private_encrypt(3)>,
+L<RSA_sign_ASN_OCTET_STRING(3)|RSA_sign_ASN_OCTET_STRING(3)>,
+L<RSA_padding_add_PKCS1_type_1(3)|RSA_padding_add_PKCS1_type_1(3)> 
+
+=cut
diff --git a/src/lib/libcrypto/dsa/Makefile.ssl b/src/lib/libcrypto/dsa/Makefile.ssl
index 4bc74a2f7c..b0bcf974fb 100644
--- a/src/lib/libcrypto/dsa/Makefile.ssl
+++ b/src/lib/libcrypto/dsa/Makefile.ssl
@@ -22,8 +22,10 @@ TEST=dsatest.c
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC= dsa_gen.c dsa_key.c dsa_lib.c dsa_asn1.c dsa_vrf.c dsa_sign.c dsa_err.c
-LIBOBJ= dsa_gen.o dsa_key.o dsa_lib.o dsa_asn1.o dsa_vrf.o dsa_sign.o dsa_err.o
+LIBSRC= dsa_gen.c dsa_key.c dsa_lib.c dsa_asn1.c dsa_vrf.c dsa_sign.c \
+        dsa_err.c dsa_ossl.c
+LIBOBJ= dsa_gen.o dsa_key.o dsa_lib.o dsa_asn1.o dsa_vrf.o dsa_sign.o \
+        dsa_err.o dsa_ossl.o
 
 SRC= $(LIBSRC)
 
@@ -86,25 +88,27 @@ dsa_asn1.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 dsa_asn1.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 dsa_asn1.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
 dsa_asn1.o: ../../include/openssl/stack.h ../cryptlib.h
-dsa_err.o: ../../include/openssl/bn.h ../../include/openssl/dh.h
-dsa_err.o: ../../include/openssl/dsa.h ../../include/openssl/err.h
-dsa_err.o: ../../include/openssl/opensslconf.h
+dsa_err.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
+dsa_err.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+dsa_err.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
+dsa_err.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+dsa_err.o: ../../include/openssl/stack.h
 dsa_gen.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dsa_gen.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dsa_gen.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 dsa_gen.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 dsa_gen.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 dsa_gen.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-dsa_gen.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-dsa_gen.o: ../cryptlib.h
+dsa_gen.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+dsa_gen.o: ../../include/openssl/stack.h ../cryptlib.h
 dsa_key.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dsa_key.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dsa_key.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 dsa_key.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 dsa_key.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 dsa_key.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-dsa_key.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-dsa_key.o: ../cryptlib.h
+dsa_key.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+dsa_key.o: ../../include/openssl/stack.h ../cryptlib.h
 dsa_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 dsa_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 dsa_lib.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
@@ -113,6 +117,15 @@ dsa_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dsa_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 dsa_lib.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 dsa_lib.o: ../cryptlib.h
+dsa_ossl.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+dsa_ossl.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+dsa_ossl.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
+dsa_ossl.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+dsa_ossl.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+dsa_ossl.o: ../../include/openssl/opensslconf.h
+dsa_ossl.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
+dsa_ossl.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+dsa_ossl.o: ../cryptlib.h
 dsa_sign.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 dsa_sign.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 dsa_sign.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
diff --git a/src/lib/libcrypto/dsa/dsa.h b/src/lib/libcrypto/dsa/dsa.h
index 20b3f8d90a..68d9912cbc 100644
--- a/src/lib/libcrypto/dsa/dsa.h
+++ b/src/lib/libcrypto/dsa/dsa.h
@@ -74,13 +74,41 @@ extern "C" {
 #endif
 
 #include <openssl/bn.h>
+#include <openssl/crypto.h>
 #ifndef NO_DH
 # include <openssl/dh.h>
 #endif
 
 #define DSA_FLAG_CACHE_MONT_P   0x01
 
-typedef struct dsa_st
+typedef struct dsa_st DSA;
+
+typedef struct DSA_SIG_st
+        {
+        BIGNUM *r;
+        BIGNUM *s;
+        } DSA_SIG;
+
+typedef struct dsa_method {
+        const char *name;
+        DSA_SIG * (*dsa_do_sign)(const unsigned char *dgst, int dlen, DSA *dsa);
+        int (*dsa_sign_setup)(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
+                                                                BIGNUM **rp);
+        int (*dsa_do_verify)(const unsigned char *dgst, int dgst_len,
+                                                        DSA_SIG *sig, DSA *dsa);
+        int (*dsa_mod_exp)(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
+                        BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
+                        BN_MONT_CTX *in_mont);
+        int (*bn_mod_exp)(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx); /* Can be null */
+        int (*init)(DSA *dsa);
+        int (*finish)(DSA *dsa);
+        int flags;
+        char *app_data;
+} DSA_METHOD;
+
+struct dsa_st
         {
         /* This first variable is used to pick up errors where
          * a DSA is passed instead of of a EVP_PKEY */
@@ -100,15 +128,10 @@ typedef struct dsa_st
         int flags;
         /* Normally used to cache montgomery values */
         char *method_mont_p;
-
         int references;
-        } DSA;
-
-typedef struct DSA_SIG_st
-        {
-        BIGNUM *r;
-        BIGNUM *s;
-        } DSA_SIG;
+        CRYPTO_EX_DATA ex_data;
+        DSA_METHOD *meth;
+        };
 
 #define DSAparams_dup(x) (DSA *)ASN1_dup((int (*)())i2d_DSAparams, \
                 (char *(*)())d2i_DSAparams,(char *)(x))
@@ -131,7 +154,14 @@ DSA_SIG * DSA_do_sign(const unsigned char *dgst,int dlen,DSA *dsa);
 int     DSA_do_verify(const unsigned char *dgst,int dgst_len,
                       DSA_SIG *sig,DSA *dsa);
 
+DSA_METHOD *DSA_OpenSSL(void);
+
+void        DSA_set_default_method(DSA_METHOD *);
+DSA_METHOD *DSA_get_default_method(void);
+DSA_METHOD *DSA_set_method(DSA *dsa, DSA_METHOD *);
+
 DSA *   DSA_new(void);
+DSA *   DSA_new_method(DSA_METHOD *meth);
 int     DSA_size(DSA *);
         /* next 4 return -1 on error */
 int     DSA_sign_setup( DSA *dsa,BN_CTX *ctx_in,BIGNUM **kinvp,BIGNUM **rp);
@@ -140,6 +170,10 @@ int	DSA_sign(int type,const unsigned char *dgst,int dlen,
 int     DSA_verify(int type,const unsigned char *dgst,int dgst_len,
                 unsigned char *sigbuf, int siglen, DSA *dsa);
 void    DSA_free (DSA *r);
+int DSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int DSA_set_ex_data(DSA *d, int idx, void *arg);
+void *DSA_get_ex_data(DSA *d, int idx);
 
 void    ERR_load_DSA_strings(void );
 
@@ -148,7 +182,7 @@ DSA *	d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length);
 DSA *   d2i_DSAparams(DSA **a, unsigned char **pp, long length);
 DSA *   DSA_generate_parameters(int bits, unsigned char *seed,int seed_len,
                 int *counter_ret, unsigned long *h_ret,void
-                (*callback)(),char *cb_arg);
+                (*callback)(int, int, void *),void *cb_arg);
 int     DSA_generate_key(DSA *a);
 int     i2d_DSAPublicKey(DSA *a, unsigned char **pp);
 int     i2d_DSAPrivateKey(DSA *a, unsigned char **pp);
@@ -163,7 +197,11 @@ int	DSAparams_print_fp(FILE *fp, DSA *x);
 int     DSA_print_fp(FILE *bp, DSA *x, int off);
 #endif
 
-int DSA_is_prime(BIGNUM *q,void (*callback)(),char *cb_arg);
+#define DSS_prime_checks 50
+/* Primality test according to FIPS PUB 186[-1], Appendix 2.1:
+ * 50 rounds of Rabin-Miller */
+#define DSA_is_prime(n, callback, cb_arg) \
+        BN_is_prime(n, DSS_prime_checks, callback, NULL, cb_arg)
 
 #ifndef NO_DH
 /* Convert DSA structure (key or just parameters) into DH structure
@@ -184,7 +222,6 @@ DH *DSA_dup_DH(DSA *r);
 #define DSA_F_DSAPARAMS_PRINT_FP                         101
 #define DSA_F_DSA_DO_SIGN                                112
 #define DSA_F_DSA_DO_VERIFY                              113
-#define DSA_F_DSA_IS_PRIME                               102
 #define DSA_F_DSA_NEW                                    103
 #define DSA_F_DSA_PRINT                                  104
 #define DSA_F_DSA_PRINT_FP                               105
diff --git a/src/lib/libcrypto/dsa/dsa_asn1.c b/src/lib/libcrypto/dsa/dsa_asn1.c
index 7523b21654..c9b32b4db7 100644
--- a/src/lib/libcrypto/dsa/dsa_asn1.c
+++ b/src/lib/libcrypto/dsa/dsa_asn1.c
@@ -83,7 +83,7 @@ DSA_SIG *d2i_DSA_SIG(DSA_SIG **a, unsigned char **pp, long length)
         M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
         if ((ret->s=BN_bin2bn(bs->data,bs->length,ret->s)) == NULL)
                 goto err_bn;
-        ASN1_BIT_STRING_free(bs);
+        M_ASN1_BIT_STRING_free(bs);
         M_ASN1_D2I_Finish_2(a);
 
 err_bn:
@@ -91,6 +91,6 @@ err_bn:
 err:
         DSAerr(DSA_F_D2I_DSA_SIG,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_SIG_free(ret);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
+        if (bs != NULL) M_ASN1_BIT_STRING_free(bs);
         return(NULL);
 }
diff --git a/src/lib/libcrypto/dsa/dsa_err.c b/src/lib/libcrypto/dsa/dsa_err.c
index 33a8270afd..38e4af968c 100644
--- a/src/lib/libcrypto/dsa/dsa_err.c
+++ b/src/lib/libcrypto/dsa/dsa_err.c
@@ -70,7 +70,6 @@ static ERR_STRING_DATA DSA_str_functs[]=
 {ERR_PACK(0,DSA_F_DSAPARAMS_PRINT_FP,0),        "DSAparams_print_fp"},
 {ERR_PACK(0,DSA_F_DSA_DO_SIGN,0),       "DSA_do_sign"},
 {ERR_PACK(0,DSA_F_DSA_DO_VERIFY,0),     "DSA_do_verify"},
-{ERR_PACK(0,DSA_F_DSA_IS_PRIME,0),      "DSA_is_prime"},
 {ERR_PACK(0,DSA_F_DSA_NEW,0),   "DSA_new"},
 {ERR_PACK(0,DSA_F_DSA_PRINT,0), "DSA_print"},
 {ERR_PACK(0,DSA_F_DSA_PRINT_FP,0),      "DSA_print_fp"},
diff --git a/src/lib/libcrypto/dsa/dsa_gen.c b/src/lib/libcrypto/dsa/dsa_gen.c
index b5e5ec06e5..2294a362d9 100644
--- a/src/lib/libcrypto/dsa/dsa_gen.c
+++ b/src/lib/libcrypto/dsa/dsa_gen.c
@@ -59,12 +59,18 @@
 #undef GENUINE_DSA
 
 #ifdef GENUINE_DSA
+/* Parameter generation follows the original release of FIPS PUB 186,
+ * Appendix 2.2 (i.e. use SHA as defined in FIPS PUB 180) */
 #define HASH    SHA
 #else
+/* Parameter generation follows the updated Appendix 2.2 for FIPS PUB 186,
+ * also Appendix 2.2 of FIPS PUB 186-1 (i.e. use SHA as defined in
+ * FIPS PUB 180-1) */
 #define HASH    SHA1
 #endif 
 
 #ifndef NO_SHA
+
 #include <stdio.h>
 #include <time.h>
 #include "cryptlib.h"
@@ -74,8 +80,9 @@
 #include <openssl/rand.h>
 
 DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
-             int *counter_ret, unsigned long *h_ret, void (*callback)(),
-             char *cb_arg)
+                int *counter_ret, unsigned long *h_ret,
+                void (*callback)(int, int, void *),
+                void *cb_arg)
         {
         int ok=0;
         unsigned char seed[SHA_DIGEST_LENGTH];
@@ -86,47 +93,63 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
         BN_MONT_CTX *mont=NULL;
         int k,n=0,i,b,m=0;
         int counter=0;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
+        int r=0;
+        BN_CTX *ctx=NULL,*ctx2=NULL,*ctx3=NULL;
         unsigned int h=2;
         DSA *ret=NULL;
 
         if (bits < 512) bits=512;
         bits=(bits+63)/64*64;
 
+        if (seed_len < 20)
+                seed_in = NULL; /* seed buffer too small -- ignore */
+        if (seed_len > 20) 
+                seed_len = 20; /* App. 2.2 of FIPS PUB 186 allows larger SEED,
+                                * but our internal buffers are restricted to 160 bits*/
         if ((seed_in != NULL) && (seed_len == 20))
                 memcpy(seed,seed_in,seed_len);
 
         if ((ctx=BN_CTX_new()) == NULL) goto err;
         if ((ctx2=BN_CTX_new()) == NULL) goto err;
+        if ((ctx3=BN_CTX_new()) == NULL) goto err;
         if ((ret=DSA_new()) == NULL) goto err;
 
         if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
 
-        r0= &(ctx2->bn[0]);
-        g= &(ctx2->bn[1]);
-        W= &(ctx2->bn[2]);
-        q= &(ctx2->bn[3]);
-        X= &(ctx2->bn[4]);
-        c= &(ctx2->bn[5]);
-        p= &(ctx2->bn[6]);
-        test= &(ctx2->bn[7]);
+        BN_CTX_start(ctx2);
+        r0 = BN_CTX_get(ctx2);
+        g = BN_CTX_get(ctx2);
+        W = BN_CTX_get(ctx2);
+        q = BN_CTX_get(ctx2);
+        X = BN_CTX_get(ctx2);
+        c = BN_CTX_get(ctx2);
+        p = BN_CTX_get(ctx2);
+        test = BN_CTX_get(ctx2);
 
         BN_lshift(test,BN_value_one(),bits-1);
 
         for (;;)
                 {
-                for (;;)
+                for (;;) /* find q */
                         {
+                        int seed_is_random;
+
                         /* step 1 */
                         if (callback != NULL) callback(0,m++,cb_arg);
 
                         if (!seed_len)
-                                RAND_bytes(seed,SHA_DIGEST_LENGTH);
+                                {
+                                RAND_pseudo_bytes(seed,SHA_DIGEST_LENGTH);
+                                seed_is_random = 1;
+                                }
                         else
-                                seed_len=0;
-
+                                {
+                                seed_is_random = 0;
+                                seed_len=0; /* use random seed if 'seed_in' turns out to be bad*/
+                                }
                         memcpy(buf,seed,SHA_DIGEST_LENGTH);
                         memcpy(buf2,seed,SHA_DIGEST_LENGTH);
+                        /* precompute "SEED + 1" for step 7: */
                         for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
                                 {
                                 buf[i]++;
@@ -142,10 +165,15 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                         /* step 3 */
                         md[0]|=0x80;
                         md[SHA_DIGEST_LENGTH-1]|=0x01;
-                        if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) abort();
+                        if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) goto err;
 
                         /* step 4 */
-                        if (DSA_is_prime(q,callback,cb_arg) > 0) break;
+                        r = BN_is_prime_fasttest(q, DSS_prime_checks, callback, ctx3, cb_arg, seed_is_random);
+                        if (r > 0)
+                                break;
+                        if (r != 0)
+                                goto err;
+
                         /* do a callback call */
                         /* step 5 */
                         }
@@ -155,16 +183,22 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
 
                 /* step 6 */
                 counter=0;
+                /* "offset = 2" */
 
                 n=(bits-1)/160;
                 b=(bits-1)-n*160;
 
                 for (;;)
                         {
+                        if (callback != NULL && counter != 0)
+                                callback(0,counter,cb_arg);
+
                         /* step 7 */
                         BN_zero(W);
+                        /* now 'buf' contains "SEED + offset - 1" */
                         for (k=0; k<=n; k++)
                                 {
+                                /* obtain "SEED + offset + k" by incrementing: */
                                 for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
                                         {
                                         buf[i]++;
@@ -174,7 +208,8 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                                 HASH(buf,SHA_DIGEST_LENGTH,md);
 
                                 /* step 8 */
-                                if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0)) abort();
+                                if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0))
+                                        goto err;
                                 BN_lshift(r0,r0,160*k);
                                 BN_add(W,W,r0);
                                 }
@@ -194,23 +229,25 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                         if (BN_cmp(p,test) >= 0)
                                 {
                                 /* step 11 */
-                                if (DSA_is_prime(p,callback,cb_arg) > 0)
-                                        goto end;
+                                r = BN_is_prime_fasttest(p, DSS_prime_checks, callback, ctx3, cb_arg, 1);
+                                if (r > 0)
+                                                goto end; /* found it */
+                                if (r != 0)
+                                        goto err;
                                 }
 
                         /* step 13 */
                         counter++;
+                        /* "offset = offset + n + 1" */
 
                         /* step 14 */
                         if (counter >= 4096) break;
-
-                        if (callback != NULL) callback(0,counter,cb_arg);
                         }
                 }
 end:
         if (callback != NULL) callback(2,1,cb_arg);
 
-        /* We now need to gernerate g */
+        /* We now need to generate g */
         /* Set r0=(p-1)/q */
         BN_sub(test,p,BN_value_one());
         BN_div(r0,NULL,test,q,ctx);
@@ -245,89 +282,13 @@ err:
                 if (h_ret != NULL) *h_ret=h;
                 }
         if (ctx != NULL) BN_CTX_free(ctx);
-        if (ctx != NULL) BN_CTX_free(ctx2);
-        if (mont != NULL) BN_MONT_CTX_free(mont);
-        return(ok?ret:NULL);
-        }
-
-int DSA_is_prime(BIGNUM *w, void (*callback)(), char *cb_arg)
-        {
-        int ok= -1,j,i,n;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
-        BIGNUM *w_1,*b,*m,*z,*tmp,*mont_1;
-        int a;
-        BN_MONT_CTX *mont=NULL;
-
-        if (!BN_is_bit_set(w,0)) return(0);
-
-        if ((ctx=BN_CTX_new()) == NULL) goto err;
-        if ((ctx2=BN_CTX_new()) == NULL) goto err;
-        if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
-
-        m=   &(ctx2->bn[2]);
-        b=   &(ctx2->bn[3]);
-        z=   &(ctx2->bn[4]);
-        w_1= &(ctx2->bn[5]);
-        tmp= &(ctx2->bn[6]);
-        mont_1= &(ctx2->bn[7]);
-
-        /* step 1 */
-        n=50;
-
-        /* step 2 */
-        if (!BN_sub(w_1,w,BN_value_one())) goto err;
-        for (a=1; !BN_is_bit_set(w_1,a); a++)
-                ;
-        if (!BN_rshift(m,w_1,a)) goto err;
-
-        BN_MONT_CTX_set(mont,w,ctx);
-        BN_to_montgomery(mont_1,BN_value_one(),mont,ctx);
-        BN_to_montgomery(w_1,w_1,mont,ctx);
-        for (i=1; i < n; i++)
+        if (ctx2 != NULL)
                 {
-                /* step 3 */
-                BN_rand(b,BN_num_bits(w)-2/*-1*/,0,0);
-                /* BN_set_word(b,0x10001L); */
-
-                /* step 4 */
-                j=0;
-                if (!BN_mod_exp_mont(z,b,m,w,ctx,mont)) goto err;
-
-                if (!BN_to_montgomery(z,z,mont,ctx)) goto err;
-
-                /* step 5 */
-                for (;;)
-                        {
-                        if (((j == 0) && (BN_cmp(z,mont_1) == 0)) ||
-                                (BN_cmp(z,w_1) == 0))
-                                break;
-
-                        /* step 6 */
-                        if ((j > 0) && (BN_cmp(z,mont_1) == 0))
-                                {
-                                ok=0;
-                                goto err;
-                                }
-
-                        j++;
-                        if (j >= a)
-                                {
-                                ok=0;
-                                goto err;
-                                }
-
-                        if (!BN_mod_mul_montgomery(z,z,z,mont,ctx)) goto err;
-                        if (callback != NULL) callback(1,j,cb_arg);
-                        }
+                BN_CTX_end(ctx2);
+                BN_CTX_free(ctx2);
                 }
-
-        ok=1;
-err:
-        if (ok == -1) DSAerr(DSA_F_DSA_IS_PRIME,ERR_R_BN_LIB);
-        BN_CTX_free(ctx);
-        BN_CTX_free(ctx2);
-        BN_MONT_CTX_free(mont);
-        
-        return(ok);
+        if (ctx3 != NULL) BN_CTX_free(ctx3);
+        if (mont != NULL) BN_MONT_CTX_free(mont);
+        return(ok?ret:NULL);
         }
 #endif
diff --git a/src/lib/libcrypto/dsa/dsa_lib.c b/src/lib/libcrypto/dsa/dsa_lib.c
index ce8e204f7e..224e412afc 100644
--- a/src/lib/libcrypto/dsa/dsa_lib.c
+++ b/src/lib/libcrypto/dsa/dsa_lib.c
@@ -66,7 +66,38 @@
 
 const char *DSA_version="DSA" OPENSSL_VERSION_PTEXT;
 
+static DSA_METHOD *default_DSA_method;
+static int dsa_meth_num = 0;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *dsa_meth = NULL;
+
+void DSA_set_default_method(DSA_METHOD *meth)
+{
+        default_DSA_method = meth;
+}
+
+DSA_METHOD *DSA_get_default_method(void)
+{
+        if(!default_DSA_method) default_DSA_method = DSA_OpenSSL();
+        return default_DSA_method;
+}
+
 DSA *DSA_new(void)
+{
+        return DSA_new_method(NULL);
+}
+
+DSA_METHOD *DSA_set_method(DSA *dsa, DSA_METHOD *meth)
+{
+        DSA_METHOD *mtmp;
+        mtmp = dsa->meth;
+        if (mtmp->finish) mtmp->finish(dsa);
+        dsa->meth = meth;
+        if (meth->init) meth->init(dsa);
+        return mtmp;
+}
+
+
+DSA *DSA_new_method(DSA_METHOD *meth)
         {
         DSA *ret;
 
@@ -76,13 +107,15 @@ DSA *DSA_new(void)
                 DSAerr(DSA_F_DSA_NEW,ERR_R_MALLOC_FAILURE);
                 return(NULL);
                 }
+        if(!default_DSA_method) default_DSA_method = DSA_OpenSSL();
+        if(meth) ret->meth = meth;
+        else ret->meth = default_DSA_method;
         ret->pad=0;
         ret->version=0;
         ret->write_params=1;
         ret->p=NULL;
         ret->q=NULL;
         ret->g=NULL;
-        ret->flags=DSA_FLAG_CACHE_MONT_P;
 
         ret->pub_key=NULL;
         ret->priv_key=NULL;
@@ -92,6 +125,15 @@ DSA *DSA_new(void)
         ret->method_mont_p=NULL;
 
         ret->references=1;
+        ret->flags=ret->meth->flags;
+        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
+                {
+                Free(ret);
+                ret=NULL;
+                }
+        else
+                CRYPTO_new_ex_data(dsa_meth,ret,&ret->ex_data);
+        
         return(ret);
         }
 
@@ -114,6 +156,10 @@ void DSA_free(DSA *r)
                 }
 #endif
 
+        CRYPTO_free_ex_data(dsa_meth, r, &r->ex_data);
+
+        if(r->meth->finish) r->meth->finish(r);
+
         if (r->p != NULL) BN_clear_free(r->p);
         if (r->q != NULL) BN_clear_free(r->q);
         if (r->g != NULL) BN_clear_free(r->g);
@@ -121,8 +167,6 @@ void DSA_free(DSA *r)
         if (r->priv_key != NULL) BN_clear_free(r->priv_key);
         if (r->kinv != NULL) BN_clear_free(r->kinv);
         if (r->r != NULL) BN_clear_free(r->r);
-        if (r->method_mont_p != NULL)
-                BN_MONT_CTX_free((BN_MONT_CTX *)r->method_mont_p);
         Free(r);
         }
 
@@ -145,6 +189,24 @@ int DSA_size(DSA *r)
         return(ret);
         }
 
+int DSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        dsa_meth_num++;
+        return(CRYPTO_get_ex_new_index(dsa_meth_num-1,
+                &dsa_meth,argl,argp,new_func,dup_func,free_func));
+        }
+
+int DSA_set_ex_data(DSA *d, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&d->ex_data,idx,arg));
+        }
+
+void *DSA_get_ex_data(DSA *d, int idx)
+        {
+        return(CRYPTO_get_ex_data(&d->ex_data,idx));
+        }
+
 #ifndef NO_DH
 DH *DSA_dup_DH(DSA *r)
         {
diff --git a/src/lib/libcrypto/dsa/dsa_ossl.c b/src/lib/libcrypto/dsa/dsa_ossl.c
new file mode 100644
index 0000000000..b51cf6ad8d
--- /dev/null
+++ b/src/lib/libcrypto/dsa/dsa_ossl.c
@@ -0,0 +1,321 @@
+/* crypto/dsa/dsa_ossl.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+/* Original version from Steven Schoch <schoch@sheba.arc.nasa.gov> */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/bn.h>
+#include <openssl/dsa.h>
+#include <openssl/rand.h>
+#include <openssl/asn1.h>
+
+static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp);
+static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
+                  DSA *dsa);
+static int dsa_init(DSA *dsa);
+static int dsa_finish(DSA *dsa);
+static int dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
+                BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *in_mont);
+static int dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx);
+
+static DSA_METHOD openssl_dsa_meth = {
+"OpenSSL DSA method",
+dsa_do_sign,
+dsa_sign_setup,
+dsa_do_verify,
+dsa_mod_exp,
+dsa_bn_mod_exp,
+dsa_init,
+dsa_finish,
+0,
+NULL
+};
+
+DSA_METHOD *DSA_OpenSSL(void)
+{
+        return &openssl_dsa_meth;
+}
+
+static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
+        {
+        BIGNUM *kinv=NULL,*r=NULL,*s=NULL;
+        BIGNUM m;
+        BIGNUM xr;
+        BN_CTX *ctx=NULL;
+        int i,reason=ERR_R_BN_LIB;
+        DSA_SIG *ret=NULL;
+
+        BN_init(&m);
+        BN_init(&xr);
+        s=BN_new();
+        if (s == NULL) goto err;
+
+        i=BN_num_bytes(dsa->q); /* should be 20 */
+        if ((dlen > i) || (dlen > 50))
+                {
+                reason=DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE;
+                goto err;
+                }
+
+        ctx=BN_CTX_new();
+        if (ctx == NULL) goto err;
+
+        if ((dsa->kinv == NULL) || (dsa->r == NULL))
+                {
+                if (!DSA_sign_setup(dsa,ctx,&kinv,&r)) goto err;
+                }
+        else
+                {
+                kinv=dsa->kinv;
+                dsa->kinv=NULL;
+                r=dsa->r;
+                dsa->r=NULL;
+                }
+
+        if (BN_bin2bn(dgst,dlen,&m) == NULL) goto err;
+
+        /* Compute  s = inv(k) (m + xr) mod q */
+        if (!BN_mod_mul(&xr,dsa->priv_key,r,dsa->q,ctx)) goto err;/* s = xr */
+        if (!BN_add(s, &xr, &m)) goto err;              /* s = m + xr */
+        if (BN_cmp(s,dsa->q) > 0)
+                BN_sub(s,s,dsa->q);
+        if (!BN_mod_mul(s,s,kinv,dsa->q,ctx)) goto err;
+
+        ret=DSA_SIG_new();
+        if (ret == NULL) goto err;
+        ret->r = r;
+        ret->s = s;
+        
+err:
+        if (!ret)
+                {
+                DSAerr(DSA_F_DSA_DO_SIGN,reason);
+                BN_free(r);
+                BN_free(s);
+                }
+        if (ctx != NULL) BN_CTX_free(ctx);
+        BN_clear_free(&m);
+        BN_clear_free(&xr);
+        if (kinv != NULL) /* dsa->kinv is NULL now if we used it */
+            BN_clear_free(kinv);
+        return(ret);
+        }
+
+static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
+        {
+        BN_CTX *ctx;
+        BIGNUM k,*kinv=NULL,*r=NULL;
+        int ret=0;
+
+        if (ctx_in == NULL)
+                {
+                if ((ctx=BN_CTX_new()) == NULL) goto err;
+                }
+        else
+                ctx=ctx_in;
+
+        BN_init(&k);
+        if ((r=BN_new()) == NULL) goto err;
+        kinv=NULL;
+
+        /* Get random k */
+        for (;;)
+                {
+                if (!BN_rand(&k, BN_num_bits(dsa->q), 1, 0)) goto err;
+                if (BN_cmp(&k,dsa->q) >= 0)
+                        BN_sub(&k,&k,dsa->q);
+                if (!BN_is_zero(&k)) break;
+                }
+
+        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
+                {
+                if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
+                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
+                                dsa->p,ctx)) goto err;
+                }
+
+        /* Compute r = (g^k mod p) mod q */
+        if (!dsa->meth->bn_mod_exp(dsa, r,dsa->g,&k,dsa->p,ctx,
+                (BN_MONT_CTX *)dsa->method_mont_p)) goto err;
+        if (!BN_mod(r,r,dsa->q,ctx)) goto err;
+
+        /* Compute  part of 's = inv(k) (m + xr) mod q' */
+        if ((kinv=BN_mod_inverse(NULL,&k,dsa->q,ctx)) == NULL) goto err;
+
+        if (*kinvp != NULL) BN_clear_free(*kinvp);
+        *kinvp=kinv;
+        kinv=NULL;
+        if (*rp != NULL) BN_clear_free(*rp);
+        *rp=r;
+        ret=1;
+err:
+        if (!ret)
+                {
+                DSAerr(DSA_F_DSA_SIGN_SETUP,ERR_R_BN_LIB);
+                if (kinv != NULL) BN_clear_free(kinv);
+                if (r != NULL) BN_clear_free(r);
+                }
+        if (ctx_in == NULL) BN_CTX_free(ctx);
+        if (kinv != NULL) BN_clear_free(kinv);
+        BN_clear_free(&k);
+        return(ret);
+        }
+
+static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
+                  DSA *dsa)
+        {
+        BN_CTX *ctx;
+        BIGNUM u1,u2,t1;
+        BN_MONT_CTX *mont=NULL;
+        int ret = -1;
+
+        if ((ctx=BN_CTX_new()) == NULL) goto err;
+        BN_init(&u1);
+        BN_init(&u2);
+        BN_init(&t1);
+
+        /* Calculate W = inv(S) mod Q
+         * save W in u2 */
+        if ((BN_mod_inverse(&u2,sig->s,dsa->q,ctx)) == NULL) goto err;
+
+        /* save M in u1 */
+        if (BN_bin2bn(dgst,dgst_len,&u1) == NULL) goto err;
+
+        /* u1 = M * w mod q */
+        if (!BN_mod_mul(&u1,&u1,&u2,dsa->q,ctx)) goto err;
+
+        /* u2 = r * w mod q */
+        if (!BN_mod_mul(&u2,sig->r,&u2,dsa->q,ctx)) goto err;
+
+        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
+                {
+                if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
+                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
+                                dsa->p,ctx)) goto err;
+                }
+        mont=(BN_MONT_CTX *)dsa->method_mont_p;
+
+#if 0
+        {
+        BIGNUM t2;
+
+        BN_init(&t2);
+        /* v = ( g^u1 * y^u2 mod p ) mod q */
+        /* let t1 = g ^ u1 mod p */
+        if (!BN_mod_exp_mont(&t1,dsa->g,&u1,dsa->p,ctx,mont)) goto err;
+        /* let t2 = y ^ u2 mod p */
+        if (!BN_mod_exp_mont(&t2,dsa->pub_key,&u2,dsa->p,ctx,mont)) goto err;
+        /* let u1 = t1 * t2 mod p */
+        if (!BN_mod_mul(&u1,&t1,&t2,dsa->p,ctx)) goto err_bn;
+        BN_free(&t2);
+        }
+        /* let u1 = u1 mod q */
+        if (!BN_mod(&u1,&u1,dsa->q,ctx)) goto err;
+#else
+        {
+        if (!dsa->meth->dsa_mod_exp(dsa, &t1,dsa->g,&u1,dsa->pub_key,&u2,
+                                                dsa->p,ctx,mont)) goto err;
+        /* BN_copy(&u1,&t1); */
+        /* let u1 = u1 mod q */
+        if (!BN_mod(&u1,&t1,dsa->q,ctx)) goto err;
+        }
+#endif
+        /* V is now in u1.  If the signature is correct, it will be
+         * equal to R. */
+        ret=(BN_ucmp(&u1, sig->r) == 0);
+
+        err:
+        if (ret != 1) DSAerr(DSA_F_DSA_DO_VERIFY,ERR_R_BN_LIB);
+        if (ctx != NULL) BN_CTX_free(ctx);
+        BN_free(&u1);
+        BN_free(&u2);
+        BN_free(&t1);
+        return(ret);
+        }
+
+static int dsa_init(DSA *dsa)
+{
+        dsa->flags|=DSA_FLAG_CACHE_MONT_P;
+        return(1);
+}
+
+static int dsa_finish(DSA *dsa)
+{
+        if(dsa->method_mont_p)
+                BN_MONT_CTX_free((BN_MONT_CTX *)dsa->method_mont_p);
+        return(1);
+}
+
+static int dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
+                BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *in_mont)
+{
+        return BN_mod_exp2_mont(rr, a1, p1, a2, p2, m, ctx, in_mont);
+}
+        
+static int dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx)
+{
+        return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx);
+}
diff --git a/src/lib/libcrypto/dsa/dsa_sign.c b/src/lib/libcrypto/dsa/dsa_sign.c
index 774c161964..89205026f0 100644
--- a/src/lib/libcrypto/dsa/dsa_sign.c
+++ b/src/lib/libcrypto/dsa/dsa_sign.c
@@ -67,73 +67,9 @@
 
 DSA_SIG * DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
         {
-        BIGNUM *kinv=NULL,*r=NULL,*s=NULL;
-        BIGNUM m;
-        BIGNUM xr;
-        BN_CTX *ctx=NULL;
-        int i,reason=ERR_R_BN_LIB;
-        DSA_SIG *ret=NULL;
-
-        BN_init(&m);
-        BN_init(&xr);
-        s=BN_new();
-        if (s == NULL) goto err;
-
-        i=BN_num_bytes(dsa->q); /* should be 20 */
-        if ((dlen > i) || (dlen > 50))
-                {
-                reason=DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE;
-                goto err;
-                }
-
-        ctx=BN_CTX_new();
-        if (ctx == NULL) goto err;
-
-        if ((dsa->kinv == NULL) || (dsa->r == NULL))
-                {
-                if (!DSA_sign_setup(dsa,ctx,&kinv,&r)) goto err;
-                }
-        else
-                {
-                kinv=dsa->kinv;
-                dsa->kinv=NULL;
-                r=dsa->r;
-                dsa->r=NULL;
-                }
-
-        if (BN_bin2bn(dgst,dlen,&m) == NULL) goto err;
-
-        /* Compute  s = inv(k) (m + xr) mod q */
-        if (!BN_mod_mul(&xr,dsa->priv_key,r,dsa->q,ctx)) goto err;/* s = xr */
-        if (!BN_add(s, &xr, &m)) goto err;              /* s = m + xr */
-        if (BN_cmp(s,dsa->q) > 0)
-                BN_sub(s,s,dsa->q);
-        if (!BN_mod_mul(s,s,kinv,dsa->q,ctx)) goto err;
-
-        ret=DSA_SIG_new();
-        if (ret == NULL) goto err;
-        ret->r = r;
-        ret->s = s;
-        
-err:
-        if (!ret)
-                {
-                DSAerr(DSA_F_DSA_DO_SIGN,reason);
-                BN_free(r);
-                BN_free(s);
-                }
-        if (ctx != NULL) BN_CTX_free(ctx);
-        BN_clear_free(&m);
-        BN_clear_free(&xr);
-        if (kinv != NULL) /* dsa->kinv is NULL now if we used it */
-            BN_clear_free(kinv);
-        return(ret);
+        return dsa->meth->dsa_do_sign(dgst, dlen, dsa);
         }
 
-/* data has already been hashed (probably with SHA or SHA-1). */
-
-/* unsigned char *sig:  out    */
-/* unsigned int *siglen:  out    */
 int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig,
              unsigned int *siglen, DSA *dsa)
         {
@@ -151,61 +87,6 @@ int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig,
 
 int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
         {
-        BN_CTX *ctx;
-        BIGNUM k,*kinv=NULL,*r=NULL;
-        int ret=0;
-
-        if (ctx_in == NULL)
-                {
-                if ((ctx=BN_CTX_new()) == NULL) goto err;
-                }
-        else
-                ctx=ctx_in;
-
-        BN_init(&k);
-        if ((r=BN_new()) == NULL) goto err;
-        kinv=NULL;
-
-        /* Get random k */
-        for (;;)
-                {
-                if (!BN_rand(&k, BN_num_bits(dsa->q), 1, 0)) goto err;
-                if (BN_cmp(&k,dsa->q) >= 0)
-                        BN_sub(&k,&k,dsa->q);
-                if (!BN_is_zero(&k)) break;
-                }
-
-        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
-                {
-                if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
-                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
-                                dsa->p,ctx)) goto err;
-                }
-
-        /* Compute r = (g^k mod p) mod q */
-        if (!BN_mod_exp_mont(r,dsa->g,&k,dsa->p,ctx,
-                (BN_MONT_CTX *)dsa->method_mont_p)) goto err;
-        if (!BN_mod(r,r,dsa->q,ctx)) goto err;
-
-        /* Compute  part of 's = inv(k) (m + xr) mod q' */
-        if ((kinv=BN_mod_inverse(NULL,&k,dsa->q,ctx)) == NULL) goto err;
-
-        if (*kinvp != NULL) BN_clear_free(*kinvp);
-        *kinvp=kinv;
-        kinv=NULL;
-        if (*rp != NULL) BN_clear_free(*rp);
-        *rp=r;
-        ret=1;
-err:
-        if (!ret)
-                {
-                DSAerr(DSA_F_DSA_SIGN_SETUP,ERR_R_BN_LIB);
-                if (kinv != NULL) BN_clear_free(kinv);
-                if (r != NULL) BN_clear_free(r);
-                }
-        if (ctx_in == NULL) BN_CTX_free(ctx);
-        if (kinv != NULL) BN_clear_free(kinv);
-        BN_clear_free(&k);
-        return(ret);
+        return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
         }
 
diff --git a/src/lib/libcrypto/dsa/dsa_vrf.c b/src/lib/libcrypto/dsa/dsa_vrf.c
index ff552208aa..03277f80fd 100644
--- a/src/lib/libcrypto/dsa/dsa_vrf.c
+++ b/src/lib/libcrypto/dsa/dsa_vrf.c
@@ -69,73 +69,7 @@
 int DSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
                   DSA *dsa)
         {
-        BN_CTX *ctx;
-        BIGNUM u1,u2,t1;
-        BN_MONT_CTX *mont=NULL;
-        int ret = -1;
-
-        if ((ctx=BN_CTX_new()) == NULL) goto err;
-        BN_init(&u1);
-        BN_init(&u2);
-        BN_init(&t1);
-
-        /* Calculate W = inv(S) mod Q
-         * save W in u2 */
-        if ((BN_mod_inverse(&u2,sig->s,dsa->q,ctx)) == NULL) goto err;
-
-        /* save M in u1 */
-        if (BN_bin2bn(dgst,dgst_len,&u1) == NULL) goto err;
-
-        /* u1 = M * w mod q */
-        if (!BN_mod_mul(&u1,&u1,&u2,dsa->q,ctx)) goto err;
-
-        /* u2 = r * w mod q */
-        if (!BN_mod_mul(&u2,sig->r,&u2,dsa->q,ctx)) goto err;
-
-        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
-                {
-                if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
-                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
-                                dsa->p,ctx)) goto err;
-                }
-        mont=(BN_MONT_CTX *)dsa->method_mont_p;
-
-#if 0
-        {
-        BIGNUM t2;
-
-        BN_init(&t2);
-        /* v = ( g^u1 * y^u2 mod p ) mod q */
-        /* let t1 = g ^ u1 mod p */
-        if (!BN_mod_exp_mont(&t1,dsa->g,&u1,dsa->p,ctx,mont)) goto err;
-        /* let t2 = y ^ u2 mod p */
-        if (!BN_mod_exp_mont(&t2,dsa->pub_key,&u2,dsa->p,ctx,mont)) goto err;
-        /* let u1 = t1 * t2 mod p */
-        if (!BN_mod_mul(&u1,&t1,&t2,dsa->p,ctx)) goto err_bn;
-        BN_free(&t2);
-        }
-        /* let u1 = u1 mod q */
-        if (!BN_mod(&u1,&u1,dsa->q,ctx)) goto err;
-#else
-        {
-        if (!BN_mod_exp2_mont(&t1,dsa->g,&u1,dsa->pub_key,&u2,dsa->p,ctx,mont))
-                goto err;
-        /* BN_copy(&u1,&t1); */
-        /* let u1 = u1 mod q */
-        if (!BN_mod(&u1,&t1,dsa->q,ctx)) goto err;
-        }
-#endif
-        /* V is now in u1.  If the signature is correct, it will be
-         * equal to R. */
-        ret=(BN_ucmp(&u1, sig->r) == 0);
-
-        err:
-        if (ret != 1) DSAerr(DSA_F_DSA_DO_VERIFY,ERR_R_BN_LIB);
-        if (ctx != NULL) BN_CTX_free(ctx);
-        BN_free(&u1);
-        BN_free(&u2);
-        BN_free(&t1);
-        return(ret);
+        return dsa->meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
         }
 
 /* data has already been hashed (probably with SHA or SHA-1). */
diff --git a/src/lib/libcrypto/dsa/dsatest.c b/src/lib/libcrypto/dsa/dsatest.c
index fc25c9a1b7..309a7cda89 100644
--- a/src/lib/libcrypto/dsa/dsatest.c
+++ b/src/lib/libcrypto/dsa/dsatest.c
@@ -84,7 +84,10 @@ int main(int argc, char *argv[])
 #define MS_CALLBACK
 #endif
 
-static void MS_CALLBACK dsa_cb(int p, int n, char *arg);
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg);
+
+/* seed, out_p, out_q, out_g are taken from the updated Appendix 5 to
+ * FIPS PUB 186 and also appear in Appendix 5 to FIPS PIB 186-1 */
 static unsigned char seed[20]={
         0xd5,0x01,0x4e,0x4b,0x60,0xef,0x2b,0xa8,0xb6,0x21,0x1b,0x40,
         0x62,0xba,0x32,0x24,0xe0,0x42,0x7d,0xd3,
@@ -120,6 +123,8 @@ static unsigned char out_g[]={
 
 static const unsigned char str1[]="12345678901234567890";
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
 static BIO *bio_err=NULL;
 
 int main(int argc, char **argv)
@@ -131,15 +136,17 @@ int main(int argc, char **argv)
         unsigned char sig[256];
         unsigned int siglen;
 
+        ERR_load_crypto_strings();
+        RAND_seed(rnd_seed, sizeof rnd_seed);
+
         if (bio_err == NULL)
                 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
 
         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 
         BIO_printf(bio_err,"test generation of DSA parameters\n");
-        BIO_printf(bio_err,"expect '.*' followed by 5 lines of '.'s and '+'s\n");
-        dsa=DSA_generate_parameters(512,seed,20,&counter,&h,dsa_cb,
-                (char *)bio_err);
+
+        dsa=DSA_generate_parameters(512,seed,20,&counter,&h,dsa_cb,bio_err);
 
         BIO_printf(bio_err,"seed\n");
         for (i=0; i<20; i+=4)
@@ -193,13 +200,18 @@ end:
         if (!ret)
                 ERR_print_errors(bio_err);
         if (dsa != NULL) DSA_free(dsa);
+        ERR_remove_state(0);
         CRYPTO_mem_leaks(bio_err);
-        if (bio_err != NULL) BIO_free(bio_err);
+        if (bio_err != NULL)
+                {
+                BIO_free(bio_err);
+                bio_err = NULL;
+                }
         exit(!ret);
         return(0);
         }
 
-static void MS_CALLBACK dsa_cb(int p, int n, char *arg)
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
         {
         char c='*';
         static int ok=0,num=0;
@@ -208,8 +220,8 @@ static void MS_CALLBACK dsa_cb(int p, int n, char *arg)
         if (p == 1) c='+';
         if (p == 2) { c='*'; ok++; }
         if (p == 3) c='\n';
-        BIO_write((BIO *)arg,&c,1);
-        (void)BIO_flush((BIO *)arg);
+        BIO_write(arg,&c,1);
+        (void)BIO_flush(arg);
 
         if (!ok && (p == 0) && (num > 1))
                 {
diff --git a/src/lib/libcrypto/ebcdic.c b/src/lib/libcrypto/ebcdic.c
new file mode 100644
index 0000000000..31397b2add
--- /dev/null
+++ b/src/lib/libcrypto/ebcdic.c
@@ -0,0 +1,217 @@
+/* crypto/ebcdic.c */
+
+#ifdef CHARSET_EBCDIC
+#include "ebcdic.h"
+/*      Initial Port for  Apache-1.3     by <Martin.Kraemer@Mch.SNI.De>
+ *      Adapted for       OpenSSL-0.9.4  by <Martin.Kraemer@Mch.SNI.De>
+ */
+
+#ifdef _OSD_POSIX
+/*
+    "BS2000 OSD" is a POSIX subsystem on a main frame.
+    It is made by Siemens AG, Germany, for their BS2000 mainframe machines.
+    Within the POSIX subsystem, the same character set was chosen as in
+    "native BS2000", namely EBCDIC. (EDF04)
+
+    The name "ASCII" in these routines is misleading: actually, conversion
+    is not between EBCDIC and ASCII, but EBCDIC(EDF04) and ISO-8859.1;
+    that means that (western european) national characters are preserved.
+
+    This table is identical to the one used by rsh/rcp/ftp and other POSIX tools.
+*/
+
+/* Here's the bijective ebcdic-to-ascii table: */
+const unsigned char os_toascii[256] = {
+/*00*/ 0x00, 0x01, 0x02, 0x03, 0x85, 0x09, 0x86, 0x7f,
+       0x87, 0x8d, 0x8e, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /*................*/
+/*10*/ 0x10, 0x11, 0x12, 0x13, 0x8f, 0x0a, 0x08, 0x97,
+       0x18, 0x19, 0x9c, 0x9d, 0x1c, 0x1d, 0x1e, 0x1f, /*................*/
+/*20*/ 0x80, 0x81, 0x82, 0x83, 0x84, 0x92, 0x17, 0x1b,
+       0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x05, 0x06, 0x07, /*................*/
+/*30*/ 0x90, 0x91, 0x16, 0x93, 0x94, 0x95, 0x96, 0x04,
+       0x98, 0x99, 0x9a, 0x9b, 0x14, 0x15, 0x9e, 0x1a, /*................*/
+/*40*/ 0x20, 0xa0, 0xe2, 0xe4, 0xe0, 0xe1, 0xe3, 0xe5,
+       0xe7, 0xf1, 0x60, 0x2e, 0x3c, 0x28, 0x2b, 0x7c, /* .........`.<(+|*/
+/*50*/ 0x26, 0xe9, 0xea, 0xeb, 0xe8, 0xed, 0xee, 0xef,
+       0xec, 0xdf, 0x21, 0x24, 0x2a, 0x29, 0x3b, 0x9f, /*&.........!$*);.*/
+/*60*/ 0x2d, 0x2f, 0xc2, 0xc4, 0xc0, 0xc1, 0xc3, 0xc5,
+       0xc7, 0xd1, 0x5e, 0x2c, 0x25, 0x5f, 0x3e, 0x3f, /*-/........^,%_>?*/
+/*70*/ 0xf8, 0xc9, 0xca, 0xcb, 0xc8, 0xcd, 0xce, 0xcf,
+       0xcc, 0xa8, 0x3a, 0x23, 0x40, 0x27, 0x3d, 0x22, /*..........:#@'="*/
+/*80*/ 0xd8, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
+       0x68, 0x69, 0xab, 0xbb, 0xf0, 0xfd, 0xfe, 0xb1, /*.abcdefghi......*/
+/*90*/ 0xb0, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+       0x71, 0x72, 0xaa, 0xba, 0xe6, 0xb8, 0xc6, 0xa4, /*.jklmnopqr......*/
+/*a0*/ 0xb5, 0xaf, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78,
+       0x79, 0x7a, 0xa1, 0xbf, 0xd0, 0xdd, 0xde, 0xae, /*..stuvwxyz......*/
+/*b0*/ 0xa2, 0xa3, 0xa5, 0xb7, 0xa9, 0xa7, 0xb6, 0xbc,
+       0xbd, 0xbe, 0xac, 0x5b, 0x5c, 0x5d, 0xb4, 0xd7, /*...........[\]..*/
+/*c0*/ 0xf9, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+       0x48, 0x49, 0xad, 0xf4, 0xf6, 0xf2, 0xf3, 0xf5, /*.ABCDEFGHI......*/
+/*d0*/ 0xa6, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50,
+       0x51, 0x52, 0xb9, 0xfb, 0xfc, 0xdb, 0xfa, 0xff, /*.JKLMNOPQR......*/
+/*e0*/ 0xd9, 0xf7, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58,
+       0x59, 0x5a, 0xb2, 0xd4, 0xd6, 0xd2, 0xd3, 0xd5, /*..STUVWXYZ......*/
+/*f0*/ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+       0x38, 0x39, 0xb3, 0x7b, 0xdc, 0x7d, 0xda, 0x7e  /*0123456789.{.}.~*/
+};
+
+
+/* The ascii-to-ebcdic table: */
+const unsigned char os_toebcdic[256] = {
+/*00*/  0x00, 0x01, 0x02, 0x03, 0x37, 0x2d, 0x2e, 0x2f,
+        0x16, 0x05, 0x15, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,  /*................*/
+/*10*/  0x10, 0x11, 0x12, 0x13, 0x3c, 0x3d, 0x32, 0x26,
+        0x18, 0x19, 0x3f, 0x27, 0x1c, 0x1d, 0x1e, 0x1f,  /*................*/
+/*20*/  0x40, 0x5a, 0x7f, 0x7b, 0x5b, 0x6c, 0x50, 0x7d,
+        0x4d, 0x5d, 0x5c, 0x4e, 0x6b, 0x60, 0x4b, 0x61,  /* !"#$%&'()*+,-./ */
+/*30*/  0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+        0xf8, 0xf9, 0x7a, 0x5e, 0x4c, 0x7e, 0x6e, 0x6f,  /*0123456789:;<=>?*/
+/*40*/  0x7c, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+        0xc8, 0xc9, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6,  /*@ABCDEFGHIJKLMNO*/
+/*50*/  0xd7, 0xd8, 0xd9, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6,
+        0xe7, 0xe8, 0xe9, 0xbb, 0xbc, 0xbd, 0x6a, 0x6d,  /*PQRSTUVWXYZ[\]^_*/
+/*60*/  0x4a, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
+        0x88, 0x89, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96,  /*`abcdefghijklmno*/
+/*70*/  0x97, 0x98, 0x99, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6,
+        0xa7, 0xa8, 0xa9, 0xfb, 0x4f, 0xfd, 0xff, 0x07,  /*pqrstuvwxyz{|}~.*/
+/*80*/  0x20, 0x21, 0x22, 0x23, 0x24, 0x04, 0x06, 0x08,
+        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x09, 0x0a, 0x14,  /*................*/
+/*90*/  0x30, 0x31, 0x25, 0x33, 0x34, 0x35, 0x36, 0x17,
+        0x38, 0x39, 0x3a, 0x3b, 0x1a, 0x1b, 0x3e, 0x5f,  /*................*/
+/*a0*/  0x41, 0xaa, 0xb0, 0xb1, 0x9f, 0xb2, 0xd0, 0xb5,
+        0x79, 0xb4, 0x9a, 0x8a, 0xba, 0xca, 0xaf, 0xa1,  /*................*/
+/*b0*/  0x90, 0x8f, 0xea, 0xfa, 0xbe, 0xa0, 0xb6, 0xb3,
+        0x9d, 0xda, 0x9b, 0x8b, 0xb7, 0xb8, 0xb9, 0xab,  /*................*/
+/*c0*/  0x64, 0x65, 0x62, 0x66, 0x63, 0x67, 0x9e, 0x68,
+        0x74, 0x71, 0x72, 0x73, 0x78, 0x75, 0x76, 0x77,  /*................*/
+/*d0*/  0xac, 0x69, 0xed, 0xee, 0xeb, 0xef, 0xec, 0xbf,
+        0x80, 0xe0, 0xfe, 0xdd, 0xfc, 0xad, 0xae, 0x59,  /*................*/
+/*e0*/  0x44, 0x45, 0x42, 0x46, 0x43, 0x47, 0x9c, 0x48,
+        0x54, 0x51, 0x52, 0x53, 0x58, 0x55, 0x56, 0x57,  /*................*/
+/*f0*/  0x8c, 0x49, 0xcd, 0xce, 0xcb, 0xcf, 0xcc, 0xe1,
+        0x70, 0xc0, 0xde, 0xdb, 0xdc, 0x8d, 0x8e, 0xdf   /*................*/
+};
+
+#else  /*_OSD_POSIX*/
+
+/*
+This code does basic character mapping for IBM's TPF and OS/390 operating systems.
+It is a modified version of the BS2000 table.
+
+Bijective EBCDIC (character set IBM-1047) to US-ASCII table:
+This table is bijective - there are no ambigous or duplicate characters.
+*/
+const unsigned char os_toascii[256] = {
+    0x00, 0x01, 0x02, 0x03, 0x85, 0x09, 0x86, 0x7f, /* 00-0f:           */
+    0x87, 0x8d, 0x8e, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* ................ */
+    0x10, 0x11, 0x12, 0x13, 0x8f, 0x0a, 0x08, 0x97, /* 10-1f:           */
+    0x18, 0x19, 0x9c, 0x9d, 0x1c, 0x1d, 0x1e, 0x1f, /* ................ */
+    0x80, 0x81, 0x82, 0x83, 0x84, 0x92, 0x17, 0x1b, /* 20-2f:           */
+    0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x05, 0x06, 0x07, /* ................ */
+    0x90, 0x91, 0x16, 0x93, 0x94, 0x95, 0x96, 0x04, /* 30-3f:           */
+    0x98, 0x99, 0x9a, 0x9b, 0x14, 0x15, 0x9e, 0x1a, /* ................ */
+    0x20, 0xa0, 0xe2, 0xe4, 0xe0, 0xe1, 0xe3, 0xe5, /* 40-4f:           */
+    0xe7, 0xf1, 0xa2, 0x2e, 0x3c, 0x28, 0x2b, 0x7c, /*  ...........<(+| */
+    0x26, 0xe9, 0xea, 0xeb, 0xe8, 0xed, 0xee, 0xef, /* 50-5f:           */
+    0xec, 0xdf, 0x21, 0x24, 0x2a, 0x29, 0x3b, 0x5e, /* &.........!$*);^ */
+    0x2d, 0x2f, 0xc2, 0xc4, 0xc0, 0xc1, 0xc3, 0xc5, /* 60-6f:           */
+    0xc7, 0xd1, 0xa6, 0x2c, 0x25, 0x5f, 0x3e, 0x3f, /* -/.........,%_>? */
+    0xf8, 0xc9, 0xca, 0xcb, 0xc8, 0xcd, 0xce, 0xcf, /* 70-7f:           */
+    0xcc, 0x60, 0x3a, 0x23, 0x40, 0x27, 0x3d, 0x22, /* .........`:#@'=" */
+    0xd8, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, /* 80-8f:           */
+    0x68, 0x69, 0xab, 0xbb, 0xf0, 0xfd, 0xfe, 0xb1, /* .abcdefghi...... */
+    0xb0, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, /* 90-9f:           */
+    0x71, 0x72, 0xaa, 0xba, 0xe6, 0xb8, 0xc6, 0xa4, /* .jklmnopqr...... */
+    0xb5, 0x7e, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, /* a0-af:           */
+    0x79, 0x7a, 0xa1, 0xbf, 0xd0, 0x5b, 0xde, 0xae, /* .~stuvwxyz...[.. */
+    0xac, 0xa3, 0xa5, 0xb7, 0xa9, 0xa7, 0xb6, 0xbc, /* b0-bf:           */
+    0xbd, 0xbe, 0xdd, 0xa8, 0xaf, 0x5d, 0xb4, 0xd7, /* .............].. */
+    0x7b, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* c0-cf:           */
+    0x48, 0x49, 0xad, 0xf4, 0xf6, 0xf2, 0xf3, 0xf5, /* {ABCDEFGHI...... */
+    0x7d, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, /* d0-df:           */
+    0x51, 0x52, 0xb9, 0xfb, 0xfc, 0xf9, 0xfa, 0xff, /* }JKLMNOPQR...... */
+    0x5c, 0xf7, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, /* e0-ef:           */
+    0x59, 0x5a, 0xb2, 0xd4, 0xd6, 0xd2, 0xd3, 0xd5, /* \.STUVWXYZ...... */
+    0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* f0-ff:           */
+    0x38, 0x39, 0xb3, 0xdb, 0xdc, 0xd9, 0xda, 0x9f  /* 0123456789...... */
+};
+
+
+/*
+The US-ASCII to EBCDIC (character set IBM-1047) table:
+This table is bijective (no ambiguous or duplicate characters)
+*/
+const unsigned char os_toebcdic[256] = {
+    0x00, 0x01, 0x02, 0x03, 0x37, 0x2d, 0x2e, 0x2f, /* 00-0f:           */
+    0x16, 0x05, 0x15, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* ................ */
+    0x10, 0x11, 0x12, 0x13, 0x3c, 0x3d, 0x32, 0x26, /* 10-1f:           */
+    0x18, 0x19, 0x3f, 0x27, 0x1c, 0x1d, 0x1e, 0x1f, /* ................ */
+    0x40, 0x5a, 0x7f, 0x7b, 0x5b, 0x6c, 0x50, 0x7d, /* 20-2f:           */
+    0x4d, 0x5d, 0x5c, 0x4e, 0x6b, 0x60, 0x4b, 0x61, /*  !"#$%&'()*+,-./ */
+    0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, /* 30-3f:           */
+    0xf8, 0xf9, 0x7a, 0x5e, 0x4c, 0x7e, 0x6e, 0x6f, /* 0123456789:;<=>? */
+    0x7c, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 40-4f:           */
+    0xc8, 0xc9, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, /* @ABCDEFGHIJKLMNO */
+    0xd7, 0xd8, 0xd9, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, /* 50-5f:           */
+    0xe7, 0xe8, 0xe9, 0xad, 0xe0, 0xbd, 0x5f, 0x6d, /* PQRSTUVWXYZ[\]^_ */
+    0x79, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 60-6f:           */
+    0x88, 0x89, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, /* `abcdefghijklmno */
+    0x97, 0x98, 0x99, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, /* 70-7f:           */
+    0xa7, 0xa8, 0xa9, 0xc0, 0x4f, 0xd0, 0xa1, 0x07, /* pqrstuvwxyz{|}~. */
+    0x20, 0x21, 0x22, 0x23, 0x24, 0x04, 0x06, 0x08, /* 80-8f:           */
+    0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x09, 0x0a, 0x14, /* ................ */
+    0x30, 0x31, 0x25, 0x33, 0x34, 0x35, 0x36, 0x17, /* 90-9f:           */
+    0x38, 0x39, 0x3a, 0x3b, 0x1a, 0x1b, 0x3e, 0xff, /* ................ */
+    0x41, 0xaa, 0x4a, 0xb1, 0x9f, 0xb2, 0x6a, 0xb5, /* a0-af:           */
+    0xbb, 0xb4, 0x9a, 0x8a, 0xb0, 0xca, 0xaf, 0xbc, /* ................ */
+    0x90, 0x8f, 0xea, 0xfa, 0xbe, 0xa0, 0xb6, 0xb3, /* b0-bf:           */
+    0x9d, 0xda, 0x9b, 0x8b, 0xb7, 0xb8, 0xb9, 0xab, /* ................ */
+    0x64, 0x65, 0x62, 0x66, 0x63, 0x67, 0x9e, 0x68, /* c0-cf:           */
+    0x74, 0x71, 0x72, 0x73, 0x78, 0x75, 0x76, 0x77, /* ................ */
+    0xac, 0x69, 0xed, 0xee, 0xeb, 0xef, 0xec, 0xbf, /* d0-df:           */
+    0x80, 0xfd, 0xfe, 0xfb, 0xfc, 0xba, 0xae, 0x59, /* ................ */
+    0x44, 0x45, 0x42, 0x46, 0x43, 0x47, 0x9c, 0x48, /* e0-ef:           */
+    0x54, 0x51, 0x52, 0x53, 0x58, 0x55, 0x56, 0x57, /* ................ */
+    0x8c, 0x49, 0xcd, 0xce, 0xcb, 0xcf, 0xcc, 0xe1, /* f0-ff:           */
+    0x70, 0xdd, 0xde, 0xdb, 0xdc, 0x8d, 0x8e, 0xdf  /* ................ */
+};
+#endif /*_OSD_POSIX*/
+
+/* Translate a memory block from EBCDIC (host charset) to ASCII (net charset)
+ * dest and srce may be identical, or separate memory blocks, but
+ * should not overlap. These functions intentionally have an interface
+ * compatible to memcpy(3).
+ */
+
+void *
+ebcdic2ascii(void *dest, const void *srce, size_t count)
+{
+    unsigned char *udest = dest;
+    const unsigned char *usrce = srce;
+
+    while (count-- != 0) {
+        *udest++ = os_toascii[*usrce++];
+    }
+
+    return dest;
+}
+
+void *
+ascii2ebcdic(void *dest, const void *srce, size_t count)
+{
+    unsigned char *udest = dest;
+    const unsigned char *usrce = srce;
+
+    while (count-- != 0) {
+        *udest++ = os_toebcdic[*usrce++];
+    }
+
+    return dest;
+}
+
+#else /*CHARSET_EBCDIC*/
+#ifdef PEDANTIC
+static void *dummy=&dummy;
+#endif
+#endif
diff --git a/src/lib/libcrypto/ebcdic.h b/src/lib/libcrypto/ebcdic.h
index d3b4e98b12..6d65afcf9e 100644
--- a/src/lib/libcrypto/ebcdic.h
+++ b/src/lib/libcrypto/ebcdic.h
@@ -1,17 +1,19 @@
+/* crypto/ebcdic.h */
+
 #ifndef HEADER_EBCDIC_H
 #define HEADER_EBCDIC_H
 
 #include <sys/types.h>
 
 /* Avoid name clashes with other applications */
-#define os_toascii   _eay2000_os_toascii
-#define os_toebcdic  _eay2000_os_toebcdic
-#define ebcdic2ascii _eay2000_ebcdic2ascii
-#define ascii2ebcdic _eay2000_ascii2ebcdic
+#define os_toascii   _openssl_os_toascii
+#define os_toebcdic  _openssl_os_toebcdic
+#define ebcdic2ascii _openssl_ebcdic2ascii
+#define ascii2ebcdic _openssl_ascii2ebcdic
 
 extern const unsigned char os_toascii[256];
 extern const unsigned char os_toebcdic[256];
-void ebcdic2ascii(unsigned char *dest, const unsigned char *srce, size_t count);
-void ascii2ebcdic(unsigned char *dest, const unsigned char *srce, size_t count);
+void *ebcdic2ascii(void *dest, const void *srce, size_t count);
+void *ascii2ebcdic(void *dest, const void *srce, size_t count);
 
 #endif
diff --git a/src/lib/libcrypto/err/Makefile.ssl b/src/lib/libcrypto/err/Makefile.ssl
index ae827edddb..fb74e4eb13 100644
--- a/src/lib/libcrypto/err/Makefile.ssl
+++ b/src/lib/libcrypto/err/Makefile.ssl
@@ -82,8 +82,8 @@ err.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 err.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 err.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
-err.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-err.o: ../cryptlib.h
+err.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+err.o: ../../include/openssl/stack.h ../cryptlib.h
 err_all.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 err_all.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 err_all.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -96,15 +96,16 @@ err_all.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
 err_all.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
 err_all.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 err_all.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs12.h
-err_all.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
-err_all.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
-err_all.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
-err_all.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-err_all.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-err_all.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+err_all.o: ../../include/openssl/pkcs7.h ../../include/openssl/rand.h
+err_all.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+err_all.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+err_all.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+err_all.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+err_all.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+err_all.o: ../../include/openssl/x509v3.h
 err_prn.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 err_prn.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 err_prn.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 err_prn.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
-err_prn.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-err_prn.o: ../cryptlib.h
+err_prn.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+err_prn.o: ../../include/openssl/stack.h ../cryptlib.h
diff --git a/src/lib/libcrypto/err/err.c b/src/lib/libcrypto/err/err.c
index 8810d838c6..93c64cbc4f 100644
--- a/src/lib/libcrypto/err/err.c
+++ b/src/lib/libcrypto/err/err.c
@@ -91,7 +91,7 @@ static ERR_STRING_DATA ERR_str_libraries[]=
 {ERR_PACK(ERR_LIB_PEM,0,0)              ,"PEM routines"},
 {ERR_PACK(ERR_LIB_ASN1,0,0)             ,"asn1 encoding routines"},
 {ERR_PACK(ERR_LIB_X509,0,0)             ,"x509 certificate routines"},
-{ERR_PACK(ERR_LIB_CONF,0,0)             ,"configuation file routines"},
+{ERR_PACK(ERR_LIB_CONF,0,0)             ,"configuration file routines"},
 {ERR_PACK(ERR_LIB_METH,0,0)             ,"X509 lookup 'method' routines"},
 {ERR_PACK(ERR_LIB_SSL,0,0)              ,"SSL routines"},
 {ERR_PACK(ERR_LIB_RSAREF,0,0)           ,"RSAref routines"},
@@ -100,6 +100,7 @@ static ERR_STRING_DATA ERR_str_libraries[]=
 {ERR_PACK(ERR_LIB_PKCS7,0,0)            ,"PKCS7 routines"},
 {ERR_PACK(ERR_LIB_X509V3,0,0)           ,"X509 V3 routines"},
 {ERR_PACK(ERR_LIB_PKCS12,0,0)           ,"PKCS12 routines"},
+{ERR_PACK(ERR_LIB_RAND,0,0)             ,"random number generator"},
 {0,NULL},
         };
 
@@ -221,7 +222,7 @@ void ERR_load_strings(int lib, ERR_STRING_DATA *str)
         while (str->error)
                 {
                 str->error|=ERR_PACK(lib,0,0);
-                lh_insert(error_hash,(char *)str);
+                lh_insert(error_hash,str);
                 str++;
                 }
         CRYPTO_w_unlock(CRYPTO_LOCK_ERR_HASH);
@@ -427,7 +428,7 @@ const char *ERR_lib_error_string(unsigned long e)
         if (error_hash != NULL)
                 {
                 d.error=ERR_PACK(l,0,0);
-                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,(char *)&d);
+                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,&d);
                 }
 
         CRYPTO_r_unlock(CRYPTO_LOCK_ERR_HASH);
@@ -448,7 +449,7 @@ const char *ERR_func_error_string(unsigned long e)
         if (error_hash != NULL)
                 {
                 d.error=ERR_PACK(l,f,0);
-                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,(char *)&d);
+                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,&d);
                 }
 
         CRYPTO_r_unlock(CRYPTO_LOCK_ERR_HASH);
@@ -469,12 +470,11 @@ const char *ERR_reason_error_string(unsigned long e)
         if (error_hash != NULL)
                 {
                 d.error=ERR_PACK(l,0,r);
-                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,(char *)&d);
+                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,&d);
                 if (p == NULL)
                         {
                         d.error=ERR_PACK(0,0,r);
-                        p=(ERR_STRING_DATA *)lh_retrieve(error_hash,
-                                (char *)&d);
+                        p=(ERR_STRING_DATA *)lh_retrieve(error_hash,&d);
                         }
                 }
 
@@ -517,7 +517,7 @@ void ERR_remove_state(unsigned long pid)
                 pid=(unsigned long)CRYPTO_thread_id();
         tmp.pid=pid;
         CRYPTO_w_lock(CRYPTO_LOCK_ERR);
-        p=(ERR_STATE *)lh_delete(thread_hash,(char *)&tmp);
+        p=(ERR_STATE *)lh_delete(thread_hash,&tmp);
         CRYPTO_w_unlock(CRYPTO_LOCK_ERR);
 
         if (p != NULL) ERR_STATE_free(p);
@@ -551,7 +551,7 @@ ERR_STATE *ERR_get_state(void)
         else
                 {
                 tmp.pid=pid;
-                ret=(ERR_STATE *)lh_retrieve(thread_hash,(char *)&tmp);
+                ret=(ERR_STATE *)lh_retrieve(thread_hash,&tmp);
                 CRYPTO_r_unlock(CRYPTO_LOCK_ERR);
                 }
 
@@ -569,7 +569,7 @@ ERR_STATE *ERR_get_state(void)
                         ret->err_data_flags[i]=0;
                         }
                 CRYPTO_w_lock(CRYPTO_LOCK_ERR);
-                tmpp=(ERR_STATE *)lh_insert(thread_hash,(char *)ret);
+                tmpp=(ERR_STATE *)lh_insert(thread_hash,ret);
                 CRYPTO_w_unlock(CRYPTO_LOCK_ERR);
                 if (tmpp != NULL) /* old entry - should not happen */
                         {
diff --git a/src/lib/libcrypto/err/err.h b/src/lib/libcrypto/err/err.h
index 9411fb3568..15bafbff43 100644
--- a/src/lib/libcrypto/err/err.h
+++ b/src/lib/libcrypto/err/err.h
@@ -122,6 +122,7 @@ typedef struct err_state_st
 #define ERR_LIB_PKCS7           33
 #define ERR_LIB_X509V3          34
 #define ERR_LIB_PKCS12          35
+#define ERR_LIB_RAND            36
 
 #define ERR_LIB_USER            128
 
@@ -149,6 +150,7 @@ typedef struct err_state_st
 #define PKCS7err(f,r) ERR_PUT_error(ERR_LIB_PKCS7,(f),(r),ERR_file_name,__LINE__)
 #define X509V3err(f,r) ERR_PUT_error(ERR_LIB_X509V3,(f),(r),ERR_file_name,__LINE__)
 #define PKCS12err(f,r) ERR_PUT_error(ERR_LIB_PKCS12,(f),(r),ERR_file_name,__LINE__)
+#define RANDerr(f,r) ERR_PUT_error(ERR_LIB_RAND,(f),(r),ERR_file_name,__LINE__)
 
 /* Borland C seems too stupid to be able to shift and do longs in
  * the pre-processor :-( */
@@ -160,7 +162,7 @@ typedef struct err_state_st
 #define ERR_GET_REASON(l)       (int)((l)&0xfffL)
 #define ERR_FATAL_ERROR(l)      (int)((l)&ERR_R_FATAL)
 
-/* OS fuctions */
+/* OS functions */
 #define SYS_F_FOPEN             1
 #define SYS_F_CONNECT           2
 #define SYS_F_GETSERVBYNAME     3
@@ -239,9 +241,9 @@ void ERR_print_errors(BIO *bp);
 void ERR_add_error_data(int num, ...);
 #endif
 void ERR_load_strings(int lib,ERR_STRING_DATA str[]);
-void ERR_load_ERR_strings(void );
-void ERR_load_crypto_strings(void );
-void ERR_free_strings(void );
+void ERR_load_ERR_strings(void);
+void ERR_load_crypto_strings(void);
+void ERR_free_strings(void);
 
 void ERR_remove_state(unsigned long pid); /* if zero we look it up */
 ERR_STATE *ERR_get_state(void);
diff --git a/src/lib/libcrypto/err/err_all.c b/src/lib/libcrypto/err/err_all.c
index ad820227d2..10c463b389 100644
--- a/src/lib/libcrypto/err/err_all.c
+++ b/src/lib/libcrypto/err/err_all.c
@@ -80,6 +80,7 @@
 #include <openssl/x509v3.h>
 #include <openssl/conf.h>
 #include <openssl/pkcs12.h>
+#include <openssl/rand.h>
 #include <openssl/err.h>
 
 void ERR_load_crypto_strings(void)
@@ -116,5 +117,6 @@ void ERR_load_crypto_strings(void)
         ERR_load_CRYPTO_strings();
         ERR_load_PKCS7_strings();
         ERR_load_PKCS12_strings();
+        ERR_load_RAND_strings();
 #endif
         }
diff --git a/src/lib/libcrypto/err/openssl.ec b/src/lib/libcrypto/err/openssl.ec
index c2a8acff0c..e132ba3182 100644
--- a/src/lib/libcrypto/err/openssl.ec
+++ b/src/lib/libcrypto/err/openssl.ec
@@ -21,6 +21,7 @@ L PKCS12	crypto/pkcs12/pkcs12.h		crypto/pkcs12/pk12err.c
 L RSAREF        rsaref/rsaref.h                 rsaref/rsar_err.c
 L SSL           ssl/ssl.h                       ssl/ssl_err.c
 L COMP          crypto/comp/comp.h              crypto/comp/comp_err.c
+L RAND          crypto/rand/rand.h              crypto/rand/rand_err.c
 
 
 F RSAREF_F_RSA_BN2BIN
@@ -47,11 +48,11 @@ R SSL_R_TLSV1_ALERT_UNKNOWN_CA			1048
 R SSL_R_TLSV1_ALERT_ACCESS_DENIED               1049
 R SSL_R_TLSV1_ALERT_DECODE_ERROR                1050
 R SSL_R_TLSV1_ALERT_DECRYPT_ERROR               1051
-R SSL_R_TLSV1_ALERT_EXPORT_RESTRICION           1060
+R SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION          1060
 R SSL_R_TLSV1_ALERT_PROTOCOL_VERSION            1070
 R SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY       1071
 R SSL_R_TLSV1_ALERT_INTERNAL_ERROR              1080
-R SSL_R_TLSV1_ALERT_USER_CANCLED                1090
+R SSL_R_TLSV1_ALERT_USER_CANCELLED              1090
 R SSL_R_TLSV1_ALERT_NO_RENEGOTIATION            1100
 
 R RSAREF_R_CONTENT_ENCODING                     0x0400
diff --git a/src/lib/libcrypto/evp/Makefile.ssl b/src/lib/libcrypto/evp/Makefile.ssl
index 753479a015..c763b5ccd6 100644
--- a/src/lib/libcrypto/evp/Makefile.ssl
+++ b/src/lib/libcrypto/evp/Makefile.ssl
@@ -35,7 +35,8 @@ LIBSRC= encode.c digest.c evp_enc.c evp_key.c \
         m_ripemd.c \
         p_open.c p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c p_dec.c \
         bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \
-        c_all.c evp_lib.c bio_ok.c evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c
+        c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \
+        evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c
 
 LIBOBJ= encode.o digest.o evp_enc.o evp_key.o \
         e_ecb_d.o e_cbc_d.o e_cfb_d.o e_ofb_d.o \
@@ -50,7 +51,8 @@ LIBOBJ=	encode.o digest.o evp_enc.o evp_key.o \
         m_ripemd.o \
         p_open.o p_seal.o p_sign.o p_verify.o p_lib.o p_enc.o p_dec.o \
         bio_md.o bio_b64.o bio_enc.o evp_err.o e_null.o \
-        c_all.o evp_lib.o bio_ok.o evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o
+        c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \
+        evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o
 
 SRC= $(LIBSRC)
 
@@ -176,13 +178,45 @@ c_all.o: ../../include/openssl/err.h ../../include/openssl/evp.h
 c_all.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
 c_all.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 c_all.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-c_all.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
-c_all.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+c_all.o: ../../include/openssl/opensslv.h ../../include/openssl/rc2.h
 c_all.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 c_all.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 c_all.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-c_all.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-c_all.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+c_all.o: ../../include/openssl/stack.h ../cryptlib.h
+c_allc.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+c_allc.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+c_allc.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+c_allc.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+c_allc.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+c_allc.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+c_allc.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+c_allc.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+c_allc.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+c_allc.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+c_allc.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
+c_allc.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+c_allc.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+c_allc.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+c_allc.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+c_allc.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+c_allc.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+c_alld.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+c_alld.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+c_alld.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+c_alld.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+c_alld.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+c_alld.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+c_alld.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+c_alld.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+c_alld.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+c_alld.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+c_alld.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
+c_alld.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+c_alld.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+c_alld.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+c_alld.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+c_alld.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+c_alld.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 digest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 digest.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 digest.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
diff --git a/src/lib/libcrypto/evp/bio_b64.c b/src/lib/libcrypto/evp/bio_b64.c
index 84729119df..bd5e24f993 100644
--- a/src/lib/libcrypto/evp/bio_b64.c
+++ b/src/lib/libcrypto/evp/bio_b64.c
@@ -69,6 +69,7 @@ static int b64_read(BIO *h,char *buf,int size);
 static long b64_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int b64_new(BIO *h);
 static int b64_free(BIO *data);
+static long b64_callback_ctrl(BIO *h,int cmd,void (*fp)());
 #define B64_BLOCK_SIZE  1024
 #define B64_BLOCK_SIZE2 768
 #define B64_NONE        0
@@ -100,6 +101,7 @@ static BIO_METHOD methods_b64=
         b64_ctrl,
         b64_new,
         b64_free,
+        b64_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_base64(void)
@@ -237,8 +239,8 @@ static int b64_read(BIO *b, char *out, int outl)
                                                         &(ctx->tmp[0]));
                                                 for (x=0; x < i; x++)
                                                         ctx->tmp[x]=p[x];
-                                                EVP_DecodeInit(&ctx->base64);
                                                 }
+                                        EVP_DecodeInit(&ctx->base64);
                                         ctx->start=0;
                                         break;
                                         }
@@ -522,3 +524,17 @@ again:
         return(ret);
         }
 
+static long b64_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
diff --git a/src/lib/libcrypto/evp/bio_enc.c b/src/lib/libcrypto/evp/bio_enc.c
index 0a7b1ecf07..629bf4b95d 100644
--- a/src/lib/libcrypto/evp/bio_enc.c
+++ b/src/lib/libcrypto/evp/bio_enc.c
@@ -69,6 +69,7 @@ static int enc_read(BIO *h,char *buf,int size);
 static long enc_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int enc_new(BIO *h);
 static int enc_free(BIO *data);
+static long enc_callback_ctrl(BIO *h,int cmd,void (*fp)());
 #define ENC_BLOCK_SIZE  (1024*4)
 
 typedef struct enc_struct
@@ -92,6 +93,7 @@ static BIO_METHOD methods_enc=
         enc_ctrl,
         enc_new,
         enc_free,
+        enc_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_cipher(void)
@@ -184,9 +186,11 @@ static int enc_read(BIO *b, char *out, int outl)
                                 ctx->ok=i;
                                 ctx->buf_off=0;
                                 }
-                        else
+                        else 
+                                {
                                 ret=(ret == 0)?i:ret;
-                        break;
+                                break;
+                                }
                         }
                 else
                         {
@@ -194,13 +198,19 @@ static int enc_read(BIO *b, char *out, int outl)
                                 (unsigned char *)ctx->buf,&ctx->buf_len,
                                 (unsigned char *)&(ctx->buf[8]),i);
                         ctx->cont=1;
+                        /* Note: it is possible for EVP_CipherUpdate to
+                         * decrypt zero bytes because this is or looks like
+                         * the final block: if this happens we should retry
+                         * and either read more data or decrypt the final
+                         * block
+                         */
+                        if(ctx->buf_len == 0) continue;
                         }
 
                 if (ctx->buf_len <= outl)
                         i=ctx->buf_len;
                 else
                         i=outl;
-
                 if (i <= 0) break;
                 memcpy(out,ctx->buf,i);
                 ret+=i;
@@ -360,6 +370,20 @@ again:
         return(ret);
         }
 
+static long enc_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 /*
 void BIO_set_cipher_ctx(b,c)
 BIO *b;
diff --git a/src/lib/libcrypto/evp/bio_md.c b/src/lib/libcrypto/evp/bio_md.c
index 317167f9c4..aef928dd8f 100644
--- a/src/lib/libcrypto/evp/bio_md.c
+++ b/src/lib/libcrypto/evp/bio_md.c
@@ -72,6 +72,8 @@ static int md_gets(BIO *h,char *str,int size);
 static long md_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int md_new(BIO *h);
 static int md_free(BIO *data);
+static long md_callback_ctrl(BIO *h,int cmd,void (*fp)());
+
 static BIO_METHOD methods_md=
         {
         BIO_TYPE_MD,"message digest",
@@ -82,6 +84,7 @@ static BIO_METHOD methods_md=
         md_ctrl,
         md_new,
         md_free,
+        md_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_md(void)
@@ -220,6 +223,20 @@ static long md_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long md_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int md_gets(BIO *bp, char *buf, int size)
         {
         EVP_MD_CTX *ctx;
diff --git a/src/lib/libcrypto/evp/bio_ok.c b/src/lib/libcrypto/evp/bio_ok.c
index 101275d648..e6ff5f2cdb 100644
--- a/src/lib/libcrypto/evp/bio_ok.c
+++ b/src/lib/libcrypto/evp/bio_ok.c
@@ -67,7 +67,7 @@
         and everything was OK. BUT if user types wrong password 
         BIO_f_cipher outputs only garbage and my function crashes. Yes
         I can and I should fix my function, but BIO_f_cipher is 
-        easy way to add encryption support to many exisiting applications
+        easy way to add encryption support to many existing applications
         and it's hard to debug and fix them all. 
 
         So I wanted another BIO which would catch the incorrect passwords and
@@ -80,10 +80,10 @@
         1) you must somehow separate checksum from actual data. 
         2) you need lot's of memory when reading the file, because you 
         must read to the end of the file and verify the checksum before
-        leting the application to read the data. 
+        letting the application to read the data. 
         
         BIO_f_reliable tries to solve both problems, so that you can 
-        read and write arbitraly long streams using only fixed amount
+        read and write arbitrary long streams using only fixed amount
         of memory.
 
         BIO_f_reliable splits data stream into blocks. Each block is prefixed
@@ -91,7 +91,7 @@
         several Kbytes of memory to buffer single block before verifying 
         it's digest. 
 
-        BIO_f_reliable goes futher and adds several important capabilities:
+        BIO_f_reliable goes further and adds several important capabilities:
 
         1) the digest of the block is computed over the whole stream 
         -- so nobody can rearrange the blocks or remove or replace them.
@@ -110,7 +110,7 @@
         and then compare the digest output.
 
         Bad things: BIO_f_reliable knows what's going on in EVP_Digest. I 
-        initialy wrote and tested this code on x86 machine and wrote the
+        initially wrote and tested this code on x86 machine and wrote the
         digests out in machine-dependent order :( There are people using
         this code and I cannot change this easily without making existing
         data files unreadable.
@@ -130,6 +130,8 @@ static int ok_read(BIO *h,char *buf,int size);
 static long ok_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int ok_new(BIO *h);
 static int ok_free(BIO *data);
+static long ok_callback_ctrl(BIO *h,int cmd,void (*fp)());
+
 static void sig_out(BIO* b);
 static void sig_in(BIO* b);
 static void block_out(BIO* b);
@@ -173,6 +175,7 @@ static BIO_METHOD methods_ok=
         ok_ctrl,
         ok_new,
         ok_free,
+        ok_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_reliable(void)
@@ -428,6 +431,20 @@ static long ok_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long ok_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static void longswap(void *_ptr, int len)
 {
 #ifndef L_ENDIAN
@@ -451,12 +468,12 @@ static void sig_out(BIO* b)
         if(ctx->buf_len+ 2* md->digest->md_size > OK_BLOCK_SIZE) return;
 
         EVP_DigestInit(md, md->digest);
-        RAND_bytes(&(md->md.base[0]), md->digest->md_size);
+        RAND_pseudo_bytes(&(md->md.base[0]), md->digest->md_size);
         memcpy(&(ctx->buf[ctx->buf_len]), &(md->md.base[0]), md->digest->md_size);
         longswap(&(ctx->buf[ctx->buf_len]), md->digest->md_size);
         ctx->buf_len+= md->digest->md_size;
 
-        EVP_DigestUpdate(md, (unsigned char*)WELLKNOWN, strlen(WELLKNOWN));
+        EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN));
         md->digest->final(&(ctx->buf[ctx->buf_len]), &(md->md.base[0]));
         ctx->buf_len+= md->digest->md_size;
         ctx->blockout= 1;
@@ -480,7 +497,7 @@ static void sig_in(BIO* b)
         longswap(&(md->md.base[0]), md->digest->md_size);
         ctx->buf_off+= md->digest->md_size;
 
-        EVP_DigestUpdate(md, (unsigned char*)WELLKNOWN, strlen(WELLKNOWN));
+        EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN));
         md->digest->final(tmp, &(md->md.base[0]));
         ret= memcmp(&(ctx->buf[ctx->buf_off]), tmp, md->digest->md_size) == 0;
         ctx->buf_off+= md->digest->md_size;
diff --git a/src/lib/libcrypto/evp/c_all.c b/src/lib/libcrypto/evp/c_all.c
index a4d3b43fb9..1e185830a3 100644
--- a/src/lib/libcrypto/evp/c_all.c
+++ b/src/lib/libcrypto/evp/c_all.c
@@ -59,135 +59,9 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/evp.h>
-#include <openssl/pkcs12.h>
-#include <openssl/objects.h>
 
-void SSLeay_add_all_algorithms(void)
-        {
-        SSLeay_add_all_ciphers();
-        SSLeay_add_all_digests();
-        }
-
-void SSLeay_add_all_ciphers(void)
-        {
-#ifndef NO_DES
-        EVP_add_cipher(EVP_des_cfb());
-        EVP_add_cipher(EVP_des_ede_cfb());
-        EVP_add_cipher(EVP_des_ede3_cfb());
-
-        EVP_add_cipher(EVP_des_ofb());
-        EVP_add_cipher(EVP_des_ede_ofb());
-        EVP_add_cipher(EVP_des_ede3_ofb());
-
-        EVP_add_cipher(EVP_desx_cbc());
-        EVP_add_cipher_alias(SN_desx_cbc,"DESX");
-        EVP_add_cipher_alias(SN_desx_cbc,"desx");
-
-        EVP_add_cipher(EVP_des_cbc());
-        EVP_add_cipher_alias(SN_des_cbc,"DES");
-        EVP_add_cipher_alias(SN_des_cbc,"des");
-        EVP_add_cipher(EVP_des_ede_cbc());
-        EVP_add_cipher(EVP_des_ede3_cbc());
-        EVP_add_cipher_alias(SN_des_ede3_cbc,"DES3");
-        EVP_add_cipher_alias(SN_des_ede3_cbc,"des3");
-
-        EVP_add_cipher(EVP_des_ecb());
-        EVP_add_cipher(EVP_des_ede());
-        EVP_add_cipher(EVP_des_ede3());
-#endif
-
-#ifndef NO_RC4
-        EVP_add_cipher(EVP_rc4());
-        EVP_add_cipher(EVP_rc4_40());
-#endif
-
-#ifndef NO_IDEA
-        EVP_add_cipher(EVP_idea_ecb());
-        EVP_add_cipher(EVP_idea_cfb());
-        EVP_add_cipher(EVP_idea_ofb());
-        EVP_add_cipher(EVP_idea_cbc());
-        EVP_add_cipher_alias(SN_idea_cbc,"IDEA");
-        EVP_add_cipher_alias(SN_idea_cbc,"idea");
-#endif
-
-#ifndef NO_RC2
-        EVP_add_cipher(EVP_rc2_ecb());
-        EVP_add_cipher(EVP_rc2_cfb());
-        EVP_add_cipher(EVP_rc2_ofb());
-        EVP_add_cipher(EVP_rc2_cbc());
-        EVP_add_cipher(EVP_rc2_40_cbc());
-        EVP_add_cipher(EVP_rc2_64_cbc());
-        EVP_add_cipher_alias(SN_rc2_cbc,"RC2");
-        EVP_add_cipher_alias(SN_rc2_cbc,"rc2");
-#endif
-
-#ifndef NO_BF
-        EVP_add_cipher(EVP_bf_ecb());
-        EVP_add_cipher(EVP_bf_cfb());
-        EVP_add_cipher(EVP_bf_ofb());
-        EVP_add_cipher(EVP_bf_cbc());
-        EVP_add_cipher_alias(SN_bf_cbc,"BF");
-        EVP_add_cipher_alias(SN_bf_cbc,"bf");
-        EVP_add_cipher_alias(SN_bf_cbc,"blowfish");
-#endif
-
-#ifndef NO_CAST
-        EVP_add_cipher(EVP_cast5_ecb());
-        EVP_add_cipher(EVP_cast5_cfb());
-        EVP_add_cipher(EVP_cast5_ofb());
-        EVP_add_cipher(EVP_cast5_cbc());
-        EVP_add_cipher_alias(SN_cast5_cbc,"CAST");
-        EVP_add_cipher_alias(SN_cast5_cbc,"cast");
-        EVP_add_cipher_alias(SN_cast5_cbc,"CAST-cbc");
-        EVP_add_cipher_alias(SN_cast5_cbc,"cast-cbc");
-#endif
-
-#ifndef NO_RC5
-        EVP_add_cipher(EVP_rc5_32_12_16_ecb());
-        EVP_add_cipher(EVP_rc5_32_12_16_cfb());
-        EVP_add_cipher(EVP_rc5_32_12_16_ofb());
-        EVP_add_cipher(EVP_rc5_32_12_16_cbc());
-        EVP_add_cipher_alias(SN_rc5_cbc,"rc5");
-        EVP_add_cipher_alias(SN_rc5_cbc,"RC5");
-#endif
-        }
-
-
-void SSLeay_add_all_digests(void)
-        {
-#ifndef NO_MD2
-        EVP_add_digest(EVP_md2());
-#endif
-#ifndef NO_MD5
-        EVP_add_digest(EVP_md5());
-        EVP_add_digest_alias(SN_md5,"ssl2-md5");
-        EVP_add_digest_alias(SN_md5,"ssl3-md5");
-#endif
-#ifndef NO_SHA
-        EVP_add_digest(EVP_sha());
-#ifndef NO_DSA
-        EVP_add_digest(EVP_dss());
-#endif
-#endif
-#ifndef NO_SHA
-        EVP_add_digest(EVP_sha1());
-        EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
-        EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA);
-#ifndef NO_DSA
-        EVP_add_digest(EVP_dss1());
-        EVP_add_digest_alias(SN_dsaWithSHA1,SN_dsaWithSHA1_2);
-        EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1");
-        EVP_add_digest_alias(SN_dsaWithSHA1,"dss1");
-#endif
-#endif
-#if !defined(NO_MDC2) && !defined(NO_DES)
-        EVP_add_digest(EVP_mdc2());
-#endif
-#ifndef NO_RIPEMD
-        EVP_add_digest(EVP_ripemd160());
-        EVP_add_digest_alias(SN_ripemd160,"ripemd");
-        EVP_add_digest_alias(SN_ripemd160,"rmd160");
-#endif
-        PKCS12_PBE_add();
-        PKCS5_PBE_add();
-        }
+void OpenSSL_add_all_algorithms(void)
+{
+        OpenSSL_add_all_ciphers();
+        OpenSSL_add_all_digests();
+}
diff --git a/src/lib/libcrypto/evp/c_allc.c b/src/lib/libcrypto/evp/c_allc.c
new file mode 100644
index 0000000000..f24d3756c9
--- /dev/null
+++ b/src/lib/libcrypto/evp/c_allc.c
@@ -0,0 +1,149 @@
+/* crypto/evp/c_allc.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/pkcs12.h>
+#include <openssl/objects.h>
+
+void OpenSSL_add_all_ciphers(void)
+        {
+#ifndef NO_DES
+        EVP_add_cipher(EVP_des_cfb());
+        EVP_add_cipher(EVP_des_ede_cfb());
+        EVP_add_cipher(EVP_des_ede3_cfb());
+
+        EVP_add_cipher(EVP_des_ofb());
+        EVP_add_cipher(EVP_des_ede_ofb());
+        EVP_add_cipher(EVP_des_ede3_ofb());
+
+        EVP_add_cipher(EVP_desx_cbc());
+        EVP_add_cipher_alias(SN_desx_cbc,"DESX");
+        EVP_add_cipher_alias(SN_desx_cbc,"desx");
+
+        EVP_add_cipher(EVP_des_cbc());
+        EVP_add_cipher_alias(SN_des_cbc,"DES");
+        EVP_add_cipher_alias(SN_des_cbc,"des");
+        EVP_add_cipher(EVP_des_ede_cbc());
+        EVP_add_cipher(EVP_des_ede3_cbc());
+        EVP_add_cipher_alias(SN_des_ede3_cbc,"DES3");
+        EVP_add_cipher_alias(SN_des_ede3_cbc,"des3");
+
+        EVP_add_cipher(EVP_des_ecb());
+        EVP_add_cipher(EVP_des_ede());
+        EVP_add_cipher(EVP_des_ede3());
+#endif
+
+#ifndef NO_RC4
+        EVP_add_cipher(EVP_rc4());
+        EVP_add_cipher(EVP_rc4_40());
+#endif
+
+#ifndef NO_IDEA
+        EVP_add_cipher(EVP_idea_ecb());
+        EVP_add_cipher(EVP_idea_cfb());
+        EVP_add_cipher(EVP_idea_ofb());
+        EVP_add_cipher(EVP_idea_cbc());
+        EVP_add_cipher_alias(SN_idea_cbc,"IDEA");
+        EVP_add_cipher_alias(SN_idea_cbc,"idea");
+#endif
+
+#ifndef NO_RC2
+        EVP_add_cipher(EVP_rc2_ecb());
+        EVP_add_cipher(EVP_rc2_cfb());
+        EVP_add_cipher(EVP_rc2_ofb());
+        EVP_add_cipher(EVP_rc2_cbc());
+        EVP_add_cipher(EVP_rc2_40_cbc());
+        EVP_add_cipher(EVP_rc2_64_cbc());
+        EVP_add_cipher_alias(SN_rc2_cbc,"RC2");
+        EVP_add_cipher_alias(SN_rc2_cbc,"rc2");
+#endif
+
+#ifndef NO_BF
+        EVP_add_cipher(EVP_bf_ecb());
+        EVP_add_cipher(EVP_bf_cfb());
+        EVP_add_cipher(EVP_bf_ofb());
+        EVP_add_cipher(EVP_bf_cbc());
+        EVP_add_cipher_alias(SN_bf_cbc,"BF");
+        EVP_add_cipher_alias(SN_bf_cbc,"bf");
+        EVP_add_cipher_alias(SN_bf_cbc,"blowfish");
+#endif
+
+#ifndef NO_CAST
+        EVP_add_cipher(EVP_cast5_ecb());
+        EVP_add_cipher(EVP_cast5_cfb());
+        EVP_add_cipher(EVP_cast5_ofb());
+        EVP_add_cipher(EVP_cast5_cbc());
+        EVP_add_cipher_alias(SN_cast5_cbc,"CAST");
+        EVP_add_cipher_alias(SN_cast5_cbc,"cast");
+        EVP_add_cipher_alias(SN_cast5_cbc,"CAST-cbc");
+        EVP_add_cipher_alias(SN_cast5_cbc,"cast-cbc");
+#endif
+
+#ifndef NO_RC5
+        EVP_add_cipher(EVP_rc5_32_12_16_ecb());
+        EVP_add_cipher(EVP_rc5_32_12_16_cfb());
+        EVP_add_cipher(EVP_rc5_32_12_16_ofb());
+        EVP_add_cipher(EVP_rc5_32_12_16_cbc());
+        EVP_add_cipher_alias(SN_rc5_cbc,"rc5");
+        EVP_add_cipher_alias(SN_rc5_cbc,"RC5");
+#endif
+        PKCS12_PBE_add();
+        PKCS5_PBE_add();
+        }
diff --git a/src/lib/libcrypto/evp/c_alld.c b/src/lib/libcrypto/evp/c_alld.c
new file mode 100644
index 0000000000..febe51a3ee
--- /dev/null
+++ b/src/lib/libcrypto/evp/c_alld.c
@@ -0,0 +1,100 @@
+/* crypto/evp/c_alld.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/pkcs12.h>
+#include <openssl/objects.h>
+
+void OpenSSL_add_all_digests(void)
+        {
+#ifndef NO_MD2
+        EVP_add_digest(EVP_md2());
+#endif
+#ifndef NO_MD5
+        EVP_add_digest(EVP_md5());
+        EVP_add_digest_alias(SN_md5,"ssl2-md5");
+        EVP_add_digest_alias(SN_md5,"ssl3-md5");
+#endif
+#ifndef NO_SHA
+        EVP_add_digest(EVP_sha());
+#ifndef NO_DSA
+        EVP_add_digest(EVP_dss());
+#endif
+#endif
+#ifndef NO_SHA
+        EVP_add_digest(EVP_sha1());
+        EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
+        EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA);
+#ifndef NO_DSA
+        EVP_add_digest(EVP_dss1());
+        EVP_add_digest_alias(SN_dsaWithSHA1,SN_dsaWithSHA1_2);
+        EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1");
+        EVP_add_digest_alias(SN_dsaWithSHA1,"dss1");
+#endif
+#endif
+#if !defined(NO_MDC2) && !defined(NO_DES)
+        EVP_add_digest(EVP_mdc2());
+#endif
+#ifndef NO_RIPEMD
+        EVP_add_digest(EVP_ripemd160());
+        EVP_add_digest_alias(SN_ripemd160,"ripemd");
+        EVP_add_digest_alias(SN_ripemd160,"rmd160");
+#endif
+        }
diff --git a/src/lib/libcrypto/evp/e_cbc_3d.c b/src/lib/libcrypto/evp/e_cbc_3d.c
index 02ccc6dc90..5d16b865c5 100644
--- a/src/lib/libcrypto/evp/e_cbc_3d.c
+++ b/src/lib/libcrypto/evp/e_cbc_3d.c
@@ -115,8 +115,8 @@ static void des_cbc_ede_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
                 memcpy( (char *)ctx->c.des_ede.ks3,
                         (char *)ctx->c.des_ede.ks1,
                         sizeof(ctx->c.des_ede.ks1));
@@ -134,9 +134,9 @@ static void des_cbc_ede3_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
-                des_set_key(&deskey[2],ctx->c.des_ede.ks3);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[2],ctx->c.des_ede.ks3);
                 }
         }
 
diff --git a/src/lib/libcrypto/evp/e_cbc_d.c b/src/lib/libcrypto/evp/e_cbc_d.c
index 9203f3f52d..5b4e5b8601 100644
--- a/src/lib/libcrypto/evp/e_cbc_d.c
+++ b/src/lib/libcrypto/evp/e_cbc_d.c
@@ -93,7 +93,7 @@ static void des_cbc_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
                 memcpy(&(ctx->oiv[0]),iv,8);
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
-                des_set_key(deskey,ctx->c.des_ks);
+                des_set_key_unchecked(deskey,ctx->c.des_ks);
         }
 
 static void des_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libcrypto/evp/e_cfb_3d.c b/src/lib/libcrypto/evp/e_cfb_3d.c
index bd32b072e2..b364bd4e31 100644
--- a/src/lib/libcrypto/evp/e_cfb_3d.c
+++ b/src/lib/libcrypto/evp/e_cfb_3d.c
@@ -116,8 +116,8 @@ static void des_ede_cfb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
                 memcpy( (char *)ctx->c.des_ede.ks3,
                         (char *)ctx->c.des_ede.ks1,
                         sizeof(ctx->c.des_ede.ks1));
@@ -136,9 +136,9 @@ static void des_ede3_cfb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
-                des_set_key(&deskey[2],ctx->c.des_ede.ks3);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[2],ctx->c.des_ede.ks3);
                 }
         }
 
diff --git a/src/lib/libcrypto/evp/e_cfb_d.c b/src/lib/libcrypto/evp/e_cfb_d.c
index 6bdf20b646..9e1714bd15 100644
--- a/src/lib/libcrypto/evp/e_cfb_d.c
+++ b/src/lib/libcrypto/evp/e_cfb_d.c
@@ -95,7 +95,7 @@ static void des_cfb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
                 memcpy(&(ctx->oiv[0]),iv,8);
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
-                des_set_key(deskey,ctx->c.des_ks);
+                des_set_key_unchecked(deskey,ctx->c.des_ks);
         }
 
 static void des_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libcrypto/evp/e_ecb_3d.c b/src/lib/libcrypto/evp/e_ecb_3d.c
index 354a8b79a7..806e971d36 100644
--- a/src/lib/libcrypto/evp/e_ecb_3d.c
+++ b/src/lib/libcrypto/evp/e_ecb_3d.c
@@ -110,8 +110,8 @@ static void des_ede_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
                 memcpy( (char *)ctx->c.des_ede.ks3,
                         (char *)ctx->c.des_ede.ks1,
                         sizeof(ctx->c.des_ede.ks1));
@@ -125,9 +125,9 @@ static void des_ede3_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
-                des_set_key(&deskey[2],ctx->c.des_ede.ks3);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[2],ctx->c.des_ede.ks3);
                 }
         }
 
diff --git a/src/lib/libcrypto/evp/e_ecb_d.c b/src/lib/libcrypto/evp/e_ecb_d.c
index 5fb4e64b1c..c11bef55ef 100644
--- a/src/lib/libcrypto/evp/e_ecb_d.c
+++ b/src/lib/libcrypto/evp/e_ecb_d.c
@@ -90,7 +90,7 @@ static void des_ecb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         des_cblock *deskey = (des_cblock *)key;
 
         if (deskey != NULL)
-                des_set_key(deskey,ctx->c.des_ks);
+                des_set_key_unchecked(deskey,ctx->c.des_ks);
         }
 
 static void des_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libcrypto/evp/e_ofb_3d.c b/src/lib/libcrypto/evp/e_ofb_3d.c
index 5233567c0c..d1a33e2ecd 100644
--- a/src/lib/libcrypto/evp/e_ofb_3d.c
+++ b/src/lib/libcrypto/evp/e_ofb_3d.c
@@ -116,8 +116,8 @@ static void des_ede_ofb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
                 memcpy( (char *)ctx->c.des_ede.ks3,
                         (char *)ctx->c.des_ede.ks1,
                         sizeof(ctx->c.des_ede.ks1));
@@ -136,9 +136,9 @@ static void des_ede3_ofb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
-                des_set_key(&deskey[2],ctx->c.des_ede.ks3);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[2],ctx->c.des_ede.ks3);
                 }
         }
 
diff --git a/src/lib/libcrypto/evp/e_ofb_d.c b/src/lib/libcrypto/evp/e_ofb_d.c
index 398b3a002e..d51ce230f4 100644
--- a/src/lib/libcrypto/evp/e_ofb_d.c
+++ b/src/lib/libcrypto/evp/e_ofb_d.c
@@ -95,7 +95,7 @@ static void des_ofb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
                 memcpy(&(ctx->oiv[0]),iv,8);
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
-                des_set_key(deskey,ctx->c.des_ks);
+                des_set_key_unchecked(deskey,ctx->c.des_ks);
         }
 
 static void des_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libcrypto/evp/e_xcbc_d.c b/src/lib/libcrypto/evp/e_xcbc_d.c
index 3a6628a75c..7568fad4ff 100644
--- a/src/lib/libcrypto/evp/e_xcbc_d.c
+++ b/src/lib/libcrypto/evp/e_xcbc_d.c
@@ -94,7 +94,7 @@ static void desx_cbc_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(deskey,ctx->c.desx_cbc.ks);
+                des_set_key_unchecked(deskey,ctx->c.desx_cbc.ks);
                 memcpy(&(ctx->c.desx_cbc.inw[0]),&(key[8]),8);
                 memcpy(&(ctx->c.desx_cbc.outw[0]),&(key[16]),8);
                 }
diff --git a/src/lib/libcrypto/evp/encode.c b/src/lib/libcrypto/evp/encode.c
index 0152624a76..14a4cb11f6 100644
--- a/src/lib/libcrypto/evp/encode.c
+++ b/src/lib/libcrypto/evp/encode.c
@@ -185,7 +185,7 @@ void EVP_EncodeFinal(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl)
         *outl=ret;
         }
 
-int EVP_EncodeBlock(unsigned char *t, unsigned char *f, int dlen)
+int EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int dlen)
         {
         int i,ret=0;
         unsigned long l;
@@ -337,7 +337,7 @@ end:
         return(rv);
         }
 
-int EVP_DecodeBlock(unsigned char *t, unsigned char *f, int n)
+int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
         {
         int i,ret=0,a,b,c,d;
         unsigned long l;
diff --git a/src/lib/libcrypto/evp/evp.h b/src/lib/libcrypto/evp/evp.h
index 570fe27d39..54215b0905 100644
--- a/src/lib/libcrypto/evp/evp.h
+++ b/src/lib/libcrypto/evp/evp.h
@@ -149,7 +149,7 @@ extern "C" {
 
 /* Type needs to be a bit field
  * Sub-type needs to be for variations on the method, as in, can it do
- * arbitary encryption.... */
+ * arbitrary encryption.... */
 typedef struct evp_pkey_st
         {
         int type;
@@ -343,7 +343,7 @@ typedef struct evp_cipher_ctx_st
         unsigned char buf[EVP_MAX_IV_LENGTH];   /* saved partial block */
         int num;                                /* used by cfb/ofb mode */
 
-        char *app_data;         /* aplication stuff */
+        char *app_data;         /* application stuff */
         union   {
 #ifndef NO_RC4
                 struct
@@ -421,9 +421,10 @@ typedef int (EVP_PBE_KEYGEN)(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
 #define EVP_MD_size(e)                  ((e)->md_size)
 #define EVP_MD_block_size(e)            ((e)->block_size)
 
+#define EVP_MD_CTX_md(e)                ((e)->digest)
 #define EVP_MD_CTX_size(e)              EVP_MD_size((e)->digest)
 #define EVP_MD_CTX_block_size(e)        EVP_MD_block_size((e)->digest)
-#define EVP_MD_CTX_type(e)              ((e)->digest)
+#define EVP_MD_CTX_type(e)              EVP_MD_type((e)->digest)
 
 #define EVP_CIPHER_nid(e)               ((e)->nid)
 #define EVP_CIPHER_block_size(e)        ((e)->block_size)
@@ -521,15 +522,14 @@ void	EVP_EncodeInit(EVP_ENCODE_CTX *ctx);
 void    EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx,unsigned char *out,
                 int *outl,unsigned char *in,int inl);
 void    EVP_EncodeFinal(EVP_ENCODE_CTX *ctx,unsigned char *out,int *outl);
-int     EVP_EncodeBlock(unsigned char *t, unsigned char *f, int n);
+int     EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int n);
 
 void    EVP_DecodeInit(EVP_ENCODE_CTX *ctx);
 int     EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx,unsigned char *out,int *outl,
                 unsigned char *in, int inl);
 int     EVP_DecodeFinal(EVP_ENCODE_CTX *ctx, unsigned
                 char *out, int *outl);
-int     EVP_DecodeBlock(unsigned char *t, unsigned
-                char *f, int n);
+int     EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n);
 
 void    ERR_load_EVP_strings(void );
 
@@ -594,9 +594,12 @@ EVP_CIPHER *EVP_rc5_32_12_16_ecb(void);
 EVP_CIPHER *EVP_rc5_32_12_16_cfb(void);
 EVP_CIPHER *EVP_rc5_32_12_16_ofb(void);
 
-void SSLeay_add_all_algorithms(void);
-void SSLeay_add_all_ciphers(void);
-void SSLeay_add_all_digests(void);
+void OpenSSL_add_all_algorithms(void);
+void OpenSSL_add_all_ciphers(void);
+void OpenSSL_add_all_digests(void);
+#define SSLeay_add_all_algorithms() OpenSSL_add_all_algorithms()
+#define SSLeay_add_all_ciphers() OpenSSL_add_all_ciphers()
+#define SSLeay_add_all_digests() OpenSSL_add_all_digests()
 
 int EVP_add_cipher(EVP_CIPHER *cipher);
 int EVP_add_digest(EVP_MD *digest);
@@ -613,6 +616,18 @@ int		EVP_PKEY_type(int type);
 int             EVP_PKEY_bits(EVP_PKEY *pkey);
 int             EVP_PKEY_size(EVP_PKEY *pkey);
 int             EVP_PKEY_assign(EVP_PKEY *pkey,int type,char *key);
+#ifndef NO_RSA
+int             EVP_PKEY_set1_RSA(EVP_PKEY *pkey,RSA *key);
+RSA *           EVP_PKEY_get1_RSA(EVP_PKEY *pkey);
+#endif
+#ifndef NO_DSA
+int             EVP_PKEY_set1_DSA(EVP_PKEY *pkey,DSA *key);
+DSA *           EVP_PKEY_get1_DSA(EVP_PKEY *pkey);
+#endif
+#ifndef NO_DH
+int             EVP_PKEY_set1_DH(EVP_PKEY *pkey,DH *key);
+DH *            EVP_PKEY_get1_DH(EVP_PKEY *pkey);
+#endif
 EVP_PKEY *      EVP_PKEY_new(void);
 void            EVP_PKEY_free(EVP_PKEY *pkey);
 EVP_PKEY *      d2i_PublicKey(int type,EVP_PKEY **a, unsigned char **pp,
@@ -621,6 +636,8 @@ int		i2d_PublicKey(EVP_PKEY *a, unsigned char **pp);
 
 EVP_PKEY *      d2i_PrivateKey(int type,EVP_PKEY **a, unsigned char **pp,
                         long length);
+EVP_PKEY *      d2i_AutoPrivateKey(EVP_PKEY **a, unsigned char **pp,
+                        long length);
 int             i2d_PrivateKey(EVP_PKEY *a, unsigned char **pp);
 
 int EVP_PKEY_copy_parameters(EVP_PKEY *to,EVP_PKEY *from);
@@ -677,6 +694,9 @@ void EVP_PBE_cleanup(void);
 #define EVP_F_EVP_PKEY_COPY_PARAMETERS                   103
 #define EVP_F_EVP_PKEY_DECRYPT                           104
 #define EVP_F_EVP_PKEY_ENCRYPT                           105
+#define EVP_F_EVP_PKEY_GET1_DH                           119
+#define EVP_F_EVP_PKEY_GET1_DSA                          120
+#define EVP_F_EVP_PKEY_GET1_RSA                          121
 #define EVP_F_EVP_PKEY_NEW                               106
 #define EVP_F_EVP_SIGNFINAL                              107
 #define EVP_F_EVP_VERIFYFINAL                            108
@@ -693,10 +713,13 @@ void EVP_PBE_cleanup(void);
 #define EVP_R_DIFFERENT_KEY_TYPES                        101
 #define EVP_R_ENCODE_ERROR                               115
 #define EVP_R_EVP_PBE_CIPHERINIT_ERROR                   119
+#define EVP_R_EXPECTING_AN_RSA_KEY                       127
+#define EVP_R_EXPECTING_A_DH_KEY                         128
+#define EVP_R_EXPECTING_A_DSA_KEY                        129
 #define EVP_R_INPUT_NOT_INITIALIZED                      111
 #define EVP_R_IV_TOO_LARGE                               102
 #define EVP_R_KEYGEN_FAILURE                             120
-#define EVP_R_MISSING_PARMATERS                          103
+#define EVP_R_MISSING_PARAMETERS                         103
 #define EVP_R_NO_DSA_PARAMETERS                          116
 #define EVP_R_NO_SIGN_FUNCTION_CONFIGURED                104
 #define EVP_R_NO_VERIFY_FUNCTION_CONFIGURED              105
diff --git a/src/lib/libcrypto/evp/evp_err.c b/src/lib/libcrypto/evp/evp_err.c
index c61cc922e8..97953a0fc1 100644
--- a/src/lib/libcrypto/evp/evp_err.c
+++ b/src/lib/libcrypto/evp/evp_err.c
@@ -77,6 +77,9 @@ static ERR_STRING_DATA EVP_str_functs[]=
 {ERR_PACK(0,EVP_F_EVP_PKEY_COPY_PARAMETERS,0),  "EVP_PKEY_copy_parameters"},
 {ERR_PACK(0,EVP_F_EVP_PKEY_DECRYPT,0),  "EVP_PKEY_decrypt"},
 {ERR_PACK(0,EVP_F_EVP_PKEY_ENCRYPT,0),  "EVP_PKEY_encrypt"},
+{ERR_PACK(0,EVP_F_EVP_PKEY_GET1_DH,0),  "EVP_PKEY_get1_DH"},
+{ERR_PACK(0,EVP_F_EVP_PKEY_GET1_DSA,0), "EVP_PKEY_get1_DSA"},
+{ERR_PACK(0,EVP_F_EVP_PKEY_GET1_RSA,0), "EVP_PKEY_get1_RSA"},
 {ERR_PACK(0,EVP_F_EVP_PKEY_NEW,0),      "EVP_PKEY_new"},
 {ERR_PACK(0,EVP_F_EVP_SIGNFINAL,0),     "EVP_SignFinal"},
 {ERR_PACK(0,EVP_F_EVP_VERIFYFINAL,0),   "EVP_VerifyFinal"},
@@ -96,10 +99,13 @@ static ERR_STRING_DATA EVP_str_reasons[]=
 {EVP_R_DIFFERENT_KEY_TYPES               ,"different key types"},
 {EVP_R_ENCODE_ERROR                      ,"encode error"},
 {EVP_R_EVP_PBE_CIPHERINIT_ERROR          ,"evp pbe cipherinit error"},
+{EVP_R_EXPECTING_AN_RSA_KEY              ,"expecting an rsa key"},
+{EVP_R_EXPECTING_A_DH_KEY                ,"expecting a dh key"},
+{EVP_R_EXPECTING_A_DSA_KEY               ,"expecting a dsa key"},
 {EVP_R_INPUT_NOT_INITIALIZED             ,"input not initialized"},
 {EVP_R_IV_TOO_LARGE                      ,"iv too large"},
 {EVP_R_KEYGEN_FAILURE                    ,"keygen failure"},
-{EVP_R_MISSING_PARMATERS                 ,"missing parmaters"},
+{EVP_R_MISSING_PARAMETERS                ,"missing parameters"},
 {EVP_R_NO_DSA_PARAMETERS                 ,"no dsa parameters"},
 {EVP_R_NO_SIGN_FUNCTION_CONFIGURED       ,"no sign function configured"},
 {EVP_R_NO_VERIFY_FUNCTION_CONFIGURED     ,"no verify function configured"},
diff --git a/src/lib/libcrypto/evp/evp_key.c b/src/lib/libcrypto/evp/evp_key.c
index 21eda418bc..667c21cca8 100644
--- a/src/lib/libcrypto/evp/evp_key.c
+++ b/src/lib/libcrypto/evp/evp_key.c
@@ -81,15 +81,18 @@ char *EVP_get_pw_prompt(void)
                 return(prompt_string);
         }
 
-#ifdef NO_DES
-int des_read_pw_string(char *buf,int len,const char *prompt,int verify);
-#endif
-
+/* For historical reasons, the standard function for reading passwords is
+ * in the DES library -- if someone ever wants to disable DES,
+ * this function will fail */
 int EVP_read_pw_string(char *buf, int len, const char *prompt, int verify)
         {
+#ifndef NO_DES
         if ((prompt == NULL) && (prompt_string[0] != '\0'))
                 prompt=prompt_string;
         return(des_read_pw_string(buf,len,prompt,verify));
+#else
+        return -1;
+#endif
         }
 
 int EVP_BytesToKey(const EVP_CIPHER *type, EVP_MD *md, unsigned char *salt,
diff --git a/src/lib/libcrypto/evp/evp_lib.c b/src/lib/libcrypto/evp/evp_lib.c
index 3f9bf55828..a431945ef5 100644
--- a/src/lib/libcrypto/evp/evp_lib.c
+++ b/src/lib/libcrypto/evp/evp_lib.c
@@ -115,6 +115,7 @@ int EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
 int EVP_CIPHER_type(const EVP_CIPHER *ctx)
 {
         int nid;
+        ASN1_OBJECT *otmp;
         nid = EVP_CIPHER_nid(ctx);
 
         switch(nid) {
@@ -131,7 +132,10 @@ int EVP_CIPHER_type(const EVP_CIPHER *ctx)
                 return NID_rc4;
 
                 default:
-
+                /* Check it has an OID and it is valid */
+                otmp = OBJ_nid2obj(nid);
+                if(!otmp || !otmp->data) nid = NID_undef;
+                ASN1_OBJECT_free(otmp);
                 return nid;
         }
 }
diff --git a/src/lib/libcrypto/evp/evp_pkey.c b/src/lib/libcrypto/evp/evp_pkey.c
index 421e452db1..d5e6f5880f 100644
--- a/src/lib/libcrypto/evp/evp_pkey.c
+++ b/src/lib/libcrypto/evp/evp_pkey.c
@@ -62,19 +62,22 @@
 #include <openssl/x509.h>
 #include <openssl/rand.h>
 
+static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8inf, EVP_PKEY *pkey);
+
 /* Extract a private key from a PKCS8 structure */
 
 EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
 {
-        EVP_PKEY *pkey;
+        EVP_PKEY *pkey = NULL;
 #ifndef NO_RSA
-        RSA *rsa;
+        RSA *rsa = NULL;
 #endif
 #ifndef NO_DSA
-        DSA *dsa;
-        ASN1_INTEGER *dsapriv;
-        STACK *ndsa;
-        BN_CTX *ctx;
+        DSA *dsa = NULL;
+        ASN1_INTEGER *privkey;
+        ASN1_TYPE *t1, *t2, *param = NULL;
+        STACK *ndsa = NULL;
+        BN_CTX *ctx = NULL;
         int plen;
 #endif
         X509_ALGOR *a;
@@ -82,21 +85,14 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
         int pkeylen;
         char obj_tmp[80];
 
-        switch (p8->broken) {
-                case PKCS8_OK:
+        if(p8->pkey->type == V_ASN1_OCTET_STRING) {
+                p8->broken = PKCS8_OK;
                 p = p8->pkey->value.octet_string->data;
                 pkeylen = p8->pkey->value.octet_string->length;
-                break;
-
-                case PKCS8_NO_OCTET:
+        } else {
+                p8->broken = PKCS8_NO_OCTET;
                 p = p8->pkey->value.sequence->data;
                 pkeylen = p8->pkey->value.sequence->length;
-                break;
-
-                default:
-                EVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE);
-                return NULL;
-                break;
         }
         if (!(pkey = EVP_PKEY_new())) {
                 EVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);
@@ -121,65 +117,83 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
                  * be recalculated.
                  */
         
-                /* Check for broken Netscape Database DSA PKCS#8, UGH! */
+                /* Check for broken DSA PKCS#8, UGH! */
                 if(*p == (V_ASN1_SEQUENCE|V_ASN1_CONSTRUCTED)) {
                     if(!(ndsa = ASN1_seq_unpack(p, pkeylen, 
-                                        (char *(*)())d2i_ASN1_INTEGER,
-                                                         ASN1_STRING_free))) {
+                                        (char *(*)())d2i_ASN1_TYPE,
+                                                         ASN1_TYPE_free))) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
-                        return NULL;
+                        goto dsaerr;
                     }
                     if(sk_num(ndsa) != 2 ) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
-                        sk_pop_free(ndsa, ASN1_STRING_free);
-                        return NULL;
+                        goto dsaerr;
                     }
-                    dsapriv = (ASN1_INTEGER *) sk_pop(ndsa);
-                    sk_pop_free(ndsa, ASN1_STRING_free);
-                } else if (!(dsapriv=d2i_ASN1_INTEGER (NULL, &p, pkeylen))) {
+                    /* Handle Two broken types:
+                     * SEQUENCE {parameters, priv_key}
+                     * SEQUENCE {pub_key, priv_key}
+                     */
+                     
+                    t1 = (ASN1_TYPE *)sk_value(ndsa, 0);
+                    t2 = (ASN1_TYPE *)sk_value(ndsa, 1);
+                    if(t1->type == V_ASN1_SEQUENCE) {
+                        p8->broken = PKCS8_EMBEDDED_PARAM;
+                        param = t1;
+                    } else if(a->parameter->type == V_ASN1_SEQUENCE) {
+                        p8->broken = PKCS8_NS_DB;
+                        param = a->parameter;
+                    } else {
                         EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
-                        return NULL;
-                }
-                /* Retrieve parameters */
-                if (a->parameter->type != V_ASN1_SEQUENCE) {
-                        EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_NO_DSA_PARAMETERS);
-                        return NULL;
+                        goto dsaerr;
+                    }
+
+                    if(t2->type != V_ASN1_INTEGER) {
+                        EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
+                        goto dsaerr;
+                    }
+                    privkey = t2->value.integer;
+                } else if (!(privkey=d2i_ASN1_INTEGER (NULL, &p, pkeylen))) {
+                        EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
+                        goto dsaerr;
                 }
-                p = a->parameter->value.sequence->data;
-                plen = a->parameter->value.sequence->length;
+                p = param->value.sequence->data;
+                plen = param->value.sequence->length;
                 if (!(dsa = d2i_DSAparams (NULL, &p, plen))) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
-                        return NULL;
+                        goto dsaerr;
                 }
                 /* We have parameters now set private key */
-                if (!(dsa->priv_key = ASN1_INTEGER_to_BN(dsapriv, NULL))) {
+                if (!(dsa->priv_key = ASN1_INTEGER_to_BN(privkey, NULL))) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_BN_DECODE_ERROR);
-                        DSA_free (dsa);
-                        return NULL;
+                        goto dsaerr;
                 }
                 /* Calculate public key (ouch!) */
                 if (!(dsa->pub_key = BN_new())) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);
-                        DSA_free (dsa);
-                        return NULL;
+                        goto dsaerr;
                 }
                 if (!(ctx = BN_CTX_new())) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);
-                        DSA_free (dsa);
-                        return NULL;
+                        goto dsaerr;
                 }
                         
                 if (!BN_mod_exp(dsa->pub_key, dsa->g,
                                                  dsa->priv_key, dsa->p, ctx)) {
                         
                         EVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_BN_PUBKEY_ERROR);
-                        BN_CTX_free (ctx);
-                        DSA_free (dsa);
-                        return NULL;
+                        goto dsaerr;
                 }
 
-                EVP_PKEY_assign_DSA (pkey, dsa);
+                EVP_PKEY_assign_DSA(pkey, dsa);
                 BN_CTX_free (ctx);
+                sk_pop_free(ndsa, ASN1_TYPE_free);
+                break;
+                dsaerr:
+                BN_CTX_free (ctx);
+                sk_pop_free(ndsa, ASN1_TYPE_free);
+                DSA_free(dsa);
+                EVP_PKEY_free(pkey);
+                return NULL;
                 break;
 #endif
                 default:
@@ -193,30 +207,35 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
         return pkey;
 }
 
+PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)
+{
+        return EVP_PKEY2PKCS8_broken(pkey, PKCS8_OK);
+}
+
 /* Turn a private key into a PKCS8 structure */
 
-PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)
+PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken)
 {
         PKCS8_PRIV_KEY_INFO *p8;
-#ifndef NO_DSA
-        ASN1_INTEGER *dpkey;
-        unsigned char *p, *q;
-        int len;
-#endif
+
         if (!(p8 = PKCS8_PRIV_KEY_INFO_new())) {        
                 EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
+        p8->broken = broken;
         ASN1_INTEGER_set (p8->version, 0);
         if (!(p8->pkeyalg->parameter = ASN1_TYPE_new ())) {
                 EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                 PKCS8_PRIV_KEY_INFO_free (p8);
                 return NULL;
         }
+        p8->pkey->type = V_ASN1_OCTET_STRING;
         switch (EVP_PKEY_type(pkey->type)) {
 #ifndef NO_RSA
                 case EVP_PKEY_RSA:
 
+                if(p8->broken == PKCS8_NO_OCTET) p8->pkey->type = V_ASN1_SEQUENCE;
+
                 p8->pkeyalg->algorithm = OBJ_nid2obj(NID_rsaEncryption);
                 p8->pkeyalg->parameter->type = V_ASN1_NULL;
                 if (!ASN1_pack_string ((char *)pkey, i2d_PrivateKey,
@@ -229,36 +248,11 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)
 #endif
 #ifndef NO_DSA
                 case EVP_PKEY_DSA:
-                p8->pkeyalg->algorithm = OBJ_nid2obj(NID_dsa);
-
-                /* get paramaters and place in AlgorithmIdentifier */
-                len = i2d_DSAparams (pkey->pkey.dsa, NULL);
-                if (!(p = Malloc(len))) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                if(!dsa_pkey2pkcs8(p8, pkey)) {
                         PKCS8_PRIV_KEY_INFO_free (p8);
                         return NULL;
                 }
-                q = p;
-                i2d_DSAparams (pkey->pkey.dsa, &q);
-                p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
-                p8->pkeyalg->parameter->value.sequence = ASN1_STRING_new();
-                ASN1_STRING_set(p8->pkeyalg->parameter->value.sequence, p, len);
-                Free(p);
-                /* Get private key into an integer and pack */
-                if (!(dpkey = BN_to_ASN1_INTEGER (pkey->pkey.dsa->priv_key, NULL))) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
-                        PKCS8_PRIV_KEY_INFO_free (p8);
-                        return NULL;
-                }
-                
-                if (!ASN1_pack_string((char *)dpkey, i2d_ASN1_INTEGER,
-                                         &p8->pkey->value.octet_string)) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
-                        ASN1_INTEGER_free (dpkey);
-                        PKCS8_PRIV_KEY_INFO_free (p8);
-                        return NULL;
-                }
-                ASN1_INTEGER_free (dpkey);
+
                 break;
 #endif
                 default:
@@ -266,9 +260,8 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)
                 PKCS8_PRIV_KEY_INFO_free (p8);
                 return NULL;
         }
-        p8->pkey->type = V_ASN1_OCTET_STRING;
-        RAND_seed (p8->pkey->value.octet_string->data,
-                                         p8->pkey->value.octet_string->length);
+        RAND_add(p8->pkey->value.octet_string->data,
+                 p8->pkey->value.octet_string->length, 0);
         return p8;
 }
 
@@ -295,4 +288,112 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken)
         }
 }
 
+#ifndef NO_DSA
+static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
+{
+        ASN1_STRING *params;
+        ASN1_INTEGER *prkey;
+        ASN1_TYPE *ttmp;
+        STACK *ndsa;
+        unsigned char *p, *q;
+        int len;
+        p8->pkeyalg->algorithm = OBJ_nid2obj(NID_dsa);
+        len = i2d_DSAparams (pkey->pkey.dsa, NULL);
+        if (!(p = Malloc(len))) {
+                EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                PKCS8_PRIV_KEY_INFO_free (p8);
+                return 0;
+        }
+        q = p;
+        i2d_DSAparams (pkey->pkey.dsa, &q);
+        params = ASN1_STRING_new();
+        ASN1_STRING_set(params, p, len);
+        Free(p);
+        /* Get private key into integer */
+        if (!(prkey = BN_to_ASN1_INTEGER (pkey->pkey.dsa->priv_key, NULL))) {
+                EVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
+                return 0;
+        }
+
+        switch(p8->broken) {
 
+                case PKCS8_OK:
+                case PKCS8_NO_OCTET:
+
+                if (!ASN1_pack_string((char *)prkey, i2d_ASN1_INTEGER,
+                                         &p8->pkey->value.octet_string)) {
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        M_ASN1_INTEGER_free (prkey);
+                        return 0;
+                }
+
+                M_ASN1_INTEGER_free (prkey);
+                p8->pkeyalg->parameter->value.sequence = params;
+                p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
+
+                break;
+
+                case PKCS8_NS_DB:
+
+                p8->pkeyalg->parameter->value.sequence = params;
+                p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
+                ndsa = sk_new_null();
+                ttmp = ASN1_TYPE_new();
+                if (!(ttmp->value.integer = BN_to_ASN1_INTEGER (pkey->pkey.dsa->pub_key, NULL))) {
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
+                        PKCS8_PRIV_KEY_INFO_free(p8);
+                        return 0;
+                }
+                ttmp->type = V_ASN1_INTEGER;
+                sk_push(ndsa, (char *)ttmp);
+
+                ttmp = ASN1_TYPE_new();
+                ttmp->value.integer = prkey;
+                ttmp->type = V_ASN1_INTEGER;
+                sk_push(ndsa, (char *)ttmp);
+
+                p8->pkey->value.octet_string = ASN1_OCTET_STRING_new();
+
+                if (!ASN1_seq_pack(ndsa, i2d_ASN1_TYPE,
+                                         &p8->pkey->value.octet_string->data,
+                                         &p8->pkey->value.octet_string->length)) {
+
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        sk_pop_free(ndsa, ASN1_TYPE_free);
+                        M_ASN1_INTEGER_free(prkey);
+                        return 0;
+                }
+                sk_pop_free(ndsa, ASN1_TYPE_free);
+                break;
+
+                case PKCS8_EMBEDDED_PARAM:
+
+                p8->pkeyalg->parameter->type = V_ASN1_NULL;
+                ndsa = sk_new_null();
+                ttmp = ASN1_TYPE_new();
+                ttmp->value.sequence = params;
+                ttmp->type = V_ASN1_SEQUENCE;
+                sk_push(ndsa, (char *)ttmp);
+
+                ttmp = ASN1_TYPE_new();
+                ttmp->value.integer = prkey;
+                ttmp->type = V_ASN1_INTEGER;
+                sk_push(ndsa, (char *)ttmp);
+
+                p8->pkey->value.octet_string = ASN1_OCTET_STRING_new();
+
+                if (!ASN1_seq_pack(ndsa, i2d_ASN1_TYPE,
+                                         &p8->pkey->value.octet_string->data,
+                                         &p8->pkey->value.octet_string->length)) {
+
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        sk_pop_free(ndsa, ASN1_TYPE_free);
+                        M_ASN1_INTEGER_free (prkey);
+                        return 0;
+                }
+                sk_pop_free(ndsa, ASN1_TYPE_free);
+                break;
+        }
+        return 1;
+}
+#endif
diff --git a/src/lib/libcrypto/evp/p_lib.c b/src/lib/libcrypto/evp/p_lib.c
index 3422b77de6..4cb387f8de 100644
--- a/src/lib/libcrypto/evp/p_lib.c
+++ b/src/lib/libcrypto/evp/p_lib.c
@@ -119,7 +119,7 @@ int EVP_PKEY_copy_parameters(EVP_PKEY *to, EVP_PKEY *from)
 
         if (EVP_PKEY_missing_parameters(from))
                 {
-                EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS,EVP_R_MISSING_PARMATERS);
+                EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS,EVP_R_MISSING_PARAMETERS);
                 goto err;
                 }
 #ifndef NO_DSA
@@ -202,8 +202,66 @@ int EVP_PKEY_assign(EVP_PKEY *pkey, int type, char *key)
         pkey->type=EVP_PKEY_type(type);
         pkey->save_type=type;
         pkey->pkey.ptr=key;
-        return(1);
+        return(key != NULL);
+        }
+
+#ifndef NO_RSA
+int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key)
+{
+        int ret = EVP_PKEY_assign_RSA(pkey, key);
+        if(ret) CRYPTO_add(&key->references, 1, CRYPTO_LOCK_RSA);
+        return ret;
+}
+
+RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey)
+        {
+        if(pkey->type != EVP_PKEY_RSA) {
+                EVPerr(EVP_F_EVP_PKEY_GET1_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
+                return NULL;
+        }
+        CRYPTO_add(&pkey->pkey.rsa->references, 1, CRYPTO_LOCK_RSA);
+        return pkey->pkey.rsa;
+}
+#endif
+
+#ifndef NO_DSA
+int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key)
+{
+        int ret = EVP_PKEY_assign_DSA(pkey, key);
+        if(ret) CRYPTO_add(&key->references, 1, CRYPTO_LOCK_DSA);
+        return ret;
+}
+
+DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey)
+        {
+        if(pkey->type != EVP_PKEY_DSA) {
+                EVPerr(EVP_F_EVP_PKEY_GET1_DSA, EVP_R_EXPECTING_A_DSA_KEY);
+                return NULL;
+        }
+        CRYPTO_add(&pkey->pkey.dsa->references, 1, CRYPTO_LOCK_DSA);
+        return pkey->pkey.dsa;
+}
+#endif
+
+#ifndef NO_DH
+
+int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key)
+{
+        int ret = EVP_PKEY_assign_DH(pkey, key);
+        if(ret) CRYPTO_add(&key->references, 1, CRYPTO_LOCK_DH);
+        return ret;
+}
+
+DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey)
+        {
+        if(pkey->type != EVP_PKEY_DH) {
+                EVPerr(EVP_F_EVP_PKEY_GET1_DH, EVP_R_EXPECTING_A_DH_KEY);
+                return NULL;
         }
+        CRYPTO_add(&pkey->pkey.dh->references, 1, CRYPTO_LOCK_DH);
+        return pkey->pkey.dh;
+}
+#endif
 
 int EVP_PKEY_type(int type)
         {
@@ -244,7 +302,7 @@ void EVP_PKEY_free(EVP_PKEY *x)
                 }
 #endif
         EVP_PKEY_free_it(x);
-        Free((char *)x);
+        Free(x);
         }
 
 static void EVP_PKEY_free_it(EVP_PKEY *x)
diff --git a/src/lib/libcrypto/evp/p_open.c b/src/lib/libcrypto/evp/p_open.c
index ddb9fd6942..b9ca7892c2 100644
--- a/src/lib/libcrypto/evp/p_open.c
+++ b/src/lib/libcrypto/evp/p_open.c
@@ -110,4 +110,10 @@ int EVP_OpenFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         EVP_DecryptInit(ctx,NULL,NULL,NULL);
         return(i);
         }
+#else /* !NO_RSA */
+
+# ifdef PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libcrypto/evp/p_seal.c b/src/lib/libcrypto/evp/p_seal.c
index 09b46f4b0e..d449e892bf 100644
--- a/src/lib/libcrypto/evp/p_seal.c
+++ b/src/lib/libcrypto/evp/p_seal.c
@@ -73,9 +73,10 @@ int EVP_SealInit(EVP_CIPHER_CTX *ctx, EVP_CIPHER *type, unsigned char **ek,
         int i;
         
         if (npubk <= 0) return(0);
-        RAND_bytes(key,EVP_MAX_KEY_LENGTH);
+        if (RAND_bytes(key,EVP_MAX_KEY_LENGTH) <= 0)
+                return(0);
         if (type->iv_len > 0)
-                RAND_bytes(iv,type->iv_len);
+                RAND_pseudo_bytes(iv,type->iv_len);
 
         EVP_CIPHER_CTX_init(ctx);
         EVP_EncryptInit(ctx,type,key,iv);
diff --git a/src/lib/libcrypto/ex_data.c b/src/lib/libcrypto/ex_data.c
index 176574766b..a057dd3b68 100644
--- a/src/lib/libcrypto/ex_data.c
+++ b/src/lib/libcrypto/ex_data.c
@@ -63,15 +63,15 @@
 #include <openssl/lhash.h>
 #include "cryptlib.h"
 
-int CRYPTO_get_ex_new_index(int idx, STACK **skp, long argl, char *argp,
-             int (*new_func)(), int (*dup_func)(), void (*free_func)())
+int CRYPTO_get_ex_new_index(int idx, STACK_OF(CRYPTO_EX_DATA_FUNCS) **skp, long argl, void *argp,
+             CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         int ret= -1;
         CRYPTO_EX_DATA_FUNCS *a;
 
         MemCheck_off();
         if (*skp == NULL)
-                *skp=sk_new_null();
+                *skp=sk_CRYPTO_EX_DATA_FUNCS_new_null();
         if (*skp == NULL)
                 {
                 CRYPTOerr(CRYPTO_F_CRYPTO_GET_EX_NEW_INDEX,ERR_R_MALLOC_FAILURE);
@@ -88,23 +88,23 @@ int CRYPTO_get_ex_new_index(int idx, STACK **skp, long argl, char *argp,
         a->new_func=new_func;
         a->dup_func=dup_func;
         a->free_func=free_func;
-        while (sk_num(*skp) <= idx)
+        while (sk_CRYPTO_EX_DATA_FUNCS_num(*skp) <= idx)
                 {
-                if (!sk_push(*skp,NULL))
+                if (!sk_CRYPTO_EX_DATA_FUNCS_push(*skp,NULL))
                         {
                         CRYPTOerr(CRYPTO_F_CRYPTO_GET_EX_NEW_INDEX,ERR_R_MALLOC_FAILURE);
                         Free(a);
                         goto err;
                         }
                 }
-        sk_set(*skp,idx, (char *)a);
+        sk_CRYPTO_EX_DATA_FUNCS_set(*skp,idx, a);
         ret=idx;
 err:
         MemCheck_on();
         return(idx);
         }
 
-int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, char *val)
+int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val)
         {
         int i;
 
@@ -131,7 +131,7 @@ int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, char *val)
         return(1);
         }
 
-char *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad, int idx)
+void *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad, int idx)
         {
         if (ad->sk == NULL)
                 return(0);
@@ -145,7 +145,7 @@ char *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad, int idx)
  * being duplicated, a pointer to the
  * 'new' object to be inserted, the index, and the argi/argp
  */
-int CRYPTO_dup_ex_data(STACK *meth, CRYPTO_EX_DATA *to,
+int CRYPTO_dup_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, CRYPTO_EX_DATA *to,
              CRYPTO_EX_DATA *from)
         {
         int i,j,m,r;
@@ -154,14 +154,14 @@ int CRYPTO_dup_ex_data(STACK *meth, CRYPTO_EX_DATA *to,
 
         if (meth == NULL) return(1);
         if (from->sk == NULL) return(1);
-        m=sk_num(meth);
+        m=sk_CRYPTO_EX_DATA_FUNCS_num(meth);
         j=sk_num(from->sk);
         for (i=0; i<j; i++)
                 {
                 from_d=CRYPTO_get_ex_data(from,i);
                 if (i < m)
                         {
-                        mm=(CRYPTO_EX_DATA_FUNCS *)sk_value(meth,i);
+                        mm=sk_CRYPTO_EX_DATA_FUNCS_value(meth,i);
                         if (mm->dup_func != NULL)
                                 r=mm->dup_func(to,from,(char **)&from_d,i,
                                         mm->argl,mm->argp);
@@ -172,18 +172,18 @@ int CRYPTO_dup_ex_data(STACK *meth, CRYPTO_EX_DATA *to,
         }
 
 /* Call each free callback */
-void CRYPTO_free_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad)
+void CRYPTO_free_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, void *obj, CRYPTO_EX_DATA *ad)
         {
         CRYPTO_EX_DATA_FUNCS *m;
-        char *ptr;
+        void *ptr;
         int i,max;
 
         if (meth != NULL)
                 {
-                max=sk_num(meth);
+                max=sk_CRYPTO_EX_DATA_FUNCS_num(meth);
                 for (i=0; i<max; i++)
                         {
-                        m=(CRYPTO_EX_DATA_FUNCS *)sk_value(meth,i);
+                        m=sk_CRYPTO_EX_DATA_FUNCS_value(meth,i);
                         if ((m != NULL) && (m->free_func != NULL))
                                 {
                                 ptr=CRYPTO_get_ex_data(ad,i);
@@ -198,19 +198,19 @@ void CRYPTO_free_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad)
                 }
         }
 
-void CRYPTO_new_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad)
+void CRYPTO_new_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, void *obj, CRYPTO_EX_DATA *ad)
         {
         CRYPTO_EX_DATA_FUNCS *m;
-        char *ptr;
+        void *ptr;
         int i,max;
 
         ad->sk=NULL;
         if (meth != NULL)
                 {
-                max=sk_num(meth);
+                max=sk_CRYPTO_EX_DATA_FUNCS_num(meth);
                 for (i=0; i<max; i++)
                         {
-                        m=(CRYPTO_EX_DATA_FUNCS *)sk_value(meth,i);
+                        m=sk_CRYPTO_EX_DATA_FUNCS_value(meth,i);
                         if ((m != NULL) && (m->new_func != NULL))
                                 {
                                 ptr=CRYPTO_get_ex_data(ad,i);
@@ -220,4 +220,4 @@ void CRYPTO_new_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad)
                 }
         }
 
-
+IMPLEMENT_STACK_OF(CRYPTO_EX_DATA_FUNCS)
diff --git a/src/lib/libcrypto/hmac/hmac.c b/src/lib/libcrypto/hmac/hmac.c
index 5c349bbb56..23b7c98f8f 100644
--- a/src/lib/libcrypto/hmac/hmac.c
+++ b/src/lib/libcrypto/hmac/hmac.c
@@ -109,7 +109,7 @@ void HMAC_Init(HMAC_CTX *ctx, const void *key, int len,
         memcpy(&ctx->md_ctx,&ctx->i_ctx,sizeof(ctx->i_ctx));
         }
 
-void HMAC_Update(HMAC_CTX *ctx, unsigned char *data, int len)
+void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, int len)
         {
         EVP_DigestUpdate(&(ctx->md_ctx),data,len);
         }
@@ -134,7 +134,7 @@ void HMAC_cleanup(HMAC_CTX *ctx)
         }
 
 unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
-                    unsigned char *d, int n, unsigned char *md,
+                    const unsigned char *d, int n, unsigned char *md,
                     unsigned int *md_len)
         {
         HMAC_CTX c;
diff --git a/src/lib/libcrypto/hmac/hmac.h b/src/lib/libcrypto/hmac/hmac.h
index f928975fcd..223eeda7f3 100644
--- a/src/lib/libcrypto/hmac/hmac.h
+++ b/src/lib/libcrypto/hmac/hmac.h
@@ -85,11 +85,11 @@ typedef struct hmac_ctx_st
 
 void HMAC_Init(HMAC_CTX *ctx, const void *key, int len,
                const EVP_MD *md);
-void HMAC_Update(HMAC_CTX *ctx,unsigned char *key, int len);
+void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, int len);
 void HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len);
 void HMAC_cleanup(HMAC_CTX *ctx);
 unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
-                    unsigned char *d, int n, unsigned char *md,
+                    const unsigned char *d, int n, unsigned char *md,
                     unsigned int *md_len);
 
 
diff --git a/src/lib/libcrypto/hmac/hmactest.c b/src/lib/libcrypto/hmac/hmactest.c
index 9a67dff36a..4b56b8ee13 100644
--- a/src/lib/libcrypto/hmac/hmactest.c
+++ b/src/lib/libcrypto/hmac/hmactest.c
@@ -73,7 +73,7 @@ int main(int argc, char *argv[])
 #include <openssl/ebcdic.h>
 #endif
 
-struct test_st
+static struct test_st
         {
         unsigned char key[16];
         int key_len;
diff --git a/src/lib/libcrypto/install.com b/src/lib/libcrypto/install.com
index b75d1b44b2..44cfc4e89a 100644
--- a/src/lib/libcrypto/install.com
+++ b/src/lib/libcrypto/install.com
@@ -90,6 +90,7 @@ $	  COPY 'tmp' WRK_SSLINCLUDE: /LOG
 $       ELSE
 $         COPY [.'D']'tmp' WRK_SSLINCLUDE: /LOG
 $       ENDIF
+$       SET FILE/PROT=WORLD:RE WRK_SSLINCLUDE:'tmp'
 $       GOTO LOOP_SDIRS
 $ LOOP_SDIRS_END:
 $
diff --git a/src/lib/libcrypto/lhash/Makefile.ssl b/src/lib/libcrypto/lhash/Makefile.ssl
index d6845d6caa..eef4000460 100644
--- a/src/lib/libcrypto/lhash/Makefile.ssl
+++ b/src/lib/libcrypto/lhash/Makefile.ssl
@@ -82,7 +82,8 @@ lh_stats.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 lh_stats.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 lh_stats.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 lh_stats.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
-lh_stats.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-lh_stats.o: ../cryptlib.h
+lh_stats.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+lh_stats.o: ../../include/openssl/stack.h ../cryptlib.h
 lhash.o: ../../include/openssl/crypto.h ../../include/openssl/lhash.h
-lhash.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
+lhash.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+lhash.o: ../../include/openssl/stack.h
diff --git a/src/lib/libcrypto/lhash/lhash.c b/src/lib/libcrypto/lhash/lhash.c
index 801322beb6..6a340a2403 100644
--- a/src/lib/libcrypto/lhash/lhash.c
+++ b/src/lib/libcrypto/lhash/lhash.c
@@ -64,11 +64,11 @@
  *
  * 2.1 eay - Added an 'error in last operation' flag. eay 6-May-98
  *
- * 2.0 eay - Fixed a bug that occured when using lh_delete
+ * 2.0 eay - Fixed a bug that occurred when using lh_delete
  *           from inside lh_doall().  As entries were deleted,
  *           the 'table' was 'contract()ed', making some entries
  *           jump from the end of the table to the start, there by
- *           skiping the lh_doall() processing. eay - 4/12/95
+ *           skipping the lh_doall() processing. eay - 4/12/95
  *
  * 1.9 eay - Fixed a memory leak in lh_free, the LHASH_NODEs
  *           were not being free()ed. 21/11/95
@@ -107,12 +107,9 @@ const char *lh_version="lhash" OPENSSL_VERSION_PTEXT;
 #define UP_LOAD         (2*LH_LOAD_MULT) /* load times 256  (default 2) */
 #define DOWN_LOAD       (LH_LOAD_MULT)   /* load times 256  (default 1) */
 
-
-#define P_CP    char *
-#define P_CPP   char *,char *
 static void expand(LHASH *lh);
 static void contract(LHASH *lh);
-static LHASH_NODE **getrn(LHASH *lh, char *data, unsigned long *rhash);
+static LHASH_NODE **getrn(LHASH *lh, void *data, unsigned long *rhash);
 
 LHASH *lh_new(unsigned long (*h)(), int (*c)())
         {
@@ -152,7 +149,7 @@ LHASH *lh_new(unsigned long (*h)(), int (*c)())
         ret->error=0;
         return(ret);
 err1:
-        Free((char *)ret);
+        Free(ret);
 err0:
         return(NULL);
         }
@@ -175,15 +172,15 @@ void lh_free(LHASH *lh)
                         n=nn;
                         }
                 }
-        Free((char *)lh->b);
-        Free((char *)lh);
+        Free(lh->b);
+        Free(lh);
         }
 
-char *lh_insert(LHASH *lh, char *data)
+void *lh_insert(LHASH *lh, void *data)
         {
         unsigned long hash;
         LHASH_NODE *nn,**rn;
-        char *ret;
+        void *ret;
 
         lh->error=0;
         if (lh->up_load <= (lh->num_items*LH_LOAD_MULT/lh->num_nodes))
@@ -217,11 +214,11 @@ char *lh_insert(LHASH *lh, char *data)
         return(ret);
         }
 
-char *lh_delete(LHASH *lh, char *data)
+void *lh_delete(LHASH *lh, void *data)
         {
         unsigned long hash;
         LHASH_NODE *nn,**rn;
-        char *ret;
+        void *ret;
 
         lh->error=0;
         rn=getrn(lh,data,&hash);
@@ -236,7 +233,7 @@ char *lh_delete(LHASH *lh, char *data)
                 nn= *rn;
                 *rn=nn->next;
                 ret=nn->data;
-                Free((char *)nn);
+                Free(nn);
                 lh->num_delete++;
                 }
 
@@ -248,11 +245,11 @@ char *lh_delete(LHASH *lh, char *data)
         return(ret);
         }
 
-char *lh_retrieve(LHASH *lh, char *data)
+void *lh_retrieve(LHASH *lh, void *data)
         {
         unsigned long hash;
         LHASH_NODE **rn;
-        char *ret;
+        void *ret;
 
         lh->error=0;
         rn=getrn(lh,data,&hash);
@@ -275,7 +272,7 @@ void lh_doall(LHASH *lh, void (*func)())
         lh_doall_arg(lh,func,NULL);
         }
 
-void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
+void lh_doall_arg(LHASH *lh, void (*func)(), void *arg)
         {
         int i;
         LHASH_NODE *a,*n;
@@ -332,7 +329,7 @@ static void expand(LHASH *lh)
         if ((lh->p) >= lh->pmax)
                 {
                 j=(int)lh->num_alloc_nodes*2;
-                n=(LHASH_NODE **)Realloc((char *)lh->b,
+                n=(LHASH_NODE **)Realloc(lh->b,
                         (unsigned int)sizeof(LHASH_NODE *)*j);
                 if (n == NULL)
                         {
@@ -360,7 +357,7 @@ static void contract(LHASH *lh)
         lh->b[lh->p+lh->pmax-1]=NULL; /* 24/07-92 - eay - weird but :-( */
         if (lh->p == 0)
                 {
-                n=(LHASH_NODE **)Realloc((char *)lh->b,
+                n=(LHASH_NODE **)Realloc(lh->b,
                         (unsigned int)(sizeof(LHASH_NODE *)*lh->pmax));
                 if (n == NULL)
                         {
@@ -391,7 +388,7 @@ static void contract(LHASH *lh)
                 }
         }
 
-static LHASH_NODE **getrn(LHASH *lh, char *data, unsigned long *rhash)
+static LHASH_NODE **getrn(LHASH *lh, void *data, unsigned long *rhash)
         {
         LHASH_NODE **ret,*n1;
         unsigned long hash,nn;
@@ -426,8 +423,7 @@ static LHASH_NODE **getrn(LHASH *lh, char *data, unsigned long *rhash)
         }
 
 /*
-static unsigned long lh_strhash(str)
-char *str;
+unsigned long lh_strhash(char *str)
         {
         int i,l;
         unsigned long ret=0;
diff --git a/src/lib/libcrypto/lhash/lhash.h b/src/lib/libcrypto/lhash/lhash.h
index 6e5a1fe708..6f6eeb2698 100644
--- a/src/lib/libcrypto/lhash/lhash.h
+++ b/src/lib/libcrypto/lhash/lhash.h
@@ -73,7 +73,7 @@ extern "C" {
 
 typedef struct lhash_node_st
         {
-        char *data;
+        void *data;
         struct lhash_node_st *next;
 #ifndef NO_HASH_COMP
         unsigned long hash;
@@ -116,13 +116,13 @@ typedef struct lhash_st
  * in lh_insert(). */
 #define lh_error(lh)    ((lh)->error)
 
-LHASH *lh_new(unsigned long (*h)(), int (*c)());
+LHASH *lh_new(unsigned long (*h)(/* void *a */), int (*c)(/* void *a,void *b */));
 void lh_free(LHASH *lh);
-char *lh_insert(LHASH *lh, char *data);
-char *lh_delete(LHASH *lh, char *data);
-char *lh_retrieve(LHASH *lh, char *data);
-void lh_doall(LHASH *lh, void (*func)(/* char *b */));
-void lh_doall_arg(LHASH *lh, void (*func)(/*char *a,char *b*/),char *arg);
+void *lh_insert(LHASH *lh, void *data);
+void *lh_delete(LHASH *lh, void *data);
+void *lh_retrieve(LHASH *lh, void *data);
+    void lh_doall(LHASH *lh, void (*func)(/*void *b*/));
+void lh_doall_arg(LHASH *lh, void (*func)(/*void *a,void *b*/),void *arg);
 unsigned long lh_strhash(const char *c);
 
 #ifndef NO_FP_API
diff --git a/src/lib/libcrypto/md2/Makefile.ssl b/src/lib/libcrypto/md2/Makefile.ssl
index 4274354b5f..eab615a5be 100644
--- a/src/lib/libcrypto/md2/Makefile.ssl
+++ b/src/lib/libcrypto/md2/Makefile.ssl
@@ -84,5 +84,5 @@ md2_one.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 md2_one.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 md2_one.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 md2_one.o: ../../include/openssl/md2.h ../../include/openssl/opensslconf.h
-md2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-md2_one.o: ../cryptlib.h
+md2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+md2_one.o: ../../include/openssl/stack.h ../cryptlib.h
diff --git a/src/lib/libcrypto/md2/md2.h b/src/lib/libcrypto/md2/md2.h
index 0d3592506c..582bffb859 100644
--- a/src/lib/libcrypto/md2/md2.h
+++ b/src/lib/libcrypto/md2/md2.h
@@ -81,9 +81,9 @@ typedef struct MD2state_st
 
 const char *MD2_options(void);
 void MD2_Init(MD2_CTX *c);
-void MD2_Update(MD2_CTX *c, register unsigned char *data, unsigned long len);
+void MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len);
 void MD2_Final(unsigned char *md, MD2_CTX *c);
-unsigned char *MD2(unsigned char *d, unsigned long n,unsigned char *md);
+unsigned char *MD2(const unsigned char *d, unsigned long n,unsigned char *md);
 #ifdef  __cplusplus
 }
 #endif
diff --git a/src/lib/libcrypto/md2/md2_dgst.c b/src/lib/libcrypto/md2/md2_dgst.c
index c7d8d6aef5..608baefa8f 100644
--- a/src/lib/libcrypto/md2/md2_dgst.c
+++ b/src/lib/libcrypto/md2/md2_dgst.c
@@ -69,9 +69,9 @@ const char *MD2_version="MD2" OPENSSL_VERSION_PTEXT;
 
 #define UCHAR   unsigned char
 
-static void md2_block(MD2_CTX *c, unsigned char *d);
+static void md2_block(MD2_CTX *c, const unsigned char *d);
 /* The magic S table - I have converted it to hex since it is
- * basicaly just a random byte string. */
+ * basically just a random byte string. */
 static MD2_INT S[256]={
         0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01,
         0x3D, 0x36, 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13,
@@ -123,7 +123,7 @@ void MD2_Init(MD2_CTX *c)
         memset(c->data,0,MD2_BLOCK);
         }
 
-void MD2_Update(MD2_CTX *c, register unsigned char *data, unsigned long len)
+void MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
         {
         register UCHAR *p;
 
@@ -161,7 +161,7 @@ void MD2_Update(MD2_CTX *c, register unsigned char *data, unsigned long len)
         c->num=(int)len;
         }
 
-static void md2_block(MD2_CTX *c, unsigned char *d)
+static void md2_block(MD2_CTX *c, const unsigned char *d)
         {
         register MD2_INT t,*sp1,*sp2;
         register int i,j;
diff --git a/src/lib/libcrypto/md2/md2_one.c b/src/lib/libcrypto/md2/md2_one.c
index 7157299d95..b12c37ce4d 100644
--- a/src/lib/libcrypto/md2/md2_one.c
+++ b/src/lib/libcrypto/md2/md2_one.c
@@ -63,7 +63,7 @@
 /* This is a separate file so that #defines in cryptlib.h can
  * map my MD functions to different names */
 
-unsigned char *MD2(unsigned char *d, unsigned long n, unsigned char *md)
+unsigned char *MD2(const unsigned char *d, unsigned long n, unsigned char *md)
         {
         MD2_CTX c;
         static unsigned char m[MD2_DIGEST_LENGTH];
diff --git a/src/lib/libcrypto/md2/md2test.c b/src/lib/libcrypto/md2/md2test.c
index 461d124957..e3f4fb4c34 100644
--- a/src/lib/libcrypto/md2/md2test.c
+++ b/src/lib/libcrypto/md2/md2test.c
@@ -73,7 +73,7 @@ int main(int argc, char *argv[])
 #include <openssl/ebcdic.h>
 #endif
 
-char *test[]={
+static char *test[]={
         "",
         "a",
         "abc",
@@ -84,7 +84,7 @@ char *test[]={
         NULL,
         };
 
-char *ret[]={
+static char *ret[]={
         "8350e5a3e24c153df2275c9f80692773",
         "32ec01ec4a6dac72c0ab96fb34c0b5d1",
         "da853b0d3f88d99b30283a69e6ded6bb",
diff --git a/src/lib/libcrypto/md32_common.h b/src/lib/libcrypto/md32_common.h
index 2b91f9eef2..1a404a458d 100644
--- a/src/lib/libcrypto/md32_common.h
+++ b/src/lib/libcrypto/md32_common.h
@@ -94,6 +94,8 @@
  *      in original (data) byte order, implemented externally (it
  *      actually is optional if data and host are of the same
  *      "endianess").
+ * HASH_MAKE_STRING
+ *      macro convering context variables to an ASCII hash string.
  *
  * Optional macros:
  *
@@ -178,8 +180,17 @@
 #undef ROTATE
 #ifndef PEDANTIC
 # if defined(_MSC_VER)
-#  define ROTATE(a,n)     _lrotl(a,n)
-# elif defined(__GNUC__) && __GNUC__>=2 && !defined(NO_ASM)
+#  define ROTATE(a,n)   _lrotl(a,n)
+# elif defined(__MWERKS__)
+#  if defined(__POWERPC__)
+#   define ROTATE(a,n)  __rlwinm(a,n,0,31)
+#  elif defined(__MC68K__)
+    /* Motorola specific tweak. <appro@fy.chalmers.se> */
+#   define ROTATE(a,n)  ( n<24 ? __rol(a,n) : __ror(a,32-n) )
+#  else
+#   define ROTATE(a,n)  __rol(a,n)
+#  endif
+# elif defined(__GNUC__) && __GNUC__>=2 && !defined(NO_ASM) && !defined(NO_INLINE_ASM)
   /*
    * Some GNU C inline assembler templates. Note that these are
    * rotates by *constant* number of bits! But that's exactly
@@ -189,16 +200,16 @@
    */
 #  if defined(__i386)
 #   define ROTATE(a,n)  ({ register unsigned int ret;   \
-                                asm volatile (          \
+                                asm (                   \
                                 "roll %1,%0"            \
                                 : "=r"(ret)             \
                                 : "I"(n), "0"(a)        \
                                 : "cc");                \
                            ret;                         \
                         })
-#  elif defined(__powerpc)
+#  elif defined(__powerpc) || defined(__ppc)
 #   define ROTATE(a,n)  ({ register unsigned int ret;   \
-                                asm volatile (          \
+                                asm (                   \
                                 "rlwinm %0,%1,%2,0,31"  \
                                 : "=r"(ret)             \
                                 : "r"(a), "I"(n));      \
@@ -211,18 +222,18 @@
  * Engage compiler specific "fetch in reverse byte order"
  * intrinsic function if available.
  */
-# if defined(__GNUC__) && __GNUC__>=2 && !defined(NO_ASM)
+# if defined(__GNUC__) && __GNUC__>=2 && !defined(NO_ASM) && !defined(NO_INLINE_ASM)
   /* some GNU C inline assembler templates by <appro@fy.chalmers.se> */
 #  if defined(__i386) && !defined(I386_ONLY)
 #   define BE_FETCH32(a)        ({ register unsigned int l=(a);\
-                                asm volatile (          \
+                                asm (                   \
                                 "bswapl %0"             \
                                 : "=r"(l) : "0"(l));    \
                           l;                            \
                         })
 #  elif defined(__powerpc)
 #   define LE_FETCH32(a)        ({ register unsigned int l;     \
-                                asm volatile (          \
+                                asm (                   \
                                 "lwbrx %0,0,%1"         \
                                 : "=r"(l)               \
                                 : "r"(a));              \
@@ -231,7 +242,7 @@
 
 #  elif defined(__sparc) && defined(ULTRASPARC)
 #  define LE_FETCH32(a) ({ register unsigned int l;             \
-                                asm volatile (                  \
+                                asm (                           \
                                 "lda [%1]#ASI_PRIMARY_LITTLE,%0"\
                                 : "=r"(l)                       \
                                 : "r"(a));                      \
@@ -399,8 +410,9 @@
  * Time for some action:-)
  */
 
-void HASH_UPDATE (HASH_CTX *c, const unsigned char *data, unsigned long len)
+void HASH_UPDATE (HASH_CTX *c, const void *data_, unsigned long len)
         {
+        const unsigned char *data=data_;
         register HASH_LONG * p;
         register unsigned long l;
         int sw,sc,ew,ec;
@@ -581,10 +593,11 @@ void HASH_FINAL (unsigned char *md, HASH_CTX *c)
 #endif
         HASH_BLOCK_HOST_ORDER (c,p,1);
 
-        l=c->A; HOST_l2c(l,md);
-        l=c->B; HOST_l2c(l,md);
-        l=c->C; HOST_l2c(l,md);
-        l=c->D; HOST_l2c(l,md);
+#ifndef HASH_MAKE_STRING
+#error "HASH_MAKE_STRING must be defined!"
+#else
+        HASH_MAKE_STRING(c,md);
+#endif
 
         c->num=0;
         /* clear stuff, HASH_BLOCK may be leaving some stuff on the stack
diff --git a/src/lib/libcrypto/md5/Makefile.ssl b/src/lib/libcrypto/md5/Makefile.ssl
index cc73fba2ba..d50f967be7 100644
--- a/src/lib/libcrypto/md5/Makefile.ssl
+++ b/src/lib/libcrypto/md5/Makefile.ssl
@@ -19,6 +19,13 @@ AR=             ar r
 MD5_ASM_OBJ=
 
 CFLAGS= $(INCLUDES) $(CFLAG)
+
+# We let the C compiler driver to take care of .s files. This is done in
+# order to be excused from maintaining a separate set of architecture
+# dependent assembler flags. E.g. if you throw -mcpu=ultrasparc at SPARC
+# gcc, then the driver will automatically translate it to -xarch=v8plus
+# and pass it down to assembler.
+AS=$(CC) -c
 ASFLAGS=$(CFLAGS)
 
 GENERAL=Makefile
@@ -77,7 +84,7 @@ asm/md5-sparcv8plus.o: asm/md5-sparcv9.S
 # if they didn't bother to upgrade GNU assembler. Such users should
 # not choose this option, but be adviced to *remove* GNU assembler
 # or upgrade it.
-sm/md5-sparcv8plus-gcc27.o: asm/md5-sparcv9.S
+asm/md5-sparcv8plus-gcc27.o: asm/md5-sparcv9.S
         $(CC) $(ASFLAGS) -DMD5_BLOCK_DATA_ORDER -E asm/md5-sparcv9.S | \
                 /usr/ccs/bin/as -xarch=v8plus - -o asm/md5-sparcv8plus-gcc27.o
 
diff --git a/src/lib/libcrypto/md5/md5.h b/src/lib/libcrypto/md5/md5.h
index bdab6d45e8..d10bc8397f 100644
--- a/src/lib/libcrypto/md5/md5.h
+++ b/src/lib/libcrypto/md5/md5.h
@@ -103,9 +103,9 @@ typedef struct MD5state_st
         } MD5_CTX;
 
 void MD5_Init(MD5_CTX *c);
-void MD5_Update(MD5_CTX *c, const unsigned char *data, unsigned long len);
+void MD5_Update(MD5_CTX *c, const void *data, unsigned long len);
 void MD5_Final(unsigned char *md, MD5_CTX *c);
-unsigned char *MD5(unsigned char *d, unsigned long n, unsigned char *md);
+unsigned char *MD5(const unsigned char *d, unsigned long n, unsigned char *md);
 void MD5_Transform(MD5_CTX *c, const unsigned char *b);
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libcrypto/md5/md5_dgst.c b/src/lib/libcrypto/md5/md5_dgst.c
index ba0115ae79..23d196b8d4 100644
--- a/src/lib/libcrypto/md5/md5_dgst.c
+++ b/src/lib/libcrypto/md5/md5_dgst.c
@@ -60,7 +60,7 @@
 #include "md5_locl.h"
 #include <openssl/opensslv.h>
 
-char *MD5_version="MD5" OPENSSL_VERSION_PTEXT;
+const char *MD5_version="MD5" OPENSSL_VERSION_PTEXT;
 
 /* Implemented from RFC1321 The MD5 Message-Digest Algorithm
  */
@@ -186,6 +186,9 @@ void md5_block_host_order (MD5_CTX *c, const void *data, int num)
 #endif
 
 #ifndef md5_block_data_order
+#ifdef X
+#undef X
+#endif
 void md5_block_data_order (MD5_CTX *c, const void *data_, int num)
         {
         const unsigned char *data=data_;
@@ -204,16 +207,15 @@ void md5_block_data_order (MD5_CTX *c, const void *data_, int num)
          *
          *                              <appro@fy.chalmers.se>
          */
-        MD5_LONG X[MD5_LBLOCK];
-        /*
-         * In case you wonder why don't I use c->data for this.
-         * RISCs usually have a handful of registers and if X is
-         * declared as automatic array good optimizing compiler
-         * shall accomodate at least part of it in register bank
-         * instead of memory.
-         *
-         *                              <appro@fy.chalmers.se>
-         */
+#ifndef MD32_XARRAY
+        /* See comment in crypto/sha/sha_locl.h for details. */
+        unsigned long   XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
+                        XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
+# define X(i)   XX##i
+#else
+        MD5_LONG XX[MD5_LBLOCK];
+# define X(i)   XX[i]
+#endif
 
         A=c->A;
         B=c->B;
@@ -222,75 +224,75 @@ void md5_block_data_order (MD5_CTX *c, const void *data_, int num)
 
         for (;num--;)
                 {
-        HOST_c2l(data,l); X[ 0]=l;              HOST_c2l(data,l); X[ 1]=l;
+        HOST_c2l(data,l); X( 0)=l;              HOST_c2l(data,l); X( 1)=l;
         /* Round 0 */
-        R0(A,B,C,D,X[ 0], 7,0xd76aa478L);       HOST_c2l(data,l); X[ 2]=l;
-        R0(D,A,B,C,X[ 1],12,0xe8c7b756L);       HOST_c2l(data,l); X[ 3]=l;
-        R0(C,D,A,B,X[ 2],17,0x242070dbL);       HOST_c2l(data,l); X[ 4]=l;
-        R0(B,C,D,A,X[ 3],22,0xc1bdceeeL);       HOST_c2l(data,l); X[ 5]=l;
-        R0(A,B,C,D,X[ 4], 7,0xf57c0fafL);       HOST_c2l(data,l); X[ 6]=l;
-        R0(D,A,B,C,X[ 5],12,0x4787c62aL);       HOST_c2l(data,l); X[ 7]=l;
-        R0(C,D,A,B,X[ 6],17,0xa8304613L);       HOST_c2l(data,l); X[ 8]=l;
-        R0(B,C,D,A,X[ 7],22,0xfd469501L);       HOST_c2l(data,l); X[ 9]=l;
-        R0(A,B,C,D,X[ 8], 7,0x698098d8L);       HOST_c2l(data,l); X[10]=l;
-        R0(D,A,B,C,X[ 9],12,0x8b44f7afL);       HOST_c2l(data,l); X[11]=l;
-        R0(C,D,A,B,X[10],17,0xffff5bb1L);       HOST_c2l(data,l); X[12]=l;
-        R0(B,C,D,A,X[11],22,0x895cd7beL);       HOST_c2l(data,l); X[13]=l;
-        R0(A,B,C,D,X[12], 7,0x6b901122L);       HOST_c2l(data,l); X[14]=l;
-        R0(D,A,B,C,X[13],12,0xfd987193L);       HOST_c2l(data,l); X[15]=l;
-        R0(C,D,A,B,X[14],17,0xa679438eL);
-        R0(B,C,D,A,X[15],22,0x49b40821L);
+        R0(A,B,C,D,X( 0), 7,0xd76aa478L);       HOST_c2l(data,l); X( 2)=l;
+        R0(D,A,B,C,X( 1),12,0xe8c7b756L);       HOST_c2l(data,l); X( 3)=l;
+        R0(C,D,A,B,X( 2),17,0x242070dbL);       HOST_c2l(data,l); X( 4)=l;
+        R0(B,C,D,A,X( 3),22,0xc1bdceeeL);       HOST_c2l(data,l); X( 5)=l;
+        R0(A,B,C,D,X( 4), 7,0xf57c0fafL);       HOST_c2l(data,l); X( 6)=l;
+        R0(D,A,B,C,X( 5),12,0x4787c62aL);       HOST_c2l(data,l); X( 7)=l;
+        R0(C,D,A,B,X( 6),17,0xa8304613L);       HOST_c2l(data,l); X( 8)=l;
+        R0(B,C,D,A,X( 7),22,0xfd469501L);       HOST_c2l(data,l); X( 9)=l;
+        R0(A,B,C,D,X( 8), 7,0x698098d8L);       HOST_c2l(data,l); X(10)=l;
+        R0(D,A,B,C,X( 9),12,0x8b44f7afL);       HOST_c2l(data,l); X(11)=l;
+        R0(C,D,A,B,X(10),17,0xffff5bb1L);       HOST_c2l(data,l); X(12)=l;
+        R0(B,C,D,A,X(11),22,0x895cd7beL);       HOST_c2l(data,l); X(13)=l;
+        R0(A,B,C,D,X(12), 7,0x6b901122L);       HOST_c2l(data,l); X(14)=l;
+        R0(D,A,B,C,X(13),12,0xfd987193L);       HOST_c2l(data,l); X(15)=l;
+        R0(C,D,A,B,X(14),17,0xa679438eL);
+        R0(B,C,D,A,X(15),22,0x49b40821L);
         /* Round 1 */
-        R1(A,B,C,D,X[ 1], 5,0xf61e2562L);
-        R1(D,A,B,C,X[ 6], 9,0xc040b340L);
-        R1(C,D,A,B,X[11],14,0x265e5a51L);
-        R1(B,C,D,A,X[ 0],20,0xe9b6c7aaL);
-        R1(A,B,C,D,X[ 5], 5,0xd62f105dL);
-        R1(D,A,B,C,X[10], 9,0x02441453L);
-        R1(C,D,A,B,X[15],14,0xd8a1e681L);
-        R1(B,C,D,A,X[ 4],20,0xe7d3fbc8L);
-        R1(A,B,C,D,X[ 9], 5,0x21e1cde6L);
-        R1(D,A,B,C,X[14], 9,0xc33707d6L);
-        R1(C,D,A,B,X[ 3],14,0xf4d50d87L);
-        R1(B,C,D,A,X[ 8],20,0x455a14edL);
-        R1(A,B,C,D,X[13], 5,0xa9e3e905L);
-        R1(D,A,B,C,X[ 2], 9,0xfcefa3f8L);
-        R1(C,D,A,B,X[ 7],14,0x676f02d9L);
-        R1(B,C,D,A,X[12],20,0x8d2a4c8aL);
+        R1(A,B,C,D,X( 1), 5,0xf61e2562L);
+        R1(D,A,B,C,X( 6), 9,0xc040b340L);
+        R1(C,D,A,B,X(11),14,0x265e5a51L);
+        R1(B,C,D,A,X( 0),20,0xe9b6c7aaL);
+        R1(A,B,C,D,X( 5), 5,0xd62f105dL);
+        R1(D,A,B,C,X(10), 9,0x02441453L);
+        R1(C,D,A,B,X(15),14,0xd8a1e681L);
+        R1(B,C,D,A,X( 4),20,0xe7d3fbc8L);
+        R1(A,B,C,D,X( 9), 5,0x21e1cde6L);
+        R1(D,A,B,C,X(14), 9,0xc33707d6L);
+        R1(C,D,A,B,X( 3),14,0xf4d50d87L);
+        R1(B,C,D,A,X( 8),20,0x455a14edL);
+        R1(A,B,C,D,X(13), 5,0xa9e3e905L);
+        R1(D,A,B,C,X( 2), 9,0xfcefa3f8L);
+        R1(C,D,A,B,X( 7),14,0x676f02d9L);
+        R1(B,C,D,A,X(12),20,0x8d2a4c8aL);
         /* Round 2 */
-        R2(A,B,C,D,X[ 5], 4,0xfffa3942L);
-        R2(D,A,B,C,X[ 8],11,0x8771f681L);
-        R2(C,D,A,B,X[11],16,0x6d9d6122L);
-        R2(B,C,D,A,X[14],23,0xfde5380cL);
-        R2(A,B,C,D,X[ 1], 4,0xa4beea44L);
-        R2(D,A,B,C,X[ 4],11,0x4bdecfa9L);
-        R2(C,D,A,B,X[ 7],16,0xf6bb4b60L);
-        R2(B,C,D,A,X[10],23,0xbebfbc70L);
-        R2(A,B,C,D,X[13], 4,0x289b7ec6L);
-        R2(D,A,B,C,X[ 0],11,0xeaa127faL);
-        R2(C,D,A,B,X[ 3],16,0xd4ef3085L);
-        R2(B,C,D,A,X[ 6],23,0x04881d05L);
-        R2(A,B,C,D,X[ 9], 4,0xd9d4d039L);
-        R2(D,A,B,C,X[12],11,0xe6db99e5L);
-        R2(C,D,A,B,X[15],16,0x1fa27cf8L);
-        R2(B,C,D,A,X[ 2],23,0xc4ac5665L);
+        R2(A,B,C,D,X( 5), 4,0xfffa3942L);
+        R2(D,A,B,C,X( 8),11,0x8771f681L);
+        R2(C,D,A,B,X(11),16,0x6d9d6122L);
+        R2(B,C,D,A,X(14),23,0xfde5380cL);
+        R2(A,B,C,D,X( 1), 4,0xa4beea44L);
+        R2(D,A,B,C,X( 4),11,0x4bdecfa9L);
+        R2(C,D,A,B,X( 7),16,0xf6bb4b60L);
+        R2(B,C,D,A,X(10),23,0xbebfbc70L);
+        R2(A,B,C,D,X(13), 4,0x289b7ec6L);
+        R2(D,A,B,C,X( 0),11,0xeaa127faL);
+        R2(C,D,A,B,X( 3),16,0xd4ef3085L);
+        R2(B,C,D,A,X( 6),23,0x04881d05L);
+        R2(A,B,C,D,X( 9), 4,0xd9d4d039L);
+        R2(D,A,B,C,X(12),11,0xe6db99e5L);
+        R2(C,D,A,B,X(15),16,0x1fa27cf8L);
+        R2(B,C,D,A,X( 2),23,0xc4ac5665L);
         /* Round 3 */
-        R3(A,B,C,D,X[ 0], 6,0xf4292244L);
-        R3(D,A,B,C,X[ 7],10,0x432aff97L);
-        R3(C,D,A,B,X[14],15,0xab9423a7L);
-        R3(B,C,D,A,X[ 5],21,0xfc93a039L);
-        R3(A,B,C,D,X[12], 6,0x655b59c3L);
-        R3(D,A,B,C,X[ 3],10,0x8f0ccc92L);
-        R3(C,D,A,B,X[10],15,0xffeff47dL);
-        R3(B,C,D,A,X[ 1],21,0x85845dd1L);
-        R3(A,B,C,D,X[ 8], 6,0x6fa87e4fL);
-        R3(D,A,B,C,X[15],10,0xfe2ce6e0L);
-        R3(C,D,A,B,X[ 6],15,0xa3014314L);
-        R3(B,C,D,A,X[13],21,0x4e0811a1L);
-        R3(A,B,C,D,X[ 4], 6,0xf7537e82L);
-        R3(D,A,B,C,X[11],10,0xbd3af235L);
-        R3(C,D,A,B,X[ 2],15,0x2ad7d2bbL);
-        R3(B,C,D,A,X[ 9],21,0xeb86d391L);
+        R3(A,B,C,D,X( 0), 6,0xf4292244L);
+        R3(D,A,B,C,X( 7),10,0x432aff97L);
+        R3(C,D,A,B,X(14),15,0xab9423a7L);
+        R3(B,C,D,A,X( 5),21,0xfc93a039L);
+        R3(A,B,C,D,X(12), 6,0x655b59c3L);
+        R3(D,A,B,C,X( 3),10,0x8f0ccc92L);
+        R3(C,D,A,B,X(10),15,0xffeff47dL);
+        R3(B,C,D,A,X( 1),21,0x85845dd1L);
+        R3(A,B,C,D,X( 8), 6,0x6fa87e4fL);
+        R3(D,A,B,C,X(15),10,0xfe2ce6e0L);
+        R3(C,D,A,B,X( 6),15,0xa3014314L);
+        R3(B,C,D,A,X(13),21,0x4e0811a1L);
+        R3(A,B,C,D,X( 4), 6,0xf7537e82L);
+        R3(D,A,B,C,X(11),10,0xbd3af235L);
+        R3(C,D,A,B,X( 2),15,0x2ad7d2bbL);
+        R3(B,C,D,A,X( 9),21,0xeb86d391L);
 
         A = c->A += A;
         B = c->B += B;
diff --git a/src/lib/libcrypto/md5/md5_locl.h b/src/lib/libcrypto/md5/md5_locl.h
index 9d04696dbd..06af633228 100644
--- a/src/lib/libcrypto/md5/md5_locl.h
+++ b/src/lib/libcrypto/md5/md5_locl.h
@@ -66,7 +66,7 @@
 #endif
 
 #ifdef MD5_ASM
-# if defined(__i386) || defined(_M_IX86)
+# if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
 #  define md5_block_host_order md5_block_asm_host_order
 # elif defined(__sparc) && defined(ULTRASPARC)
    void md5_block_asm_data_order_aligned (MD5_CTX *c, const MD5_LONG *p,int num);
@@ -77,11 +77,11 @@
 void md5_block_host_order (MD5_CTX *c, const void *p,int num);
 void md5_block_data_order (MD5_CTX *c, const void *p,int num);
 
-#if defined(__i386) || defined(_M_IX86)
+#if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
 /*
  * *_block_host_order is expected to handle aligned data while
  * *_block_data_order - unaligned. As algorithm and host (x86)
- * are in this case of the same "endianess" these two are
+ * are in this case of the same "endianness" these two are
  * otherwise indistinguishable. But normally you don't want to
  * call the same function because unaligned access in places
  * where alignment is expected is usually a "Bad Thing". Indeed,
@@ -112,6 +112,13 @@ void md5_block_data_order (MD5_CTX *c, const void *p,int num);
 #define HASH_UPDATE             MD5_Update
 #define HASH_TRANSFORM          MD5_Transform
 #define HASH_FINAL              MD5_Final
+#define HASH_MAKE_STRING(c,s)   do {    \
+        unsigned long ll;               \
+        ll=(c)->A; HOST_l2c(ll,(s));    \
+        ll=(c)->B; HOST_l2c(ll,(s));    \
+        ll=(c)->C; HOST_l2c(ll,(s));    \
+        ll=(c)->D; HOST_l2c(ll,(s));    \
+        } while (0)
 #define HASH_BLOCK_HOST_ORDER   md5_block_host_order
 #if !defined(L_ENDIAN) || defined(md5_block_data_order)
 #define HASH_BLOCK_DATA_ORDER   md5_block_data_order
@@ -119,7 +126,7 @@ void md5_block_data_order (MD5_CTX *c, const void *p,int num);
  * Little-endians (Intel and Alpha) feel better without this.
  * It looks like memcpy does better job than generic
  * md5_block_data_order on copying-n-aligning input data.
- * But franlky speaking I didn't expect such result on Alpha.
+ * But frankly speaking I didn't expect such result on Alpha.
  * On the other hand I've got this with egcs-1.0.2 and if
  * program is compiled with another (better?) compiler it
  * might turn out other way around.
@@ -140,7 +147,7 @@ void md5_block_data_order (MD5_CTX *c, const void *p,int num);
 */
 
 /* As pointed out by Wei Dai <weidai@eskimo.com>, the above can be
- * simplified to the code below.  Wei attributes these optimisations
+ * simplified to the code below.  Wei attributes these optimizations
  * to Peter Gutmann's SHS code, and he attributes it to Rich Schroeppel.
  */
 #define F(b,c,d)        ((((c) ^ (d)) & (b)) ^ (d))
diff --git a/src/lib/libcrypto/md5/md5_one.c b/src/lib/libcrypto/md5/md5_one.c
index 4b10e7f940..b89dec850d 100644
--- a/src/lib/libcrypto/md5/md5_one.c
+++ b/src/lib/libcrypto/md5/md5_one.c
@@ -64,7 +64,7 @@
 #include <openssl/ebcdic.h>
 #endif
 
-unsigned char *MD5(unsigned char *d, unsigned long n, unsigned char *md)
+unsigned char *MD5(const unsigned char *d, unsigned long n, unsigned char *md)
         {
         MD5_CTX c;
         static unsigned char m[MD5_DIGEST_LENGTH];
diff --git a/src/lib/libcrypto/md5/md5test.c b/src/lib/libcrypto/md5/md5test.c
index a192a62bb3..6bd8656302 100644
--- a/src/lib/libcrypto/md5/md5test.c
+++ b/src/lib/libcrypto/md5/md5test.c
@@ -69,7 +69,7 @@ int main(int argc, char *argv[])
 #else
 #include <openssl/md5.h>
 
-char *test[]={
+static char *test[]={
         "",
         "a",
         "abc",
@@ -80,7 +80,7 @@ char *test[]={
         NULL,
         };
 
-char *ret[]={
+static char *ret[]={
         "d41d8cd98f00b204e9800998ecf8427e",
         "0cc175b9c0f1b6a831c399e269772661",
         "900150983cd24fb0d6963f7d28e17f72",
diff --git a/src/lib/libcrypto/mdc2/Makefile.ssl b/src/lib/libcrypto/mdc2/Makefile.ssl
index f8c824c4a8..7c28103350 100644
--- a/src/lib/libcrypto/mdc2/Makefile.ssl
+++ b/src/lib/libcrypto/mdc2/Makefile.ssl
@@ -83,7 +83,7 @@ mdc2_one.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 mdc2_one.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 mdc2_one.o: ../../include/openssl/err.h ../../include/openssl/mdc2.h
 mdc2_one.o: ../../include/openssl/opensslconf.h
-mdc2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-mdc2_one.o: ../cryptlib.h
+mdc2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+mdc2_one.o: ../../include/openssl/stack.h ../cryptlib.h
 mdc2dgst.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
 mdc2dgst.o: ../../include/openssl/mdc2.h ../../include/openssl/opensslconf.h
diff --git a/src/lib/libcrypto/mdc2/mdc2.h b/src/lib/libcrypto/mdc2/mdc2.h
index ec8e159fc9..00acd707cd 100644
--- a/src/lib/libcrypto/mdc2/mdc2.h
+++ b/src/lib/libcrypto/mdc2/mdc2.h
@@ -82,9 +82,10 @@ typedef struct mdc2_ctx_st
 
 
 void MDC2_Init(MDC2_CTX *c);
-void MDC2_Update(MDC2_CTX *c, unsigned char *data, unsigned long len);
+void MDC2_Update(MDC2_CTX *c, const unsigned char *data, unsigned long len);
 void MDC2_Final(unsigned char *md, MDC2_CTX *c);
-unsigned char *MDC2(unsigned char *d, unsigned long n, unsigned char *md);
+unsigned char *MDC2(const unsigned char *d, unsigned long n,
+        unsigned char *md);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libcrypto/mem.c b/src/lib/libcrypto/mem.c
index 61fc1e184e..5a661e5f45 100644
--- a/src/lib/libcrypto/mem.c
+++ b/src/lib/libcrypto/mem.c
@@ -59,371 +59,203 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <openssl/crypto.h>
-#ifdef CRYPTO_MDEBUG_TIME
-# include <time.h>      
-#endif
-#include <openssl/buffer.h>
-#include <openssl/bio.h>
-#include <openssl/lhash.h>
 #include "cryptlib.h"
 
-/* #ifdef CRYPTO_MDEBUG */
-/* static int mh_mode=CRYPTO_MEM_CHECK_ON; */
-/* #else */
-static int mh_mode=CRYPTO_MEM_CHECK_OFF;
-/* #endif */
-/* State CRYPTO_MEM_CHECK_ON exists only temporarily when the library
- * thinks that certain allocations should not be checked (e.g. the data
- * structures used for memory checking).  It is not suitable as an initial
- * state: the library will unexpectedly enable memory checking when it
- * executes one of those sections that want to disable checking
- * temporarily.
- *
- * State CRYPTO_MEM_CHECK_ENABLE without ..._ON makes no sense whatsoever.
- */
-
-static unsigned long order=0;
-
-static LHASH *mh=NULL;
 
-typedef struct mem_st
-        {
-        char *addr;
-        int num;
-        const char *file;
-        int line;
-#ifdef CRYPTO_MDEBUG_THREAD
-        unsigned long thread;
+static int allow_customize = 1;      /* we provide flexible functions for */
+static int allow_customize_debug = 1;/* exchanging memory-related functions at
+                                      * run-time, but this must be done
+                                      * before any blocks are actually
+                                      * allocated; or we'll run into huge
+                                      * problems when malloc/free pairs
+                                      * don't match etc. */
+
+/* may be changed as long as `allow_customize' is set */
+static void *(*malloc_locked_func)(size_t)  = malloc;
+static void (*free_locked_func)(void *)     = free;
+static void *(*malloc_func)(size_t)         = malloc;
+static void *(*realloc_func)(void *, size_t)= realloc;
+static void (*free_func)(void *)            = free;
+
+/* may be changed as long as `allow_customize_debug' is set */
+/* XXX use correct function pointer types */
+#ifdef CRYPTO_MDEBUG
+  /* use default functions from mem_dbg.c */
+  static void (*malloc_debug_func)()= (void (*)())CRYPTO_dbg_malloc;
+  static void (*realloc_debug_func)()= (void (*)())CRYPTO_dbg_realloc;
+  static void (*free_debug_func)()= (void (*)())CRYPTO_dbg_free;
+  static void (*set_debug_options_func)()= (void (*)())CRYPTO_dbg_set_options;
+  static long (*get_debug_options_func)()= (long (*)())CRYPTO_dbg_get_options;
+#else
+  /* applications can use CRYPTO_malloc_debug_init() to select above case
+   * at run-time */
+  static void (*malloc_debug_func)()= NULL;
+  static void (*realloc_debug_func)()= NULL;
+  static void (*free_debug_func)()= NULL;
+  static void (*set_debug_options_func)()= NULL;
+  static long (*get_debug_options_func)()= NULL;
 #endif
-        unsigned long order;
-#ifdef CRYPTO_MDEBUG_TIME
-        time_t time;
-#endif
-        } MEM;
-
-int CRYPTO_mem_ctrl(int mode)
-        {
-        int ret=mh_mode;
-
-        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-        switch (mode)
-                {
-        /* for applications: */
-        case CRYPTO_MEM_CHECK_ON: /* aka MemCheck_start() */
-                mh_mode = CRYPTO_MEM_CHECK_ON|CRYPTO_MEM_CHECK_ENABLE;
-                break;
-        case CRYPTO_MEM_CHECK_OFF: /* aka MemCheck_stop() */
-                mh_mode = 0;
-                break;
 
-        /* switch off temporarily (for library-internal use): */
-        case CRYPTO_MEM_CHECK_DISABLE: /* aka MemCheck_off() */
-                mh_mode&= ~CRYPTO_MEM_CHECK_ENABLE;
-                break;
-        case CRYPTO_MEM_CHECK_ENABLE: /* aka MemCheck_on() */
-                if (mh_mode&CRYPTO_MEM_CHECK_ON)
-                        mh_mode|=CRYPTO_MEM_CHECK_ENABLE;
-                break;
 
-        default:
-                break;
-                }
-        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-        return(ret);
-        }
-
-static int mem_cmp(MEM *a, MEM *b)
-        {
-        return(a->addr - b->addr);
-        }
-
-static unsigned long mem_hash(MEM *a)
+int CRYPTO_set_mem_functions(void *(*m)(size_t), void *(*r)(void *, size_t),
+        void (*f)(void *))
         {
-        unsigned long ret;
-
-        ret=(unsigned long)a->addr;
-
-        ret=ret*17851+(ret>>14)*7+(ret>>4)*251;
-        return(ret);
-        }
-
-static char *(*malloc_locked_func)()=(char *(*)())malloc;
-static void (*free_locked_func)()=(void (*)())free;
-static char *(*malloc_func)()=  (char *(*)())malloc;
-static char *(*realloc_func)()= (char *(*)())realloc;
-static void (*free_func)()=     (void (*)())free;
-
-void CRYPTO_set_mem_functions(char *(*m)(), char *(*r)(), void (*f)())
-        {
-        if ((m == NULL) || (r == NULL) || (f == NULL)) return;
+        if (!allow_customize)
+                return 0;
+        if ((m == NULL) || (r == NULL) || (f == NULL))
+                return 0;
         malloc_func=m;
         realloc_func=r;
         free_func=f;
         malloc_locked_func=m;
         free_locked_func=f;
+        return 1;
         }
 
-void CRYPTO_set_locked_mem_functions(char *(*m)(), void (*f)())
+int CRYPTO_set_locked_mem_functions(void *(*m)(size_t), void (*f)(void *))
         {
-        if ((m == NULL) || (f == NULL)) return;
+        if (!allow_customize)
+                return 0;
+        if ((m == NULL) || (f == NULL))
+                return 0;
         malloc_locked_func=m;
         free_locked_func=f;
+        return 1;
+        }
+
+int CRYPTO_set_mem_debug_functions(void (*m)(), void (*r)(), void (*f)(),void (*so)(),long (*go)())
+        {
+        if (!allow_customize_debug)
+                return 0;
+        malloc_debug_func=m;
+        realloc_debug_func=r;
+        free_debug_func=f;
+        set_debug_options_func=so;
+        get_debug_options_func=go;
+        return 1;
         }
 
-void CRYPTO_get_mem_functions(char *(**m)(), char *(**r)(), void (**f)())
+void CRYPTO_get_mem_functions(void *(**m)(size_t), void *(**r)(void *, size_t),
+        void (**f)(void *))
         {
         if (m != NULL) *m=malloc_func;
         if (r != NULL) *r=realloc_func;
         if (f != NULL) *f=free_func;
         }
 
-void CRYPTO_get_locked_mem_functions(char *(**m)(), void (**f)())
+void CRYPTO_get_locked_mem_functions(void *(**m)(size_t), void (**f)(void *))
         {
         if (m != NULL) *m=malloc_locked_func;
         if (f != NULL) *f=free_locked_func;
         }
 
-void *CRYPTO_malloc_locked(int num)
+void CRYPTO_get_mem_debug_functions(void (**m)(), void (**r)(), void (**f)(),void (**so)(),long (**go)())
         {
-        return(malloc_locked_func(num));
+        if (m != NULL) *m=malloc_debug_func;
+        if (r != NULL) *r=realloc_debug_func;
+        if (f != NULL) *f=free_debug_func;
+        if (so != NULL) *so=set_debug_options_func;
+        if (go != NULL) *go=get_debug_options_func;
         }
 
-void CRYPTO_free_locked(void *str)
-        {
-        free_locked_func(str);
-        }
 
-void *CRYPTO_malloc(int num)
+void *CRYPTO_malloc_locked(int num, const char *file, int line)
         {
-        return(malloc_func(num));
-        }
+        char *ret = NULL;
 
-void *CRYPTO_realloc(void *str, int num)
-        {
-        return(realloc_func(str,num));
-        }
-
-void CRYPTO_free(void *str)
-        {
-        free_func(str);
-        }
-
-static unsigned long break_order_num=0;
-void *CRYPTO_dbg_malloc(int num, const char *file, int line)
-        {
-        char *ret;
-        MEM *m,*mm;
-
-        if ((ret=malloc_func(num)) == NULL)
-                return(NULL);
-
-        if (mh_mode & CRYPTO_MEM_CHECK_ENABLE)
+        allow_customize = 0;
+        if (malloc_debug_func != NULL)
                 {
-                MemCheck_off();
-                if ((m=(MEM *)Malloc(sizeof(MEM))) == NULL)
-                        {
-                        Free(ret);
-                        MemCheck_on();
-                        return(NULL);
-                        }
-                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-                if (mh == NULL)
-                        {
-                        if ((mh=lh_new(mem_hash,mem_cmp)) == NULL)
-                                {
-                                Free(ret);
-                                Free(m);
-                                ret=NULL;
-                                goto err;
-                                }
-                        }
-
-                m->addr=ret;
-                m->file=file;
-                m->line=line;
-                m->num=num;
-#ifdef CRYPTO_MDEBUG_THREAD
-                m->thread=CRYPTO_thread_id();
-#endif
-                if (order == break_order_num)
-                        {
-                        /* BREAK HERE */
-                        m->order=order;
-                        }
-                m->order=order++;
-#ifdef CRYPTO_MDEBUG_TIME
-                m->time=time(NULL);
-#endif
-                if ((mm=(MEM *)lh_insert(mh,(char *)m)) != NULL)
-                        {
-                        /* Not good, but don't sweat it */
-                        Free(mm);
-                        }
-err:
-                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-                MemCheck_on();
+                allow_customize_debug = 0;
+                malloc_debug_func(NULL, num, file, line, 0);
                 }
-        return(ret);
+        ret = malloc_locked_func(num);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         > 0x%p (%d)\n", ret, num);
+#endif
+        if (malloc_debug_func != NULL)
+                malloc_debug_func(ret, num, file, line, 1);
+
+        return ret;
         }
 
-void CRYPTO_dbg_free(void *addr)
+void CRYPTO_free_locked(void *str)
         {
-        MEM m,*mp;
-
-        if ((mh_mode & CRYPTO_MEM_CHECK_ENABLE) && (mh != NULL))
-                {
-                MemCheck_off();
-                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-                m.addr=addr;
-                mp=(MEM *)lh_delete(mh,(char *)&m);
-                if (mp != NULL)
-                        Free(mp);
-                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-                MemCheck_on();
-                }
-        free_func(addr);
+        if (free_debug_func != NULL)
+                free_debug_func(str, 0);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         < 0x%p\n", str);
+#endif
+        free_locked_func(str);
+        if (free_debug_func != NULL)
+                free_debug_func(NULL, 1);
         }
 
-void *CRYPTO_dbg_realloc(void *addr, int num, const char *file, int line)
+void *CRYPTO_malloc(int num, const char *file, int line)
         {
-        char *ret;
-        MEM m,*mp;
-
-        ret=realloc_func(addr,num);
-        if (ret == addr) return(ret);
+        char *ret = NULL;
 
-        if (mh_mode & CRYPTO_MEM_CHECK_ENABLE)
+        allow_customize = 0;
+        if (malloc_debug_func != NULL)
                 {
-                MemCheck_off();
-                if (ret == NULL) return(NULL);
-                m.addr=addr;
-                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-                mp=(MEM *)lh_delete(mh,(char *)&m);
-                if (mp != NULL)
-                        {
-                        mp->addr=ret;
-                        lh_insert(mh,(char *)mp);
-                        }
-                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-                MemCheck_on();
+                allow_customize_debug = 0;
+                malloc_debug_func(NULL, num, file, line, 0);
                 }
-        return(ret);
-        }
-
-void *CRYPTO_remalloc(void *a, int n)
-        {
-        if (a != NULL) Free(a);
-        a=(char *)Malloc(n);
-        return(a);
-        }
+        ret = malloc_func(num);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         > 0x%p (%d)\n", ret, num);
+#endif
+        if (malloc_debug_func != NULL)
+                malloc_debug_func(ret, num, file, line, 1);
 
-void *CRYPTO_dbg_remalloc(void *a, int n, const char *file, int line)
-        {
-        if (a != NULL) CRYPTO_dbg_free(a);
-        a=(char *)CRYPTO_dbg_malloc(n,file,line);
-        return(a);
+        return ret;
         }
 
-
-typedef struct mem_leak_st
+void *CRYPTO_realloc(void *str, int num, const char *file, int line)
         {
-        BIO *bio;
-        int chunks;
-        long bytes;
-        } MEM_LEAK;
+        char *ret = NULL;
 
-static void print_leak(MEM *m, MEM_LEAK *l)
-        {
-        char buf[128];
-#ifdef CRYPTO_MDEBUG_TIME
-        struct tm *lcl;
+        if (realloc_debug_func != NULL)
+                realloc_debug_func(str, NULL, num, file, line, 0);
+        ret = realloc_func(str,num);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         | 0x%p -> 0x%p (%d)\n", str, ret, num);
 #endif
+        if (realloc_debug_func != NULL)
+                realloc_debug_func(str, ret, num, file, line, 1);
 
-        if(m->addr == (char *)l->bio)
-            return;
-
-#ifdef CRYPTO_MDEBUG_TIME
-        lcl = localtime(&m->time);
-#endif
-
-        sprintf(buf,
-#ifdef CRYPTO_MDEBUG_TIME
-                "[%02d:%02d:%02d] "
-#endif
-                "%5lu file=%s, line=%d, "
-#ifdef CRYPTO_MDEBUG_THREAD
-                "thread=%lu, "
-#endif
-                "number=%d, address=%08lX\n",
-#ifdef CRYPTO_MDEBUG_TIME
-                lcl->tm_hour,lcl->tm_min,lcl->tm_sec,
-#endif
-                m->order,m->file,m->line,
-#ifdef CRYPTO_MDEBUG_THREAD
-                m->thread,
-#endif
-                m->num,(unsigned long)m->addr);
-
-        BIO_puts(l->bio,buf);
-        l->chunks++;
-        l->bytes+=m->num;
+        return ret;
         }
 
-void CRYPTO_mem_leaks(BIO *b)
+void CRYPTO_free(void *str)
         {
-        MEM_LEAK ml;
-        char buf[80];
-
-        if (mh == NULL) return;
-        ml.bio=b;
-        ml.bytes=0;
-        ml.chunks=0;
-        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-        lh_doall_arg(mh,(void (*)())print_leak,(char *)&ml);
-        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-        if (ml.chunks != 0)
-                {
-                sprintf(buf,"%ld bytes leaked in %d chunks\n",
-                        ml.bytes,ml.chunks);
-                BIO_puts(b,buf);
-                }
-
-#if 0
-        lh_stats_bio(mh,b);
-        lh_node_stats_bio(mh,b);
-        lh_node_usage_stats_bio(mh,b);
+        if (free_debug_func != NULL)
+                free_debug_func(str, 0);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         < 0x%p\n", str);
 #endif
+        free_func(str);
+        if (free_debug_func != NULL)
+                free_debug_func(NULL, 1);
         }
 
-static void (*mem_cb)()=NULL;
-
-static void cb_leak(MEM *m, char *cb)
+void *CRYPTO_remalloc(void *a, int num, const char *file, int line)
         {
-        void (*mem_callback)()=(void (*)())cb;
-        mem_callback(m->order,m->file,m->line,m->num,m->addr);
+        if (a != NULL) Free(a);
+        a=(char *)Malloc(num);
+        return(a);
         }
 
-void CRYPTO_mem_leaks_cb(void (*cb)())
+
+void CRYPTO_set_mem_debug_options(long bits)
         {
-        if (mh == NULL) return;
-        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-        mem_cb=cb;
-        lh_doall_arg(mh,(void (*)())cb_leak,(char *)mem_cb);
-        mem_cb=NULL;
-        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
+        if (set_debug_options_func != NULL)
+                set_debug_options_func(bits);
         }
 
-#ifndef NO_FP_API
-void CRYPTO_mem_leaks_fp(FILE *fp)
+long CRYPTO_get_mem_debug_options(void)
         {
-        BIO *b;
-
-        if (mh == NULL) return;
-        if ((b=BIO_new(BIO_s_file())) == NULL)
-                return;
-        BIO_set_fp(b,fp,BIO_NOCLOSE);
-        CRYPTO_mem_leaks(b);
-        BIO_free(b);
+        if (get_debug_options_func != NULL)
+                return get_debug_options_func();
+        return 0;
         }
-#endif
-
diff --git a/src/lib/libcrypto/mem_dbg.c b/src/lib/libcrypto/mem_dbg.c
new file mode 100644
index 0000000000..14770c0733
--- /dev/null
+++ b/src/lib/libcrypto/mem_dbg.c
@@ -0,0 +1,703 @@
+/* crypto/mem_dbg.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>       
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/bio.h>
+#include <openssl/lhash.h>
+#include "cryptlib.h"
+
+static int mh_mode=CRYPTO_MEM_CHECK_OFF;
+/* The state changes to CRYPTO_MEM_CHECK_ON | CRYPTO_MEM_CHECK_ENABLE
+ * when the application asks for it (usually after library initialisation
+ * for which no book-keeping is desired).
+ *
+ * State CRYPTO_MEM_CHECK_ON exists only temporarily when the library
+ * thinks that certain allocations should not be checked (e.g. the data
+ * structures used for memory checking).  It is not suitable as an initial
+ * state: the library will unexpectedly enable memory checking when it
+ * executes one of those sections that want to disable checking
+ * temporarily.
+ *
+ * State CRYPTO_MEM_CHECK_ENABLE without ..._ON makes no sense whatsoever.
+ */
+
+static unsigned long order = 0; /* number of memory requests */
+static LHASH *mh=NULL; /* hash-table of memory requests (address as key) */
+
+
+typedef struct app_mem_info_st
+/* For application-defined information (static C-string `info')
+ * to be displayed in memory leak list.
+ * Each thread has its own stack.  For applications, there is
+ *   CRYPTO_push_info("...")     to push an entry,
+ *   CRYPTO_pop_info()           to pop an entry,
+ *   CRYPTO_remove_all_info()    to pop all entries.
+ */
+        {       
+        unsigned long thread;
+        const char *file;
+        int line;
+        const char *info;
+        struct app_mem_info_st *next; /* tail of thread's stack */
+        int references;
+        } APP_INFO;
+
+static LHASH *amih=NULL; /* hash-table with those app_mem_info_st's
+                          * that are at the top of their thread's stack
+                          * (with `thread' as key) */
+
+typedef struct mem_st
+/* memory-block description */
+        {
+        char *addr;
+        int num;
+        const char *file;
+        int line;
+        unsigned long thread;
+        unsigned long order;
+        time_t time;
+        APP_INFO *app_info;
+        } MEM;
+
+static long options =             /* extra information to be recorded */
+#if defined(CRYPTO_MDEBUG_TIME) || defined(CRYPTO_MDEBUG_ALL)
+        V_CRYPTO_MDEBUG_TIME |
+#endif
+#if defined(CRYPTO_MDEBUG_THREAD) || defined(CRYPTO_MDEBUG_ALL)
+        V_CRYPTO_MDEBUG_THREAD |
+#endif
+        0;
+
+
+static unsigned long disabling_thread = 0;
+
+int CRYPTO_mem_ctrl(int mode)
+        {
+        int ret=mh_mode;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
+        switch (mode)
+                {
+        /* for applications: */
+        case CRYPTO_MEM_CHECK_ON: /* aka MemCheck_start() */
+                mh_mode = CRYPTO_MEM_CHECK_ON|CRYPTO_MEM_CHECK_ENABLE;
+                disabling_thread = 0;
+                break;
+        case CRYPTO_MEM_CHECK_OFF: /* aka MemCheck_stop() */
+                mh_mode = 0;
+                disabling_thread = 0;
+                break;
+
+        /* switch off temporarily (for library-internal use): */
+        case CRYPTO_MEM_CHECK_DISABLE: /* aka MemCheck_off() */
+                if (mh_mode & CRYPTO_MEM_CHECK_ON)
+                        {
+                        mh_mode&= ~CRYPTO_MEM_CHECK_ENABLE;
+                        if (disabling_thread != CRYPTO_thread_id()) /* otherwise we already have the MALLOC2 lock */
+                                {
+                                /* Long-time lock CRYPTO_LOCK_MALLOC2 must not be claimed while
+                                 * we're holding CRYPTO_LOCK_MALLOC, or we'll deadlock if
+                                 * somebody else holds CRYPTO_LOCK_MALLOC2 (and cannot release
+                                 * it because we block entry to this function).
+                                 * Give them a chance, first, and then claim the locks in
+                                 * appropriate order (long-time lock first).
+                                 */
+                                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
+                                /* Note that after we have waited for CRYPTO_LOCK_MALLOC2
+                                 * and CRYPTO_LOCK_MALLOC, we'll still be in the right
+                                 * "case" and "if" branch because MemCheck_start and
+                                 * MemCheck_stop may never be used while there are multiple
+                                 * OpenSSL threads. */
+                                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC2);
+                                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
+                                disabling_thread=CRYPTO_thread_id();
+                                }
+                        }
+                break;
+        case CRYPTO_MEM_CHECK_ENABLE: /* aka MemCheck_on() */
+                if (mh_mode & CRYPTO_MEM_CHECK_ON)
+                        {
+                        mh_mode|=CRYPTO_MEM_CHECK_ENABLE;
+                        if (disabling_thread != 0)
+                                {
+                                disabling_thread=0;
+                                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC2);
+                                }
+                        }
+                break;
+
+        default:
+                break;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
+        return(ret);
+        }
+
+int CRYPTO_is_mem_check_on(void)
+        {
+        int ret = 0;
+
+        if (mh_mode & CRYPTO_MEM_CHECK_ON)
+                {
+                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
+
+                ret = (mh_mode & CRYPTO_MEM_CHECK_ENABLE)
+                        && disabling_thread != CRYPTO_thread_id();
+
+                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
+                }
+        return(ret);
+        }       
+
+
+void CRYPTO_dbg_set_options(long bits)
+        {
+        options = bits;
+        }
+
+long CRYPTO_dbg_get_options(void)
+        {
+        return options;
+        }
+
+static int mem_cmp(MEM *a, MEM *b)
+        {
+        return(a->addr - b->addr);
+        }
+
+static unsigned long mem_hash(MEM *a)
+        {
+        unsigned long ret;
+
+        ret=(unsigned long)a->addr;
+
+        ret=ret*17851+(ret>>14)*7+(ret>>4)*251;
+        return(ret);
+        }
+
+static int app_info_cmp(APP_INFO *a, APP_INFO *b)
+        {
+        return(a->thread != b->thread);
+        }
+
+static unsigned long app_info_hash(APP_INFO *a)
+        {
+        unsigned long ret;
+
+        ret=(unsigned long)a->thread;
+
+        ret=ret*17851+(ret>>14)*7+(ret>>4)*251;
+        return(ret);
+        }
+
+static APP_INFO *pop_info()
+        {
+        APP_INFO tmp;
+        APP_INFO *ret = NULL;
+
+        if (amih != NULL)
+                {
+                tmp.thread=CRYPTO_thread_id();
+                if ((ret=(APP_INFO *)lh_delete(amih,&tmp)) != NULL)
+                        {
+                        APP_INFO *next=ret->next;
+
+                        if (next != NULL)
+                                {
+                                next->references++;
+                                lh_insert(amih,(char *)next);
+                                }
+#ifdef LEVITTE_DEBUG
+                        if (ret->thread != tmp.thread)
+                                {
+                                fprintf(stderr, "pop_info(): deleted info has other thread ID (%lu) than the current thread (%lu)!!!!\n",
+                                        ret->thread, tmp.thread);
+                                abort();
+                                }
+#endif
+                        if (--(ret->references) <= 0)
+                                {
+                                ret->next = NULL;
+                                if (next != NULL)
+                                        next->references--;
+                                Free(ret);
+                                }
+                        }
+                }
+        return(ret);
+        }
+
+int CRYPTO_push_info_(const char *info, const char *file, int line)
+        {
+        APP_INFO *ami, *amim;
+        int ret=0;
+
+        if (is_MemCheck_on())
+                {
+                MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+
+                if ((ami = (APP_INFO *)Malloc(sizeof(APP_INFO))) == NULL)
+                        {
+                        ret=0;
+                        goto err;
+                        }
+                if (amih == NULL)
+                        {
+                        if ((amih=lh_new(app_info_hash,app_info_cmp)) == NULL)
+                                {
+                                Free(ami);
+                                ret=0;
+                                goto err;
+                                }
+                        }
+
+                ami->thread=CRYPTO_thread_id();
+                ami->file=file;
+                ami->line=line;
+                ami->info=info;
+                ami->references=1;
+                ami->next=NULL;
+
+                if ((amim=(APP_INFO *)lh_insert(amih,(char *)ami)) != NULL)
+                        {
+#ifdef LEVITTE_DEBUG
+                        if (ami->thread != amim->thread)
+                                {
+                                fprintf(stderr, "CRYPTO_push_info(): previous info has other thread ID (%lu) than the current thread (%lu)!!!!\n",
+                                        amim->thread, ami->thread);
+                                abort();
+                                }
+#endif
+                        ami->next=amim;
+                        }
+ err:
+                MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                }
+
+        return(ret);
+        }
+
+int CRYPTO_pop_info(void)
+        {
+        int ret=0;
+
+        if (is_MemCheck_on()) /* _must_ be true, or something went severely wrong */
+                {
+                MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+
+                ret=(pop_info() != NULL);
+
+                MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                }
+        return(ret);
+        }
+
+int CRYPTO_remove_all_info(void)
+        {
+        int ret=0;
+
+        if (is_MemCheck_on()) /* _must_ be true */
+                {
+                MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+
+                while(pop_info() != NULL)
+                        ret++;
+
+                MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                }
+        return(ret);
+        }
+
+
+static unsigned long break_order_num=0;
+void CRYPTO_dbg_malloc(void *addr, int num, const char *file, int line,
+        int before_p)
+        {
+        MEM *m,*mm;
+        APP_INFO tmp,*amim;
+
+        switch(before_p & 127)
+                {
+        case 0:
+                break;
+        case 1:
+                if (addr == NULL)
+                        break;
+
+                if (is_MemCheck_on())
+                        {
+                        MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+                        if ((m=(MEM *)Malloc(sizeof(MEM))) == NULL)
+                                {
+                                Free(addr);
+                                MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                                return;
+                                }
+                        if (mh == NULL)
+                                {
+                                if ((mh=lh_new(mem_hash,mem_cmp)) == NULL)
+                                        {
+                                        Free(addr);
+                                        Free(m);
+                                        addr=NULL;
+                                        goto err;
+                                        }
+                                }
+
+                        m->addr=addr;
+                        m->file=file;
+                        m->line=line;
+                        m->num=num;
+                        if (options & V_CRYPTO_MDEBUG_THREAD)
+                                m->thread=CRYPTO_thread_id();
+                        else
+                                m->thread=0;
+
+                        if (order == break_order_num)
+                                {
+                                /* BREAK HERE */
+                                m->order=order;
+                                }
+                        m->order=order++;
+#ifdef LEVITTE_DEBUG
+                        fprintf(stderr, "LEVITTE_DEBUG: [%5d] %c 0x%p (%d)\n",
+                                m->order,
+                                (before_p & 128) ? '*' : '+',
+                                m->addr, m->num);
+#endif
+                        if (options & V_CRYPTO_MDEBUG_TIME)
+                                m->time=time(NULL);
+                        else
+                                m->time=0;
+
+                        tmp.thread=CRYPTO_thread_id();
+                        m->app_info=NULL;
+                        if (amih != NULL
+                                && (amim=(APP_INFO *)lh_retrieve(amih,(char *)&tmp)) != NULL)
+                                {
+                                m->app_info = amim;
+                                amim->references++;
+                                }
+
+                        if ((mm=(MEM *)lh_insert(mh,(char *)m)) != NULL)
+                                {
+                                /* Not good, but don't sweat it */
+                                if (mm->app_info != NULL)
+                                        {
+                                        mm->app_info->references--;
+                                        }
+                                Free(mm);
+                                }
+                err:
+                        MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                        }
+                break;
+                }
+        return;
+        }
+
+void CRYPTO_dbg_free(void *addr, int before_p)
+        {
+        MEM m,*mp;
+
+        switch(before_p)
+                {
+        case 0:
+                if (addr == NULL)
+                        break;
+
+                if (is_MemCheck_on() && (mh != NULL))
+                        {
+                        MemCheck_off();
+
+                        m.addr=addr;
+                        mp=(MEM *)lh_delete(mh,(char *)&m);
+                        if (mp != NULL)
+                                {
+#ifdef LEVITTE_DEBUG
+                        fprintf(stderr, "LEVITTE_DEBUG: [%5d] - 0x%p (%d)\n",
+                                mp->order, mp->addr, mp->num);
+#endif
+                                if (mp->app_info != NULL)
+                                        {
+                                        mp->app_info->references--;
+                                        }
+                                Free(mp);
+                                }
+
+                        MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                        }
+                break;
+        case 1:
+                break;
+                }
+        }
+
+void CRYPTO_dbg_realloc(void *addr1, void *addr2, int num,
+        const char *file, int line, int before_p)
+        {
+        MEM m,*mp;
+
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG: --> CRYPTO_dbg_malloc(addr1 = %p, addr2 = %p, num = %d, file = \"%s\", line = %d, before_p = %d)\n",
+                addr1, addr2, num, file, line, before_p);
+#endif
+
+        switch(before_p)
+                {
+        case 0:
+                break;
+        case 1:
+                if (addr2 == NULL)
+                        break;
+
+                if (addr1 == NULL)
+                        {
+                        CRYPTO_dbg_malloc(addr2, num, file, line, 128 | before_p);
+                        break;
+                        }
+
+                if (is_MemCheck_on())
+                        {
+                        MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+
+                        m.addr=addr1;
+                        mp=(MEM *)lh_delete(mh,(char *)&m);
+                        if (mp != NULL)
+                                {
+#ifdef LEVITTE_DEBUG
+                                fprintf(stderr, "LEVITTE_DEBUG: [%5d] * 0x%p (%d) -> 0x%p (%d)\n",
+                                        mp->order,
+                                        mp->addr, mp->num,
+                                        addr2, num);
+#endif
+                                mp->addr=addr2;
+                                mp->num=num;
+                                lh_insert(mh,(char *)mp);
+                                }
+
+                        MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                        }
+                break;
+                }
+        return;
+        }
+
+
+typedef struct mem_leak_st
+        {
+        BIO *bio;
+        int chunks;
+        long bytes;
+        } MEM_LEAK;
+
+static void print_leak(MEM *m, MEM_LEAK *l)
+        {
+        char buf[1024];
+        char *bufp = buf;
+        APP_INFO *amip;
+        int ami_cnt;
+        struct tm *lcl = NULL;
+        unsigned long ti;
+
+        if(m->addr == (char *)l->bio)
+            return;
+
+        if (options & V_CRYPTO_MDEBUG_TIME)
+                {
+                lcl = localtime(&m->time);
+        
+                sprintf(bufp, "[%02d:%02d:%02d] ",
+                        lcl->tm_hour,lcl->tm_min,lcl->tm_sec);
+                bufp += strlen(bufp);
+                }
+
+        sprintf(bufp, "%5lu file=%s, line=%d, ",
+                m->order,m->file,m->line);
+        bufp += strlen(bufp);
+
+        if (options & V_CRYPTO_MDEBUG_THREAD)
+                {
+                sprintf(bufp, "thread=%lu, ", m->thread);
+                bufp += strlen(bufp);
+                }
+
+        sprintf(bufp, "number=%d, address=%08lX\n",
+                m->num,(unsigned long)m->addr);
+        bufp += strlen(bufp);
+
+        BIO_puts(l->bio,buf);
+        
+        l->chunks++;
+        l->bytes+=m->num;
+
+        amip=m->app_info;
+        ami_cnt=0;
+        if (!amip)
+                return;
+        ti=amip->thread;
+        
+        do
+                {
+                int buf_len;
+                int info_len;
+
+                ami_cnt++;
+                memset(buf,'>',ami_cnt);
+                sprintf(buf + ami_cnt,
+                        " thread=%lu, file=%s, line=%d, info=\"",
+                        amip->thread, amip->file, amip->line);
+                buf_len=strlen(buf);
+                info_len=strlen(amip->info);
+                if (128 - buf_len - 3 < info_len)
+                        {
+                        memcpy(buf + buf_len, amip->info, 128 - buf_len - 3);
+                        buf_len = 128 - 3;
+                        }
+                else
+                        {
+                        strcpy(buf + buf_len, amip->info);
+                        buf_len = strlen(buf);
+                        }
+                sprintf(buf + buf_len, "\"\n");
+                
+                BIO_puts(l->bio,buf);
+
+                amip = amip->next;
+                }
+        while(amip && amip->thread == ti);
+                
+#ifdef LEVITTE_DEBUG
+        if (amip)
+                {
+                fprintf(stderr, "Thread switch detected in backtrace!!!!\n");
+                abort();
+                }
+#endif
+        }
+
+void CRYPTO_mem_leaks(BIO *b)
+        {
+        MEM_LEAK ml;
+        char buf[80];
+
+        if (mh == NULL) return;
+        ml.bio=b;
+        ml.bytes=0;
+        ml.chunks=0;
+        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC2);
+        lh_doall_arg(mh,(void (*)())print_leak,(char *)&ml);
+        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC2);
+        if (ml.chunks != 0)
+                {
+                sprintf(buf,"%ld bytes leaked in %d chunks\n",
+                        ml.bytes,ml.chunks);
+                BIO_puts(b,buf);
+                }
+
+#if 0
+        lh_stats_bio(mh,b);
+        lh_node_stats_bio(mh,b);
+        lh_node_usage_stats_bio(mh,b);
+#endif
+        }
+
+union void_fn_to_char_u
+        {
+        char *char_p;
+        void (*fn_p)();
+        };
+
+static void cb_leak(MEM *m, char *cb)
+        {
+        union void_fn_to_char_u mem_callback;
+
+        mem_callback.char_p=cb;
+        mem_callback.fn_p(m->order,m->file,m->line,m->num,m->addr);
+        }
+
+void CRYPTO_mem_leaks_cb(void (*cb)())
+        {
+        union void_fn_to_char_u mem_cb;
+
+        if (mh == NULL) return;
+        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC2);
+        mem_cb.fn_p=cb;
+        lh_doall_arg(mh,(void (*)())cb_leak,mem_cb.char_p);
+        mem_cb.char_p=NULL;
+        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC2);
+        }
+
+#ifndef NO_FP_API
+void CRYPTO_mem_leaks_fp(FILE *fp)
+        {
+        BIO *b;
+
+        if (mh == NULL) return;
+        if ((b=BIO_new(BIO_s_file())) == NULL)
+                return;
+        BIO_set_fp(b,fp,BIO_NOCLOSE);
+        CRYPTO_mem_leaks(b);
+        BIO_free(b);
+        }
+#endif
+
diff --git a/src/lib/libcrypto/objects/Makefile.ssl b/src/lib/libcrypto/objects/Makefile.ssl
index 53450f8754..f05e15df96 100644
--- a/src/lib/libcrypto/objects/Makefile.ssl
+++ b/src/lib/libcrypto/objects/Makefile.ssl
@@ -37,9 +37,6 @@ top:
 
 all:    obj_dat.h lib
 
-obj_dat.h: objects.h obj_dat.pl
-        $(PERL) ./obj_dat.pl < objects.h > obj_dat.h
-
 lib:    $(LIBOBJ)
         $(AR) $(LIB) $(LIBOBJ)
         $(RANLIB) $(LIB)
diff --git a/src/lib/libcrypto/objects/o_names.c b/src/lib/libcrypto/objects/o_names.c
index 4da5e45b9c..d654eb220e 100644
--- a/src/lib/libcrypto/objects/o_names.c
+++ b/src/lib/libcrypto/objects/o_names.c
@@ -4,15 +4,25 @@
 
 #include <openssl/lhash.h>
 #include <openssl/objects.h>
+#include <openssl/safestack.h>
 
 /* I use the ex_data stuff to manage the identifiers for the obj_name_types
  * that applications may define.  I only really use the free function field.
  */
 static LHASH *names_lh=NULL;
 static int names_type_num=OBJ_NAME_TYPE_NUM;
-static STACK *names_cmp=NULL;
-static STACK *names_hash=NULL;
-static STACK *names_free=NULL;
+
+typedef struct name_funcs_st
+        {
+        unsigned long (*hash_func)();
+        int (*cmp_func)();
+        void (*free_func)();
+        } NAME_FUNCS;
+
+DECLARE_STACK_OF(NAME_FUNCS)
+IMPLEMENT_STACK_OF(NAME_FUNCS)
+
+STACK_OF(NAME_FUNCS) *name_funcs_stack;
 
 static unsigned long obj_name_hash(OBJ_NAME *a);
 static int obj_name_cmp(OBJ_NAME *a,OBJ_NAME *b);
@@ -31,51 +41,57 @@ int OBJ_NAME_new_index(unsigned long (*hash_func)(), int (*cmp_func)(),
         {
         int ret;
         int i;
+        NAME_FUNCS *name_funcs;
 
-        if (names_free == NULL)
+        if (name_funcs_stack == NULL)
                 {
                 MemCheck_off();
-                names_hash=sk_new_null();
-                names_cmp=sk_new_null();
-                names_free=sk_new_null();
+                name_funcs_stack=sk_NAME_FUNCS_new_null();
                 MemCheck_on();
                 }
-        if ((names_free == NULL) || (names_hash == NULL) || (names_cmp == NULL))
+        if ((name_funcs_stack == NULL))
                 {
                 /* ERROR */
                 return(0);
                 }
         ret=names_type_num;
         names_type_num++;
-        for (i=sk_num(names_free); i<names_type_num; i++)
+        for (i=sk_NAME_FUNCS_num(name_funcs_stack); i<names_type_num; i++)
                 {
                 MemCheck_off();
-                sk_push(names_hash,(char *)strcmp);
-                sk_push(names_cmp,(char *)lh_strhash);
-                sk_push(names_free,NULL);
+                name_funcs = Malloc(sizeof(NAME_FUNCS));
+                name_funcs->hash_func = lh_strhash;
+                name_funcs->cmp_func = (int (*)())strcmp;
+                name_funcs->free_func = 0; /* NULL is often declared to
+                                            * ((void *)0), which according
+                                            * to Compaq C is not really
+                                            * compatible with a function
+                                            * pointer.  -- Richard Levitte*/
+                sk_NAME_FUNCS_push(name_funcs_stack,name_funcs);
                 MemCheck_on();
                 }
+        name_funcs = sk_NAME_FUNCS_value(name_funcs_stack, ret);
         if (hash_func != NULL)
-                sk_set(names_hash,ret,(char *)hash_func);
+                name_funcs->hash_func = hash_func;
         if (cmp_func != NULL)
-                sk_set(names_cmp,ret,(char *)cmp_func);
+                name_funcs->cmp_func = cmp_func;
         if (free_func != NULL)
-                sk_set(names_free,ret,(char *)free_func);
+                name_funcs->free_func = free_func;
         return(ret);
         }
 
 static int obj_name_cmp(OBJ_NAME *a, OBJ_NAME *b)
         {
         int ret;
-        int (*cmp)();
 
         ret=a->type-b->type;
         if (ret == 0)
                 {
-                if ((names_cmp != NULL) && (sk_num(names_cmp) > a->type))
+                if ((name_funcs_stack != NULL)
+                        && (sk_NAME_FUNCS_num(name_funcs_stack) > a->type))
                         {
-                        cmp=(int (*)())sk_value(names_cmp,a->type);
-                        ret=cmp(a->name,b->name);
+                        ret=sk_NAME_FUNCS_value(name_funcs_stack,a->type)
+                                ->cmp_func(a->name,b->name);
                         }
                 else
                         ret=strcmp(a->name,b->name);
@@ -86,12 +102,11 @@ static int obj_name_cmp(OBJ_NAME *a, OBJ_NAME *b)
 static unsigned long obj_name_hash(OBJ_NAME *a)
         {
         unsigned long ret;
-        unsigned long (*hash)();
 
-        if ((names_hash != NULL) && (sk_num(names_hash) > a->type))
+        if ((name_funcs_stack != NULL) && (sk_NAME_FUNCS_num(name_funcs_stack) > a->type))
                 {
-                hash=(unsigned long (*)())sk_value(names_hash,a->type);
-                ret=hash(a->name);
+                ret=sk_NAME_FUNCS_value(name_funcs_stack,a->type)
+                        ->hash_func(a->name);
                 }
         else
                 {
@@ -117,7 +132,7 @@ const char *OBJ_NAME_get(const char *name, int type)
 
         for (;;)
                 {
-                ret=(OBJ_NAME *)lh_retrieve(names_lh,(char *)&on);
+                ret=(OBJ_NAME *)lh_retrieve(names_lh,&on);
                 if (ret == NULL) return(NULL);
                 if ((ret->alias) && !alias)
                         {
@@ -133,7 +148,6 @@ const char *OBJ_NAME_get(const char *name, int type)
 
 int OBJ_NAME_add(const char *name, int type, const char *data)
         {
-        void (*f)();
         OBJ_NAME *onp,*ret;
         int alias;
 
@@ -154,16 +168,20 @@ int OBJ_NAME_add(const char *name, int type, const char *data)
         onp->type=type;
         onp->data=data;
 
-        ret=(OBJ_NAME *)lh_insert(names_lh,(char *)onp);
+        ret=(OBJ_NAME *)lh_insert(names_lh,onp);
         if (ret != NULL)
                 {
                 /* free things */
-                if ((names_free != NULL) && (sk_num(names_free) > ret->type))
+                if ((name_funcs_stack != NULL) && (sk_NAME_FUNCS_num(name_funcs_stack) > ret->type))
                         {
-                        f=(void (*)())sk_value(names_free,ret->type);
-                        f(ret->name,ret->type,ret->data);
+                        /* XXX: I'm not sure I understand why the free
+                         * function should get three arguments...
+                         * -- Richard Levitte
+                         */
+                        sk_NAME_FUNCS_value(name_funcs_stack,ret->type)
+                                ->free_func(ret->name,ret->type,ret->data);
                         }
-                Free((char *)ret);
+                Free(ret);
                 }
         else
                 {
@@ -179,23 +197,26 @@ int OBJ_NAME_add(const char *name, int type, const char *data)
 int OBJ_NAME_remove(const char *name, int type)
         {
         OBJ_NAME on,*ret;
-        void (*f)();
 
         if (names_lh == NULL) return(0);
 
         type&= ~OBJ_NAME_ALIAS;
         on.name=name;
         on.type=type;
-        ret=(OBJ_NAME *)lh_delete(names_lh,(char *)&on);
+        ret=(OBJ_NAME *)lh_delete(names_lh,&on);
         if (ret != NULL)
                 {
                 /* free things */
-                if ((names_free != NULL) && (sk_num(names_free) > type))
+                if ((name_funcs_stack != NULL) && (sk_NAME_FUNCS_num(name_funcs_stack) > ret->type))
                         {
-                        f=(void (*)())sk_value(names_free,type);
-                        f(ret->name,ret->type,ret->data);
+                        /* XXX: I'm not sure I understand why the free
+                         * function should get three arguments...
+                         * -- Richard Levitte
+                         */
+                        sk_NAME_FUNCS_value(name_funcs_stack,ret->type)
+                                ->free_func(ret->name,ret->type,ret->data);
                         }
-                Free((char *)ret);
+                Free(ret);
                 return(1);
                 }
         else
@@ -215,6 +236,11 @@ static void names_lh_free(OBJ_NAME *onp, int type)
                 }
         }
 
+static void name_funcs_free(NAME_FUNCS *ptr)
+        {
+        Free(ptr);
+        }
+
 void OBJ_NAME_cleanup(int type)
         {
         unsigned long down_load;
@@ -229,13 +255,9 @@ void OBJ_NAME_cleanup(int type)
         if (type < 0)
                 {
                 lh_free(names_lh);
-                sk_free(names_hash);
-                sk_free(names_cmp);
-                sk_free(names_free);
+                sk_NAME_FUNCS_pop_free(name_funcs_stack,name_funcs_free);
                 names_lh=NULL;
-                names_hash=NULL;
-                names_cmp=NULL;
-                names_free=NULL;
+                name_funcs_stack = NULL;
                 }
         else
                 names_lh->down_load=down_load;
diff --git a/src/lib/libcrypto/objects/obj_dat.c b/src/lib/libcrypto/objects/obj_dat.c
index d47b874399..da6df3762a 100644
--- a/src/lib/libcrypto/objects/obj_dat.c
+++ b/src/lib/libcrypto/objects/obj_dat.c
@@ -214,16 +214,12 @@ int OBJ_new_nid(int num)
 int OBJ_add_object(ASN1_OBJECT *obj)
         {
         ASN1_OBJECT *o;
-        ADDED_OBJ *ao[4],*aop;
+        ADDED_OBJ *ao[4]={NULL,NULL,NULL,NULL},*aop;
         int i;
 
         if (added == NULL)
                 if (!init_added()) return(0);
         if ((o=OBJ_dup(obj)) == NULL) goto err;
-        ao[ADDED_DATA]=NULL;
-        ao[ADDED_SNAME]=NULL;
-        ao[ADDED_LNAME]=NULL;
-        ao[ADDED_NID]=NULL;
         ao[ADDED_NID]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));
         if ((o->length != 0) && (obj->data != NULL))
                 ao[ADDED_DATA]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));
@@ -238,7 +234,7 @@ int OBJ_add_object(ASN1_OBJECT *obj)
                         {
                         ao[i]->type=i;
                         ao[i]->obj=o;
-                        aop=(ADDED_OBJ *)lh_insert(added,(char *)ao[i]);
+                        aop=(ADDED_OBJ *)lh_insert(added,ao[i]);
                         /* memory leak, buit should not normally matter */
                         if (aop != NULL)
                                 Free(aop);
@@ -276,7 +272,7 @@ ASN1_OBJECT *OBJ_nid2obj(int n)
                 ad.type=ADDED_NID;
                 ad.obj= &ob;
                 ob.nid=n;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL)
                         return(adp->obj);
                 else
@@ -308,7 +304,7 @@ const char *OBJ_nid2sn(int n)
                 ad.type=ADDED_NID;
                 ad.obj= &ob;
                 ob.nid=n;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL)
                         return(adp->obj->sn);
                 else
@@ -340,7 +336,7 @@ const char *OBJ_nid2ln(int n)
                 ad.type=ADDED_NID;
                 ad.obj= &ob;
                 ob.nid=n;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL)
                         return(adp->obj->ln);
                 else
@@ -365,7 +361,7 @@ int OBJ_obj2nid(ASN1_OBJECT *a)
                 {
                 ad.type=ADDED_DATA;
                 ad.obj=a;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL) return (adp->obj->nid);
                 }
         op=(ASN1_OBJECT **)OBJ_bsearch((char *)&a,(char *)obj_objs,NUM_OBJ,
@@ -504,7 +500,7 @@ int OBJ_ln2nid(const char *s)
                 {
                 ad.type=ADDED_LNAME;
                 ad.obj= &o;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL) return (adp->obj->nid);
                 }
         op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)ln_objs,NUM_LN,
@@ -523,7 +519,7 @@ int OBJ_sn2nid(const char *s)
                 {
                 ad.type=ADDED_SNAME;
                 ad.obj= &o;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL) return (adp->obj->nid);
                 }
         op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)sn_objs,NUM_SN,
@@ -647,7 +643,7 @@ int OBJ_create(char *oid, char *sn, char *ln)
         ok=OBJ_add_object(op);
 err:
         ASN1_OBJECT_free(op);
-        Free((char *)buf);
+        Free(buf);
         return(ok);
         }
 
diff --git a/src/lib/libcrypto/objects/obj_dat.pl b/src/lib/libcrypto/objects/obj_dat.pl
index 5043daef2a..e6e3c3b9c0 100644
--- a/src/lib/libcrypto/objects/obj_dat.pl
+++ b/src/lib/libcrypto/objects/obj_dat.pl
@@ -38,7 +38,10 @@ sub expand_obj
         return(%objn);
         }
 
-while (<>)
+open (IN,"$ARGV[0]") || die "Can't open input file $ARGV[0]";
+open (OUT,">$ARGV[1]") || die "Can't open output file $ARGV[1]";
+
+while (<IN>)
         {
         next unless /^\#define\s+(\S+)\s+(.*)$/;
         $v=$1;
@@ -55,6 +58,7 @@ while (<>)
                 $objd{$v}=$d;
                 }
         }
+close IN;
 
 %ob=&expand_obj(*objd);
 
@@ -132,7 +136,7 @@ foreach (sort obj_cmp @a)
         push(@ob,sprintf("&(nid_objs[%2d]),/* %-32s %s */\n",$_,$m,$v));
         }
 
-print <<'EOF';
+print OUT <<'EOF';
 /* lib/obj/obj_dat.h */
 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
@@ -193,21 +197,21 @@ print <<'EOF';
 
 /* THIS FILE IS GENERATED FROM Objects.h by obj_dat.pl via the
  * following command:
- * perl obj_dat.pl < objects.h > obj_dat.h
+ * perl obj_dat.pl objects.h obj_dat.h
  */
 
 EOF
 
-printf "#define NUM_NID %d\n",$n;
-printf "#define NUM_SN %d\n",$#sn+1;
-printf "#define NUM_LN %d\n",$#ln+1;
-printf "#define NUM_OBJ %d\n\n",$#ob+1;
+printf OUT "#define NUM_NID %d\n",$n;
+printf OUT "#define NUM_SN %d\n",$#sn+1;
+printf OUT "#define NUM_LN %d\n",$#ln+1;
+printf OUT "#define NUM_OBJ %d\n\n",$#ob+1;
 
-printf "static unsigned char lvalues[%d]={\n",$lvalues+1;
-print @lvalues;
-print "};\n\n";
+printf OUT "static unsigned char lvalues[%d]={\n",$lvalues+1;
+print OUT @lvalues;
+print OUT "};\n\n";
 
-printf "static ASN1_OBJECT nid_objs[NUM_NID]={\n";
+printf OUT "static ASN1_OBJECT nid_objs[NUM_NID]={\n";
 foreach (@out)
         {
         if (length($_) > 75)
@@ -218,30 +222,32 @@ foreach (@out)
                         $t=$out.$_.",";
                         if (length($t) > 70)
                                 {
-                                print "$out\n";
+                                print OUT "$out\n";
                                 $t="\t$_,";
                                 }
                         $out=$t;
                         }
                 chop $out;
-                print "$out";
+                print OUT "$out";
                 }
         else
-                { print $_; }
+                { print OUT $_; }
         }
-print  "};\n\n";
+print  OUT "};\n\n";
+
+printf OUT "static ASN1_OBJECT *sn_objs[NUM_SN]={\n";
+print  OUT @sn;
+print  OUT "};\n\n";
 
-printf "static ASN1_OBJECT *sn_objs[NUM_SN]={\n";
-print  @sn;
-print  "};\n\n";
+printf OUT "static ASN1_OBJECT *ln_objs[NUM_LN]={\n";
+print  OUT @ln;
+print  OUT "};\n\n";
 
-printf "static ASN1_OBJECT *ln_objs[NUM_LN]={\n";
-print  @ln;
-print  "};\n\n";
+printf OUT "static ASN1_OBJECT *obj_objs[NUM_OBJ]={\n";
+print  OUT @ob;
+print  OUT "};\n\n";
 
-printf "static ASN1_OBJECT *obj_objs[NUM_OBJ]={\n";
-print  @ob;
-print  "};\n\n";
+close OUT;
 
 sub der_it
         {
diff --git a/src/lib/libcrypto/objects/objects.h b/src/lib/libcrypto/objects/objects.h
index d03748e022..d1a5ad2502 100644
--- a/src/lib/libcrypto/objects/objects.h
+++ b/src/lib/libcrypto/objects/objects.h
@@ -110,10 +110,12 @@ extern "C" {
 #define NID_md5WithRSAEncryption        8
 #define OBJ_md5WithRSAEncryption        OBJ_pkcs,1L,4L
 
+#define SN_pbeWithMD2AndDES_CBC         "PBE-MD2-DES"
 #define LN_pbeWithMD2AndDES_CBC         "pbeWithMD2AndDES-CBC"
 #define NID_pbeWithMD2AndDES_CBC        9
 #define OBJ_pbeWithMD2AndDES_CBC        OBJ_pkcs,5L,1L
 
+#define SN_pbeWithMD5AndDES_CBC         "PBE-MD5-DES"
 #define LN_pbeWithMD5AndDES_CBC         "pbeWithMD5AndDES-CBC"
 #define NID_pbeWithMD5AndDES_CBC        10
 #define OBJ_pbeWithMD5AndDES_CBC        OBJ_pkcs,5L,3L
@@ -230,6 +232,7 @@ extern "C" {
 #define SN_idea_cbc                     "IDEA-CBC"
 #define LN_idea_cbc                     "idea-cbc"
 #define NID_idea_cbc                    34
+#define OBJ_idea_cbc                    1L,3L,6L,1L,4L,1L,188L,7L,1L,1L,2L
 
 #define SN_idea_cfb64                   "IDEA-CFB"
 #define LN_idea_cfb64                   "idea-cfb"
@@ -380,6 +383,7 @@ extern "C" {
 #define OBJ_dsa_2                       OBJ_algorithm,12L
 
 /* proposed by microsoft to RSA */
+#define SN_pbeWithSHA1AndRC2_CBC        "PBE-SHA1-RC2-64"
 #define LN_pbeWithSHA1AndRC2_CBC        "pbeWithSHA1AndRC2-CBC"
 #define NID_pbeWithSHA1AndRC2_CBC       68
 #define OBJ_pbeWithSHA1AndRC2_CBC       OBJ_pkcs,5L,11L 
@@ -499,6 +503,7 @@ extern "C" {
 #define SN_bf_cbc                       "BF-CBC"
 #define LN_bf_cbc                       "bf-cbc"
 #define NID_bf_cbc                      91
+#define OBJ_bf_cbc                      1L,3L,6L,1L,4L,1L,3029L,1L,2L
 
 #define SN_bf_ecb                       "BF-ECB"
 #define LN_bf_ecb                       "bf-ecb"
@@ -627,7 +632,7 @@ extern "C" {
 #define OBJ_ripemd160                   1L,3L,36L,3L,2L,1L
 
 /* The name should actually be rsaSignatureWithripemd160, but I'm going
- * to contiune using the convention I'm using with the other ciphers */
+ * to continue using the convention I'm using with the other ciphers */
 #define SN_ripemd160WithRSA             "RSA-RIPEMD160"
 #define LN_ripemd160WithRSA             "ripemd160WithRSA"
 #define NID_ripemd160WithRSA            119
@@ -661,12 +666,12 @@ extern "C" {
 #define SN_rle_compression              "RLE"
 #define LN_rle_compression              "run length compression"
 #define NID_rle_compression             124
-#define OBJ_rle_compression             1L,1L,1L,1L,666L.1L
+#define OBJ_rle_compression             1L,1L,1L,1L,666L,1L
 
 #define SN_zlib_compression             "ZLIB"
 #define LN_zlib_compression             "zlib compression"
 #define NID_zlib_compression            125
-#define OBJ_zlib_compression            1L,1L,1L,1L,666L.2L
+#define OBJ_zlib_compression            1L,1L,1L,1L,666L,2L
 
 #define SN_ext_key_usage                "extendedKeyUsage"
 #define LN_ext_key_usage                "X509v3 Extended Key Usage"
@@ -735,7 +740,7 @@ extern "C" {
 #define NID_ms_efs                      138
 #define OBJ_ms_efs                      1L,3L,6L,1L,4L,1L,311L,10L,3L,4L
 
-/* Addidional usage: Netscape */
+/* Additional usage: Netscape */
 
 #define SN_ns_sgc                       "nsSGC"
 #define LN_ns_sgc                       "Netscape Server Gated Crypto"
@@ -767,26 +772,32 @@ extern "C" {
 #define OBJ_pkcs12                      OBJ_pkcs,12L
 #define OBJ_pkcs12_pbeids               OBJ_pkcs12, 1
 
+#define SN_pbe_WithSHA1And128BitRC4     "PBE-SHA1-RC4-128"
 #define LN_pbe_WithSHA1And128BitRC4     "pbeWithSHA1And128BitRC4"
 #define NID_pbe_WithSHA1And128BitRC4    144
 #define OBJ_pbe_WithSHA1And128BitRC4    OBJ_pkcs12_pbeids, 1L
 
+#define SN_pbe_WithSHA1And40BitRC4      "PBE-SHA1-RC4-40"
 #define LN_pbe_WithSHA1And40BitRC4      "pbeWithSHA1And40BitRC4"
 #define NID_pbe_WithSHA1And40BitRC4     145
 #define OBJ_pbe_WithSHA1And40BitRC4     OBJ_pkcs12_pbeids, 2L
 
+#define SN_pbe_WithSHA1And3_Key_TripleDES_CBC   "PBE-SHA1-3DES"
 #define LN_pbe_WithSHA1And3_Key_TripleDES_CBC   "pbeWithSHA1And3-KeyTripleDES-CBC"
 #define NID_pbe_WithSHA1And3_Key_TripleDES_CBC  146
 #define OBJ_pbe_WithSHA1And3_Key_TripleDES_CBC  OBJ_pkcs12_pbeids, 3L
 
+#define SN_pbe_WithSHA1And2_Key_TripleDES_CBC   "PBE-SHA1-2DES"
 #define LN_pbe_WithSHA1And2_Key_TripleDES_CBC   "pbeWithSHA1And2-KeyTripleDES-CBC"
 #define NID_pbe_WithSHA1And2_Key_TripleDES_CBC  147
 #define OBJ_pbe_WithSHA1And2_Key_TripleDES_CBC  OBJ_pkcs12_pbeids, 4L
 
+#define SN_pbe_WithSHA1And128BitRC2_CBC         "PBE-SHA1-RC2-128"
 #define LN_pbe_WithSHA1And128BitRC2_CBC         "pbeWithSHA1And128BitRC2-CBC"
 #define NID_pbe_WithSHA1And128BitRC2_CBC        148
 #define OBJ_pbe_WithSHA1And128BitRC2_CBC        OBJ_pkcs12_pbeids, 5L
 
+#define SN_pbe_WithSHA1And40BitRC2_CBC  "PBE-SHA1-RC2-40"
 #define LN_pbe_WithSHA1And40BitRC2_CBC  "pbeWithSHA1And40BitRC2-CBC"
 #define NID_pbe_WithSHA1And40BitRC2_CBC 149
 #define OBJ_pbe_WithSHA1And40BitRC2_CBC OBJ_pkcs12_pbeids, 6L
@@ -876,20 +887,73 @@ extern "C" {
 #define SN_SMIMECapabilities            "SMIME-CAPS"
 #define LN_SMIMECapabilities            "S/MIME Capabilities"
 #define NID_SMIMECapabilities           167
-#define OBJ_SMIMECapabilities           OBJ_id_pkcs9,15L
+#define OBJ_SMIMECapabilities           OBJ_pkcs9,15L
 
+#define SN_pbeWithMD2AndRC2_CBC         "PBE-MD2-RC2-64"
 #define LN_pbeWithMD2AndRC2_CBC         "pbeWithMD2AndRC2-CBC"
 #define NID_pbeWithMD2AndRC2_CBC        168
 #define OBJ_pbeWithMD2AndRC2_CBC        OBJ_pkcs,5L,4L
 
+#define SN_pbeWithMD5AndRC2_CBC         "PBE-MD5-RC2-64"
 #define LN_pbeWithMD5AndRC2_CBC         "pbeWithMD5AndRC2-CBC"
 #define NID_pbeWithMD5AndRC2_CBC        169
 #define OBJ_pbeWithMD5AndRC2_CBC        OBJ_pkcs,5L,6L
 
+#define SN_pbeWithSHA1AndDES_CBC        "PBE-SHA1-DES"
 #define LN_pbeWithSHA1AndDES_CBC        "pbeWithSHA1AndDES-CBC"
 #define NID_pbeWithSHA1AndDES_CBC       170
 #define OBJ_pbeWithSHA1AndDES_CBC       OBJ_pkcs,5L,10L
 
+/* Extension request OIDs */
+
+#define LN_ms_ext_req                   "Microsoft Extension Request"
+#define SN_ms_ext_req                   "msExtReq"
+#define NID_ms_ext_req                  171
+#define OBJ_ms_ext_req                  1L,3L,6L,1L,4L,1L,311L,2L,1L,14L
+
+#define LN_ext_req                      "Extension Request"
+#define SN_ext_req                      "extReq"
+#define NID_ext_req                     172
+#define OBJ_ext_req                     OBJ_pkcs9,14L
+
+#define SN_name                         "name"
+#define LN_name                         "name"
+#define NID_name                        173
+#define OBJ_name                        OBJ_X509,41L
+
+#define SN_dnQualifier                  "dnQualifier"
+#define LN_dnQualifier                  "dnQualifier"
+#define NID_dnQualifier                 174
+#define OBJ_dnQualifier                 OBJ_X509,46L
+
+#define SN_id_pe                        "id-pe"
+#define NID_id_pe                       175
+#define OBJ_id_pe                       OBJ_id_pkix,1L
+
+#define SN_id_ad                        "id-ad"
+#define NID_id_ad                       176
+#define OBJ_id_ad                       OBJ_id_pkix,48L
+
+#define SN_info_access                  "authorityInfoAccess"
+#define LN_info_access                  "Authority Information Access"
+#define NID_info_access                 177
+#define OBJ_info_access                 OBJ_id_pe,1L
+
+#define SN_ad_OCSP                      "OCSP"
+#define LN_ad_OCSP                      "OCSP"
+#define NID_ad_OCSP                     178
+#define OBJ_ad_OCSP                     OBJ_id_ad,1L
+
+#define SN_ad_ca_issuers                "caIssuers"
+#define LN_ad_ca_issuers                "CA Issuers"
+#define NID_ad_ca_issuers               179
+#define OBJ_ad_ca_issuers               OBJ_id_ad,2L
+
+#define SN_OSCP_sign                    "OCSPSigning"
+#define LN_OCSP_sign                    "OCSP Signing"
+#define NID_OCSP_sign                   180
+#define OBJ_OCSP_sign                   OBJ_id_kp,9L
+
 #include <openssl/bio.h>
 #include <openssl/asn1.h>
 
diff --git a/src/lib/libcrypto/opensslconf.h.in b/src/lib/libcrypto/opensslconf.h.in
index e4a8f8ad54..1b85ae5989 100644
--- a/src/lib/libcrypto/opensslconf.h.in
+++ b/src/lib/libcrypto/opensslconf.h.in
@@ -1,5 +1,4 @@
-/* crypto/opensslconf.h */
-/* WARNING: This file is autogenerated by Configure */
+/* crypto/opensslconf.h.in */
 
 /* Generate 80386 code? */
 #undef I386_ONLY
@@ -25,11 +24,25 @@
 #define RC2_INT unsigned int
 #endif
 
-#if defined(HEADER_RC4_H) && !defined(RC4_INT)
+#if defined(HEADER_RC4_H)
+#if !defined(RC4_INT)
 /* using int types make the structure larger but make the code faster
  * on most boxes I have tested - up to %20 faster. */
+/*
+ * I don't know what does "most" mean, but declaring "int" is a must on:
+ * - Intel P6 because partial register stalls are very expensive;
+ * - elder Alpha because it lacks byte load/store instructions;
+ */
 #define RC4_INT unsigned int
 #endif
+#if !defined(RC4_CHUNK)
+/*
+ * This enables code handling data aligned at natural CPU word
+ * boundary. See crypto/rc4/rc4_enc.c for further details.
+ */
+#undef RC4_CHUNK
+#endif
+#endif
 
 #if defined(HEADER_DES_H) && !defined(DES_LONG)
 /* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
diff --git a/src/lib/libcrypto/opensslv.h b/src/lib/libcrypto/opensslv.h
index b841347f05..55d5d06cf5 100644
--- a/src/lib/libcrypto/opensslv.h
+++ b/src/lib/libcrypto/opensslv.h
@@ -7,15 +7,15 @@
  * 0.9.3-dev      0x00903000
  * 0.9.3beta1     0x00903001
  * 0.9.3beta2-dev 0x00903002
- * 0.9.3beta2     0x00903002
+ * 0.9.3beta2     0x00903002 (same as ...beta2-dev)
  * 0.9.3          0x00903100
  * 0.9.3a         0x00903101
  * 0.9.4          0x00904100
  * 1.2.3z         0x1020311a
  * (Prior to 0.9.3-dev a different scheme was used: 0.9.2b is 0x0922.)
  */
-#define OPENSSL_VERSION_NUMBER  0x00904100L
-#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.4 09 Aug 1999"
+#define OPENSSL_VERSION_NUMBER  0x00905100L
+#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.5 28 Feb 2000"
 #define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
 #endif /* HEADER_OPENSSLV_H */
diff --git a/src/lib/libcrypto/pem/pem.h b/src/lib/libcrypto/pem/pem.h
index fc333e42c8..e4bae0b4aa 100644
--- a/src/lib/libcrypto/pem/pem.h
+++ b/src/lib/libcrypto/pem/pem.h
@@ -103,13 +103,16 @@ extern "C" {
 
 #define PEM_STRING_X509_OLD     "X509 CERTIFICATE"
 #define PEM_STRING_X509         "CERTIFICATE"
+#define PEM_STRING_X509_TRUSTED "TRUSTED CERTIFICATE"
 #define PEM_STRING_X509_REQ_OLD "NEW CERTIFICATE REQUEST"
 #define PEM_STRING_X509_REQ     "CERTIFICATE REQUEST"
 #define PEM_STRING_X509_CRL     "X509 CRL"
 #define PEM_STRING_EVP_PKEY     "ANY PRIVATE KEY"
+#define PEM_STRING_PUBLIC       "PUBLIC KEY"
 #define PEM_STRING_RSA          "RSA PRIVATE KEY"
 #define PEM_STRING_RSA_PUBLIC   "RSA PUBLIC KEY"
 #define PEM_STRING_DSA          "DSA PRIVATE KEY"
+#define PEM_STRING_DSA_PUBLIC   "DSA PUBLIC KEY"
 #define PEM_STRING_PKCS7        "PKCS7"
 #define PEM_STRING_PKCS8        "ENCRYPTED PRIVATE KEY"
 #define PEM_STRING_PKCS8INF     "PRIVATE KEY"
@@ -528,7 +531,10 @@ void	PEM_dek_info(char *buf, const char *type, int len, char *str);
 
 DECLARE_PEM_rw(X509, X509)
 
+DECLARE_PEM_rw(X509_AUX, X509)
+
 DECLARE_PEM_rw(X509_REQ, X509_REQ)
+DECLARE_PEM_write(X509_REQ_NEW, X509_REQ)
 
 DECLARE_PEM_rw(X509_CRL, X509_CRL)
 
@@ -545,6 +551,7 @@ DECLARE_PEM_rw(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO)
 DECLARE_PEM_rw_cb(RSAPrivateKey, RSA)
 
 DECLARE_PEM_rw(RSAPublicKey, RSA)
+DECLARE_PEM_rw(RSA_PUBKEY, RSA)
 
 #endif
 
@@ -552,6 +559,8 @@ DECLARE_PEM_rw(RSAPublicKey, RSA)
 
 DECLARE_PEM_rw_cb(DSAPrivateKey, DSA)
 
+DECLARE_PEM_rw(DSA_PUBKEY, DSA)
+
 DECLARE_PEM_rw(DSAparams, DSA)
 
 #endif
@@ -564,10 +573,36 @@ DECLARE_PEM_rw(DHparams, DH)
 
 DECLARE_PEM_rw_cb(PrivateKey, EVP_PKEY)
 
+DECLARE_PEM_rw(PUBKEY, EVP_PKEY)
+
+int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
 int PEM_write_bio_PKCS8PrivateKey(BIO *, EVP_PKEY *, const EVP_CIPHER *,
                                   char *, int, pem_password_cb *, void *);
+int i2d_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, void *u);
+
+int i2d_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+int PEM_write_PKCS8PrivateKey_nid(FILE *fp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+
+EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void *u);
+
 int PEM_write_PKCS8PrivateKey(FILE *fp,EVP_PKEY *x,const EVP_CIPHER *enc,
                               char *kstr,int klen, pem_password_cb *cd, void *u);
+
 #endif /* SSLEAY_MACROS */
 
 
@@ -579,6 +614,8 @@ int PEM_write_PKCS8PrivateKey(FILE *fp,EVP_PKEY *x,const EVP_CIPHER *enc,
 /* Error codes for the PEM functions. */
 
 /* Function codes. */
+#define PEM_F_D2I_PKCS8PRIVATEKEY_BIO                    120
+#define PEM_F_D2I_PKCS8PRIVATEKEY_FP                     121
 #define PEM_F_DEF_CALLBACK                               100
 #define PEM_F_LOAD_IV                                    101
 #define PEM_F_PEM_ASN1_READ                              102
@@ -586,6 +623,7 @@ int PEM_write_PKCS8PrivateKey(FILE *fp,EVP_PKEY *x,const EVP_CIPHER *enc,
 #define PEM_F_PEM_ASN1_WRITE                             104
 #define PEM_F_PEM_ASN1_WRITE_BIO                         105
 #define PEM_F_PEM_DO_HEADER                              106
+#define PEM_F_PEM_F_DO_PK8KEY_FP                         122
 #define PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY            118
 #define PEM_F_PEM_GET_EVP_CIPHER_INFO                    107
 #define PEM_F_PEM_READ                                   108
diff --git a/src/lib/libcrypto/pem/pem_all.c b/src/lib/libcrypto/pem/pem_all.c
index bc473f3cff..dc9c35b4b4 100644
--- a/src/lib/libcrypto/pem/pem_all.c
+++ b/src/lib/libcrypto/pem/pem_all.c
@@ -65,10 +65,21 @@
 #include <openssl/pkcs7.h>
 #include <openssl/pem.h>
 
+#ifndef NO_RSA
+static RSA *pkey_get_rsa(EVP_PKEY *key, RSA **rsa);
+#endif
+#ifndef NO_DSA
+static DSA *pkey_get_dsa(EVP_PKEY *key, DSA **dsa);
+#endif
+
 IMPLEMENT_PEM_rw(X509, X509, PEM_STRING_X509, X509)
 
+IMPLEMENT_PEM_rw(X509_AUX, X509, PEM_STRING_X509_TRUSTED, X509_AUX)
+
 IMPLEMENT_PEM_rw(X509_REQ, X509_REQ, PEM_STRING_X509_REQ, X509_REQ)
 
+IMPLEMENT_PEM_write(X509_REQ_NEW, X509_REQ, PEM_STRING_X509_REQ_OLD, X509_REQ)
+
 IMPLEMENT_PEM_rw(X509_CRL, X509_CRL, PEM_STRING_X509_CRL, X509_CRL)
 
 IMPLEMENT_PEM_rw(PKCS7, PKCS7, PEM_STRING_PKCS7, PKCS7)
@@ -82,15 +93,92 @@ IMPLEMENT_PEM_rw(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO, PEM_STRING_PKCS8INF,
 
 #ifndef NO_RSA
 
-IMPLEMENT_PEM_rw_cb(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
+/* We treat RSA or DSA private keys as a special case.
+ *
+ * For private keys we read in an EVP_PKEY structure with
+ * PEM_read_bio_PrivateKey() and extract the relevant private
+ * key: this means can handle "traditional" and PKCS#8 formats
+ * transparently.
+ */
+
+static RSA *pkey_get_rsa(EVP_PKEY *key, RSA **rsa)
+{
+        RSA *rtmp;
+        if(!key) return NULL;
+        rtmp = EVP_PKEY_get1_RSA(key);
+        EVP_PKEY_free(key);
+        if(!rtmp) return NULL;
+        if(rsa) {
+                RSA_free(*rsa);
+                *rsa = rtmp;
+        }
+        return rtmp;
+}
+
+RSA *PEM_read_bio_RSAPrivateKey(BIO *bp, RSA **rsa, pem_password_cb *cb,
+                                                                void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_bio_PrivateKey(bp, NULL, cb, u);
+        return pkey_get_rsa(pktmp, rsa);
+}
+
+#ifndef NO_FP_API
+
+RSA *PEM_read_RSAPrivateKey(FILE *fp, RSA **rsa, pem_password_cb *cb,
+                                                                void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
+        return pkey_get_rsa(pktmp, rsa);
+}
+
+#endif
 
+IMPLEMENT_PEM_write_cb(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
 IMPLEMENT_PEM_rw(RSAPublicKey, RSA, PEM_STRING_RSA_PUBLIC, RSAPublicKey)
+IMPLEMENT_PEM_rw(RSA_PUBKEY, RSA, PEM_STRING_PUBLIC, RSA_PUBKEY)
 
 #endif
 
 #ifndef NO_DSA
 
-IMPLEMENT_PEM_rw_cb(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
+static DSA *pkey_get_dsa(EVP_PKEY *key, DSA **dsa)
+{
+        DSA *dtmp;
+        if(!key) return NULL;
+        dtmp = EVP_PKEY_get1_DSA(key);
+        EVP_PKEY_free(key);
+        if(!dtmp) return NULL;
+        if(dsa) {
+                DSA_free(*dsa);
+                *dsa = dtmp;
+        }
+        return dtmp;
+}
+
+DSA *PEM_read_bio_DSAPrivateKey(BIO *bp, DSA **dsa, pem_password_cb *cb,
+                                                                void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_bio_PrivateKey(bp, NULL, cb, u);
+        return pkey_get_dsa(pktmp, dsa);
+}
+
+IMPLEMENT_PEM_write_cb(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
+IMPLEMENT_PEM_rw(DSA_PUBKEY, DSA, PEM_STRING_PUBLIC, DSA_PUBKEY)
+
+#ifndef NO_FP_API
+
+DSA *PEM_read_DSAPrivateKey(FILE *fp, DSA **dsa, pem_password_cb *cb,
+                                                                void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
+        return pkey_get_dsa(pktmp, dsa);
+}
+
+#endif
 
 IMPLEMENT_PEM_rw(DSAparams, DSA, PEM_STRING_DSAPARAMS, DSAparams)
 
@@ -111,3 +199,5 @@ IMPLEMENT_PEM_rw(DHparams, DH, PEM_STRING_DHPARAMS, DHparams)
  */
 IMPLEMENT_PEM_read(PrivateKey, EVP_PKEY, PEM_STRING_EVP_PKEY, PrivateKey)
 IMPLEMENT_PEM_write_cb(PrivateKey, EVP_PKEY, ((x->type == EVP_PKEY_DSA)?PEM_STRING_DSA:PEM_STRING_RSA), PrivateKey)
+
+IMPLEMENT_PEM_rw(PUBKEY, EVP_PKEY, PEM_STRING_PUBLIC, PUBKEY)
diff --git a/src/lib/libcrypto/pem/pem_err.c b/src/lib/libcrypto/pem/pem_err.c
index fa70f60998..642129da20 100644
--- a/src/lib/libcrypto/pem/pem_err.c
+++ b/src/lib/libcrypto/pem/pem_err.c
@@ -65,6 +65,8 @@
 #ifndef NO_ERR
 static ERR_STRING_DATA PEM_str_functs[]=
         {
+{ERR_PACK(0,PEM_F_D2I_PKCS8PRIVATEKEY_BIO,0),   "d2i_PKCS8PrivateKey_bio"},
+{ERR_PACK(0,PEM_F_D2I_PKCS8PRIVATEKEY_FP,0),    "d2i_PKCS8PrivateKey_fp"},
 {ERR_PACK(0,PEM_F_DEF_CALLBACK,0),      "DEF_CALLBACK"},
 {ERR_PACK(0,PEM_F_LOAD_IV,0),   "LOAD_IV"},
 {ERR_PACK(0,PEM_F_PEM_ASN1_READ,0),     "PEM_ASN1_read"},
@@ -72,6 +74,7 @@ static ERR_STRING_DATA PEM_str_functs[]=
 {ERR_PACK(0,PEM_F_PEM_ASN1_WRITE,0),    "PEM_ASN1_write"},
 {ERR_PACK(0,PEM_F_PEM_ASN1_WRITE_BIO,0),        "PEM_ASN1_write_bio"},
 {ERR_PACK(0,PEM_F_PEM_DO_HEADER,0),     "PEM_do_header"},
+{ERR_PACK(0,PEM_F_PEM_F_DO_PK8KEY_FP,0),        "PEM_F_DO_PK8KEY_FP"},
 {ERR_PACK(0,PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY,0),   "PEM_F_PEM_WRITE_PKCS8PRIVATEKEY"},
 {ERR_PACK(0,PEM_F_PEM_GET_EVP_CIPHER_INFO,0),   "PEM_get_EVP_CIPHER_INFO"},
 {ERR_PACK(0,PEM_F_PEM_READ,0),  "PEM_read"},
diff --git a/src/lib/libcrypto/pem/pem_info.c b/src/lib/libcrypto/pem/pem_info.c
index fec18a4c2e..b65239a920 100644
--- a/src/lib/libcrypto/pem/pem_info.c
+++ b/src/lib/libcrypto/pem/pem_info.c
@@ -132,6 +132,17 @@ start:
                                 }
                         pp=(char **)&(xi->x509);
                         }
+                else if ((strcmp(name,PEM_STRING_X509_TRUSTED) == 0))
+                        {
+                        d2i=(char *(*)())d2i_X509_AUX;
+                        if (xi->x509 != NULL)
+                                {
+                                if (!sk_X509_INFO_push(ret,xi)) goto err;
+                                if ((xi=X509_INFO_new()) == NULL) goto err;
+                                goto start;
+                                }
+                        pp=(char **)&(xi->x509);
+                        }
                 else if (strcmp(name,PEM_STRING_X509_CRL) == 0)
                         {
                         d2i=(char *(*)())d2i_X509_CRL;
diff --git a/src/lib/libcrypto/pem/pem_lib.c b/src/lib/libcrypto/pem/pem_lib.c
index 90f02011ba..072211ba0f 100644
--- a/src/lib/libcrypto/pem/pem_lib.c
+++ b/src/lib/libcrypto/pem/pem_lib.c
@@ -75,8 +75,17 @@ const char *PEM_version="PEM" OPENSSL_VERSION_PTEXT;
 
 static int def_callback(char *buf, int num, int w, void *userdata);
 static int load_iv(unsigned char **fromp,unsigned char *to, int num);
-
-static int def_callback(char *buf, int num, int w, void *userdata)
+static int check_pem(const char *nm, const char *name);
+static int do_pk8pkey(BIO *bp, EVP_PKEY *x, int isder,
+                                int nid, const EVP_CIPHER *enc,
+                                char *kstr, int klen,
+                                pem_password_cb *cb, void *u);
+static int do_pk8pkey_fp(FILE *bp, EVP_PKEY *x, int isder,
+                                int nid, const EVP_CIPHER *enc,
+                                char *kstr, int klen,
+                                pem_password_cb *cb, void *u);
+
+static int def_callback(char *buf, int num, int w, void *key)
         {
 #ifdef NO_FP_API
         /* We should not ever call the default callback routine from
@@ -86,6 +95,12 @@ static int def_callback(char *buf, int num, int w, void *userdata)
 #else
         int i,j;
         const char *prompt;
+        if(key) {
+                i=strlen(key);
+                i=(i > num)?num:i;
+                memcpy(buf,key,i);
+                return(i);
+        }
 
         prompt=EVP_get_pw_prompt();
         if (prompt == NULL)
@@ -168,6 +183,47 @@ char *PEM_ASN1_read(char *(*d2i)(), const char *name, FILE *fp, char **x,
         }
 #endif
 
+static int check_pem(const char *nm, const char *name)
+{
+        /* Normal matching nm and name */
+        if (!strcmp(nm,name)) return 1;
+
+        /* Make PEM_STRING_EVP_PKEY match any private key */
+
+        if(!strcmp(nm,PEM_STRING_PKCS8) &&
+                !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_PKCS8INF) &&
+                 !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_RSA) &&
+                !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_DSA) &&
+                 !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
+
+        /* Permit older strings */
+
+        if(!strcmp(nm,PEM_STRING_X509_OLD) &&
+                !strcmp(name,PEM_STRING_X509)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_X509_REQ_OLD) &&
+                !strcmp(name,PEM_STRING_X509_REQ)) return 1;
+
+        /* Allow normal certs to be read as trusted certs */
+        if(!strcmp(nm,PEM_STRING_X509) &&
+                !strcmp(name,PEM_STRING_X509_TRUSTED)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_X509_OLD) &&
+                !strcmp(name,PEM_STRING_X509_TRUSTED)) return 1;
+
+        /* Some CAs use PKCS#7 with CERTIFICATE headers */
+        if(!strcmp(nm, PEM_STRING_X509) &&
+                !strcmp(name, PEM_STRING_PKCS7)) return 1;
+
+        return 0;
+}
+
 char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
              pem_password_cb *cb, void *u)
         {
@@ -179,22 +235,13 @@ char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
 
         for (;;)
                 {
-                if (!PEM_read_bio(bp,&nm,&header,&data,&len)) return(NULL);
-                if (    (strcmp(nm,name) == 0) ||
-                        ((strcmp(nm,PEM_STRING_RSA) == 0) &&
-                         (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_DSA) == 0) &&
-                         (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_PKCS8) == 0) &&
-                         (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_PKCS8INF) == 0) &&
-                         (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_X509_OLD) == 0) &&
-                         (strcmp(name,PEM_STRING_X509) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_X509_REQ_OLD) == 0) &&
-                         (strcmp(name,PEM_STRING_X509_REQ) == 0)) 
-                        )
-                        break;
+                if (!PEM_read_bio(bp,&nm,&header,&data,&len)) {
+                        if(ERR_GET_REASON(ERR_peek_error()) ==
+                                PEM_R_NO_START_LINE)
+                                ERR_add_error_data(2, "Expecting: ", name);
+                        return(NULL);
+                }
+                if(check_pem(nm, name)) break;
                 Free(nm);
                 Free(header);
                 Free(data);
@@ -218,7 +265,7 @@ char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
                         X509_SIG *p8;
                         int klen;
                         char psbuf[PEM_BUFSIZE];
-                        p8 = d2i_X509_SIG((X509_SIG **)x, &p, len);
+                        p8 = d2i_X509_SIG(NULL, &p, len);
                         if(!p8) goto p8err;
                         if (cb) klen=cb(psbuf,PEM_BUFSIZE,0,u);
                         else klen=def_callback(psbuf,PEM_BUFSIZE,0,u);
@@ -231,6 +278,10 @@ char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
                         X509_SIG_free(p8);
                         if(!p8inf) goto p8err;
                         ret = (char *)EVP_PKCS82PKEY(p8inf);
+                        if(x) {
+                                if(*x) EVP_PKEY_free((EVP_PKEY *)*x);
+                                *x = ret;
+                        }
                         PKCS8_PRIV_KEY_INFO_free(p8inf);
                 }
         } else  ret=d2i(x,&p,len);
@@ -321,8 +372,9 @@ int PEM_ASN1_write_bio(int (*i2d)(), const char *name, BIO *bp, char *x,
 #endif
                         kstr=(unsigned char *)buf;
                         }
-                RAND_seed(data,i);/* put in the RSA key. */
-                RAND_bytes(iv,8);       /* Generate a salt */
+                RAND_add(data,i,0);/* put in the RSA key. */
+                if (RAND_bytes(iv,8) <= 0)      /* Generate a salt */
+                        goto err;
                 /* The 'iv' is used as the iv and as a salt.  It is
                  * NOT taken from the BytesToKey function */
                 EVP_BytesToKey(enc,EVP_md5(),iv,kstr,klen,1,key,NULL);
@@ -743,16 +795,44 @@ err:
         return(0);
         }
 
-/* This function writes a private key in PKCS#8 format: it is a "drop in"
- * replacement for PEM_write_bio_PrivateKey(). As usual if 'enc' is NULL then
- * it uses the unencrypted private key form. It uses PKCS#5 v2.0 password based
- * encryption algorithms.
+/* These functions write a private key in PKCS#8 format: it is a "drop in"
+ * replacement for PEM_write_bio_PrivateKey() and friends. As usual if 'enc'
+ * is NULL then it uses the unencrypted private key form. The 'nid' versions
+ * uses PKCS#5 v1.5 PBE algorithms whereas the others use PKCS#5 v2.0.
  */
 
+int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey(bp, x, 0, nid, NULL, kstr, klen, cb, u);
+}
+
 int PEM_write_bio_PKCS8PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
                                   char *kstr, int klen,
                                   pem_password_cb *cb, void *u)
 {
+        return do_pk8pkey(bp, x, 0, -1, enc, kstr, klen, cb, u);
+}
+
+int i2d_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey(bp, x, 1, -1, enc, kstr, klen, cb, u);
+}
+
+int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey(bp, x, 1, nid, NULL, kstr, klen, cb, u);
+}
+
+static int do_pk8pkey(BIO *bp, EVP_PKEY *x, int isder, int nid, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
         X509_SIG *p8;
         PKCS8_PRIV_KEY_INFO *p8inf;
         char buf[PEM_BUFSIZE];
@@ -762,7 +842,7 @@ int PEM_write_bio_PKCS8PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
                                         PEM_R_ERROR_CONVERTING_PRIVATE_KEY);
                 return 0;
         }
-        if(enc) {
+        if(enc || (nid != -1)) {
                 if(!kstr) {
                         if(!cb) klen = def_callback(buf, PEM_BUFSIZE, 1, u);
                         else klen = cb(buf, PEM_BUFSIZE, 1, u);
@@ -775,29 +855,109 @@ int PEM_write_bio_PKCS8PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
                                 
                         kstr = buf;
                 }
-                p8 = PKCS8_encrypt(-1, enc, kstr, klen, NULL, 0, 0, p8inf);
+                p8 = PKCS8_encrypt(nid, enc, kstr, klen, NULL, 0, 0, p8inf);
                 if(kstr == buf) memset(buf, 0, klen);
                 PKCS8_PRIV_KEY_INFO_free(p8inf);
-                ret = PEM_write_bio_PKCS8(bp, p8);
+                if(isder) ret = i2d_PKCS8_bio(bp, p8);
+                else ret = PEM_write_bio_PKCS8(bp, p8);
                 X509_SIG_free(p8);
                 return ret;
         } else {
-                ret = PEM_write_bio_PKCS8_PRIV_KEY_INFO(bp, p8inf);
+                if(isder) ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
+                else ret = PEM_write_bio_PKCS8_PRIV_KEY_INFO(bp, p8inf);
                 PKCS8_PRIV_KEY_INFO_free(p8inf);
                 return ret;
         }
 }
 
+/* Finally the DER version to read PKCS#8 encrypted private keys. It has to be
+ * here to access the default callback.
+ */
+
+EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, void *u)
+{
+        PKCS8_PRIV_KEY_INFO *p8inf = NULL;
+        X509_SIG *p8 = NULL;
+        int klen;
+        EVP_PKEY *ret;
+        char psbuf[PEM_BUFSIZE];
+        p8 = d2i_PKCS8_bio(bp, NULL);
+        if(!p8) return NULL;
+        if (cb) klen=cb(psbuf,PEM_BUFSIZE,0,u);
+        else klen=def_callback(psbuf,PEM_BUFSIZE,0,u);
+        if (klen <= 0) {
+                PEMerr(PEM_F_D2I_PKCS8PRIVATEKEY_BIO, PEM_R_BAD_PASSWORD_READ);
+                X509_SIG_free(p8);
+                return NULL;    
+        }
+        p8inf = M_PKCS8_decrypt(p8, psbuf, klen);
+        X509_SIG_free(p8);
+        if(!p8inf) return NULL;
+        ret = EVP_PKCS82PKEY(p8inf);
+        PKCS8_PRIV_KEY_INFO_free(p8inf);
+        if(!ret) return NULL;
+        if(x) {
+                if(*x) EVP_PKEY_free(*x);
+                *x = ret;
+        }
+        return ret;
+}
+
+#ifndef NO_FP_API
+
+int i2d_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey_fp(fp, x, 1, -1, enc, kstr, klen, cb, u);
+}
+
+int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey_fp(fp, x, 1, nid, NULL, kstr, klen, cb, u);
+}
+
+int PEM_write_PKCS8PrivateKey_nid(FILE *fp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey_fp(fp, x, 0, nid, NULL, kstr, klen, cb, u);
+}
+
 int PEM_write_PKCS8PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
                               char *kstr, int klen, pem_password_cb *cb, void *u)
 {
+        return do_pk8pkey_fp(fp, x, 0, -1, enc, kstr, klen, cb, u);
+}
+
+static int do_pk8pkey_fp(FILE *fp, EVP_PKEY *x, int isder, int nid, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
         BIO *bp;
         int ret;
         if(!(bp = BIO_new_fp(fp, BIO_NOCLOSE))) {
-                PEMerr(PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY,ERR_R_BUF_LIB);
+                PEMerr(PEM_F_PEM_F_DO_PK8KEY_FP,ERR_R_BUF_LIB);
                 return(0);
         }
-        ret = PEM_write_bio_PKCS8PrivateKey(bp, x, enc, kstr, klen, cb, u);
+        ret = do_pk8pkey(bp, x, isder, nid, enc, kstr, klen, cb, u);
         BIO_free(bp);
         return ret;
 }
+
+EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void *u)
+{
+        BIO *bp;
+        EVP_PKEY *ret;
+        if(!(bp = BIO_new_fp(fp, BIO_NOCLOSE))) {
+                PEMerr(PEM_F_D2I_PKCS8PRIVATEKEY_FP,ERR_R_BUF_LIB);
+                return NULL;
+        }
+        ret = d2i_PKCS8PrivateKey_bio(bp, x, cb, u);
+        BIO_free(bp);
+        return ret;
+}
+
+#endif
diff --git a/src/lib/libcrypto/pem/pem_seal.c b/src/lib/libcrypto/pem/pem_seal.c
index 23f95beb1e..126e29d375 100644
--- a/src/lib/libcrypto/pem/pem_seal.c
+++ b/src/lib/libcrypto/pem/pem_seal.c
@@ -175,4 +175,10 @@ err:
         if (s != NULL) Free(s);
         return(ret);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libcrypto/perlasm/x86ms.pl b/src/lib/libcrypto/perlasm/x86ms.pl
index 51dcce067f..252a57bdb5 100644
--- a/src/lib/libcrypto/perlasm/x86ms.pl
+++ b/src/lib/libcrypto/perlasm/x86ms.pl
@@ -341,7 +341,14 @@ sub main'set_label
                 $label{$_[0]}="${label}${_[0]}";
                 $label++;
                 }
-        push(@out,"$label{$_[0]}:\n");
+        if((defined $_[1]) && ($_[1] == 1))
+                {
+                push(@out,"$label{$_[0]}::\n");
+                }
+        else
+                {
+                push(@out,"$label{$_[0]}:\n");
+                }
         }
 
 sub main'data_word
diff --git a/src/lib/libcrypto/perlasm/x86unix.pl b/src/lib/libcrypto/perlasm/x86unix.pl
index 8c456b14af..60d75f5ce4 100644
--- a/src/lib/libcrypto/perlasm/x86unix.pl
+++ b/src/lib/libcrypto/perlasm/x86unix.pl
@@ -368,10 +368,10 @@ sub main'function_end_B
 
         $func=$under.$func;
 
-        push(@out,".${func}_end:\n");
+        push(@out,".L_${func}_end:\n");
         if ($main'cpp)
-                { push(@out,"\tSIZE($func,.${func}_end-$func)\n"); }
-        else    { push(@out,"\t.size\t$func,.${func}_end-$func\n"); }
+                { push(@out,"\tSIZE($func,.L_${func}_end-$func)\n"); }
+        else    { push(@out,"\t.size\t$func,.L_${func}_end-$func\n"); }
         push(@out,".ident       \"desasm.pl\"\n");
         $stack=0;
         %label=();
diff --git a/src/lib/libcrypto/pkcs12/Makefile.ssl b/src/lib/libcrypto/pkcs12/Makefile.ssl
index 7b0c65fad9..5716f608b6 100644
--- a/src/lib/libcrypto/pkcs12/Makefile.ssl
+++ b/src/lib/libcrypto/pkcs12/Makefile.ssl
@@ -1,5 +1,5 @@
 #
-# SSLeay/crypto/asn1/Makefile
+# SSLeay/crypto/pkcs12/Makefile
 #
 
 DIR=    pkcs12
@@ -24,10 +24,10 @@ APPS=
 LIB=$(TOP)/libcrypto.a
 LIBSRC= p12_add.c p12_attr.c p12_bags.c p12_crpt.c p12_crt.c p12_decr.c \
         p12_init.c p12_key.c p12_kiss.c p12_lib.c p12_mac.c p12_mutl.c\
-        p12_sbag.c p12_utl.c pk12err.c
+        p12_sbag.c p12_utl.c p12_npas.c pk12err.c
 LIBOBJ= p12_add.o p12_attr.o p12_bags.o p12_crpt.o p12_crt.o p12_decr.o \
         p12_init.o p12_key.o p12_kiss.o p12_lib.o p12_mac.o p12_mutl.o\
-        p12_sbag.o p12_utl.o pk12err.o
+        p12_sbag.o p12_utl.o p12_npas.o pk12err.o
 
 SRC= $(LIBSRC)
 
@@ -293,6 +293,23 @@ p12_mutl.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 p12_mutl.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 p12_mutl.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 p12_mutl.o: ../cryptlib.h
+p12_npas.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+p12_npas.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+p12_npas.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+p12_npas.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+p12_npas.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
+p12_npas.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+p12_npas.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_npas.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+p12_npas.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_npas.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h
+p12_npas.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs12.h
+p12_npas.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+p12_npas.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+p12_npas.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+p12_npas.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+p12_npas.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+p12_npas.o: ../../include/openssl/x509_vfy.h
 p12_sbag.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 p12_sbag.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 p12_sbag.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
diff --git a/src/lib/libcrypto/pkcs12/p12_add.c b/src/lib/libcrypto/pkcs12/p12_add.c
index ae3d9de3b4..d045cbba8d 100644
--- a/src/lib/libcrypto/pkcs12/p12_add.c
+++ b/src/lib/libcrypto/pkcs12/p12_add.c
@@ -133,7 +133,7 @@ PKCS7 *PKCS12_pack_p7data (STACK *sk)
                 return NULL;
         }
         p7->type = OBJ_nid2obj(NID_pkcs7_data);
-        if (!(p7->d.data = ASN1_OCTET_STRING_new())) {
+        if (!(p7->d.data = M_ASN1_OCTET_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -157,20 +157,18 @@ PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, const char *pass, int passlen,
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        p7->type = OBJ_nid2obj(NID_pkcs7_encrypted);
-        if (!(p7->d.encrypted = PKCS7_ENCRYPT_new ())) {
-                PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
+        if(!PKCS7_set_type(p7, NID_pkcs7_encrypted)) {
+                PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA,
+                                PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE);
                 return NULL;
         }
-        ASN1_INTEGER_set (p7->d.encrypted->version, 0);
-        p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
         if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm);
         p7->d.encrypted->enc_data->algorithm = pbe;
-        ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
+        M_ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
         if (!(p7->d.encrypted->enc_data->enc_data =
         PKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen,
                                  (char *)bags, 1))) {
@@ -191,24 +189,28 @@ X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
 
         if (!(p8 = X509_SIG_new())) {
                 PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE);
-                return NULL;
+                goto err;
         }
 
         if(pbe_nid == -1) pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen);
         else pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen);
         if(!pbe) {
-                PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE);
-                return NULL;
+                PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_ASN1_LIB);
+                goto err;
         }
         X509_ALGOR_free(p8->algor);
         p8->algor = pbe;
-        ASN1_OCTET_STRING_free(p8->digest);
+        M_ASN1_OCTET_STRING_free(p8->digest);
         if (!(p8->digest = 
         PKCS12_i2d_encrypt (pbe, i2d_PKCS8_PRIV_KEY_INFO, pass, passlen,
                                                  (char *)p8inf, 0))) {
                 PKCS12err(PKCS12_F_PKCS8_ENCRYPT, PKCS12_R_ENCRYPT_ERROR);
-                return NULL;
+                goto err;
         }
 
         return p8;
+
+        err:
+        X509_SIG_free(p8);
+        return NULL;
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_attr.c b/src/lib/libcrypto/pkcs12/p12_attr.c
index 31c9782b77..f559351d18 100644
--- a/src/lib/libcrypto/pkcs12/p12_attr.c
+++ b/src/lib/libcrypto/pkcs12/p12_attr.c
@@ -73,11 +73,11 @@ int PKCS12_add_localkeyid (PKCS12_SAFEBAG *bag, unsigned char *name,
                 return 0;
         }
         keyid->type = V_ASN1_OCTET_STRING;
-        if (!(oct = ASN1_OCTET_STRING_new())) {
+        if (!(oct = M_ASN1_OCTET_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!ASN1_OCTET_STRING_set(oct, name, namelen)) {
+        if (!M_ASN1_OCTET_STRING_set(oct, name, namelen)) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
@@ -115,11 +115,11 @@ int PKCS8_add_keyusage (PKCS8_PRIV_KEY_INFO *p8, int usage)
                 return 0;
         }
         keyid->type = V_ASN1_BIT_STRING;
-        if (!(bstr = ASN1_BIT_STRING_new())) {
+        if (!(bstr = M_ASN1_BIT_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!ASN1_BIT_STRING_set(bstr, &us_val, 1)) {
+        if (!M_ASN1_BIT_STRING_set(bstr, &us_val, 1)) {
                 PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
@@ -176,7 +176,7 @@ int PKCS12_add_friendlyname_uni (PKCS12_SAFEBAG *bag,
                 return 0;
         }
         fname->type = V_ASN1_BMPSTRING;
-        if (!(bmp = ASN1_BMPSTRING_new())) {
+        if (!(bmp = M_ASN1_BMPSTRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI,
                                                         ERR_R_MALLOC_FAILURE);
                 return 0;
diff --git a/src/lib/libcrypto/pkcs12/p12_bags.c b/src/lib/libcrypto/pkcs12/p12_bags.c
index d6eab92c83..c358b06735 100644
--- a/src/lib/libcrypto/pkcs12/p12_bags.c
+++ b/src/lib/libcrypto/pkcs12/p12_bags.c
@@ -171,15 +171,15 @@ void PKCS12_BAGS_free (PKCS12_BAGS *a)
         switch (OBJ_obj2nid(a->type)) {
 
                 case NID_x509Certificate:
-                        ASN1_OCTET_STRING_free (a->value.x509cert);
+                        M_ASN1_OCTET_STRING_free (a->value.x509cert);
                 break;
 
                 case NID_x509Crl:
-                        ASN1_OCTET_STRING_free (a->value.x509crl);
+                        M_ASN1_OCTET_STRING_free (a->value.x509crl);
                 break;
 
                 case NID_sdsiCertificate:
-                        ASN1_IA5STRING_free (a->value.sdsicert);
+                        M_ASN1_IA5STRING_free (a->value.sdsicert);
                 break;
 
                 default:
@@ -188,5 +188,5 @@ void PKCS12_BAGS_free (PKCS12_BAGS *a)
         }
 
         ASN1_OBJECT_free (a->type);
-        Free ((char *)a);
+        Free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_crpt.c b/src/lib/libcrypto/pkcs12/p12_crpt.c
index 6de6f8128f..7b96584f07 100644
--- a/src/lib/libcrypto/pkcs12/p12_crpt.c
+++ b/src/lib/libcrypto/pkcs12/p12_crpt.c
@@ -70,10 +70,12 @@ EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC4, EVP_rc4(), EVP_sha1(),
 EVP_PBE_alg_add(NID_pbe_WithSHA1And40BitRC4, EVP_rc4_40(), EVP_sha1(),
                                                          PKCS12_PBE_keyivgen);
 #endif
+#ifndef NO_DES
 EVP_PBE_alg_add(NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
                         EVP_des_ede3_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen);
 EVP_PBE_alg_add(NID_pbe_WithSHA1And2_Key_TripleDES_CBC, 
                         EVP_des_ede_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen);
+#endif
 #ifndef NO_RC2
 EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC2_CBC, EVP_rc2_cbc(),
                                         EVP_sha1(), PKCS12_PBE_keyivgen);
diff --git a/src/lib/libcrypto/pkcs12/p12_decr.c b/src/lib/libcrypto/pkcs12/p12_decr.c
index d3d288e187..4be44eac50 100644
--- a/src/lib/libcrypto/pkcs12/p12_decr.c
+++ b/src/lib/libcrypto/pkcs12/p12_decr.c
@@ -155,7 +155,7 @@ ASN1_OCTET_STRING *PKCS12_i2d_encrypt (X509_ALGOR *algor, int (*i2d)(),
         ASN1_OCTET_STRING *oct;
         unsigned char *in, *p;
         int inlen;
-        if (!(oct = ASN1_OCTET_STRING_new ())) {
+        if (!(oct = M_ASN1_OCTET_STRING_new ())) {
                 PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
diff --git a/src/lib/libcrypto/pkcs12/p12_init.c b/src/lib/libcrypto/pkcs12/p12_init.c
index dc6ab41db8..d5d4884c82 100644
--- a/src/lib/libcrypto/pkcs12/p12_init.c
+++ b/src/lib/libcrypto/pkcs12/p12_init.c
@@ -69,11 +69,11 @@ PKCS12 *PKCS12_init (int mode)
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        if (!(pkcs12->version = ASN1_INTEGER_new ())) {
+        if (!(pkcs12->version = M_ASN1_INTEGER_new ())) {
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        ASN1_INTEGER_set (pkcs12->version, 3);
+        ASN1_INTEGER_set(pkcs12->version, 3);
         if (!(pkcs12->authsafes = PKCS7_new())) {
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
@@ -82,7 +82,7 @@ PKCS12 *PKCS12_init (int mode)
         switch (mode) {
                 case NID_pkcs7_data:
                         if (!(pkcs12->authsafes->d.data =
-                                 ASN1_OCTET_STRING_new())) {
+                                 M_ASN1_OCTET_STRING_new())) {
                         PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                         return NULL;
                 }
diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c
index 25d8cdae57..02fdd20e2f 100644
--- a/src/lib/libcrypto/pkcs12/p12_key.c
+++ b/src/lib/libcrypto/pkcs12/p12_key.c
@@ -64,7 +64,7 @@
 /* Uncomment out this line to get debugging info about key generation */
 /*#define DEBUG_KEYGEN*/
 #ifdef DEBUG_KEYGEN
-#include <bio.h>
+#include <openssl/bio.h>
 extern BIO *bio_err;
 void h__dump (unsigned char *p, int len);
 #endif
@@ -104,13 +104,12 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
 #ifdef  DEBUG_KEYGEN
         unsigned char *tmpout = out;
         int tmpn = n;
-        BIO_printf (bio_err, "KEYGEN DEBUG\n");
-        BIO_printf (bio_err, "ID %d, ITER %d\n", id, iter);
-        BIO_printf (bio_err, "Password (length %d):\n", passlen);
-        h__dump (pass, passlen);
-        BIO_printf (bio_err, "Salt (length %d):\n", saltlen);
-        h__dump (salt, saltlen);
-        BIO_printf (bio_err, "ID %d, ITER %d\n\n", id, iter);
+        fprintf(stderr, "KEYGEN DEBUG\n");
+        fprintf(stderr, "ID %d, ITER %d\n", id, iter);
+        fprintf(stderr, "Password (length %d):\n", passlen);
+        h__dump(pass, passlen);
+        fprintf(stderr, "Salt (length %d):\n", saltlen);
+        h__dump(salt, saltlen);
 #endif
         v = EVP_MD_block_size (md_type);
         u = EVP_MD_size (md_type);
@@ -150,8 +149,8 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
                         BN_free (Ij);
                         BN_free (Bpl1);
 #ifdef DEBUG_KEYGEN
-                        BIO_printf (bio_err, "Output KEY (length %d)\n", tmpn);
-                        h__dump (tmpout, tmpn);
+                        fprintf(stderr, "Output KEY (length %d)\n", tmpn);
+                        h__dump(tmpout, tmpn);
 #endif
                         return 1;       
                 }
@@ -176,7 +175,7 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
 #ifdef DEBUG_KEYGEN
 void h__dump (unsigned char *p, int len)
 {
-        for (; len --; p++) BIO_printf (bio_err, "%02X", *p);
-        BIO_printf (bio_err, "\n");     
+        for (; len --; p++) fprintf(stderr, "%02X", *p);
+        fprintf(stderr, "\n");  
 }
 #endif
diff --git a/src/lib/libcrypto/pkcs12/p12_kiss.c b/src/lib/libcrypto/pkcs12/p12_kiss.c
index 767e1303da..08a60556e0 100644
--- a/src/lib/libcrypto/pkcs12/p12_kiss.c
+++ b/src/lib/libcrypto/pkcs12/p12_kiss.c
@@ -139,16 +139,16 @@ static int parse_pk12 (PKCS12 *p12, const char *pass, int passlen,
                         sk_pop_free (asafes, PKCS7_free);
                         return 0;
                 }
-                if (!parse_bags (bags, pass, passlen, pkey, cert, ca,
+                if (!parse_bags(bags, pass, passlen, pkey, cert, ca,
                                                          &keyid, &keymatch)) {
-                        sk_pop_free (bags, PKCS12_SAFEBAG_free);
-                        sk_pop_free (asafes, PKCS7_free);
+                        sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                        sk_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
-                sk_pop_free (bags, PKCS12_SAFEBAG_free);
+                sk_pop_free(bags, PKCS12_SAFEBAG_free);
         }
-        sk_pop_free (asafes, PKCS7_free);
-        if (keyid) ASN1_OCTET_STRING_free (keyid);
+        sk_pop_free(asafes, PKCS7_free);
+        if (keyid) M_ASN1_OCTET_STRING_free(keyid);
         return 1;
 }
 
@@ -158,8 +158,8 @@ static int parse_bags (STACK *bags, const char *pass, int passlen,
                        ASN1_OCTET_STRING **keyid, char *keymatch)
 {
         int i;
-        for (i = 0; i < sk_num (bags); i++) {
-                if (!parse_bag ((PKCS12_SAFEBAG *)sk_value (bags, i),
+        for (i = 0; i < sk_num(bags); i++) {
+                if (!parse_bag((PKCS12_SAFEBAG *)sk_value (bags, i),
                          pass, passlen, pkey, cert, ca, keyid,
                                                          keymatch)) return 0;
         }
@@ -170,7 +170,7 @@ static int parse_bags (STACK *bags, const char *pass, int passlen,
 #define MATCH_CERT 0x2
 #define MATCH_ALL  0x3
 
-static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
+static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                       EVP_PKEY **pkey, X509 **cert, STACK **ca,
                       ASN1_OCTET_STRING **keyid,
              char *keymatch)
@@ -187,9 +187,9 @@ static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
         /* Check for any local key id matching (if needed) */
         if (lkey && ((*keymatch & MATCH_ALL) != MATCH_ALL)) {
                 if (*keyid) {
-                        if (ASN1_OCTET_STRING_cmp (*keyid, lkey)) lkey = NULL;
+                        if (M_ASN1_OCTET_STRING_cmp(*keyid, lkey)) lkey = NULL;
                 } else {
-                        if (!(*keyid = ASN1_OCTET_STRING_dup (lkey))) {
+                        if (!(*keyid = M_ASN1_OCTET_STRING_dup(lkey))) {
                                 PKCS12err(PKCS12_F_PARSE_BAGS,ERR_R_MALLOC_FAILURE);
                                 return 0;
                     }
@@ -200,16 +200,16 @@ static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
         {
         case NID_keyBag:
                 if (!lkey || !pkey) return 1;   
-                if (!(*pkey = EVP_PKCS82PKEY (bag->value.keybag))) return 0;
+                if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag))) return 0;
                 *keymatch |= MATCH_KEY;
         break;
 
         case NID_pkcs8ShroudedKeyBag:
                 if (!lkey || !pkey) return 1;   
-                if (!(p8 = M_PKCS12_decrypt_skey (bag, pass, passlen)))
+                if (!(p8 = M_PKCS12_decrypt_skey(bag, pass, passlen)))
                                 return 0;
-                *pkey = EVP_PKCS82PKEY (p8);
-                PKCS8_PRIV_KEY_INFO_free (p8);
+                *pkey = EVP_PKCS82PKEY(p8);
+                PKCS8_PRIV_KEY_INFO_free(p8);
                 if (!(*pkey)) return 0;
                 *keymatch |= MATCH_KEY;
         break;
diff --git a/src/lib/libcrypto/pkcs12/p12_lib.c b/src/lib/libcrypto/pkcs12/p12_lib.c
index 00a6695d9b..7ca9c14908 100644
--- a/src/lib/libcrypto/pkcs12/p12_lib.c
+++ b/src/lib/libcrypto/pkcs12/p12_lib.c
@@ -104,8 +104,8 @@ PKCS12 *PKCS12_new(void)
 void PKCS12_free (PKCS12 *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free (a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS12_MAC_DATA_free (a->mac);
         PKCS7_free (a->authsafes);
-        Free ((char *)a);
+        Free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_mac.c b/src/lib/libcrypto/pkcs12/p12_mac.c
index f163d4cfaa..f5ab0d6464 100644
--- a/src/lib/libcrypto/pkcs12/p12_mac.c
+++ b/src/lib/libcrypto/pkcs12/p12_mac.c
@@ -82,9 +82,9 @@ PKCS12_MAC_DATA *PKCS12_MAC_DATA_new(void)
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PKCS12_MAC_DATA);
         ret->dinfo = X509_SIG_new();
-        ret->salt = ASN1_OCTET_STRING_new();
+        ret->salt = M_ASN1_OCTET_STRING_new();
         ret->iter = NULL;
-        return (ret);
+        return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS12_MAC_DATA_NEW);
 }
 
@@ -94,9 +94,9 @@ PKCS12_MAC_DATA *d2i_PKCS12_MAC_DATA(PKCS12_MAC_DATA **a, unsigned char **pp,
         M_ASN1_D2I_vars(a,PKCS12_MAC_DATA *,PKCS12_MAC_DATA_new);
         M_ASN1_D2I_Init();
         M_ASN1_D2I_start_sequence();
-        M_ASN1_D2I_get (ret->dinfo, d2i_X509_SIG);
-        M_ASN1_D2I_get (ret->salt, d2i_ASN1_OCTET_STRING);
-        M_ASN1_D2I_get_opt (ret->iter, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
+        M_ASN1_D2I_get(ret->dinfo, d2i_X509_SIG);
+        M_ASN1_D2I_get(ret->salt, d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_opt(ret->iter, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
         M_ASN1_D2I_Finish(a, PKCS12_MAC_DATA_free, ASN1_F_D2I_PKCS12_MAC_DATA);
 }
 
@@ -104,7 +104,7 @@ void PKCS12_MAC_DATA_free (PKCS12_MAC_DATA *a)
 {
         if (a == NULL) return;
         X509_SIG_free (a->dinfo);
-        ASN1_OCTET_STRING_free (a->salt);
-        ASN1_INTEGER_free (a->iter);
-        Free ((char *)a);
+        M_ASN1_OCTET_STRING_free(a->salt);
+        M_ASN1_INTEGER_free(a->iter);
+        Free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_mutl.c b/src/lib/libcrypto/pkcs12/p12_mutl.c
index bac558d6b9..f1094b3840 100644
--- a/src/lib/libcrypto/pkcs12/p12_mutl.c
+++ b/src/lib/libcrypto/pkcs12/p12_mutl.c
@@ -131,7 +131,7 @@ int PKCS12_set_mac (PKCS12 *p12, const char *pass, int passlen,
                 PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_GENERATION_ERROR);
                 return 0;
         }
-        if (!(ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) {
+        if (!(M_ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) {
                 PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_STRING_SET_ERROR);
                                                 return 0;
         }
@@ -142,13 +142,13 @@ int PKCS12_set_mac (PKCS12 *p12, const char *pass, int passlen,
 int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
              EVP_MD *md_type)
 {
-        if (!(p12->mac = PKCS12_MAC_DATA_new ())) return PKCS12_ERROR;
+        if (!(p12->mac = PKCS12_MAC_DATA_new())) return PKCS12_ERROR;
         if (iter > 1) {
-                if(!(p12->mac->iter = ASN1_INTEGER_new())) {
+                if(!(p12->mac->iter = M_ASN1_INTEGER_new())) {
                         PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
                         return 0;
                 }
-                ASN1_INTEGER_set (p12->mac->iter, iter);
+                ASN1_INTEGER_set(p12->mac->iter, iter);
         }
         if (!saltlen) saltlen = PKCS12_SALT_LEN;
         p12->mac->salt->length = saltlen;
@@ -156,7 +156,10 @@ int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
                 PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!salt) RAND_bytes (p12->mac->salt->data, saltlen);
+        if (!salt) {
+                if (RAND_bytes (p12->mac->salt->data, saltlen) <= 0)
+                        return 0;
+        }
         else memcpy (p12->mac->salt->data, salt, saltlen);
         p12->mac->dinfo->algor->algorithm = OBJ_nid2obj(EVP_MD_type(md_type));
         if (!(p12->mac->dinfo->algor->parameter = ASN1_TYPE_new())) {
diff --git a/src/lib/libcrypto/pkcs12/p12_npas.c b/src/lib/libcrypto/pkcs12/p12_npas.c
new file mode 100644
index 0000000000..ee71707e2c
--- /dev/null
+++ b/src/lib/libcrypto/pkcs12/p12_npas.c
@@ -0,0 +1,212 @@
+/* p12_npas.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <openssl/pem.h>
+#include <openssl/err.h>
+#include <openssl/pkcs12.h>
+
+/* PKCS#12 password change routine */
+
+static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass);
+static int newpass_bags(STACK *bags, char *oldpass,  char *newpass);
+static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass);
+static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen);
+
+/* 
+ * Change the password on a PKCS#12 structure.
+ */
+
+int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass)
+{
+
+/* Check for NULL PKCS12 structure */
+
+if(!p12) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
+        return 0;
+}
+
+/* Check the mac */
+
+if (!PKCS12_verify_mac(p12, oldpass, -1)) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_MAC_VERIFY_FAILURE);
+        return 0;
+}
+
+if (!newpass_p12(p12, oldpass, newpass)) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_PARSE_ERROR);
+        return 0;
+}
+
+return 1;
+
+}
+
+/* Parse the outer PKCS#12 structure */
+
+static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass)
+{
+        STACK *asafes, *newsafes, *bags;
+        int i, bagnid, pbe_nid, pbe_iter, pbe_saltlen;
+        PKCS7 *p7, *p7new;
+        ASN1_OCTET_STRING *p12_data_tmp = NULL, *macnew = NULL;
+        unsigned char mac[EVP_MAX_MD_SIZE];
+        unsigned int maclen;
+        if (!(asafes = M_PKCS12_unpack_authsafes(p12))) return 0;
+        if(!(newsafes = sk_new(NULL))) return 0;
+        for (i = 0; i < sk_num (asafes); i++) {
+                p7 = (PKCS7 *) sk_value(asafes, i);
+                bagnid = OBJ_obj2nid(p7->type);
+                if (bagnid == NID_pkcs7_data) {
+                        bags = M_PKCS12_unpack_p7data(p7);
+                } else if (bagnid == NID_pkcs7_encrypted) {
+                        bags = M_PKCS12_unpack_p7encdata(p7, oldpass, -1);
+                        alg_get(p7->d.encrypted->enc_data->algorithm,
+                                &pbe_nid, &pbe_iter, &pbe_saltlen);
+                } else continue;
+                if (!bags) {
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                if (!newpass_bags(bags, oldpass, newpass)) {
+                        sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                /* Repack bag in same form with new password */
+                if (bagnid == NID_pkcs7_data) p7new = PKCS12_pack_p7data(bags);
+                else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL,
+                                                 pbe_saltlen, pbe_iter, bags);
+                sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                if(!p7new) {
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                sk_push(newsafes, (char *)p7new);
+        }
+        sk_pop_free(asafes, PKCS7_free);
+
+        /* Repack safe: save old safe in case of error */
+
+        p12_data_tmp = p12->authsafes->d.data;
+        if(!(p12->authsafes->d.data = ASN1_OCTET_STRING_new())) goto saferr;
+        if(!M_PKCS12_pack_authsafes(p12, newsafes)) goto saferr;
+
+        if(!PKCS12_gen_mac(p12, newpass, -1, mac, &maclen)) goto saferr;
+        if(!(macnew = ASN1_OCTET_STRING_new())) goto saferr;
+        if(!ASN1_OCTET_STRING_set(macnew, mac, maclen)) goto saferr;
+        ASN1_OCTET_STRING_free(p12->mac->dinfo->digest);
+        p12->mac->dinfo->digest = macnew;
+        ASN1_OCTET_STRING_free(p12_data_tmp);
+
+        return 1;
+
+        saferr:
+        /* Restore old safe */
+        ASN1_OCTET_STRING_free(p12->authsafes->d.data);
+        ASN1_OCTET_STRING_free(macnew);
+        p12->authsafes->d.data = p12_data_tmp;
+        return 0;
+
+}
+
+
+static int newpass_bags(STACK *bags, char *oldpass,  char *newpass)
+{
+        int i;
+        for (i = 0; i < sk_num(bags); i++) {
+                if (!newpass_bag((PKCS12_SAFEBAG *)sk_value(bags, i),
+                                                 oldpass, newpass)) return 0;
+        }
+        return 1;
+}
+
+/* Change password of safebag: only needs handle shrouded keybags */
+
+static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass)
+{
+        PKCS8_PRIV_KEY_INFO *p8;
+        X509_SIG *p8new;
+        int p8_nid, p8_saltlen, p8_iter;
+
+        if(M_PKCS12_bag_type(bag) != NID_pkcs8ShroudedKeyBag) return 1;
+
+        if (!(p8 = M_PKCS12_decrypt_skey(bag, oldpass, -1))) return 0;
+        alg_get(bag->value.shkeybag->algor, &p8_nid, &p8_iter, &p8_saltlen);
+        if(!(p8new = PKCS8_encrypt(p8_nid, NULL, newpass, -1, NULL, p8_saltlen,
+                                                     p8_iter, p8))) return 0;
+        X509_SIG_free(bag->value.shkeybag);
+        bag->value.shkeybag = p8new;
+        return 1;
+}
+
+static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen)
+{
+        PBEPARAM *pbe;
+        unsigned char *p;
+        p = alg->parameter->value.sequence->data;
+        pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
+        *pnid = OBJ_obj2nid(alg->algorithm);
+        *piter = ASN1_INTEGER_get(pbe->iter);
+        *psaltlen = pbe->salt->length;
+        PBEPARAM_free(pbe);
+        return 0;
+}
diff --git a/src/lib/libcrypto/pkcs12/pk12err.c b/src/lib/libcrypto/pkcs12/pk12err.c
index 38d7be7675..9d8de10e1e 100644
--- a/src/lib/libcrypto/pkcs12/pk12err.c
+++ b/src/lib/libcrypto/pkcs12/pk12err.c
@@ -79,6 +79,7 @@ static ERR_STRING_DATA PKCS12_str_functs[]=
 {ERR_PACK(0,PKCS12_F_PKCS12_KEY_GEN_UNI,0),     "PKCS12_key_gen_uni"},
 {ERR_PACK(0,PKCS12_F_PKCS12_MAKE_KEYBAG,0),     "PKCS12_MAKE_KEYBAG"},
 {ERR_PACK(0,PKCS12_F_PKCS12_MAKE_SHKEYBAG,0),   "PKCS12_MAKE_SHKEYBAG"},
+{ERR_PACK(0,PKCS12_F_PKCS12_NEWPASS,0), "PKCS12_newpass"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_P7DATA,0),     "PKCS12_pack_p7data"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_P7ENCDATA,0),  "PKCS12_pack_p7encdata"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_SAFEBAG,0),    "PKCS12_pack_safebag"},
@@ -99,6 +100,7 @@ static ERR_STRING_DATA PKCS12_str_reasons[]=
 {PKCS12_R_DECODE_ERROR                   ,"decode error"},
 {PKCS12_R_ENCODE_ERROR                   ,"encode error"},
 {PKCS12_R_ENCRYPT_ERROR                  ,"encrypt error"},
+{PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE,"error setting encrypted data type"},
 {PKCS12_R_INVALID_NULL_ARGUMENT          ,"invalid null argument"},
 {PKCS12_R_INVALID_NULL_PKCS12_POINTER    ,"invalid null pkcs12 pointer"},
 {PKCS12_R_IV_GEN_ERROR                   ,"iv gen error"},
diff --git a/src/lib/libcrypto/pkcs12/pkcs12.h b/src/lib/libcrypto/pkcs12/pkcs12.h
index 4cfba5e6c6..254000fa12 100644
--- a/src/lib/libcrypto/pkcs12/pkcs12.h
+++ b/src/lib/libcrypto/pkcs12/pkcs12.h
@@ -273,6 +273,7 @@ int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12);
 int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12);
 PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12);
 PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
+int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -296,6 +297,7 @@ PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
 #define PKCS12_F_PKCS12_KEY_GEN_UNI                      111
 #define PKCS12_F_PKCS12_MAKE_KEYBAG                      112
 #define PKCS12_F_PKCS12_MAKE_SHKEYBAG                    113
+#define PKCS12_F_PKCS12_NEWPASS                          128
 #define PKCS12_F_PKCS12_PACK_P7DATA                      114
 #define PKCS12_F_PKCS12_PACK_P7ENCDATA                   115
 #define PKCS12_F_PKCS12_PACK_SAFEBAG                     117
@@ -313,6 +315,7 @@ PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
 #define PKCS12_R_DECODE_ERROR                            101
 #define PKCS12_R_ENCODE_ERROR                            102
 #define PKCS12_R_ENCRYPT_ERROR                           103
+#define PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE       120
 #define PKCS12_R_INVALID_NULL_ARGUMENT                   104
 #define PKCS12_R_INVALID_NULL_PKCS12_POINTER             105
 #define PKCS12_R_IV_GEN_ERROR                            106
diff --git a/src/lib/libcrypto/pkcs7/Makefile.ssl b/src/lib/libcrypto/pkcs7/Makefile.ssl
index 6c4644b2f2..0e508386e8 100644
--- a/src/lib/libcrypto/pkcs7/Makefile.ssl
+++ b/src/lib/libcrypto/pkcs7/Makefile.ssl
@@ -1,5 +1,5 @@
 #
-# SSLeay/crypto/asn1/Makefile
+# SSLeay/crypto/pkcs7/Makefile
 #
 
 DIR=    pkcs7
@@ -15,6 +15,9 @@ MAKEDEPEND=	$(TOP)/util/domd $(TOP)
 MAKEFILE=       Makefile.ssl
 AR=             ar r
 
+PEX_LIBS=
+EX_LIBS=
+ 
 CFLAGS= $(INCLUDES) $(CFLAG)
 
 GENERAL=Makefile README
@@ -22,8 +25,8 @@ TEST=
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC= pk7_lib.c pkcs7err.c pk7_doit.c
-LIBOBJ= pk7_lib.o pkcs7err.o pk7_doit.o
+LIBSRC= pk7_lib.c pkcs7err.c pk7_doit.c pk7_smime.c pk7_attr.c pk7_mime.c
+LIBOBJ= pk7_lib.o pkcs7err.o pk7_doit.o pk7_smime.o pk7_attr.o pk7_mime.o
 
 SRC= $(LIBSRC)
 
@@ -42,16 +45,16 @@ all:	lib
 testapps: enc dec sign verify
 
 enc: enc.o lib
-        $(CC) $(CFLAGS) -o enc enc.o $(LIB)
+        $(CC) $(CFLAGS) -o enc enc.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
 
 dec: dec.o lib
-        $(CC) $(CFLAGS) -o dec dec.o $(LIB)
+        $(CC) $(CFLAGS) -o dec dec.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
 
 sign: sign.o lib
-        $(CC) $(CFLAGS) -o sign sign.o $(LIB)
+        $(CC) $(CFLAGS) -o sign sign.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
 
 verify: verify.o example.o lib
-        $(CC) $(CFLAGS) -o verify verify.o example.o $(LIB)
+        $(CC) $(CFLAGS) -o verify verify.o $(PEX_LIBS) example.o $(LIB) $(EX_LIBS)
 
 lib:    $(LIBOBJ)
         $(AR) $(LIB) $(LIBOBJ)
@@ -90,18 +93,35 @@ dclean:
         mv -f Makefile.new $(MAKEFILE)
 
 clean:
-        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff enc dec sign verify
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
+pk7_attr.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+pk7_attr.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+pk7_attr.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+pk7_attr.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+pk7_attr.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
+pk7_attr.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+pk7_attr.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+pk7_attr.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pk7_attr.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+pk7_attr.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h
+pk7_attr.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
+pk7_attr.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+pk7_attr.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+pk7_attr.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+pk7_attr.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+pk7_attr.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 pk7_doit.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk7_doit.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pk7_doit.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-pk7_doit.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-pk7_doit.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-pk7_doit.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-pk7_doit.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-pk7_doit.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+pk7_doit.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+pk7_doit.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+pk7_doit.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+pk7_doit.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+pk7_doit.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+pk7_doit.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 pk7_doit.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 pk7_doit.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 pk7_doit.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -110,7 +130,8 @@ pk7_doit.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 pk7_doit.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 pk7_doit.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 pk7_doit.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-pk7_doit.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+pk7_doit.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+pk7_doit.o: ../cryptlib.h
 pk7_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk7_lib.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pk7_lib.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -128,6 +149,42 @@ pk7_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 pk7_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 pk7_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 pk7_lib.o: ../cryptlib.h
+pk7_mime.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+pk7_mime.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+pk7_mime.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+pk7_mime.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+pk7_mime.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+pk7_mime.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+pk7_mime.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+pk7_mime.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+pk7_mime.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pk7_mime.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+pk7_mime.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+pk7_mime.o: ../../include/openssl/rand.h ../../include/openssl/rc2.h
+pk7_mime.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+pk7_mime.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+pk7_mime.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+pk7_mime.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+pk7_mime.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+pk7_smime.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+pk7_smime.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+pk7_smime.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+pk7_smime.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+pk7_smime.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+pk7_smime.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+pk7_smime.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+pk7_smime.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+pk7_smime.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+pk7_smime.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pk7_smime.o: ../../include/openssl/objects.h
+pk7_smime.o: ../../include/openssl/opensslconf.h
+pk7_smime.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+pk7_smime.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+pk7_smime.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+pk7_smime.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+pk7_smime.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+pk7_smime.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+pk7_smime.o: ../../include/openssl/x509v3.h ../cryptlib.h
 pkcs7err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pkcs7err.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pkcs7err.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
diff --git a/src/lib/libcrypto/pkcs7/bio_ber.c b/src/lib/libcrypto/pkcs7/bio_ber.c
index 2f17723e98..4803966fd2 100644
--- a/src/lib/libcrypto/pkcs7/bio_ber.c
+++ b/src/lib/libcrypto/pkcs7/bio_ber.c
@@ -69,6 +69,7 @@ static int ber_read(BIO *h,char *buf,int size);
 static long ber_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int ber_new(BIO *h);
 static int ber_free(BIO *data);
+static long ber_callback_ctrl(BIO *h,int cmd,void *(*fp)());
 #define BER_BUF_SIZE    (32)
 
 /* This is used to hold the state of the BER objects being read. */
@@ -92,7 +93,7 @@ typedef struct bio_ber_struct
         /* most of the following are used when doing non-blocking IO */
         /* reading */
         long num_left;  /* number of bytes still to read/write in block */
-        int depth;      /* used with idefinite encoding. */
+        int depth;      /* used with indefinite encoding. */
         int finished;   /* No more read data */
 
         /* writting */ 
@@ -115,6 +116,7 @@ static BIO_METHOD methods_ber=
         ber_ctrl,
         ber_new,
         ber_free,
+        ber_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_ber(void)
@@ -409,6 +411,20 @@ again:
         return(ret);
         }
 
+static long ber_callback_ctrl(BIO *b, int cmd, void *(*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 /*
 void BIO_set_cipher_ctx(b,c)
 BIO *b;
diff --git a/src/lib/libcrypto/pkcs7/dec.c b/src/lib/libcrypto/pkcs7/dec.c
index b3661f28d3..6752ec568a 100644
--- a/src/lib/libcrypto/pkcs7/dec.c
+++ b/src/lib/libcrypto/pkcs7/dec.c
@@ -57,6 +57,7 @@
  */
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
@@ -85,7 +86,7 @@ char *argv[];
         int i,printit=0;
         STACK_OF(PKCS7_SIGNER_INFO) *sk;
 
-        SSLeay_add_all_algorithms();
+        OpenSSL_add_all_algorithms();
         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
 
         data=BIO_new(BIO_s_file());
@@ -121,9 +122,10 @@ char *argv[];
         }
 
         if ((in=BIO_new_file(keyfile,"r")) == NULL) goto err;
-        if ((x509=PEM_read_bio_X509(in,NULL,NULL)) == NULL) goto err;
+        if ((x509=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL) goto err;
         BIO_reset(in);
-        if ((pkey=PEM_read_bio_PrivateKey(in,NULL,NULL)) == NULL) goto err;
+        if ((pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL)) == NULL)
+                goto err;
         BIO_free(in);
 
         if (pp == NULL)
@@ -131,7 +133,7 @@ char *argv[];
 
 
         /* Load the PKCS7 object from a file */
-        if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL)) == NULL) goto err;
+        if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL,NULL)) == NULL) goto err;
 
 
 
@@ -148,7 +150,7 @@ char *argv[];
         /* We need to process the data */
         /* We cannot support detached encryption */
         p7bio=PKCS7_dataDecode(p7,pkey,detached,x509);
-        
+
         if (p7bio == NULL)
                 {
                 printf("problems decoding\n");
diff --git a/src/lib/libcrypto/pkcs7/enc.c b/src/lib/libcrypto/pkcs7/enc.c
index 43bfd10a23..2b56c2eff3 100644
--- a/src/lib/libcrypto/pkcs7/enc.c
+++ b/src/lib/libcrypto/pkcs7/enc.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 #include <stdio.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
@@ -76,7 +77,7 @@ char *argv[];
         const EVP_CIPHER *cipher=NULL;
         STACK_OF(X509) *recips=NULL;
 
-        SSLeay_add_all_algorithms();
+        OpenSSL_add_all_algorithms();
 
         data=BIO_new(BIO_s_file());
         while(argc > 1)
@@ -98,7 +99,8 @@ char *argv[];
                         argc-=2;
                         argv+=2;
                         if (!(in=BIO_new_file(keyfile,"r"))) goto err;
-                        if (!(x509=PEM_read_bio_X509(in,NULL,NULL))) goto err;
+                        if (!(x509=PEM_read_bio_X509(in,NULL,NULL,NULL)))
+                                goto err;
                         if(!recips) recips = sk_X509_new_null();
                         sk_X509_push(recips, x509);
                         BIO_free(in);
@@ -125,7 +127,14 @@ char *argv[];
 #else
         PKCS7_set_type(p7,NID_pkcs7_enveloped);
 #endif
-        if(!cipher) cipher = EVP_des_ede3_cbc();
+        if(!cipher)     {
+#ifndef NO_DES
+                cipher = EVP_des_ede3_cbc();
+#else
+                fprintf(stderr, "No cipher selected\n");
+                goto err;
+#endif
+        }
 
         if (!PKCS7_set_cipher(p7,cipher)) goto err;
         for(i = 0; i < sk_X509_num(recips); i++) {
diff --git a/src/lib/libcrypto/pkcs7/example.c b/src/lib/libcrypto/pkcs7/example.c
index 7354890084..f6656be28e 100644
--- a/src/lib/libcrypto/pkcs7/example.c
+++ b/src/lib/libcrypto/pkcs7/example.c
@@ -1,5 +1,6 @@
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <openssl/pkcs7.h>
 #include <openssl/asn1_mac.h>
 
@@ -36,7 +37,7 @@ void add_signed_string(PKCS7_SIGNER_INFO *si, char *str)
                 signed_string_nid=
                         OBJ_create("1.2.3.4.5","OID_example","Our example OID");
         os=ASN1_OCTET_STRING_new();
-        ASN1_OCTET_STRING_set(os,str,strlen(str));
+        ASN1_OCTET_STRING_set(os,(unsigned char*)str,strlen(str));
         /* When we add, we do not free */
         PKCS7_add_signed_attribute(si,signed_string_nid,
                 V_ASN1_OCTET_STRING,(char *)os);
@@ -68,7 +69,7 @@ int get_signed_string(PKCS7_SIGNER_INFO *si, char *buf, int len)
         return(0);
         }
 
-static signed_seq2string_nid= -1;
+static int signed_seq2string_nid= -1;
 /* ########################################### */
 int add_signed_seq2string(PKCS7_SIGNER_INFO *si, char *str1, char *str2)
         {
@@ -86,8 +87,8 @@ int add_signed_seq2string(PKCS7_SIGNER_INFO *si, char *str1, char *str2)
 
         os1=ASN1_OCTET_STRING_new();
         os2=ASN1_OCTET_STRING_new();
-        ASN1_OCTET_STRING_set(os1,str1,strlen(str1));
-        ASN1_OCTET_STRING_set(os2,str1,strlen(str1));
+        ASN1_OCTET_STRING_set(os1,(unsigned char*)str1,strlen(str1));
+        ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));
         i =i2d_ASN1_OCTET_STRING(os1,NULL);
         i+=i2d_ASN1_OCTET_STRING(os2,NULL);
         total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
@@ -197,7 +198,7 @@ X509_ATTRIBUTE *create_string(char *str)
                 signed_string_nid=
                         OBJ_create("1.2.3.4.5","OID_example","Our example OID");
         os=ASN1_OCTET_STRING_new();
-        ASN1_OCTET_STRING_set(os,str,strlen(str));
+        ASN1_OCTET_STRING_set(os,(unsigned char*)str,strlen(str));
         /* When we add, we do not free */
         ret=X509_ATTRIBUTE_create(signed_string_nid,
                 V_ASN1_OCTET_STRING,(char *)os);
@@ -250,8 +251,8 @@ X509_ATTRIBUTE *add_seq2string(PKCS7_SIGNER_INFO *si, char *str1, char *str2)
 
         os1=ASN1_OCTET_STRING_new();
         os2=ASN1_OCTET_STRING_new();
-        ASN1_OCTET_STRING_set(os1,str1,strlen(str1));
-        ASN1_OCTET_STRING_set(os2,str1,strlen(str1));
+        ASN1_OCTET_STRING_set(os1,(unsigned char*)str1,strlen(str1));
+        ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));
         i =i2d_ASN1_OCTET_STRING(os1,NULL);
         i+=i2d_ASN1_OCTET_STRING(os2,NULL);
         total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
diff --git a/src/lib/libcrypto/pkcs7/pk7_attr.c b/src/lib/libcrypto/pkcs7/pk7_attr.c
new file mode 100644
index 0000000000..3b9c0fe3f2
--- /dev/null
+++ b/src/lib/libcrypto/pkcs7/pk7_attr.c
@@ -0,0 +1,85 @@
+/* pk7_attr.c */
+/* S/MIME code.
+ * Copyright (C) 1997-8 Dr S N Henson (shenson@bigfoot.com) 
+ * All Rights Reserved. 
+ * Redistribution of this code without the authors permission is expressly
+ * prohibited.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <openssl/bio.h>
+#include <openssl/asn1.h>
+#include <openssl/pem.h>
+#include <openssl/pkcs7.h>
+#include <openssl/err.h>
+
+int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK *cap)
+{
+        ASN1_STRING *seq;
+        unsigned char *p, *pp;
+        int len;
+        len=i2d_ASN1_SET(cap,NULL,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
+                                                V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        if(!(pp=(unsigned char *)Malloc(len))) {
+                PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        p=pp;
+        i2d_ASN1_SET(cap,&p,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
+                                                V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        if(!(seq = ASN1_STRING_new())) {
+                PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        if(!ASN1_STRING_set (seq, pp, len)) {
+                PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        Free (pp);
+        return PKCS7_add_signed_attribute(si, NID_SMIMECapabilities,
+                                                        V_ASN1_SEQUENCE, seq);
+}
+
+STACK *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si)
+{
+        ASN1_TYPE *cap;
+        unsigned char *p;
+        cap = PKCS7_get_signed_attribute(si, NID_SMIMECapabilities);
+        if (!cap) return NULL;
+        p = cap->value.sequence->data;
+        return d2i_ASN1_SET (NULL, &p, cap->value.sequence->length, 
+                (char *(*)())d2i_X509_ALGOR, X509_ALGOR_free, V_ASN1_SEQUENCE,
+                                                         V_ASN1_UNIVERSAL);
+}
+
+/* Basic smime-capabilities OID and optional integer arg */
+int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
+{
+        X509_ALGOR *alg;
+        if(!(alg = X509_ALGOR_new())) {
+                PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        ASN1_OBJECT_free(alg->algorithm);
+        alg->algorithm = OBJ_nid2obj (nid);
+        if (arg > 0) {
+                ASN1_INTEGER *nbit;
+                if(!(alg->parameter = ASN1_TYPE_new())) {
+                        PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if(!(nbit = ASN1_INTEGER_new())) {
+                        PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if(!ASN1_INTEGER_set (nbit, arg)) {
+                        PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                alg->parameter->value.integer = nbit;
+                alg->parameter->type = V_ASN1_INTEGER;
+        }
+        sk_push (sk, (char *)alg);
+        return 1;
+}
diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index dee81b547a..80ac5e34b4 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -61,6 +61,7 @@
 #include <openssl/rand.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 static int add_attribute(STACK_OF(X509_ATTRIBUTE) **sk, int nid, int atrtype,
                          void *value);
@@ -160,9 +161,10 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 BIO_get_cipher_ctx(btmp, &ctx);
                 keylen=EVP_CIPHER_key_length(evp_cipher);
                 ivlen=EVP_CIPHER_iv_length(evp_cipher);
-                RAND_bytes(key,keylen);
+                if (RAND_bytes(key,keylen) <= 0)
+                        goto err;
                 xalg->algorithm = OBJ_nid2obj(EVP_CIPHER_type(evp_cipher));
-                if (ivlen > 0) RAND_bytes(iv,ivlen);
+                if (ivlen > 0) RAND_pseudo_bytes(iv,ivlen);
                 EVP_CipherInit(ctx, evp_cipher, key, iv, 1);
 
                 if (ivlen > 0) {
@@ -204,7 +206,7 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                                 Free(tmp);
                                 goto err;
                                 }
-                        ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj);
+                        M_ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj);
                         }
                 Free(tmp);
                 memset(key, 0, keylen);
@@ -216,30 +218,23 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 btmp=NULL;
                 }
 
-        if (bio == NULL) /* ??????????? */
-                {
+        if (bio == NULL) {
                 if (p7->detached)
                         bio=BIO_new(BIO_s_null());
-                else
-                        {
-                        bio=BIO_new(BIO_s_mem());
-                        /* We need to set this so that when we have read all
-                         * the data, the encrypt BIO, if present, will read
-                         * EOF and encode the last few bytes */
-                        BIO_set_mem_eof_return(bio,0);
-
+                else {
                         if (PKCS7_type_is_signed(p7) &&
-                                PKCS7_type_is_data(p7->d.sign->contents))
-                                {
+                                PKCS7_type_is_data(p7->d.sign->contents)) {
                                 ASN1_OCTET_STRING *os;
-
                                 os=p7->d.sign->contents->d.data;
-                                if (os->length > 0)
-                                        BIO_write(bio,(char *)os->data,
-                                                os->length);
-                                }
+                                if (os->length > 0) bio = 
+                                        BIO_new_mem_buf(os->data, os->length);
+                        } 
+                        if(bio == NULL) {
+                                bio=BIO_new(BIO_s_mem());
+                                BIO_set_mem_eof_return(bio,0);
                         }
                 }
+        }
         BIO_push(out,bio);
         bio=NULL;
         if (0)
@@ -259,7 +254,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         {
         int i,j;
         BIO *out=NULL,*btmp=NULL,*etmp=NULL,*bio=NULL;
-        char *tmp=NULL;
+        unsigned char *tmp=NULL;
         X509_ALGOR *xa;
         ASN1_OCTET_STRING *data_body=NULL;
         const EVP_MD *evp_md;
@@ -270,6 +265,9 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
         X509_ALGOR *xalg=NULL;
         PKCS7_RECIP_INFO *ri=NULL;
+#ifndef NO_RC2
+        char is_rc2 = 0;
+#endif
 /*      EVP_PKEY *pkey; */
 #if 0
         X509_STORE_CTX s_ctx;
@@ -314,6 +312,16 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 goto err;
                 }
 
+        if(EVP_CIPHER_nid(evp_cipher) == NID_rc2_cbc)
+                {
+#ifndef NO_RC2          
+                is_rc2 = 1; 
+#else
+                PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
+                goto err;
+#endif
+                }
+
         /* We will be checking the signature */
         if (md_sk != NULL)
                 {
@@ -372,7 +380,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                         ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
                         if(!X509_NAME_cmp(ri->issuer_and_serial->issuer,
                                         pcert->cert_info->issuer) &&
-                             !ASN1_INTEGER_cmp(pcert->cert_info->serialNumber,
+                             !M_ASN1_INTEGER_cmp(pcert->cert_info->serialNumber,
                                         ri->issuer_and_serial->serial)) break;
                         ri=NULL;
                 }
@@ -383,17 +391,15 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 }
 
                 jj=EVP_PKEY_size(pkey);
-                tmp=Malloc(jj+10);
+                tmp=(unsigned char *)Malloc(jj+10);
                 if (tmp == NULL)
                         {
                         PKCS7err(PKCS7_F_PKCS7_DATADECODE,ERR_R_MALLOC_FAILURE);
                         goto err;
                         }
 
-                jj=EVP_PKEY_decrypt((unsigned char *)tmp,
-                        ASN1_STRING_data(ri->enc_key),
-                        ASN1_STRING_length(ri->enc_key),
-                        pkey);
+                jj=EVP_PKEY_decrypt(tmp, M_ASN1_STRING_data(ri->enc_key),
+                        M_ASN1_STRING_length(ri->enc_key), pkey);
                 if (jj <= 0)
                         {
                         PKCS7err(PKCS7_F_PKCS7_DATADECODE,ERR_R_EVP_LIB);
@@ -406,13 +412,25 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 if (EVP_CIPHER_asn1_to_param(evp_ctx,enc_alg->parameter) < 0)
                         return(NULL);
 
-                if (jj != EVP_CIPHER_CTX_key_length(evp_ctx))
-                        {
-                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,
+                if (jj != EVP_CIPHER_CTX_key_length(evp_ctx)) {
+                        /* HACK: some S/MIME clients don't use the same key
+                         * and effective key length. The key length is
+                         * determined by the size of the decrypted RSA key.
+                         * So we hack things to manually set the RC2 key
+                         * because we currently can't do this with the EVP
+                         * interface.
+                         */
+#ifndef NO_RC2          
+                        if(is_rc2) RC2_set_key(&(evp_ctx->c.rc2_ks),jj, tmp,
+                                        EVP_CIPHER_CTX_key_length(evp_ctx)*8);
+                        else
+#endif
+                                {
+                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
                                         PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH);
-                        goto err;
-                        }
-                EVP_CipherInit(evp_ctx,NULL,(unsigned char *)tmp,NULL,0);
+                                goto err;
+                                }
+                } else EVP_CipherInit(evp_ctx,NULL,tmp,NULL,0);
 
                 memset(tmp,0,jj);
 
@@ -430,6 +448,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 }
         else 
                 {
+#if 0
                 bio=BIO_new(BIO_s_mem());
                 /* We need to set this so that when we have read all
                  * the data, the encrypt BIO, if present, will read
@@ -438,6 +457,14 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
                 if (data_body->length > 0)
                         BIO_write(bio,(char *)data_body->data,data_body->length);
+#else
+                if (data_body->length > 0)
+                      bio = BIO_new_mem_buf(data_body->data,data_body->length);
+                else {
+                        bio=BIO_new(BIO_s_mem());
+                        BIO_set_mem_eof_return(bio,0);
+                }
+#endif
                 }
         BIO_push(out,bio);
         bio=NULL;
@@ -479,12 +506,12 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
         case NID_pkcs7_signedAndEnveloped:
                 /* XXXXXXXXXXXXXXXX */
                 si_sk=p7->d.signed_and_enveloped->signer_info;
-                os=ASN1_OCTET_STRING_new();
+                os=M_ASN1_OCTET_STRING_new();
                 p7->d.signed_and_enveloped->enc_data->enc_data=os;
                 break;
         case NID_pkcs7_enveloped:
                 /* XXXXXXXXXXXXXXXX */
-                os=ASN1_OCTET_STRING_new();
+                os=M_ASN1_OCTET_STRING_new();
                 p7->d.enveloped->enc_data->enc_data=os;
                 break;
         case NID_pkcs7_signed:
@@ -492,7 +519,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                 os=p7->d.sign->contents->d.data;
                 /* If detached data then the content is excluded */
                 if(p7->detached) {
-                        ASN1_OCTET_STRING_free(os);
+                        M_ASN1_OCTET_STRING_free(os);
                         p7->d.sign->contents->d.data = NULL;
                 }
                 break;
@@ -527,7 +554,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                         PKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_INTERNAL_ERROR);
                                         goto err;
                                         }
-                                if (EVP_MD_type(EVP_MD_CTX_type(mdc)) == j)
+                                if (EVP_MD_CTX_type(mdc) == j)
                                         break;
                                 else
                                         btmp=btmp->next_bio;
@@ -561,10 +588,10 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                         V_ASN1_UTCTIME,sign_time);
 
                                 /* Add digest */
-                                md_tmp=EVP_MD_CTX_type(&ctx_tmp);
+                                md_tmp=EVP_MD_CTX_md(&ctx_tmp);
                                 EVP_DigestFinal(&ctx_tmp,md_data,&md_len);
-                                digest=ASN1_OCTET_STRING_new();
-                                ASN1_OCTET_STRING_set(digest,md_data,md_len);
+                                digest=M_ASN1_OCTET_STRING_new();
+                                M_ASN1_OCTET_STRING_set(digest,md_data,md_len);
                                 PKCS7_add_signed_attribute(si,
                                         NID_pkcs9_messageDigest,
                                         V_ASN1_OCTET_STRING,digest);
@@ -611,8 +638,17 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                         goto err;
                         }
                 BIO_get_mem_ptr(btmp,&buf_mem);
-                ASN1_OCTET_STRING_set(os,
+                /* Mark the BIO read only then we can use its copy of the data
+                 * instead of making an extra copy.
+                 */
+                BIO_set_flags(btmp, BIO_FLAGS_MEM_RDONLY);
+                BIO_set_mem_eof_return(btmp, 0);
+                os->data = (unsigned char *)buf_mem->data;
+                os->length = buf_mem->length;
+#if 0
+                M_ASN1_OCTET_STRING_set(os,
                         (unsigned char *)buf_mem->data,buf_mem->length);
+#endif
                 }
         if (pp != NULL) Free(pp);
         pp=NULL;
@@ -658,6 +694,7 @@ int PKCS7_dataVerify(X509_STORE *cert_store, X509_STORE_CTX *ctx, BIO *bio,
 
         /* Lets verify */
         X509_STORE_CTX_init(ctx,cert_store,x509,cert);
+        X509_STORE_CTX_set_purpose(ctx, X509_PURPOSE_SMIME_SIGN);
         i=X509_verify_cert(ctx);
         if (i <= 0) 
                 {
@@ -709,7 +746,7 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
                                                         PKCS7_R_INTERNAL_ERROR);
                         goto err;
                         }
-                if (EVP_MD_type(EVP_MD_CTX_type(mdc)) == md_type)
+                if (EVP_MD_CTX_type(mdc) == md_type)
                         break;
                 btmp=btmp->next_bio;    
                 }
diff --git a/src/lib/libcrypto/pkcs7/pk7_lib.c b/src/lib/libcrypto/pkcs7/pk7_lib.c
index 8b863d0558..45973fe850 100644
--- a/src/lib/libcrypto/pkcs7/pk7_lib.c
+++ b/src/lib/libcrypto/pkcs7/pk7_lib.c
@@ -123,7 +123,7 @@ int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data)
                 {
         case NID_pkcs7_signed:
                 if (p7->d.sign->contents != NULL)
-                        PKCS7_content_free(p7->d.sign->contents);
+                        PKCS7_free(p7->d.sign->contents);
                 p7->d.sign->contents=p7_data;
                 break;
         case NID_pkcs7_digest:
@@ -157,7 +157,7 @@ int PKCS7_set_type(PKCS7 *p7, int type)
                 break;
         case NID_pkcs7_data:
                 p7->type=obj;
-                if ((p7->d.data=ASN1_OCTET_STRING_new()) == NULL)
+                if ((p7->d.data=M_ASN1_OCTET_STRING_new()) == NULL)
                         goto err;
                 break;
         case NID_pkcs7_signedAndEnveloped:
@@ -165,9 +165,6 @@ int PKCS7_set_type(PKCS7 *p7, int type)
                 if ((p7->d.signed_and_enveloped=PKCS7_SIGN_ENVELOPE_new())
                         == NULL) goto err;
                 ASN1_INTEGER_set(p7->d.signed_and_enveloped->version,1);
-/*              p7->d.signed_and_enveloped->enc_data->content_type=
-                        OBJ_nid2obj(NID_pkcs7_encrypted);*/
-                        
                 break;
         case NID_pkcs7_enveloped:
                 p7->type=obj;
@@ -175,8 +172,14 @@ int PKCS7_set_type(PKCS7 *p7, int type)
                         == NULL) goto err;
                 ASN1_INTEGER_set(p7->d.enveloped->version,0);
                 break;
-        case NID_pkcs7_digest:
         case NID_pkcs7_encrypted:
+                p7->type=obj;
+                if ((p7->d.encrypted=PKCS7_ENCRYPT_new())
+                        == NULL) goto err;
+                ASN1_INTEGER_set(p7->d.encrypted->version,0);
+                break;
+
+        case NID_pkcs7_digest:
         default:
                 PKCS7err(PKCS7_F_PKCS7_SET_TYPE,PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
                 goto err;
@@ -224,8 +227,13 @@ int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)
                 }
         if (!j) /* we need to add another algorithm */
                 {
-                alg=X509_ALGOR_new();
+                if(!(alg=X509_ALGOR_new())
+                        || !(alg->parameter = ASN1_TYPE_new())) {
+                        PKCS7err(PKCS7_F_PKCS7_ADD_SIGNER,ERR_R_MALLOC_FAILURE);
+                        return(0);
+                }
                 alg->algorithm=OBJ_nid2obj(nid);
+                alg->parameter->type = V_ASN1_NULL;
                 sk_X509_ALGOR_push(md_sk,alg);
                 }
 
@@ -289,6 +297,9 @@ int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl)
 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
              EVP_MD *dgst)
         {
+        char is_dsa;
+        if (pkey->type == EVP_PKEY_DSA) is_dsa = 1;
+        else is_dsa = 0;
         /* We now need to add another PKCS7_SIGNER_INFO entry */
         ASN1_INTEGER_set(p7i->version,1);
         X509_NAME_set(&p7i->issuer_and_serial->issuer,
@@ -296,17 +307,16 @@ int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
 
         /* because ASN1_INTEGER_set is used to set a 'long' we will do
          * things the ugly way. */
-        ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
+        M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
         p7i->issuer_and_serial->serial=
-                ASN1_INTEGER_dup(X509_get_serialNumber(x509));
+                M_ASN1_INTEGER_dup(X509_get_serialNumber(x509));
 
         /* lets keep the pkey around for a while */
         CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
         p7i->pkey=pkey;
 
         /* Set the algorithms */
-        if (pkey->type == EVP_PKEY_DSA)
-                p7i->digest_alg->algorithm=OBJ_nid2obj(NID_sha1);
+        if (is_dsa) p7i->digest_alg->algorithm=OBJ_nid2obj(NID_sha1);
         else    
                 p7i->digest_alg->algorithm=OBJ_nid2obj(EVP_MD_type(dgst));
 
@@ -320,9 +330,12 @@ int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
 
         if (p7i->digest_enc_alg->parameter != NULL)
                 ASN1_TYPE_free(p7i->digest_enc_alg->parameter);
-        if ((p7i->digest_enc_alg->parameter=ASN1_TYPE_new()) == NULL)
-                goto err;
-        p7i->digest_enc_alg->parameter->type=V_ASN1_NULL;
+        if(is_dsa) p7i->digest_enc_alg->parameter = NULL;
+        else {
+                if (!(p7i->digest_enc_alg->parameter=ASN1_TYPE_new()))
+                        goto err;
+                p7i->digest_enc_alg->parameter->type=V_ASN1_NULL;
+        }
 
         return(1);
 err:
@@ -397,9 +410,9 @@ int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509)
         X509_NAME_set(&p7i->issuer_and_serial->issuer,
                 X509_get_issuer_name(x509));
 
-        ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
+        M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
         p7i->issuer_and_serial->serial=
-                ASN1_INTEGER_dup(X509_get_serialNumber(x509));
+                M_ASN1_INTEGER_dup(X509_get_serialNumber(x509));
 
         X509_ALGOR_free(p7i->key_enc_algor);
         p7i->key_enc_algor=(X509_ALGOR *)ASN1_dup(i2d_X509_ALGOR,
@@ -425,6 +438,7 @@ X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si)
 int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher)
         {
         int i;
+        ASN1_OBJECT *objtmp;
         PKCS7_ENC_CONTENT *ec;
 
         i=OBJ_obj2nid(p7->type);
@@ -441,7 +455,13 @@ int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher)
                 return(0);
                 }
 
-        /* Setup cipher OID */
+        /* Check cipher OID exists and has data in it*/
+        i = EVP_CIPHER_type(cipher);
+        if(i == NID_undef) {
+                PKCS7err(PKCS7_F_PKCS7_SET_CIPHER,PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
+                return(0);
+        }
+        objtmp = OBJ_nid2obj(i);
 
         ec->cipher = cipher;
         return 1;
diff --git a/src/lib/libcrypto/pkcs7/pk7_mime.c b/src/lib/libcrypto/pkcs7/pk7_mime.c
new file mode 100644
index 0000000000..734643be28
--- /dev/null
+++ b/src/lib/libcrypto/pkcs7/pk7_mime.c
@@ -0,0 +1,673 @@
+/* pk7_mime.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/rand.h>
+#include <openssl/x509.h>
+
+/* MIME and related routines */
+
+/* MIME format structures
+ * Note that all are translated to lower case apart from
+ * parameter values. Quotes are stripped off
+ */
+
+typedef struct {
+char *name;                             /* Name of line e.g. "content-type" */
+char *value;                            /* Value of line e.g. "text/plain" */
+STACK /* MIME_PARAM */ *params;         /* Zero or more parameters */
+} MIME_HEADER;
+
+typedef struct {
+char *param_name;                       /* Param name e.g. "micalg" */
+char *param_value;                      /* Param value e.g. "sha1" */
+} MIME_PARAM;
+
+
+static int B64_write_PKCS7(BIO *bio, PKCS7 *p7);
+static PKCS7 *B64_read_PKCS7(BIO *bio);
+static char * strip_ends(char *name);
+static char * strip_start(char *name);
+static char * strip_end(char *name);
+static MIME_HEADER *mime_hdr_new(char *name, char *value);
+static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value);
+static STACK *mime_parse_hdr(BIO *bio);
+static int mime_hdr_cmp(MIME_HEADER **a, MIME_HEADER **b);
+static int mime_param_cmp(MIME_PARAM **a, MIME_PARAM **b);
+static void mime_param_free(MIME_PARAM *param);
+static int mime_bound_check(char *line, int linelen, char *bound, int blen);
+static int multi_split(BIO *bio, char *bound, STACK **ret);
+static int iscrlf(char c);
+static MIME_HEADER *mime_hdr_find(STACK *hdrs, char *name);
+static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name);
+static void mime_hdr_free(MIME_HEADER *hdr);
+
+#define MAX_SMLEN 1024
+#define mime_debug(x) /* x */
+
+
+typedef void (*stkfree)();
+
+/* Base 64 read and write of PKCS#7 structure */
+
+static int B64_write_PKCS7(BIO *bio, PKCS7 *p7)
+{
+        BIO *b64;
+        if(!(b64 = BIO_new(BIO_f_base64()))) {
+                PKCS7err(PKCS7_F_B64_WRITE_PKCS7,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        bio = BIO_push(b64, bio);
+        i2d_PKCS7_bio(bio, p7);
+        BIO_flush(bio);
+        bio = BIO_pop(bio);
+        BIO_free(b64);
+        return 1;
+}
+
+static PKCS7 *B64_read_PKCS7(BIO *bio)
+{
+        BIO *b64;
+        PKCS7 *p7;
+        if(!(b64 = BIO_new(BIO_f_base64()))) {
+                PKCS7err(PKCS7_F_B64_READ_PKCS7,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        bio = BIO_push(b64, bio);
+        if(!(p7 = d2i_PKCS7_bio(bio, NULL))) 
+                PKCS7err(PKCS7_F_B64_READ_PKCS7,PKCS7_R_DECODE_ERROR);
+        BIO_flush(bio);
+        bio = BIO_pop(bio);
+        BIO_free(b64);
+        return p7;
+}
+
+/* SMIME sender */
+
+int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
+{
+        char linebuf[MAX_SMLEN];
+        char bound[33], c;
+        int i;
+        if((flags & PKCS7_DETACHED) && data) {
+        /* We want multipart/signed */
+                /* Generate a random boundary */
+                RAND_pseudo_bytes((unsigned char *)bound, 32);
+                for(i = 0; i < 32; i++) {
+                        c = bound[i] & 0xf;
+                        if(c < 10) c += '0';
+                        else c += 'A' - 10;
+                        bound[i] = c;
+                }
+                bound[32] = 0;
+                BIO_printf(bio, "MIME-Version: 1.0\n");
+                BIO_printf(bio, "Content-Type: multipart/signed ; ");
+                BIO_printf(bio, "protocol=\"application/x-pkcs7-signature\" ; ");
+                BIO_printf(bio, "micalg=sha1 ; boundary=\"----%s\"\n\n", bound);
+                BIO_printf(bio, "This is an S/MIME signed message\n\n");
+                /* Now write out the first part */
+                BIO_printf(bio, "------%s\r\n", bound);
+                if(flags & PKCS7_TEXT) BIO_printf(bio, "Content-Type: text/plain\n\n");
+                while((i = BIO_read(data, linebuf, MAX_SMLEN)) > 0) 
+                                                BIO_write(bio, linebuf, i);
+                BIO_printf(bio, "\n------%s\n", bound);
+
+                /* Headers for signature */
+
+                BIO_printf(bio, "Content-Type: application/x-pkcs7-signature; name=\"smime.p7s\"\n");
+                BIO_printf(bio, "Content-Transfer-Encoding: base64\n");
+                BIO_printf(bio, "Content-Disposition: attachment; filename=\"smime.p7s\"\n\n");
+                B64_write_PKCS7(bio, p7);
+                BIO_printf(bio,"\n------%s--\n\n", bound);
+                return 1;
+        }
+        /* MIME headers */
+        BIO_printf(bio, "MIME-Version: 1.0\n");
+        BIO_printf(bio, "Content-Disposition: attachment; filename=\"smime.p7m\"\n");
+        BIO_printf(bio, "Content-Type: application/x-pkcs7-mime; name=\"smime.p7m\"\n");
+        BIO_printf(bio, "Content-Transfer-Encoding: base64\n\n");
+        B64_write_PKCS7(bio, p7);
+        BIO_printf(bio, "\n");
+        return 1;
+}
+
+/* SMIME reader: handle multipart/signed and opaque signing.
+ * in multipart case the content is placed in a memory BIO
+ * pointed to by "bcont". In opaque this is set to NULL
+ */
+
+PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont)
+{
+        BIO *p7in;
+        STACK *headers = NULL;
+        STACK *parts = NULL;
+        MIME_HEADER *hdr;
+        MIME_PARAM *prm;
+        PKCS7 *p7;
+        int ret;
+
+        if(bcont) *bcont = NULL;
+
+        if (!(headers = mime_parse_hdr(bio))) {
+                PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_MIME_PARSE_ERROR);
+                return NULL;
+        }
+
+        if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
+                sk_pop_free(headers, mime_hdr_free);
+                PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_CONTENT_TYPE);
+                return NULL;
+        }
+
+        /* Handle multipart/signed */
+
+        if(!strcmp(hdr->value, "multipart/signed")) {
+                /* Split into two parts */
+                prm = mime_param_find(hdr, "boundary");
+                if(!prm || !prm->param_value) {
+                        sk_pop_free(headers, mime_hdr_free);
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_MULTIPART_BOUNDARY);
+                        return NULL;
+                }
+                ret = multi_split(bio, prm->param_value, &parts);
+                sk_pop_free(headers, mime_hdr_free);
+                if(!ret || (sk_num(parts) != 2) ) {
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_MULTIPART_BODY_FAILURE);
+                        sk_pop_free(parts, (stkfree)BIO_free);
+                        return NULL;
+                }
+
+                /* Parse the signature piece */
+                p7in = (BIO *)sk_value(parts, 1);
+
+                if (!(headers = mime_parse_hdr(p7in))) {
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_MIME_SIG_PARSE_ERROR);
+                        sk_pop_free(parts, (stkfree)BIO_free);
+                        return NULL;
+                }
+
+                /* Get content type */
+
+                if(!(hdr = mime_hdr_find(headers, "content-type")) ||
+                                                                 !hdr->value) {
+                        sk_pop_free(headers, mime_hdr_free);
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_SIG_CONTENT_TYPE);
+                        return NULL;
+                }
+
+                if(strcmp(hdr->value, "application/x-pkcs7-signature") &&
+                        strcmp(hdr->value, "application/pkcs7-signature")) {
+                        sk_pop_free(headers, mime_hdr_free);
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_SIG_INVALID_MIME_TYPE);
+                        ERR_add_error_data(2, "type: ", hdr->value);
+                        sk_pop_free(parts, (stkfree)BIO_free);
+                        return NULL;
+                }
+                sk_pop_free(headers, mime_hdr_free);
+                /* Read in PKCS#7 */
+                if(!(p7 = B64_read_PKCS7(p7in))) {
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_PKCS7_SIG_PARSE_ERROR);
+                        sk_pop_free(parts, (stkfree)BIO_free);
+                        return NULL;
+                }
+
+                if(bcont) {
+                        *bcont = (BIO *)sk_value(parts, 0);
+                        BIO_free(p7in);
+                        sk_free(parts);
+                } else sk_pop_free(parts, (stkfree)BIO_free);
+                return p7;
+        }
+                
+        /* OK, if not multipart/signed try opaque signature */
+
+        if (strcmp (hdr->value, "application/x-pkcs7-mime") &&
+            strcmp (hdr->value, "application/pkcs7-mime")) {
+                PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_INVALID_MIME_TYPE);
+                ERR_add_error_data(2, "type: ", hdr->value);
+                sk_pop_free(headers, mime_hdr_free);
+                return NULL;
+        }
+
+        sk_pop_free(headers, mime_hdr_free);
+        
+        if(!(p7 = B64_read_PKCS7(bio))) {
+                PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_PKCS7_PARSE_ERROR);
+                return NULL;
+        }
+        return p7;
+
+}
+
+/* Copy text from one BIO to another making the output CRLF at EOL */
+int SMIME_crlf_copy(BIO *in, BIO *out, int flags)
+{
+        char eol;
+        int len;
+        char linebuf[MAX_SMLEN];
+        if(flags & PKCS7_BINARY) {
+                while((len = BIO_read(in, linebuf, MAX_SMLEN)) > 0)
+                                                BIO_write(out, linebuf, len);
+                return 1;
+        }
+        if(flags & PKCS7_TEXT) BIO_printf(out, "Content-Type: text/plain\r\n\r\n");
+        while ((len = BIO_gets(in, linebuf, MAX_SMLEN)) > 0) {
+                eol = 0;
+                while(iscrlf(linebuf[len - 1])) {
+                        len--;
+                        eol = 1;
+                }       
+                BIO_write(out, linebuf, len);
+                if(eol) BIO_write(out, "\r\n", 2);
+        }
+        return 1;
+}
+
+/* Strip off headers if they are text/plain */
+int SMIME_text(BIO *in, BIO *out)
+{
+        char iobuf[4096];
+        int len;
+        STACK *headers;
+        MIME_HEADER *hdr;
+        if (!(headers = mime_parse_hdr(in))) {
+                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_MIME_PARSE_ERROR);
+                return 0;
+        }
+        if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
+                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_MIME_NO_CONTENT_TYPE);
+                sk_pop_free(headers, mime_hdr_free);
+                return 0;
+        }
+        if (strcmp (hdr->value, "text/plain")) {
+                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_INVALID_MIME_TYPE);
+                ERR_add_error_data(2, "type: ", hdr->value);
+                sk_pop_free(headers, mime_hdr_free);
+                return 0;
+        }
+        sk_pop_free(headers, mime_hdr_free);
+        while ((len = BIO_read(in, iobuf, sizeof(iobuf))) > 0)
+                                                BIO_write(out, iobuf, len);
+        return 1;
+}
+
+/* Split a multipart/XXX message body into component parts: result is
+ * canonical parts in a STACK of bios
+ */
+
+static int multi_split(BIO *bio, char *bound, STACK **ret)
+{
+        char linebuf[MAX_SMLEN];
+        int len, blen;
+        BIO *bpart = NULL;
+        STACK *parts;
+        char state, part, first;
+        blen = strlen(bound);
+        part = 0;
+        state = 0;
+        first = 1;
+        parts = sk_new(NULL);
+        *ret = parts;
+        while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
+                state = mime_bound_check(linebuf, len, bound, blen);
+                if(state == 1) {
+                        first = 1;
+                        part++;
+                } else if(state == 2) {
+                        sk_push(parts, (char *)bpart);
+                        return 1;
+                } else if(part) {
+                        if(first) {
+                                first = 0;
+                                if(bpart) sk_push(parts, (char *)bpart);
+                                bpart = BIO_new(BIO_s_mem());
+                                
+                        } else BIO_write(bpart, "\r\n", 2);
+                        /* Strip CR+LF from linebuf */
+                        while(iscrlf(linebuf[len - 1])) len--;
+                        BIO_write(bpart, linebuf, len);
+                }
+        }
+        return 0;
+}
+
+static int iscrlf(char c)
+{
+        if(c == '\r' || c == '\n') return 1;
+        return 0;
+}
+
+/* This is the big one: parse MIME header lines up to message body */
+
+#define MIME_INVALID    0
+#define MIME_START      1
+#define MIME_TYPE       2
+#define MIME_NAME       3
+#define MIME_VALUE      4
+#define MIME_QUOTE      5
+#define MIME_COMMENT    6
+
+
+static STACK *mime_parse_hdr(BIO *bio)
+{
+        char *p, *q, c;
+        char *ntmp;
+        char linebuf[MAX_SMLEN];
+        MIME_HEADER *mhdr = NULL;
+        STACK *headers;
+        int len, state, save_state = 0;
+        headers = sk_new(mime_hdr_cmp);
+        while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
+        /* If whitespace at line start then continuation line */
+        if(mhdr && isspace((unsigned char)linebuf[0])) state = MIME_NAME;
+        else state = MIME_START;
+        ntmp = NULL;
+        /* Go through all characters */
+        for(p = linebuf, q = linebuf; (c = *p) && (c!='\r') && (c!='\n'); p++) {
+
+        /* State machine to handle MIME headers
+         * if this looks horrible that's because it *is*
+         */
+
+                switch(state) {
+                        case MIME_START:
+                        if(c == ':') {
+                                state = MIME_TYPE;
+                                *p = 0;
+                                ntmp = strip_ends(q);
+                                q = p + 1;
+                        }
+                        break;
+
+                        case MIME_TYPE:
+                        if(c == ';') {
+                                mime_debug("Found End Value\n");
+                                *p = 0;
+                                mhdr = mime_hdr_new(ntmp, strip_ends(q));
+                                sk_push(headers, (char *)mhdr);
+                                ntmp = NULL;
+                                q = p + 1;
+                                state = MIME_NAME;
+                        } else if(c == '(') {
+                                save_state = state;
+                                state = MIME_COMMENT;
+                        }
+                        break;
+
+                        case MIME_COMMENT:
+                        if(c == ')') {
+                                state = save_state;
+                        }
+                        break;
+
+                        case MIME_NAME:
+                        if(c == '=') {
+                                state = MIME_VALUE;
+                                *p = 0;
+                                ntmp = strip_ends(q);
+                                q = p + 1;
+                        }
+                        break ;
+
+                        case MIME_VALUE:
+                        if(c == ';') {
+                                state = MIME_NAME;
+                                *p = 0;
+                                mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
+                                ntmp = NULL;
+                                q = p + 1;
+                        } else if (c == '"') {
+                                mime_debug("Found Quote\n");
+                                state = MIME_QUOTE;
+                        } else if(c == '(') {
+                                save_state = state;
+                                state = MIME_COMMENT;
+                        }
+                        break;
+
+                        case MIME_QUOTE:
+                        if(c == '"') {
+                                mime_debug("Found Match Quote\n");
+                                state = MIME_VALUE;
+                        }
+                        break;
+                }
+        }
+
+        if(state == MIME_TYPE) {
+                mhdr = mime_hdr_new(ntmp, strip_ends(q));
+                sk_push(headers, (char *)mhdr);
+        } else if(state == MIME_VALUE)
+                         mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
+        if(p == linebuf) break; /* Blank line means end of headers */
+}
+
+return headers;
+
+}
+
+static char *strip_ends(char *name)
+{
+        return strip_end(strip_start(name));
+}
+
+/* Strip a parameter of whitespace from start of param */
+static char *strip_start(char *name)
+{
+        char *p, c;
+        /* Look for first non white space or quote */
+        for(p = name; (c = *p) ;p++) {
+                if(c == '"') {
+                        /* Next char is start of string if non null */
+                        if(p[1]) return p + 1;
+                        /* Else null string */
+                        return NULL;
+                }
+                if(!isspace((unsigned char)c)) return p;
+        }
+        return NULL;
+}
+
+/* As above but strip from end of string : maybe should handle brackets? */
+static char *strip_end(char *name)
+{
+        char *p, c;
+        if(!name) return NULL;
+        /* Look for first non white space or quote */
+        for(p = name + strlen(name) - 1; p >= name ;p--) {
+                c = *p;
+                if(c == '"') {
+                        if(p - 1 == name) return NULL;
+                        *p = 0;
+                        return name;
+                }
+                if(isspace((unsigned char)c)) *p = 0;   
+                else return name;
+        }
+        return NULL;
+}
+
+static MIME_HEADER *mime_hdr_new(char *name, char *value)
+{
+        MIME_HEADER *mhdr;
+        char *tmpname, *tmpval, *p;
+        int c;
+        if(name) {
+                if(!(tmpname = BUF_strdup(name))) return NULL;
+                for(p = tmpname ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpname = NULL;
+        if(value) {
+                if(!(tmpval = BUF_strdup(value))) return NULL;
+                for(p = tmpval ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpval = NULL;
+        mhdr = (MIME_HEADER *) Malloc(sizeof(MIME_HEADER));
+        if(!mhdr) return NULL;
+        mhdr->name = tmpname;
+        mhdr->value = tmpval;
+        if(!(mhdr->params = sk_new(mime_param_cmp))) return NULL;
+        return mhdr;
+}
+                
+static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value)
+{
+        char *tmpname, *tmpval, *p;
+        int c;
+        MIME_PARAM *mparam;
+        if(name) {
+                tmpname = BUF_strdup(name);
+                if(!tmpname) return 0;
+                for(p = tmpname ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpname = NULL;
+        if(value) {
+                tmpval = BUF_strdup(value);
+                if(!tmpval) return 0;
+        } else tmpval = NULL;
+        /* Parameter values are case sensitive so leave as is */
+        mparam = (MIME_PARAM *) Malloc(sizeof(MIME_PARAM));
+        if(!mparam) return 0;
+        mparam->param_name = tmpname;
+        mparam->param_value = tmpval;
+        sk_push(mhdr->params, (char *)mparam);
+        return 1;
+}
+
+static int mime_hdr_cmp(MIME_HEADER **a, MIME_HEADER **b)
+{
+        return(strcmp((*a)->name, (*b)->name));
+}
+
+static int mime_param_cmp(MIME_PARAM **a, MIME_PARAM **b)
+{
+        return(strcmp((*a)->param_name, (*b)->param_name));
+}
+
+/* Find a header with a given name (if possible) */
+
+static MIME_HEADER *mime_hdr_find(STACK *hdrs, char *name)
+{
+        MIME_HEADER htmp;
+        int idx;
+        htmp.name = name;
+        idx = sk_find(hdrs, (char *)&htmp);
+        if(idx < 0) return NULL;
+        return (MIME_HEADER *)sk_value(hdrs, idx);
+}
+
+static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name)
+{
+        MIME_PARAM param;
+        int idx;
+        param.param_name = name;
+        idx = sk_find(hdr->params, (char *)&param);
+        if(idx < 0) return NULL;
+        return (MIME_PARAM *)sk_value(hdr->params, idx);
+}
+
+static void mime_hdr_free(MIME_HEADER *hdr)
+{
+        if(hdr->name) Free(hdr->name);
+        if(hdr->value) Free(hdr->value);
+        if(hdr->params) sk_pop_free(hdr->params, mime_param_free);
+        Free(hdr);
+}
+
+static void mime_param_free(MIME_PARAM *param)
+{
+        if(param->param_name) Free(param->param_name);
+        if(param->param_value) Free(param->param_value);
+        Free(param);
+}
+
+/* Check for a multipart boundary. Returns:
+ * 0 : no boundary
+ * 1 : part boundary
+ * 2 : final boundary
+ */
+static int mime_bound_check(char *line, int linelen, char *bound, int blen)
+{
+        if(linelen == -1) linelen = strlen(line);
+        if(blen == -1) blen = strlen(bound);
+        /* Quickly eliminate if line length too short */
+        if(blen + 2 > linelen) return 0;
+        /* Check for part boundary */
+        if(!strncmp(line, "--", 2) && !strncmp(line + 2, bound, blen)) {
+                if(!strncmp(line + blen + 2, "--", 2)) return 2;
+                else return 1;
+        }
+        return 0;
+}
diff --git a/src/lib/libcrypto/pkcs7/pk7_smime.c b/src/lib/libcrypto/pkcs7/pk7_smime.c
new file mode 100644
index 0000000000..b41f42ed04
--- /dev/null
+++ b/src/lib/libcrypto/pkcs7/pk7_smime.c
@@ -0,0 +1,427 @@
+/* pk7_smime.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* Simple PKCS#7 processing functions */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
+                                                        BIO *data, int flags)
+{
+        PKCS7 *p7;
+        PKCS7_SIGNER_INFO *si;
+        BIO *p7bio;
+        STACK *smcap;
+        int i;
+
+        if(!X509_check_private_key(signcert, pkey)) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+                return NULL;
+        }
+
+        if(!(p7 = PKCS7_new())) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+        PKCS7_set_type(p7, NID_pkcs7_signed);
+
+        PKCS7_content_new(p7, NID_pkcs7_data);
+
+        if (!(si = PKCS7_add_signature(p7,signcert,pkey,EVP_sha1()))) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR);
+                return NULL;
+        }
+
+        if(!(flags & PKCS7_NOCERTS)) {
+                PKCS7_add_certificate(p7, signcert);
+                if(certs) for(i = 0; i < sk_X509_num(certs); i++)
+                        PKCS7_add_certificate(p7, sk_X509_value(certs, i));
+        }
+
+        if(!(p7bio = PKCS7_dataInit(p7, NULL))) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+
+        SMIME_crlf_copy(data, p7bio, flags);
+
+        if(!(flags & PKCS7_NOATTR)) {
+                PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
+                                V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data));
+                /* Add SMIMECapabilities */
+                if(!(smcap = sk_new(NULL))) {
+                        PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                }
+#ifndef NO_DES
+                PKCS7_simple_smimecap (smcap, NID_des_ede3_cbc, -1);
+#endif
+#ifndef NO_RC2
+                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 128);
+                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64);
+#endif
+#ifndef NO_DES
+                PKCS7_simple_smimecap (smcap, NID_des_cbc, -1);
+#endif
+#ifndef NO_RC2
+                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
+#endif
+                PKCS7_add_attrib_smimecap (si, smcap);
+                sk_pop_free(smcap, X509_ALGOR_free);
+        }
+
+        if(flags & PKCS7_DETACHED)PKCS7_set_detached(p7, 1);
+
+        if (!PKCS7_dataFinal(p7,p7bio)) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,PKCS7_R_PKCS7_DATASIGN);
+                return NULL;
+        }
+
+        BIO_free_all(p7bio);
+        return p7;
+}
+
+int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
+                                        BIO *indata, BIO *out, int flags)
+{
+        STACK_OF(X509) *signers;
+        X509 *signer;
+        STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
+        PKCS7_SIGNER_INFO *si;
+        X509_STORE_CTX cert_ctx;
+        char buf[4096];
+        int i, j=0;
+        BIO *p7bio;
+        BIO *tmpout;
+
+        if(!p7) {
+                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_INVALID_NULL_POINTER);
+                return 0;
+        }
+
+        if(!PKCS7_type_is_signed(p7)) {
+                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_WRONG_CONTENT_TYPE);
+                return 0;
+        }
+
+        /* Check for no data and no content: no data to verify signature */
+        if(PKCS7_get_detached(p7) && !indata) {
+                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_CONTENT);
+                return 0;
+        }
+
+        /* Check for data and content: two sets of data */
+        if(!PKCS7_get_detached(p7) && indata) {
+                                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_CONTENT_AND_DATA_PRESENT);
+                return 0;
+        }
+
+        sinfos = PKCS7_get_signer_info(p7);
+
+        if(!sinfos || !sk_PKCS7_SIGNER_INFO_num(sinfos)) {
+                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_SIGNATURES_ON_DATA);
+                return 0;
+        }
+
+
+        signers = PKCS7_get0_signers(p7, certs, flags);
+
+        if(!signers) return 0;
+
+        /* Now verify the certificates */
+
+        if (!(flags & PKCS7_NOVERIFY)) for (i = 0; i < sk_X509_num(signers); i++) {
+                signer = sk_X509_value (signers, i);
+                if (!(flags & PKCS7_NOCHAIN)) {
+                        X509_STORE_CTX_init(&cert_ctx, store, signer,
+                                                        p7->d.sign->cert);
+                        X509_STORE_CTX_set_purpose(&cert_ctx,
+                                                X509_PURPOSE_SMIME_SIGN);
+                } else X509_STORE_CTX_init (&cert_ctx, store, signer, NULL);
+                i = X509_verify_cert(&cert_ctx);
+                if (i <= 0) j = X509_STORE_CTX_get_error(&cert_ctx);
+                X509_STORE_CTX_cleanup(&cert_ctx);
+                if (i <= 0) {
+                        PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_CERTIFICATE_VERIFY_ERROR);
+                        ERR_add_error_data(2, "Verify error:",
+                                         X509_verify_cert_error_string(j));
+                        sk_X509_free(signers);
+                        return 0;
+                }
+                /* Check for revocation status here */
+        }
+
+        p7bio=PKCS7_dataInit(p7,indata);
+
+        if(flags & PKCS7_TEXT) {
+                if(!(tmpout = BIO_new(BIO_s_mem()))) {
+                        PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+        } else tmpout = out;
+
+        /* We now have to 'read' from p7bio to calculate digests etc. */
+        for (;;)
+        {
+                i=BIO_read(p7bio,buf,sizeof(buf));
+                if (i <= 0) break;
+                if (tmpout) BIO_write(tmpout, buf, i);
+        }
+
+        if(flags & PKCS7_TEXT) {
+                if(!SMIME_text(tmpout, out)) {
+                        PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_SMIME_TEXT_ERROR);
+                        BIO_free(tmpout);
+                        goto err;
+                }
+                BIO_free(tmpout);
+        }
+
+        /* Now Verify All Signatures */
+        if (!(flags & PKCS7_NOSIGS))
+            for (i=0; i<sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
+                {
+                si=sk_PKCS7_SIGNER_INFO_value(sinfos,i);
+                signer = sk_X509_value (signers, i);
+                j=PKCS7_signatureVerify(p7bio,p7,si, signer);
+                if (j <= 0) {
+                        PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_SIGNATURE_FAILURE);
+                        goto err;
+                }
+        }
+
+        sk_X509_free(signers);
+        if(indata) BIO_pop(p7bio);
+        BIO_free_all(p7bio);
+
+        return 1;
+
+        err:
+
+        sk_X509_free(signers);
+        BIO_free(p7bio);
+
+        return 0;
+}
+
+STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
+{
+        STACK_OF(X509) *signers;
+        STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
+        PKCS7_SIGNER_INFO *si;
+        PKCS7_ISSUER_AND_SERIAL *ias;
+        X509 *signer;
+        int i;
+
+        if(!p7) {
+                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_INVALID_NULL_POINTER);
+                return NULL;
+        }
+
+        if(!PKCS7_type_is_signed(p7)) {
+                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_WRONG_CONTENT_TYPE);
+                return NULL;
+        }
+        if(!(signers = sk_X509_new(NULL))) {
+                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+        /* Collect all the signers together */
+
+        sinfos = PKCS7_get_signer_info(p7);
+
+        if(sk_PKCS7_SIGNER_INFO_num(sinfos) <= 0) {
+                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_NO_SIGNERS);
+                return 0;
+        }
+
+        for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
+        {
+            si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
+            ias = si->issuer_and_serial;
+            signer = NULL;
+                /* If any certificates passed they take priority */
+            if (certs) signer = X509_find_by_issuer_and_serial (certs,
+                                                ias->issuer, ias->serial);
+            if (!signer && !(flags & PKCS7_NOINTERN)
+                        && p7->d.sign->cert) signer =
+                              X509_find_by_issuer_and_serial (p7->d.sign->cert,
+                                                ias->issuer, ias->serial);
+            if (!signer) {
+                        PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND);
+                        sk_X509_free(signers);
+                        return 0;
+            }
+
+            sk_X509_push(signers, signer);
+        }
+        return signers;
+}
+
+
+/* Build a complete PKCS#7 enveloped data */
+
+PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, EVP_CIPHER *cipher,
+                                                                int flags)
+{
+        PKCS7 *p7;
+        BIO *p7bio = NULL;
+        int i;
+        X509 *x509;
+        if(!(p7 = PKCS7_new())) {
+                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+        PKCS7_set_type(p7, NID_pkcs7_enveloped);
+        if(!PKCS7_set_cipher(p7, cipher)) {
+                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_ERROR_SETTING_CIPHER);
+                goto err;
+        }
+
+        for(i = 0; i < sk_X509_num(certs); i++) {
+                x509 = sk_X509_value(certs, i);
+                if(!PKCS7_add_recipient(p7, x509)) {
+                        PKCS7err(PKCS7_F_PKCS7_ENCRYPT,
+                                        PKCS7_R_ERROR_ADDING_RECIPIENT);
+                        goto err;
+                }
+        }
+
+        if(!(p7bio = PKCS7_dataInit(p7, NULL))) {
+                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,ERR_R_MALLOC_FAILURE);
+                goto err;
+        }
+
+        SMIME_crlf_copy(in, p7bio, flags);
+
+        BIO_flush(p7bio);
+
+        if (!PKCS7_dataFinal(p7,p7bio)) {
+                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_PKCS7_DATAFINAL_ERROR);
+                goto err;
+        }
+        BIO_free_all(p7bio);
+
+        return p7;
+
+        err:
+
+        BIO_free(p7bio);
+        PKCS7_free(p7);
+        return NULL;
+
+}
+
+int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags)
+{
+        BIO *tmpmem;
+        int ret, i;
+        char buf[4096];
+
+        if(!p7) {
+                PKCS7err(PKCS7_F_PKCS7_DECRYPT,PKCS7_R_INVALID_NULL_POINTER);
+                return 0;
+        }
+
+        if(!PKCS7_type_is_enveloped(p7)) {
+                PKCS7err(PKCS7_F_PKCS7_DECRYPT,PKCS7_R_WRONG_CONTENT_TYPE);
+                return 0;
+        }
+
+        if(!X509_check_private_key(cert, pkey)) {
+                PKCS7err(PKCS7_F_PKCS7_DECRYPT,
+                                PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+                return 0;
+        }
+
+        if(!(tmpmem = PKCS7_dataDecode(p7, pkey, NULL, cert))) {
+                PKCS7err(PKCS7_F_PKCS7_DECRYPT, PKCS7_R_DECRYPT_ERROR);
+                return 0;
+        }
+
+        if (flags & PKCS7_TEXT) {
+                BIO *tmpbuf, *bread;
+                /* Encrypt BIOs can't do BIO_gets() so add a buffer BIO */
+                if(!(tmpbuf = BIO_new(BIO_f_buffer()))) {
+                        PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if(!(bread = BIO_push(tmpbuf, tmpmem))) {
+                        PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                ret = SMIME_text(bread, data);
+                BIO_free_all(bread);
+                return ret;
+        } else {
+                for(;;) {
+                        i = BIO_read(tmpmem, buf, sizeof(buf));
+                        if(i <= 0) break;
+                        BIO_write(data, buf, i);
+                }
+                BIO_free_all(tmpmem);
+                return 1;
+        }
+}
diff --git a/src/lib/libcrypto/pkcs7/pkcs7.h b/src/lib/libcrypto/pkcs7/pkcs7.h
index c42bd6d391..3ec725d226 100644
--- a/src/lib/libcrypto/pkcs7/pkcs7.h
+++ b/src/lib/libcrypto/pkcs7/pkcs7.h
@@ -71,8 +71,9 @@ extern "C" {
 #endif
 
 #ifdef WIN32
-/* Under Win32 this is defined in wincrypt.h */
+/* Under Win32 thes are defined in wincrypt.h */
 #undef PKCS7_ISSUER_AND_SERIAL
+#undef PKCS7_SIGNER_INFO
 #endif
 
 /*
@@ -219,6 +220,7 @@ typedef struct pkcs7_st
 #define PKCS7_get_attributes(si)        ((si)->unauth_attr)
 
 #define PKCS7_type_is_signed(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_signed)
+#define PKCS7_type_is_enveloped(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_enveloped)
 #define PKCS7_type_is_signedAndEnveloped(a) \
                 (OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped)
 #define PKCS7_type_is_data(a)   (OBJ_obj2nid((a)->type) == NID_pkcs7_data)
@@ -236,6 +238,29 @@ typedef struct pkcs7_st
 #endif
 #endif
 
+/* S/MIME related flags */
+
+#define PKCS7_TEXT      0x1
+#define PKCS7_NOCERTS   0x2
+#define PKCS7_NOSIGS    0x4
+#define PKCS7_NOCHAIN   0x8
+#define PKCS7_NOINTERN  0x10
+#define PKCS7_NOVERIFY  0x20
+#define PKCS7_DETACHED  0x40
+#define PKCS7_BINARY    0x80
+#define PKCS7_NOATTR    0x100
+
+/* Flags: for compatibility with older code */
+
+#define SMIME_TEXT      PKCS7_TEXT
+#define SMIME_NOCERTS   PKCS7_NOCERTS
+#define SMIME_NOSIGS    PKCS7_NOSIGS
+#define SMIME_NOCHAIN   PKCS7_NOCHAIN
+#define SMIME_NOINTERN  PKCS7_NOINTERN
+#define SMIME_NOVERIFY  PKCS7_NOVERIFY
+#define SMIME_DETACHED  PKCS7_DETACHED
+#define SMIME_BINARY    PKCS7_BINARY
+#define SMIME_NOATTR    PKCS7_NOATTR
 
 PKCS7_ISSUER_AND_SERIAL *PKCS7_ISSUER_AND_SERIAL_new(void );
 void                    PKCS7_ISSUER_AND_SERIAL_free(
@@ -247,7 +272,7 @@ PKCS7_ISSUER_AND_SERIAL *d2i_PKCS7_ISSUER_AND_SERIAL(
                                 unsigned char **pp, long length);
 
 #ifndef SSLEAY_MACROS
-int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,EVP_MD *type,
+int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,const EVP_MD *type,
         unsigned char *md,unsigned int *len);
 #ifndef NO_FP_API
 PKCS7 *d2i_PKCS7_fp(FILE *fp,PKCS7 **p7);
@@ -368,6 +393,23 @@ int PKCS7_set_signed_attributes(PKCS7_SIGNER_INFO *p7si,
 int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si,STACK_OF(X509_ATTRIBUTE) *sk);
 
 
+PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
+                                                        BIO *data, int flags);
+int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
+                                        BIO *indata, BIO *out, int flags);
+STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags);
+PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, EVP_CIPHER *cipher,
+                                                                int flags);
+int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags);
+
+int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK *cap);
+STACK *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si);
+int PKCS7_simple_smimecap(STACK *sk, int nid, int arg);
+
+int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags);
+PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont);
+int SMIME_crlf_copy(BIO *in, BIO *out, int flags);
+int SMIME_text(BIO *in, BIO *out);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -377,6 +419,9 @@ int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si,STACK_OF(X509_ATTRIBUTE) *sk);
 /* Error codes for the PKCS7 functions. */
 
 /* Function codes. */
+#define PKCS7_F_B64_READ_PKCS7                           120
+#define PKCS7_F_B64_WRITE_PKCS7                          121
+#define PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP                118
 #define PKCS7_F_PKCS7_ADD_CERTIFICATE                    100
 #define PKCS7_F_PKCS7_ADD_CRL                            101
 #define PKCS7_F_PKCS7_ADD_RECIPIENT_INFO                 102
@@ -386,20 +431,56 @@ int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si,STACK_OF(X509_ATTRIBUTE) *sk);
 #define PKCS7_F_PKCS7_DATAINIT                           105
 #define PKCS7_F_PKCS7_DATASIGN                           106
 #define PKCS7_F_PKCS7_DATAVERIFY                         107
+#define PKCS7_F_PKCS7_DECRYPT                            114
+#define PKCS7_F_PKCS7_ENCRYPT                            115
+#define PKCS7_F_PKCS7_GET0_SIGNERS                       124
 #define PKCS7_F_PKCS7_SET_CIPHER                         108
 #define PKCS7_F_PKCS7_SET_CONTENT                        109
 #define PKCS7_F_PKCS7_SET_TYPE                           110
+#define PKCS7_F_PKCS7_SIGN                               116
 #define PKCS7_F_PKCS7_SIGNATUREVERIFY                    113
+#define PKCS7_F_PKCS7_SIMPLE_SMIMECAP                    119
+#define PKCS7_F_PKCS7_VERIFY                             117
+#define PKCS7_F_SMIME_READ_PKCS7                         122
+#define PKCS7_F_SMIME_TEXT                               123
 
 /* Reason codes. */
+#define PKCS7_R_CERTIFICATE_VERIFY_ERROR                 117
+#define PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER          144
 #define PKCS7_R_CIPHER_NOT_INITIALIZED                   116
+#define PKCS7_R_CONTENT_AND_DATA_PRESENT                 118
+#define PKCS7_R_DECODE_ERROR                             130
 #define PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH            100
+#define PKCS7_R_DECRYPT_ERROR                            119
 #define PKCS7_R_DIGEST_FAILURE                           101
+#define PKCS7_R_ERROR_ADDING_RECIPIENT                   120
+#define PKCS7_R_ERROR_SETTING_CIPHER                     121
 #define PKCS7_R_INTERNAL_ERROR                           102
+#define PKCS7_R_INVALID_MIME_TYPE                        131
+#define PKCS7_R_INVALID_NULL_POINTER                     143
+#define PKCS7_R_MIME_NO_CONTENT_TYPE                     132
+#define PKCS7_R_MIME_PARSE_ERROR                         133
+#define PKCS7_R_MIME_SIG_PARSE_ERROR                     134
 #define PKCS7_R_MISSING_CERIPEND_INFO                    103
+#define PKCS7_R_NO_CONTENT                               122
+#define PKCS7_R_NO_CONTENT_TYPE                          135
+#define PKCS7_R_NO_MULTIPART_BODY_FAILURE                136
+#define PKCS7_R_NO_MULTIPART_BOUNDARY                    137
 #define PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE         115
+#define PKCS7_R_NO_SIGNATURES_ON_DATA                    123
+#define PKCS7_R_NO_SIGNERS                               142
+#define PKCS7_R_NO_SIG_CONTENT_TYPE                      138
 #define PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE     104
+#define PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR                124
+#define PKCS7_R_PKCS7_DATAFINAL_ERROR                    125
+#define PKCS7_R_PKCS7_DATASIGN                           126
+#define PKCS7_R_PKCS7_PARSE_ERROR                        139
+#define PKCS7_R_PKCS7_SIG_PARSE_ERROR                    140
+#define PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE   127
 #define PKCS7_R_SIGNATURE_FAILURE                        105
+#define PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND             128
+#define PKCS7_R_SIG_INVALID_MIME_TYPE                    141
+#define PKCS7_R_SMIME_TEXT_ERROR                         129
 #define PKCS7_R_UNABLE_TO_FIND_CERTIFICATE               106
 #define PKCS7_R_UNABLE_TO_FIND_MEM_BIO                   107
 #define PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST            108
diff --git a/src/lib/libcrypto/pkcs7/pkcs7err.c b/src/lib/libcrypto/pkcs7/pkcs7err.c
index 82be3c2ca1..813a8af9ed 100644
--- a/src/lib/libcrypto/pkcs7/pkcs7err.c
+++ b/src/lib/libcrypto/pkcs7/pkcs7err.c
@@ -65,6 +65,9 @@
 #ifndef NO_ERR
 static ERR_STRING_DATA PKCS7_str_functs[]=
         {
+{ERR_PACK(0,PKCS7_F_B64_READ_PKCS7,0),  "B64_READ_PKCS7"},
+{ERR_PACK(0,PKCS7_F_B64_WRITE_PKCS7,0), "B64_WRITE_PKCS7"},
+{ERR_PACK(0,PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,0),       "PKCS7_add_attrib_smimecap"},
 {ERR_PACK(0,PKCS7_F_PKCS7_ADD_CERTIFICATE,0),   "PKCS7_add_certificate"},
 {ERR_PACK(0,PKCS7_F_PKCS7_ADD_CRL,0),   "PKCS7_add_crl"},
 {ERR_PACK(0,PKCS7_F_PKCS7_ADD_RECIPIENT_INFO,0),        "PKCS7_add_recipient_info"},
@@ -74,23 +77,59 @@ static ERR_STRING_DATA PKCS7_str_functs[]=
 {ERR_PACK(0,PKCS7_F_PKCS7_DATAINIT,0),  "PKCS7_dataInit"},
 {ERR_PACK(0,PKCS7_F_PKCS7_DATASIGN,0),  "PKCS7_DATASIGN"},
 {ERR_PACK(0,PKCS7_F_PKCS7_DATAVERIFY,0),        "PKCS7_dataVerify"},
+{ERR_PACK(0,PKCS7_F_PKCS7_DECRYPT,0),   "PKCS7_decrypt"},
+{ERR_PACK(0,PKCS7_F_PKCS7_ENCRYPT,0),   "PKCS7_encrypt"},
+{ERR_PACK(0,PKCS7_F_PKCS7_GET0_SIGNERS,0),      "PKCS7_get0_signers"},
 {ERR_PACK(0,PKCS7_F_PKCS7_SET_CIPHER,0),        "PKCS7_set_cipher"},
 {ERR_PACK(0,PKCS7_F_PKCS7_SET_CONTENT,0),       "PKCS7_set_content"},
 {ERR_PACK(0,PKCS7_F_PKCS7_SET_TYPE,0),  "PKCS7_set_type"},
+{ERR_PACK(0,PKCS7_F_PKCS7_SIGN,0),      "PKCS7_sign"},
 {ERR_PACK(0,PKCS7_F_PKCS7_SIGNATUREVERIFY,0),   "PKCS7_signatureVerify"},
+{ERR_PACK(0,PKCS7_F_PKCS7_SIMPLE_SMIMECAP,0),   "PKCS7_simple_smimecap"},
+{ERR_PACK(0,PKCS7_F_PKCS7_VERIFY,0),    "PKCS7_verify"},
+{ERR_PACK(0,PKCS7_F_SMIME_READ_PKCS7,0),        "SMIME_read_PKCS7"},
+{ERR_PACK(0,PKCS7_F_SMIME_TEXT,0),      "SMIME_text"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA PKCS7_str_reasons[]=
         {
+{PKCS7_R_CERTIFICATE_VERIFY_ERROR        ,"certificate verify error"},
+{PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER ,"cipher has no object identifier"},
 {PKCS7_R_CIPHER_NOT_INITIALIZED          ,"cipher not initialized"},
+{PKCS7_R_CONTENT_AND_DATA_PRESENT        ,"content and data present"},
+{PKCS7_R_DECODE_ERROR                    ,"decode error"},
 {PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH   ,"decrypted key is wrong length"},
+{PKCS7_R_DECRYPT_ERROR                   ,"decrypt error"},
 {PKCS7_R_DIGEST_FAILURE                  ,"digest failure"},
+{PKCS7_R_ERROR_ADDING_RECIPIENT          ,"error adding recipient"},
+{PKCS7_R_ERROR_SETTING_CIPHER            ,"error setting cipher"},
 {PKCS7_R_INTERNAL_ERROR                  ,"internal error"},
+{PKCS7_R_INVALID_MIME_TYPE               ,"invalid mime type"},
+{PKCS7_R_INVALID_NULL_POINTER            ,"invalid null pointer"},
+{PKCS7_R_MIME_NO_CONTENT_TYPE            ,"mime no content type"},
+{PKCS7_R_MIME_PARSE_ERROR                ,"mime parse error"},
+{PKCS7_R_MIME_SIG_PARSE_ERROR            ,"mime sig parse error"},
 {PKCS7_R_MISSING_CERIPEND_INFO           ,"missing ceripend info"},
+{PKCS7_R_NO_CONTENT                      ,"no content"},
+{PKCS7_R_NO_CONTENT_TYPE                 ,"no content type"},
+{PKCS7_R_NO_MULTIPART_BODY_FAILURE       ,"no multipart body failure"},
+{PKCS7_R_NO_MULTIPART_BOUNDARY           ,"no multipart boundary"},
 {PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE,"no recipient matches certificate"},
+{PKCS7_R_NO_SIGNATURES_ON_DATA           ,"no signatures on data"},
+{PKCS7_R_NO_SIGNERS                      ,"no signers"},
+{PKCS7_R_NO_SIG_CONTENT_TYPE             ,"no sig content type"},
 {PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE,"operation not supported on this type"},
+{PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR       ,"pkcs7 add signature error"},
+{PKCS7_R_PKCS7_DATAFINAL_ERROR           ,"pkcs7 datafinal error"},
+{PKCS7_R_PKCS7_DATASIGN                  ,"pkcs7 datasign"},
+{PKCS7_R_PKCS7_PARSE_ERROR               ,"pkcs7 parse error"},
+{PKCS7_R_PKCS7_SIG_PARSE_ERROR           ,"pkcs7 sig parse error"},
+{PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE,"private key does not match certificate"},
 {PKCS7_R_SIGNATURE_FAILURE               ,"signature failure"},
+{PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND    ,"signer certificate not found"},
+{PKCS7_R_SIG_INVALID_MIME_TYPE           ,"sig invalid mime type"},
+{PKCS7_R_SMIME_TEXT_ERROR                ,"smime text error"},
 {PKCS7_R_UNABLE_TO_FIND_CERTIFICATE      ,"unable to find certificate"},
 {PKCS7_R_UNABLE_TO_FIND_MEM_BIO          ,"unable to find mem bio"},
 {PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST   ,"unable to find message digest"},
diff --git a/src/lib/libcrypto/pkcs7/sign.c b/src/lib/libcrypto/pkcs7/sign.c
index d5f1154006..22290e192c 100644
--- a/src/lib/libcrypto/pkcs7/sign.c
+++ b/src/lib/libcrypto/pkcs7/sign.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 #include <stdio.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
@@ -75,10 +76,18 @@ char *argv[];
         int i;
         int nodetach=0;
 
+#ifndef NO_MD2
         EVP_add_digest(EVP_md2());
+#endif
+#ifndef NO_MD5
         EVP_add_digest(EVP_md5());
+#endif
+#ifndef NO_SHA1
         EVP_add_digest(EVP_sha1());
+#endif
+#ifndef NO_MDC2
         EVP_add_digest(EVP_mdc2());
+#endif
 
         data=BIO_new(BIO_s_file());
 again:
@@ -97,9 +106,9 @@ again:
                 BIO_set_fp(data,stdin,BIO_NOCLOSE);
 
         if ((in=BIO_new_file("server.pem","r")) == NULL) goto err;
-        if ((x509=PEM_read_bio_X509(in,NULL,NULL)) == NULL) goto err;
+        if ((x509=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL) goto err;
         BIO_reset(in);
-        if ((pkey=PEM_read_bio_PrivateKey(in,NULL,NULL)) == NULL) goto err;
+        if ((pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL)) == NULL) goto err;
         BIO_free(in);
 
         p7=PKCS7_new();
diff --git a/src/lib/libcrypto/pkcs7/verify.c b/src/lib/libcrypto/pkcs7/verify.c
index 32d9783e45..49fc8d8bed 100644
--- a/src/lib/libcrypto/pkcs7/verify.c
+++ b/src/lib/libcrypto/pkcs7/verify.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 #include <stdio.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/asn1.h>
 #include <openssl/x509.h>
@@ -84,10 +85,18 @@ char *argv[];
 
         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
         bio_out=BIO_new_fp(stdout,BIO_NOCLOSE);
+#ifndef NO_MD2
         EVP_add_digest(EVP_md2());
+#endif
+#ifndef NO_MD5
         EVP_add_digest(EVP_md5());
+#endif
+#ifndef NO_SHA1
         EVP_add_digest(EVP_sha1());
+#endif
+#ifndef NO_MDC2
         EVP_add_digest(EVP_mdc2());
+#endif
 
         data=BIO_new(BIO_s_file());
 
@@ -121,7 +130,7 @@ char *argv[];
 
 
         /* Load the PKCS7 object from a file */
-        if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL)) == NULL) goto err;
+        if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL,NULL)) == NULL) goto err;
 
         /* This stuff is being setup for certificate verification.
          * When using SSL, it could be replaced with a 
diff --git a/src/lib/libcrypto/rand/Makefile.ssl b/src/lib/libcrypto/rand/Makefile.ssl
index 014356cb18..be8eea34a2 100644
--- a/src/lib/libcrypto/rand/Makefile.ssl
+++ b/src/lib/libcrypto/rand/Makefile.ssl
@@ -22,8 +22,8 @@ TEST= randtest.c
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC=md_rand.c randfile.c rand_lib.c
-LIBOBJ=md_rand.o randfile.o rand_lib.o
+LIBSRC=md_rand.c randfile.c rand_lib.c rand_err.c rand_egd.c
+LIBOBJ=md_rand.o randfile.o rand_lib.o rand_err.o rand_egd.o
 
 SRC= $(LIBSRC)
 
@@ -79,9 +79,14 @@ clean:
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
 md_rand.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
-md_rand.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
-md_rand.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
+md_rand.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+md_rand.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+md_rand.o: ../../include/openssl/rand.h ../../include/openssl/safestack.h
 md_rand.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+rand_egd.o: ../../include/openssl/opensslconf.h ../../include/openssl/rand.h
+rand_err.o: ../../include/openssl/err.h ../../include/openssl/rand.h
 rand_lib.o: ../../include/openssl/rand.h
-randfile.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-randfile.o: ../../include/openssl/opensslconf.h ../../include/openssl/rand.h
+randfile.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+randfile.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+randfile.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
+randfile.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
diff --git a/src/lib/libcrypto/rand/md_rand.c b/src/lib/libcrypto/rand/md_rand.c
index c9a071bd22..6b158f0349 100644
--- a/src/lib/libcrypto/rand/md_rand.c
+++ b/src/lib/libcrypto/rand/md_rand.c
@@ -56,15 +56,23 @@
  * [including the GNU Public Licence.]
  */
 
+#define ENTROPY_NEEDED 16  /* require 128 bits = 16 bytes of randomness */
+
+#ifndef MD_RAND_DEBUG
+# ifndef NDEBUG
+#   define NDEBUG
+# endif
+#endif
+
+#include <assert.h>
 #include <stdio.h>
-#include <sys/types.h>
-#include <fcntl.h>
 #include <time.h>
 #include <string.h>
 
 #include "openssl/e_os.h"
 
 #include <openssl/crypto.h>
+#include <openssl/err.h>
 
 #if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
 #if !defined(NO_SHA) && !defined(NO_SHA1)
@@ -130,17 +138,23 @@ static int state_num=0,state_index=0;
 static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH];
 static unsigned char md[MD_DIGEST_LENGTH];
 static long md_count[2]={0,0};
+static double entropy=0;
+static int initialized=0;
 
 const char *RAND_version="RAND" OPENSSL_VERSION_PTEXT;
 
 static void ssleay_rand_cleanup(void);
 static void ssleay_rand_seed(const void *buf, int num);
-static void ssleay_rand_bytes(unsigned char *buf, int num);
+static void ssleay_rand_add(const void *buf, int num, double add_entropy);
+static int ssleay_rand_bytes(unsigned char *buf, int num);
+static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
 
 RAND_METHOD rand_ssleay_meth={
         ssleay_rand_seed,
         ssleay_rand_bytes,
         ssleay_rand_cleanup,
+        ssleay_rand_add,
+        ssleay_rand_pseudo_bytes,
         }; 
 
 RAND_METHOD *RAND_SSLeay(void)
@@ -156,22 +170,49 @@ static void ssleay_rand_cleanup(void)
         memset(md,0,MD_DIGEST_LENGTH);
         md_count[0]=0;
         md_count[1]=0;
+        entropy=0;
         }
 
-static void ssleay_rand_seed(const void *buf, int num)
+static void ssleay_rand_add(const void *buf, int num, double add)
         {
-        int i,j,k,st_idx,st_num;
+        int i,j,k,st_idx;
+        long md_c[2];
+        unsigned char local_md[MD_DIGEST_LENGTH];
         MD_CTX m;
 
 #ifdef NORAND
         return;
 #endif
 
+        /*
+         * (Based on the rand(3) manpage)
+         *
+         * The input is chopped up into units of 20 bytes (or less for
+         * the last block).  Each of these blocks is run through the hash
+         * function as follows:  The data passed to the hash function
+         * is the current 'md', the same number of bytes from the 'state'
+         * (the location determined by in incremented looping index) as
+         * the current 'block', the new key data 'block', and 'count'
+         * (which is incremented after each use).
+         * The result of this is kept in 'md' and also xored into the
+         * 'state' at the same locations that were used as input into the
+         * hash function.
+         */
+
         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
         st_idx=state_index;
-        st_num=state_num;
 
-        state_index=(state_index+num);
+        /* use our own copies of the counters so that even
+         * if a concurrent thread seeds with exactly the
+         * same data and uses the same subarray there's _some_
+         * difference */
+        md_c[0] = md_count[0];
+        md_c[1] = md_count[1];
+
+        memcpy(local_md, md, sizeof md);
+
+        /* state_index <= state_num <= STATE_SIZE */
+        state_index += num;
         if (state_index >= STATE_SIZE)
                 {
                 state_index%=STATE_SIZE;
@@ -182,6 +223,14 @@ static void ssleay_rand_seed(const void *buf, int num)
                 if (state_index > state_num)
                         state_num=state_index;
                 }
+        /* state_index <= state_num <= STATE_SIZE */
+
+        /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE]
+         * are what we will use now, but other threads may use them
+         * as well */
+
+        md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
+
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
         for (i=0; i<num; i+=MD_DIGEST_LENGTH)
@@ -190,7 +239,7 @@ static void ssleay_rand_seed(const void *buf, int num)
                 j=(j > MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j;
 
                 MD_Init(&m);
-                MD_Update(&m,md,MD_DIGEST_LENGTH);
+                MD_Update(&m,local_md,MD_DIGEST_LENGTH);
                 k=(st_idx+j)-STATE_SIZE;
                 if (k > 0)
                         {
@@ -201,33 +250,107 @@ static void ssleay_rand_seed(const void *buf, int num)
                         MD_Update(&m,&(state[st_idx]),j);
                         
                 MD_Update(&m,buf,j);
-                MD_Update(&m,(unsigned char *)&(md_count[0]),sizeof(md_count));
-                MD_Final(md,&m);
-                md_count[1]++;
+                MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
+                MD_Final(local_md,&m);
+                md_c[1]++;
 
                 buf=(const char *)buf + j;
 
                 for (k=0; k<j; k++)
                         {
-                        state[st_idx++]^=md[k];
+                        /* Parallel threads may interfere with this,
+                         * but always each byte of the new state is
+                         * the XOR of some previous value of its
+                         * and local_md (itermediate values may be lost).
+                         * Alway using locking could hurt performance more
+                         * than necessary given that conflicts occur only
+                         * when the total seeding is longer than the random
+                         * state. */
+                        state[st_idx++]^=local_md[k];
                         if (st_idx >= STATE_SIZE)
-                                {
                                 st_idx=0;
-                                st_num=STATE_SIZE;
-                                }
                         }
                 }
         memset((char *)&m,0,sizeof(m));
+
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        /* Don't just copy back local_md into md -- this could mean that
+         * other thread's seeding remains without effect (except for
+         * the incremented counter).  By XORing it we keep at least as
+         * much entropy as fits into md. */
+        for (k = 0; k < sizeof md; k++)
+                {
+                md[k] ^= local_md[k];
+                }
+        if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */
+            entropy += add;
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+        
+#ifndef THREADS 
+        assert(md_c[1] == md_count[1]);
+#endif
         }
 
-static void ssleay_rand_bytes(unsigned char *buf, int num)
+static void ssleay_rand_seed(const void *buf, int num)
+        {
+        ssleay_rand_add(buf, num, num);
+        }
+
+static void ssleay_rand_initialize(void)
         {
-        int i,j,k,st_num,st_idx;
-        MD_CTX m;
-        static int init=1;
         unsigned long l;
+#ifndef GETPID_IS_MEANINGLESS
+        pid_t curr_pid = getpid();
+#endif
 #ifdef DEVRANDOM
-        int fd;
+        FILE *fh;
+#endif
+
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+        /* put in some default random data, we need more than just this */
+#ifndef GETPID_IS_MEANINGLESS
+        l=curr_pid;
+        RAND_add(&l,sizeof(l),0);
+        l=getuid();
+        RAND_add(&l,sizeof(l),0);
+#endif
+        l=time(NULL);
+        RAND_add(&l,sizeof(l),0);
+
+#ifdef DEVRANDOM
+        /* Use a random entropy pool device. Linux, FreeBSD and OpenBSD
+         * have this. Use /dev/urandom if you can as /dev/random may block
+         * if it runs out of random entries.  */
+
+        if ((fh = fopen(DEVRANDOM, "r")) != NULL)
+                {
+                unsigned char tmpbuf[ENTROPY_NEEDED];
+                int n;
+                
+                setvbuf(fh, NULL, _IONBF, 0);
+                n=fread((unsigned char *)tmpbuf,1,ENTROPY_NEEDED,fh);
+                fclose(fh);
+                RAND_add(tmpbuf,sizeof tmpbuf,n);
+                memset(tmpbuf,0,n);
+                }
+#endif
+#ifdef PURIFY
+        memset(state,0,STATE_SIZE);
+        memset(md,0,MD_DIGEST_LENGTH);
+#endif
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        initialized=1;
+        }
+
+static int ssleay_rand_bytes(unsigned char *buf, int num)
+        {
+        int i,j,k,st_num,st_idx;
+        int ok;
+        long md_c[2];
+        unsigned char local_md[MD_DIGEST_LENGTH];
+        MD_CTX m;
+#ifndef GETPID_IS_MEANINGLESS
+        pid_t curr_pid = getpid();
 #endif
 
 #ifdef PREDICT
@@ -236,65 +359,63 @@ static void ssleay_rand_bytes(unsigned char *buf, int num)
 
         for (i=0; i<num; i++)
                 buf[i]=val++;
-        return;
+        return(1);
         }
 #endif
 
+        /*
+         * (Based on the rand(3) manpage:)
+         *
+         * For each group of 10 bytes (or less), we do the following:
+         *
+         * Input into the hash function the top 10 bytes from the
+         * local 'md' (which is initialized from the global 'md'
+         * before any bytes are generated), the bytes that are
+         * to be overwritten by the random bytes, and bytes from the
+         * 'state' (incrementing looping index).  From this digest output
+         * (which is kept in 'md'), the top (up to) 10 bytes are
+         * returned to the caller and the bottom (up to) 10 bytes are xored
+         * into the 'state'.
+         * Finally, after we have finished 'num' random bytes for the
+         * caller, 'count' (which is incremented) and the local and global 'md'
+         * are fed into the hash function and the results are kept in the
+         * global 'md'.
+         */
+
         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
 
-        if (init)
+        if (!initialized)
+                ssleay_rand_initialize();
+
+        ok = (entropy >= ENTROPY_NEEDED);
+        if (!ok)
                 {
-                CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
-                /* put in some default random data, we need more than
-                 * just this */
-                RAND_seed(&m,sizeof(m));
-#ifndef MSDOS
-                l=getpid();
-                RAND_seed(&l,sizeof(l));
-                l=getuid();
-                RAND_seed(&l,sizeof(l));
-#endif
-                l=time(NULL);
-                RAND_seed(&l,sizeof(l));
-
-/* #ifdef DEVRANDOM */
-                /* 
-                 * Use a random entropy pool device.
-                 * Linux 1.3.x, OpenBSD, and FreeBSD have
-                 * this. Use /dev/urandom if you can
-                 * as /dev/random will block if it runs out
-                 * of random entries.
+                /* If the PRNG state is not yet unpredictable, then seeing
+                 * the PRNG output may help attackers to determine the new
+                 * state; thus we have to decrease the entropy estimate.
+                 * Once we've had enough initial seeding we don't bother to
+                 * adjust the entropy count, though, because we're not ambitious
+                 * to provide *information-theoretic* randomness.
                  */
-                if ((fd = open(DEVRANDOM, O_RDONLY)) != NULL)
-                        {
-                        unsigned char tmpbuf[32];
-
-                        read(fd, tmpbuf, sizeof(tmpbuf));
-                        /* we don't care how many bytes we read,
-                         * we will just copy the 'stack' if there is
-                         * nothing else :-) */
-                        /* the above comment is EVIL.  Security software
-                         * RELIES ON THESE PRIMITIVES HAVING MORE SECURE
-                         * BEHAVIOUR! Secure entropy is required in
-                         * many cases! */
-                        RAND_seed(tmpbuf,32);
-                        memset(tmpbuf,0,32);
-                        }
-/* #endif */
-#ifdef PURIFY
-                memset(state,0,STATE_SIZE);
-                memset(md,0,MD_DIGEST_LENGTH);
-#endif
-                CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-                init=0;
+                entropy -= num;
+                if (entropy < 0)
+                        entropy = 0;
                 }
 
         st_idx=state_index;
         st_num=state_num;
+        md_c[0] = md_count[0];
+        md_c[1] = md_count[1];
+        memcpy(local_md, md, sizeof md);
+
         state_index+=num;
         if (state_index > state_num)
-                state_index=(state_index%state_num);
+                state_index %= state_num;
+
+        /* state[st_idx], ..., state[(st_idx + num - 1) % st_num]
+         * are now ours (but other threads may use them too) */
 
+        md_count[0] += 1;
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
         while (num > 0)
@@ -302,8 +423,15 @@ static void ssleay_rand_bytes(unsigned char *buf, int num)
                 j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num;
                 num-=j;
                 MD_Init(&m);
-                MD_Update(&m,&(md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2);
-                MD_Update(&m,(unsigned char *)&(md_count[0]),sizeof(md_count));
+#ifndef GETPID_IS_MEANINGLESS
+                if (curr_pid) /* just in the first iteration to save time */
+                        {
+                        MD_Update(&m,(unsigned char*)&curr_pid,sizeof curr_pid);
+                        curr_pid = 0;
+                        }
+#endif
+                MD_Update(&m,&(local_md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2);
+                MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
 #ifndef PURIFY
                 MD_Update(&m,buf,j); /* purify complains */
 #endif
@@ -315,23 +443,57 @@ static void ssleay_rand_bytes(unsigned char *buf, int num)
                         }
                 else
                         MD_Update(&m,&(state[st_idx]),j);
-                MD_Final(md,&m);
+                MD_Final(local_md,&m);
 
                 for (i=0; i<j; i++)
                         {
+                        state[st_idx++]^=local_md[i]; /* may compete with other threads */
+                        *(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
                         if (st_idx >= st_num)
                                 st_idx=0;
-                        state[st_idx++]^=md[i];
-                        *(buf++)=md[i+MD_DIGEST_LENGTH/2];
                         }
                 }
 
         MD_Init(&m);
-        MD_Update(&m,(unsigned char *)&(md_count[0]),sizeof(md_count));
-        md_count[0]++;
+        MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
+        MD_Update(&m,local_md,MD_DIGEST_LENGTH);
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
         MD_Update(&m,md,MD_DIGEST_LENGTH);
         MD_Final(md,&m);
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
         memset(&m,0,sizeof(m));
+        if (ok)
+                return(1);
+        else
+                {
+                RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
+                return(0);
+                }
+        }
+
+/* pseudo-random bytes that are guaranteed to be unique but not
+   unpredictable */
+static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) 
+        {
+        int ret, err;
+
+        ret = RAND_bytes(buf, num);
+        if (ret == 0)
+                {
+                err = ERR_peek_error();
+                if (ERR_GET_LIB(err) == ERR_LIB_RAND &&
+                    ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED)
+                        (void)ERR_get_error();
+                }
+        return (ret);
+        }
+
+int RAND_status(void)
+        {
+        if (!initialized)
+                ssleay_rand_initialize();
+        return (entropy >= ENTROPY_NEEDED);
         }
 
 #ifdef WINDOWS
@@ -358,12 +520,12 @@ static void ssleay_rand_bytes(unsigned char *buf, int num)
  */
 /*
  * I have modified the loading of bytes via RAND_seed() mechanism since
- * the origional would have been very very CPU intensive since RAND_seed()
+ * the original would have been very very CPU intensive since RAND_seed()
  * does an MD5 per 16 bytes of input.  The cost to digest 16 bytes is the same
  * as that to digest 56 bytes.  So under the old system, a screen of
- * 1024*768*256 would have been CPU cost of approximatly 49,000 56 byte MD5
+ * 1024*768*256 would have been CPU cost of approximately 49,000 56 byte MD5
  * digests or digesting 2.7 mbytes.  What I have put in place would
- * be 48 16k MD5 digests, or efectivly 48*16+48 MD5 bytes or 816 kbytes
+ * be 48 16k MD5 digests, or effectively 48*16+48 MD5 bytes or 816 kbytes
  * or about 3.5 times as much.
  * - eric 
  */
diff --git a/src/lib/libcrypto/rand/md_rand_munged.c b/src/lib/libcrypto/rand/md_rand_munged.c
new file mode 100644
index 0000000000..1611bf335b
--- /dev/null
+++ b/src/lib/libcrypto/rand/md_rand_munged.c
@@ -0,0 +1,515 @@
+/* crypto/rand/md_rand.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <sys/types.h>
+#include <fcntl.h>
+#include <time.h>
+#include <string.h>
+
+#include "openssl/e_os.h"
+
+#include <openssl/crypto.h>
+
+#if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
+#if !defined(NO_SHA) && !defined(NO_SHA1)
+#define USE_SHA1_RAND
+#elif !defined(NO_MD5)
+#define USE_MD5_RAND
+#elif !defined(NO_MDC2) && !defined(NO_DES)
+#define USE_MDC2_RAND
+#elif !defined(NO_MD2)
+#define USE_MD2_RAND
+#else
+#error No message digest algorithm available
+#endif
+#endif
+
+/* Changed how the state buffer used.  I now attempt to 'wrap' such
+ * that I don't run over the same locations the next time  go through
+ * the 1023 bytes - many thanks to
+ * Robert J. LeBlanc <rjl@renaissoft.com> for his comments
+ */
+
+#if defined(USE_MD5_RAND)
+#include <openssl/md5.h>
+#define MD_DIGEST_LENGTH        MD5_DIGEST_LENGTH
+#define MD_CTX                  MD5_CTX
+#define MD_Init(a)              MD5_Init(a)
+#define MD_Update(a,b,c)        MD5_Update(a,b,c)
+#define MD_Final(a,b)           MD5_Final(a,b)
+#define MD(a,b,c)               MD5(a,b,c)
+#elif defined(USE_SHA1_RAND)
+#include <openssl/sha.h>
+#define MD_DIGEST_LENGTH        SHA_DIGEST_LENGTH
+#define MD_CTX                  SHA_CTX
+#define MD_Init(a)              SHA1_Init(a)
+#define MD_Update(a,b,c)        SHA1_Update(a,b,c)
+#define MD_Final(a,b)           SHA1_Final(a,b)
+#define MD(a,b,c)               SHA1(a,b,c)
+#elif defined(USE_MDC2_RAND)
+#include <openssl/mdc2.h>
+#define MD_DIGEST_LENGTH        MDC2_DIGEST_LENGTH
+#define MD_CTX                  MDC2_CTX
+#define MD_Init(a)              MDC2_Init(a)
+#define MD_Update(a,b,c)        MDC2_Update(a,b,c)
+#define MD_Final(a,b)           MDC2_Final(a,b)
+#define MD(a,b,c)               MDC2(a,b,c)
+#elif defined(USE_MD2_RAND)
+#include <openssl/md2.h>
+#define MD_DIGEST_LENGTH        MD2_DIGEST_LENGTH
+#define MD_CTX                  MD2_CTX
+#define MD_Init(a)              MD2_Init(a)
+#define MD_Update(a,b,c)        MD2_Update(a,b,c)
+#define MD_Final(a,b)           MD2_Final(a,b)
+#define MD(a,b,c)               MD2(a,b,c)
+#endif
+
+#include <openssl/rand.h>
+
+/* #define NORAND       1 */
+/* #define PREDICT      1 */
+
+#define STATE_SIZE      1023
+static int state_num=0,state_index=0;
+static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH];
+static unsigned char md[MD_DIGEST_LENGTH];
+static long md_count[2]={0,0};
+static double entropy=0;
+static int initialized=0;
+
+const char *RAND_version="RAND" OPENSSL_VERSION_PTEXT;
+
+static void ssleay_rand_cleanup(void);
+static void ssleay_rand_seed(const void *buf, int num);
+static void ssleay_rand_add(const void *buf, int num, double add_entropy);
+static int ssleay_rand_bytes(unsigned char *buf, int num);
+static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
+
+RAND_METHOD rand_ssleay_meth={
+        ssleay_rand_seed,
+        ssleay_rand_bytes,
+        ssleay_rand_cleanup,
+        ssleay_rand_add,
+        ssleay_rand_pseudo_bytes,
+        }; 
+
+RAND_METHOD *RAND_SSLeay(void)
+        {
+        return(&rand_ssleay_meth);
+        }
+
+static void ssleay_rand_cleanup(void)
+        {
+        memset(state,0,sizeof(state));
+        state_num=0;
+        state_index=0;
+        memset(md,0,MD_DIGEST_LENGTH);
+        md_count[0]=0;
+        md_count[1]=0;
+        entropy=0;
+        }
+
+static void ssleay_rand_add(const void *buf, int num, double add)
+        {
+        int i,j,k,st_idx;
+        long md_c[2];
+        unsigned char local_md[MD_DIGEST_LENGTH];
+        MD_CTX m;
+
+#ifdef NORAND
+        return;
+#endif
+
+        /*
+         * (Based on the rand(3) manpage)
+         *
+         * The input is chopped up into units of 20 bytes (or less for
+         * the last block).  Each of these blocks is run through the hash
+         * function as follows:  The data passed to the hash function
+         * is the current 'md', the same number of bytes from the 'state'
+         * (the location determined by in incremented looping index) as
+         * the current 'block', the new key data 'block', and 'count'
+         * (which is incremented after each use).
+         * The result of this is kept in 'md' and also xored into the
+         * 'state' at the same locations that were used as input into the
+         * hash function.
+         */
+
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        st_idx=state_index;
+
+        /* use our own copies of the counters so that even
+         * if a concurrent thread seeds with exactly the
+         * same data and uses the same subarray there's _some_
+         * difference */
+        md_c[0] = md_count[0];
+        md_c[1] = md_count[1];
+
+        memcpy(local_md, md, sizeof md);
+
+        /* state_index <= state_num <= STATE_SIZE */
+        state_index += num;
+        if (state_index >= STATE_SIZE)
+                {
+                state_index%=STATE_SIZE;
+                state_num=STATE_SIZE;
+                }
+        else if (state_num < STATE_SIZE)        
+                {
+                if (state_index > state_num)
+                        state_num=state_index;
+                }
+        /* state_index <= state_num <= STATE_SIZE */
+
+        /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE]
+         * are what we will use now, but other threads may use them
+         * as well */
+
+        md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
+
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
+        for (i=0; i<num; i+=MD_DIGEST_LENGTH)
+                {
+                j=(num-i);
+                j=(j > MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j;
+
+                MD_Init(&m);
+                MD_Update(&m,local_md,MD_DIGEST_LENGTH);
+                k=(st_idx+j)-STATE_SIZE;
+                if (k > 0)
+                        {
+                        MD_Update(&m,&(state[st_idx]),j-k);
+                        MD_Update(&m,&(state[0]),k);
+                        }
+                else
+                        MD_Update(&m,&(state[st_idx]),j);
+                        
+                MD_Update(&m,buf,j);
+                MD_Update(&m,(unsigned char *)&(md_count[0]),sizeof(md_count));
+                MD_Final(md,&m);
+                md_count[1]++;
+
+                buf=(const char *)buf + j;
+
+                for (k=0; k<j; k++)
+                        {
+                        state[st_idx++]^=md[k];
+                        if (st_idx >= STATE_SIZE)
+                                {
+                                st_idx=0;
+                                st_num=STATE_SIZE;
+                                }
+                        }
+                }
+        memset((char *)&m,0,sizeof(m));
+        }
+
+static void ssleay_rand_bytes(unsigned char *buf, int num)
+        {
+        int i,j,k,st_num,st_idx;
+        MD_CTX m;
+        static int init=1;
+        unsigned long l;
+#ifdef DEVRANDOM
+        int fd;
+#endif
+
+#ifdef PREDICT
+        {
+        static unsigned char val=0;
+
+        for (i=0; i<num; i++)
+                buf[i]=val++;
+        return;
+        }
+#endif
+
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+
+        if (init)
+                {
+                CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+                /* put in some default random data, we need more than
+                 * just this */
+                RAND_seed(&m,sizeof(m));
+#ifndef MSDOS
+                l=getpid();
+                RAND_seed(&l,sizeof(l));
+                l=getuid();
+                RAND_seed(&l,sizeof(l));
+#endif
+                l=time(NULL);
+                RAND_seed(&l,sizeof(l));
+
+/* #ifdef DEVRANDOM */
+                /* 
+                 * Use a random entropy pool device.
+                 * Linux 1.3.x, OpenBSD, and FreeBSD have
+                 * this. Use /dev/urandom if you can
+                 * as /dev/random will block if it runs out
+                 * of random entries.
+                 */
+                if ((fd = open(DEVRANDOM, O_RDONLY)) != NULL)
+                        {
+                        unsigned char tmpbuf[32];
+
+                        read(fd, tmpbuf, sizeof(tmpbuf));
+                        /* we don't care how many bytes we read,
+                         * we will just copy the 'stack' if there is
+                         * nothing else :-) */
+                        /* the above comment is EVIL.  Security software
+                         * RELIES ON THESE PRIMITIVES HAVING MORE SECURE
+                         * BEHAVIOUR! Secure entropy is required in
+                         * many cases! */
+                        RAND_seed(tmpbuf,32);
+                        memset(tmpbuf,0,32);
+                        }
+/* #endif */
+#ifdef PURIFY
+                memset(state,0,STATE_SIZE);
+                memset(md,0,MD_DIGEST_LENGTH);
+#endif
+                CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+                init=0;
+                }
+
+        st_idx=state_index;
+        st_num=state_num;
+        state_index+=num;
+        if (state_index > state_num)
+                state_index=(state_index%state_num);
+
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
+        while (num > 0)
+                {
+                j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num;
+                num-=j;
+                MD_Init(&m);
+#ifndef GETPID_IS_MEANINGLESS
+                if (curr_pid) /* just in the first iteration to save time */
+                        {
+                        MD_Update(&m,(unsigned char*)&curr_pid,sizeof curr_pid);
+                        curr_pid = 0;
+                        }
+#endif
+                MD_Update(&m,&(local_md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2);
+                MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
+#ifndef PURIFY
+                MD_Update(&m,buf,j); /* purify complains */
+#endif
+                k=(st_idx+j)-st_num;
+                if (k > 0)
+                        {
+                        MD_Update(&m,&(state[st_idx]),j-k);
+                        MD_Update(&m,&(state[0]),k);
+                        }
+                else
+                        MD_Update(&m,&(state[st_idx]),j);
+                MD_Final(local_md,&m);
+
+                for (i=0; i<j; i++)
+                        {
+                        state[st_idx++]^=local_md[i]; /* may compete with other threads */
+                        *(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
+                        if (st_idx >= st_num)
+                                st_idx=0;
+                        }
+                }
+
+        MD_Init(&m);
+        MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
+        MD_Update(&m,local_md,MD_DIGEST_LENGTH);
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        MD_Update(&m,md,MD_DIGEST_LENGTH);
+        MD_Final(md,&m);
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
+        memset(&m,0,sizeof(m));
+        if (ok)
+                return(1);
+        else
+                {
+                RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
+                return(0);
+                }
+        }
+
+/* pseudo-random bytes that are guaranteed to be unique but not
+   unpredictable */
+static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) 
+        {
+        int ret, err;
+
+        ret = RAND_bytes(buf, num);
+        if (ret == 0)
+                {
+                err = ERR_peek_error();
+                if (ERR_GET_LIB(err) == ERR_LIB_RAND &&
+                    ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED)
+                        (void)ERR_get_error();
+                }
+        return (ret);
+        }
+
+int RAND_status(void)
+        {
+        if (!initialized)
+                ssleay_rand_initialize();
+        return (entropy >= ENTROPY_NEEDED);
+        }
+
+#ifdef WINDOWS
+#include <windows.h>
+#include <openssl/rand.h>
+
+/*****************************************************************************
+ * Initialisation function for the SSL random generator.  Takes the contents
+ * of the screen as random seed.
+ *
+ * Created 960901 by Gertjan van Oosten, gertjan@West.NL, West Consulting B.V.
+ *
+ * Code adapted from
+ * <URL:http://www.microsoft.com/kb/developr/win_dk/q97193.htm>;
+ * the original copyright message is:
+ *
+ *   (C) Copyright Microsoft Corp. 1993.  All rights reserved.
+ *
+ *   You have a royalty-free right to use, modify, reproduce and
+ *   distribute the Sample Files (and/or any modified version) in
+ *   any way you find useful, provided that you agree that
+ *   Microsoft has no warranty obligations or liability for any
+ *   Sample Application Files which are modified.
+ */
+/*
+ * I have modified the loading of bytes via RAND_seed() mechanism since
+ * the original would have been very very CPU intensive since RAND_seed()
+ * does an MD5 per 16 bytes of input.  The cost to digest 16 bytes is the same
+ * as that to digest 56 bytes.  So under the old system, a screen of
+ * 1024*768*256 would have been CPU cost of approximately 49,000 56 byte MD5
+ * digests or digesting 2.7 mbytes.  What I have put in place would
+ * be 48 16k MD5 digests, or effectively 48*16+48 MD5 bytes or 816 kbytes
+ * or about 3.5 times as much.
+ * - eric 
+ */
+void RAND_screen(void)
+{
+  HDC           hScrDC;         /* screen DC */
+  HDC           hMemDC;         /* memory DC */
+  HBITMAP       hBitmap;        /* handle for our bitmap */
+  HBITMAP       hOldBitmap;     /* handle for previous bitmap */
+  BITMAP        bm;             /* bitmap properties */
+  unsigned int  size;           /* size of bitmap */
+  char          *bmbits;        /* contents of bitmap */
+  int           w;              /* screen width */
+  int           h;              /* screen height */
+  int           y;              /* y-coordinate of screen lines to grab */
+  int           n = 16;         /* number of screen lines to grab at a time */
+
+  /* Create a screen DC and a memory DC compatible to screen DC */
+  hScrDC = CreateDC("DISPLAY", NULL, NULL, NULL);
+  hMemDC = CreateCompatibleDC(hScrDC);
+
+  /* Get screen resolution */
+  w = GetDeviceCaps(hScrDC, HORZRES);
+  h = GetDeviceCaps(hScrDC, VERTRES);
+
+  /* Create a bitmap compatible with the screen DC */
+  hBitmap = CreateCompatibleBitmap(hScrDC, w, n);
+
+  /* Select new bitmap into memory DC */
+  hOldBitmap = SelectObject(hMemDC, hBitmap);
+
+  /* Get bitmap properties */
+  GetObject(hBitmap, sizeof(BITMAP), (LPSTR)&bm);
+  size = (unsigned int)bm.bmWidthBytes * bm.bmHeight * bm.bmPlanes;
+
+  bmbits = Malloc(size);
+  if (bmbits) {
+    /* Now go through the whole screen, repeatedly grabbing n lines */
+    for (y = 0; y < h-n; y += n)
+        {
+        unsigned char md[MD_DIGEST_LENGTH];
+
+        /* Bitblt screen DC to memory DC */
+        BitBlt(hMemDC, 0, 0, w, n, hScrDC, 0, y, SRCCOPY);
+
+        /* Copy bitmap bits from memory DC to bmbits */
+        GetBitmapBits(hBitmap, size, bmbits);
+
+        /* Get the MD5 of the bitmap */
+        MD(bmbits,size,md);
+
+        /* Seed the random generator with the MD5 digest */
+        RAND_seed(md, MD_DIGEST_LENGTH);
+        }
+
+    Free(bmbits);
+  }
+
+  /* Select old bitmap back into memory DC */
+  hBitmap = SelectObject(hMemDC, hOldBitmap);
+
+  /* Clean up */
+  DeleteObject(hBitmap);
+  DeleteDC(hMemDC);
+  DeleteDC(hScrDC);
+}
+#endif
diff --git a/src/lib/libcrypto/rand/rand.h b/src/lib/libcrypto/rand/rand.h
index fd8ee38366..28f45ec052 100644
--- a/src/lib/libcrypto/rand/rand.h
+++ b/src/lib/libcrypto/rand/rand.h
@@ -66,24 +66,45 @@ extern "C" {
 typedef struct rand_meth_st
         {
         void (*seed)(const void *buf, int num);
-        void (*bytes)(unsigned char *buf, int num);
+        int (*bytes)(unsigned char *buf, int num);
         void (*cleanup)(void);
+        void (*add)(const void *buf, int num, double entropy);
+        int (*pseudorand)(unsigned char *buf, int num);
         } RAND_METHOD;
 
 void RAND_set_rand_method(RAND_METHOD *meth);
 RAND_METHOD *RAND_get_rand_method(void );
 RAND_METHOD *RAND_SSLeay(void);
 void RAND_cleanup(void );
-void RAND_bytes(unsigned char *buf,int num);
+int  RAND_bytes(unsigned char *buf,int num);
+int  RAND_pseudo_bytes(unsigned char *buf,int num);
 void RAND_seed(const void *buf,int num);
+void RAND_add(const void *buf,int num,double entropy);
 int  RAND_load_file(const char *file,long max_bytes);
 int  RAND_write_file(const char *file);
-char *RAND_file_name(char *file,int num);
+const char *RAND_file_name(char *file,int num);
+int RAND_status(void);
+int RAND_egd(const char *path);
 #ifdef WINDOWS
 void RAND_screen(void);
 #endif
+void    ERR_load_RAND_strings(void);
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+
+/* Error codes for the RAND functions. */
+
+/* Function codes. */
+#define RAND_F_SSLEAY_RAND_BYTES                         100
+
+/* Reason codes. */
+#define RAND_R_PRNG_NOT_SEEDED                           100
+
 #ifdef  __cplusplus
 }
 #endif
-
 #endif
+
diff --git a/src/lib/libcrypto/rand/rand_egd.c b/src/lib/libcrypto/rand/rand_egd.c
new file mode 100644
index 0000000000..d834408bd4
--- /dev/null
+++ b/src/lib/libcrypto/rand/rand_egd.c
@@ -0,0 +1,110 @@
+/* crypto/rand/rand_egd.c */
+/* Written by Ulf Moeller for the OpenSSL project. */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/rand.h>
+
+/* Query the EGD <URL: http://www.lothar.com/tech/crypto/>.
+ */
+
+#if defined(WIN32) || defined(VMS) || defined(__VMS)
+int RAND_egd(const char *path)
+        {
+        return(-1);
+        }
+#else
+#include <openssl/opensslconf.h>
+#include OPENSSL_UNISTD
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <string.h>
+
+#ifndef offsetof
+#  define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+#endif
+
+int RAND_egd(const char *path)
+        {
+        int ret = -1;
+        struct sockaddr_un addr;
+        int len, num;
+        int fd = -1;
+        unsigned char buf[256];
+
+        memset(&addr, 0, sizeof(addr));
+        addr.sun_family = AF_UNIX;
+        if (strlen(path) > sizeof(addr.sun_path))
+                return (-1);
+        strcpy(addr.sun_path,path);
+        len = offsetof(struct sockaddr_un, sun_path) + strlen(path);
+        fd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (fd == -1) return (-1);
+        if (connect(fd, (struct sockaddr *)&addr, len) == -1) goto err;
+        buf[0] = 1;
+        buf[1] = 255;
+        write(fd, buf, 2);
+        if (read(fd, buf, 1) != 1) goto err;
+    if (buf[0] == 0) goto err;
+        num = read(fd, buf, 255);
+        if (num < 1) goto err;
+        RAND_seed(buf, num);
+        if (RAND_status() == 1)
+                ret = num;
+ err:
+        if (fd != -1) close(fd);
+        return(ret);
+        }
+#endif
diff --git a/src/lib/libcrypto/rand/rand_err.c b/src/lib/libcrypto/rand/rand_err.c
new file mode 100644
index 0000000000..d1263edf80
--- /dev/null
+++ b/src/lib/libcrypto/rand/rand_err.c
@@ -0,0 +1,93 @@
+/* crypto/rand/rand_err.c */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+
+/* BEGIN ERROR CODES */
+#ifndef NO_ERR
+static ERR_STRING_DATA RAND_str_functs[]=
+        {
+{ERR_PACK(0,RAND_F_SSLEAY_RAND_BYTES,0),        "SSLEAY_RAND_BYTES"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA RAND_str_reasons[]=
+        {
+{RAND_R_PRNG_NOT_SEEDED                  ,"prng not seeded"},
+{0,NULL}
+        };
+
+#endif
+
+void ERR_load_RAND_strings(void)
+        {
+        static int init=1;
+
+        if (init)
+                {
+                init=0;
+#ifndef NO_ERR
+                ERR_load_strings(ERR_LIB_RAND,RAND_str_functs);
+                ERR_load_strings(ERR_LIB_RAND,RAND_str_reasons);
+#endif
+
+                }
+        }
diff --git a/src/lib/libcrypto/rand/rand_lib.c b/src/lib/libcrypto/rand/rand_lib.c
index 34c6d5b968..b09a300c46 100644
--- a/src/lib/libcrypto/rand/rand_lib.c
+++ b/src/lib/libcrypto/rand/rand_lib.c
@@ -57,7 +57,6 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
 #include <time.h>
 #include <openssl/rand.h>
 
@@ -90,9 +89,22 @@ void RAND_seed(const void *buf, int num)
                 rand_meth->seed(buf,num);
         }
 
-void RAND_bytes(unsigned char *buf, int num)
+void RAND_add(const void *buf, int num, double entropy)
         {
         if (rand_meth != NULL)
-                rand_meth->bytes(buf,num);
+                rand_meth->add(buf,num,entropy);
         }
 
+int RAND_bytes(unsigned char *buf, int num)
+        {
+        if (rand_meth != NULL)
+                return rand_meth->bytes(buf,num);
+        return(-1);
+        }
+
+int RAND_pseudo_bytes(unsigned char *buf, int num)
+        {
+        if (rand_meth != NULL)
+                return rand_meth->pseudorand(buf,num);
+        return(-1);
+        }
diff --git a/src/lib/libcrypto/rand/randfile.c b/src/lib/libcrypto/rand/randfile.c
index 6829d4ec37..658a8d6b65 100644
--- a/src/lib/libcrypto/rand/randfile.c
+++ b/src/lib/libcrypto/rand/randfile.c
@@ -60,22 +60,35 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
 #include "openssl/e_os.h"
 
+#ifdef VMS
+#include <unixio.h>
+#endif
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifdef MAC_OS_pre_X
+# include <stat.h>
+#else
+# include <sys/stat.h>
+#endif
+
+#include <openssl/crypto.h>
 #include <openssl/rand.h>
 
 #undef BUFSIZE
 #define BUFSIZE 1024
 #define RAND_DATA 1024
 
-/* #define RFILE ".rand" - defined in ../../e_os.h */
+/* #define RFILE ".rnd" - defined in ../../e_os.h */
 
 int RAND_load_file(const char *file, long bytes)
         {
+        /* If bytes >= 0, read up to 'bytes' bytes.
+         * if bytes == -1, read complete file. */
+
         MS_STATIC unsigned char buf[BUFSIZE];
         struct stat sb;
         int i,ret=0,n;
@@ -85,23 +98,28 @@ int RAND_load_file(const char *file, long bytes)
 
         i=stat(file,&sb);
         /* If the state fails, put some crap in anyway */
-        RAND_seed(&sb,sizeof(sb));
-        ret+=sizeof(sb);
+        RAND_add(&sb,sizeof(sb),0);
         if (i < 0) return(0);
-        if (bytes <= 0) return(ret);
+        if (bytes == 0) return(ret);
 
         in=fopen(file,"rb");
         if (in == NULL) goto err;
         for (;;)
                 {
-                n=(bytes < BUFSIZE)?(int)bytes:BUFSIZE;
+                if (bytes > 0)
+                        n = (bytes < BUFSIZE)?(int)bytes:BUFSIZE;
+                else
+                        n = BUFSIZE;
                 i=fread(buf,1,n,in);
                 if (i <= 0) break;
                 /* even if n != i, use the full array */
-                RAND_seed(buf,n);
+                RAND_add(buf,n,i);
                 ret+=i;
-                bytes-=n;
-                if (bytes <= 0) break;
+                if (bytes > 0)
+                        {
+                        bytes-=n;
+                        if (bytes == 0) break;
+                        }
                 }
         fclose(in);
         memset(buf,0,BUFSIZE);
@@ -112,29 +130,48 @@ err:
 int RAND_write_file(const char *file)
         {
         unsigned char buf[BUFSIZE];
-        int i,ret=0;
-        FILE *out;
+        int i,ret=0,err=0;
+        FILE *out = NULL;
         int n;
 
-        /* Under VMS, fopen(file, "wb") will craete a new version of the
+#ifdef VMS
+        /* Under VMS, fopen(file, "wb") will create a new version of the
            same file.  This is not good, so let's try updating an existing
-           one, and create file only if it doesn't already exist.  This
-           should be completely harmless on system that have no file
-           versions.                                    -- Richard Levitte */
+           one, and create file only if it doesn't already exist. */
+        /* At the same time, if we just update a file, we also need to
+           truncate it, and unfortunately, ftruncate() and truncate() do
+           not exist everywhere.  All that remains is to delete old versions
+           of the random data file (done at the end). */
+#if 0
         out=fopen(file,"rb+");
-        if (out == NULL && errno == ENOENT)
+        if (out == NULL && errno != ENOENT)
+                goto err;
+#endif
+#endif
+
+        if (out == NULL)
                 {
-                errno = 0;
+#if defined O_CREAT && defined O_EXCL
+                /* chmod(..., 0600) is too late to protect the file,
+                 * permissions should be restrictive from the start */
+                int fd = open(file, O_CREAT | O_EXCL, 0600);
+                if (fd != -1)
+                        out = fdopen(fd, "wb");
+#else           
                 out=fopen(file,"wb");
+#endif
                 }
         if (out == NULL) goto err;
+#ifndef NO_CHMOD
         chmod(file,0600);
+#endif
         n=RAND_DATA;
         for (;;)
                 {
                 i=(n > BUFSIZE)?BUFSIZE:n;
                 n-=BUFSIZE;
-                RAND_bytes(buf,i);
+                if (RAND_bytes(buf,i) <= 0)
+                        err=1;
                 i=fwrite(buf,1,i,out);
                 if (i <= 0)
                         {
@@ -144,13 +181,40 @@ int RAND_write_file(const char *file)
                 ret+=i;
                 if (n <= 0) break;
                 }
+#ifdef VMS
+        /* We may have updated an existing file using mode "rb+",
+         * now remove any old extra bytes */
+#if 0
+        if (ret > 0)
+                ftruncate(fileno(out), ret);
+#else
+        /* Try to delete older versions of the file, until there aren't
+           any */
+        {
+        char *tmpf;
+
+        tmpf = Malloc(strlen(file) + 4);  /* to add ";-1" and a nul */
+        if (tmpf)
+                {
+                strcpy(tmpf, file);
+                strcat(tmpf, ";-1");
+                while(delete(tmpf) == 0)
+                        ;
+                rename(file,";1"); /* Make sure it's version 1, or we
+                                      will reach the limit (32767) at
+                                      some point... */
+                }
+        }
+#endif
+#endif
+
         fclose(out);
         memset(buf,0,BUFSIZE);
 err:
-        return(ret);
+        return(err ? -1 : ret);
         }
 
-char *RAND_file_name(char *buf, int size)
+const char *RAND_file_name(char *buf, int size)
         {
         char *s;
         char *ret=NULL;
diff --git a/src/lib/libcrypto/rand/randtest.c b/src/lib/libcrypto/rand/randtest.c
index f0706d779a..da96e3f695 100644
--- a/src/lib/libcrypto/rand/randtest.c
+++ b/src/lib/libcrypto/rand/randtest.c
@@ -73,7 +73,7 @@ int main()
         /*double d; */
         long d;
 
-        RAND_bytes(buf,2500);
+        RAND_pseudo_bytes(buf,2500);
 
         n1=0;
         for (i=0; i<16; i++) n2[i]=0;
diff --git a/src/lib/libcrypto/rc2/rc2speed.c b/src/lib/libcrypto/rc2/rc2speed.c
index c3da63e77e..9f7f5ccfa3 100644
--- a/src/lib/libcrypto/rc2/rc2speed.c
+++ b/src/lib/libcrypto/rc2/rc2speed.c
@@ -183,7 +183,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libcrypto/rc2/rc2test.c b/src/lib/libcrypto/rc2/rc2test.c
index 6a5defa6ea..521269ded1 100644
--- a/src/lib/libcrypto/rc2/rc2test.c
+++ b/src/lib/libcrypto/rc2/rc2test.c
@@ -72,7 +72,7 @@ int main(int argc, char *argv[])
 #else
 #include <openssl/rc2.h>
 
-unsigned char RC2key[4][16]={
+static unsigned char RC2key[4][16]={
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
          0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
@@ -83,14 +83,14 @@ unsigned char RC2key[4][16]={
          0x08,0x09,0x0A,0x0B,0x0C,0x0D,0x0E,0x0F},
         };
 
-unsigned char RC2plain[4][8]={
+static unsigned char RC2plain[4][8]={
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
         {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
         };
 
-unsigned char RC2cipher[4][8]={
+static unsigned char RC2cipher[4][8]={
         {0x1C,0x19,0x8A,0x83,0x8D,0xF0,0x28,0xB7},
         {0x21,0x82,0x9C,0x78,0xA9,0xF9,0xC0,0x74},
         {0x13,0xDB,0x35,0x17,0xD3,0x21,0x86,0x9E},
diff --git a/src/lib/libcrypto/rc4/rc4.h b/src/lib/libcrypto/rc4/rc4.h
index 7418c2a9a2..8556dddab0 100644
--- a/src/lib/libcrypto/rc4/rc4.h
+++ b/src/lib/libcrypto/rc4/rc4.h
@@ -77,8 +77,8 @@ typedef struct rc4_key_st
 
  
 const char *RC4_options(void);
-void RC4_set_key(RC4_KEY *key, int len, unsigned char *data);
-void RC4(RC4_KEY *key, unsigned long len, unsigned char *indata,
+void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
+void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
                 unsigned char *outdata);
 
 #ifdef  __cplusplus
diff --git a/src/lib/libcrypto/rc4/rc4_enc.c b/src/lib/libcrypto/rc4/rc4_enc.c
index 3256bea8cc..d5f18a3a70 100644
--- a/src/lib/libcrypto/rc4/rc4_enc.c
+++ b/src/lib/libcrypto/rc4/rc4_enc.c
@@ -67,7 +67,7 @@
  * Date: Wed, 14 Sep 1994 06:35:31 GMT
  */
 
-void RC4(RC4_KEY *key, unsigned long len, unsigned char *indata,
+void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
              unsigned char *outdata)
         {
         register RC4_INT *d;
@@ -78,6 +78,190 @@ void RC4(RC4_KEY *key, unsigned long len, unsigned char *indata,
         y=key->y;     
         d=key->data; 
 
+#if defined(RC4_CHUNK)
+        /*
+         * The original reason for implementing this(*) was the fact that
+         * pre-21164a Alpha CPUs don't have byte load/store instructions
+         * and e.g. a byte store has to be done with 64-bit load, shift,
+         * and, or and finally 64-bit store. Peaking data and operating
+         * at natural word size made it possible to reduce amount of
+         * instructions as well as to perform early read-ahead without
+         * suffering from RAW (read-after-write) hazard. This resulted
+         * in ~40%(**) performance improvement on 21064 box with gcc.
+         * But it's not only Alpha users who win here:-) Thanks to the
+         * early-n-wide read-ahead this implementation also exhibits
+         * >40% speed-up on SPARC and 20-30% on 64-bit MIPS (depending
+         * on sizeof(RC4_INT)).
+         *
+         * (*)  "this" means code which recognizes the case when input
+         *      and output pointers appear to be aligned at natural CPU
+         *      word boundary
+         * (**) i.e. according to 'apps/openssl speed rc4' benchmark,
+         *      crypto/rc4/rc4speed.c exhibits almost 70% speed-up...
+         *
+         * Cavets.
+         *
+         * - RC4_CHUNK="unsigned long long" should be a #1 choice for
+         *   UltraSPARC. Unfortunately gcc generates very slow code
+         *   (2.5-3 times slower than one generated by Sun's WorkShop
+         *   C) and therefore gcc (at least 2.95 and earlier) should
+         *   always be told that RC4_CHUNK="unsigned long".
+         *
+         *                                      <appro@fy.chalmers.se>
+         */
+
+# define RC4_STEP       ( \
+                        x=(x+1) &0xff,  \
+                        tx=d[x],        \
+                        y=(tx+y)&0xff,  \
+                        ty=d[y],        \
+                        d[y]=tx,        \
+                        d[x]=ty,        \
+                        (RC4_CHUNK)d[(tx+ty)&0xff]\
+                        )
+
+        if ( ( ((unsigned long)indata  & (sizeof(RC4_CHUNK)-1)) | 
+               ((unsigned long)outdata & (sizeof(RC4_CHUNK)-1)) ) == 0 )
+                {
+                RC4_CHUNK ichunk,otp;
+                const union { long one; char little; } is_endian = {1};
+
+                /*
+                 * I reckon we can afford to implement both endian
+                 * cases and to decide which way to take at run-time
+                 * because the machine code appears to be very compact
+                 * and redundant 1-2KB is perfectly tolerable (i.e.
+                 * in case the compiler fails to eliminate it:-). By
+                 * suggestion from Terrel Larson <terr@terralogic.net>
+                 * who also stands for the is_endian union:-)
+                 *
+                 * Special notes.
+                 *
+                 * - is_endian is declared automatic as doing otherwise
+                 *   (declaring static) prevents gcc from eliminating
+                 *   the redundant code;
+                 * - compilers (those I've tried) don't seem to have
+                 *   problems eliminating either the operators guarded
+                 *   by "if (sizeof(RC4_CHUNK)==8)" or the condition
+                 *   expressions themselves so I've got 'em to replace
+                 *   corresponding #ifdefs from the previous version;
+                 * - I chose to let the redundant switch cases when
+                 *   sizeof(RC4_CHUNK)!=8 be (were also #ifdefed
+                 *   before);
+                 * - in case you wonder "&(sizeof(RC4_CHUNK)*8-1)" in
+                 *   [LB]ESHFT guards against "shift is out of range"
+                 *   warnings when sizeof(RC4_CHUNK)!=8 
+                 *
+                 *                      <appro@fy.chalmers.se>
+                 */
+                if (!is_endian.little)
+                        {       /* BIG-ENDIAN CASE */
+# define BESHFT(c)      (((sizeof(RC4_CHUNK)-(c)-1)*8)&(sizeof(RC4_CHUNK)*8-1))
+                        for (;len&-sizeof(RC4_CHUNK);len-=sizeof(RC4_CHUNK))
+                                {
+                                ichunk  = *(RC4_CHUNK *)indata;
+                                otp  = RC4_STEP<<BESHFT(0);
+                                otp |= RC4_STEP<<BESHFT(1);
+                                otp |= RC4_STEP<<BESHFT(2);
+                                otp |= RC4_STEP<<BESHFT(3);
+                                if (sizeof(RC4_CHUNK)==8)
+                                        {
+                                        otp |= RC4_STEP<<BESHFT(4);
+                                        otp |= RC4_STEP<<BESHFT(5);
+                                        otp |= RC4_STEP<<BESHFT(6);
+                                        otp |= RC4_STEP<<BESHFT(7);
+                                        }
+                                *(RC4_CHUNK *)outdata = otp^ichunk;
+                                indata  += sizeof(RC4_CHUNK);
+                                outdata += sizeof(RC4_CHUNK);
+                                }
+                        if (len)
+                                {
+                                RC4_CHUNK mask=(RC4_CHUNK)-1, ochunk;
+
+                                ichunk = *(RC4_CHUNK *)indata;
+                                ochunk = *(RC4_CHUNK *)outdata;
+                                otp = 0;
+                                i = BESHFT(0);
+                                mask <<= (sizeof(RC4_CHUNK)-len)<<3;
+                                switch (len&(sizeof(RC4_CHUNK)-1))
+                                        {
+                                        case 7: otp  = RC4_STEP<<i, i-=8;
+                                        case 6: otp |= RC4_STEP<<i, i-=8;
+                                        case 5: otp |= RC4_STEP<<i, i-=8;
+                                        case 4: otp |= RC4_STEP<<i, i-=8;
+                                        case 3: otp |= RC4_STEP<<i, i-=8;
+                                        case 2: otp |= RC4_STEP<<i, i-=8;
+                                        case 1: otp |= RC4_STEP<<i, i-=8;
+                                        case 0: ; /*
+                                                   * it's never the case,
+                                                   * but it has to be here
+                                                   * for ultrix?
+                                                   */
+                                        }
+                                ochunk &= ~mask;
+                                ochunk |= (otp^ichunk) & mask;
+                                *(RC4_CHUNK *)outdata = ochunk;
+                                }
+                        key->x=x;     
+                        key->y=y;
+                        return;
+                        }
+                else
+                        {       /* LITTLE-ENDIAN CASE */
+# define LESHFT(c)      (((c)*8)&(sizeof(RC4_CHUNK)*8-1))
+                        for (;len&-sizeof(RC4_CHUNK);len-=sizeof(RC4_CHUNK))
+                                {
+                                ichunk  = *(RC4_CHUNK *)indata;
+                                otp  = RC4_STEP;
+                                otp |= RC4_STEP<<8;
+                                otp |= RC4_STEP<<16;
+                                otp |= RC4_STEP<<24;
+                                if (sizeof(RC4_CHUNK)==8)
+                                        {
+                                        otp |= RC4_STEP<<LESHFT(4);
+                                        otp |= RC4_STEP<<LESHFT(5);
+                                        otp |= RC4_STEP<<LESHFT(6);
+                                        otp |= RC4_STEP<<LESHFT(7);
+                                        }
+                                *(RC4_CHUNK *)outdata = otp^ichunk;
+                                indata  += sizeof(RC4_CHUNK);
+                                outdata += sizeof(RC4_CHUNK);
+                                }
+                        if (len)
+                                {
+                                RC4_CHUNK mask=(RC4_CHUNK)-1, ochunk;
+
+                                ichunk = *(RC4_CHUNK *)indata;
+                                ochunk = *(RC4_CHUNK *)outdata;
+                                otp = 0;
+                                i   = 0;
+                                mask >>= (sizeof(RC4_CHUNK)-len)<<3;
+                                switch (len&(sizeof(RC4_CHUNK)-1))
+                                        {
+                                        case 7: otp  = RC4_STEP,    i+=8;
+                                        case 6: otp |= RC4_STEP<<i, i+=8;
+                                        case 5: otp |= RC4_STEP<<i, i+=8;
+                                        case 4: otp |= RC4_STEP<<i, i+=8;
+                                        case 3: otp |= RC4_STEP<<i, i+=8;
+                                        case 2: otp |= RC4_STEP<<i, i+=8;
+                                        case 1: otp |= RC4_STEP<<i, i+=8;
+                                        case 0: ; /*
+                                                   * it's never the case,
+                                                   * but it has to be here
+                                                   * for ultrix?
+                                                   */
+                                        }
+                                ochunk &= ~mask;
+                                ochunk |= (otp^ichunk) & mask;
+                                *(RC4_CHUNK *)outdata = ochunk;
+                                }
+                        key->x=x;     
+                        key->y=y;
+                        return;
+                        }
+                }
+#endif
 #define LOOP(in,out) \
                 x=((x+1)&0xff); \
                 tx=d[x]; \
diff --git a/src/lib/libcrypto/rc4/rc4_skey.c b/src/lib/libcrypto/rc4/rc4_skey.c
index c67a445f1f..bb10c1ebe2 100644
--- a/src/lib/libcrypto/rc4/rc4_skey.c
+++ b/src/lib/libcrypto/rc4/rc4_skey.c
@@ -85,7 +85,7 @@ const char *RC4_options(void)
  * Date: Wed, 14 Sep 1994 06:35:31 GMT
  */
 
-void RC4_set_key(RC4_KEY *key, int len, register unsigned char *data)
+void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
         {
         register RC4_INT tmp;
         register int id1,id2;
diff --git a/src/lib/libcrypto/rc4/rc4speed.c b/src/lib/libcrypto/rc4/rc4speed.c
index 4fb5ebf573..b448f4a5c6 100644
--- a/src/lib/libcrypto/rc4/rc4speed.c
+++ b/src/lib/libcrypto/rc4/rc4speed.c
@@ -183,7 +183,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libcrypto/rc4/rc4test.c b/src/lib/libcrypto/rc4/rc4test.c
index 5abf8cff30..3914eb6c38 100644
--- a/src/lib/libcrypto/rc4/rc4test.c
+++ b/src/lib/libcrypto/rc4/rc4test.c
@@ -69,7 +69,7 @@ int main(int argc, char *argv[])
 #else
 #include <openssl/rc4.h>
 
-unsigned char keys[7][30]={
+static unsigned char keys[7][30]={
         {8,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef},
         {8,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef},
         {8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
@@ -78,8 +78,8 @@ unsigned char keys[7][30]={
         {4,0xef,0x01,0x23,0x45},
         };
 
-unsigned char data_len[7]={8,8,8,20,28,10};
-unsigned char data[7][30]={
+static unsigned char data_len[7]={8,8,8,20,28,10};
+static unsigned char data[7][30]={
         {0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xff},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff},
@@ -94,7 +94,7 @@ unsigned char data[7][30]={
         {0},
         };
 
-unsigned char output[7][30]={
+static unsigned char output[7][30]={
         {0x75,0xb7,0x87,0x80,0x99,0xe0,0xc5,0x96,0x00},
         {0x74,0x94,0xc2,0xe7,0x10,0x4b,0x08,0x79,0x00},
         {0xde,0x18,0x89,0x41,0xa3,0x37,0x5d,0x3a,0x00},
diff --git a/src/lib/libcrypto/ripemd/Makefile.ssl b/src/lib/libcrypto/ripemd/Makefile.ssl
index 5b6d1d2599..c6153d4361 100644
--- a/src/lib/libcrypto/ripemd/Makefile.ssl
+++ b/src/lib/libcrypto/ripemd/Makefile.ssl
@@ -102,6 +102,7 @@ clean:
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
+rmd_dgst.o: ../../include/openssl/opensslconf.h
 rmd_dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/ripemd.h
-rmd_dgst.o: rmd_locl.h rmdconst.h
-rmd_one.o: ../../include/openssl/ripemd.h rmd_locl.h rmdconst.h
+rmd_dgst.o: ../md32_common.h rmd_locl.h rmdconst.h
+rmd_one.o: ../../include/openssl/ripemd.h
diff --git a/src/lib/libcrypto/ripemd/asm/rips.cpp b/src/lib/libcrypto/ripemd/asm/rips.cpp
index 321a98443e..f7a13677a9 100644
--- a/src/lib/libcrypto/ripemd/asm/rips.cpp
+++ b/src/lib/libcrypto/ripemd/asm/rips.cpp
@@ -34,6 +34,8 @@ void GetTSC(unsigned long& tsc)
 #include <stdlib.h>
 #include <openssl/ripemd.h>
 
+#define ripemd160_block_x86 ripemd160_block_asm_host_order
+
 extern "C" {
 void ripemd160_block_x86(RIPEMD160_CTX *ctx, unsigned char *buffer,int num);
 }
@@ -55,8 +57,10 @@ void main(int argc,char *argv[])
         if (num == 0) num=16;
         if (num > 250) num=16;
         numm=num+2;
+#if 0
         num*=64;
         numm*=64;
+#endif
 
         for (j=0; j<6; j++)
                 {
@@ -71,7 +75,7 @@ void main(int argc,char *argv[])
                         GetTSC(e2);
                         ripemd160_block_x86(&ctx,buffer,num);
                         }
-                printf("ripemd160 (%d bytes) %d %d (%.2f)\n",num,
+                printf("ripemd160 (%d bytes) %d %d (%.2f)\n",num*64,
                         e1-s1,e2-s2,(double)((e1-s1)-(e2-s2))/2);
                 }
         }
diff --git a/src/lib/libcrypto/ripemd/asm/rm-win32.asm b/src/lib/libcrypto/ripemd/asm/rm-win32.asm
index bd38791c13..f07d517857 100644
--- a/src/lib/libcrypto/ripemd/asm/rm-win32.asm
+++ b/src/lib/libcrypto/ripemd/asm/rm-win32.asm
@@ -8,1965 +8,1966 @@
         .386
 .model FLAT
 _TEXT   SEGMENT
-PUBLIC  _ripemd160_block_x86
+PUBLIC  _ripemd160_block_asm_host_order
 
-_ripemd160_block_x86 PROC NEAR
+_ripemd160_block_asm_host_order PROC NEAR
+        mov     edx,            DWORD PTR 4[esp]
+        mov     eax,            DWORD PTR 8[esp]
         push    esi
-        mov     ecx,            DWORD PTR 16[esp]
+        mov     ecx,            DWORD PTR [edx]
         push    edi
-        mov     esi,            DWORD PTR 16[esp]
+        mov     esi,            DWORD PTR 4[edx]
         push    ebp
-        add     ecx,            esi
+        mov     edi,            DWORD PTR 8[edx]
         push    ebx
-        sub     ecx,            64
-        sub     esp,            88
-        mov     DWORD PTR [esp],ecx
-        mov     edi,            DWORD PTR 108[esp]
+        sub     esp,            108
 L000start:
         ; 
-        mov     eax,            DWORD PTR [esi]
-        mov     ebx,            DWORD PTR 4[esi]
-        mov     DWORD PTR 4[esp],eax
+        mov     ebx,            DWORD PTR [eax]
+        mov     ebp,            DWORD PTR 4[eax]
+        mov     DWORD PTR [esp],ebx
+        mov     DWORD PTR 4[esp],ebp
+        mov     ebx,            DWORD PTR 8[eax]
+        mov     ebp,            DWORD PTR 12[eax]
         mov     DWORD PTR 8[esp],ebx
-        mov     eax,            DWORD PTR 8[esi]
-        mov     ebx,            DWORD PTR 12[esi]
-        mov     DWORD PTR 12[esp],eax
+        mov     DWORD PTR 12[esp],ebp
+        mov     ebx,            DWORD PTR 16[eax]
+        mov     ebp,            DWORD PTR 20[eax]
         mov     DWORD PTR 16[esp],ebx
-        mov     eax,            DWORD PTR 16[esi]
-        mov     ebx,            DWORD PTR 20[esi]
-        mov     DWORD PTR 20[esp],eax
+        mov     DWORD PTR 20[esp],ebp
+        mov     ebx,            DWORD PTR 24[eax]
+        mov     ebp,            DWORD PTR 28[eax]
         mov     DWORD PTR 24[esp],ebx
-        mov     eax,            DWORD PTR 24[esi]
-        mov     ebx,            DWORD PTR 28[esi]
-        mov     DWORD PTR 28[esp],eax
+        mov     DWORD PTR 28[esp],ebp
+        mov     ebx,            DWORD PTR 32[eax]
+        mov     ebp,            DWORD PTR 36[eax]
         mov     DWORD PTR 32[esp],ebx
-        mov     eax,            DWORD PTR 32[esi]
-        mov     ebx,            DWORD PTR 36[esi]
-        mov     DWORD PTR 36[esp],eax
+        mov     DWORD PTR 36[esp],ebp
+        mov     ebx,            DWORD PTR 40[eax]
+        mov     ebp,            DWORD PTR 44[eax]
         mov     DWORD PTR 40[esp],ebx
-        mov     eax,            DWORD PTR 40[esi]
-        mov     ebx,            DWORD PTR 44[esi]
-        mov     DWORD PTR 44[esp],eax
+        mov     DWORD PTR 44[esp],ebp
+        mov     ebx,            DWORD PTR 48[eax]
+        mov     ebp,            DWORD PTR 52[eax]
         mov     DWORD PTR 48[esp],ebx
-        mov     eax,            DWORD PTR 48[esi]
-        mov     ebx,            DWORD PTR 52[esi]
-        mov     DWORD PTR 52[esp],eax
+        mov     DWORD PTR 52[esp],ebp
+        mov     ebx,            DWORD PTR 56[eax]
+        mov     ebp,            DWORD PTR 60[eax]
         mov     DWORD PTR 56[esp],ebx
-        mov     eax,            DWORD PTR 56[esi]
-        mov     ebx,            DWORD PTR 60[esi]
-        mov     DWORD PTR 60[esp],eax
-        mov     DWORD PTR 64[esp],ebx
-        add     esi,            64
-        mov     eax,            DWORD PTR [edi]
-        mov     DWORD PTR 112[esp],esi
-        mov     ebx,            DWORD PTR 4[edi]
-        mov     ecx,            DWORD PTR 8[edi]
-        mov     edx,            DWORD PTR 12[edi]
-        mov     ebp,            DWORD PTR 16[edi]
+        mov     DWORD PTR 60[esp],ebp
+        mov     eax,            edi
+        mov     ebx,            DWORD PTR 12[edx]
+        mov     ebp,            DWORD PTR 16[edx]
         ; 0
-        mov     esi,            ecx
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 4[esp]
-        xor     esi,            ebx
-        add     eax,            edi
-        rol     ecx,            10
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     eax,            11
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR [esp]
+        xor     eax,            esi
+        add     ecx,            edx
+        rol     edi,            10
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     ecx,            11
+        add     ecx,            ebp
         ; 1
-        xor     esi,            ecx
-        mov     edi,            DWORD PTR 8[esp]
-        xor     esi,            eax
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebx,            10
-        add     ebp,            edi
-        xor     esi,            ebx
-        rol     ebp,            14
+        xor     eax,            edi
+        mov     edx,            DWORD PTR 4[esp]
+        xor     eax,            ecx
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     esi,            10
         add     ebp,            edx
+        xor     eax,            esi
+        rol     ebp,            14
+        add     ebp,            ebx
         ; 2
-        mov     edi,            DWORD PTR 12[esp]
-        xor     esi,            ebp
-        add     edx,            edi
-        rol     eax,            10
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     edx,            15
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 8[esp]
+        xor     eax,            ebp
+        add     ebx,            edx
+        rol     ecx,            10
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ebx,            15
+        add     ebx,            edi
         ; 3
-        xor     esi,            eax
-        mov     edi,            DWORD PTR 16[esp]
-        xor     esi,            edx
-        add     ecx,            esi
-        mov     esi,            edx
+        xor     eax,            ecx
+        mov     edx,            DWORD PTR 12[esp]
+        xor     eax,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
         rol     ebp,            10
-        add     ecx,            edi
-        xor     esi,            ebp
-        rol     ecx,            12
-        add     ecx,            ebx
+        add     edi,            edx
+        xor     eax,            ebp
+        rol     edi,            12
+        add     edi,            esi
         ; 4
-        mov     edi,            DWORD PTR 20[esp]
-        xor     esi,            ecx
-        add     ebx,            edi
-        rol     edx,            10
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     ebx,            5
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 16[esp]
+        xor     eax,            edi
+        add     esi,            edx
+        rol     ebx,            10
+        add     esi,            eax
+        mov     eax,            edi
+        rol     esi,            5
+        add     esi,            ecx
         ; 5
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 24[esp]
-        xor     esi,            ebx
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     ecx,            10
-        add     eax,            edi
-        xor     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR 20[esp]
+        xor     eax,            esi
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     edi,            10
+        add     ecx,            edx
+        xor     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 6
-        mov     edi,            DWORD PTR 28[esp]
-        xor     esi,            eax
-        add     ebp,            edi
-        rol     ebx,            10
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebp,            7
+        mov     edx,            DWORD PTR 24[esp]
+        xor     eax,            ecx
         add     ebp,            edx
+        rol     esi,            10
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     ebp,            7
+        add     ebp,            ebx
         ; 7
-        xor     esi,            ebx
-        mov     edi,            DWORD PTR 32[esp]
-        xor     esi,            ebp
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     eax,            10
-        add     edx,            edi
-        xor     esi,            eax
-        rol     edx,            9
-        add     edx,            ecx
+        xor     eax,            esi
+        mov     edx,            DWORD PTR 28[esp]
+        xor     eax,            ebp
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ecx,            10
+        add     ebx,            edx
+        xor     eax,            ecx
+        rol     ebx,            9
+        add     ebx,            edi
         ; 8
-        mov     edi,            DWORD PTR 36[esp]
-        xor     esi,            edx
-        add     ecx,            edi
+        mov     edx,            DWORD PTR 32[esp]
+        xor     eax,            ebx
+        add     edi,            edx
         rol     ebp,            10
-        add     ecx,            esi
-        mov     esi,            edx
-        rol     ecx,            11
-        add     ecx,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
+        rol     edi,            11
+        add     edi,            esi
         ; 9
-        xor     esi,            ebp
-        mov     edi,            DWORD PTR 40[esp]
-        xor     esi,            ecx
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     edx,            10
-        add     ebx,            edi
-        xor     esi,            edx
-        rol     ebx,            13
-        add     ebx,            eax
+        xor     eax,            ebp
+        mov     edx,            DWORD PTR 36[esp]
+        xor     eax,            edi
+        add     esi,            eax
+        mov     eax,            edi
+        rol     ebx,            10
+        add     esi,            edx
+        xor     eax,            ebx
+        rol     esi,            13
+        add     esi,            ecx
         ; 10
-        mov     edi,            DWORD PTR 44[esp]
-        xor     esi,            ebx
-        add     eax,            edi
-        rol     ecx,            10
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     eax,            14
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 40[esp]
+        xor     eax,            esi
+        add     ecx,            edx
+        rol     edi,            10
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 11
-        xor     esi,            ecx
-        mov     edi,            DWORD PTR 48[esp]
-        xor     esi,            eax
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebx,            10
-        add     ebp,            edi
-        xor     esi,            ebx
-        rol     ebp,            15
+        xor     eax,            edi
+        mov     edx,            DWORD PTR 44[esp]
+        xor     eax,            ecx
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     esi,            10
         add     ebp,            edx
+        xor     eax,            esi
+        rol     ebp,            15
+        add     ebp,            ebx
         ; 12
-        mov     edi,            DWORD PTR 52[esp]
-        xor     esi,            ebp
-        add     edx,            edi
-        rol     eax,            10
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     edx,            6
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 48[esp]
+        xor     eax,            ebp
+        add     ebx,            edx
+        rol     ecx,            10
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ebx,            6
+        add     ebx,            edi
         ; 13
-        xor     esi,            eax
-        mov     edi,            DWORD PTR 56[esp]
-        xor     esi,            edx
-        add     ecx,            esi
-        mov     esi,            edx
+        xor     eax,            ecx
+        mov     edx,            DWORD PTR 52[esp]
+        xor     eax,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
         rol     ebp,            10
-        add     ecx,            edi
-        xor     esi,            ebp
-        rol     ecx,            7
-        add     ecx,            ebx
+        add     edi,            edx
+        xor     eax,            ebp
+        rol     edi,            7
+        add     edi,            esi
         ; 14
-        mov     edi,            DWORD PTR 60[esp]
-        xor     esi,            ecx
-        add     ebx,            edi
-        rol     edx,            10
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     ebx,            9
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 56[esp]
+        xor     eax,            edi
+        add     esi,            edx
+        rol     ebx,            10
+        add     esi,            eax
+        mov     eax,            edi
+        rol     esi,            9
+        add     esi,            ecx
         ; 15
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 64[esp]
-        xor     esi,            ebx
-        add     eax,            esi
-        mov     esi,            -1
-        rol     ecx,            10
-        add     eax,            edi
-        mov     edi,            DWORD PTR 32[esp]
-        rol     eax,            8
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR 60[esp]
+        xor     eax,            esi
+        add     ecx,            eax
+        mov     eax,            -1
+        rol     edi,            10
+        add     ecx,            edx
+        mov     edx,            DWORD PTR 28[esp]
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 16
-        add     ebp,            edi
-        mov     edi,            ebx
-        sub     esi,            eax
-        and     edi,            eax
-        and     esi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 20[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            -1
-        rol     ebp,            7
         add     ebp,            edx
+        mov     edx,            esi
+        sub     eax,            ecx
+        and     edx,            ecx
+        and     eax,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 16[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
+        mov     edx,            -1
+        rol     ebp,            7
+        add     ebp,            ebx
         ; 17
-        add     edx,            esi
-        mov     esi,            eax
-        sub     edi,            ebp
-        and     esi,            ebp
-        and     edi,            ebx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 56[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1518500249[esi*1+edx]
-        mov     esi,            -1
-        rol     edx,            6
-        add     edx,            ecx
+        add     ebx,            eax
+        mov     eax,            ecx
+        sub     edx,            ebp
+        and     eax,            ebp
+        and     edx,            esi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 52[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1518500249[eax*1+ebx]
+        mov     eax,            -1
+        rol     ebx,            6
+        add     ebx,            edi
         ; 18
-        add     ecx,            edi
-        mov     edi,            ebp
-        sub     esi,            edx
-        and     edi,            edx
-        and     esi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 8[esp]
+        add     edi,            edx
+        mov     edx,            ebp
+        sub     eax,            ebx
+        and     edx,            ebx
+        and     eax,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 4[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1518500249[edi*1+ecx]
-        mov     edi,            -1
-        rol     ecx,            8
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1518500249[edx*1+edi]
+        mov     edx,            -1
+        rol     edi,            8
+        add     edi,            esi
         ; 19
-        add     ebx,            esi
-        mov     esi,            edx
-        sub     edi,            ecx
-        and     esi,            ecx
-        and     edi,            ebp
-        or      esi,            edi
-        mov     edi,            DWORD PTR 44[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1518500249[esi*1+ebx]
-        mov     esi,            -1
-        rol     ebx,            13
-        add     ebx,            eax
+        add     esi,            eax
+        mov     eax,            ebx
+        sub     edx,            edi
+        and     eax,            edi
+        and     edx,            ebp
+        or      eax,            edx
+        mov     edx,            DWORD PTR 40[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1518500249[eax*1+esi]
+        mov     eax,            -1
+        rol     esi,            13
+        add     esi,            ecx
         ; 20
-        add     eax,            edi
-        mov     edi,            ecx
-        sub     esi,            ebx
-        and     edi,            ebx
-        and     esi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 28[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1518500249[edi*1+eax]
-        mov     edi,            -1
-        rol     eax,            11
-        add     eax,            ebp
+        add     ecx,            edx
+        mov     edx,            edi
+        sub     eax,            esi
+        and     edx,            esi
+        and     eax,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 24[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1518500249[edx*1+ecx]
+        mov     edx,            -1
+        rol     ecx,            11
+        add     ecx,            ebp
         ; 21
-        add     ebp,            esi
-        mov     esi,            ebx
-        sub     edi,            eax
-        and     esi,            eax
-        and     edi,            ecx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 64[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1518500249[esi*1+ebp]
-        mov     esi,            -1
+        add     ebp,            eax
+        mov     eax,            esi
+        sub     edx,            ecx
+        and     eax,            ecx
+        and     edx,            edi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 60[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1518500249[eax*1+ebp]
+        mov     eax,            -1
         rol     ebp,            9
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 22
-        add     edx,            edi
-        mov     edi,            eax
-        sub     esi,            ebp
-        and     edi,            ebp
-        and     esi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 16[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1518500249[edi*1+edx]
-        mov     edi,            -1
-        rol     edx,            7
-        add     edx,            ecx
+        add     ebx,            edx
+        mov     edx,            ecx
+        sub     eax,            ebp
+        and     edx,            ebp
+        and     eax,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 12[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1518500249[edx*1+ebx]
+        mov     edx,            -1
+        rol     ebx,            7
+        add     ebx,            edi
         ; 23
-        add     ecx,            esi
-        mov     esi,            ebp
-        sub     edi,            edx
-        and     esi,            edx
-        and     edi,            eax
-        or      esi,            edi
-        mov     edi,            DWORD PTR 52[esp]
+        add     edi,            eax
+        mov     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            ebx
+        and     edx,            ecx
+        or      eax,            edx
+        mov     edx,            DWORD PTR 48[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1518500249[esi*1+ecx]
-        mov     esi,            -1
-        rol     ecx,            15
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1518500249[eax*1+edi]
+        mov     eax,            -1
+        rol     edi,            15
+        add     edi,            esi
         ; 24
-        add     ebx,            edi
-        mov     edi,            edx
-        sub     esi,            ecx
-        and     edi,            ecx
-        and     esi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 4[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1518500249[edi*1+ebx]
-        mov     edi,            -1
-        rol     ebx,            7
-        add     ebx,            eax
+        add     esi,            edx
+        mov     edx,            ebx
+        sub     eax,            edi
+        and     edx,            edi
+        and     eax,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR [esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1518500249[edx*1+esi]
+        mov     edx,            -1
+        rol     esi,            7
+        add     esi,            ecx
         ; 25
-        add     eax,            esi
-        mov     esi,            ecx
-        sub     edi,            ebx
-        and     esi,            ebx
-        and     edi,            edx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 40[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1518500249[esi*1+eax]
-        mov     esi,            -1
-        rol     eax,            12
-        add     eax,            ebp
+        add     ecx,            eax
+        mov     eax,            edi
+        sub     edx,            esi
+        and     eax,            esi
+        and     edx,            ebx
+        or      eax,            edx
+        mov     edx,            DWORD PTR 36[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1518500249[eax*1+ecx]
+        mov     eax,            -1
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 26
-        add     ebp,            edi
-        mov     edi,            ebx
-        sub     esi,            eax
-        and     edi,            eax
-        and     esi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 24[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            -1
-        rol     ebp,            15
         add     ebp,            edx
+        mov     edx,            esi
+        sub     eax,            ecx
+        and     edx,            ecx
+        and     eax,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 20[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
+        mov     edx,            -1
+        rol     ebp,            15
+        add     ebp,            ebx
         ; 27
-        add     edx,            esi
-        mov     esi,            eax
-        sub     edi,            ebp
-        and     esi,            ebp
-        and     edi,            ebx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 12[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1518500249[esi*1+edx]
-        mov     esi,            -1
-        rol     edx,            9
-        add     edx,            ecx
+        add     ebx,            eax
+        mov     eax,            ecx
+        sub     edx,            ebp
+        and     eax,            ebp
+        and     edx,            esi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 8[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1518500249[eax*1+ebx]
+        mov     eax,            -1
+        rol     ebx,            9
+        add     ebx,            edi
         ; 28
-        add     ecx,            edi
-        mov     edi,            ebp
-        sub     esi,            edx
-        and     edi,            edx
-        and     esi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 60[esp]
+        add     edi,            edx
+        mov     edx,            ebp
+        sub     eax,            ebx
+        and     edx,            ebx
+        and     eax,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 56[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1518500249[edi*1+ecx]
-        mov     edi,            -1
-        rol     ecx,            11
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1518500249[edx*1+edi]
+        mov     edx,            -1
+        rol     edi,            11
+        add     edi,            esi
         ; 29
-        add     ebx,            esi
-        mov     esi,            edx
-        sub     edi,            ecx
-        and     esi,            ecx
-        and     edi,            ebp
-        or      esi,            edi
-        mov     edi,            DWORD PTR 48[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1518500249[esi*1+ebx]
-        mov     esi,            -1
-        rol     ebx,            7
-        add     ebx,            eax
+        add     esi,            eax
+        mov     eax,            ebx
+        sub     edx,            edi
+        and     eax,            edi
+        and     edx,            ebp
+        or      eax,            edx
+        mov     edx,            DWORD PTR 44[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1518500249[eax*1+esi]
+        mov     eax,            -1
+        rol     esi,            7
+        add     esi,            ecx
         ; 30
-        add     eax,            edi
-        mov     edi,            ecx
-        sub     esi,            ebx
-        and     edi,            ebx
-        and     esi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 36[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1518500249[edi*1+eax]
-        mov     edi,            -1
-        rol     eax,            13
-        add     eax,            ebp
+        add     ecx,            edx
+        mov     edx,            edi
+        sub     eax,            esi
+        and     edx,            esi
+        and     eax,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 32[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1518500249[edx*1+ecx]
+        mov     edx,            -1
+        rol     ecx,            13
+        add     ecx,            ebp
         ; 31
-        add     ebp,            esi
-        mov     esi,            ebx
-        sub     edi,            eax
-        and     esi,            eax
-        and     edi,            ecx
-        or      esi,            edi
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1518500249[esi*1+ebp]
-        sub     edi,            eax
+        add     ebp,            eax
+        mov     eax,            esi
+        sub     edx,            ecx
+        and     eax,            ecx
+        and     edx,            edi
+        or      eax,            edx
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1518500249[eax*1+ebp]
+        sub     edx,            ecx
         rol     ebp,            12
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 32
-        mov     esi,            DWORD PTR 16[esp]
-        or      edi,            ebp
-        add     edx,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1859775393[edi*1+edx]
-        sub     esi,            ebp
-        rol     edx,            11
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 12[esp]
+        or      edx,            ebp
+        add     ebx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1859775393[edx*1+ebx]
+        sub     eax,            ebp
+        rol     ebx,            11
+        add     ebx,            edi
         ; 33
-        mov     edi,            DWORD PTR 44[esp]
-        or      esi,            edx
-        add     ecx,            edi
-        xor     esi,            eax
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 40[esp]
+        or      eax,            ebx
+        add     edi,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1859775393[esi*1+ecx]
-        sub     edi,            edx
-        rol     ecx,            13
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1859775393[eax*1+edi]
+        sub     edx,            ebx
+        rol     edi,            13
+        add     edi,            esi
         ; 34
-        mov     esi,            DWORD PTR 60[esp]
-        or      edi,            ecx
-        add     ebx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1859775393[edi*1+ebx]
-        sub     esi,            ecx
-        rol     ebx,            6
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 56[esp]
+        or      edx,            edi
+        add     esi,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1859775393[edx*1+esi]
+        sub     eax,            edi
+        rol     esi,            6
+        add     esi,            ecx
         ; 35
-        mov     edi,            DWORD PTR 20[esp]
-        or      esi,            ebx
-        add     eax,            edi
-        xor     esi,            edx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        sub     edi,            ebx
-        rol     eax,            7
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 16[esp]
+        or      eax,            esi
+        add     ecx,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        sub     edx,            esi
+        rol     ecx,            7
+        add     ecx,            ebp
         ; 36
-        mov     esi,            DWORD PTR 40[esp]
-        or      edi,            eax
-        add     ebp,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1859775393[edi*1+ebp]
-        sub     esi,            eax
+        mov     eax,            DWORD PTR 36[esp]
+        or      edx,            ecx
+        add     ebp,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1859775393[edx*1+ebp]
+        sub     eax,            ecx
         rol     ebp,            14
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 37
-        mov     edi,            DWORD PTR 64[esp]
-        or      esi,            ebp
-        add     edx,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1859775393[esi*1+edx]
-        sub     edi,            ebp
-        rol     edx,            9
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 60[esp]
+        or      eax,            ebp
+        add     ebx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
+        sub     edx,            ebp
+        rol     ebx,            9
+        add     ebx,            edi
         ; 38
-        mov     esi,            DWORD PTR 36[esp]
-        or      edi,            edx
-        add     ecx,            esi
-        xor     edi,            eax
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 32[esp]
+        or      edx,            ebx
+        add     edi,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1859775393[edi*1+ecx]
-        sub     esi,            edx
-        rol     ecx,            13
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1859775393[edx*1+edi]
+        sub     eax,            ebx
+        rol     edi,            13
+        add     edi,            esi
         ; 39
-        mov     edi,            DWORD PTR 8[esp]
-        or      esi,            ecx
-        add     ebx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1859775393[esi*1+ebx]
-        sub     edi,            ecx
-        rol     ebx,            15
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 4[esp]
+        or      eax,            edi
+        add     esi,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1859775393[eax*1+esi]
+        sub     edx,            edi
+        rol     esi,            15
+        add     esi,            ecx
         ; 40
-        mov     esi,            DWORD PTR 12[esp]
-        or      edi,            ebx
-        add     eax,            esi
-        xor     edi,            edx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1859775393[edi*1+eax]
-        sub     esi,            ebx
-        rol     eax,            14
-        add     eax,            ebp
+        mov     eax,            DWORD PTR 8[esp]
+        or      edx,            esi
+        add     ecx,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1859775393[edx*1+ecx]
+        sub     eax,            esi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 41
-        mov     edi,            DWORD PTR 32[esp]
-        or      esi,            eax
-        add     ebp,            edi
-        xor     esi,            ecx
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1859775393[esi*1+ebp]
-        sub     edi,            eax
-        rol     ebp,            8
+        mov     edx,            DWORD PTR 28[esp]
+        or      eax,            ecx
         add     ebp,            edx
+        xor     eax,            edi
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1859775393[eax*1+ebp]
+        sub     edx,            ecx
+        rol     ebp,            8
+        add     ebp,            ebx
         ; 42
-        mov     esi,            DWORD PTR 4[esp]
-        or      edi,            ebp
-        add     edx,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1859775393[edi*1+edx]
-        sub     esi,            ebp
-        rol     edx,            13
-        add     edx,            ecx
+        mov     eax,            DWORD PTR [esp]
+        or      edx,            ebp
+        add     ebx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1859775393[edx*1+ebx]
+        sub     eax,            ebp
+        rol     ebx,            13
+        add     ebx,            edi
         ; 43
-        mov     edi,            DWORD PTR 28[esp]
-        or      esi,            edx
-        add     ecx,            edi
-        xor     esi,            eax
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 24[esp]
+        or      eax,            ebx
+        add     edi,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1859775393[esi*1+ecx]
-        sub     edi,            edx
-        rol     ecx,            6
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1859775393[eax*1+edi]
+        sub     edx,            ebx
+        rol     edi,            6
+        add     edi,            esi
         ; 44
-        mov     esi,            DWORD PTR 56[esp]
-        or      edi,            ecx
-        add     ebx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1859775393[edi*1+ebx]
-        sub     esi,            ecx
-        rol     ebx,            5
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 52[esp]
+        or      edx,            edi
+        add     esi,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1859775393[edx*1+esi]
+        sub     eax,            edi
+        rol     esi,            5
+        add     esi,            ecx
         ; 45
-        mov     edi,            DWORD PTR 48[esp]
-        or      esi,            ebx
-        add     eax,            edi
-        xor     esi,            edx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        sub     edi,            ebx
-        rol     eax,            12
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 44[esp]
+        or      eax,            esi
+        add     ecx,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        sub     edx,            esi
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 46
-        mov     esi,            DWORD PTR 24[esp]
-        or      edi,            eax
-        add     ebp,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1859775393[edi*1+ebp]
-        sub     esi,            eax
+        mov     eax,            DWORD PTR 20[esp]
+        or      edx,            ecx
+        add     ebp,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1859775393[edx*1+ebp]
+        sub     eax,            ecx
         rol     ebp,            7
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 47
-        mov     edi,            DWORD PTR 52[esp]
-        or      esi,            ebp
-        add     edx,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1859775393[esi*1+edx]
-        mov     esi,            eax
-        rol     edx,            5
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 48[esp]
+        or      eax,            ebp
+        add     ebx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
+        mov     eax,            ecx
+        rol     ebx,            5
+        add     ebx,            edi
         ; 48
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 8[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 4[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2400959708[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            11
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2400959708[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            11
+        add     edi,            esi
         ; 49
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 40[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2400959708[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            12
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 36[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2400959708[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            12
+        add     esi,            ecx
         ; 50
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 48[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2400959708[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            14
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 44[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2400959708[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 51
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 44[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2400959708[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 40[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2400959708[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            15
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 52
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 4[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2400959708[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            14
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR [esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2400959708[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            14
+        add     ebx,            edi
         ; 53
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 36[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 32[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2400959708[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            15
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2400959708[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            15
+        add     edi,            esi
         ; 54
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 52[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2400959708[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            9
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 48[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2400959708[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            9
+        add     esi,            ecx
         ; 55
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 20[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2400959708[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 16[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2400959708[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 56
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 56[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2400959708[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 52[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2400959708[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            9
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 57
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 16[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2400959708[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            14
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 12[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2400959708[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            14
+        add     ebx,            edi
         ; 58
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 32[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 28[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2400959708[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            5
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2400959708[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            5
+        add     edi,            esi
         ; 59
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 64[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2400959708[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            6
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 60[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2400959708[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            6
+        add     esi,            ecx
         ; 60
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 60[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2400959708[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 56[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2400959708[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 61
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 24[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2400959708[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 20[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2400959708[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            6
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 62
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 28[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2400959708[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            5
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 24[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2400959708[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            5
+        add     ebx,            edi
         ; 63
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 12[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 8[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2400959708[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        sub     edi,            ebp
-        rol     ecx,            12
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2400959708[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        sub     edx,            ebp
+        rol     edi,            12
+        add     edi,            esi
         ; 64
-        mov     esi,            DWORD PTR 20[esp]
-        or      edi,            edx
-        add     ebx,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2840853838[edi*1+ebx]
-        sub     esi,            edx
-        rol     ebx,            9
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 16[esp]
+        or      edx,            ebx
+        add     esi,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2840853838[edx*1+esi]
+        sub     eax,            ebx
+        rol     esi,            9
+        add     esi,            ecx
         ; 65
-        mov     edi,            DWORD PTR 4[esp]
-        or      esi,            ecx
-        add     eax,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2840853838[esi*1+eax]
-        sub     edi,            ecx
-        rol     eax,            15
-        add     eax,            ebp
+        mov     edx,            DWORD PTR [esp]
+        or      eax,            edi
+        add     ecx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2840853838[eax*1+ecx]
+        sub     edx,            edi
+        rol     ecx,            15
+        add     ecx,            ebp
         ; 66
-        mov     esi,            DWORD PTR 24[esp]
-        or      edi,            ebx
-        add     ebp,            esi
-        xor     edi,            eax
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2840853838[edi*1+ebp]
-        sub     esi,            ebx
+        mov     eax,            DWORD PTR 20[esp]
+        or      edx,            esi
+        add     ebp,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2840853838[edx*1+ebp]
+        sub     eax,            esi
         rol     ebp,            5
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 67
-        mov     edi,            DWORD PTR 40[esp]
-        or      esi,            eax
-        add     edx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2840853838[esi*1+edx]
-        sub     edi,            eax
-        rol     edx,            11
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 36[esp]
+        or      eax,            ecx
+        add     ebx,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2840853838[eax*1+ebx]
+        sub     edx,            ecx
+        rol     ebx,            11
+        add     ebx,            edi
         ; 68
-        mov     esi,            DWORD PTR 32[esp]
-        or      edi,            ebp
-        add     ecx,            esi
-        xor     edi,            edx
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 28[esp]
+        or      edx,            ebp
+        add     edi,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2840853838[edi*1+ecx]
-        sub     esi,            ebp
-        rol     ecx,            6
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2840853838[edx*1+edi]
+        sub     eax,            ebp
+        rol     edi,            6
+        add     edi,            esi
         ; 69
-        mov     edi,            DWORD PTR 52[esp]
-        or      esi,            edx
-        add     ebx,            edi
-        xor     esi,            ecx
-        mov     edi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2840853838[esi*1+ebx]
-        sub     edi,            edx
-        rol     ebx,            8
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 48[esp]
+        or      eax,            ebx
+        add     esi,            edx
+        xor     eax,            edi
+        mov     edx,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2840853838[eax*1+esi]
+        sub     edx,            ebx
+        rol     esi,            8
+        add     esi,            ecx
         ; 70
-        mov     esi,            DWORD PTR 12[esp]
-        or      edi,            ecx
-        add     eax,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2840853838[edi*1+eax]
-        sub     esi,            ecx
-        rol     eax,            13
-        add     eax,            ebp
+        mov     eax,            DWORD PTR 8[esp]
+        or      edx,            edi
+        add     ecx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2840853838[edx*1+ecx]
+        sub     eax,            edi
+        rol     ecx,            13
+        add     ecx,            ebp
         ; 71
-        mov     edi,            DWORD PTR 44[esp]
-        or      esi,            ebx
-        add     ebp,            edi
-        xor     esi,            eax
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2840853838[esi*1+ebp]
-        sub     edi,            ebx
-        rol     ebp,            12
+        mov     edx,            DWORD PTR 40[esp]
+        or      eax,            esi
         add     ebp,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2840853838[eax*1+ebp]
+        sub     edx,            esi
+        rol     ebp,            12
+        add     ebp,            ebx
         ; 72
-        mov     esi,            DWORD PTR 60[esp]
-        or      edi,            eax
-        add     edx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2840853838[edi*1+edx]
-        sub     esi,            eax
-        rol     edx,            5
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 56[esp]
+        or      edx,            ecx
+        add     ebx,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2840853838[edx*1+ebx]
+        sub     eax,            ecx
+        rol     ebx,            5
+        add     ebx,            edi
         ; 73
-        mov     edi,            DWORD PTR 8[esp]
-        or      esi,            ebp
-        add     ecx,            edi
-        xor     esi,            edx
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 4[esp]
+        or      eax,            ebp
+        add     edi,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2840853838[esi*1+ecx]
-        sub     edi,            ebp
-        rol     ecx,            12
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2840853838[eax*1+edi]
+        sub     edx,            ebp
+        rol     edi,            12
+        add     edi,            esi
         ; 74
-        mov     esi,            DWORD PTR 16[esp]
-        or      edi,            edx
-        add     ebx,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2840853838[edi*1+ebx]
-        sub     esi,            edx
-        rol     ebx,            13
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 12[esp]
+        or      edx,            ebx
+        add     esi,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2840853838[edx*1+esi]
+        sub     eax,            ebx
+        rol     esi,            13
+        add     esi,            ecx
         ; 75
-        mov     edi,            DWORD PTR 36[esp]
-        or      esi,            ecx
-        add     eax,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2840853838[esi*1+eax]
-        sub     edi,            ecx
-        rol     eax,            14
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 32[esp]
+        or      eax,            edi
+        add     ecx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2840853838[eax*1+ecx]
+        sub     edx,            edi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 76
-        mov     esi,            DWORD PTR 48[esp]
-        or      edi,            ebx
-        add     ebp,            esi
-        xor     edi,            eax
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2840853838[edi*1+ebp]
-        sub     esi,            ebx
+        mov     eax,            DWORD PTR 44[esp]
+        or      edx,            esi
+        add     ebp,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2840853838[edx*1+ebp]
+        sub     eax,            esi
         rol     ebp,            11
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 77
-        mov     edi,            DWORD PTR 28[esp]
-        or      esi,            eax
-        add     edx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2840853838[esi*1+edx]
-        sub     edi,            eax
-        rol     edx,            8
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 24[esp]
+        or      eax,            ecx
+        add     ebx,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2840853838[eax*1+ebx]
+        sub     edx,            ecx
+        rol     ebx,            8
+        add     ebx,            edi
         ; 78
-        mov     esi,            DWORD PTR 64[esp]
-        or      edi,            ebp
-        add     ecx,            esi
-        xor     edi,            edx
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 60[esp]
+        or      edx,            ebp
+        add     edi,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2840853838[edi*1+ecx]
-        sub     esi,            ebp
-        rol     ecx,            5
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2840853838[edx*1+edi]
+        sub     eax,            ebp
+        rol     edi,            5
+        add     edi,            esi
         ; 79
-        mov     edi,            DWORD PTR 56[esp]
-        or      esi,            edx
-        add     ebx,            edi
-        xor     esi,            ecx
-        mov     edi,            DWORD PTR 108[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2840853838[esi*1+ebx]
-        mov     DWORD PTR 68[esp],eax
-        rol     ebx,            6
-        add     ebx,            eax
-        mov     eax,            DWORD PTR [edi]
-        mov     DWORD PTR 72[esp],ebx
-        mov     DWORD PTR 76[esp],ecx
-        mov     ebx,            DWORD PTR 4[edi]
-        mov     DWORD PTR 80[esp],edx
-        mov     ecx,            DWORD PTR 8[edi]
-        mov     DWORD PTR 84[esp],ebp
-        mov     edx,            DWORD PTR 12[edi]
-        mov     ebp,            DWORD PTR 16[edi]
+        mov     edx,            DWORD PTR 52[esp]
+        or      eax,            ebx
+        add     esi,            edx
+        xor     eax,            edi
+        mov     edx,            DWORD PTR 128[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2840853838[eax*1+esi]
+        mov     DWORD PTR 64[esp],ecx
+        rol     esi,            6
+        add     esi,            ecx
+        mov     ecx,            DWORD PTR [edx]
+        mov     DWORD PTR 68[esp],esi
+        mov     DWORD PTR 72[esp],edi
+        mov     esi,            DWORD PTR 4[edx]
+        mov     DWORD PTR 76[esp],ebx
+        mov     edi,            DWORD PTR 8[edx]
+        mov     DWORD PTR 80[esp],ebp
+        mov     ebx,            DWORD PTR 12[edx]
+        mov     ebp,            DWORD PTR 16[edx]
         ; 80
-        mov     edi,            -1
-        sub     edi,            edx
-        mov     esi,            DWORD PTR 24[esp]
-        or      edi,            ecx
-        add     eax,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1352829926[edi*1+eax]
-        sub     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        mov     edx,            -1
+        sub     edx,            ebx
+        mov     eax,            DWORD PTR 20[esp]
+        or      edx,            edi
+        add     ecx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1352829926[edx*1+ecx]
+        sub     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 81
-        mov     edi,            DWORD PTR 60[esp]
-        or      esi,            ebx
-        add     ebp,            edi
-        xor     esi,            eax
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1352829926[esi*1+ebp]
-        sub     edi,            ebx
-        rol     ebp,            9
+        mov     edx,            DWORD PTR 56[esp]
+        or      eax,            esi
         add     ebp,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1352829926[eax*1+ebp]
+        sub     edx,            esi
+        rol     ebp,            9
+        add     ebp,            ebx
         ; 82
-        mov     esi,            DWORD PTR 32[esp]
-        or      edi,            eax
-        add     edx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1352829926[edi*1+edx]
-        sub     esi,            eax
-        rol     edx,            9
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 28[esp]
+        or      edx,            ecx
+        add     ebx,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1352829926[edx*1+ebx]
+        sub     eax,            ecx
+        rol     ebx,            9
+        add     ebx,            edi
         ; 83
-        mov     edi,            DWORD PTR 4[esp]
-        or      esi,            ebp
-        add     ecx,            edi
-        xor     esi,            edx
-        mov     edi,            -1
+        mov     edx,            DWORD PTR [esp]
+        or      eax,            ebp
+        add     edi,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1352829926[esi*1+ecx]
-        sub     edi,            ebp
-        rol     ecx,            11
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1352829926[eax*1+edi]
+        sub     edx,            ebp
+        rol     edi,            11
+        add     edi,            esi
         ; 84
-        mov     esi,            DWORD PTR 40[esp]
-        or      edi,            edx
-        add     ebx,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1352829926[edi*1+ebx]
-        sub     esi,            edx
-        rol     ebx,            13
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 36[esp]
+        or      edx,            ebx
+        add     esi,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1352829926[edx*1+esi]
+        sub     eax,            ebx
+        rol     esi,            13
+        add     esi,            ecx
         ; 85
-        mov     edi,            DWORD PTR 12[esp]
-        or      esi,            ecx
-        add     eax,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1352829926[esi*1+eax]
-        sub     edi,            ecx
-        rol     eax,            15
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 8[esp]
+        or      eax,            edi
+        add     ecx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1352829926[eax*1+ecx]
+        sub     edx,            edi
+        rol     ecx,            15
+        add     ecx,            ebp
         ; 86
-        mov     esi,            DWORD PTR 48[esp]
-        or      edi,            ebx
-        add     ebp,            esi
-        xor     edi,            eax
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1352829926[edi*1+ebp]
-        sub     esi,            ebx
+        mov     eax,            DWORD PTR 44[esp]
+        or      edx,            esi
+        add     ebp,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1352829926[edx*1+ebp]
+        sub     eax,            esi
         rol     ebp,            15
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 87
-        mov     edi,            DWORD PTR 20[esp]
-        or      esi,            eax
-        add     edx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1352829926[esi*1+edx]
-        sub     edi,            eax
-        rol     edx,            5
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 16[esp]
+        or      eax,            ecx
+        add     ebx,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1352829926[eax*1+ebx]
+        sub     edx,            ecx
+        rol     ebx,            5
+        add     ebx,            edi
         ; 88
-        mov     esi,            DWORD PTR 56[esp]
-        or      edi,            ebp
-        add     ecx,            esi
-        xor     edi,            edx
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 52[esp]
+        or      edx,            ebp
+        add     edi,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1352829926[edi*1+ecx]
-        sub     esi,            ebp
-        rol     ecx,            7
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1352829926[edx*1+edi]
+        sub     eax,            ebp
+        rol     edi,            7
+        add     edi,            esi
         ; 89
-        mov     edi,            DWORD PTR 28[esp]
-        or      esi,            edx
-        add     ebx,            edi
-        xor     esi,            ecx
-        mov     edi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1352829926[esi*1+ebx]
-        sub     edi,            edx
-        rol     ebx,            7
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 24[esp]
+        or      eax,            ebx
+        add     esi,            edx
+        xor     eax,            edi
+        mov     edx,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1352829926[eax*1+esi]
+        sub     edx,            ebx
+        rol     esi,            7
+        add     esi,            ecx
         ; 90
-        mov     esi,            DWORD PTR 64[esp]
-        or      edi,            ecx
-        add     eax,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1352829926[edi*1+eax]
-        sub     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        mov     eax,            DWORD PTR 60[esp]
+        or      edx,            edi
+        add     ecx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1352829926[edx*1+ecx]
+        sub     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 91
-        mov     edi,            DWORD PTR 36[esp]
-        or      esi,            ebx
-        add     ebp,            edi
-        xor     esi,            eax
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1352829926[esi*1+ebp]
-        sub     edi,            ebx
-        rol     ebp,            11
+        mov     edx,            DWORD PTR 32[esp]
+        or      eax,            esi
         add     ebp,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1352829926[eax*1+ebp]
+        sub     edx,            esi
+        rol     ebp,            11
+        add     ebp,            ebx
         ; 92
-        mov     esi,            DWORD PTR 8[esp]
-        or      edi,            eax
-        add     edx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1352829926[edi*1+edx]
-        sub     esi,            eax
-        rol     edx,            14
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 4[esp]
+        or      edx,            ecx
+        add     ebx,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1352829926[edx*1+ebx]
+        sub     eax,            ecx
+        rol     ebx,            14
+        add     ebx,            edi
         ; 93
-        mov     edi,            DWORD PTR 44[esp]
-        or      esi,            ebp
-        add     ecx,            edi
-        xor     esi,            edx
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 40[esp]
+        or      eax,            ebp
+        add     edi,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1352829926[esi*1+ecx]
-        sub     edi,            ebp
-        rol     ecx,            14
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1352829926[eax*1+edi]
+        sub     edx,            ebp
+        rol     edi,            14
+        add     edi,            esi
         ; 94
-        mov     esi,            DWORD PTR 16[esp]
-        or      edi,            edx
-        add     ebx,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1352829926[edi*1+ebx]
-        sub     esi,            edx
-        rol     ebx,            12
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 12[esp]
+        or      edx,            ebx
+        add     esi,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1352829926[edx*1+esi]
+        sub     eax,            ebx
+        rol     esi,            12
+        add     esi,            ecx
         ; 95
-        mov     edi,            DWORD PTR 52[esp]
-        or      esi,            ecx
-        add     eax,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1352829926[esi*1+eax]
-        mov     esi,            ecx
-        rol     eax,            6
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 48[esp]
+        or      eax,            edi
+        add     ecx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1352829926[eax*1+ecx]
+        mov     eax,            edi
+        rol     ecx,            6
+        add     ecx,            ebp
         ; 96
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 28[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1548603684[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 24[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1548603684[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            9
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 97
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 48[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1548603684[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            13
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 44[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1548603684[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            13
+        add     ebx,            edi
         ; 98
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 16[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 12[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1548603684[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            15
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1548603684[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            15
+        add     edi,            esi
         ; 99
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 32[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1548603684[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            7
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 28[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1548603684[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            7
+        add     esi,            ecx
         ; 100
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 4[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1548603684[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            12
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR [esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1548603684[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 101
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 56[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1548603684[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 52[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1548603684[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            8
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 102
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 24[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1548603684[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            9
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 20[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1548603684[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            9
+        add     ebx,            edi
         ; 103
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 44[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 40[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1548603684[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            11
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1548603684[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            11
+        add     edi,            esi
         ; 104
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 60[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1548603684[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            7
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 56[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1548603684[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            7
+        add     esi,            ecx
         ; 105
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 64[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1548603684[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            7
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 60[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1548603684[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            7
+        add     ecx,            ebp
         ; 106
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 36[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1548603684[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 32[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1548603684[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            12
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 107
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 52[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1548603684[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            7
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 48[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1548603684[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            7
+        add     ebx,            edi
         ; 108
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 20[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 16[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1548603684[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            6
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1548603684[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            6
+        add     edi,            esi
         ; 109
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 40[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1548603684[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            15
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 36[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1548603684[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            15
+        add     esi,            ecx
         ; 110
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 8[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1548603684[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            13
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 4[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1548603684[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            13
+        add     ecx,            ebp
         ; 111
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 12[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1548603684[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        sub     edi,            eax
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 8[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1548603684[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        sub     edx,            ecx
         rol     ebp,            11
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 112
-        mov     esi,            DWORD PTR 64[esp]
-        or      edi,            ebp
-        add     edx,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1836072691[edi*1+edx]
-        sub     esi,            ebp
-        rol     edx,            9
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 60[esp]
+        or      edx,            ebp
+        add     ebx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1836072691[edx*1+ebx]
+        sub     eax,            ebp
+        rol     ebx,            9
+        add     ebx,            edi
         ; 113
-        mov     edi,            DWORD PTR 24[esp]
-        or      esi,            edx
-        add     ecx,            edi
-        xor     esi,            eax
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 20[esp]
+        or      eax,            ebx
+        add     edi,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1836072691[esi*1+ecx]
-        sub     edi,            edx
-        rol     ecx,            7
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1836072691[eax*1+edi]
+        sub     edx,            ebx
+        rol     edi,            7
+        add     edi,            esi
         ; 114
-        mov     esi,            DWORD PTR 8[esp]
-        or      edi,            ecx
-        add     ebx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1836072691[edi*1+ebx]
-        sub     esi,            ecx
-        rol     ebx,            15
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 4[esp]
+        or      edx,            edi
+        add     esi,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1836072691[edx*1+esi]
+        sub     eax,            edi
+        rol     esi,            15
+        add     esi,            ecx
         ; 115
-        mov     edi,            DWORD PTR 16[esp]
-        or      esi,            ebx
-        add     eax,            edi
-        xor     esi,            edx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1836072691[esi*1+eax]
-        sub     edi,            ebx
-        rol     eax,            11
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 12[esp]
+        or      eax,            esi
+        add     ecx,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1836072691[eax*1+ecx]
+        sub     edx,            esi
+        rol     ecx,            11
+        add     ecx,            ebp
         ; 116
-        mov     esi,            DWORD PTR 32[esp]
-        or      edi,            eax
-        add     ebp,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1836072691[edi*1+ebp]
-        sub     esi,            eax
+        mov     eax,            DWORD PTR 28[esp]
+        or      edx,            ecx
+        add     ebp,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1836072691[edx*1+ebp]
+        sub     eax,            ecx
         rol     ebp,            8
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 117
-        mov     edi,            DWORD PTR 60[esp]
-        or      esi,            ebp
-        add     edx,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1836072691[esi*1+edx]
-        sub     edi,            ebp
-        rol     edx,            6
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 56[esp]
+        or      eax,            ebp
+        add     ebx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1836072691[eax*1+ebx]
+        sub     edx,            ebp
+        rol     ebx,            6
+        add     ebx,            edi
         ; 118
-        mov     esi,            DWORD PTR 28[esp]
-        or      edi,            edx
-        add     ecx,            esi
-        xor     edi,            eax
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 24[esp]
+        or      edx,            ebx
+        add     edi,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1836072691[edi*1+ecx]
-        sub     esi,            edx
-        rol     ecx,            6
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1836072691[edx*1+edi]
+        sub     eax,            ebx
+        rol     edi,            6
+        add     edi,            esi
         ; 119
-        mov     edi,            DWORD PTR 40[esp]
-        or      esi,            ecx
-        add     ebx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1836072691[esi*1+ebx]
-        sub     edi,            ecx
-        rol     ebx,            14
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 36[esp]
+        or      eax,            edi
+        add     esi,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1836072691[eax*1+esi]
+        sub     edx,            edi
+        rol     esi,            14
+        add     esi,            ecx
         ; 120
-        mov     esi,            DWORD PTR 48[esp]
-        or      edi,            ebx
-        add     eax,            esi
-        xor     edi,            edx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1836072691[edi*1+eax]
-        sub     esi,            ebx
-        rol     eax,            12
-        add     eax,            ebp
+        mov     eax,            DWORD PTR 44[esp]
+        or      edx,            esi
+        add     ecx,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1836072691[edx*1+ecx]
+        sub     eax,            esi
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 121
-        mov     edi,            DWORD PTR 36[esp]
-        or      esi,            eax
-        add     ebp,            edi
-        xor     esi,            ecx
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1836072691[esi*1+ebp]
-        sub     edi,            eax
-        rol     ebp,            13
+        mov     edx,            DWORD PTR 32[esp]
+        or      eax,            ecx
         add     ebp,            edx
+        xor     eax,            edi
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1836072691[eax*1+ebp]
+        sub     edx,            ecx
+        rol     ebp,            13
+        add     ebp,            ebx
         ; 122
-        mov     esi,            DWORD PTR 52[esp]
-        or      edi,            ebp
-        add     edx,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1836072691[edi*1+edx]
-        sub     esi,            ebp
-        rol     edx,            5
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 48[esp]
+        or      edx,            ebp
+        add     ebx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1836072691[edx*1+ebx]
+        sub     eax,            ebp
+        rol     ebx,            5
+        add     ebx,            edi
         ; 123
-        mov     edi,            DWORD PTR 12[esp]
-        or      esi,            edx
-        add     ecx,            edi
-        xor     esi,            eax
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 8[esp]
+        or      eax,            ebx
+        add     edi,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1836072691[esi*1+ecx]
-        sub     edi,            edx
-        rol     ecx,            14
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1836072691[eax*1+edi]
+        sub     edx,            ebx
+        rol     edi,            14
+        add     edi,            esi
         ; 124
-        mov     esi,            DWORD PTR 44[esp]
-        or      edi,            ecx
-        add     ebx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1836072691[edi*1+ebx]
-        sub     esi,            ecx
-        rol     ebx,            13
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 40[esp]
+        or      edx,            edi
+        add     esi,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1836072691[edx*1+esi]
+        sub     eax,            edi
+        rol     esi,            13
+        add     esi,            ecx
         ; 125
-        mov     edi,            DWORD PTR 4[esp]
-        or      esi,            ebx
-        add     eax,            edi
-        xor     esi,            edx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1836072691[esi*1+eax]
-        sub     edi,            ebx
-        rol     eax,            13
-        add     eax,            ebp
+        mov     edx,            DWORD PTR [esp]
+        or      eax,            esi
+        add     ecx,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1836072691[eax*1+ecx]
+        sub     edx,            esi
+        rol     ecx,            13
+        add     ecx,            ebp
         ; 126
-        mov     esi,            DWORD PTR 20[esp]
-        or      edi,            eax
-        add     ebp,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1836072691[edi*1+ebp]
-        sub     esi,            eax
+        mov     eax,            DWORD PTR 16[esp]
+        or      edx,            ecx
+        add     ebp,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1836072691[edx*1+ebp]
+        sub     eax,            ecx
         rol     ebp,            7
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 127
-        mov     edi,            DWORD PTR 56[esp]
-        or      esi,            ebp
-        add     edx,            edi
-        xor     esi,            ebx
-        mov     edi,            DWORD PTR 36[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1836072691[esi*1+edx]
-        mov     esi,            -1
-        rol     edx,            5
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 52[esp]
+        or      eax,            ebp
+        add     ebx,            edx
+        xor     eax,            esi
+        mov     edx,            DWORD PTR 32[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1836072691[eax*1+ebx]
+        mov     eax,            -1
+        rol     ebx,            5
+        add     ebx,            edi
         ; 128
-        add     ecx,            edi
-        mov     edi,            ebp
-        sub     esi,            edx
-        and     edi,            edx
-        and     esi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 28[esp]
+        add     edi,            edx
+        mov     edx,            ebp
+        sub     eax,            ebx
+        and     edx,            ebx
+        and     eax,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 24[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2053994217[edi*1+ecx]
-        mov     edi,            -1
-        rol     ecx,            15
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2053994217[edx*1+edi]
+        mov     edx,            -1
+        rol     edi,            15
+        add     edi,            esi
         ; 129
-        add     ebx,            esi
-        mov     esi,            edx
-        sub     edi,            ecx
-        and     esi,            ecx
-        and     edi,            ebp
-        or      esi,            edi
-        mov     edi,            DWORD PTR 20[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2053994217[esi*1+ebx]
-        mov     esi,            -1
-        rol     ebx,            5
-        add     ebx,            eax
+        add     esi,            eax
+        mov     eax,            ebx
+        sub     edx,            edi
+        and     eax,            edi
+        and     edx,            ebp
+        or      eax,            edx
+        mov     edx,            DWORD PTR 16[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2053994217[eax*1+esi]
+        mov     eax,            -1
+        rol     esi,            5
+        add     esi,            ecx
         ; 130
-        add     eax,            edi
-        mov     edi,            ecx
-        sub     esi,            ebx
-        and     edi,            ebx
-        and     esi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 8[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2053994217[edi*1+eax]
-        mov     edi,            -1
-        rol     eax,            8
-        add     eax,            ebp
+        add     ecx,            edx
+        mov     edx,            edi
+        sub     eax,            esi
+        and     edx,            esi
+        and     eax,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 4[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2053994217[edx*1+ecx]
+        mov     edx,            -1
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 131
-        add     ebp,            esi
-        mov     esi,            ebx
-        sub     edi,            eax
-        and     esi,            eax
-        and     edi,            ecx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 16[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2053994217[esi*1+ebp]
-        mov     esi,            -1
+        add     ebp,            eax
+        mov     eax,            esi
+        sub     edx,            ecx
+        and     eax,            ecx
+        and     edx,            edi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 12[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2053994217[eax*1+ebp]
+        mov     eax,            -1
         rol     ebp,            11
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 132
-        add     edx,            edi
-        mov     edi,            eax
-        sub     esi,            ebp
-        and     edi,            ebp
-        and     esi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 48[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2053994217[edi*1+edx]
-        mov     edi,            -1
-        rol     edx,            14
-        add     edx,            ecx
+        add     ebx,            edx
+        mov     edx,            ecx
+        sub     eax,            ebp
+        and     edx,            ebp
+        and     eax,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 44[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2053994217[edx*1+ebx]
+        mov     edx,            -1
+        rol     ebx,            14
+        add     ebx,            edi
         ; 133
-        add     ecx,            esi
-        mov     esi,            ebp
-        sub     edi,            edx
-        and     esi,            edx
-        and     edi,            eax
-        or      esi,            edi
-        mov     edi,            DWORD PTR 64[esp]
+        add     edi,            eax
+        mov     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            ebx
+        and     edx,            ecx
+        or      eax,            edx
+        mov     edx,            DWORD PTR 60[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2053994217[esi*1+ecx]
-        mov     esi,            -1
-        rol     ecx,            14
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2053994217[eax*1+edi]
+        mov     eax,            -1
+        rol     edi,            14
+        add     edi,            esi
         ; 134
-        add     ebx,            edi
-        mov     edi,            edx
-        sub     esi,            ecx
-        and     edi,            ecx
-        and     esi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 4[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2053994217[edi*1+ebx]
-        mov     edi,            -1
-        rol     ebx,            6
-        add     ebx,            eax
+        add     esi,            edx
+        mov     edx,            ebx
+        sub     eax,            edi
+        and     edx,            edi
+        and     eax,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR [esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2053994217[edx*1+esi]
+        mov     edx,            -1
+        rol     esi,            6
+        add     esi,            ecx
         ; 135
-        add     eax,            esi
-        mov     esi,            ecx
-        sub     edi,            ebx
-        and     esi,            ebx
-        and     edi,            edx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 24[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2053994217[esi*1+eax]
-        mov     esi,            -1
-        rol     eax,            14
-        add     eax,            ebp
+        add     ecx,            eax
+        mov     eax,            edi
+        sub     edx,            esi
+        and     eax,            esi
+        and     edx,            ebx
+        or      eax,            edx
+        mov     edx,            DWORD PTR 20[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2053994217[eax*1+ecx]
+        mov     eax,            -1
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 136
-        add     ebp,            edi
-        mov     edi,            ebx
-        sub     esi,            eax
-        and     edi,            eax
-        and     esi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 52[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2053994217[edi*1+ebp]
-        mov     edi,            -1
-        rol     ebp,            6
         add     ebp,            edx
+        mov     edx,            esi
+        sub     eax,            ecx
+        and     edx,            ecx
+        and     eax,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 48[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2053994217[edx*1+ebp]
+        mov     edx,            -1
+        rol     ebp,            6
+        add     ebp,            ebx
         ; 137
-        add     edx,            esi
-        mov     esi,            eax
-        sub     edi,            ebp
-        and     esi,            ebp
-        and     edi,            ebx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 12[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2053994217[esi*1+edx]
-        mov     esi,            -1
-        rol     edx,            9
-        add     edx,            ecx
+        add     ebx,            eax
+        mov     eax,            ecx
+        sub     edx,            ebp
+        and     eax,            ebp
+        and     edx,            esi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 8[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2053994217[eax*1+ebx]
+        mov     eax,            -1
+        rol     ebx,            9
+        add     ebx,            edi
         ; 138
-        add     ecx,            edi
-        mov     edi,            ebp
-        sub     esi,            edx
-        and     edi,            edx
-        and     esi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 56[esp]
+        add     edi,            edx
+        mov     edx,            ebp
+        sub     eax,            ebx
+        and     edx,            ebx
+        and     eax,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 52[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2053994217[edi*1+ecx]
-        mov     edi,            -1
-        rol     ecx,            12
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2053994217[edx*1+edi]
+        mov     edx,            -1
+        rol     edi,            12
+        add     edi,            esi
         ; 139
-        add     ebx,            esi
-        mov     esi,            edx
-        sub     edi,            ecx
-        and     esi,            ecx
-        and     edi,            ebp
-        or      esi,            edi
-        mov     edi,            DWORD PTR 40[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2053994217[esi*1+ebx]
-        mov     esi,            -1
-        rol     ebx,            9
-        add     ebx,            eax
+        add     esi,            eax
+        mov     eax,            ebx
+        sub     edx,            edi
+        and     eax,            edi
+        and     edx,            ebp
+        or      eax,            edx
+        mov     edx,            DWORD PTR 36[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2053994217[eax*1+esi]
+        mov     eax,            -1
+        rol     esi,            9
+        add     esi,            ecx
         ; 140
-        add     eax,            edi
-        mov     edi,            ecx
-        sub     esi,            ebx
-        and     edi,            ebx
-        and     esi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 32[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2053994217[edi*1+eax]
-        mov     edi,            -1
-        rol     eax,            12
-        add     eax,            ebp
+        add     ecx,            edx
+        mov     edx,            edi
+        sub     eax,            esi
+        and     edx,            esi
+        and     eax,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 28[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2053994217[edx*1+ecx]
+        mov     edx,            -1
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 141
-        add     ebp,            esi
-        mov     esi,            ebx
-        sub     edi,            eax
-        and     esi,            eax
-        and     edi,            ecx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 44[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2053994217[esi*1+ebp]
-        mov     esi,            -1
+        add     ebp,            eax
+        mov     eax,            esi
+        sub     edx,            ecx
+        and     eax,            ecx
+        and     edx,            edi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 40[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2053994217[eax*1+ebp]
+        mov     eax,            -1
         rol     ebp,            5
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 142
-        add     edx,            edi
-        mov     edi,            eax
-        sub     esi,            ebp
-        and     edi,            ebp
-        and     esi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 60[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2053994217[edi*1+edx]
-        mov     edi,            -1
-        rol     edx,            15
-        add     edx,            ecx
+        add     ebx,            edx
+        mov     edx,            ecx
+        sub     eax,            ebp
+        and     edx,            ebp
+        and     eax,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 56[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2053994217[edx*1+ebx]
+        mov     edx,            -1
+        rol     ebx,            15
+        add     ebx,            edi
         ; 143
-        add     ecx,            esi
-        mov     esi,            ebp
-        sub     edi,            edx
-        and     esi,            edx
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            edx
+        add     edi,            eax
+        mov     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            ebx
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            ebx
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2053994217[edi*1+ecx]
-        xor     esi,            ebp
-        rol     ecx,            8
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2053994217[edx*1+edi]
+        xor     eax,            ebp
+        rol     edi,            8
+        add     edi,            esi
         ; 144
-        mov     edi,            DWORD PTR 52[esp]
-        xor     esi,            ecx
-        add     ebx,            edi
-        rol     edx,            10
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     ebx,            8
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 48[esp]
+        xor     eax,            edi
+        add     esi,            edx
+        rol     ebx,            10
+        add     esi,            eax
+        mov     eax,            edi
+        rol     esi,            8
+        add     esi,            ecx
         ; 145
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 64[esp]
-        xor     esi,            ebx
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     ecx,            10
-        add     eax,            edi
-        xor     esi,            ecx
-        rol     eax,            5
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR 60[esp]
+        xor     eax,            esi
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     edi,            10
+        add     ecx,            edx
+        xor     eax,            edi
+        rol     ecx,            5
+        add     ecx,            ebp
         ; 146
-        mov     edi,            DWORD PTR 44[esp]
-        xor     esi,            eax
-        add     ebp,            edi
-        rol     ebx,            10
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebp,            12
+        mov     edx,            DWORD PTR 40[esp]
+        xor     eax,            ecx
         add     ebp,            edx
+        rol     esi,            10
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     ebp,            12
+        add     ebp,            ebx
         ; 147
-        xor     esi,            ebx
-        mov     edi,            DWORD PTR 20[esp]
-        xor     esi,            ebp
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     eax,            10
-        add     edx,            edi
-        xor     esi,            eax
-        rol     edx,            9
-        add     edx,            ecx
+        xor     eax,            esi
+        mov     edx,            DWORD PTR 16[esp]
+        xor     eax,            ebp
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ecx,            10
+        add     ebx,            edx
+        xor     eax,            ecx
+        rol     ebx,            9
+        add     ebx,            edi
         ; 148
-        mov     edi,            DWORD PTR 8[esp]
-        xor     esi,            edx
-        add     ecx,            edi
+        mov     edx,            DWORD PTR 4[esp]
+        xor     eax,            ebx
+        add     edi,            edx
         rol     ebp,            10
-        add     ecx,            esi
-        mov     esi,            edx
-        rol     ecx,            12
-        add     ecx,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
+        rol     edi,            12
+        add     edi,            esi
         ; 149
-        xor     esi,            ebp
-        mov     edi,            DWORD PTR 24[esp]
-        xor     esi,            ecx
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     edx,            10
-        add     ebx,            edi
-        xor     esi,            edx
-        rol     ebx,            5
-        add     ebx,            eax
+        xor     eax,            ebp
+        mov     edx,            DWORD PTR 20[esp]
+        xor     eax,            edi
+        add     esi,            eax
+        mov     eax,            edi
+        rol     ebx,            10
+        add     esi,            edx
+        xor     eax,            ebx
+        rol     esi,            5
+        add     esi,            ecx
         ; 150
-        mov     edi,            DWORD PTR 36[esp]
-        xor     esi,            ebx
-        add     eax,            edi
-        rol     ecx,            10
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     eax,            14
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 32[esp]
+        xor     eax,            esi
+        add     ecx,            edx
+        rol     edi,            10
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 151
-        xor     esi,            ecx
-        mov     edi,            DWORD PTR 32[esp]
-        xor     esi,            eax
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebx,            10
-        add     ebp,            edi
-        xor     esi,            ebx
-        rol     ebp,            6
+        xor     eax,            edi
+        mov     edx,            DWORD PTR 28[esp]
+        xor     eax,            ecx
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     esi,            10
         add     ebp,            edx
+        xor     eax,            esi
+        rol     ebp,            6
+        add     ebp,            ebx
         ; 152
-        mov     edi,            DWORD PTR 28[esp]
-        xor     esi,            ebp
-        add     edx,            edi
-        rol     eax,            10
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     edx,            8
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 24[esp]
+        xor     eax,            ebp
+        add     ebx,            edx
+        rol     ecx,            10
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ebx,            8
+        add     ebx,            edi
         ; 153
-        xor     esi,            eax
-        mov     edi,            DWORD PTR 12[esp]
-        xor     esi,            edx
-        add     ecx,            esi
-        mov     esi,            edx
+        xor     eax,            ecx
+        mov     edx,            DWORD PTR 8[esp]
+        xor     eax,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
         rol     ebp,            10
-        add     ecx,            edi
-        xor     esi,            ebp
-        rol     ecx,            13
-        add     ecx,            ebx
+        add     edi,            edx
+        xor     eax,            ebp
+        rol     edi,            13
+        add     edi,            esi
         ; 154
-        mov     edi,            DWORD PTR 56[esp]
-        xor     esi,            ecx
-        add     ebx,            edi
-        rol     edx,            10
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     ebx,            6
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 52[esp]
+        xor     eax,            edi
+        add     esi,            edx
+        rol     ebx,            10
+        add     esi,            eax
+        mov     eax,            edi
+        rol     esi,            6
+        add     esi,            ecx
         ; 155
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 60[esp]
-        xor     esi,            ebx
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     ecx,            10
-        add     eax,            edi
-        xor     esi,            ecx
-        rol     eax,            5
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR 56[esp]
+        xor     eax,            esi
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     edi,            10
+        add     ecx,            edx
+        xor     eax,            edi
+        rol     ecx,            5
+        add     ecx,            ebp
         ; 156
-        mov     edi,            DWORD PTR 4[esp]
-        xor     esi,            eax
-        add     ebp,            edi
-        rol     ebx,            10
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebp,            15
+        mov     edx,            DWORD PTR [esp]
+        xor     eax,            ecx
         add     ebp,            edx
+        rol     esi,            10
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     ebp,            15
+        add     ebp,            ebx
         ; 157
-        xor     esi,            ebx
-        mov     edi,            DWORD PTR 16[esp]
-        xor     esi,            ebp
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     eax,            10
-        add     edx,            edi
-        xor     esi,            eax
-        rol     edx,            13
-        add     edx,            ecx
+        xor     eax,            esi
+        mov     edx,            DWORD PTR 12[esp]
+        xor     eax,            ebp
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ecx,            10
+        add     ebx,            edx
+        xor     eax,            ecx
+        rol     ebx,            13
+        add     ebx,            edi
         ; 158
-        mov     edi,            DWORD PTR 40[esp]
-        xor     esi,            edx
-        add     ecx,            edi
+        mov     edx,            DWORD PTR 36[esp]
+        xor     eax,            ebx
+        add     edi,            edx
         rol     ebp,            10
-        add     ecx,            esi
-        mov     esi,            edx
-        rol     ecx,            11
-        add     ecx,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
+        rol     edi,            11
+        add     edi,            esi
         ; 159
-        xor     esi,            ebp
-        mov     edi,            DWORD PTR 48[esp]
-        xor     esi,            ecx
-        add     ebx,            esi
-        rol     edx,            10
-        add     ebx,            edi
-        mov     edi,            DWORD PTR 108[esp]
-        rol     ebx,            11
+        xor     eax,            ebp
+        mov     edx,            DWORD PTR 44[esp]
+        xor     eax,            edi
+        add     esi,            eax
+        rol     ebx,            10
+        add     esi,            edx
+        mov     edx,            DWORD PTR 128[esp]
+        rol     esi,            11
+        add     esi,            ecx
+        mov     eax,            DWORD PTR 4[edx]
         add     ebx,            eax
-        mov     esi,            DWORD PTR 4[edi]
-        add     edx,            esi
-        mov     esi,            DWORD PTR 76[esp]
-        add     edx,            esi
-        mov     esi,            DWORD PTR 8[edi]
-        add     ebp,            esi
-        mov     esi,            DWORD PTR 80[esp]
-        add     ebp,            esi
-        mov     esi,            DWORD PTR 12[edi]
-        add     eax,            esi
-        mov     esi,            DWORD PTR 84[esp]
-        add     eax,            esi
-        mov     esi,            DWORD PTR 16[edi]
-        add     ebx,            esi
-        mov     esi,            DWORD PTR 68[esp]
-        add     ebx,            esi
-        mov     esi,            DWORD PTR [edi]
-        add     ecx,            esi
-        mov     esi,            DWORD PTR 72[esp]
-        add     ecx,            esi
-        mov     DWORD PTR [edi],edx
-        mov     DWORD PTR 4[edi],ebp
-        mov     DWORD PTR 8[edi],eax
-        mov     DWORD PTR 12[edi],ebx
-        mov     DWORD PTR 16[edi],ecx
-        mov     edi,            DWORD PTR [esp]
-        mov     esi,            DWORD PTR 112[esp]
-        cmp     edi,            esi
-        mov     edi,            DWORD PTR 108[esp]
-        jge     L000start
-        add     esp,            88
+        mov     eax,            DWORD PTR 72[esp]
+        add     ebx,            eax
+        mov     eax,            DWORD PTR 8[edx]
+        add     ebp,            eax
+        mov     eax,            DWORD PTR 76[esp]
+        add     ebp,            eax
+        mov     eax,            DWORD PTR 12[edx]
+        add     ecx,            eax
+        mov     eax,            DWORD PTR 80[esp]
+        add     ecx,            eax
+        mov     eax,            DWORD PTR 16[edx]
+        add     esi,            eax
+        mov     eax,            DWORD PTR 64[esp]
+        add     esi,            eax
+        mov     eax,            DWORD PTR [edx]
+        add     edi,            eax
+        mov     eax,            DWORD PTR 68[esp]
+        add     edi,            eax
+        mov     eax,            DWORD PTR 136[esp]
+        mov     DWORD PTR [edx],ebx
+        mov     DWORD PTR 4[edx],ebp
+        mov     DWORD PTR 8[edx],ecx
+        sub     eax,            1
+        mov     DWORD PTR 12[edx],esi
+        mov     DWORD PTR 16[edx],edi
+        jle     $L001get_out
+        mov     DWORD PTR 136[esp],eax
+        mov     edi,            ecx
+        mov     eax,            DWORD PTR 132[esp]
+        mov     ecx,            ebx
+        add     eax,            64
+        mov     esi,            ebp
+        mov     DWORD PTR 132[esp],eax
+        jmp     L000start
+$L001get_out:
+        add     esp,            108
         pop     ebx
         pop     ebp
         pop     edi
         pop     esi
         ret
-_ripemd160_block_x86 ENDP
+_ripemd160_block_asm_host_order ENDP
 _TEXT   ENDS
 END
diff --git a/src/lib/libcrypto/ripemd/asm/rmd-586.pl b/src/lib/libcrypto/ripemd/asm/rmd-586.pl
index e53c5fadba..0ab6f76bff 100644
--- a/src/lib/libcrypto/ripemd/asm/rmd-586.pl
+++ b/src/lib/libcrypto/ripemd/asm/rmd-586.pl
@@ -1,9 +1,7 @@
 #!/usr/local/bin/perl
 
 # Normal is the
-# ripemd160_block_x86(MD5_CTX *c, ULONG *X);
-# version, non-normal is the
-# ripemd160_block_x86(MD5_CTX *c, ULONG *X,int blocks);
+# ripemd160_block_asm_host_order(RIPEMD160_CTX *c, ULONG *X,int blocks);
 
 $normal=0;
 
@@ -12,13 +10,13 @@ require "x86asm.pl";
 
 &asm_init($ARGV[0],$0);
 
-$A="eax";
-$B="ebx";
-$C="ecx";
-$D="edx";
+$A="ecx";
+$B="esi";
+$C="edi";
+$D="ebx";
 $E="ebp";
-$tmp1="esi";
-$tmp2="edi";
+$tmp1="eax";
+$tmp2="edx";
 
 $KL1=0x5A827999;
 $KL2=0x6ED9EBA1;
@@ -58,13 +56,13 @@ $KR3=0x7A6D76E9;
          8, 5,12, 9,12, 5,14, 6, 8,13, 6, 5,15,13,11,11,
         );
 
-&ripemd160_block("ripemd160_block_x86");
+&ripemd160_block("ripemd160_block_asm_host_order");
 &asm_finish();
 
 sub Xv
         {
         local($n)=@_;
-        return(&swtmp($n+1));
+        return(&swtmp($n));
         # tmp on stack
         }
 
@@ -82,7 +80,7 @@ sub RIP1
         &comment($p++);
         if ($p & 1)
                 {
-         &mov($tmp1,    $c) if $o == -1;
+         #&mov($tmp1,   $c) if $o == -1;
         &xor($tmp1,     $d) if $o == -1;
          &mov($tmp2,    &Xv($pos));
         &xor($tmp1,     $b);
@@ -290,7 +288,7 @@ sub RIP5
         &rotl($c,       10);
         &lea($a,        &DWP($K,$a,$tmp1,1));
          &sub($tmp2,    &Np($d)) if $o <= 0;
-         &mov(&swtmp(1+16),     $A) if $o == 1;
+         &mov(&swtmp(16),       $A) if $o == 1;
          &mov($tmp1,    &Np($d)) if $o == 2;
         &rotl($a,       $s);
         &add($a,        $e);
@@ -310,19 +308,25 @@ sub ripemd160_block
         # D     12
         # E     16
 
+        &mov($tmp2,     &wparam(0));
+         &mov($tmp1,    &wparam(1));
         &push("esi");
-         &mov($C,       &wparam(2));
+         &mov($A,       &DWP( 0,$tmp2,"",0));
         &push("edi");
-         &mov($tmp1,    &wparam(1)); # edi
+         &mov($B,       &DWP( 4,$tmp2,"",0));
         &push("ebp");
-         &add($C,       $tmp1); # offset we end at
+         &mov($C,       &DWP( 8,$tmp2,"",0));
         &push("ebx");
-         &sub($C,       64);
-        &stack_push(16+5+1);
-         # XXX
-
-        &mov(&swtmp(0), $C);
-         &mov($tmp2,    &wparam(0)); # Done at end of loop
+         &stack_push(16+5+6);
+                          # Special comment about the figure of 6.
+                          # Idea is to pad the current frame so
+                          # that the top of the stack gets fairly
+                          # aligned. Well, as you realize it would
+                          # always depend on how the frame below is
+                          # aligned. The good news are that gcc-2.95
+                          # and later does keep first argument at
+                          # least double-wise aligned.
+                          #                     <appro@fy.chalmers.se>
 
         &set_label("start") unless $normal;
         &comment("");
@@ -332,16 +336,12 @@ sub ripemd160_block
 
         for ($z=0; $z<16; $z+=2)
                 {
-                &mov($A,                &DWP( $z*4,$tmp1,"",0));
-                 &mov($B,               &DWP( ($z+1)*4,$tmp1,"",0));
-                &mov(&swtmp(1+$z),      $A);
-                 &mov(&swtmp(1+$z+1),   $B);
+                &mov($D,                &DWP( $z*4,$tmp1,"",0));
+                 &mov($E,               &DWP( ($z+1)*4,$tmp1,"",0));
+                &mov(&swtmp($z),        $D);
+                 &mov(&swtmp($z+1),     $E);
                 }
-        &add($tmp1,     64);
-         &mov($A,       &DWP( 0,$tmp2,"",0));
-        &mov(&wparam(1),$tmp1);
-         &mov($B,       &DWP( 4,$tmp2,"",0));
-        &mov($C,        &DWP( 8,$tmp2,"",0));
+        &mov($tmp1,     $C);
          &mov($D,       &DWP(12,$tmp2,"",0));
         &mov($E,        &DWP(16,$tmp2,"",0));
 
@@ -431,14 +431,14 @@ sub ripemd160_block
         &RIP5($B,$C,$D,$E,$A,$wl[79],$sl[79],$KL4,1);
 
         # &mov($tmp2,   &wparam(0)); # moved into last RIP5
-        # &mov(&swtmp(1+16),    $A);
+        # &mov(&swtmp(16),      $A);
          &mov($A,       &DWP( 0,$tmp2,"",0));
-        &mov(&swtmp(1+17),      $B);
-         &mov(&swtmp(1+18),     $C);
+        &mov(&swtmp(16+1),      $B);
+         &mov(&swtmp(16+2),     $C);
         &mov($B,        &DWP( 4,$tmp2,"",0));
-         &mov(&swtmp(1+19),     $D);
+         &mov(&swtmp(16+3),     $D);
         &mov($C,        &DWP( 8,$tmp2,"",0));
-         &mov(&swtmp(1+20),     $E);
+         &mov(&swtmp(16+4),     $E);
         &mov($D,        &DWP(12,$tmp2,"",0));
          &mov($E,       &DWP(16,$tmp2,"",0));
 
@@ -531,46 +531,54 @@ sub ripemd160_block
 
          &mov($tmp1,    &DWP( 4,$tmp2,"",0));   # ctx->B
         &add($D,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+18));          # $c
+         &mov($tmp1,    &swtmp(16+2));          # $c
         &add($D,        $tmp1);
 
          &mov($tmp1,    &DWP( 8,$tmp2,"",0));   # ctx->C
         &add($E,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+19));          # $d
+         &mov($tmp1,    &swtmp(16+3));          # $d
         &add($E,        $tmp1);
 
          &mov($tmp1,    &DWP(12,$tmp2,"",0));   # ctx->D
         &add($A,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+20));          # $e
+         &mov($tmp1,    &swtmp(16+4));          # $e
         &add($A,        $tmp1);
 
 
          &mov($tmp1,    &DWP(16,$tmp2,"",0));   # ctx->E
         &add($B,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+16));          # $a
+         &mov($tmp1,    &swtmp(16+0));          # $a
         &add($B,        $tmp1);
 
          &mov($tmp1,    &DWP( 0,$tmp2,"",0));   # ctx->A
         &add($C,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+17));          # $b
+         &mov($tmp1,    &swtmp(16+1));          # $b
         &add($C,        $tmp1);
 
+         &mov($tmp1,    &wparam(2));
+
         &mov(&DWP( 0,$tmp2,"",0),       $D);
          &mov(&DWP( 4,$tmp2,"",0),      $E);
         &mov(&DWP( 8,$tmp2,"",0),       $A);
-         &mov(&DWP(12,$tmp2,"",0),      $B);
-        &mov(&DWP(16,$tmp2,"",0),       $C);
+         &sub($tmp1,1);
+        &mov(&DWP(12,$tmp2,"",0),       $B);
+         &mov(&DWP(16,$tmp2,"",0),      $C);
 
-        &mov($tmp2,             &swtmp(0));
-         &mov($tmp1,            &wparam(1));
+        &jle(&label("get_out"));
+
+        &mov(&wparam(2),$tmp1);
+         &mov($C,       $A);
+        &mov($tmp1,     &wparam(1));
+         &mov($A,       $D);
+        &add($tmp1,     64);
+         &mov($B,       $E);
+        &mov(&wparam(1),$tmp1);
 
-        &cmp($tmp2,$tmp1);
-         &mov($tmp2,    &wparam(0));
+        &jmp(&label("start"));
 
-        # XXX
-         &jge(&label("start"));
+        &set_label("get_out");
 
-        &stack_pop(16+5+1);
+        &stack_pop(16+5+6);
 
         &pop("ebx");
         &pop("ebp");
diff --git a/src/lib/libcrypto/ripemd/ripemd.h b/src/lib/libcrypto/ripemd/ripemd.h
index ab76be4c33..dd1627cf40 100644
--- a/src/lib/libcrypto/ripemd/ripemd.h
+++ b/src/lib/libcrypto/ripemd/ripemd.h
@@ -67,26 +67,33 @@ extern "C" {
 #error RIPEMD is disabled.
 #endif
 
+#if defined(WIN16) || defined(__LP32__)
+#define RIPEMD160_LONG unsigned long
+#elif defined(_CRAY) || defined(__ILP64__)
+#define RIPEMD160_LONG unsigned long
+#define RIPEMD160_LONG_LOG2 3
+#else
+#define RIPEMD160_LONG unsigned int
+#endif
+
 #define RIPEMD160_CBLOCK        64
-#define RIPEMD160_LBLOCK        16
-#define RIPEMD160_BLOCK         16
-#define RIPEMD160_LAST_BLOCK    56
-#define RIPEMD160_LENGTH_BLOCK  8
+#define RIPEMD160_LBLOCK        (RIPEMD160_CBLOCK/4)
 #define RIPEMD160_DIGEST_LENGTH 20
 
 typedef struct RIPEMD160state_st
         {
-        unsigned long A,B,C,D,E;
-        unsigned long Nl,Nh;
-        unsigned long data[RIPEMD160_LBLOCK];
+        RIPEMD160_LONG A,B,C,D,E;
+        RIPEMD160_LONG Nl,Nh;
+        RIPEMD160_LONG data[RIPEMD160_LBLOCK];
         int num;
         } RIPEMD160_CTX;
 
 void RIPEMD160_Init(RIPEMD160_CTX *c);
-void RIPEMD160_Update(RIPEMD160_CTX *c, unsigned char *data, unsigned long len);
+void RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, unsigned long len);
 void RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
-unsigned char *RIPEMD160(unsigned char *d, unsigned long n, unsigned char *md);
-void RIPEMD160_Transform(RIPEMD160_CTX *c, unsigned char *b);
+unsigned char *RIPEMD160(const unsigned char *d, unsigned long n,
+        unsigned char *md);
+void RIPEMD160_Transform(RIPEMD160_CTX *c, const unsigned char *b);
 #ifdef  __cplusplus
 }
 #endif
diff --git a/src/lib/libcrypto/ripemd/rmd_dgst.c b/src/lib/libcrypto/ripemd/rmd_dgst.c
index b590856229..bdfae270b6 100644
--- a/src/lib/libcrypto/ripemd/rmd_dgst.c
+++ b/src/lib/libcrypto/ripemd/rmd_dgst.c
@@ -60,7 +60,7 @@
 #include "rmd_locl.h"
 #include <openssl/opensslv.h>
 
-char *RMD160_version="RIPE-MD160" OPENSSL_VERSION_PTEXT;
+const char *RMD160_version="RIPE-MD160" OPENSSL_VERSION_PTEXT;
 
 #  ifdef RMD160_ASM
      void ripemd160_block_x86(RIPEMD160_CTX *c, unsigned long *p,int num);
@@ -68,6 +68,7 @@ char *RMD160_version="RIPE-MD160" OPENSSL_VERSION_PTEXT;
 #  else
      void ripemd160_block(RIPEMD160_CTX *c, unsigned long *p,int num);
 #  endif
+
 void RIPEMD160_Init(RIPEMD160_CTX *c)
         {
         c->A=RIPEMD160_A;
@@ -80,180 +81,21 @@ void RIPEMD160_Init(RIPEMD160_CTX *c)
         c->num=0;
         }
 
-void RIPEMD160_Update(RIPEMD160_CTX *c, register unsigned char *data,
-             unsigned long len)
-        {
-        register ULONG *p;
-        int sw,sc;
-        ULONG l;
-
-        if (len == 0) return;
-
-        l=(c->Nl+(len<<3))&0xffffffffL;
-        if (l < c->Nl) /* overflow */
-                c->Nh++;
-        c->Nh+=(len>>29);
-        c->Nl=l;
-
-        if (c->num != 0)
-                {
-                p=c->data;
-                sw=c->num>>2;
-                sc=c->num&0x03;
-
-                if ((c->num+len) >= RIPEMD160_CBLOCK)
-                        {
-                        l= p[sw];
-                        p_c2l(data,l,sc);
-                        p[sw++]=l;
-                        for (; sw<RIPEMD160_LBLOCK; sw++)
-                                {
-                                c2l(data,l);
-                                p[sw]=l;
-                                }
-                        len-=(RIPEMD160_CBLOCK-c->num);
-
-                        ripemd160_block(c,p,64);
-                        c->num=0;
-                        /* drop through and do the rest */
-                        }
-                else
-                        {
-                        int ew,ec;
-
-                        c->num+=(int)len;
-                        if ((sc+len) < 4) /* ugly, add char's to a word */
-                                {
-                                l= p[sw];
-                                p_c2l_p(data,l,sc,len);
-                                p[sw]=l;
-                                }
-                        else
-                                {
-                                ew=(c->num>>2);
-                                ec=(c->num&0x03);
-                                l= p[sw];
-                                p_c2l(data,l,sc);
-                                p[sw++]=l;
-                                for (; sw < ew; sw++)
-                                        { c2l(data,l); p[sw]=l; }
-                                if (ec)
-                                        {
-                                        c2l_p(data,l,ec);
-                                        p[sw]=l;
-                                        }
-                                }
-                        return;
-                        }
-                }
-        /* we now can process the input data in blocks of RIPEMD160_CBLOCK
-         * chars and save the leftovers to c->data. */
-#ifdef L_ENDIAN
-        if ((((unsigned long)data)%sizeof(ULONG)) == 0)
-                {
-                sw=(int)len/RIPEMD160_CBLOCK;
-                if (sw > 0)
-                        {
-                        sw*=RIPEMD160_CBLOCK;
-                        ripemd160_block(c,(ULONG *)data,sw);
-                        data+=sw;
-                        len-=sw;
-                        }
-                }
-#endif
-        p=c->data;
-        while (len >= RIPEMD160_CBLOCK)
-                {
-#if defined(L_ENDIAN) || defined(B_ENDIAN)
-                if (p != (unsigned long *)data)
-                        memcpy(p,data,RIPEMD160_CBLOCK);
-                data+=RIPEMD160_CBLOCK;
-#ifdef B_ENDIAN
-                for (sw=(RIPEMD160_LBLOCK/4); sw; sw--)
-                        {
-                        Endian_Reverse32(p[0]);
-                        Endian_Reverse32(p[1]);
-                        Endian_Reverse32(p[2]);
-                        Endian_Reverse32(p[3]);
-                        p+=4;
-                        }
-#endif
-#else
-                for (sw=(RIPEMD160_LBLOCK/4); sw; sw--)
-                        {
-                        c2l(data,l); *(p++)=l;
-                        c2l(data,l); *(p++)=l;
-                        c2l(data,l); *(p++)=l;
-                        c2l(data,l); *(p++)=l; 
-                        } 
+#ifndef ripemd160_block_host_order
+#ifdef X
+#undef X
 #endif
-                p=c->data;
-                ripemd160_block(c,p,64);
-                len-=RIPEMD160_CBLOCK;
-                }
-        sc=(int)len;
-        c->num=sc;
-        if (sc)
-                {
-                sw=sc>>2;       /* words to copy */
-#ifdef L_ENDIAN
-                p[sw]=0;
-                memcpy(p,data,sc);
-#else
-                sc&=0x03;
-                for ( ; sw; sw--)
-                        { c2l(data,l); *(p++)=l; }
-                c2l_p(data,l,sc);
-                *p=l;
-#endif
-                }
-        }
-
-void RIPEMD160_Transform(RIPEMD160_CTX *c, unsigned char *b)
+#define X(i)    XX[i]
+void ripemd160_block_host_order (RIPEMD160_CTX *ctx, const void *p, int num)
         {
-        ULONG p[16];
-#if !defined(L_ENDIAN)
-        ULONG *q;
-        int i;
-#endif
+        const RIPEMD160_LONG *XX=p;
+        register unsigned long A,B,C,D,E;
+        register unsigned long a,b,c,d,e;
 
-#if defined(B_ENDIAN) || defined(L_ENDIAN)
-        memcpy(p,b,64);
-#ifdef B_ENDIAN
-        q=p;
-        for (i=(RIPEMD160_LBLOCK/4); i; i--)
-                {
-                Endian_Reverse32(q[0]);
-                Endian_Reverse32(q[1]);
-                Endian_Reverse32(q[2]);
-                Endian_Reverse32(q[3]);
-                q+=4;
-                }
-#endif
-#else
-        q=p;
-        for (i=(RIPEMD160_LBLOCK/4); i; i--)
+        for (;num--;XX+=HASH_LBLOCK)
                 {
-                ULONG l;
-                c2l(b,l); *(q++)=l;
-                c2l(b,l); *(q++)=l;
-                c2l(b,l); *(q++)=l;
-                c2l(b,l); *(q++)=l; 
-                } 
-#endif
-        ripemd160_block(c,p,64);
-        }
-
-#ifndef RMD160_ASM
-
-void ripemd160_block(RIPEMD160_CTX *ctx, register ULONG *X, int num)
-        {
-        register ULONG A,B,C,D,E;
-        ULONG a,b,c,d,e;
 
-        for (;;)
-                {
-                A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
+        A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
 
         RIP1(A,B,C,D,E,WL00,SL00);
         RIP1(E,A,B,C,D,WL01,SL01);
@@ -436,80 +278,216 @@ void ripemd160_block(RIPEMD160_CTX *ctx, register ULONG *X, int num)
         ctx->E=ctx->A+b+C;
         ctx->A=D;
 
-        X+=16;
-        num-=64;
-        if (num <= 0) break;
                 }
         }
 #endif
 
-void RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c)
+#ifndef ripemd160_block_data_order
+#ifdef X
+#undef X
+#endif
+void ripemd160_block_data_order (RIPEMD160_CTX *ctx, const void *p, int num)
         {
-        register int i,j;
-        register ULONG l;
-        register ULONG *p;
-        static unsigned char end[4]={0x80,0x00,0x00,0x00};
-        unsigned char *cp=end;
-
-        /* c->num should definitly have room for at least one more byte. */
-        p=c->data;
-        j=c->num;
-        i=j>>2;
-
-        /* purify often complains about the following line as an
-         * Uninitialized Memory Read.  While this can be true, the
-         * following p_c2l macro will reset l when that case is true.
-         * This is because j&0x03 contains the number of 'valid' bytes
-         * already in p[i].  If and only if j&0x03 == 0, the UMR will
-         * occur but this is also the only time p_c2l will do
-         * l= *(cp++) instead of l|= *(cp++)
-         * Many thanks to Alex Tang <altitude@cic.net> for pickup this
-         * 'potential bug' */
-#ifdef PURIFY
-        if ((j&0x03) == 0) p[i]=0;
+        const unsigned char *data=p;
+        register unsigned long A,B,C,D,E;
+        unsigned long a,b,c,d,e,l;
+#ifndef MD32_XARRAY
+        /* See comment in crypto/sha/sha_locl.h for details. */
+        unsigned long   XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
+                        XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
+# define X(i)   XX##i
+#else
+        RIPEMD160_LONG  XX[16];
+# define X(i)   XX[i]
 #endif
-        l=p[i];
-        p_c2l(cp,l,j&0x03);
-        p[i]=l;
-        i++;
-        /* i is the next 'undefined word' */
-        if (c->num >= RIPEMD160_LAST_BLOCK)
+
+        for (;num--;)
                 {
-                for (; i<RIPEMD160_LBLOCK; i++)
-                        p[i]=0;
-                ripemd160_block(c,p,64);
-                i=0;
-                }
-        for (; i<(RIPEMD160_LBLOCK-2); i++)
-                p[i]=0;
-        p[RIPEMD160_LBLOCK-2]=c->Nl;
-        p[RIPEMD160_LBLOCK-1]=c->Nh;
-        ripemd160_block(c,p,64);
-        cp=md;
-        l=c->A; l2c(l,cp);
-        l=c->B; l2c(l,cp);
-        l=c->C; l2c(l,cp);
-        l=c->D; l2c(l,cp);
-        l=c->E; l2c(l,cp);
-
-        /* clear stuff, ripemd160_block may be leaving some stuff on the stack
-         * but I'm not worried :-) */
-        c->num=0;
-/*      memset((char *)&c,0,sizeof(c));*/
-        }
 
-#ifdef undef
-int printit(unsigned long *l)
-        {
-        int i,ii;
+        A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
+
+        HOST_c2l(data,l); X( 0)=l;      HOST_c2l(data,l); X( 1)=l;
+        RIP1(A,B,C,D,E,WL00,SL00);      HOST_c2l(data,l); X( 2)=l;
+        RIP1(E,A,B,C,D,WL01,SL01);      HOST_c2l(data,l); X( 3)=l;
+        RIP1(D,E,A,B,C,WL02,SL02);      HOST_c2l(data,l); X( 4)=l;
+        RIP1(C,D,E,A,B,WL03,SL03);      HOST_c2l(data,l); X( 5)=l;
+        RIP1(B,C,D,E,A,WL04,SL04);      HOST_c2l(data,l); X( 6)=l;
+        RIP1(A,B,C,D,E,WL05,SL05);      HOST_c2l(data,l); X( 7)=l;
+        RIP1(E,A,B,C,D,WL06,SL06);      HOST_c2l(data,l); X( 8)=l;
+        RIP1(D,E,A,B,C,WL07,SL07);      HOST_c2l(data,l); X( 9)=l;
+        RIP1(C,D,E,A,B,WL08,SL08);      HOST_c2l(data,l); X(10)=l;
+        RIP1(B,C,D,E,A,WL09,SL09);      HOST_c2l(data,l); X(11)=l;
+        RIP1(A,B,C,D,E,WL10,SL10);      HOST_c2l(data,l); X(12)=l;
+        RIP1(E,A,B,C,D,WL11,SL11);      HOST_c2l(data,l); X(13)=l;
+        RIP1(D,E,A,B,C,WL12,SL12);      HOST_c2l(data,l); X(14)=l;
+        RIP1(C,D,E,A,B,WL13,SL13);      HOST_c2l(data,l); X(15)=l;
+        RIP1(B,C,D,E,A,WL14,SL14);
+        RIP1(A,B,C,D,E,WL15,SL15);
+
+        RIP2(E,A,B,C,D,WL16,SL16,KL1);
+        RIP2(D,E,A,B,C,WL17,SL17,KL1);
+        RIP2(C,D,E,A,B,WL18,SL18,KL1);
+        RIP2(B,C,D,E,A,WL19,SL19,KL1);
+        RIP2(A,B,C,D,E,WL20,SL20,KL1);
+        RIP2(E,A,B,C,D,WL21,SL21,KL1);
+        RIP2(D,E,A,B,C,WL22,SL22,KL1);
+        RIP2(C,D,E,A,B,WL23,SL23,KL1);
+        RIP2(B,C,D,E,A,WL24,SL24,KL1);
+        RIP2(A,B,C,D,E,WL25,SL25,KL1);
+        RIP2(E,A,B,C,D,WL26,SL26,KL1);
+        RIP2(D,E,A,B,C,WL27,SL27,KL1);
+        RIP2(C,D,E,A,B,WL28,SL28,KL1);
+        RIP2(B,C,D,E,A,WL29,SL29,KL1);
+        RIP2(A,B,C,D,E,WL30,SL30,KL1);
+        RIP2(E,A,B,C,D,WL31,SL31,KL1);
+
+        RIP3(D,E,A,B,C,WL32,SL32,KL2);
+        RIP3(C,D,E,A,B,WL33,SL33,KL2);
+        RIP3(B,C,D,E,A,WL34,SL34,KL2);
+        RIP3(A,B,C,D,E,WL35,SL35,KL2);
+        RIP3(E,A,B,C,D,WL36,SL36,KL2);
+        RIP3(D,E,A,B,C,WL37,SL37,KL2);
+        RIP3(C,D,E,A,B,WL38,SL38,KL2);
+        RIP3(B,C,D,E,A,WL39,SL39,KL2);
+        RIP3(A,B,C,D,E,WL40,SL40,KL2);
+        RIP3(E,A,B,C,D,WL41,SL41,KL2);
+        RIP3(D,E,A,B,C,WL42,SL42,KL2);
+        RIP3(C,D,E,A,B,WL43,SL43,KL2);
+        RIP3(B,C,D,E,A,WL44,SL44,KL2);
+        RIP3(A,B,C,D,E,WL45,SL45,KL2);
+        RIP3(E,A,B,C,D,WL46,SL46,KL2);
+        RIP3(D,E,A,B,C,WL47,SL47,KL2);
+
+        RIP4(C,D,E,A,B,WL48,SL48,KL3);
+        RIP4(B,C,D,E,A,WL49,SL49,KL3);
+        RIP4(A,B,C,D,E,WL50,SL50,KL3);
+        RIP4(E,A,B,C,D,WL51,SL51,KL3);
+        RIP4(D,E,A,B,C,WL52,SL52,KL3);
+        RIP4(C,D,E,A,B,WL53,SL53,KL3);
+        RIP4(B,C,D,E,A,WL54,SL54,KL3);
+        RIP4(A,B,C,D,E,WL55,SL55,KL3);
+        RIP4(E,A,B,C,D,WL56,SL56,KL3);
+        RIP4(D,E,A,B,C,WL57,SL57,KL3);
+        RIP4(C,D,E,A,B,WL58,SL58,KL3);
+        RIP4(B,C,D,E,A,WL59,SL59,KL3);
+        RIP4(A,B,C,D,E,WL60,SL60,KL3);
+        RIP4(E,A,B,C,D,WL61,SL61,KL3);
+        RIP4(D,E,A,B,C,WL62,SL62,KL3);
+        RIP4(C,D,E,A,B,WL63,SL63,KL3);
+
+        RIP5(B,C,D,E,A,WL64,SL64,KL4);
+        RIP5(A,B,C,D,E,WL65,SL65,KL4);
+        RIP5(E,A,B,C,D,WL66,SL66,KL4);
+        RIP5(D,E,A,B,C,WL67,SL67,KL4);
+        RIP5(C,D,E,A,B,WL68,SL68,KL4);
+        RIP5(B,C,D,E,A,WL69,SL69,KL4);
+        RIP5(A,B,C,D,E,WL70,SL70,KL4);
+        RIP5(E,A,B,C,D,WL71,SL71,KL4);
+        RIP5(D,E,A,B,C,WL72,SL72,KL4);
+        RIP5(C,D,E,A,B,WL73,SL73,KL4);
+        RIP5(B,C,D,E,A,WL74,SL74,KL4);
+        RIP5(A,B,C,D,E,WL75,SL75,KL4);
+        RIP5(E,A,B,C,D,WL76,SL76,KL4);
+        RIP5(D,E,A,B,C,WL77,SL77,KL4);
+        RIP5(C,D,E,A,B,WL78,SL78,KL4);
+        RIP5(B,C,D,E,A,WL79,SL79,KL4);
+
+        a=A; b=B; c=C; d=D; e=E;
+        /* Do other half */
+        A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
+
+        RIP5(A,B,C,D,E,WR00,SR00,KR0);
+        RIP5(E,A,B,C,D,WR01,SR01,KR0);
+        RIP5(D,E,A,B,C,WR02,SR02,KR0);
+        RIP5(C,D,E,A,B,WR03,SR03,KR0);
+        RIP5(B,C,D,E,A,WR04,SR04,KR0);
+        RIP5(A,B,C,D,E,WR05,SR05,KR0);
+        RIP5(E,A,B,C,D,WR06,SR06,KR0);
+        RIP5(D,E,A,B,C,WR07,SR07,KR0);
+        RIP5(C,D,E,A,B,WR08,SR08,KR0);
+        RIP5(B,C,D,E,A,WR09,SR09,KR0);
+        RIP5(A,B,C,D,E,WR10,SR10,KR0);
+        RIP5(E,A,B,C,D,WR11,SR11,KR0);
+        RIP5(D,E,A,B,C,WR12,SR12,KR0);
+        RIP5(C,D,E,A,B,WR13,SR13,KR0);
+        RIP5(B,C,D,E,A,WR14,SR14,KR0);
+        RIP5(A,B,C,D,E,WR15,SR15,KR0);
+
+        RIP4(E,A,B,C,D,WR16,SR16,KR1);
+        RIP4(D,E,A,B,C,WR17,SR17,KR1);
+        RIP4(C,D,E,A,B,WR18,SR18,KR1);
+        RIP4(B,C,D,E,A,WR19,SR19,KR1);
+        RIP4(A,B,C,D,E,WR20,SR20,KR1);
+        RIP4(E,A,B,C,D,WR21,SR21,KR1);
+        RIP4(D,E,A,B,C,WR22,SR22,KR1);
+        RIP4(C,D,E,A,B,WR23,SR23,KR1);
+        RIP4(B,C,D,E,A,WR24,SR24,KR1);
+        RIP4(A,B,C,D,E,WR25,SR25,KR1);
+        RIP4(E,A,B,C,D,WR26,SR26,KR1);
+        RIP4(D,E,A,B,C,WR27,SR27,KR1);
+        RIP4(C,D,E,A,B,WR28,SR28,KR1);
+        RIP4(B,C,D,E,A,WR29,SR29,KR1);
+        RIP4(A,B,C,D,E,WR30,SR30,KR1);
+        RIP4(E,A,B,C,D,WR31,SR31,KR1);
+
+        RIP3(D,E,A,B,C,WR32,SR32,KR2);
+        RIP3(C,D,E,A,B,WR33,SR33,KR2);
+        RIP3(B,C,D,E,A,WR34,SR34,KR2);
+        RIP3(A,B,C,D,E,WR35,SR35,KR2);
+        RIP3(E,A,B,C,D,WR36,SR36,KR2);
+        RIP3(D,E,A,B,C,WR37,SR37,KR2);
+        RIP3(C,D,E,A,B,WR38,SR38,KR2);
+        RIP3(B,C,D,E,A,WR39,SR39,KR2);
+        RIP3(A,B,C,D,E,WR40,SR40,KR2);
+        RIP3(E,A,B,C,D,WR41,SR41,KR2);
+        RIP3(D,E,A,B,C,WR42,SR42,KR2);
+        RIP3(C,D,E,A,B,WR43,SR43,KR2);
+        RIP3(B,C,D,E,A,WR44,SR44,KR2);
+        RIP3(A,B,C,D,E,WR45,SR45,KR2);
+        RIP3(E,A,B,C,D,WR46,SR46,KR2);
+        RIP3(D,E,A,B,C,WR47,SR47,KR2);
+
+        RIP2(C,D,E,A,B,WR48,SR48,KR3);
+        RIP2(B,C,D,E,A,WR49,SR49,KR3);
+        RIP2(A,B,C,D,E,WR50,SR50,KR3);
+        RIP2(E,A,B,C,D,WR51,SR51,KR3);
+        RIP2(D,E,A,B,C,WR52,SR52,KR3);
+        RIP2(C,D,E,A,B,WR53,SR53,KR3);
+        RIP2(B,C,D,E,A,WR54,SR54,KR3);
+        RIP2(A,B,C,D,E,WR55,SR55,KR3);
+        RIP2(E,A,B,C,D,WR56,SR56,KR3);
+        RIP2(D,E,A,B,C,WR57,SR57,KR3);
+        RIP2(C,D,E,A,B,WR58,SR58,KR3);
+        RIP2(B,C,D,E,A,WR59,SR59,KR3);
+        RIP2(A,B,C,D,E,WR60,SR60,KR3);
+        RIP2(E,A,B,C,D,WR61,SR61,KR3);
+        RIP2(D,E,A,B,C,WR62,SR62,KR3);
+        RIP2(C,D,E,A,B,WR63,SR63,KR3);
+
+        RIP1(B,C,D,E,A,WR64,SR64);
+        RIP1(A,B,C,D,E,WR65,SR65);
+        RIP1(E,A,B,C,D,WR66,SR66);
+        RIP1(D,E,A,B,C,WR67,SR67);
+        RIP1(C,D,E,A,B,WR68,SR68);
+        RIP1(B,C,D,E,A,WR69,SR69);
+        RIP1(A,B,C,D,E,WR70,SR70);
+        RIP1(E,A,B,C,D,WR71,SR71);
+        RIP1(D,E,A,B,C,WR72,SR72);
+        RIP1(C,D,E,A,B,WR73,SR73);
+        RIP1(B,C,D,E,A,WR74,SR74);
+        RIP1(A,B,C,D,E,WR75,SR75);
+        RIP1(E,A,B,C,D,WR76,SR76);
+        RIP1(D,E,A,B,C,WR77,SR77);
+        RIP1(C,D,E,A,B,WR78,SR78);
+        RIP1(B,C,D,E,A,WR79,SR79);
+
+        D     =ctx->B+c+D;
+        ctx->B=ctx->C+d+E;
+        ctx->C=ctx->D+e+A;
+        ctx->D=ctx->E+a+B;
+        ctx->E=ctx->A+b+C;
+        ctx->A=D;
 
-        for (i=0; i<2; i++)
-                {
-                for (ii=0; ii<8; ii++)
-                        {
-                        fprintf(stderr,"%08lx ",l[i*8+ii]);
-                        }
-                fprintf(stderr,"\n");
                 }
         }
 #endif
diff --git a/src/lib/libcrypto/ripemd/rmd_locl.h b/src/lib/libcrypto/ripemd/rmd_locl.h
index d6ba02001a..145cf316b9 100644
--- a/src/lib/libcrypto/ripemd/rmd_locl.h
+++ b/src/lib/libcrypto/ripemd/rmd_locl.h
@@ -58,134 +58,76 @@
 
 #include <stdlib.h>
 #include <string.h>
+#include <openssl/opensslconf.h>
 #include <openssl/ripemd.h>
 
-#define ULONG   unsigned long
-#define UCHAR   unsigned char
-#define UINT    unsigned int
-
-#undef c2nl
-#define c2nl(c,l)       (l =(((unsigned long)(*((c)++)))<<24), \
-                         l|=(((unsigned long)(*((c)++)))<<16), \
-                         l|=(((unsigned long)(*((c)++)))<< 8), \
-                         l|=(((unsigned long)(*((c)++)))    ))
-
-#undef p_c2nl
-#define p_c2nl(c,l,n)   { \
-                        switch (n) { \
-                        case 0: l =((unsigned long)(*((c)++)))<<24; \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16; \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8; \
-                        case 3: l|=((unsigned long)(*((c)++))); \
-                                } \
-                        }
-
-#undef c2nl_p
-/* NOTE the pointer is not incremented at the end of this */
-#define c2nl_p(c,l,n)   { \
-                        l=0; \
-                        (c)+=n; \
-                        switch (n) { \
-                        case 3: l =((unsigned long)(*(--(c))))<< 8; \
-                        case 2: l|=((unsigned long)(*(--(c))))<<16; \
-                        case 1: l|=((unsigned long)(*(--(c))))<<24; \
-                                } \
-                        }
-
-#undef p_c2nl_p
-#define p_c2nl_p(c,l,sc,len) { \
-                        switch (sc) \
-                                { \
-                        case 0: l =((unsigned long)(*((c)++)))<<24; \
-                                if (--len == 0) break; \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16; \
-                                if (--len == 0) break; \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8; \
-                                } \
-                        }
-
-#undef nl2c
-#define nl2c(l,c)       (*((c)++)=(unsigned char)(((l)>>24)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
-                         *((c)++)=(unsigned char)(((l)    )&0xff))
-
-#undef c2l
-#define c2l(c,l)        (l =(((unsigned long)(*((c)++)))    ), \
-                         l|=(((unsigned long)(*((c)++)))<< 8), \
-                         l|=(((unsigned long)(*((c)++)))<<16), \
-                         l|=(((unsigned long)(*((c)++)))<<24))
-
-#undef p_c2l
-#define p_c2l(c,l,n)    { \
-                        switch (n) { \
-                        case 0: l =((unsigned long)(*((c)++))); \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8; \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16; \
-                        case 3: l|=((unsigned long)(*((c)++)))<<24; \
-                                } \
-                        }
-
-#undef c2l_p
-/* NOTE the pointer is not incremented at the end of this */
-#define c2l_p(c,l,n)    { \
-                        l=0; \
-                        (c)+=n; \
-                        switch (n) { \
-                        case 3: l =((unsigned long)(*(--(c))))<<16; \
-                        case 2: l|=((unsigned long)(*(--(c))))<< 8; \
-                        case 1: l|=((unsigned long)(*(--(c)))); \
-                                } \
-                        }
-
-#undef p_c2l_p
-#define p_c2l_p(c,l,sc,len) { \
-                        switch (sc) \
-                                { \
-                        case 0: l =((unsigned long)(*((c)++))); \
-                                if (--len == 0) break; \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8; \
-                                if (--len == 0) break; \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16; \
-                                } \
-                        }
-
-#undef l2c
-#define l2c(l,c)        (*((c)++)=(unsigned char)(((l)    )&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>24)&0xff))
-
-#undef ROTATE
-#if defined(WIN32)
-#define ROTATE(a,n)     _lrotl(a,n)
-#else
-#define ROTATE(a,n)     (((a)<<(n))|(((a)&0xffffffff)>>(32-(n))))
+#ifndef RIPEMD160_LONG_LOG2
+#define RIPEMD160_LONG_LOG2 2 /* default to 32 bits */
+#endif
+
+/*
+ * DO EXAMINE COMMENTS IN crypto/md5/md5_locl.h & crypto/md5/md5_dgst.c
+ * FOR EXPLANATIONS ON FOLLOWING "CODE."
+ *                                      <appro@fy.chalmers.se>
+ */
+#ifdef RMD160_ASM
+# if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
+#  define ripemd160_block_host_order ripemd160_block_asm_host_order
+# endif
+#endif
+
+void ripemd160_block_host_order (RIPEMD160_CTX *c, const void *p,int num);
+void ripemd160_block_data_order (RIPEMD160_CTX *c, const void *p,int num);
+
+#if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
+#define ripemd160_block_data_order ripemd160_block_host_order
+#endif
+
+#define DATA_ORDER_IS_LITTLE_ENDIAN
+
+#define HASH_LONG               RIPEMD160_LONG
+#define HASH_LONG_LOG2          RIPEMD160_LONG_LOG2
+#define HASH_CTX                RIPEMD160_CTX
+#define HASH_CBLOCK             RIPEMD160_CBLOCK
+#define HASH_LBLOCK             RIPEMD160_LBLOCK
+#define HASH_UPDATE             RIPEMD160_Update
+#define HASH_TRANSFORM          RIPEMD160_Transform
+#define HASH_FINAL              RIPEMD160_Final
+#define HASH_BLOCK_HOST_ORDER   ripemd160_block_host_order
+#define HASH_MAKE_STRING(c,s)   do {    \
+        unsigned long ll;               \
+        ll=(c)->A; HOST_l2c(ll,(s));    \
+        ll=(c)->B; HOST_l2c(ll,(s));    \
+        ll=(c)->C; HOST_l2c(ll,(s));    \
+        ll=(c)->D; HOST_l2c(ll,(s));    \
+        ll=(c)->E; HOST_l2c(ll,(s));    \
+        } while (0)
+#if !defined(L_ENDIAN) || defined(ripemd160_block_data_order)
+#define HASH_BLOCK_DATA_ORDER   ripemd160_block_data_order
 #endif
 
-/* A nice byte order reversal from Wei Dai <weidai@eskimo.com> */
-#if defined(WIN32)
-/* 5 instructions with rotate instruction, else 9 */
-#define Endian_Reverse32(a) \
-        { \
-        unsigned long l=(a); \
-        (a)=((ROTATE(l,8)&0x00FF00FF)|(ROTATE(l,24)&0xFF00FF00)); \
-        }
+#ifndef FLAT_INC
+#include "../md32_common.h"
 #else
-/* 6 instructions with rotate instruction, else 8 */
-#define Endian_Reverse32(a) \
-        { \
-        unsigned long l=(a); \
-        l=(((l&0xFF00FF00)>>8L)|((l&0x00FF00FF)<<8L)); \
-        (a)=ROTATE(l,16L); \
-        }
+#include "md32_common.h"
 #endif
 
+#if 0
 #define F1(x,y,z)        ((x)^(y)^(z))
 #define F2(x,y,z)       (((x)&(y))|((~x)&z))
 #define F3(x,y,z)       (((x)|(~y))^(z))
 #define F4(x,y,z)       (((x)&(z))|((y)&(~(z))))
 #define F5(x,y,z)        ((x)^((y)|(~(z))))
+#else
+/*
+ * Transformed F2 and F4 are courtesy of Wei Dai <weidai@eskimo.com>
+ */
+#define F1(x,y,z)       ((x) ^ (y) ^ (z))
+#define F2(x,y,z)       ((((y) ^ (z)) & (x)) ^ (z))
+#define F3(x,y,z)       (((~(y)) | (x)) ^ (z))
+#define F4(x,y,z)       ((((x) ^ (y)) & (z)) ^ (y))
+#define F5(x,y,z)       (((~(z)) | (y)) ^ (x))
+#endif
 
 #define RIPEMD160_A     0x67452301L
 #define RIPEMD160_B     0xEFCDAB89L
@@ -196,27 +138,27 @@
 #include "rmdconst.h"
 
 #define RIP1(a,b,c,d,e,w,s) { \
-        a+=F1(b,c,d)+X[w]; \
+        a+=F1(b,c,d)+X(w); \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
 #define RIP2(a,b,c,d,e,w,s,K) { \
-        a+=F2(b,c,d)+X[w]+K; \
+        a+=F2(b,c,d)+X(w)+K; \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
 #define RIP3(a,b,c,d,e,w,s,K) { \
-        a+=F3(b,c,d)+X[w]+K; \
+        a+=F3(b,c,d)+X(w)+K; \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
 #define RIP4(a,b,c,d,e,w,s,K) { \
-        a+=F4(b,c,d)+X[w]+K; \
+        a+=F4(b,c,d)+X(w)+K; \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
 #define RIP5(a,b,c,d,e,w,s,K) { \
-        a+=F5(b,c,d)+X[w]+K; \
+        a+=F5(b,c,d)+X(w)+K; \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
diff --git a/src/lib/libcrypto/ripemd/rmd_one.c b/src/lib/libcrypto/ripemd/rmd_one.c
index 5b6ff14714..efdf2dd6ef 100644
--- a/src/lib/libcrypto/ripemd/rmd_one.c
+++ b/src/lib/libcrypto/ripemd/rmd_one.c
@@ -57,9 +57,10 @@
  */
 
 #include <stdio.h>
-#include "rmd_locl.h"
+#include <string.h>
+#include <openssl/ripemd.h>
 
-unsigned char *RIPEMD160(unsigned char *d, unsigned long n,
+unsigned char *RIPEMD160(const unsigned char *d, unsigned long n,
              unsigned char *md)
         {
         RIPEMD160_CTX c;
diff --git a/src/lib/libcrypto/ripemd/rmdtest.c b/src/lib/libcrypto/ripemd/rmdtest.c
index 5e93d4627c..5d79c99725 100644
--- a/src/lib/libcrypto/ripemd/rmdtest.c
+++ b/src/lib/libcrypto/ripemd/rmdtest.c
@@ -73,7 +73,7 @@ int main(int argc, char *argv[])
 #include <openssl/ebcdic.h>
 #endif
 
-char *test[]={
+static char *test[]={
         "",
         "a",
         "abc",
@@ -85,7 +85,7 @@ char *test[]={
         NULL,
         };
 
-char *ret[]={
+static char *ret[]={
         "9c1185a5c5e9fc54612808977ee8f548b2258d31",
         "0bdc9d2d256b3ee9daae347be6f4dc835a467ffe",
         "8eb208f7e05d987a9b044a8e98c6b087f15a0bfc",
diff --git a/src/lib/libcrypto/rsa/Makefile.ssl b/src/lib/libcrypto/rsa/Makefile.ssl
index 3bb89701a2..7b3960e70d 100644
--- a/src/lib/libcrypto/rsa/Makefile.ssl
+++ b/src/lib/libcrypto/rsa/Makefile.ssl
@@ -18,14 +18,14 @@ AR=		ar r
 CFLAGS= $(INCLUDES) $(CFLAG)
 
 GENERAL=Makefile
-TEST=rsa_oaep_test.c
+TEST=rsa_test.c
 APPS=
 
 LIB=$(TOP)/libcrypto.a
 LIBSRC= rsa_eay.c rsa_gen.c rsa_lib.c rsa_sign.c rsa_saos.c rsa_err.c \
-        rsa_pk1.c rsa_ssl.c rsa_none.c rsa_oaep.c rsa_chk.c
+        rsa_pk1.c rsa_ssl.c rsa_none.c rsa_oaep.c rsa_chk.c rsa_null.c
 LIBOBJ= rsa_eay.o rsa_gen.o rsa_lib.o rsa_sign.o rsa_saos.o rsa_err.o \
-        rsa_pk1.o rsa_ssl.o rsa_none.o rsa_oaep.o rsa_chk.o
+        rsa_pk1.o rsa_ssl.o rsa_none.o rsa_oaep.o rsa_chk.o rsa_null.o
 
 SRC= $(LIBSRC)
 
@@ -83,52 +83,61 @@ clean:
 rsa_chk.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
 rsa_chk.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_chk.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-rsa_chk.o: ../../include/openssl/stack.h
+rsa_chk.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 rsa_eay.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_eay.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_eay.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_eay.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_eay.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_eay.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_eay.o: ../cryptlib.h
+rsa_eay.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_eay.o: ../../include/openssl/stack.h ../cryptlib.h
 rsa_err.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
 rsa_err.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_err.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-rsa_err.o: ../../include/openssl/stack.h
+rsa_err.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 rsa_gen.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_gen.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_gen.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_gen.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_gen.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-rsa_gen.o: ../../include/openssl/stack.h ../cryptlib.h
+rsa_gen.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+rsa_gen.o: ../cryptlib.h
 rsa_lib.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_lib.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_lib.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_lib.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
 rsa_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-rsa_lib.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_lib.o: ../cryptlib.h
+rsa_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_lib.o: ../../include/openssl/stack.h ../cryptlib.h
 rsa_none.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_none.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_none.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_none.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_none.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_none.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_none.o: ../cryptlib.h
+rsa_none.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_none.o: ../../include/openssl/stack.h ../cryptlib.h
+rsa_null.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
+rsa_null.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+rsa_null.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+rsa_null.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
+rsa_null.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
+rsa_null.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_null.o: ../../include/openssl/stack.h ../cryptlib.h
 rsa_oaep.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_oaep.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_oaep.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_oaep.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_oaep.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_oaep.o: ../../include/openssl/rsa.h ../../include/openssl/sha.h
-rsa_oaep.o: ../../include/openssl/stack.h ../cryptlib.h
+rsa_oaep.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_oaep.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+rsa_oaep.o: ../cryptlib.h
 rsa_pk1.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_pk1.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_pk1.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_pk1.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_pk1.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_pk1.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_pk1.o: ../cryptlib.h
+rsa_pk1.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_pk1.o: ../../include/openssl/stack.h ../cryptlib.h
 rsa_saos.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 rsa_saos.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 rsa_saos.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -168,5 +177,5 @@ rsa_ssl.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_ssl.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_ssl.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_ssl.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_ssl.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_ssl.o: ../cryptlib.h
+rsa_ssl.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_ssl.o: ../../include/openssl/stack.h ../cryptlib.h
diff --git a/src/lib/libcrypto/rsa/rsa.h b/src/lib/libcrypto/rsa/rsa.h
index 9230b2fcc9..f9f9b5cfe9 100644
--- a/src/lib/libcrypto/rsa/rsa.h
+++ b/src/lib/libcrypto/rsa/rsa.h
@@ -91,6 +91,18 @@ typedef struct rsa_meth_st
         int (*finish)(RSA *rsa);        /* called at free */
         int flags;                      /* RSA_METHOD_FLAG_* things */
         char *app_data;                 /* may be needed! */
+/* New sign and verify functions: some libraries don't allow arbitrary data
+ * to be signed/verified: this allows them to be used. Note: for this to work
+ * the RSA_public_decrypt() and RSA_private_encrypt() should *NOT* be used
+ * RSA_sign(), RSA_verify() should be used instead. Note: for backwards
+ * compatibility this functionality is only enabled if the RSA_FLAG_SIGN_VER
+ * option is set in 'flags'.
+ */
+        int (*rsa_sign)(int type, unsigned char *m, unsigned int m_len,
+             unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+        int (*rsa_verify)(int dtype, unsigned char *m, unsigned int m_len,
+             unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+
         } RSA_METHOD;
 
 struct rsa_st
@@ -140,12 +152,16 @@ struct rsa_st
  */
 #define RSA_FLAG_EXT_PKEY               0x20
 
+/* This flag in the RSA_METHOD enables the new rsa_sign, rsa_verify functions.
+ */
+#define RSA_FLAG_SIGN_VER               0x40
+
 #define RSA_PKCS1_PADDING       1
 #define RSA_SSLV23_PADDING      2
 #define RSA_NO_PADDING          3
 #define RSA_PKCS1_OAEP_PADDING  4
 
-#define RSA_set_app_data(s,arg)         RSA_set_ex_data(s,0,(char *)arg)
+#define RSA_set_app_data(s,arg)         RSA_set_ex_data(s,0,arg)
 #define RSA_get_app_data(s)             RSA_get_ex_data(s,0)
 
 RSA *   RSA_new(void);
@@ -181,6 +197,8 @@ RSA_METHOD *RSA_PKCS1_RSAref(void);
 /* these are the actual SSLeay RSA functions */
 RSA_METHOD *RSA_PKCS1_SSLeay(void);
 
+RSA_METHOD *RSA_null_method(void);
+
 void    ERR_load_RSA_strings(void );
 
 RSA *   d2i_RSAPublicKey(RSA **a, unsigned char **pp, long length);
@@ -241,10 +259,10 @@ int RSA_padding_add_none(unsigned char *to,int tlen,
 int RSA_padding_check_none(unsigned char *to,int tlen,
         unsigned char *f,int fl,int rsa_len);
 
-int RSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
-int RSA_set_ex_data(RSA *r,int idx,char *arg);
-char *RSA_get_ex_data(RSA *r, int idx);
+int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int RSA_set_ex_data(RSA *r,int idx,void *arg);
+void *RSA_get_ex_data(RSA *r, int idx);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -262,6 +280,7 @@ char *RSA_get_ex_data(RSA *r, int idx);
 #define RSA_F_RSA_EAY_PUBLIC_ENCRYPT                     104
 #define RSA_F_RSA_GENERATE_KEY                           105
 #define RSA_F_RSA_NEW_METHOD                             106
+#define RSA_F_RSA_NULL                                   124
 #define RSA_F_RSA_PADDING_ADD_NONE                       107
 #define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP                 121
 #define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1               108
@@ -292,10 +311,11 @@ char *RSA_get_ex_data(RSA *r, int idx);
 #define RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE                110
 #define RSA_R_DATA_TOO_SMALL                             111
 #define RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE                122
-#define RSA_R_D_E_NOT_CONGRUENT_TO_1                     123
 #define RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY                 112
 #define RSA_R_DMP1_NOT_CONGRUENT_TO_D                    124
 #define RSA_R_DMQ1_NOT_CONGRUENT_TO_D                    125
+#define RSA_R_D_E_NOT_CONGRUENT_TO_1                     123
+#define RSA_R_INVALID_MESSAGE_LENGTH                     131
 #define RSA_R_IQMP_NOT_INVERSE_OF_Q                      126
 #define RSA_R_KEY_SIZE_TOO_SMALL                         120
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING                  113
@@ -304,6 +324,7 @@ char *RSA_get_ex_data(RSA *r, int idx);
 #define RSA_R_PADDING_CHECK_FAILED                       114
 #define RSA_R_P_NOT_PRIME                                128
 #define RSA_R_Q_NOT_PRIME                                129
+#define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED               130
 #define RSA_R_SSLV3_ROLLBACK_ATTACK                      115
 #define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 116
 #define RSA_R_UNKNOWN_ALGORITHM_TYPE                     117
diff --git a/src/lib/libcrypto/rsa/rsa_eay.c b/src/lib/libcrypto/rsa/rsa_eay.c
index 776324860c..179b7da90a 100644
--- a/src/lib/libcrypto/rsa/rsa_eay.c
+++ b/src/lib/libcrypto/rsa/rsa_eay.c
@@ -72,6 +72,8 @@
 #include <openssl/rsa.h>
 #include <openssl/rand.h>
 
+#ifndef RSA_NULL
+
 static int RSA_eay_public_encrypt(int flen, unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
 static int RSA_eay_private_encrypt(int flen, unsigned char *from,
@@ -285,4 +287,4 @@ static int RSA_eay_finish(RSA *rsa)
         return(1);
         }
 
-
+#endif
diff --git a/src/lib/libcrypto/rsa/rsa_err.c b/src/lib/libcrypto/rsa/rsa_err.c
index 9fb15e398d..5cfbea2b03 100644
--- a/src/lib/libcrypto/rsa/rsa_err.c
+++ b/src/lib/libcrypto/rsa/rsa_err.c
@@ -73,6 +73,7 @@ static ERR_STRING_DATA RSA_str_functs[]=
 {ERR_PACK(0,RSA_F_RSA_EAY_PUBLIC_ENCRYPT,0),    "RSA_EAY_PUBLIC_ENCRYPT"},
 {ERR_PACK(0,RSA_F_RSA_GENERATE_KEY,0),  "RSA_generate_key"},
 {ERR_PACK(0,RSA_F_RSA_NEW_METHOD,0),    "RSA_new_method"},
+{ERR_PACK(0,RSA_F_RSA_NULL,0),  "RSA_NULL"},
 {ERR_PACK(0,RSA_F_RSA_PADDING_ADD_NONE,0),      "RSA_padding_add_none"},
 {ERR_PACK(0,RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,0),        "RSA_padding_add_PKCS1_OAEP"},
 {ERR_PACK(0,RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1,0),      "RSA_padding_add_PKCS1_type_1"},
@@ -106,10 +107,11 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE       ,"data too large for key size"},
 {RSA_R_DATA_TOO_SMALL                    ,"data too small"},
 {RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE       ,"data too small for key size"},
-{RSA_R_D_E_NOT_CONGRUENT_TO_1            ,"d e not congruent to 1"},
 {RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY        ,"digest too big for rsa key"},
 {RSA_R_DMP1_NOT_CONGRUENT_TO_D           ,"dmp1 not congruent to d"},
 {RSA_R_DMQ1_NOT_CONGRUENT_TO_D           ,"dmq1 not congruent to d"},
+{RSA_R_D_E_NOT_CONGRUENT_TO_1            ,"d e not congruent to 1"},
+{RSA_R_INVALID_MESSAGE_LENGTH            ,"invalid message length"},
 {RSA_R_IQMP_NOT_INVERSE_OF_Q             ,"iqmp not inverse of q"},
 {RSA_R_KEY_SIZE_TOO_SMALL                ,"key size too small"},
 {RSA_R_NULL_BEFORE_BLOCK_MISSING         ,"null before block missing"},
@@ -118,6 +120,7 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {RSA_R_PADDING_CHECK_FAILED              ,"padding check failed"},
 {RSA_R_P_NOT_PRIME                       ,"p not prime"},
 {RSA_R_Q_NOT_PRIME                       ,"q not prime"},
+{RSA_R_RSA_OPERATIONS_NOT_SUPPORTED      ,"rsa operations not supported"},
 {RSA_R_SSLV3_ROLLBACK_ATTACK             ,"sslv3 rollback attack"},
 {RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD,"the asn1 object identifier is not known for this md"},
 {RSA_R_UNKNOWN_ALGORITHM_TYPE            ,"unknown algorithm type"},
diff --git a/src/lib/libcrypto/rsa/rsa_gen.c b/src/lib/libcrypto/rsa/rsa_gen.c
index 3227dba794..b1ee5d8dce 100644
--- a/src/lib/libcrypto/rsa/rsa_gen.c
+++ b/src/lib/libcrypto/rsa/rsa_gen.c
@@ -85,6 +85,7 @@ err:
                 RSAerr(RSA_F_RSA_GENERATE_KEY,ERR_LIB_BN);
                 ok=0;
                 }
+        BN_CTX_end(ctx);
         BN_CTX_free(ctx);
         BN_CTX_free(ctx2);
         
diff --git a/src/lib/libcrypto/rsa/rsa_lib.c b/src/lib/libcrypto/rsa/rsa_lib.c
index c0ca2923a6..074a4f5074 100644
--- a/src/lib/libcrypto/rsa/rsa_lib.c
+++ b/src/lib/libcrypto/rsa/rsa_lib.c
@@ -67,7 +67,7 @@ const char *RSA_version="RSA" OPENSSL_VERSION_PTEXT;
 
 static RSA_METHOD *default_RSA_meth=NULL;
 static int rsa_meth_num=0;
-static STACK *rsa_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *rsa_meth=NULL;
 
 RSA *RSA_new(void)
         {
@@ -105,11 +105,15 @@ RSA *RSA_new_method(RSA_METHOD *meth)
 
         if (default_RSA_meth == NULL)
                 {
+#ifdef RSA_NULL
+                default_RSA_meth=RSA_null_method();
+#else
 #ifdef RSAref
                 default_RSA_meth=RSA_PKCS1_RSAref();
 #else
                 default_RSA_meth=RSA_PKCS1_SSLeay();
 #endif
+#endif
                 }
         ret=(RSA *)Malloc(sizeof(RSA));
         if (ret == NULL)
@@ -146,7 +150,7 @@ RSA *RSA_new_method(RSA_METHOD *meth)
                 ret=NULL;
                 }
         else
-                CRYPTO_new_ex_data(rsa_meth,(char *)ret,&ret->ex_data);
+                CRYPTO_new_ex_data(rsa_meth,ret,&ret->ex_data);
         return(ret);
         }
 
@@ -169,7 +173,7 @@ void RSA_free(RSA *r)
                 }
 #endif
 
-        CRYPTO_free_ex_data(rsa_meth,(char *)r,&r->ex_data);
+        CRYPTO_free_ex_data(rsa_meth,r,&r->ex_data);
 
         if (r->meth->finish != NULL)
                 r->meth->finish(r);
@@ -187,20 +191,20 @@ void RSA_free(RSA *r)
         Free(r);
         }
 
-int RSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-             int (*dup_func)(), void (*free_func)())
+int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         rsa_meth_num++;
         return(CRYPTO_get_ex_new_index(rsa_meth_num-1,
                 &rsa_meth,argl,argp,new_func,dup_func,free_func));
         }
 
-int RSA_set_ex_data(RSA *r, int idx, char *arg)
+int RSA_set_ex_data(RSA *r, int idx, void *arg)
         {
         return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
         }
 
-char *RSA_get_ex_data(RSA *r, int idx)
+void *RSA_get_ex_data(RSA *r, int idx)
         {
         return(CRYPTO_get_ex_data(&r->ex_data,idx));
         }
@@ -265,19 +269,19 @@ int RSA_blinding_on(RSA *rsa, BN_CTX *p_ctx)
         if (rsa->blinding != NULL)
                 BN_BLINDING_free(rsa->blinding);
 
-        A= &(ctx->bn[0]);
-        ctx->tos++;
+        BN_CTX_start(ctx);
+        A = BN_CTX_get(ctx);
         if (!BN_rand(A,BN_num_bits(rsa->n)-1,1,0)) goto err;
         if ((Ai=BN_mod_inverse(NULL,A,rsa->n,ctx)) == NULL) goto err;
 
         if (!rsa->meth->bn_mod_exp(A,A,rsa->e,rsa->n,ctx,rsa->_method_mod_n))
             goto err;
         rsa->blinding=BN_BLINDING_new(A,Ai,rsa->n);
-        ctx->tos--;
         rsa->flags|=RSA_FLAG_BLINDING;
         BN_free(Ai);
         ret=1;
 err:
+        BN_CTX_end(ctx);
         if (ctx != p_ctx) BN_CTX_free(ctx);
         return(ret);
         }
diff --git a/src/lib/libcrypto/rsa/rsa_null.c b/src/lib/libcrypto/rsa/rsa_null.c
new file mode 100644
index 0000000000..7b58a0eca3
--- /dev/null
+++ b/src/lib/libcrypto/rsa/rsa_null.c
@@ -0,0 +1,149 @@
+/* rsa_null.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/rand.h>
+
+/* This is a dummy RSA implementation that just returns errors when called.
+ * It is designed to allow some RSA functions to work while stopping those
+ * covered by the RSA patent. That is RSA, encryption, decryption, signing
+ * and verify is not allowed but RSA key generation, key checking and other
+ * operations (like storing RSA keys) are permitted.
+ */
+
+static int RSA_null_public_encrypt(int flen, unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+static int RSA_null_private_encrypt(int flen, unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+static int RSA_null_public_decrypt(int flen, unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+static int RSA_null_private_decrypt(int flen, unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+#if 0 /* not currently used */
+static int RSA_null_mod_exp(BIGNUM *r0, BIGNUM *i, RSA *rsa);
+#endif
+static int RSA_null_init(RSA *rsa);
+static int RSA_null_finish(RSA *rsa);
+static RSA_METHOD rsa_null_meth={
+        "Null RSA",
+        RSA_null_public_encrypt,
+        RSA_null_public_decrypt,
+        RSA_null_private_encrypt,
+        RSA_null_private_decrypt,
+        NULL, NULL,
+        RSA_null_init,
+        RSA_null_finish,
+        0,
+        NULL,
+        };
+
+RSA_METHOD *RSA_null_method(void)
+        {
+        return(&rsa_null_meth);
+        }
+
+static int RSA_null_public_encrypt(int flen, unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+
+static int RSA_null_private_encrypt(int flen, unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+
+static int RSA_null_private_decrypt(int flen, unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+
+static int RSA_null_public_decrypt(int flen, unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+
+#if 0 /* not currently used */
+static int RSA_null_mod_exp(BIGNUM *r0, BIGNUM *I, RSA *rsa)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+#endif
+
+static int RSA_null_init(RSA *rsa)
+        {
+        return(1);
+        }
+
+static int RSA_null_finish(RSA *rsa)
+        {
+        return(1);
+        }
+
+
diff --git a/src/lib/libcrypto/rsa/rsa_oaep.c b/src/lib/libcrypto/rsa/rsa_oaep.c
index 843c40c864..1465c01f4f 100644
--- a/src/lib/libcrypto/rsa/rsa_oaep.c
+++ b/src/lib/libcrypto/rsa/rsa_oaep.c
@@ -50,7 +50,8 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
            emlen - flen - 2 * SHA_DIGEST_LENGTH - 1);
     db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;
     memcpy(db + emlen - flen - SHA_DIGEST_LENGTH, from, (unsigned int) flen);
-    RAND_bytes(seed, SHA_DIGEST_LENGTH);
+    if (RAND_bytes(seed, SHA_DIGEST_LENGTH) <= 0)
+        return (0);
 #ifdef PKCS_TESTVECT
     memcpy(seed,
            "\xaa\xfd\x12\xf6\x59\xca\xe6\x34\x89\xb4\x79\xe5\x07\x6d\xde\xc2\xf0\x6c\xb5\x8f",
diff --git a/src/lib/libcrypto/rsa/rsa_oaep_test.c b/src/lib/libcrypto/rsa/rsa_oaep_test.c
index 0d4e39d3da..e69de29bb2 100644
--- a/src/lib/libcrypto/rsa/rsa_oaep_test.c
+++ b/src/lib/libcrypto/rsa/rsa_oaep_test.c
@@ -1,309 +0,0 @@
-/* test vectors from p1ovect1.txt */
-
-#include <stdio.h>
-#include <string.h>
-
-#include "openssl/e_os.h"
-
-#include <openssl/crypto.h>
-#include <openssl/err.h>
-#ifdef NO_RSA
-int main(int argc, char *argv[])
-{
-    printf("No RSA support\n");
-    return(0);
-}
-#else
-#include <openssl/rsa.h>
-
-#define SetKey \
-  key->n = BN_bin2bn(n, sizeof(n)-1, key->n); \
-  key->e = BN_bin2bn(e, sizeof(e)-1, key->e); \
-  key->d = BN_bin2bn(d, sizeof(d)-1, key->d); \
-  key->p = BN_bin2bn(p, sizeof(p)-1, key->p); \
-  key->q = BN_bin2bn(q, sizeof(q)-1, key->q); \
-  key->dmp1 = BN_bin2bn(dmp1, sizeof(dmp1)-1, key->dmp1); \
-  key->dmq1 = BN_bin2bn(dmq1, sizeof(dmq1)-1, key->dmq1); \
-  key->iqmp = BN_bin2bn(iqmp, sizeof(iqmp)-1, key->iqmp); \
-  memcpy(c, ctext_ex, sizeof(ctext_ex) - 1); \
-  return (sizeof(ctext_ex) - 1);
-
-static int key1(RSA *key, unsigned char *c)
-    {
-    static unsigned char n[] =
-"\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F"
-"\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5"
-"\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93"
-"\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1"
-"\xF5";
-
-    static unsigned char e[] = "\x11";
-
-    static unsigned char d[] =
-"\x0A\x03\x37\x48\x62\x64\x87\x69\x5F\x5F\x30\xBC\x38\xB9\x8B\x44"
-"\xC2\xCD\x2D\xFF\x43\x40\x98\xCD\x20\xD8\xA1\x38\xD0\x90\xBF\x64"
-"\x79\x7C\x3F\xA7\xA2\xCD\xCB\x3C\xD1\xE0\xBD\xBA\x26\x54\xB4\xF9"
-"\xDF\x8E\x8A\xE5\x9D\x73\x3D\x9F\x33\xB3\x01\x62\x4A\xFD\x1D\x51";
-
-    static unsigned char p[] =
-"\x00\xD8\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
-"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x12"
-"\x0D";
-    
-    static unsigned char q[] =
-"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
-"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
-"\x89";
-
-    static unsigned char dmp1[] =
-"\x59\x0B\x95\x72\xA2\xC2\xA9\xC4\x06\x05\x9D\xC2\xAB\x2F\x1D\xAF"
-"\xEB\x7E\x8B\x4F\x10\xA7\x54\x9E\x8E\xED\xF5\xB4\xFC\xE0\x9E\x05";
-
-    static unsigned char dmq1[] =
-"\x00\x8E\x3C\x05\x21\xFE\x15\xE0\xEA\x06\xA3\x6F\xF0\xF1\x0C\x99"
-"\x52\xC3\x5B\x7A\x75\x14\xFD\x32\x38\xB8\x0A\xAD\x52\x98\x62\x8D"
-"\x51";
-
-    static unsigned char iqmp[] =
-"\x36\x3F\xF7\x18\x9D\xA8\xE9\x0B\x1D\x34\x1F\x71\xD0\x9B\x76\xA8"
-"\xA9\x43\xE1\x1D\x10\xB2\x4D\x24\x9F\x2D\xEA\xFE\xF8\x0C\x18\x26";
-
-    static unsigned char ctext_ex[] =
-"\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89"
-"\x2b\xfb\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52"
-"\x33\x89\x5c\x74\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44"
-"\xb0\x05\xc3\x9e\xd8\x27\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";
-
-    SetKey;
-    }
-
-static int key2(RSA *key, unsigned char *c)
-    {
-    static unsigned char n[] =
-"\x00\xA3\x07\x9A\x90\xDF\x0D\xFD\x72\xAC\x09\x0C\xCC\x2A\x78\xB8"
-"\x74\x13\x13\x3E\x40\x75\x9C\x98\xFA\xF8\x20\x4F\x35\x8A\x0B\x26"
-"\x3C\x67\x70\xE7\x83\xA9\x3B\x69\x71\xB7\x37\x79\xD2\x71\x7B\xE8"
-"\x34\x77\xCF";
-
-    static unsigned char e[] = "\x3";
-
-    static unsigned char d[] =
-"\x6C\xAF\xBC\x60\x94\xB3\xFE\x4C\x72\xB0\xB3\x32\xC6\xFB\x25\xA2"
-"\xB7\x62\x29\x80\x4E\x68\x65\xFC\xA4\x5A\x74\xDF\x0F\x8F\xB8\x41"
-"\x3B\x52\xC0\xD0\xE5\x3D\x9B\x59\x0F\xF1\x9B\xE7\x9F\x49\xDD\x21"
-"\xE5\xEB";
-
-    static unsigned char p[] =
-"\x00\xCF\x20\x35\x02\x8B\x9D\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92"
-"\xEA\x0D\xA3\xB4\x32\x04\xB5\xCF\xCE\x91";
-
-    static unsigned char q[] =
-"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
-"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5F";
-    
-    static unsigned char dmp1[] =
-"\x00\x8A\x15\x78\xAC\x5D\x13\xAF\x10\x2B\x22\xB9\x99\xCD\x74\x61"
-"\xF1\x5E\x6D\x22\xCC\x03\x23\xDF\xDF\x0B";
-
-    static unsigned char dmq1[] =
-"\x00\x86\x55\x21\x4A\xC5\x4D\x8D\x4E\xCD\x61\x77\xF1\xC7\x36\x90"
-"\xCE\x2A\x48\x2C\x8B\x05\x99\xCB\xE0\x3F";
-
-    static unsigned char iqmp[] =
-"\x00\x83\xEF\xEF\xB8\xA9\xA4\x0D\x1D\xB6\xED\x98\xAD\x84\xED\x13"
-"\x35\xDC\xC1\x08\xF3\x22\xD0\x57\xCF\x8D";
-
-    static unsigned char ctext_ex[] =
-"\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a"
-"\x8b\x40\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4"
-"\x17\x53\x03\x29\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52"
-"\x62\x51";
-
-    SetKey;
-    }
-
-static int key3(RSA *key, unsigned char *c)
-    {
-    static unsigned char n[] =
-"\x00\xBB\xF8\x2F\x09\x06\x82\xCE\x9C\x23\x38\xAC\x2B\x9D\xA8\x71"
-"\xF7\x36\x8D\x07\xEE\xD4\x10\x43\xA4\x40\xD6\xB6\xF0\x74\x54\xF5"
-"\x1F\xB8\xDF\xBA\xAF\x03\x5C\x02\xAB\x61\xEA\x48\xCE\xEB\x6F\xCD"
-"\x48\x76\xED\x52\x0D\x60\xE1\xEC\x46\x19\x71\x9D\x8A\x5B\x8B\x80"
-"\x7F\xAF\xB8\xE0\xA3\xDF\xC7\x37\x72\x3E\xE6\xB4\xB7\xD9\x3A\x25"
-"\x84\xEE\x6A\x64\x9D\x06\x09\x53\x74\x88\x34\xB2\x45\x45\x98\x39"
-"\x4E\xE0\xAA\xB1\x2D\x7B\x61\xA5\x1F\x52\x7A\x9A\x41\xF6\xC1\x68"
-"\x7F\xE2\x53\x72\x98\xCA\x2A\x8F\x59\x46\xF8\xE5\xFD\x09\x1D\xBD"
-"\xCB";
-
-    static unsigned char e[] = "\x11";
-
-    static unsigned char d[] =
-"\x00\xA5\xDA\xFC\x53\x41\xFA\xF2\x89\xC4\xB9\x88\xDB\x30\xC1\xCD"
-"\xF8\x3F\x31\x25\x1E\x06\x68\xB4\x27\x84\x81\x38\x01\x57\x96\x41"
-"\xB2\x94\x10\xB3\xC7\x99\x8D\x6B\xC4\x65\x74\x5E\x5C\x39\x26\x69"
-"\xD6\x87\x0D\xA2\xC0\x82\xA9\x39\xE3\x7F\xDC\xB8\x2E\xC9\x3E\xDA"
-"\xC9\x7F\xF3\xAD\x59\x50\xAC\xCF\xBC\x11\x1C\x76\xF1\xA9\x52\x94"
-"\x44\xE5\x6A\xAF\x68\xC5\x6C\x09\x2C\xD3\x8D\xC3\xBE\xF5\xD2\x0A"
-"\x93\x99\x26\xED\x4F\x74\xA1\x3E\xDD\xFB\xE1\xA1\xCE\xCC\x48\x94"
-"\xAF\x94\x28\xC2\xB7\xB8\x88\x3F\xE4\x46\x3A\x4B\xC8\x5B\x1C\xB3"
-"\xC1";
-
-    static unsigned char p[] =
-"\x00\xEE\xCF\xAE\x81\xB1\xB9\xB3\xC9\x08\x81\x0B\x10\xA1\xB5\x60"
-"\x01\x99\xEB\x9F\x44\xAE\xF4\xFD\xA4\x93\xB8\x1A\x9E\x3D\x84\xF6"
-"\x32\x12\x4E\xF0\x23\x6E\x5D\x1E\x3B\x7E\x28\xFA\xE7\xAA\x04\x0A"
-"\x2D\x5B\x25\x21\x76\x45\x9D\x1F\x39\x75\x41\xBA\x2A\x58\xFB\x65"
-"\x99";
-
-    static unsigned char q[] =
-"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
-"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
-"\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
-"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x15"
-"\x03";
-
-    static unsigned char dmp1[] =
-"\x54\x49\x4C\xA6\x3E\xBA\x03\x37\xE4\xE2\x40\x23\xFC\xD6\x9A\x5A"
-"\xEB\x07\xDD\xDC\x01\x83\xA4\xD0\xAC\x9B\x54\xB0\x51\xF2\xB1\x3E"
-"\xD9\x49\x09\x75\xEA\xB7\x74\x14\xFF\x59\xC1\xF7\x69\x2E\x9A\x2E"
-"\x20\x2B\x38\xFC\x91\x0A\x47\x41\x74\xAD\xC9\x3C\x1F\x67\xC9\x81";
-
-    static unsigned char dmq1[] =
-"\x47\x1E\x02\x90\xFF\x0A\xF0\x75\x03\x51\xB7\xF8\x78\x86\x4C\xA9"
-"\x61\xAD\xBD\x3A\x8A\x7E\x99\x1C\x5C\x05\x56\xA9\x4C\x31\x46\xA7"
-"\xF9\x80\x3F\x8F\x6F\x8A\xE3\x42\xE9\x31\xFD\x8A\xE4\x7A\x22\x0D"
-"\x1B\x99\xA4\x95\x84\x98\x07\xFE\x39\xF9\x24\x5A\x98\x36\xDA\x3D";
-    
-    static unsigned char iqmp[] =
-"\x00\xB0\x6C\x4F\xDA\xBB\x63\x01\x19\x8D\x26\x5B\xDB\xAE\x94\x23"
-"\xB3\x80\xF2\x71\xF7\x34\x53\x88\x50\x93\x07\x7F\xCD\x39\xE2\x11"
-"\x9F\xC9\x86\x32\x15\x4F\x58\x83\xB1\x67\xA9\x67\xBF\x40\x2B\x4E"
-"\x9E\x2E\x0F\x96\x56\xE6\x98\xEA\x36\x66\xED\xFB\x25\x79\x80\x39"
-"\xF7";
-
-    static unsigned char ctext_ex[] =
-"\xb8\x24\x6b\x56\xa6\xed\x58\x81\xae\xb5\x85\xd9\xa2\x5b\x2a\xd7"
-"\x90\xc4\x17\xe0\x80\x68\x1b\xf1\xac\x2b\xc3\xde\xb6\x9d\x8b\xce"
-"\xf0\xc4\x36\x6f\xec\x40\x0a\xf0\x52\xa7\x2e\x9b\x0e\xff\xb5\xb3"
-"\xf2\xf1\x92\xdb\xea\xca\x03\xc1\x27\x40\x05\x71\x13\xbf\x1f\x06"
-"\x69\xac\x22\xe9\xf3\xa7\x85\x2e\x3c\x15\xd9\x13\xca\xb0\xb8\x86"
-"\x3a\x95\xc9\x92\x94\xce\x86\x74\x21\x49\x54\x61\x03\x46\xf4\xd4"
-"\x74\xb2\x6f\x7c\x48\xb4\x2e\xe6\x8e\x1f\x57\x2a\x1f\xc4\x02\x6a"
-"\xc4\x56\xb4\xf5\x9f\x7b\x62\x1e\xa1\xb9\xd8\x8f\x64\x20\x2f\xb1";
-
-    SetKey;
-    }
-
-static int pad_unknown(void)
-{
-    unsigned long l;
-    while ((l = ERR_get_error()) != 0)
-      if (ERR_GET_REASON(l) == RSA_R_UNKNOWN_PADDING_TYPE)
-        return(1);
-    return(0);
-}
-
-int main() 
-    {
-    int err=0;
-    int v;
-    RSA *key;
-    unsigned char ptext[256];
-    unsigned char ctext[256];
-    static unsigned char ptext_ex[] = "\x54\x85\x9b\x34\x2c\x49\xea\x2a";
-    unsigned char ctext_ex[256];
-    int plen;
-    int clen = 0;
-    int num;
-
-    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
-        
-    plen = sizeof(ptext_ex) - 1;
-
-    for (v = 0; v < 3; v++)
-        {
-        key = RSA_new();
-        switch (v) {
-    case 0:
-        clen = key1(key, ctext_ex);
-        break;
-    case 1:
-        clen = key2(key, ctext_ex);
-        break;
-    case 2:
-        clen = key3(key, ctext_ex);
-        break;
-        }
-
-        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
-                                 RSA_PKCS1_PADDING);
-        if (num != clen)
-            {
-            printf("PKCS#1 v1.5 encryption failed!\n");
-            err=1;
-            goto oaep;
-            }
-  
-        num = RSA_private_decrypt(num, ctext, ptext, key,
-                                  RSA_PKCS1_PADDING);
-        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
-            {
-            printf("PKCS#1 v1.5 decryption failed!\n");
-            err=1;
-            }
-        else
-            printf("PKCS #1 v1.5 encryption/decryption ok\n");
-
-    oaep:
-        ERR_clear_error();
-        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
-                                 RSA_PKCS1_OAEP_PADDING);
-        if (num == -1 && pad_unknown())
-            {
-            printf("No OAEP support\n");
-            goto next;
-            }
-        if (num != clen)
-            {
-            printf("OAEP encryption failed!\n");
-            err=1;
-            goto next;
-            }
-  
-        num = RSA_private_decrypt(num, ctext, ptext, key,
-                                  RSA_PKCS1_OAEP_PADDING);
-        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
-            {
-            printf("OAEP decryption (encrypted data) failed!\n");
-            err=1;
-            }
-        else if (memcmp(ctext, ctext_ex, num) == 0)
-            {
-            printf("OAEP test vector %d passed!\n", v);
-            goto next;
-            }
-    
-        /* Different ciphertexts (rsa_oaep.c without -DPKCS_TESTVECT).
-           Try decrypting ctext_ex */
-
-        num = RSA_private_decrypt(clen, ctext_ex, ptext, key,
-                                  RSA_PKCS1_OAEP_PADDING);
-
-        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
-            {
-            printf("OAEP decryption (test vector data) failed!\n");
-            err=1;
-            }
-        else
-            printf("OAEP encryption/decryption ok\n");
-    next:
-        RSA_free(key);
-        }
-
-    ERR_remove_state(0);
-
-    CRYPTO_mem_leaks_fp(stdout);
-
-    return err;
-    }
-#endif
diff --git a/src/lib/libcrypto/rsa/rsa_pk1.c b/src/lib/libcrypto/rsa/rsa_pk1.c
index f0ae51f234..48a32bc264 100644
--- a/src/lib/libcrypto/rsa/rsa_pk1.c
+++ b/src/lib/libcrypto/rsa/rsa_pk1.c
@@ -79,7 +79,7 @@ int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
         *(p++)=0;
         *(p++)=1; /* Private Key BT (Block Type) */
 
-        /* padd out with 0xff data */
+        /* pad out with 0xff data */
         j=tlen-3-flen;
         memset(p,0xff,j);
         p+=j;
@@ -130,6 +130,11 @@ int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
                 }
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);
@@ -155,12 +160,14 @@ int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
         /* pad out with non-zero random data */
         j=tlen-3-flen;
 
-        RAND_bytes(p,j);
+        if (RAND_bytes(p,j) <= 0)
+                return(0);
         for (i=0; i<j; i++)
                 {
                 if (*p == '\0')
                         do      {
-                                RAND_bytes(p,1);
+                                if (RAND_bytes(p,1) <= 0)
+                                        return(0);
                                 } while (*p == '\0');
                 p++;
                 }
@@ -205,6 +212,11 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
                 }
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);
diff --git a/src/lib/libcrypto/rsa/rsa_saos.c b/src/lib/libcrypto/rsa/rsa_saos.c
index 73b8b0c7ad..61efb0b00f 100644
--- a/src/lib/libcrypto/rsa/rsa_saos.c
+++ b/src/lib/libcrypto/rsa/rsa_saos.c
@@ -136,7 +136,7 @@ int RSA_verify_ASN1_OCTET_STRING(int dtype, unsigned char *m,
         else
                 ret=1;
 err:
-        if (sig != NULL) ASN1_OCTET_STRING_free(sig);
+        if (sig != NULL) M_ASN1_OCTET_STRING_free(sig);
         memset(s,0,(unsigned int)siglen);
         Free(s);
         return(ret);
diff --git a/src/lib/libcrypto/rsa/rsa_sign.c b/src/lib/libcrypto/rsa/rsa_sign.c
index 1740494a4c..05bb7fb74a 100644
--- a/src/lib/libcrypto/rsa/rsa_sign.c
+++ b/src/lib/libcrypto/rsa/rsa_sign.c
@@ -63,59 +63,77 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 
+/* Size of an SSL signature: MD5+SHA1 */
+#define SSL_SIG_LENGTH  36
+
 int RSA_sign(int type, unsigned char *m, unsigned int m_len,
              unsigned char *sigret, unsigned int *siglen, RSA *rsa)
         {
         X509_SIG sig;
         ASN1_TYPE parameter;
         int i,j,ret=1;
-        unsigned char *p,*s;
+        unsigned char *p,*s = NULL;
         X509_ALGOR algor;
         ASN1_OCTET_STRING digest;
-
-        sig.algor= &algor;
-        sig.algor->algorithm=OBJ_nid2obj(type);
-        if (sig.algor->algorithm == NULL)
-                {
-                RSAerr(RSA_F_RSA_SIGN,RSA_R_UNKNOWN_ALGORITHM_TYPE);
-                return(0);
-                }
-        if (sig.algor->algorithm->length == 0)
-                {
-                RSAerr(RSA_F_RSA_SIGN,RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
-                return(0);
+        if(rsa->flags & RSA_FLAG_SIGN_VER)
+              return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);
+        /* Special case: SSL signature, just check the length */
+        if(type == NID_md5_sha1) {
+                if(m_len != SSL_SIG_LENGTH) {
+                        RSAerr(RSA_F_RSA_SIGN,RSA_R_INVALID_MESSAGE_LENGTH);
+                        return(0);
                 }
-        parameter.type=V_ASN1_NULL;
-        parameter.value.ptr=NULL;
-        sig.algor->parameter= &parameter;
+                i = SSL_SIG_LENGTH;
+                s = m;
+        } else {
+                sig.algor= &algor;
+                sig.algor->algorithm=OBJ_nid2obj(type);
+                if (sig.algor->algorithm == NULL)
+                        {
+                        RSAerr(RSA_F_RSA_SIGN,RSA_R_UNKNOWN_ALGORITHM_TYPE);
+                        return(0);
+                        }
+                if (sig.algor->algorithm->length == 0)
+                        {
+                        RSAerr(RSA_F_RSA_SIGN,RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
+                        return(0);
+                        }
+                parameter.type=V_ASN1_NULL;
+                parameter.value.ptr=NULL;
+                sig.algor->parameter= &parameter;
 
-        sig.digest= &digest;
-        sig.digest->data=m;
-        sig.digest->length=m_len;
+                sig.digest= &digest;
+                sig.digest->data=m;
+                sig.digest->length=m_len;
 
-        i=i2d_X509_SIG(&sig,NULL);
+                i=i2d_X509_SIG(&sig,NULL);
+        }
         j=RSA_size(rsa);
         if ((i-RSA_PKCS1_PADDING) > j)
                 {
                 RSAerr(RSA_F_RSA_SIGN,RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);
                 return(0);
                 }
-        s=(unsigned char *)Malloc((unsigned int)j+1);
-        if (s == NULL)
-                {
-                RSAerr(RSA_F_RSA_SIGN,ERR_R_MALLOC_FAILURE);
-                return(0);
-                }
-        p=s;
-        i2d_X509_SIG(&sig,&p);
+        if(type != NID_md5_sha1) {
+                s=(unsigned char *)Malloc((unsigned int)j+1);
+                if (s == NULL)
+                        {
+                        RSAerr(RSA_F_RSA_SIGN,ERR_R_MALLOC_FAILURE);
+                        return(0);
+                        }
+                p=s;
+                i2d_X509_SIG(&sig,&p);
+        }
         i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);
         if (i <= 0)
                 ret=0;
         else
                 *siglen=i;
 
-        memset(s,0,(unsigned int)j+1);
-        Free(s);
+        if(type != NID_md5_sha1) {
+                memset(s,0,(unsigned int)j+1);
+                Free(s);
+        }
         return(ret);
         }
 
@@ -132,53 +150,68 @@ int RSA_verify(int dtype, unsigned char *m, unsigned int m_len,
                 return(0);
                 }
 
+        if(rsa->flags & RSA_FLAG_SIGN_VER)
+            return rsa->meth->rsa_verify(dtype, m, m_len, sigbuf, siglen, rsa);
+
         s=(unsigned char *)Malloc((unsigned int)siglen);
         if (s == NULL)
                 {
                 RSAerr(RSA_F_RSA_VERIFY,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
+        if((dtype == NID_md5_sha1) && (m_len != SSL_SIG_LENGTH) ) {
+                        RSAerr(RSA_F_RSA_VERIFY,RSA_R_INVALID_MESSAGE_LENGTH);
+                        return(0);
+        }
         i=RSA_public_decrypt((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING);
 
         if (i <= 0) goto err;
 
-        p=s;
-        sig=d2i_X509_SIG(NULL,&p,(long)i);
+        /* Special case: SSL signature */
+        if(dtype == NID_md5_sha1) {
+                if((i != SSL_SIG_LENGTH) || memcmp(s, m, SSL_SIG_LENGTH))
+                                RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+                else ret = 1;
+        } else {
+                p=s;
+                sig=d2i_X509_SIG(NULL,&p,(long)i);
 
-        if (sig == NULL) goto err;
-        sigtype=OBJ_obj2nid(sig->algor->algorithm);
+                if (sig == NULL) goto err;
+                sigtype=OBJ_obj2nid(sig->algor->algorithm);
 
 
-#ifdef RSA_DEBUG
-        /* put a backward compatability flag in EAY */
-        fprintf(stderr,"in(%s) expect(%s)\n",OBJ_nid2ln(sigtype),
-                OBJ_nid2ln(dtype));
-#endif
-        if (sigtype != dtype)
-                {
-                if (((dtype == NID_md5) &&
-                        (sigtype == NID_md5WithRSAEncryption)) ||
-                        ((dtype == NID_md2) &&
-                        (sigtype == NID_md2WithRSAEncryption)))
+        #ifdef RSA_DEBUG
+                /* put a backward compatibility flag in EAY */
+                fprintf(stderr,"in(%s) expect(%s)\n",OBJ_nid2ln(sigtype),
+                        OBJ_nid2ln(dtype));
+        #endif
+                if (sigtype != dtype)
                         {
-                        /* ok, we will let it through */
-#if !defined(NO_STDIO) && !defined(WIN16)
-                        fprintf(stderr,"signature has problems, re-make with post SSLeay045\n");
-#endif
+                        if (((dtype == NID_md5) &&
+                                (sigtype == NID_md5WithRSAEncryption)) ||
+                                ((dtype == NID_md2) &&
+                                (sigtype == NID_md2WithRSAEncryption)))
+                                {
+                                /* ok, we will let it through */
+        #if !defined(NO_STDIO) && !defined(WIN16)
+                                fprintf(stderr,"signature has problems, re-make with post SSLeay045\n");
+        #endif
+                                }
+                        else
+                                {
+                                RSAerr(RSA_F_RSA_VERIFY,
+                                                RSA_R_ALGORITHM_MISMATCH);
+                                goto err;
+                                }
                         }
-                else
+                if (    ((unsigned int)sig->digest->length != m_len) ||
+                        (memcmp(m,sig->digest->data,m_len) != 0))
                         {
-                        RSAerr(RSA_F_RSA_VERIFY,RSA_R_ALGORITHM_MISMATCH);
-                        goto err;
+                        RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
                         }
-                }
-        if (    ((unsigned int)sig->digest->length != m_len) ||
-                (memcmp(m,sig->digest->data,m_len) != 0))
-                {
-                RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
-                }
-        else
-                ret=1;
+                else
+                        ret=1;
+        }
 err:
         if (sig != NULL) X509_SIG_free(sig);
         memset(s,0,(unsigned int)siglen);
diff --git a/src/lib/libcrypto/rsa/rsa_ssl.c b/src/lib/libcrypto/rsa/rsa_ssl.c
index 1050844f8d..81a857c813 100644
--- a/src/lib/libcrypto/rsa/rsa_ssl.c
+++ b/src/lib/libcrypto/rsa/rsa_ssl.c
@@ -82,12 +82,14 @@ int RSA_padding_add_SSLv23(unsigned char *to, int tlen, unsigned char *from,
         /* pad out with non-zero random data */
         j=tlen-3-8-flen;
 
-        RAND_bytes(p,j);
+        if (RAND_bytes(p,j) <= 0)
+                return(0);
         for (i=0; i<j; i++)
                 {
                 if (*p == '\0')
                         do      {
-                                RAND_bytes(p,1);
+                                if (RAND_bytes(p,1) <= 0)
+                                        return(0);
                                 } while (*p == '\0');
                 p++;
                 }
@@ -140,6 +142,11 @@ int RSA_padding_check_SSLv23(unsigned char *to, int tlen, unsigned char *from,
 
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);
diff --git a/src/lib/libcrypto/rsa/rsa_test.c b/src/lib/libcrypto/rsa/rsa_test.c
new file mode 100644
index 0000000000..e5ae0c1f69
--- /dev/null
+++ b/src/lib/libcrypto/rsa/rsa_test.c
@@ -0,0 +1,314 @@
+/* test vectors from p1ovect1.txt */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "openssl/e_os.h"
+
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+#ifdef NO_RSA
+int main(int argc, char *argv[])
+{
+    printf("No RSA support\n");
+    return(0);
+}
+#else
+#include <openssl/rsa.h>
+
+#define SetKey \
+  key->n = BN_bin2bn(n, sizeof(n)-1, key->n); \
+  key->e = BN_bin2bn(e, sizeof(e)-1, key->e); \
+  key->d = BN_bin2bn(d, sizeof(d)-1, key->d); \
+  key->p = BN_bin2bn(p, sizeof(p)-1, key->p); \
+  key->q = BN_bin2bn(q, sizeof(q)-1, key->q); \
+  key->dmp1 = BN_bin2bn(dmp1, sizeof(dmp1)-1, key->dmp1); \
+  key->dmq1 = BN_bin2bn(dmq1, sizeof(dmq1)-1, key->dmq1); \
+  key->iqmp = BN_bin2bn(iqmp, sizeof(iqmp)-1, key->iqmp); \
+  memcpy(c, ctext_ex, sizeof(ctext_ex) - 1); \
+  return (sizeof(ctext_ex) - 1);
+
+static int key1(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F"
+"\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5"
+"\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93"
+"\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1"
+"\xF5";
+
+    static unsigned char e[] = "\x11";
+
+    static unsigned char d[] =
+"\x0A\x03\x37\x48\x62\x64\x87\x69\x5F\x5F\x30\xBC\x38\xB9\x8B\x44"
+"\xC2\xCD\x2D\xFF\x43\x40\x98\xCD\x20\xD8\xA1\x38\xD0\x90\xBF\x64"
+"\x79\x7C\x3F\xA7\xA2\xCD\xCB\x3C\xD1\xE0\xBD\xBA\x26\x54\xB4\xF9"
+"\xDF\x8E\x8A\xE5\x9D\x73\x3D\x9F\x33\xB3\x01\x62\x4A\xFD\x1D\x51";
+
+    static unsigned char p[] =
+"\x00\xD8\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
+"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x12"
+"\x0D";
+    
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
+"\x89";
+
+    static unsigned char dmp1[] =
+"\x59\x0B\x95\x72\xA2\xC2\xA9\xC4\x06\x05\x9D\xC2\xAB\x2F\x1D\xAF"
+"\xEB\x7E\x8B\x4F\x10\xA7\x54\x9E\x8E\xED\xF5\xB4\xFC\xE0\x9E\x05";
+
+    static unsigned char dmq1[] =
+"\x00\x8E\x3C\x05\x21\xFE\x15\xE0\xEA\x06\xA3\x6F\xF0\xF1\x0C\x99"
+"\x52\xC3\x5B\x7A\x75\x14\xFD\x32\x38\xB8\x0A\xAD\x52\x98\x62\x8D"
+"\x51";
+
+    static unsigned char iqmp[] =
+"\x36\x3F\xF7\x18\x9D\xA8\xE9\x0B\x1D\x34\x1F\x71\xD0\x9B\x76\xA8"
+"\xA9\x43\xE1\x1D\x10\xB2\x4D\x24\x9F\x2D\xEA\xFE\xF8\x0C\x18\x26";
+
+    static unsigned char ctext_ex[] =
+"\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89"
+"\x2b\xfb\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52"
+"\x33\x89\x5c\x74\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44"
+"\xb0\x05\xc3\x9e\xd8\x27\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";
+
+    SetKey;
+    }
+
+static int key2(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xA3\x07\x9A\x90\xDF\x0D\xFD\x72\xAC\x09\x0C\xCC\x2A\x78\xB8"
+"\x74\x13\x13\x3E\x40\x75\x9C\x98\xFA\xF8\x20\x4F\x35\x8A\x0B\x26"
+"\x3C\x67\x70\xE7\x83\xA9\x3B\x69\x71\xB7\x37\x79\xD2\x71\x7B\xE8"
+"\x34\x77\xCF";
+
+    static unsigned char e[] = "\x3";
+
+    static unsigned char d[] =
+"\x6C\xAF\xBC\x60\x94\xB3\xFE\x4C\x72\xB0\xB3\x32\xC6\xFB\x25\xA2"
+"\xB7\x62\x29\x80\x4E\x68\x65\xFC\xA4\x5A\x74\xDF\x0F\x8F\xB8\x41"
+"\x3B\x52\xC0\xD0\xE5\x3D\x9B\x59\x0F\xF1\x9B\xE7\x9F\x49\xDD\x21"
+"\xE5\xEB";
+
+    static unsigned char p[] =
+"\x00\xCF\x20\x35\x02\x8B\x9D\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92"
+"\xEA\x0D\xA3\xB4\x32\x04\xB5\xCF\xCE\x91";
+
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5F";
+    
+    static unsigned char dmp1[] =
+"\x00\x8A\x15\x78\xAC\x5D\x13\xAF\x10\x2B\x22\xB9\x99\xCD\x74\x61"
+"\xF1\x5E\x6D\x22\xCC\x03\x23\xDF\xDF\x0B";
+
+    static unsigned char dmq1[] =
+"\x00\x86\x55\x21\x4A\xC5\x4D\x8D\x4E\xCD\x61\x77\xF1\xC7\x36\x90"
+"\xCE\x2A\x48\x2C\x8B\x05\x99\xCB\xE0\x3F";
+
+    static unsigned char iqmp[] =
+"\x00\x83\xEF\xEF\xB8\xA9\xA4\x0D\x1D\xB6\xED\x98\xAD\x84\xED\x13"
+"\x35\xDC\xC1\x08\xF3\x22\xD0\x57\xCF\x8D";
+
+    static unsigned char ctext_ex[] =
+"\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a"
+"\x8b\x40\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4"
+"\x17\x53\x03\x29\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52"
+"\x62\x51";
+
+    SetKey;
+    }
+
+static int key3(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xBB\xF8\x2F\x09\x06\x82\xCE\x9C\x23\x38\xAC\x2B\x9D\xA8\x71"
+"\xF7\x36\x8D\x07\xEE\xD4\x10\x43\xA4\x40\xD6\xB6\xF0\x74\x54\xF5"
+"\x1F\xB8\xDF\xBA\xAF\x03\x5C\x02\xAB\x61\xEA\x48\xCE\xEB\x6F\xCD"
+"\x48\x76\xED\x52\x0D\x60\xE1\xEC\x46\x19\x71\x9D\x8A\x5B\x8B\x80"
+"\x7F\xAF\xB8\xE0\xA3\xDF\xC7\x37\x72\x3E\xE6\xB4\xB7\xD9\x3A\x25"
+"\x84\xEE\x6A\x64\x9D\x06\x09\x53\x74\x88\x34\xB2\x45\x45\x98\x39"
+"\x4E\xE0\xAA\xB1\x2D\x7B\x61\xA5\x1F\x52\x7A\x9A\x41\xF6\xC1\x68"
+"\x7F\xE2\x53\x72\x98\xCA\x2A\x8F\x59\x46\xF8\xE5\xFD\x09\x1D\xBD"
+"\xCB";
+
+    static unsigned char e[] = "\x11";
+
+    static unsigned char d[] =
+"\x00\xA5\xDA\xFC\x53\x41\xFA\xF2\x89\xC4\xB9\x88\xDB\x30\xC1\xCD"
+"\xF8\x3F\x31\x25\x1E\x06\x68\xB4\x27\x84\x81\x38\x01\x57\x96\x41"
+"\xB2\x94\x10\xB3\xC7\x99\x8D\x6B\xC4\x65\x74\x5E\x5C\x39\x26\x69"
+"\xD6\x87\x0D\xA2\xC0\x82\xA9\x39\xE3\x7F\xDC\xB8\x2E\xC9\x3E\xDA"
+"\xC9\x7F\xF3\xAD\x59\x50\xAC\xCF\xBC\x11\x1C\x76\xF1\xA9\x52\x94"
+"\x44\xE5\x6A\xAF\x68\xC5\x6C\x09\x2C\xD3\x8D\xC3\xBE\xF5\xD2\x0A"
+"\x93\x99\x26\xED\x4F\x74\xA1\x3E\xDD\xFB\xE1\xA1\xCE\xCC\x48\x94"
+"\xAF\x94\x28\xC2\xB7\xB8\x88\x3F\xE4\x46\x3A\x4B\xC8\x5B\x1C\xB3"
+"\xC1";
+
+    static unsigned char p[] =
+"\x00\xEE\xCF\xAE\x81\xB1\xB9\xB3\xC9\x08\x81\x0B\x10\xA1\xB5\x60"
+"\x01\x99\xEB\x9F\x44\xAE\xF4\xFD\xA4\x93\xB8\x1A\x9E\x3D\x84\xF6"
+"\x32\x12\x4E\xF0\x23\x6E\x5D\x1E\x3B\x7E\x28\xFA\xE7\xAA\x04\x0A"
+"\x2D\x5B\x25\x21\x76\x45\x9D\x1F\x39\x75\x41\xBA\x2A\x58\xFB\x65"
+"\x99";
+
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
+"\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
+"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x15"
+"\x03";
+
+    static unsigned char dmp1[] =
+"\x54\x49\x4C\xA6\x3E\xBA\x03\x37\xE4\xE2\x40\x23\xFC\xD6\x9A\x5A"
+"\xEB\x07\xDD\xDC\x01\x83\xA4\xD0\xAC\x9B\x54\xB0\x51\xF2\xB1\x3E"
+"\xD9\x49\x09\x75\xEA\xB7\x74\x14\xFF\x59\xC1\xF7\x69\x2E\x9A\x2E"
+"\x20\x2B\x38\xFC\x91\x0A\x47\x41\x74\xAD\xC9\x3C\x1F\x67\xC9\x81";
+
+    static unsigned char dmq1[] =
+"\x47\x1E\x02\x90\xFF\x0A\xF0\x75\x03\x51\xB7\xF8\x78\x86\x4C\xA9"
+"\x61\xAD\xBD\x3A\x8A\x7E\x99\x1C\x5C\x05\x56\xA9\x4C\x31\x46\xA7"
+"\xF9\x80\x3F\x8F\x6F\x8A\xE3\x42\xE9\x31\xFD\x8A\xE4\x7A\x22\x0D"
+"\x1B\x99\xA4\x95\x84\x98\x07\xFE\x39\xF9\x24\x5A\x98\x36\xDA\x3D";
+    
+    static unsigned char iqmp[] =
+"\x00\xB0\x6C\x4F\xDA\xBB\x63\x01\x19\x8D\x26\x5B\xDB\xAE\x94\x23"
+"\xB3\x80\xF2\x71\xF7\x34\x53\x88\x50\x93\x07\x7F\xCD\x39\xE2\x11"
+"\x9F\xC9\x86\x32\x15\x4F\x58\x83\xB1\x67\xA9\x67\xBF\x40\x2B\x4E"
+"\x9E\x2E\x0F\x96\x56\xE6\x98\xEA\x36\x66\xED\xFB\x25\x79\x80\x39"
+"\xF7";
+
+    static unsigned char ctext_ex[] =
+"\xb8\x24\x6b\x56\xa6\xed\x58\x81\xae\xb5\x85\xd9\xa2\x5b\x2a\xd7"
+"\x90\xc4\x17\xe0\x80\x68\x1b\xf1\xac\x2b\xc3\xde\xb6\x9d\x8b\xce"
+"\xf0\xc4\x36\x6f\xec\x40\x0a\xf0\x52\xa7\x2e\x9b\x0e\xff\xb5\xb3"
+"\xf2\xf1\x92\xdb\xea\xca\x03\xc1\x27\x40\x05\x71\x13\xbf\x1f\x06"
+"\x69\xac\x22\xe9\xf3\xa7\x85\x2e\x3c\x15\xd9\x13\xca\xb0\xb8\x86"
+"\x3a\x95\xc9\x92\x94\xce\x86\x74\x21\x49\x54\x61\x03\x46\xf4\xd4"
+"\x74\xb2\x6f\x7c\x48\xb4\x2e\xe6\x8e\x1f\x57\x2a\x1f\xc4\x02\x6a"
+"\xc4\x56\xb4\xf5\x9f\x7b\x62\x1e\xa1\xb9\xd8\x8f\x64\x20\x2f\xb1";
+
+    SetKey;
+    }
+
+static int pad_unknown(void)
+{
+    unsigned long l;
+    while ((l = ERR_get_error()) != 0)
+      if (ERR_GET_REASON(l) == RSA_R_UNKNOWN_PADDING_TYPE)
+        return(1);
+    return(0);
+}
+
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
+int main(int argc, char *argv[])
+    {
+    int err=0;
+    int v;
+    RSA *key;
+    unsigned char ptext[256];
+    unsigned char ctext[256];
+    static unsigned char ptext_ex[] = "\x54\x85\x9b\x34\x2c\x49\xea\x2a";
+    unsigned char ctext_ex[256];
+    int plen;
+    int clen = 0;
+    int num;
+
+    RAND_seed(rnd_seed, sizeof rnd_seed); /* or OAEP may fail */
+
+    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+        
+    plen = sizeof(ptext_ex) - 1;
+
+    for (v = 0; v < 3; v++)
+        {
+        key = RSA_new();
+        switch (v) {
+    case 0:
+        clen = key1(key, ctext_ex);
+        break;
+    case 1:
+        clen = key2(key, ctext_ex);
+        break;
+    case 2:
+        clen = key3(key, ctext_ex);
+        break;
+        }
+
+        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
+                                 RSA_PKCS1_PADDING);
+        if (num != clen)
+            {
+            printf("PKCS#1 v1.5 encryption failed!\n");
+            err=1;
+            goto oaep;
+            }
+  
+        num = RSA_private_decrypt(num, ctext, ptext, key,
+                                  RSA_PKCS1_PADDING);
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("PKCS#1 v1.5 decryption failed!\n");
+            err=1;
+            }
+        else
+            printf("PKCS #1 v1.5 encryption/decryption ok\n");
+
+    oaep:
+        ERR_clear_error();
+        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
+                                 RSA_PKCS1_OAEP_PADDING);
+        if (num == -1 && pad_unknown())
+            {
+            printf("No OAEP support\n");
+            goto next;
+            }
+        if (num != clen)
+            {
+            printf("OAEP encryption failed!\n");
+            err=1;
+            goto next;
+            }
+  
+        num = RSA_private_decrypt(num, ctext, ptext, key,
+                                  RSA_PKCS1_OAEP_PADDING);
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("OAEP decryption (encrypted data) failed!\n");
+            err=1;
+            }
+        else if (memcmp(ctext, ctext_ex, num) == 0)
+            {
+            printf("OAEP test vector %d passed!\n", v);
+            goto next;
+            }
+    
+        /* Different ciphertexts (rsa_oaep.c without -DPKCS_TESTVECT).
+           Try decrypting ctext_ex */
+
+        num = RSA_private_decrypt(clen, ctext_ex, ptext, key,
+                                  RSA_PKCS1_OAEP_PADDING);
+
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("OAEP decryption (test vector data) failed!\n");
+            err=1;
+            }
+        else
+            printf("OAEP encryption/decryption ok\n");
+    next:
+        RSA_free(key);
+        }
+
+    ERR_remove_state(0);
+
+    CRYPTO_mem_leaks_fp(stdout);
+
+    return err;
+    }
+#endif
diff --git a/src/lib/libcrypto/sha/Makefile.ssl b/src/lib/libcrypto/sha/Makefile.ssl
index 6ea5b1d719..79ef43aa34 100644
--- a/src/lib/libcrypto/sha/Makefile.ssl
+++ b/src/lib/libcrypto/sha/Makefile.ssl
@@ -104,8 +104,8 @@ clean:
 sha1_one.o: ../../include/openssl/sha.h
 sha1dgst.o: ../../include/openssl/opensslconf.h
 sha1dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/sha.h
-sha1dgst.o: sha_locl.h
+sha1dgst.o: ../md32_common.h sha_locl.h
 sha_dgst.o: ../../include/openssl/opensslconf.h
 sha_dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/sha.h
-sha_dgst.o: sha_locl.h
+sha_dgst.o: ../md32_common.h sha_locl.h
 sha_one.o: ../../include/openssl/sha.h
diff --git a/src/lib/libcrypto/sha/asm/s1-win32.asm b/src/lib/libcrypto/sha/asm/s1-win32.asm
index 61335666b9..699afdb022 100644
--- a/src/lib/libcrypto/sha/asm/s1-win32.asm
+++ b/src/lib/libcrypto/sha/asm/s1-win32.asm
@@ -8,302 +8,303 @@
         .486
 .model FLAT
 _TEXT   SEGMENT
-PUBLIC  _sha1_block_x86
+PUBLIC  _sha1_block_asm_data_order
 
-_sha1_block_x86 PROC NEAR
+_sha1_block_asm_data_order PROC NEAR
+        mov     ecx,            DWORD PTR 12[esp]
         push    esi
+        shl     ecx,            6
+        mov     esi,            DWORD PTR 12[esp]
         push    ebp
-        mov     eax,            DWORD PTR 20[esp]
-        mov     esi,            DWORD PTR 16[esp]
-        add     eax,            esi
-        mov     ebp,            DWORD PTR 12[esp]
+        add     ecx,            esi
         push    ebx
-        sub     eax,            64
+        mov     ebp,            DWORD PTR 16[esp]
         push    edi
-        mov     ebx,            DWORD PTR 4[ebp]
-        sub     esp,            72
         mov     edx,            DWORD PTR 12[ebp]
+        sub     esp,            108
         mov     edi,            DWORD PTR 16[ebp]
-        mov     ecx,            DWORD PTR 8[ebp]
-        mov     DWORD PTR 68[esp],eax
+        mov     ebx,            DWORD PTR 8[ebp]
+        mov     DWORD PTR 68[esp],ecx
         ; First we need to setup the X array
-        mov     eax,            DWORD PTR [esi]
 L000start:
         ; First, load the words onto the stack in network byte order
+        mov     eax,            DWORD PTR [esi]
+        mov     ecx,            DWORD PTR 4[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR [esp],eax
-        mov     eax,            DWORD PTR 4[esi]
-        bswap   eax
-        mov     DWORD PTR 4[esp],eax
+        mov     DWORD PTR 4[esp],ecx
         mov     eax,            DWORD PTR 8[esi]
+        mov     ecx,            DWORD PTR 12[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 8[esp],eax
-        mov     eax,            DWORD PTR 12[esi]
-        bswap   eax
-        mov     DWORD PTR 12[esp],eax
+        mov     DWORD PTR 12[esp],ecx
         mov     eax,            DWORD PTR 16[esi]
+        mov     ecx,            DWORD PTR 20[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 16[esp],eax
-        mov     eax,            DWORD PTR 20[esi]
-        bswap   eax
-        mov     DWORD PTR 20[esp],eax
+        mov     DWORD PTR 20[esp],ecx
         mov     eax,            DWORD PTR 24[esi]
+        mov     ecx,            DWORD PTR 28[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 24[esp],eax
-        mov     eax,            DWORD PTR 28[esi]
-        bswap   eax
-        mov     DWORD PTR 28[esp],eax
+        mov     DWORD PTR 28[esp],ecx
         mov     eax,            DWORD PTR 32[esi]
+        mov     ecx,            DWORD PTR 36[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 32[esp],eax
-        mov     eax,            DWORD PTR 36[esi]
-        bswap   eax
-        mov     DWORD PTR 36[esp],eax
+        mov     DWORD PTR 36[esp],ecx
         mov     eax,            DWORD PTR 40[esi]
+        mov     ecx,            DWORD PTR 44[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 40[esp],eax
-        mov     eax,            DWORD PTR 44[esi]
-        bswap   eax
-        mov     DWORD PTR 44[esp],eax
+        mov     DWORD PTR 44[esp],ecx
         mov     eax,            DWORD PTR 48[esi]
+        mov     ecx,            DWORD PTR 52[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 48[esp],eax
-        mov     eax,            DWORD PTR 52[esi]
-        bswap   eax
-        mov     DWORD PTR 52[esp],eax
+        mov     DWORD PTR 52[esp],ecx
         mov     eax,            DWORD PTR 56[esi]
+        mov     ecx,            DWORD PTR 60[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 56[esp],eax
-        mov     eax,            DWORD PTR 60[esi]
-        bswap   eax
-        mov     DWORD PTR 60[esp],eax
+        mov     DWORD PTR 60[esp],ecx
         ; We now have the X array on the stack
         ; starting at sp-4
-        mov     DWORD PTR 64[esp],esi
+        mov     DWORD PTR 132[esp],esi
+L001shortcut:
         ; 
         ; Start processing
         mov     eax,            DWORD PTR [ebp]
+        mov     ecx,            DWORD PTR 4[ebp]
         ; 00_15 0
-        mov     esi,            ecx
+        mov     esi,            ebx
         mov     ebp,            eax
         xor     esi,            edx
         rol     ebp,            5
-        and     esi,            ebx
+        and     esi,            ecx
         add     ebp,            edi
-        ror     ebx,            1
+        ror     ecx,            1
         mov     edi,            DWORD PTR [esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     esi,            edx
         lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            ebx
+        mov     edi,            ecx
         add     esi,            ebp
-        xor     edi,            ecx
+        xor     edi,            ebx
         mov     ebp,            esi
         and     edi,            eax
         rol     ebp,            5
         add     ebp,            edx
         mov     edx,            DWORD PTR 4[esp]
         ror     eax,            1
-        xor     edi,            ecx
+        xor     edi,            ebx
         ror     eax,            1
         lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
         add     edi,            ebp
         ; 00_15 2
         mov     edx,            eax
         mov     ebp,            edi
-        xor     edx,            ebx
+        xor     edx,            ecx
         rol     ebp,            5
         and     edx,            esi
-        add     ebp,            ecx
+        add     ebp,            ebx
         ror     esi,            1
-        mov     ecx,            DWORD PTR 8[esp]
+        mov     ebx,            DWORD PTR 8[esp]
         ror     esi,            1
-        xor     edx,            ebx
-        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
-        mov     ecx,            esi
+        xor     edx,            ecx
+        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
+        mov     ebx,            esi
         add     edx,            ebp
-        xor     ecx,            eax
+        xor     ebx,            eax
         mov     ebp,            edx
-        and     ecx,            edi
+        and     ebx,            edi
         rol     ebp,            5
-        add     ebp,            ebx
-        mov     ebx,            DWORD PTR 12[esp]
+        add     ebp,            ecx
+        mov     ecx,            DWORD PTR 12[esp]
         ror     edi,            1
-        xor     ecx,            eax
+        xor     ebx,            eax
         ror     edi,            1
-        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
-        add     ecx,            ebp
+        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
+        add     ebx,            ebp
         ; 00_15 4
-        mov     ebx,            edi
-        mov     ebp,            ecx
-        xor     ebx,            esi
+        mov     ecx,            edi
+        mov     ebp,            ebx
+        xor     ecx,            esi
         rol     ebp,            5
-        and     ebx,            edx
+        and     ecx,            edx
         add     ebp,            eax
         ror     edx,            1
         mov     eax,            DWORD PTR 16[esp]
         ror     edx,            1
-        xor     ebx,            esi
+        xor     ecx,            esi
         lea     ebp,            DWORD PTR 1518500249[eax*1+ebp]
         mov     eax,            edx
-        add     ebx,            ebp
+        add     ecx,            ebp
         xor     eax,            edi
-        mov     ebp,            ebx
-        and     eax,            ecx
+        mov     ebp,            ecx
+        and     eax,            ebx
         rol     ebp,            5
         add     ebp,            esi
         mov     esi,            DWORD PTR 20[esp]
-        ror     ecx,            1
+        ror     ebx,            1
         xor     eax,            edi
-        ror     ecx,            1
+        ror     ebx,            1
         lea     ebp,            DWORD PTR 1518500249[esi*1+ebp]
         add     eax,            ebp
         ; 00_15 6
-        mov     esi,            ecx
+        mov     esi,            ebx
         mov     ebp,            eax
         xor     esi,            edx
         rol     ebp,            5
-        and     esi,            ebx
+        and     esi,            ecx
         add     ebp,            edi
-        ror     ebx,            1
+        ror     ecx,            1
         mov     edi,            DWORD PTR 24[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     esi,            edx
         lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            ebx
+        mov     edi,            ecx
         add     esi,            ebp
-        xor     edi,            ecx
+        xor     edi,            ebx
         mov     ebp,            esi
         and     edi,            eax
         rol     ebp,            5
         add     ebp,            edx
         mov     edx,            DWORD PTR 28[esp]
         ror     eax,            1
-        xor     edi,            ecx
+        xor     edi,            ebx
         ror     eax,            1
         lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
         add     edi,            ebp
         ; 00_15 8
         mov     edx,            eax
         mov     ebp,            edi
-        xor     edx,            ebx
+        xor     edx,            ecx
         rol     ebp,            5
         and     edx,            esi
-        add     ebp,            ecx
+        add     ebp,            ebx
         ror     esi,            1
-        mov     ecx,            DWORD PTR 32[esp]
+        mov     ebx,            DWORD PTR 32[esp]
         ror     esi,            1
-        xor     edx,            ebx
-        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
-        mov     ecx,            esi
+        xor     edx,            ecx
+        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
+        mov     ebx,            esi
         add     edx,            ebp
-        xor     ecx,            eax
+        xor     ebx,            eax
         mov     ebp,            edx
-        and     ecx,            edi
+        and     ebx,            edi
         rol     ebp,            5
-        add     ebp,            ebx
-        mov     ebx,            DWORD PTR 36[esp]
+        add     ebp,            ecx
+        mov     ecx,            DWORD PTR 36[esp]
         ror     edi,            1
-        xor     ecx,            eax
+        xor     ebx,            eax
         ror     edi,            1
-        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
-        add     ecx,            ebp
+        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
+        add     ebx,            ebp
         ; 00_15 10
-        mov     ebx,            edi
-        mov     ebp,            ecx
-        xor     ebx,            esi
+        mov     ecx,            edi
+        mov     ebp,            ebx
+        xor     ecx,            esi
         rol     ebp,            5
-        and     ebx,            edx
+        and     ecx,            edx
         add     ebp,            eax
         ror     edx,            1
         mov     eax,            DWORD PTR 40[esp]
         ror     edx,            1
-        xor     ebx,            esi
+        xor     ecx,            esi
         lea     ebp,            DWORD PTR 1518500249[eax*1+ebp]
         mov     eax,            edx
-        add     ebx,            ebp
+        add     ecx,            ebp
         xor     eax,            edi
-        mov     ebp,            ebx
-        and     eax,            ecx
+        mov     ebp,            ecx
+        and     eax,            ebx
         rol     ebp,            5
         add     ebp,            esi
         mov     esi,            DWORD PTR 44[esp]
-        ror     ecx,            1
+        ror     ebx,            1
         xor     eax,            edi
-        ror     ecx,            1
+        ror     ebx,            1
         lea     ebp,            DWORD PTR 1518500249[esi*1+ebp]
         add     eax,            ebp
         ; 00_15 12
-        mov     esi,            ecx
+        mov     esi,            ebx
         mov     ebp,            eax
         xor     esi,            edx
         rol     ebp,            5
-        and     esi,            ebx
+        and     esi,            ecx
         add     ebp,            edi
-        ror     ebx,            1
+        ror     ecx,            1
         mov     edi,            DWORD PTR 48[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     esi,            edx
         lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            ebx
+        mov     edi,            ecx
         add     esi,            ebp
-        xor     edi,            ecx
+        xor     edi,            ebx
         mov     ebp,            esi
         and     edi,            eax
         rol     ebp,            5
         add     ebp,            edx
         mov     edx,            DWORD PTR 52[esp]
         ror     eax,            1
-        xor     edi,            ecx
+        xor     edi,            ebx
         ror     eax,            1
         lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
         add     edi,            ebp
         ; 00_15 14
         mov     edx,            eax
         mov     ebp,            edi
-        xor     edx,            ebx
+        xor     edx,            ecx
         rol     ebp,            5
         and     edx,            esi
-        add     ebp,            ecx
+        add     ebp,            ebx
         ror     esi,            1
-        mov     ecx,            DWORD PTR 56[esp]
+        mov     ebx,            DWORD PTR 56[esp]
         ror     esi,            1
-        xor     edx,            ebx
-        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
-        mov     ecx,            esi
+        xor     edx,            ecx
+        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
+        mov     ebx,            esi
         add     edx,            ebp
-        xor     ecx,            eax
+        xor     ebx,            eax
         mov     ebp,            edx
-        and     ecx,            edi
+        and     ebx,            edi
         rol     ebp,            5
-        add     ebp,            ebx
-        mov     ebx,            DWORD PTR 60[esp]
+        add     ebp,            ecx
+        mov     ecx,            DWORD PTR 60[esp]
         ror     edi,            1
-        xor     ecx,            eax
+        xor     ebx,            eax
         ror     edi,            1
-        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
-        add     ecx,            ebp
+        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
+        add     ebx,            ebp
         ; 16_19 16
         nop
         mov     ebp,            DWORD PTR [esp]
-        mov     ebx,            DWORD PTR 8[esp]
-        xor     ebx,            ebp
+        mov     ecx,            DWORD PTR 8[esp]
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edi
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            esi
-        mov     DWORD PTR [esp],ebx
+        mov     DWORD PTR [esp],ecx
         and     ebp,            edx
-        lea     ebx,            DWORD PTR 1518500249[eax*1+ebx]
+        lea     ecx,            DWORD PTR 1518500249[eax*1+ecx]
         xor     ebp,            esi
-        mov     eax,            ecx
-        add     ebx,            ebp
+        mov     eax,            ebx
+        add     ecx,            ebp
         rol     eax,            5
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         mov     eax,            DWORD PTR 4[esp]
         mov     ebp,            DWORD PTR 12[esp]
         xor     eax,            ebp
@@ -316,14 +317,14 @@ L000start:
         mov     ebp,            edx
         xor     ebp,            edi
         mov     DWORD PTR 4[esp],eax
-        and     ebp,            ecx
+        and     ebp,            ebx
         lea     eax,            DWORD PTR 1518500249[esi*1+eax]
         xor     ebp,            edi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 16_19 18
         mov     ebp,            DWORD PTR 8[esp]
@@ -333,17 +334,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 60[esp]
         xor     esi,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     esi,            1
         xor     ebp,            edx
         mov     DWORD PTR 8[esp],esi
-        and     ebp,            ebx
+        and     ebp,            ecx
         lea     esi,            DWORD PTR 1518500249[edi*1+esi]
         xor     ebp,            edx
         mov     edi,            eax
         add     esi,            ebp
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         mov     edi,            DWORD PTR 12[esp]
         mov     ebp,            DWORD PTR 20[esp]
@@ -351,15 +352,15 @@ L000start:
         mov     ebp,            DWORD PTR 44[esp]
         xor     edi,            ebp
         mov     ebp,            DWORD PTR [esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     edi,            ebp
         rol     edi,            1
-        mov     ebp,            ebx
-        xor     ebp,            ecx
+        mov     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 12[esp],edi
         and     ebp,            eax
         lea     edi,            DWORD PTR 1518500249[edx*1+edi]
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     edx,            esi
         rol     edx,            5
         ror     eax,            1
@@ -378,54 +379,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 16[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 1859775393[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 1859775393[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 21
-        mov     ecx,            DWORD PTR 20[esp]
+        mov     ebx,            DWORD PTR 20[esp]
         mov     ebp,            DWORD PTR 28[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 8[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 20[esp],ecx
+        mov     DWORD PTR 20[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 1859775393[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 1859775393[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 22
-        mov     ebx,            DWORD PTR 24[esp]
+        mov     ecx,            DWORD PTR 24[esp]
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 24[esp],ebx
+        mov     DWORD PTR 24[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 23
         mov     eax,            DWORD PTR 28[esp]
         mov     ebp,            DWORD PTR 36[esp]
@@ -434,17 +435,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 16[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 28[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 24
         mov     esi,            DWORD PTR 32[esp]
@@ -454,17 +455,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 20[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 32[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 1859775393[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 25
         mov     edi,            DWORD PTR 36[esp]
@@ -476,9 +477,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 36[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 36[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 1859775393[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -498,54 +499,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 40[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 1859775393[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 1859775393[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 27
-        mov     ecx,            DWORD PTR 44[esp]
+        mov     ebx,            DWORD PTR 44[esp]
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 44[esp],ecx
+        mov     DWORD PTR 44[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 1859775393[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 1859775393[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 28
-        mov     ebx,            DWORD PTR 48[esp]
+        mov     ecx,            DWORD PTR 48[esp]
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 16[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 36[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 48[esp],ebx
+        mov     DWORD PTR 48[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 29
         mov     eax,            DWORD PTR 52[esp]
         mov     ebp,            DWORD PTR 60[esp]
@@ -554,17 +555,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 40[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 52[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 30
         mov     esi,            DWORD PTR 56[esp]
@@ -574,17 +575,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 44[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 56[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 1859775393[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 31
         mov     edi,            DWORD PTR 60[esp]
@@ -596,9 +597,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 60[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 60[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 1859775393[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -618,54 +619,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR [esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 1859775393[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 1859775393[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 33
-        mov     ecx,            DWORD PTR 4[esp]
+        mov     ebx,            DWORD PTR 4[esp]
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 36[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 4[esp],ecx
+        mov     DWORD PTR 4[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 1859775393[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 1859775393[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 34
-        mov     ebx,            DWORD PTR 8[esp]
+        mov     ecx,            DWORD PTR 8[esp]
         mov     ebp,            DWORD PTR 16[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 40[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 60[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 8[esp],ebx
+        mov     DWORD PTR 8[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 35
         mov     eax,            DWORD PTR 12[esp]
         mov     ebp,            DWORD PTR 20[esp]
@@ -674,17 +675,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR [esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 12[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 36
         mov     esi,            DWORD PTR 16[esp]
@@ -694,17 +695,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 4[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 16[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 1859775393[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 37
         mov     edi,            DWORD PTR 20[esp]
@@ -716,9 +717,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 20[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 20[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 1859775393[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -738,57 +739,57 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 24[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 1859775393[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 1859775393[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 39
-        mov     ecx,            DWORD PTR 28[esp]
+        mov     ebx,            DWORD PTR 28[esp]
         mov     ebp,            DWORD PTR 36[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 60[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 16[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 28[esp],ecx
+        mov     DWORD PTR 28[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 1859775393[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 1859775393[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 40_59 40
-        mov     ebx,            DWORD PTR 32[esp]
+        mov     ecx,            DWORD PTR 32[esp]
         mov     ebp,            DWORD PTR 40[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR [esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 20[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         or      ebp,            edi
-        mov     DWORD PTR 32[esp],ebx
+        mov     DWORD PTR 32[esp],ecx
         and     ebp,            esi
-        lea     ebx,            DWORD PTR 2400959708[eax*1+ebx]
+        lea     ecx,            DWORD PTR 2400959708[eax*1+ecx]
         mov     eax,            edx
         ror     edx,            1
         and     eax,            edi
         or      ebp,            eax
-        mov     eax,            ecx
+        mov     eax,            ebx
         rol     eax,            5
         add     ebp,            eax
         mov     eax,            DWORD PTR 36[esp]
-        add     ebx,            ebp
+        add     ecx,            ebp
         mov     ebp,            DWORD PTR 44[esp]
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 4[esp]
@@ -797,19 +798,19 @@ L000start:
         ror     edx,            1
         xor     eax,            ebp
         rol     eax,            1
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         mov     DWORD PTR 36[esp],eax
         or      ebp,            edx
         lea     eax,            DWORD PTR 2400959708[esi*1+eax]
-        mov     esi,            ecx
+        mov     esi,            ebx
         and     ebp,            edi
         and     esi,            edx
         or      ebp,            esi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     ebp,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 40_59 41
         ; 40_59 42
@@ -820,15 +821,15 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 28[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        or      ebp,            ecx
+        or      ebp,            ebx
         mov     DWORD PTR 40[esp],esi
         and     ebp,            edx
         lea     esi,            DWORD PTR 2400959708[edi*1+esi]
-        mov     edi,            ebx
-        ror     ebx,            1
-        and     edi,            ecx
+        mov     edi,            ecx
+        ror     ecx,            1
+        and     edi,            ebx
         or      ebp,            edi
         mov     edi,            eax
         rol     edi,            5
@@ -840,16 +841,16 @@ L000start:
         mov     ebp,            DWORD PTR 12[esp]
         xor     edi,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     edi,            ebp
         rol     edi,            1
         mov     ebp,            eax
         mov     DWORD PTR 44[esp],edi
-        or      ebp,            ebx
+        or      ebp,            ecx
         lea     edi,            DWORD PTR 2400959708[edx*1+edi]
         mov     edx,            eax
-        and     ebp,            ecx
-        and     edx,            ebx
+        and     ebp,            ebx
+        and     edx,            ecx
         or      ebp,            edx
         mov     edx,            esi
         rol     edx,            5
@@ -870,63 +871,63 @@ L000start:
         rol     edx,            1
         or      ebp,            eax
         mov     DWORD PTR 48[esp],edx
-        and     ebp,            ebx
-        lea     edx,            DWORD PTR 2400959708[ecx*1+edx]
-        mov     ecx,            esi
+        and     ebp,            ecx
+        lea     edx,            DWORD PTR 2400959708[ebx*1+edx]
+        mov     ebx,            esi
         ror     esi,            1
-        and     ecx,            eax
-        or      ebp,            ecx
-        mov     ecx,            edi
-        rol     ecx,            5
-        add     ebp,            ecx
-        mov     ecx,            DWORD PTR 52[esp]
+        and     ebx,            eax
+        or      ebp,            ebx
+        mov     ebx,            edi
+        rol     ebx,            5
+        add     ebp,            ebx
+        mov     ebx,            DWORD PTR 52[esp]
         add     edx,            ebp
         mov     ebp,            DWORD PTR 60[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 20[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 40[esp]
         ror     esi,            1
-        xor     ecx,            ebp
-        rol     ecx,            1
+        xor     ebx,            ebp
+        rol     ebx,            1
         mov     ebp,            edi
-        mov     DWORD PTR 52[esp],ecx
+        mov     DWORD PTR 52[esp],ebx
         or      ebp,            esi
-        lea     ecx,            DWORD PTR 2400959708[ebx*1+ecx]
-        mov     ebx,            edi
+        lea     ebx,            DWORD PTR 2400959708[ecx*1+ebx]
+        mov     ecx,            edi
         and     ebp,            eax
-        and     ebx,            esi
-        or      ebp,            ebx
-        mov     ebx,            edx
-        rol     ebx,            5
+        and     ecx,            esi
+        or      ebp,            ecx
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebp,            ebx
+        add     ebp,            ecx
         ror     edi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ; 40_59 45
         ; 40_59 46
-        mov     ebx,            DWORD PTR 56[esp]
+        mov     ecx,            DWORD PTR 56[esp]
         mov     ebp,            DWORD PTR [esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 24[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 44[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         or      ebp,            edi
-        mov     DWORD PTR 56[esp],ebx
+        mov     DWORD PTR 56[esp],ecx
         and     ebp,            esi
-        lea     ebx,            DWORD PTR 2400959708[eax*1+ebx]
+        lea     ecx,            DWORD PTR 2400959708[eax*1+ecx]
         mov     eax,            edx
         ror     edx,            1
         and     eax,            edi
         or      ebp,            eax
-        mov     eax,            ecx
+        mov     eax,            ebx
         rol     eax,            5
         add     ebp,            eax
         mov     eax,            DWORD PTR 60[esp]
-        add     ebx,            ebp
+        add     ecx,            ebp
         mov     ebp,            DWORD PTR 4[esp]
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 28[esp]
@@ -935,19 +936,19 @@ L000start:
         ror     edx,            1
         xor     eax,            ebp
         rol     eax,            1
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         mov     DWORD PTR 60[esp],eax
         or      ebp,            edx
         lea     eax,            DWORD PTR 2400959708[esi*1+eax]
-        mov     esi,            ecx
+        mov     esi,            ebx
         and     ebp,            edi
         and     esi,            edx
         or      ebp,            esi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     ebp,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 40_59 47
         ; 40_59 48
@@ -958,15 +959,15 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 52[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        or      ebp,            ecx
+        or      ebp,            ebx
         mov     DWORD PTR [esp],esi
         and     ebp,            edx
         lea     esi,            DWORD PTR 2400959708[edi*1+esi]
-        mov     edi,            ebx
-        ror     ebx,            1
-        and     edi,            ecx
+        mov     edi,            ecx
+        ror     ecx,            1
+        and     edi,            ebx
         or      ebp,            edi
         mov     edi,            eax
         rol     edi,            5
@@ -978,16 +979,16 @@ L000start:
         mov     ebp,            DWORD PTR 36[esp]
         xor     edi,            ebp
         mov     ebp,            DWORD PTR 56[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     edi,            ebp
         rol     edi,            1
         mov     ebp,            eax
         mov     DWORD PTR 4[esp],edi
-        or      ebp,            ebx
+        or      ebp,            ecx
         lea     edi,            DWORD PTR 2400959708[edx*1+edi]
         mov     edx,            eax
-        and     ebp,            ecx
-        and     edx,            ebx
+        and     ebp,            ebx
+        and     edx,            ecx
         or      ebp,            edx
         mov     edx,            esi
         rol     edx,            5
@@ -1008,63 +1009,63 @@ L000start:
         rol     edx,            1
         or      ebp,            eax
         mov     DWORD PTR 8[esp],edx
-        and     ebp,            ebx
-        lea     edx,            DWORD PTR 2400959708[ecx*1+edx]
-        mov     ecx,            esi
+        and     ebp,            ecx
+        lea     edx,            DWORD PTR 2400959708[ebx*1+edx]
+        mov     ebx,            esi
         ror     esi,            1
-        and     ecx,            eax
-        or      ebp,            ecx
-        mov     ecx,            edi
-        rol     ecx,            5
-        add     ebp,            ecx
-        mov     ecx,            DWORD PTR 12[esp]
+        and     ebx,            eax
+        or      ebp,            ebx
+        mov     ebx,            edi
+        rol     ebx,            5
+        add     ebp,            ebx
+        mov     ebx,            DWORD PTR 12[esp]
         add     edx,            ebp
         mov     ebp,            DWORD PTR 20[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 44[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR [esp]
         ror     esi,            1
-        xor     ecx,            ebp
-        rol     ecx,            1
+        xor     ebx,            ebp
+        rol     ebx,            1
         mov     ebp,            edi
-        mov     DWORD PTR 12[esp],ecx
+        mov     DWORD PTR 12[esp],ebx
         or      ebp,            esi
-        lea     ecx,            DWORD PTR 2400959708[ebx*1+ecx]
-        mov     ebx,            edi
+        lea     ebx,            DWORD PTR 2400959708[ecx*1+ebx]
+        mov     ecx,            edi
         and     ebp,            eax
-        and     ebx,            esi
-        or      ebp,            ebx
-        mov     ebx,            edx
-        rol     ebx,            5
+        and     ecx,            esi
+        or      ebp,            ecx
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebp,            ebx
+        add     ebp,            ecx
         ror     edi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ; 40_59 51
         ; 40_59 52
-        mov     ebx,            DWORD PTR 16[esp]
+        mov     ecx,            DWORD PTR 16[esp]
         mov     ebp,            DWORD PTR 24[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 48[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 4[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         or      ebp,            edi
-        mov     DWORD PTR 16[esp],ebx
+        mov     DWORD PTR 16[esp],ecx
         and     ebp,            esi
-        lea     ebx,            DWORD PTR 2400959708[eax*1+ebx]
+        lea     ecx,            DWORD PTR 2400959708[eax*1+ecx]
         mov     eax,            edx
         ror     edx,            1
         and     eax,            edi
         or      ebp,            eax
-        mov     eax,            ecx
+        mov     eax,            ebx
         rol     eax,            5
         add     ebp,            eax
         mov     eax,            DWORD PTR 20[esp]
-        add     ebx,            ebp
+        add     ecx,            ebp
         mov     ebp,            DWORD PTR 28[esp]
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 52[esp]
@@ -1073,19 +1074,19 @@ L000start:
         ror     edx,            1
         xor     eax,            ebp
         rol     eax,            1
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         mov     DWORD PTR 20[esp],eax
         or      ebp,            edx
         lea     eax,            DWORD PTR 2400959708[esi*1+eax]
-        mov     esi,            ecx
+        mov     esi,            ebx
         and     ebp,            edi
         and     esi,            edx
         or      ebp,            esi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     ebp,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 40_59 53
         ; 40_59 54
@@ -1096,15 +1097,15 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 12[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        or      ebp,            ecx
+        or      ebp,            ebx
         mov     DWORD PTR 24[esp],esi
         and     ebp,            edx
         lea     esi,            DWORD PTR 2400959708[edi*1+esi]
-        mov     edi,            ebx
-        ror     ebx,            1
-        and     edi,            ecx
+        mov     edi,            ecx
+        ror     ecx,            1
+        and     edi,            ebx
         or      ebp,            edi
         mov     edi,            eax
         rol     edi,            5
@@ -1116,16 +1117,16 @@ L000start:
         mov     ebp,            DWORD PTR 60[esp]
         xor     edi,            ebp
         mov     ebp,            DWORD PTR 16[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     edi,            ebp
         rol     edi,            1
         mov     ebp,            eax
         mov     DWORD PTR 28[esp],edi
-        or      ebp,            ebx
+        or      ebp,            ecx
         lea     edi,            DWORD PTR 2400959708[edx*1+edi]
         mov     edx,            eax
-        and     ebp,            ecx
-        and     edx,            ebx
+        and     ebp,            ebx
+        and     edx,            ecx
         or      ebp,            edx
         mov     edx,            esi
         rol     edx,            5
@@ -1146,63 +1147,63 @@ L000start:
         rol     edx,            1
         or      ebp,            eax
         mov     DWORD PTR 32[esp],edx
-        and     ebp,            ebx
-        lea     edx,            DWORD PTR 2400959708[ecx*1+edx]
-        mov     ecx,            esi
+        and     ebp,            ecx
+        lea     edx,            DWORD PTR 2400959708[ebx*1+edx]
+        mov     ebx,            esi
         ror     esi,            1
-        and     ecx,            eax
-        or      ebp,            ecx
-        mov     ecx,            edi
-        rol     ecx,            5
-        add     ebp,            ecx
-        mov     ecx,            DWORD PTR 36[esp]
+        and     ebx,            eax
+        or      ebp,            ebx
+        mov     ebx,            edi
+        rol     ebx,            5
+        add     ebp,            ebx
+        mov     ebx,            DWORD PTR 36[esp]
         add     edx,            ebp
         mov     ebp,            DWORD PTR 44[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 4[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 24[esp]
         ror     esi,            1
-        xor     ecx,            ebp
-        rol     ecx,            1
+        xor     ebx,            ebp
+        rol     ebx,            1
         mov     ebp,            edi
-        mov     DWORD PTR 36[esp],ecx
+        mov     DWORD PTR 36[esp],ebx
         or      ebp,            esi
-        lea     ecx,            DWORD PTR 2400959708[ebx*1+ecx]
-        mov     ebx,            edi
+        lea     ebx,            DWORD PTR 2400959708[ecx*1+ebx]
+        mov     ecx,            edi
         and     ebp,            eax
-        and     ebx,            esi
-        or      ebp,            ebx
-        mov     ebx,            edx
-        rol     ebx,            5
+        and     ecx,            esi
+        or      ebp,            ecx
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebp,            ebx
+        add     ebp,            ecx
         ror     edi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ; 40_59 57
         ; 40_59 58
-        mov     ebx,            DWORD PTR 40[esp]
+        mov     ecx,            DWORD PTR 40[esp]
         mov     ebp,            DWORD PTR 48[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 8[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 28[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         or      ebp,            edi
-        mov     DWORD PTR 40[esp],ebx
+        mov     DWORD PTR 40[esp],ecx
         and     ebp,            esi
-        lea     ebx,            DWORD PTR 2400959708[eax*1+ebx]
+        lea     ecx,            DWORD PTR 2400959708[eax*1+ecx]
         mov     eax,            edx
         ror     edx,            1
         and     eax,            edi
         or      ebp,            eax
-        mov     eax,            ecx
+        mov     eax,            ebx
         rol     eax,            5
         add     ebp,            eax
         mov     eax,            DWORD PTR 44[esp]
-        add     ebx,            ebp
+        add     ecx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 12[esp]
@@ -1211,19 +1212,19 @@ L000start:
         ror     edx,            1
         xor     eax,            ebp
         rol     eax,            1
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         mov     DWORD PTR 44[esp],eax
         or      ebp,            edx
         lea     eax,            DWORD PTR 2400959708[esi*1+eax]
-        mov     esi,            ecx
+        mov     esi,            ebx
         and     ebp,            edi
         and     esi,            edx
         or      ebp,            esi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     ebp,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 40_59 59
         ; 20_39 60
@@ -1234,17 +1235,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 36[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 48[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 3395469782[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 61
         mov     edi,            DWORD PTR 52[esp]
@@ -1256,9 +1257,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 52[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 52[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 3395469782[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -1278,54 +1279,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 56[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 3395469782[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 3395469782[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 63
-        mov     ecx,            DWORD PTR 60[esp]
+        mov     ebx,            DWORD PTR 60[esp]
         mov     ebp,            DWORD PTR 4[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 28[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 48[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 60[esp],ecx
+        mov     DWORD PTR 60[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 3395469782[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 3395469782[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 64
-        mov     ebx,            DWORD PTR [esp]
+        mov     ecx,            DWORD PTR [esp]
         mov     ebp,            DWORD PTR 8[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR [esp],ebx
+        mov     DWORD PTR [esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 3395469782[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 3395469782[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 65
         mov     eax,            DWORD PTR 4[esp]
         mov     ebp,            DWORD PTR 12[esp]
@@ -1334,17 +1335,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 56[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 4[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 3395469782[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 66
         mov     esi,            DWORD PTR 8[esp]
@@ -1354,17 +1355,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 60[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 8[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 3395469782[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 67
         mov     edi,            DWORD PTR 12[esp]
@@ -1376,9 +1377,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 12[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 12[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 3395469782[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -1398,54 +1399,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 16[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 3395469782[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 3395469782[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 69
-        mov     ecx,            DWORD PTR 20[esp]
+        mov     ebx,            DWORD PTR 20[esp]
         mov     ebp,            DWORD PTR 28[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 8[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 20[esp],ecx
+        mov     DWORD PTR 20[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 3395469782[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 3395469782[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 70
-        mov     ebx,            DWORD PTR 24[esp]
+        mov     ecx,            DWORD PTR 24[esp]
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 24[esp],ebx
+        mov     DWORD PTR 24[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 3395469782[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 3395469782[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 71
         mov     eax,            DWORD PTR 28[esp]
         mov     ebp,            DWORD PTR 36[esp]
@@ -1454,17 +1455,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 16[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 28[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 3395469782[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 72
         mov     esi,            DWORD PTR 32[esp]
@@ -1474,17 +1475,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 20[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 32[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 3395469782[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 73
         mov     edi,            DWORD PTR 36[esp]
@@ -1496,9 +1497,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 36[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 36[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 3395469782[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -1518,54 +1519,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 40[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 3395469782[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 3395469782[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 75
-        mov     ecx,            DWORD PTR 44[esp]
+        mov     ebx,            DWORD PTR 44[esp]
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 44[esp],ecx
+        mov     DWORD PTR 44[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 3395469782[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 3395469782[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 76
-        mov     ebx,            DWORD PTR 48[esp]
+        mov     ecx,            DWORD PTR 48[esp]
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 16[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 36[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 48[esp],ebx
+        mov     DWORD PTR 48[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 3395469782[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 3395469782[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 77
         mov     eax,            DWORD PTR 52[esp]
         mov     ebp,            DWORD PTR 60[esp]
@@ -1574,17 +1575,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 40[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 52[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 3395469782[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 78
         mov     esi,            DWORD PTR 56[esp]
@@ -1594,17 +1595,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 44[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 56[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 3395469782[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 79
         mov     edi,            DWORD PTR 60[esp]
@@ -1616,49 +1617,100 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 60[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 60[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 3395469782[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
         add     edx,            ebp
-        mov     ebp,            DWORD PTR 92[esp]
+        mov     ebp,            DWORD PTR 128[esp]
         ror     eax,            1
         add     edi,            edx
         ror     eax,            1
         ; End processing
         ; 
         mov     edx,            DWORD PTR 12[ebp]
-        add     edx,            ebx
-        mov     ebx,            DWORD PTR 4[ebp]
-        add     ebx,            esi
+        add     edx,            ecx
+        mov     ecx,            DWORD PTR 4[ebp]
+        add     ecx,            esi
         mov     esi,            eax
         mov     eax,            DWORD PTR [ebp]
         mov     DWORD PTR 12[ebp],edx
         add     eax,            edi
         mov     edi,            DWORD PTR 16[ebp]
-        add     edi,            ecx
-        mov     ecx,            DWORD PTR 8[ebp]
-        add     ecx,            esi
+        add     edi,            ebx
+        mov     ebx,            DWORD PTR 8[ebp]
+        add     ebx,            esi
         mov     DWORD PTR [ebp],eax
-        mov     esi,            DWORD PTR 64[esp]
-        mov     DWORD PTR 8[ebp],ecx
+        mov     esi,            DWORD PTR 132[esp]
+        mov     DWORD PTR 8[ebp],ebx
         add     esi,            64
         mov     eax,            DWORD PTR 68[esp]
         mov     DWORD PTR 16[ebp],edi
-        cmp     eax,            esi
-        mov     DWORD PTR 4[ebp],ebx
-        jl      $L001end
-        mov     eax,            DWORD PTR [esi]
-        jmp     L000start
-$L001end:
-        add     esp,            72
+        cmp     esi,            eax
+        mov     DWORD PTR 4[ebp],ecx
+        jl      L000start
+        add     esp,            108
         pop     edi
         pop     ebx
         pop     ebp
         pop     esi
         ret
-_sha1_block_x86 ENDP
+_TEXT   SEGMENT
+PUBLIC  _sha1_block_asm_host_order
+
+_sha1_block_asm_host_order PROC NEAR
+        mov     ecx,            DWORD PTR 12[esp]
+        push    esi
+        shl     ecx,            6
+        mov     esi,            DWORD PTR 12[esp]
+        push    ebp
+        add     ecx,            esi
+        push    ebx
+        mov     ebp,            DWORD PTR 16[esp]
+        push    edi
+        mov     edx,            DWORD PTR 12[ebp]
+        sub     esp,            108
+        mov     edi,            DWORD PTR 16[ebp]
+        mov     ebx,            DWORD PTR 8[ebp]
+        mov     DWORD PTR 68[esp],ecx
+        ; First we need to setup the X array
+        mov     eax,            DWORD PTR [esi]
+        mov     ecx,            DWORD PTR 4[esi]
+        mov     DWORD PTR [esp],eax
+        mov     DWORD PTR 4[esp],ecx
+        mov     eax,            DWORD PTR 8[esi]
+        mov     ecx,            DWORD PTR 12[esi]
+        mov     DWORD PTR 8[esp],eax
+        mov     DWORD PTR 12[esp],ecx
+        mov     eax,            DWORD PTR 16[esi]
+        mov     ecx,            DWORD PTR 20[esi]
+        mov     DWORD PTR 16[esp],eax
+        mov     DWORD PTR 20[esp],ecx
+        mov     eax,            DWORD PTR 24[esi]
+        mov     ecx,            DWORD PTR 28[esi]
+        mov     DWORD PTR 24[esp],eax
+        mov     DWORD PTR 28[esp],ecx
+        mov     eax,            DWORD PTR 32[esi]
+        mov     ecx,            DWORD PTR 36[esi]
+        mov     DWORD PTR 32[esp],eax
+        mov     DWORD PTR 36[esp],ecx
+        mov     eax,            DWORD PTR 40[esi]
+        mov     ecx,            DWORD PTR 44[esi]
+        mov     DWORD PTR 40[esp],eax
+        mov     DWORD PTR 44[esp],ecx
+        mov     eax,            DWORD PTR 48[esi]
+        mov     ecx,            DWORD PTR 52[esi]
+        mov     DWORD PTR 48[esp],eax
+        mov     DWORD PTR 52[esp],ecx
+        mov     eax,            DWORD PTR 56[esi]
+        mov     ecx,            DWORD PTR 60[esi]
+        mov     DWORD PTR 56[esp],eax
+        mov     DWORD PTR 60[esp],ecx
+        jmp     L001shortcut
+_sha1_block_asm_host_order ENDP
+_TEXT   ENDS
+_sha1_block_asm_data_order ENDP
 _TEXT   ENDS
 END
diff --git a/src/lib/libcrypto/sha/asm/sha1-586.pl b/src/lib/libcrypto/sha/asm/sha1-586.pl
index 04e42ab09f..48d9192a4e 100644
--- a/src/lib/libcrypto/sha/asm/sha1-586.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-586.pl
@@ -8,8 +8,8 @@ require "x86asm.pl";
 &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386");
 
 $A="eax";
-$B="ebx";
-$C="ecx";
+$B="ecx";
+$C="ebx";
 $D="edx";
 $E="edi";
 $T="esi";
@@ -19,7 +19,7 @@ $off=9*4;
 
 @K=(0x5a827999,0x6ed9eba1,0x8f1bbcdc,0xca62c1d6);
 
-&sha1_block("sha1_block_x86");
+&sha1_block_data("sha1_block_asm_data_order");
 
 &asm_finish();
 
@@ -53,11 +53,14 @@ sub X_expand
         local($in)=@_;
 
         &comment("First, load the words onto the stack in network byte order");
-        for ($i=0; $i<16; $i++)
+        for ($i=0; $i<16; $i+=2)
                 {
-                &mov("eax",&DWP(($i+0)*4,$in,"",0)) unless $i == 0;
-                &bswap("eax");
-                &mov(&swtmp($i+0),"eax");
+                &mov($A,&DWP(($i+0)*4,$in,"",0));# unless $i == 0;
+                 &mov($B,&DWP(($i+1)*4,$in,"",0));
+                &bswap($A);
+                 &bswap($B);
+                &mov(&swtmp($i+0),$A);
+                 &mov(&swtmp($i+1),$B);
                 }
 
         &comment("We now have the X array on the stack");
@@ -312,7 +315,7 @@ sub BODY_60_79
         &BODY_20_39(@_);
         }
 
-sub sha1_block
+sub sha1_block_host
         {
         local($name)=@_;
 
@@ -325,35 +328,77 @@ sub sha1_block
         # D     12
         # E     16
 
-        &push("esi");
-         &push("ebp");
-        &mov("eax",     &wparam(2));
+        &mov("ecx",     &wparam(2));
+         &push("esi");
+        &shl("ecx",6);
          &mov("esi",    &wparam(1));
-        &add("eax",     "esi"); # offset to leave on
+        &push("ebp");
+         &add("ecx","esi");     # offset to leave on
+        &push("ebx");
          &mov("ebp",    &wparam(0));
+        &push("edi");
+         &mov($D,       &DWP(12,"ebp","",0));
+        &stack_push(18+9);
+         &mov($E,       &DWP(16,"ebp","",0));
+        &mov($C,        &DWP( 8,"ebp","",0));
+         &mov(&swtmp(17),"ecx");
+
+        &comment("First we need to setup the X array");
+
+        for ($i=0; $i<16; $i+=2)
+                {
+                &mov($A,&DWP(($i+0)*4,"esi","",0));# unless $i == 0;
+                 &mov($B,&DWP(($i+1)*4,"esi","",0));
+                &mov(&swtmp($i+0),$A);
+                 &mov(&swtmp($i+1),$B);
+                }
+        &jmp(&label("shortcut"));
+        &function_end_B($name);
+        }
+
+
+sub sha1_block_data
+        {
+        local($name)=@_;
+
+        &function_begin_B($name,"");
+
+        # parameter 1 is the MD5_CTX structure.
+        # A     0
+        # B     4
+        # C     8
+        # D     12
+        # E     16
+
+        &mov("ecx",     &wparam(2));
+         &push("esi");
+        &shl("ecx",6);
+         &mov("esi",    &wparam(1));
+        &push("ebp");
+         &add("ecx","esi");     # offset to leave on
         &push("ebx");
-         &sub("eax",    64);
+         &mov("ebp",    &wparam(0));
         &push("edi");
-         &mov($B,       &DWP( 4,"ebp","",0));
-        &stack_push(18);
          &mov($D,       &DWP(12,"ebp","",0));
-        &mov($E,        &DWP(16,"ebp","",0));
-         &mov($C,       &DWP( 8,"ebp","",0));
-        &mov(&swtmp(17),"eax");
+        &stack_push(18+9);
+         &mov($E,       &DWP(16,"ebp","",0));
+        &mov($C,        &DWP( 8,"ebp","",0));
+         &mov(&swtmp(17),"ecx");
 
         &comment("First we need to setup the X array");
-         &mov("eax",&DWP(0,"esi","",0)); # pulled out of X_expand
 
         &set_label("start") unless $normal;
 
         &X_expand("esi");
-         &mov(&swtmp(16),"esi");
+         &mov(&wparam(1),"esi");
 
+        &set_label("shortcut", 1);
         &comment("");
         &comment("Start processing");
 
         # odd start
         &mov($A,        &DWP( 0,"ebp","",0));
+         &mov($B,       &DWP( 4,"ebp","",0));
         $X="esp";
         &BODY_00_15(-2,$K[0],$X, 0,$A,$B,$C,$D,$E,$T);
         &BODY_00_15( 0,$K[0],$X, 1,$T,$A,$B,$C,$D,$E);
@@ -468,24 +513,26 @@ sub sha1_block
         &add($C,$T);
 
          &mov(&DWP( 0,$tmp1,"",0),$A);
-        &mov("esi",&swtmp(16));
-         &mov(&DWP( 8,$tmp1,"",0),$C);  # This is for looping
+        &mov("esi",&wparam(1));
+         &mov(&DWP( 8,$tmp1,"",0),$C);
         &add("esi",64);
          &mov("eax",&swtmp(17));
         &mov(&DWP(16,$tmp1,"",0),$E);
-         &cmp("eax","esi");
-        &mov(&DWP( 4,$tmp1,"",0),$B);   # This is for looping
-         &jl(&label("end"));
-        &mov("eax",&DWP(0,"esi","",0)); # Pulled down from 
-         &jmp(&label("start"));
-
-        &set_label("end");
-        &stack_pop(18);
+         &cmp("esi","eax");
+        &mov(&DWP( 4,$tmp1,"",0),$B);
+         &jl(&label("start"));
+
+        &stack_pop(18+9);
          &pop("edi");
         &pop("ebx");
          &pop("ebp");
         &pop("esi");
          &ret();
+
+        # it has to reside within sha1_block_asm_host_order body
+        # because it calls &jmp(&label("shortcut"));
+        &sha1_block_host("sha1_block_asm_host_order");
+
         &function_end_B($name);
         }
 
diff --git a/src/lib/libcrypto/sha/sha.h b/src/lib/libcrypto/sha/sha.h
index cd6960ee1a..77f6d9695e 100644
--- a/src/lib/libcrypto/sha/sha.h
+++ b/src/lib/libcrypto/sha/sha.h
@@ -63,7 +63,7 @@
 extern "C" {
 #endif
 
-#ifdef NO_SHA
+#if defined(NO_SHA) || (defined(NO_SHA0) && defined(NO_SHA1))
 #error SHA is disabled.
 #endif
 
@@ -100,17 +100,17 @@ typedef struct SHAstate_st
 
 #ifndef NO_SHA0
 void SHA_Init(SHA_CTX *c);
-void SHA_Update(SHA_CTX *c, const unsigned char *data, unsigned long len);
+void SHA_Update(SHA_CTX *c, const void *data, unsigned long len);
 void SHA_Final(unsigned char *md, SHA_CTX *c);
 unsigned char *SHA(const unsigned char *d, unsigned long n,unsigned char *md);
-void SHA_Transform(SHA_CTX *c, unsigned char *data);
+void SHA_Transform(SHA_CTX *c, const unsigned char *data);
 #endif
 #ifndef NO_SHA1
 void SHA1_Init(SHA_CTX *c);
-void SHA1_Update(SHA_CTX *c, const unsigned char *data, unsigned long len);
+void SHA1_Update(SHA_CTX *c, const void *data, unsigned long len);
 void SHA1_Final(unsigned char *md, SHA_CTX *c);
 unsigned char *SHA1(const unsigned char *d, unsigned long n,unsigned char *md);
-void SHA1_Transform(SHA_CTX *c, unsigned char *data);
+void SHA1_Transform(SHA_CTX *c, const unsigned char *data);
 #endif
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libcrypto/sha/sha1dgst.c b/src/lib/libcrypto/sha/sha1dgst.c
index 66e885dd76..c09edb4cd7 100644
--- a/src/lib/libcrypto/sha/sha1dgst.c
+++ b/src/lib/libcrypto/sha/sha1dgst.c
@@ -56,443 +56,18 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
-#include <string.h>
+#if !defined(NO_SHA1) && !defined(NO_SHA)
+
 #undef  SHA_0
 #define SHA_1
-#include <openssl/sha.h>
-#include "sha_locl.h"
-#include <openssl/opensslv.h>
-
-#ifndef NO_SHA1
-char *SHA1_version="SHA1" OPENSSL_VERSION_PTEXT;
-
-/* Implemented from SHA-1 document - The Secure Hash Algorithm
- */
-
-#define INIT_DATA_h0 0x67452301UL
-#define INIT_DATA_h1 0xefcdab89UL
-#define INIT_DATA_h2 0x98badcfeUL
-#define INIT_DATA_h3 0x10325476UL
-#define INIT_DATA_h4 0xc3d2e1f0UL
-
-#define K_00_19 0x5a827999UL
-#define K_20_39 0x6ed9eba1UL
-#define K_40_59 0x8f1bbcdcUL
-#define K_60_79 0xca62c1d6UL
-
-#ifdef SHA1_ASM
-   void sha1_block_x86(SHA_CTX *c, register SHA_LONG *p, int num);
-#  define sha1_block(c,p,n) sha1_block_x86((c),(p),(n)*SHA_CBLOCK)
-#else
-   static void sha1_block(SHA_CTX *c, register SHA_LONG *p, int num);
-#endif
-
-#if !defined(B_ENDIAN) && defined(SHA1_ASM)
-#  define       M_c2nl          c2l
-#  define       M_p_c2nl        p_c2l
-#  define       M_c2nl_p        c2l_p
-#  define       M_p_c2nl_p      p_c2l_p
-#  define       M_nl2c          l2c
-#else
-#  define       M_c2nl          c2nl
-#  define       M_p_c2nl        p_c2nl
-#  define       M_c2nl_p        c2nl_p
-#  define       M_p_c2nl_p      p_c2nl_p
-#  define       M_nl2c          nl2c
-#endif
-
-void SHA1_Init(SHA_CTX *c)
-        {
-        c->h0=INIT_DATA_h0;
-        c->h1=INIT_DATA_h1;
-        c->h2=INIT_DATA_h2;
-        c->h3=INIT_DATA_h3;
-        c->h4=INIT_DATA_h4;
-        c->Nl=0;
-        c->Nh=0;
-        c->num=0;
-        }
-
-void SHA1_Update(SHA_CTX *c, register const unsigned char *data,
-             unsigned long len)
-        {
-        register SHA_LONG *p;
-        int ew,ec,sw,sc;
-        SHA_LONG l;
-
-        if (len == 0) return;
-
-        l=(c->Nl+(len<<3))&0xffffffffL;
-        if (l < c->Nl) /* overflow */
-                c->Nh++;
-        c->Nh+=(len>>29);
-        c->Nl=l;
-
-        if (c->num != 0)
-                {
-                p=c->data;
-                sw=c->num>>2;
-                sc=c->num&0x03;
-
-                if ((c->num+len) >= SHA_CBLOCK)
-                        {
-                        l= p[sw];
-                        M_p_c2nl(data,l,sc);
-                        p[sw++]=l;
-                        for (; sw<SHA_LBLOCK; sw++)
-                                {
-                                M_c2nl(data,l);
-                                p[sw]=l;
-                                }
-                        len-=(SHA_CBLOCK-c->num);
-
-                        sha1_block(c,p,1);
-                        c->num=0;
-                        /* drop through and do the rest */
-                        }
-                else
-                        {
-                        c->num+=(int)len;
-                        if ((sc+len) < 4) /* ugly, add char's to a word */
-                                {
-                                l= p[sw];
-                                M_p_c2nl_p(data,l,sc,len);
-                                p[sw]=l;
-                                }
-                        else
-                                {
-                                ew=(c->num>>2);
-                                ec=(c->num&0x03);
-                                l= p[sw];
-                                M_p_c2nl(data,l,sc);
-                                p[sw++]=l;
-                                for (; sw < ew; sw++)
-                                        { M_c2nl(data,l); p[sw]=l; }
-                                if (ec)
-                                        {
-                                        M_c2nl_p(data,l,ec);
-                                        p[sw]=l;
-                                        }
-                                }
-                        return;
-                        }
-                }
-        /* We can only do the following code for assember, the reason
-         * being that the sha1_block 'C' version changes the values
-         * in the 'data' array.  The assember code avoids this and
-         * copies it to a local array.  I should be able to do this for
-         * the C version as well....
-         */
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA1_ASM)
-        if ((((unsigned long)data)%sizeof(SHA_LONG)) == 0)
-                {
-                sw=len/SHA_CBLOCK;
-                if (sw)
-                        {
-                        sha1_block(c,(SHA_LONG *)data,sw);
-                        sw*=SHA_CBLOCK;
-                        data+=sw;
-                        len-=sw;
-                        }
-                }
-#endif
-#endif
-        /* we now can process the input data in blocks of SHA_CBLOCK
-         * chars and save the leftovers to c->data. */
-        p=c->data;
-        while (len >= SHA_CBLOCK)
-                {
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA1_ASM)
-#define SHA_NO_TAIL_CODE
-                /*
-                 * Basically we get here only when data happens
-                 * to be unaligned.
-                 */
-                if (p != (SHA_LONG *)data)
-                        memcpy(p,data,SHA_CBLOCK);
-                data+=SHA_CBLOCK;
-                sha1_block(c,p=c->data,1);
-                len-=SHA_CBLOCK;
-#elif defined(L_ENDIAN)
-#define BE_COPY(dst,src,i)      {                               \
-                                l = ((SHA_LONG *)src)[i];       \
-                                Endian_Reverse32(l);            \
-                                dst[i] = l;                     \
-                                }
-                if ((((unsigned long)data)%sizeof(SHA_LONG)) == 0)
-                        {
-                        for (sw=(SHA_LBLOCK/4); sw; sw--)
-                                {
-                                BE_COPY(p,data,0);
-                                BE_COPY(p,data,1);
-                                BE_COPY(p,data,2);
-                                BE_COPY(p,data,3);
-                                p+=4;
-                                data += 4*sizeof(SHA_LONG);
-                                }
-                        sha1_block(c,p=c->data,1);
-                        len-=SHA_CBLOCK;
-                        continue;
-                        }
-#endif
-#endif
-#ifndef SHA_NO_TAIL_CODE
-                /*
-                 * In addition to "sizeof(SHA_LONG)!= 4" case the
-                 * following code covers unaligned access cases on
-                 * little-endian machines.
-                 *                      <appro@fy.chalmers.se>
-                 */
-                p=c->data;
-                for (sw=(SHA_LBLOCK/4); sw; sw--)
-                        {
-                        M_c2nl(data,l); p[0]=l;
-                        M_c2nl(data,l); p[1]=l;
-                        M_c2nl(data,l); p[2]=l;
-                        M_c2nl(data,l); p[3]=l;
-                        p+=4;
-                        }
-                p=c->data;
-                sha1_block(c,p,1);
-                len-=SHA_CBLOCK;
-#endif
-                }
-        ec=(int)len;
-        c->num=ec;
-        ew=(ec>>2);
-        ec&=0x03;
-
-        for (sw=0; sw < ew; sw++)
-                { M_c2nl(data,l); p[sw]=l; }
-        M_c2nl_p(data,l,ec);
-        p[sw]=l;
-        }
-
-void SHA1_Transform(SHA_CTX *c, unsigned char *b)
-        {
-        SHA_LONG p[SHA_LBLOCK];
-
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA1_ASM)
-        memcpy(p,b,SHA_CBLOCK);
-        sha1_block(c,p,1);
-        return;
-#elif defined(L_ENDIAN)
-        if (((unsigned long)b%sizeof(SHA_LONG)) == 0)
-                {
-                SHA_LONG *q;
-                int i;
-
-                q=p;
-                for (i=(SHA_LBLOCK/4); i; i--)
-                        {
-                        unsigned long l;
-                        BE_COPY(q,b,0); /* BE_COPY was defined above */
-                        BE_COPY(q,b,1);
-                        BE_COPY(q,b,2);
-                        BE_COPY(q,b,3);
-                        q+=4;
-                        b+=4*sizeof(SHA_LONG);
-                        }
-                sha1_block(c,p,1);
-                return;
-                }
-#endif
-#endif
-#ifndef SHA_NO_TAIL_CODE /* defined above, see comment */
-                {
-                SHA_LONG *q;
-                int i;
-        
-                q=p;
-                for (i=(SHA_LBLOCK/4); i; i--)
-                        {
-                        SHA_LONG l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l; 
-                        } 
-                sha1_block(c,p,1);
-                }
-#endif
-        }
-
-#ifndef SHA1_ASM
-static void sha1_block(SHA_CTX *c, register SHA_LONG *W, int num)
-        {
-        register SHA_LONG A,B,C,D,E,T;
-        SHA_LONG X[SHA_LBLOCK];
-
-        A=c->h0;
-        B=c->h1;
-        C=c->h2;
-        D=c->h3;
-        E=c->h4;
 
-        for (;;)
-                {
-        BODY_00_15( 0,A,B,C,D,E,T,W);
-        BODY_00_15( 1,T,A,B,C,D,E,W);
-        BODY_00_15( 2,E,T,A,B,C,D,W);
-        BODY_00_15( 3,D,E,T,A,B,C,W);
-        BODY_00_15( 4,C,D,E,T,A,B,W);
-        BODY_00_15( 5,B,C,D,E,T,A,W);
-        BODY_00_15( 6,A,B,C,D,E,T,W);
-        BODY_00_15( 7,T,A,B,C,D,E,W);
-        BODY_00_15( 8,E,T,A,B,C,D,W);
-        BODY_00_15( 9,D,E,T,A,B,C,W);
-        BODY_00_15(10,C,D,E,T,A,B,W);
-        BODY_00_15(11,B,C,D,E,T,A,W);
-        BODY_00_15(12,A,B,C,D,E,T,W);
-        BODY_00_15(13,T,A,B,C,D,E,W);
-        BODY_00_15(14,E,T,A,B,C,D,W);
-        BODY_00_15(15,D,E,T,A,B,C,W);
-        BODY_16_19(16,C,D,E,T,A,B,W,W,W,W);
-        BODY_16_19(17,B,C,D,E,T,A,W,W,W,W);
-        BODY_16_19(18,A,B,C,D,E,T,W,W,W,W);
-        BODY_16_19(19,T,A,B,C,D,E,W,W,W,X);
-
-        BODY_20_31(20,E,T,A,B,C,D,W,W,W,X);
-        BODY_20_31(21,D,E,T,A,B,C,W,W,W,X);
-        BODY_20_31(22,C,D,E,T,A,B,W,W,W,X);
-        BODY_20_31(23,B,C,D,E,T,A,W,W,W,X);
-        BODY_20_31(24,A,B,C,D,E,T,W,W,X,X);
-        BODY_20_31(25,T,A,B,C,D,E,W,W,X,X);
-        BODY_20_31(26,E,T,A,B,C,D,W,W,X,X);
-        BODY_20_31(27,D,E,T,A,B,C,W,W,X,X);
-        BODY_20_31(28,C,D,E,T,A,B,W,W,X,X);
-        BODY_20_31(29,B,C,D,E,T,A,W,W,X,X);
-        BODY_20_31(30,A,B,C,D,E,T,W,X,X,X);
-        BODY_20_31(31,T,A,B,C,D,E,W,X,X,X);
-        BODY_32_39(32,E,T,A,B,C,D,X);
-        BODY_32_39(33,D,E,T,A,B,C,X);
-        BODY_32_39(34,C,D,E,T,A,B,X);
-        BODY_32_39(35,B,C,D,E,T,A,X);
-        BODY_32_39(36,A,B,C,D,E,T,X);
-        BODY_32_39(37,T,A,B,C,D,E,X);
-        BODY_32_39(38,E,T,A,B,C,D,X);
-        BODY_32_39(39,D,E,T,A,B,C,X);
-
-        BODY_40_59(40,C,D,E,T,A,B,X);
-        BODY_40_59(41,B,C,D,E,T,A,X);
-        BODY_40_59(42,A,B,C,D,E,T,X);
-        BODY_40_59(43,T,A,B,C,D,E,X);
-        BODY_40_59(44,E,T,A,B,C,D,X);
-        BODY_40_59(45,D,E,T,A,B,C,X);
-        BODY_40_59(46,C,D,E,T,A,B,X);
-        BODY_40_59(47,B,C,D,E,T,A,X);
-        BODY_40_59(48,A,B,C,D,E,T,X);
-        BODY_40_59(49,T,A,B,C,D,E,X);
-        BODY_40_59(50,E,T,A,B,C,D,X);
-        BODY_40_59(51,D,E,T,A,B,C,X);
-        BODY_40_59(52,C,D,E,T,A,B,X);
-        BODY_40_59(53,B,C,D,E,T,A,X);
-        BODY_40_59(54,A,B,C,D,E,T,X);
-        BODY_40_59(55,T,A,B,C,D,E,X);
-        BODY_40_59(56,E,T,A,B,C,D,X);
-        BODY_40_59(57,D,E,T,A,B,C,X);
-        BODY_40_59(58,C,D,E,T,A,B,X);
-        BODY_40_59(59,B,C,D,E,T,A,X);
-
-        BODY_60_79(60,A,B,C,D,E,T,X);
-        BODY_60_79(61,T,A,B,C,D,E,X);
-        BODY_60_79(62,E,T,A,B,C,D,X);
-        BODY_60_79(63,D,E,T,A,B,C,X);
-        BODY_60_79(64,C,D,E,T,A,B,X);
-        BODY_60_79(65,B,C,D,E,T,A,X);
-        BODY_60_79(66,A,B,C,D,E,T,X);
-        BODY_60_79(67,T,A,B,C,D,E,X);
-        BODY_60_79(68,E,T,A,B,C,D,X);
-        BODY_60_79(69,D,E,T,A,B,C,X);
-        BODY_60_79(70,C,D,E,T,A,B,X);
-        BODY_60_79(71,B,C,D,E,T,A,X);
-        BODY_60_79(72,A,B,C,D,E,T,X);
-        BODY_60_79(73,T,A,B,C,D,E,X);
-        BODY_60_79(74,E,T,A,B,C,D,X);
-        BODY_60_79(75,D,E,T,A,B,C,X);
-        BODY_60_79(76,C,D,E,T,A,B,X);
-        BODY_60_79(77,B,C,D,E,T,A,X);
-        BODY_60_79(78,A,B,C,D,E,T,X);
-        BODY_60_79(79,T,A,B,C,D,E,X);
-        
-        c->h0=(c->h0+E)&0xffffffffL; 
-        c->h1=(c->h1+T)&0xffffffffL;
-        c->h2=(c->h2+A)&0xffffffffL;
-        c->h3=(c->h3+B)&0xffffffffL;
-        c->h4=(c->h4+C)&0xffffffffL;
-
-        if (--num <= 0) break;
+#include <openssl/opensslv.h>
 
-        A=c->h0;
-        B=c->h1;
-        C=c->h2;
-        D=c->h3;
-        E=c->h4;
+const char *SHA1_version="SHA1" OPENSSL_VERSION_PTEXT;
 
-        W+=SHA_LBLOCK;  /* Note! This can happen only when sizeof(SHA_LONG)
-                         * is 4. Whenever it's not the actual case this
-                         * function is never called with num larger than 1
-                         * and we never advance down here.
-                         *                      <appro@fy.chalmers.se>
-                         */
-                }
-        }
-#endif
+/* The implementation is in ../md32_common.h */
 
-void SHA1_Final(unsigned char *md, SHA_CTX *c)
-        {
-        register int i,j;
-        register SHA_LONG l;
-        register SHA_LONG *p;
-        static unsigned char end[4]={0x80,0x00,0x00,0x00};
-        unsigned char *cp=end;
-
-        /* c->num should definitly have room for at least one more byte. */
-        p=c->data;
-        j=c->num;
-        i=j>>2;
-#ifdef PURIFY
-        if ((j&0x03) == 0) p[i]=0;
-#endif
-        l=p[i];
-        M_p_c2nl(cp,l,j&0x03);
-        p[i]=l;
-        i++;
-        /* i is the next 'undefined word' */
-        if (c->num >= SHA_LAST_BLOCK)
-                {
-                for (; i<SHA_LBLOCK; i++)
-                        p[i]=0;
-                sha1_block(c,p,1);
-                i=0;
-                }
-        for (; i<(SHA_LBLOCK-2); i++)
-                p[i]=0;
-        p[SHA_LBLOCK-2]=c->Nh;
-        p[SHA_LBLOCK-1]=c->Nl;
-#if SHA_LONG_LOG2==2
-#if !defined(B_ENDIAN) && defined(SHA1_ASM)
-        Endian_Reverse32(p[SHA_LBLOCK-2]);
-        Endian_Reverse32(p[SHA_LBLOCK-1]);
-#endif
-#endif
-        sha1_block(c,p,1);
-        cp=md;
-        l=c->h0; nl2c(l,cp);
-        l=c->h1; nl2c(l,cp);
-        l=c->h2; nl2c(l,cp);
-        l=c->h3; nl2c(l,cp);
-        l=c->h4; nl2c(l,cp);
+#include "sha_locl.h"
 
-        c->num=0;
-        /* sha_block may be leaving some stuff on the stack
-         * but I'm not worried :-)
-        memset((void *)c,0,sizeof(SHA_CTX));
-         */
-        }
 #endif
 
diff --git a/src/lib/libcrypto/sha/sha1s.cpp b/src/lib/libcrypto/sha/sha1s.cpp
index 3103e1871b..af23d1e0f2 100644
--- a/src/lib/libcrypto/sha/sha1s.cpp
+++ b/src/lib/libcrypto/sha/sha1s.cpp
@@ -34,6 +34,7 @@ void GetTSC(unsigned long& tsc)
 #include <stdlib.h>
 #include <openssl/sha.h>
 
+#define sha1_block_x86 sha1_block_asm_data_order
 extern "C" {
 void sha1_block_x86(SHA_CTX *ctx, unsigned char *buffer,int num);
 }
@@ -55,8 +56,10 @@ void main(int argc,char *argv[])
         if (num == 0) num=16;
         if (num > 250) num=16;
         numm=num+2;
+#if 0
         num*=64;
         numm*=64;
+#endif
 
         for (j=0; j<6; j++)
                 {
@@ -72,7 +75,7 @@ void main(int argc,char *argv[])
                         sha1_block_x86(&ctx,buffer,num);
                         }
 
-                printf("sha1 (%d bytes) %d %d (%.2f)\n",num,
+                printf("sha1 (%d bytes) %d %d (%.2f)\n",num*64,
                         e1-s1,e2-s2,(double)((e1-s1)-(e2-s2))/2);
                 }
         }
diff --git a/src/lib/libcrypto/sha/sha1test.c b/src/lib/libcrypto/sha/sha1test.c
index 9400ad2a61..688d06c637 100644
--- a/src/lib/libcrypto/sha/sha1test.c
+++ b/src/lib/libcrypto/sha/sha1test.c
@@ -76,26 +76,26 @@ int main(int argc, char *argv[])
 #undef SHA_0 /* FIPS 180 */
 #define  SHA_1 /* FIPS 180-1 */
 
-char *test[]={
+static char *test[]={
         "abc",
         "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
         NULL,
         };
 
 #ifdef SHA_0
-char *ret[]={
+static char *ret[]={
         "0164b8a914cd2a5e74c4f7ff082c4d97f1edf880",
         "d2516ee1acfa5baf33dfc1c471e438449ef134c8",
         };
-char *bigret=
+static char *bigret=
         "3232affa48628a26653b5aaa44541fd90d690603";
 #endif
 #ifdef SHA_1
-char *ret[]={
+static char *ret[]={
         "a9993e364706816aba3e25717850c26c9cd0d89d",
         "84983e441c3bd26ebaae4aa1f95129e5e54670f1",
         };
-char *bigret=
+static char *bigret=
         "34aa973cd4c4daa4f61eeb2bdbad27316534016f";
 #endif
 
diff --git a/src/lib/libcrypto/sha/sha_dgst.c b/src/lib/libcrypto/sha/sha_dgst.c
index 4df535360f..894a96274a 100644
--- a/src/lib/libcrypto/sha/sha_dgst.c
+++ b/src/lib/libcrypto/sha/sha_dgst.c
@@ -1,4 +1,4 @@
-/* crypto/sha/sha_dgst.c */
+/* crypto/sha/sha1dgst.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -56,437 +56,18 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
-#include <string.h>
-#define  SHA_0
-#undef SHA_1
-#include <openssl/sha.h>
-#include "sha_locl.h"
-#include <openssl/opensslv.h>
-
-#ifndef NO_SHA0
-char *SHA_version="SHA" OPENSSL_VERSION_PTEXT;
-
-/* Implemented from SHA-0 document - The Secure Hash Algorithm
- */
-
-#define INIT_DATA_h0 0x67452301UL
-#define INIT_DATA_h1 0xefcdab89UL
-#define INIT_DATA_h2 0x98badcfeUL
-#define INIT_DATA_h3 0x10325476UL
-#define INIT_DATA_h4 0xc3d2e1f0UL
-
-#define K_00_19 0x5a827999UL
-#define K_20_39 0x6ed9eba1UL
-#define K_40_59 0x8f1bbcdcUL
-#define K_60_79 0xca62c1d6UL
-
-static void sha_block(SHA_CTX *c, register SHA_LONG *p, int num);
-
-#if !defined(B_ENDIAN) && defined(SHA_ASM)
-#  define       M_c2nl          c2l
-#  define       M_p_c2nl        p_c2l
-#  define       M_c2nl_p        c2l_p
-#  define       M_p_c2nl_p      p_c2l_p
-#  define       M_nl2c          l2c
-#else
-#  define       M_c2nl          c2nl
-#  define       M_p_c2nl        p_c2nl
-#  define       M_c2nl_p        c2nl_p
-#  define       M_p_c2nl_p      p_c2nl_p
-#  define       M_nl2c          nl2c
-#endif
-
-void SHA_Init(SHA_CTX *c)
-        {
-        c->h0=INIT_DATA_h0;
-        c->h1=INIT_DATA_h1;
-        c->h2=INIT_DATA_h2;
-        c->h3=INIT_DATA_h3;
-        c->h4=INIT_DATA_h4;
-        c->Nl=0;
-        c->Nh=0;
-        c->num=0;
-        }
+#if !defined(NO_SHA0) && !defined(NO_SHA)
 
-void SHA_Update(SHA_CTX *c, register const unsigned char *data,
-                unsigned long len)
-        {
-        register SHA_LONG *p;
-        int ew,ec,sw,sc;
-        SHA_LONG l;
-
-        if (len == 0) return;
-
-        l=(c->Nl+(len<<3))&0xffffffffL;
-        if (l < c->Nl) /* overflow */
-                c->Nh++;
-        c->Nh+=(len>>29);
-        c->Nl=l;
-
-        if (c->num != 0)
-                {
-                p=c->data;
-                sw=c->num>>2;
-                sc=c->num&0x03;
-
-                if ((c->num+len) >= SHA_CBLOCK)
-                        {
-                        l= p[sw];
-                        M_p_c2nl(data,l,sc);
-                        p[sw++]=l;
-                        for (; sw<SHA_LBLOCK; sw++)
-                                {
-                                M_c2nl(data,l);
-                                p[sw]=l;
-                                }
-                        len-=(SHA_CBLOCK-c->num);
-
-                        sha_block(c,p,1);
-                        c->num=0;
-                        /* drop through and do the rest */
-                        }
-                else
-                        {
-                        c->num+=(int)len;
-                        if ((sc+len) < 4) /* ugly, add char's to a word */
-                                {
-                                l= p[sw];
-                                M_p_c2nl_p(data,l,sc,len);
-                                p[sw]=l;
-                                }
-                        else
-                                {
-                                ew=(c->num>>2);
-                                ec=(c->num&0x03);
-                                l= p[sw];
-                                M_p_c2nl(data,l,sc);
-                                p[sw++]=l;
-                                for (; sw < ew; sw++)
-                                        { M_c2nl(data,l); p[sw]=l; }
-                                if (ec)
-                                        {
-                                        M_c2nl_p(data,l,ec);
-                                        p[sw]=l;
-                                        }
-                                }
-                        return;
-                        }
-                }
-        /* We can only do the following code for assember, the reason
-         * being that the sha_block 'C' version changes the values
-         * in the 'data' array.  The assember code avoids this and
-         * copies it to a local array.  I should be able to do this for
-         * the C version as well....
-         */
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA_ASM)
-        if ((((unsigned long)data)%sizeof(SHA_LONG)) == 0)
-                {
-                sw=len/SHA_CBLOCK;
-                if (sw)
-                        {
-                        sha_block(c,(SHA_LONG *)data,sw);
-                        sw*=SHA_CBLOCK;
-                        data+=sw;
-                        len-=sw;
-                        }
-                }
-#endif
-#endif
-        /* we now can process the input data in blocks of SHA_CBLOCK
-         * chars and save the leftovers to c->data. */
-        p=c->data;
-        while (len >= SHA_CBLOCK)
-                {
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA_ASM)
-#define SHA_NO_TAIL_CODE
-                /*
-                 * Basically we get here only when data happens
-                 * to be unaligned.
-                 */
-                if (p != (SHA_LONG *)data)
-                        memcpy(p,data,SHA_CBLOCK);
-                data+=SHA_CBLOCK;
-                sha_block(c,p=c->data,1);
-                len-=SHA_CBLOCK;
-#elif defined(L_ENDIAN)
-#define BE_COPY(dst,src,i)      {                               \
-                                l = ((SHA_LONG *)src)[i];       \
-                                Endian_Reverse32(l);            \
-                                dst[i] = l;                     \
-                                }
-                if ((((unsigned long)data)%sizeof(SHA_LONG)) == 0)
-                        {
-                        for (sw=(SHA_LBLOCK/4); sw; sw--)
-                                {
-                                BE_COPY(p,data,0);
-                                BE_COPY(p,data,1);
-                                BE_COPY(p,data,2);
-                                BE_COPY(p,data,3);
-                                p+=4;
-                                data += 4*sizeof(SHA_LONG);
-                                }
-                        sha_block(c,p=c->data,1);
-                        len-=SHA_CBLOCK;
-                        continue;
-                        }
-#endif
-#endif
-#ifndef SHA_NO_TAIL_CODE
-                /*
-                 * In addition to "sizeof(SHA_LONG)!= 4" case the
-                 * following code covers unaligned access cases on
-                 * little-endian machines.
-                 *                      <appro@fy.chalmers.se>
-                 */
-                p=c->data;
-                for (sw=(SHA_LBLOCK/4); sw; sw--)
-                        {
-                        M_c2nl(data,l); p[0]=l;
-                        M_c2nl(data,l); p[1]=l;
-                        M_c2nl(data,l); p[2]=l;
-                        M_c2nl(data,l); p[3]=l;
-                        p+=4;
-                        }
-                p=c->data;
-                sha_block(c,p,1);
-                len-=SHA_CBLOCK;
-#endif
-                }
-        ec=(int)len;
-        c->num=ec;
-        ew=(ec>>2);
-        ec&=0x03;
+#undef  SHA_1
+#define SHA_0
 
-        for (sw=0; sw < ew; sw++)
-                { M_c2nl(data,l); p[sw]=l; }
-        M_c2nl_p(data,l,ec);
-        p[sw]=l;
-        }
-
-void SHA_Transform(SHA_CTX *c, unsigned char *b)
-        {
-        SHA_LONG p[SHA_LBLOCK];
-
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA_ASM)
-        memcpy(p,b,SHA_CBLOCK);
-        sha_block(c,p,1);
-        return;
-#elif defined(L_ENDIAN)
-        if (((unsigned long)b%sizeof(SHA_LONG)) == 0)
-                {
-                SHA_LONG *q;
-                int i;
-
-                q=p;
-                for (i=(SHA_LBLOCK/4); i; i--)
-                        {
-                        unsigned long l;
-                        BE_COPY(q,b,0); /* BE_COPY was defined above */
-                        BE_COPY(q,b,1);
-                        BE_COPY(q,b,2);
-                        BE_COPY(q,b,3);
-                        q+=4;
-                        b+=4*sizeof(SHA_LONG);
-                        }
-                sha_block(c,p,1);
-                return;
-                }
-#endif
-#endif
-#ifndef SHA_NO_TAIL_CODE /* defined above, see comment */
-                {
-                SHA_LONG *q;
-                int i;
-
-                q=p;
-                for (i=(SHA_LBLOCK/4); i; i--)
-                        {
-                        SHA_LONG l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l; 
-                        } 
-                sha_block(c,p,1);
-                }
-#endif
-        }
-
-#ifndef SHA_ASM
-static void sha_block(SHA_CTX *c, register SHA_LONG *W, int num)
-        {
-        register SHA_LONG A,B,C,D,E,T;
-        SHA_LONG X[SHA_LBLOCK];
-
-        A=c->h0;
-        B=c->h1;
-        C=c->h2;
-        D=c->h3;
-        E=c->h4;
-
-        for (;;)
-                {
-        BODY_00_15( 0,A,B,C,D,E,T,W);
-        BODY_00_15( 1,T,A,B,C,D,E,W);
-        BODY_00_15( 2,E,T,A,B,C,D,W);
-        BODY_00_15( 3,D,E,T,A,B,C,W);
-        BODY_00_15( 4,C,D,E,T,A,B,W);
-        BODY_00_15( 5,B,C,D,E,T,A,W);
-        BODY_00_15( 6,A,B,C,D,E,T,W);
-        BODY_00_15( 7,T,A,B,C,D,E,W);
-        BODY_00_15( 8,E,T,A,B,C,D,W);
-        BODY_00_15( 9,D,E,T,A,B,C,W);
-        BODY_00_15(10,C,D,E,T,A,B,W);
-        BODY_00_15(11,B,C,D,E,T,A,W);
-        BODY_00_15(12,A,B,C,D,E,T,W);
-        BODY_00_15(13,T,A,B,C,D,E,W);
-        BODY_00_15(14,E,T,A,B,C,D,W);
-        BODY_00_15(15,D,E,T,A,B,C,W);
-        BODY_16_19(16,C,D,E,T,A,B,W,W,W,W);
-        BODY_16_19(17,B,C,D,E,T,A,W,W,W,W);
-        BODY_16_19(18,A,B,C,D,E,T,W,W,W,W);
-        BODY_16_19(19,T,A,B,C,D,E,W,W,W,X);
-
-        BODY_20_31(20,E,T,A,B,C,D,W,W,W,X);
-        BODY_20_31(21,D,E,T,A,B,C,W,W,W,X);
-        BODY_20_31(22,C,D,E,T,A,B,W,W,W,X);
-        BODY_20_31(23,B,C,D,E,T,A,W,W,W,X);
-        BODY_20_31(24,A,B,C,D,E,T,W,W,X,X);
-        BODY_20_31(25,T,A,B,C,D,E,W,W,X,X);
-        BODY_20_31(26,E,T,A,B,C,D,W,W,X,X);
-        BODY_20_31(27,D,E,T,A,B,C,W,W,X,X);
-        BODY_20_31(28,C,D,E,T,A,B,W,W,X,X);
-        BODY_20_31(29,B,C,D,E,T,A,W,W,X,X);
-        BODY_20_31(30,A,B,C,D,E,T,W,X,X,X);
-        BODY_20_31(31,T,A,B,C,D,E,W,X,X,X);
-        BODY_32_39(32,E,T,A,B,C,D,X);
-        BODY_32_39(33,D,E,T,A,B,C,X);
-        BODY_32_39(34,C,D,E,T,A,B,X);
-        BODY_32_39(35,B,C,D,E,T,A,X);
-        BODY_32_39(36,A,B,C,D,E,T,X);
-        BODY_32_39(37,T,A,B,C,D,E,X);
-        BODY_32_39(38,E,T,A,B,C,D,X);
-        BODY_32_39(39,D,E,T,A,B,C,X);
-
-        BODY_40_59(40,C,D,E,T,A,B,X);
-        BODY_40_59(41,B,C,D,E,T,A,X);
-        BODY_40_59(42,A,B,C,D,E,T,X);
-        BODY_40_59(43,T,A,B,C,D,E,X);
-        BODY_40_59(44,E,T,A,B,C,D,X);
-        BODY_40_59(45,D,E,T,A,B,C,X);
-        BODY_40_59(46,C,D,E,T,A,B,X);
-        BODY_40_59(47,B,C,D,E,T,A,X);
-        BODY_40_59(48,A,B,C,D,E,T,X);
-        BODY_40_59(49,T,A,B,C,D,E,X);
-        BODY_40_59(50,E,T,A,B,C,D,X);
-        BODY_40_59(51,D,E,T,A,B,C,X);
-        BODY_40_59(52,C,D,E,T,A,B,X);
-        BODY_40_59(53,B,C,D,E,T,A,X);
-        BODY_40_59(54,A,B,C,D,E,T,X);
-        BODY_40_59(55,T,A,B,C,D,E,X);
-        BODY_40_59(56,E,T,A,B,C,D,X);
-        BODY_40_59(57,D,E,T,A,B,C,X);
-        BODY_40_59(58,C,D,E,T,A,B,X);
-        BODY_40_59(59,B,C,D,E,T,A,X);
-
-        BODY_60_79(60,A,B,C,D,E,T,X);
-        BODY_60_79(61,T,A,B,C,D,E,X);
-        BODY_60_79(62,E,T,A,B,C,D,X);
-        BODY_60_79(63,D,E,T,A,B,C,X);
-        BODY_60_79(64,C,D,E,T,A,B,X);
-        BODY_60_79(65,B,C,D,E,T,A,X);
-        BODY_60_79(66,A,B,C,D,E,T,X);
-        BODY_60_79(67,T,A,B,C,D,E,X);
-        BODY_60_79(68,E,T,A,B,C,D,X);
-        BODY_60_79(69,D,E,T,A,B,C,X);
-        BODY_60_79(70,C,D,E,T,A,B,X);
-        BODY_60_79(71,B,C,D,E,T,A,X);
-        BODY_60_79(72,A,B,C,D,E,T,X);
-        BODY_60_79(73,T,A,B,C,D,E,X);
-        BODY_60_79(74,E,T,A,B,C,D,X);
-        BODY_60_79(75,D,E,T,A,B,C,X);
-        BODY_60_79(76,C,D,E,T,A,B,X);
-        BODY_60_79(77,B,C,D,E,T,A,X);
-        BODY_60_79(78,A,B,C,D,E,T,X);
-        BODY_60_79(79,T,A,B,C,D,E,X);
-        
-        c->h0=(c->h0+E)&0xffffffffL; 
-        c->h1=(c->h1+T)&0xffffffffL;
-        c->h2=(c->h2+A)&0xffffffffL;
-        c->h3=(c->h3+B)&0xffffffffL;
-        c->h4=(c->h4+C)&0xffffffffL;
-
-        if (--num <= 0) break;
+#include <openssl/opensslv.h>
 
-        A=c->h0;
-        B=c->h1;
-        C=c->h2;
-        D=c->h3;
-        E=c->h4;
+const char *SHA_version="SHA" OPENSSL_VERSION_PTEXT;
 
-        W+=SHA_LBLOCK;  /* Note! This can happen only when sizeof(SHA_LONG)
-                         * is 4. Whenever it's not the actual case this
-                         * function is never called with num larger than 1
-                         * and we never advance down here.
-                         *                      <appro@fy.chalmers.se>
-                         */
-                }
-        }
-#endif
+/* The implementation is in ../md32_common.h */
 
-void SHA_Final(unsigned char *md, SHA_CTX *c)
-        {
-        register int i,j;
-        register SHA_LONG l;
-        register SHA_LONG *p;
-        static unsigned char end[4]={0x80,0x00,0x00,0x00};
-        unsigned char *cp=end;
+#include "sha_locl.h"
 
-        /* c->num should definitly have room for at least one more byte. */
-        p=c->data;
-        j=c->num;
-        i=j>>2;
-#ifdef PURIFY
-        if ((j&0x03) == 0) p[i]=0;
-#endif
-        l=p[i];
-        M_p_c2nl(cp,l,j&0x03);
-        p[i]=l;
-        i++;
-        /* i is the next 'undefined word' */
-        if (c->num >= SHA_LAST_BLOCK)
-                {
-                for (; i<SHA_LBLOCK; i++)
-                        p[i]=0;
-                sha_block(c,p,1);
-                i=0;
-                }
-        for (; i<(SHA_LBLOCK-2); i++)
-                p[i]=0;
-        p[SHA_LBLOCK-2]=c->Nh;
-        p[SHA_LBLOCK-1]=c->Nl;
-#if SHA_LONG_LOG2==2
-#if !defined(B_ENDIAN) && defined(SHA_ASM)
-        Endian_Reverse32(p[SHA_LBLOCK-2]);
-        Endian_Reverse32(p[SHA_LBLOCK-1]);
 #endif
-#endif
-        sha_block(c,p,1);
-        cp=md;
-        l=c->h0; nl2c(l,cp);
-        l=c->h1; nl2c(l,cp);
-        l=c->h2; nl2c(l,cp);
-        l=c->h3; nl2c(l,cp);
-        l=c->h4; nl2c(l,cp);
 
-        c->num=0;
-        /* sha_block may be leaving some stuff on the stack
-         * but I'm not worried :-)
-        memset((void *)c,0,sizeof(SHA_CTX));
-         */
-        }
-#endif
diff --git a/src/lib/libcrypto/sha/sha_locl.h b/src/lib/libcrypto/sha/sha_locl.h
index 6646a8915b..3e6f489b87 100644
--- a/src/lib/libcrypto/sha/sha_locl.h
+++ b/src/lib/libcrypto/sha/sha_locl.h
@@ -60,180 +60,105 @@
 #include <string.h>
 
 #include <openssl/opensslconf.h>
-
-#ifdef undef
-/* one or the other needs to be defined */
-#ifndef SHA_1 /* FIPE 180-1 */
-#define SHA_0 /* FIPS 180   */
-#endif
-#endif
-
-#undef c2nl
-#define c2nl(c,l)       (l =(((unsigned long)(*((c)++)))<<24), \
-                         l|=(((unsigned long)(*((c)++)))<<16), \
-                         l|=(((unsigned long)(*((c)++)))<< 8), \
-                         l|=(((unsigned long)(*((c)++)))    ))
-
-#undef p_c2nl
-#define p_c2nl(c,l,n)   { \
-                        switch (n) { \
-                        case 0: l =((unsigned long)(*((c)++)))<<24; \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16; \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8; \
-                        case 3: l|=((unsigned long)(*((c)++))); \
-                                } \
-                        }
-
-#undef c2nl_p
-/* NOTE the pointer is not incremented at the end of this */
-#define c2nl_p(c,l,n)   { \
-                        l=0; \
-                        (c)+=n; \
-                        switch (n) { \
-                        case 3: l =((unsigned long)(*(--(c))))<< 8; \
-                        case 2: l|=((unsigned long)(*(--(c))))<<16; \
-                        case 1: l|=((unsigned long)(*(--(c))))<<24; \
-                                } \
-                        }
-
-#undef p_c2nl_p
-#define p_c2nl_p(c,l,sc,len) { \
-                        switch (sc) \
-                                { \
-                        case 0: l =((unsigned long)(*((c)++)))<<24; \
-                                if (--len == 0) break; \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16; \
-                                if (--len == 0) break; \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8; \
-                                } \
-                        }
-
-#undef nl2c
-#define nl2c(l,c)       (*((c)++)=(unsigned char)(((l)>>24)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
-                         *((c)++)=(unsigned char)(((l)    )&0xff))
-
-#undef c2l
-#define c2l(c,l)        (l =(((unsigned long)(*((c)++)))    ), \
-                         l|=(((unsigned long)(*((c)++)))<< 8), \
-                         l|=(((unsigned long)(*((c)++)))<<16), \
-                         l|=(((unsigned long)(*((c)++)))<<24))
-
-#undef p_c2l
-#define p_c2l(c,l,n)    { \
-                        switch (n) { \
-                        case 0: l =((unsigned long)(*((c)++))); \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8; \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16; \
-                        case 3: l|=((unsigned long)(*((c)++)))<<24; \
-                                } \
-                        }
-
-#undef c2l_p
-/* NOTE the pointer is not incremented at the end of this */
-#define c2l_p(c,l,n)    { \
-                        l=0; \
-                        (c)+=n; \
-                        switch (n) { \
-                        case 3: l =((unsigned long)(*(--(c))))<<16; \
-                        case 2: l|=((unsigned long)(*(--(c))))<< 8; \
-                        case 1: l|=((unsigned long)(*(--(c)))); \
-                                } \
-                        }
-
-#undef p_c2l_p
-#define p_c2l_p(c,l,sc,len) { \
-                        switch (sc) \
-                                { \
-                        case 0: l =((unsigned long)(*((c)++))); \
-                                if (--len == 0) break; \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8; \
-                                if (--len == 0) break; \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16; \
-                                } \
-                        }
-
-#undef l2c
-#define l2c(l,c)        (*((c)++)=(unsigned char)(((l)    )&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>24)&0xff))
+#include <openssl/sha.h>
 
 #ifndef SHA_LONG_LOG2
 #define SHA_LONG_LOG2   2       /* default to 32 bits */
 #endif
 
-#undef ROTATE
-#undef Endian_Reverse32
-#if defined(WIN32)
-#define ROTATE(a,n)     _lrotl(a,n)
-#elif defined(__GNUC__) && !defined(PEDANTIC)
-/* some inline assembler templates by <appro@fy.chalmers.se> */
-#if defined(__i386) && !defined(NO_ASM)
-#define ROTATE(a,n)     ({ register unsigned int ret;   \
-                                asm ("roll %1,%0"       \
-                                : "=r"(ret)             \
-                                : "I"(n), "0"(a)        \
-                                : "cc");                \
-                           ret;                         \
-                        })
-#ifndef I386_ONLY
-#define Endian_Reverse32(a) \
-                        { register unsigned int ltmp=(a);       \
-                                asm ("bswapl %0"        \
-                                : "=r"(ltmp) : "0"(ltmp));      \
-                          (a)=ltmp;                     \
-                        }
-#endif
-#elif defined(__powerpc)
-#define ROTATE(a,n)     ({ register unsigned int ret;           \
-                                asm ("rlwinm %0,%1,%2,0,31"     \
-                                : "=r"(ret)                     \
-                                : "r"(a), "I"(n));              \
-                           ret;                                 \
-                        })
-/* Endian_Reverse32 is not needed for PowerPC */
-#endif
-#endif
+#define DATA_ORDER_IS_BIG_ENDIAN
+
+#define HASH_LONG               SHA_LONG
+#define HASH_LONG_LOG2          SHA_LONG_LOG2
+#define HASH_CTX                SHA_CTX
+#define HASH_CBLOCK             SHA_CBLOCK
+#define HASH_LBLOCK             SHA_LBLOCK
+#define HASH_MAKE_STRING(c,s)   do {    \
+        unsigned long ll;               \
+        ll=(c)->h0; HOST_l2c(ll,(s));   \
+        ll=(c)->h1; HOST_l2c(ll,(s));   \
+        ll=(c)->h2; HOST_l2c(ll,(s));   \
+        ll=(c)->h3; HOST_l2c(ll,(s));   \
+        ll=(c)->h4; HOST_l2c(ll,(s));   \
+        } while (0)
+
+#if defined(SHA_0)
+
+# define HASH_UPDATE                    SHA_Update
+# define HASH_TRANSFORM                 SHA_Transform
+# define HASH_FINAL                     SHA_Final
+# define HASH_INIT                      SHA_Init
+# define HASH_BLOCK_HOST_ORDER          sha_block_host_order
+# define HASH_BLOCK_DATA_ORDER          sha_block_data_order
+# define Xupdate(a,ix,ia,ib,ic,id)      (ix=(a)=(ia^ib^ic^id))
+
+  void sha_block_host_order (SHA_CTX *c, const void *p,int num);
+  void sha_block_data_order (SHA_CTX *c, const void *p,int num);
+
+#elif defined(SHA_1)
+
+# define HASH_UPDATE                    SHA1_Update
+# define HASH_TRANSFORM                 SHA1_Transform
+# define HASH_FINAL                     SHA1_Final
+# define HASH_INIT                      SHA1_Init
+# define HASH_BLOCK_HOST_ORDER          sha1_block_host_order
+# define HASH_BLOCK_DATA_ORDER          sha1_block_data_order
+# if defined(__MWERKS__) && defined(__MC68K__)
+   /* Metrowerks for Motorola fails otherwise:-( <appro@fy.chalmers.se> */
+#  define Xupdate(a,ix,ia,ib,ic,id)     do { (a)=(ia^ib^ic^id);         \
+                                             ix=(a)=ROTATE((a),1);      \
+                                        } while (0)
+# else
+#  define Xupdate(a,ix,ia,ib,ic,id)     ( (a)=(ia^ib^ic^id),    \
+                                          ix=(a)=ROTATE((a),1)  \
+                                        )
+# endif
+
+# ifdef SHA1_ASM
+#  if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
+#   define sha1_block_host_order                sha1_block_asm_host_order
+#   define DONT_IMPLEMENT_BLOCK_HOST_ORDER
+#   define sha1_block_data_order                sha1_block_asm_data_order
+#   define DONT_IMPLEMENT_BLOCK_DATA_ORDER
+#   define HASH_BLOCK_DATA_ORDER_ALIGNED        sha1_block_asm_data_order
+#  endif
+# endif
+  void sha1_block_host_order (SHA_CTX *c, const void *p,int num);
+  void sha1_block_data_order (SHA_CTX *c, const void *p,int num);
 
-/* A nice byte order reversal from Wei Dai <weidai@eskimo.com> */
-#ifdef ROTATE
-#ifndef Endian_Reverse32
-/* 5 instructions with rotate instruction, else 9 */
-#define Endian_Reverse32(a) \
-        { \
-        unsigned long t=(a); \
-        (a)=((ROTATE(t,8)&0x00FF00FF)|(ROTATE((t&0x00FF00FF),24))); \
-        }
-#endif
 #else
-#define ROTATE(a,n)     (((a)<<(n))|(((a)&0xffffffff)>>(32-(n))))
-#ifndef Endian_Reverse32
-/* 6 instructions with rotate instruction, else 8 */
-#define Endian_Reverse32(a) \
-        { \
-        unsigned long t=(a); \
-        t=(((t>>8)&0x00FF00FF)|((t&0x00FF00FF)<<8)); \
-        (a)=ROTATE(t,16); \
-        }
+# error "Either SHA_0 or SHA_1 must be defined."
 #endif
-/*
- * Originally the middle line started with l=(((l&0xFF00FF00)>>8)|...
- * It's rewritten as above for two reasons:
- *      - RISCs aren't good at long constants and have to explicitely
- *        compose 'em with several (well, usually 2) instructions in a
- *        register before performing the actual operation and (as you
- *        already realized:-) having same constant should inspire the
- *        compiler to permanently allocate the only register for it;
- *      - most modern CPUs have two ALUs, but usually only one has
- *        circuitry for shifts:-( this minor tweak inspires compiler
- *        to schedule shift instructions in a better way...
- *
- *                              <appro@fy.chalmers.se>
- */
+
+#ifndef FLAT_INC
+#include "../md32_common.h"
+#else
+#include "md32_common.h"
 #endif
 
+#define INIT_DATA_h0 0x67452301UL
+#define INIT_DATA_h1 0xefcdab89UL
+#define INIT_DATA_h2 0x98badcfeUL
+#define INIT_DATA_h3 0x10325476UL
+#define INIT_DATA_h4 0xc3d2e1f0UL
+
+void HASH_INIT (SHA_CTX *c)
+        {
+        c->h0=INIT_DATA_h0;
+        c->h1=INIT_DATA_h1;
+        c->h2=INIT_DATA_h2;
+        c->h3=INIT_DATA_h3;
+        c->h4=INIT_DATA_h4;
+        c->Nl=0;
+        c->Nh=0;
+        c->num=0;
+        }
+
+#define K_00_19 0x5a827999UL
+#define K_20_39 0x6ed9eba1UL
+#define K_40_59 0x8f1bbcdcUL
+#define K_60_79 0xca62c1d6UL
+
 /* As  pointed out by Wei Dai <weidai@eskimo.com>, F() below can be
  * simplified to the code in F_00_19.  Wei attributes these optimisations
  * to Peter Gutmann's SHS code, and he attributes it to Rich Schroeppel.
@@ -246,43 +171,305 @@
 #define F_40_59(b,c,d)  (((b) & (c)) | (((b)|(c)) & (d))) 
 #define F_60_79(b,c,d)  F_20_39(b,c,d)
 
-#undef Xupdate
-#ifdef SHA_0
-#define Xupdate(a,i,ia,ib,ic,id) X[(i)&0x0f]=(a)=\
-        (ia[(i)&0x0f]^ib[((i)+2)&0x0f]^ic[((i)+8)&0x0f]^id[((i)+13)&0x0f]);
-#endif
-#ifdef SHA_1
-#define Xupdate(a,i,ia,ib,ic,id) (a)=\
-        (ia[(i)&0x0f]^ib[((i)+2)&0x0f]^ic[((i)+8)&0x0f]^id[((i)+13)&0x0f]);\
-        X[(i)&0x0f]=(a)=ROTATE((a),1);
-#endif
-
-#define BODY_00_15(i,a,b,c,d,e,f,xa) \
-        (f)=xa[i]+(e)+K_00_19+ROTATE((a),5)+F_00_19((b),(c),(d)); \
+#define BODY_00_15(i,a,b,c,d,e,f,xi) \
+        (f)=xi+(e)+K_00_19+ROTATE((a),5)+F_00_19((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_16_19(i,a,b,c,d,e,f,xa,xb,xc,xd) \
-        Xupdate(f,i,xa,xb,xc,xd); \
+#define BODY_16_19(i,a,b,c,d,e,f,xi,xa,xb,xc,xd) \
+        Xupdate(f,xi,xa,xb,xc,xd); \
         (f)+=(e)+K_00_19+ROTATE((a),5)+F_00_19((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_20_31(i,a,b,c,d,e,f,xa,xb,xc,xd) \
-        Xupdate(f,i,xa,xb,xc,xd); \
+#define BODY_20_31(i,a,b,c,d,e,f,xi,xa,xb,xc,xd) \
+        Xupdate(f,xi,xa,xb,xc,xd); \
         (f)+=(e)+K_20_39+ROTATE((a),5)+F_20_39((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_32_39(i,a,b,c,d,e,f,xa) \
-        Xupdate(f,i,xa,xa,xa,xa); \
+#define BODY_32_39(i,a,b,c,d,e,f,xa,xb,xc,xd) \
+        Xupdate(f,xa,xa,xb,xc,xd); \
         (f)+=(e)+K_20_39+ROTATE((a),5)+F_20_39((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_40_59(i,a,b,c,d,e,f,xa) \
-        Xupdate(f,i,xa,xa,xa,xa); \
+#define BODY_40_59(i,a,b,c,d,e,f,xa,xb,xc,xd) \
+        Xupdate(f,xa,xa,xb,xc,xd); \
         (f)+=(e)+K_40_59+ROTATE((a),5)+F_40_59((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_60_79(i,a,b,c,d,e,f,xa) \
-        Xupdate(f,i,xa,xa,xa,xa); \
-        (f)=X[(i)&0x0f]+(e)+K_60_79+ROTATE((a),5)+F_60_79((b),(c),(d)); \
+#define BODY_60_79(i,a,b,c,d,e,f,xa,xb,xc,xd) \
+        Xupdate(f,xa,xa,xb,xc,xd); \
+        (f)=xa+(e)+K_60_79+ROTATE((a),5)+F_60_79((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
+#ifdef X
+#undef X
+#endif
+#ifndef MD32_XARRAY
+  /*
+   * Originally X was an array. As it's automatic it's natural
+   * to expect RISC compiler to accomodate at least part of it in
+   * the register bank, isn't it? Unfortunately not all compilers
+   * "find" this expectation reasonable:-( On order to make such
+   * compilers generate better code I replace X[] with a bunch of
+   * X0, X1, etc. See the function body below...
+   *                                    <appro@fy.chalmers.se>
+   */
+# define X(i)   XX##i
+#else
+  /*
+   * However! Some compilers (most notably HP C) get overwhelmed by
+   * that many local variables so that we have to have the way to
+   * fall down to the original behavior.
+   */
+# define X(i)   XX[i]
+#endif
+
+#ifndef DONT_IMPLEMENT_BLOCK_HOST_ORDER
+void HASH_BLOCK_HOST_ORDER (SHA_CTX *c, const void *d, int num)
+        {
+        const SHA_LONG *W=d;
+        register unsigned long A,B,C,D,E,T;
+#ifndef MD32_XARRAY
+        unsigned long   XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
+                        XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
+#else
+        SHA_LONG        XX[16];
+#endif
+
+        A=c->h0;
+        B=c->h1;
+        C=c->h2;
+        D=c->h3;
+        E=c->h4;
+
+        for (;;)
+                {
+        BODY_00_15( 0,A,B,C,D,E,T,W[ 0]);
+        BODY_00_15( 1,T,A,B,C,D,E,W[ 1]);
+        BODY_00_15( 2,E,T,A,B,C,D,W[ 2]);
+        BODY_00_15( 3,D,E,T,A,B,C,W[ 3]);
+        BODY_00_15( 4,C,D,E,T,A,B,W[ 4]);
+        BODY_00_15( 5,B,C,D,E,T,A,W[ 5]);
+        BODY_00_15( 6,A,B,C,D,E,T,W[ 6]);
+        BODY_00_15( 7,T,A,B,C,D,E,W[ 7]);
+        BODY_00_15( 8,E,T,A,B,C,D,W[ 8]);
+        BODY_00_15( 9,D,E,T,A,B,C,W[ 9]);
+        BODY_00_15(10,C,D,E,T,A,B,W[10]);
+        BODY_00_15(11,B,C,D,E,T,A,W[11]);
+        BODY_00_15(12,A,B,C,D,E,T,W[12]);
+        BODY_00_15(13,T,A,B,C,D,E,W[13]);
+        BODY_00_15(14,E,T,A,B,C,D,W[14]);
+        BODY_00_15(15,D,E,T,A,B,C,W[15]);
+
+        BODY_16_19(16,C,D,E,T,A,B,X( 0),W[ 0],W[ 2],W[ 8],W[13]);
+        BODY_16_19(17,B,C,D,E,T,A,X( 1),W[ 1],W[ 3],W[ 9],W[14]);
+        BODY_16_19(18,A,B,C,D,E,T,X( 2),W[ 2],W[ 4],W[10],W[15]);
+        BODY_16_19(19,T,A,B,C,D,E,X( 3),W[ 3],W[ 5],W[11],X( 0));
+
+        BODY_20_31(20,E,T,A,B,C,D,X( 4),W[ 4],W[ 6],W[12],X( 1));
+        BODY_20_31(21,D,E,T,A,B,C,X( 5),W[ 5],W[ 7],W[13],X( 2));
+        BODY_20_31(22,C,D,E,T,A,B,X( 6),W[ 6],W[ 8],W[14],X( 3));
+        BODY_20_31(23,B,C,D,E,T,A,X( 7),W[ 7],W[ 9],W[15],X( 4));
+        BODY_20_31(24,A,B,C,D,E,T,X( 8),W[ 8],W[10],X( 0),X( 5));
+        BODY_20_31(25,T,A,B,C,D,E,X( 9),W[ 9],W[11],X( 1),X( 6));
+        BODY_20_31(26,E,T,A,B,C,D,X(10),W[10],W[12],X( 2),X( 7));
+        BODY_20_31(27,D,E,T,A,B,C,X(11),W[11],W[13],X( 3),X( 8));
+        BODY_20_31(28,C,D,E,T,A,B,X(12),W[12],W[14],X( 4),X( 9));
+        BODY_20_31(29,B,C,D,E,T,A,X(13),W[13],W[15],X( 5),X(10));
+        BODY_20_31(30,A,B,C,D,E,T,X(14),W[14],X( 0),X( 6),X(11));
+        BODY_20_31(31,T,A,B,C,D,E,X(15),W[15],X( 1),X( 7),X(12));
+
+        BODY_32_39(32,E,T,A,B,C,D,X( 0),X( 2),X( 8),X(13));
+        BODY_32_39(33,D,E,T,A,B,C,X( 1),X( 3),X( 9),X(14));
+        BODY_32_39(34,C,D,E,T,A,B,X( 2),X( 4),X(10),X(15));
+        BODY_32_39(35,B,C,D,E,T,A,X( 3),X( 5),X(11),X( 0));
+        BODY_32_39(36,A,B,C,D,E,T,X( 4),X( 6),X(12),X( 1));
+        BODY_32_39(37,T,A,B,C,D,E,X( 5),X( 7),X(13),X( 2));
+        BODY_32_39(38,E,T,A,B,C,D,X( 6),X( 8),X(14),X( 3));
+        BODY_32_39(39,D,E,T,A,B,C,X( 7),X( 9),X(15),X( 4));
+
+        BODY_40_59(40,C,D,E,T,A,B,X( 8),X(10),X( 0),X( 5));
+        BODY_40_59(41,B,C,D,E,T,A,X( 9),X(11),X( 1),X( 6));
+        BODY_40_59(42,A,B,C,D,E,T,X(10),X(12),X( 2),X( 7));
+        BODY_40_59(43,T,A,B,C,D,E,X(11),X(13),X( 3),X( 8));
+        BODY_40_59(44,E,T,A,B,C,D,X(12),X(14),X( 4),X( 9));
+        BODY_40_59(45,D,E,T,A,B,C,X(13),X(15),X( 5),X(10));
+        BODY_40_59(46,C,D,E,T,A,B,X(14),X( 0),X( 6),X(11));
+        BODY_40_59(47,B,C,D,E,T,A,X(15),X( 1),X( 7),X(12));
+        BODY_40_59(48,A,B,C,D,E,T,X( 0),X( 2),X( 8),X(13));
+        BODY_40_59(49,T,A,B,C,D,E,X( 1),X( 3),X( 9),X(14));
+        BODY_40_59(50,E,T,A,B,C,D,X( 2),X( 4),X(10),X(15));
+        BODY_40_59(51,D,E,T,A,B,C,X( 3),X( 5),X(11),X( 0));
+        BODY_40_59(52,C,D,E,T,A,B,X( 4),X( 6),X(12),X( 1));
+        BODY_40_59(53,B,C,D,E,T,A,X( 5),X( 7),X(13),X( 2));
+        BODY_40_59(54,A,B,C,D,E,T,X( 6),X( 8),X(14),X( 3));
+        BODY_40_59(55,T,A,B,C,D,E,X( 7),X( 9),X(15),X( 4));
+        BODY_40_59(56,E,T,A,B,C,D,X( 8),X(10),X( 0),X( 5));
+        BODY_40_59(57,D,E,T,A,B,C,X( 9),X(11),X( 1),X( 6));
+        BODY_40_59(58,C,D,E,T,A,B,X(10),X(12),X( 2),X( 7));
+        BODY_40_59(59,B,C,D,E,T,A,X(11),X(13),X( 3),X( 8));
+
+        BODY_60_79(60,A,B,C,D,E,T,X(12),X(14),X( 4),X( 9));
+        BODY_60_79(61,T,A,B,C,D,E,X(13),X(15),X( 5),X(10));
+        BODY_60_79(62,E,T,A,B,C,D,X(14),X( 0),X( 6),X(11));
+        BODY_60_79(63,D,E,T,A,B,C,X(15),X( 1),X( 7),X(12));
+        BODY_60_79(64,C,D,E,T,A,B,X( 0),X( 2),X( 8),X(13));
+        BODY_60_79(65,B,C,D,E,T,A,X( 1),X( 3),X( 9),X(14));
+        BODY_60_79(66,A,B,C,D,E,T,X( 2),X( 4),X(10),X(15));
+        BODY_60_79(67,T,A,B,C,D,E,X( 3),X( 5),X(11),X( 0));
+        BODY_60_79(68,E,T,A,B,C,D,X( 4),X( 6),X(12),X( 1));
+        BODY_60_79(69,D,E,T,A,B,C,X( 5),X( 7),X(13),X( 2));
+        BODY_60_79(70,C,D,E,T,A,B,X( 6),X( 8),X(14),X( 3));
+        BODY_60_79(71,B,C,D,E,T,A,X( 7),X( 9),X(15),X( 4));
+        BODY_60_79(72,A,B,C,D,E,T,X( 8),X(10),X( 0),X( 5));
+        BODY_60_79(73,T,A,B,C,D,E,X( 9),X(11),X( 1),X( 6));
+        BODY_60_79(74,E,T,A,B,C,D,X(10),X(12),X( 2),X( 7));
+        BODY_60_79(75,D,E,T,A,B,C,X(11),X(13),X( 3),X( 8));
+        BODY_60_79(76,C,D,E,T,A,B,X(12),X(14),X( 4),X( 9));
+        BODY_60_79(77,B,C,D,E,T,A,X(13),X(15),X( 5),X(10));
+        BODY_60_79(78,A,B,C,D,E,T,X(14),X( 0),X( 6),X(11));
+        BODY_60_79(79,T,A,B,C,D,E,X(15),X( 1),X( 7),X(12));
+        
+        c->h0=(c->h0+E)&0xffffffffL; 
+        c->h1=(c->h1+T)&0xffffffffL;
+        c->h2=(c->h2+A)&0xffffffffL;
+        c->h3=(c->h3+B)&0xffffffffL;
+        c->h4=(c->h4+C)&0xffffffffL;
+
+        if (--num <= 0) break;
+
+        A=c->h0;
+        B=c->h1;
+        C=c->h2;
+        D=c->h3;
+        E=c->h4;
+
+        W+=SHA_LBLOCK;
+                }
+        }
+#endif
+
+#ifndef DONT_IMPLEMENT_BLOCK_DATA_ORDER
+void HASH_BLOCK_DATA_ORDER (SHA_CTX *c, const void *p, int num)
+        {
+        const unsigned char *data=p;
+        register unsigned long A,B,C,D,E,T,l;
+#ifndef MD32_XARRAY
+        unsigned long   XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
+                        XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
+#else
+        SHA_LONG        XX[16];
+#endif
+
+        A=c->h0;
+        B=c->h1;
+        C=c->h2;
+        D=c->h3;
+        E=c->h4;
+
+        for (;;)
+                {
+
+        HOST_c2l(data,l); X( 0)=l;              HOST_c2l(data,l); X( 1)=l;
+        BODY_00_15( 0,A,B,C,D,E,T,X( 0));       HOST_c2l(data,l); X( 2)=l;
+        BODY_00_15( 1,T,A,B,C,D,E,X( 1));       HOST_c2l(data,l); X( 3)=l;
+        BODY_00_15( 2,E,T,A,B,C,D,X( 2));       HOST_c2l(data,l); X( 4)=l;
+        BODY_00_15( 3,D,E,T,A,B,C,X( 3));       HOST_c2l(data,l); X( 5)=l;
+        BODY_00_15( 4,C,D,E,T,A,B,X( 4));       HOST_c2l(data,l); X( 6)=l;
+        BODY_00_15( 5,B,C,D,E,T,A,X( 5));       HOST_c2l(data,l); X( 7)=l;
+        BODY_00_15( 6,A,B,C,D,E,T,X( 6));       HOST_c2l(data,l); X( 8)=l;
+        BODY_00_15( 7,T,A,B,C,D,E,X( 7));       HOST_c2l(data,l); X( 9)=l;
+        BODY_00_15( 8,E,T,A,B,C,D,X( 8));       HOST_c2l(data,l); X(10)=l;
+        BODY_00_15( 9,D,E,T,A,B,C,X( 9));       HOST_c2l(data,l); X(11)=l;
+        BODY_00_15(10,C,D,E,T,A,B,X(10));       HOST_c2l(data,l); X(12)=l;
+        BODY_00_15(11,B,C,D,E,T,A,X(11));       HOST_c2l(data,l); X(13)=l;
+        BODY_00_15(12,A,B,C,D,E,T,X(12));       HOST_c2l(data,l); X(14)=l;
+        BODY_00_15(13,T,A,B,C,D,E,X(13));       HOST_c2l(data,l); X(15)=l;
+        BODY_00_15(14,E,T,A,B,C,D,X(14));
+        BODY_00_15(15,D,E,T,A,B,C,X(15));
+
+        BODY_16_19(16,C,D,E,T,A,B,X( 0),X( 0),X( 2),X( 8),X(13));
+        BODY_16_19(17,B,C,D,E,T,A,X( 1),X( 1),X( 3),X( 9),X(14));
+        BODY_16_19(18,A,B,C,D,E,T,X( 2),X( 2),X( 4),X(10),X(15));
+        BODY_16_19(19,T,A,B,C,D,E,X( 3),X( 3),X( 5),X(11),X( 0));
+
+        BODY_20_31(20,E,T,A,B,C,D,X( 4),X( 4),X( 6),X(12),X( 1));
+        BODY_20_31(21,D,E,T,A,B,C,X( 5),X( 5),X( 7),X(13),X( 2));
+        BODY_20_31(22,C,D,E,T,A,B,X( 6),X( 6),X( 8),X(14),X( 3));
+        BODY_20_31(23,B,C,D,E,T,A,X( 7),X( 7),X( 9),X(15),X( 4));
+        BODY_20_31(24,A,B,C,D,E,T,X( 8),X( 8),X(10),X( 0),X( 5));
+        BODY_20_31(25,T,A,B,C,D,E,X( 9),X( 9),X(11),X( 1),X( 6));
+        BODY_20_31(26,E,T,A,B,C,D,X(10),X(10),X(12),X( 2),X( 7));
+        BODY_20_31(27,D,E,T,A,B,C,X(11),X(11),X(13),X( 3),X( 8));
+        BODY_20_31(28,C,D,E,T,A,B,X(12),X(12),X(14),X( 4),X( 9));
+        BODY_20_31(29,B,C,D,E,T,A,X(13),X(13),X(15),X( 5),X(10));
+        BODY_20_31(30,A,B,C,D,E,T,X(14),X(14),X( 0),X( 6),X(11));
+        BODY_20_31(31,T,A,B,C,D,E,X(15),X(15),X( 1),X( 7),X(12));
+
+        BODY_32_39(32,E,T,A,B,C,D,X( 0),X( 2),X( 8),X(13));
+        BODY_32_39(33,D,E,T,A,B,C,X( 1),X( 3),X( 9),X(14));
+        BODY_32_39(34,C,D,E,T,A,B,X( 2),X( 4),X(10),X(15));
+        BODY_32_39(35,B,C,D,E,T,A,X( 3),X( 5),X(11),X( 0));
+        BODY_32_39(36,A,B,C,D,E,T,X( 4),X( 6),X(12),X( 1));
+        BODY_32_39(37,T,A,B,C,D,E,X( 5),X( 7),X(13),X( 2));
+        BODY_32_39(38,E,T,A,B,C,D,X( 6),X( 8),X(14),X( 3));
+        BODY_32_39(39,D,E,T,A,B,C,X( 7),X( 9),X(15),X( 4));
+
+        BODY_40_59(40,C,D,E,T,A,B,X( 8),X(10),X( 0),X( 5));
+        BODY_40_59(41,B,C,D,E,T,A,X( 9),X(11),X( 1),X( 6));
+        BODY_40_59(42,A,B,C,D,E,T,X(10),X(12),X( 2),X( 7));
+        BODY_40_59(43,T,A,B,C,D,E,X(11),X(13),X( 3),X( 8));
+        BODY_40_59(44,E,T,A,B,C,D,X(12),X(14),X( 4),X( 9));
+        BODY_40_59(45,D,E,T,A,B,C,X(13),X(15),X( 5),X(10));
+        BODY_40_59(46,C,D,E,T,A,B,X(14),X( 0),X( 6),X(11));
+        BODY_40_59(47,B,C,D,E,T,A,X(15),X( 1),X( 7),X(12));
+        BODY_40_59(48,A,B,C,D,E,T,X( 0),X( 2),X( 8),X(13));
+        BODY_40_59(49,T,A,B,C,D,E,X( 1),X( 3),X( 9),X(14));
+        BODY_40_59(50,E,T,A,B,C,D,X( 2),X( 4),X(10),X(15));
+        BODY_40_59(51,D,E,T,A,B,C,X( 3),X( 5),X(11),X( 0));
+        BODY_40_59(52,C,D,E,T,A,B,X( 4),X( 6),X(12),X( 1));
+        BODY_40_59(53,B,C,D,E,T,A,X( 5),X( 7),X(13),X( 2));
+        BODY_40_59(54,A,B,C,D,E,T,X( 6),X( 8),X(14),X( 3));
+        BODY_40_59(55,T,A,B,C,D,E,X( 7),X( 9),X(15),X( 4));
+        BODY_40_59(56,E,T,A,B,C,D,X( 8),X(10),X( 0),X( 5));
+        BODY_40_59(57,D,E,T,A,B,C,X( 9),X(11),X( 1),X( 6));
+        BODY_40_59(58,C,D,E,T,A,B,X(10),X(12),X( 2),X( 7));
+        BODY_40_59(59,B,C,D,E,T,A,X(11),X(13),X( 3),X( 8));
+
+        BODY_60_79(60,A,B,C,D,E,T,X(12),X(14),X( 4),X( 9));
+        BODY_60_79(61,T,A,B,C,D,E,X(13),X(15),X( 5),X(10));
+        BODY_60_79(62,E,T,A,B,C,D,X(14),X( 0),X( 6),X(11));
+        BODY_60_79(63,D,E,T,A,B,C,X(15),X( 1),X( 7),X(12));
+        BODY_60_79(64,C,D,E,T,A,B,X( 0),X( 2),X( 8),X(13));
+        BODY_60_79(65,B,C,D,E,T,A,X( 1),X( 3),X( 9),X(14));
+        BODY_60_79(66,A,B,C,D,E,T,X( 2),X( 4),X(10),X(15));
+        BODY_60_79(67,T,A,B,C,D,E,X( 3),X( 5),X(11),X( 0));
+        BODY_60_79(68,E,T,A,B,C,D,X( 4),X( 6),X(12),X( 1));
+        BODY_60_79(69,D,E,T,A,B,C,X( 5),X( 7),X(13),X( 2));
+        BODY_60_79(70,C,D,E,T,A,B,X( 6),X( 8),X(14),X( 3));
+        BODY_60_79(71,B,C,D,E,T,A,X( 7),X( 9),X(15),X( 4));
+        BODY_60_79(72,A,B,C,D,E,T,X( 8),X(10),X( 0),X( 5));
+        BODY_60_79(73,T,A,B,C,D,E,X( 9),X(11),X( 1),X( 6));
+        BODY_60_79(74,E,T,A,B,C,D,X(10),X(12),X( 2),X( 7));
+        BODY_60_79(75,D,E,T,A,B,C,X(11),X(13),X( 3),X( 8));
+        BODY_60_79(76,C,D,E,T,A,B,X(12),X(14),X( 4),X( 9));
+        BODY_60_79(77,B,C,D,E,T,A,X(13),X(15),X( 5),X(10));
+        BODY_60_79(78,A,B,C,D,E,T,X(14),X( 0),X( 6),X(11));
+        BODY_60_79(79,T,A,B,C,D,E,X(15),X( 1),X( 7),X(12));
+        
+        c->h0=(c->h0+E)&0xffffffffL; 
+        c->h1=(c->h1+T)&0xffffffffL;
+        c->h2=(c->h2+A)&0xffffffffL;
+        c->h3=(c->h3+B)&0xffffffffL;
+        c->h4=(c->h4+C)&0xffffffffL;
+
+        if (--num <= 0) break;
+
+        A=c->h0;
+        B=c->h1;
+        C=c->h2;
+        D=c->h3;
+        E=c->h4;
+
+                }
+        }
+#endif
diff --git a/src/lib/libcrypto/sha/shatest.c b/src/lib/libcrypto/sha/shatest.c
index 2b0744d937..a5786bbf76 100644
--- a/src/lib/libcrypto/sha/shatest.c
+++ b/src/lib/libcrypto/sha/shatest.c
@@ -76,26 +76,26 @@ int main(int argc, char *argv[])
 #define SHA_0 /* FIPS 180 */
 #undef  SHA_1 /* FIPS 180-1 */
 
-char *test[]={
+static char *test[]={
         "abc",
         "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
         NULL,
         };
 
 #ifdef SHA_0
-char *ret[]={
+static char *ret[]={
         "0164b8a914cd2a5e74c4f7ff082c4d97f1edf880",
         "d2516ee1acfa5baf33dfc1c471e438449ef134c8",
         };
-char *bigret=
+static char *bigret=
         "3232affa48628a26653b5aaa44541fd90d690603";
 #endif
 #ifdef SHA_1
-char *ret[]={
+static char *ret[]={
         "a9993e364706816aba3e25717850c26c9cd0d89d",
         "84983e441c3bd26ebaae4aa1f95129e5e54670f1",
         };
-char *bigret=
+static char *bigret=
         "34aa973cd4c4daa4f61eeb2bdbad27316534016f";
 #endif
 
diff --git a/src/lib/libcrypto/stack/Makefile.ssl b/src/lib/libcrypto/stack/Makefile.ssl
index faed4d0364..64a93b33ac 100644
--- a/src/lib/libcrypto/stack/Makefile.ssl
+++ b/src/lib/libcrypto/stack/Makefile.ssl
@@ -82,4 +82,5 @@ stack.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 stack.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 stack.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 stack.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-stack.o: ../../include/openssl/stack.h ../cryptlib.h
+stack.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+stack.o: ../cryptlib.h
diff --git a/src/lib/libcrypto/stack/stack.c b/src/lib/libcrypto/stack/stack.c
index 8b96713884..58e9126339 100644
--- a/src/lib/libcrypto/stack/stack.c
+++ b/src/lib/libcrypto/stack/stack.c
@@ -59,7 +59,7 @@
 /* Code for stacks
  * Author - Eric Young v 1.0
  * 1.2 eay 12-Mar-97 -  Modified sk_find so that it _DOES_ return the
- *                      lowest index for the seached item.
+ *                      lowest index for the searched item.
  *
  * 1.1 eay - Take from netdb and added to SSLeay
  *
@@ -126,7 +126,7 @@ STACK *sk_new(int (*c)())
         ret->sorted=0;
         return(ret);
 err1:
-        Free((char *)ret);
+        Free(ret);
 err0:
         return(NULL);
         }
@@ -276,8 +276,8 @@ void sk_pop_free(STACK *st, void (*func)())
 void sk_free(STACK *st)
         {
         if (st == NULL) return;
-        if (st->data != NULL) Free((char *)st->data);
-        Free((char *)st);
+        if (st->data != NULL) Free(st->data);
+        Free(st);
         }
 
 int sk_num(STACK *st)
diff --git a/src/lib/libcrypto/stack/stack.h b/src/lib/libcrypto/stack/stack.h
index 0f825cc0c4..a615d9b4c9 100644
--- a/src/lib/libcrypto/stack/stack.h
+++ b/src/lib/libcrypto/stack/stack.h
@@ -76,8 +76,8 @@ typedef struct stack_st
 
 #define sk_new_null()   sk_new(NULL)
 
-#define M_sk_num(sk)            ((sk)->num)
-#define M_sk_value(sk,n)        ((sk)->data[n])
+#define M_sk_num(sk)            ((sk) ? (sk)->num:-1)
+#define M_sk_value(sk,n)        ((sk) ? (sk)->data[n] : NULL)
 
 int sk_num(STACK *);
 char *sk_value(STACK *, int);
diff --git a/src/lib/libcrypto/threads/README b/src/lib/libcrypto/threads/README
new file mode 100644
index 0000000000..df6b26e146
--- /dev/null
+++ b/src/lib/libcrypto/threads/README
@@ -0,0 +1,14 @@
+Mutithreading testing area.
+
+Since this stuff is very very platorm specific, this is not part of the
+normal build.  Have a read of doc/threads.doc.
+
+mttest will do some testing and will currently build under Windows NT/95,
+Solaris and Linux.  The IRIX stuff is not finished.
+
+I have tested this program on a 12 CPU ultra sparc box (solaris 2.5.1)
+and things seem to work ok.
+
+The Linux pthreads package can be retrieved from 
+http://www.mit.edu:8001/people/proven/pthreads.html
+
diff --git a/src/lib/libcrypto/threads/mttest.c b/src/lib/libcrypto/threads/mttest.c
index 142623edda..24713a3157 100644
--- a/src/lib/libcrypto/threads/mttest.c
+++ b/src/lib/libcrypto/threads/mttest.c
@@ -74,26 +74,29 @@
 #include <ulocks.h>
 #include <sys/prctl.h>
 #endif
+#ifdef PTHREADS
+#include <pthread.h>
+#endif
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
-#include "../e_os.h"
+#include "../../e_os.h"
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <openssl/rand.h>
 
 #ifdef NO_FP_API
 #define APPS_WIN16
-#include "../crypto/buffer/bss_file.c"
+#include "../buffer/bss_file.c"
 #endif
 
-#define TEST_SERVER_CERT "../apps/server.pem"
-#define TEST_CLIENT_CERT "../apps/client.pem"
+#define TEST_SERVER_CERT "../../apps/server.pem"
+#define TEST_CLIENT_CERT "../../apps/client.pem"
 
 #define MAX_THREAD_NUMBER       100
 
-int MS_CALLBACK verify_callback(int ok, X509 *xs, X509 *xi, int depth,
-        int error,char *arg);
+int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *xs);
 void thread_setup(void);
 void thread_cleanup(void);
 void do_threads(SSL_CTX *s_ctx,SSL_CTX *c_ctx);
@@ -121,6 +124,8 @@ int number_of_loops=10;
 int reconnect=0;
 int cache_stats=0;
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
 int doit(char *ctx[4]);
 static void print_stats(FILE *fp, SSL_CTX *ctx)
 {
@@ -170,6 +175,8 @@ int main(int argc, char *argv[])
         char *ccert=TEST_CLIENT_CERT;
         SSL_METHOD *ssl_method=SSLv23_method();
 
+        RAND_seed(rnd_seed, sizeof rnd_seed);
+
         if (bio_err == NULL)
                 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
         if (bio_stdout == NULL)
@@ -244,7 +251,7 @@ bad:
         if (cipher == NULL) cipher=getenv("SSL_CIPHER");
 
         SSL_load_error_strings();
-        SSLeay_add_ssl_algorithms();
+        OpenSSL_add_ssl_algorithms();
 
         c_ctx=SSL_CTX_new(ssl_method);
         s_ctx=SSL_CTX_new(ssl_method);
@@ -259,8 +266,15 @@ bad:
         SSL_CTX_set_session_cache_mode(c_ctx,
                 SSL_SESS_CACHE_NO_AUTO_CLEAR|SSL_SESS_CACHE_SERVER);
 
-        SSL_CTX_use_certificate_file(s_ctx,scert,SSL_FILETYPE_PEM);
-        SSL_CTX_use_RSAPrivateKey_file(s_ctx,scert,SSL_FILETYPE_PEM);
+        if (!SSL_CTX_use_certificate_file(s_ctx,scert,SSL_FILETYPE_PEM))
+                {
+                ERR_print_errors(bio_err);
+                }
+        else if (!SSL_CTX_use_RSAPrivateKey_file(s_ctx,scert,SSL_FILETYPE_PEM))
+                {
+                ERR_print_errors(bio_err);
+                goto end;
+                }
 
         if (client_auth)
                 {
@@ -489,6 +503,7 @@ int doit(char *ctx[4])
                                         else
                                                 {
                                                 fprintf(stderr,"ERROR in CLIENT\n");
+                                                ERR_print_errors_fp(stderr);
                                                 return(1);
                                                 }
                                         }
@@ -520,6 +535,7 @@ int doit(char *ctx[4])
                                         else
                                                 {
                                                 fprintf(stderr,"ERROR in CLIENT\n");
+                                                ERR_print_errors_fp(stderr);
                                                 return(1);
                                                 }
                                         }
@@ -652,18 +668,23 @@ err:
         return(0);
         }
 
-int MS_CALLBACK verify_callback(int ok, X509 *xs, X509 *xi, int depth,
-             int error, char *arg)
+int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
         {
-        char buf[256];
+        char *s, buf[256];
 
         if (verbose)
                 {
-                X509_NAME_oneline(X509_get_subject_name(xs),buf,256);
-                if (ok)
-                        fprintf(stderr,"depth=%d %s\n",depth,buf);
-                else
-                        fprintf(stderr,"depth=%d error=%d %s\n",depth,error,buf);
+                s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),
+                                    buf,256);
+                if (s != NULL)
+                        {
+                        if (ok)
+                                fprintf(stderr,"depth=%d %s\n",
+                                        ctx->error_depth,buf);
+                        else
+                                fprintf(stderr,"depth=%d error=%d %s\n",
+                                        ctx->error_depth,ctx->error,buf);
+                        }
                 }
         return(ok);
         }
@@ -672,13 +693,14 @@ int MS_CALLBACK verify_callback(int ok, X509 *xs, X509 *xi, int depth,
 
 #ifdef WIN32
 
-static HANDLE lock_cs[CRYPTO_NUM_LOCKS];
+static HANDLE *lock_cs;
 
 void thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(HANDLE));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_cs[i]=CreateMutex(NULL,FALSE,NULL);
                 }
@@ -692,8 +714,9 @@ void thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 CloseHandle(lock_cs[i]);
+        Free(lock_cs);
         }
 
 void win32_locking_callback(int mode, int type, char *file, int line)
@@ -763,15 +786,17 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
 
 #ifdef SOLARIS
 
-static mutex_t lock_cs[CRYPTO_NUM_LOCKS];
-/*static rwlock_t lock_cs[CRYPTO_NUM_LOCKS]; */
-static long lock_count[CRYPTO_NUM_LOCKS];
+static mutex_t *lock_cs;
+/*static rwlock_t *lock_cs; */
+static long *lock_count;
 
 void thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(mutex_t));
+        lock_count=Malloc(CRYPTO_num_locks() * sizeof(long));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_count[i]=0;
                 /* rwlock_init(&(lock_cs[i]),USYNC_THREAD,NULL); */
@@ -787,31 +812,37 @@ void thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-fprintf(stderr,"cleanup\n");
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+
+        fprintf(stderr,"cleanup\n");
+
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 /* rwlock_destroy(&(lock_cs[i])); */
                 mutex_destroy(&(lock_cs[i]));
                 fprintf(stderr,"%8ld:%s\n",lock_count[i],CRYPTO_get_lock_name(i));
                 }
-fprintf(stderr,"done cleanup\n");
+        Free(lock_cs);
+        Free(lock_count);
+
+        fprintf(stderr,"done cleanup\n");
+
         }
 
 void solaris_locking_callback(int mode, int type, char *file, int line)
         {
 #ifdef undef
-fprintf(stderr,"thread=%4d mode=%s lock=%s %s:%d\n",
-        CRYPTO_thread_id(),
-        (mode&CRYPTO_LOCK)?"l":"u",
-        (type&CRYPTO_READ)?"r":"w",file,line);
+        fprintf(stderr,"thread=%4d mode=%s lock=%s %s:%d\n",
+                CRYPTO_thread_id(),
+                (mode&CRYPTO_LOCK)?"l":"u",
+                (type&CRYPTO_READ)?"r":"w",file,line);
 #endif
 
-/*
-if (CRYPTO_LOCK_SSL_CERT == type)
+        /*
+        if (CRYPTO_LOCK_SSL_CERT == type)
         fprintf(stderr,"(t,m,f,l) %ld %d %s %d\n",
                 CRYPTO_thread_id(),
                 mode,file,line);
-*/
+        */
         if (mode & CRYPTO_LOCK)
                 {
         /*      if (mode & CRYPTO_READ)
@@ -871,7 +902,7 @@ unsigned long solaris_thread_id(void)
 
 
 static usptr_t *arena;
-static usema_t *lock_cs[CRYPTO_NUM_LOCKS];
+static usema_t **lock_cs;
 
 void thread_setup(void)
         {
@@ -888,7 +919,8 @@ void thread_setup(void)
         arena=usinit(filename);
         unlink(filename);
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(usema_t *));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_cs[i]=usnewsema(arena,1);
                 }
@@ -902,7 +934,7 @@ void thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 char buf[10];
 
@@ -910,6 +942,7 @@ void thread_cleanup(void)
                 usdumpsema(lock_cs[i],stdout,buf);
                 usfreesema(lock_cs[i],arena);
                 }
+        Free(lock_cs);
         }
 
 void irix_locking_callback(int mode, int type, char *file, int line)
@@ -962,14 +995,16 @@ unsigned long irix_thread_id(void)
 
 #ifdef PTHREADS
 
-static pthread_mutex_t lock_cs[CRYPTO_NUM_LOCKS];
-static long lock_count[CRYPTO_NUM_LOCKS];
+static pthread_mutex_t *lock_cs;
+static long *lock_count;
 
 void thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
+        lock_count=Malloc(CRYPTO_num_locks() * sizeof(long));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_count[i]=0;
                 pthread_mutex_init(&(lock_cs[i]),NULL);
@@ -985,12 +1020,15 @@ void thread_cleanup(void)
 
         CRYPTO_set_locking_callback(NULL);
         fprintf(stderr,"cleanup\n");
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 pthread_mutex_destroy(&(lock_cs[i]));
                 fprintf(stderr,"%8ld:%s\n",lock_count[i],
                         CRYPTO_get_lock_name(i));
                 }
+        Free(lock_cs);
+        Free(lock_count);
+
         fprintf(stderr,"done cleanup\n");
         }
 
@@ -1045,7 +1083,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                 }
 
         printf("pthreads threads done (%d,%d)\n",
-        s_ctx->references,c_ctx->references);
+                s_ctx->references,c_ctx->references);
         }
 
 unsigned long pthreads_thread_id(void)
diff --git a/src/lib/libcrypto/threads/profile.sh b/src/lib/libcrypto/threads/profile.sh
new file mode 100644
index 0000000000..6e3e342fc0
--- /dev/null
+++ b/src/lib/libcrypto/threads/profile.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+/bin/rm -f mttest
+cc -p -DSOLARIS -I../../include -g mttest.c -o mttest -L/usr/lib/libc -ldl -L../.. -lthread  -lssl -lcrypto -lnsl -lsocket
+
diff --git a/src/lib/libcrypto/threads/ptest.bat b/src/lib/libcrypto/threads/ptest.bat
new file mode 100644
index 0000000000..4071b5ffea
--- /dev/null
+++ b/src/lib/libcrypto/threads/ptest.bat
@@ -0,0 +1,4 @@
+del mttest.exe
+
+purify cl /O2 -DWIN32 /MD -I..\..\out mttest.c /Femttest ..\..\out\ssl32.lib ..\..\out\crypt32.lib
+
diff --git a/src/lib/libcrypto/threads/pthread.sh b/src/lib/libcrypto/threads/pthread.sh
new file mode 100644
index 0000000000..f1c49821d2
--- /dev/null
+++ b/src/lib/libcrypto/threads/pthread.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+#
+# build using pthreads
+#
+# http://www.mit.edu:8001/people/proven/pthreads.html
+#
+/bin/rm -f mttest
+pgcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto 
+
diff --git a/src/lib/libcrypto/threads/pthread2.sh b/src/lib/libcrypto/threads/pthread2.sh
new file mode 100644
index 0000000000..41264c6a50
--- /dev/null
+++ b/src/lib/libcrypto/threads/pthread2.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+#
+# build using pthreads where it's already built into the system
+#
+/bin/rm -f mttest
+gcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto -lpthread
+
diff --git a/src/lib/libcrypto/threads/pthreads-vms.com b/src/lib/libcrypto/threads/pthreads-vms.com
new file mode 100644
index 0000000000..63f5b8cc2e
--- /dev/null
+++ b/src/lib/libcrypto/threads/pthreads-vms.com
@@ -0,0 +1,9 @@
+$! To compile mttest on VMS.
+$!
+$! WARNING: only tested with DEC C so far.
+$
+$ arch := vax
+$ if f$getsyi("CPU") .ge. 128 then arch := axp
+$ define/user openssl [--.include.openssl]
+$ cc/def=PTHREADS mttest.c
+$ link mttest,[--.'arch'.exe.ssl]libssl/lib,[--.'arch'.exe.crypto]libcrypto/lib
diff --git a/src/lib/libcrypto/threads/purify.sh b/src/lib/libcrypto/threads/purify.sh
new file mode 100644
index 0000000000..6d44fe26b7
--- /dev/null
+++ b/src/lib/libcrypto/threads/purify.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+/bin/rm -f mttest
+purify cc -DSOLARIS -I../../include -g mttest.c -o mttest -L../.. -lthread  -lssl -lcrypto -lnsl -lsocket
+
diff --git a/src/lib/libcrypto/threads/solaris.sh b/src/lib/libcrypto/threads/solaris.sh
new file mode 100644
index 0000000000..bc93094a27
--- /dev/null
+++ b/src/lib/libcrypto/threads/solaris.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+/bin/rm -f mttest
+cc -DSOLARIS -I../../include -g mttest.c -o mttest -L../.. -lthread  -lssl -lcrypto -lnsl -lsocket
+
diff --git a/src/lib/libcrypto/threads/th-lock.c b/src/lib/libcrypto/threads/th-lock.c
index afb4f4caf2..3ee978060c 100644
--- a/src/lib/libcrypto/threads/th-lock.c
+++ b/src/lib/libcrypto/threads/th-lock.c
@@ -74,6 +74,9 @@
 #include <ulocks.h>
 #include <sys/prctl.h>
 #endif
+#ifdef PTHREADS
+#include <pthread.h>
+#endif
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
@@ -82,7 +85,7 @@
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 
-int CRYPTO_thread_setup(void);
+void CRYPTO_thread_setup(void);
 void CRYPTO_thread_cleanup(void);
 
 static void irix_locking_callback(int mode,int type,char *file,int line);
@@ -96,7 +99,7 @@ static unsigned long pthreads_thread_id(void );
 
 /* usage:
  * CRYPTO_thread_setup();
- * applicaion code
+ * application code
  * CRYPTO_thread_cleanup();
  */
 
@@ -104,13 +107,14 @@ static unsigned long pthreads_thread_id(void );
 
 #ifdef WIN32
 
-static HANDLE lock_cs[CRYPTO_NUM_LOCKS];
+static HANDLE *lock_cs;
 
-int CRYPTO_thread_setup(void)
+void CRYPTO_thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(HANDLE));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_cs[i]=CreateMutex(NULL,FALSE,NULL);
                 }
@@ -125,8 +129,9 @@ static void CRYPTO_thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 CloseHandle(lock_cs[i]);
+        Free(lock_cs);
         }
 
 void win32_locking_callback(int mode, int type, char *file, int line)
@@ -147,18 +152,24 @@ void win32_locking_callback(int mode, int type, char *file, int line)
 
 #define USE_MUTEX
 
-static mutex_t lock_cs[CRYPTO_NUM_LOCKS];
 #ifdef USE_MUTEX
-static long lock_count[CRYPTO_NUM_LOCKS];
+static mutex_t *lock_cs;
 #else
-static rwlock_t lock_cs[CRYPTO_NUM_LOCKS];
+static rwlock_t *lock_cs;
 #endif
+static long *lock_count;
 
 void CRYPTO_thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+#ifdef USE_MUTEX
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(mutex_t));
+#else
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(rwlock_t));
+#endif
+        lock_count=Malloc(CRYPTO_num_locks() * sizeof(long));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_count[i]=0;
 #ifdef USE_MUTEX
@@ -177,7 +188,7 @@ void CRYPTO_thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
 #ifdef USE_MUTEX
                 mutex_destroy(&(lock_cs[i]));
@@ -185,6 +196,8 @@ void CRYPTO_thread_cleanup(void)
                 rwlock_destroy(&(lock_cs[i]));
 #endif
                 }
+        Free(lock_cs);
+        Free(lock_count);
         }
 
 void solaris_locking_callback(int mode, int type, char *file, int line)
@@ -237,7 +250,7 @@ unsigned long solaris_thread_id(void)
 /* I don't think this works..... */
 
 static usptr_t *arena;
-static usema_t *lock_cs[CRYPTO_NUM_LOCKS];
+static usema_t **lock_cs;
 
 void CRYPTO_thread_setup(void)
         {
@@ -254,7 +267,8 @@ void CRYPTO_thread_setup(void)
         arena=usinit(filename);
         unlink(filename);
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(usema_t *));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_cs[i]=usnewsema(arena,1);
                 }
@@ -268,7 +282,7 @@ void CRYPTO_thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 char buf[10];
 
@@ -276,6 +290,7 @@ void CRYPTO_thread_cleanup(void)
                 usdumpsema(lock_cs[i],stdout,buf);
                 usfreesema(lock_cs[i],arena);
                 }
+        Free(lock_cs);
         }
 
 void irix_locking_callback(int mode, int type, char *file, int line)
@@ -302,14 +317,16 @@ unsigned long irix_thread_id(void)
 /* Linux and a few others */
 #ifdef PTHREADS
 
-static pthread_mutex_t lock_cs[CRYPTO_NUM_LOCKS];
-static long lock_count[CRYPTO_NUM_LOCKS];
+static pthread_mutex_t *lock_cs;
+static long *lock_count;
 
 void CRYPTO_thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
+        lock_count=Malloc(CRYPTO_num_locks() * sizeof(long));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_count[i]=0;
                 pthread_mutex_init(&(lock_cs[i]),NULL);
@@ -324,10 +341,12 @@ void thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 pthread_mutex_destroy(&(lock_cs[i]));
                 }
+        Free(lock_cs);
+        Free(lock_count);
         }
 
 void pthreads_locking_callback(int mode, int type, char *file,
diff --git a/src/lib/libcrypto/threads/win32.bat b/src/lib/libcrypto/threads/win32.bat
new file mode 100644
index 0000000000..ee6da80a07
--- /dev/null
+++ b/src/lib/libcrypto/threads/win32.bat
@@ -0,0 +1,4 @@
+del mttest.exe
+
+cl /O2 -DWIN32 /MD -I..\..\out mttest.c /Femttest ..\..\out\ssleay32.lib ..\..\out\libeay32.lib
+
diff --git a/src/lib/libcrypto/txt_db/Makefile.ssl b/src/lib/libcrypto/txt_db/Makefile.ssl
index 02b863bf89..a631dce6f2 100644
--- a/src/lib/libcrypto/txt_db/Makefile.ssl
+++ b/src/lib/libcrypto/txt_db/Makefile.ssl
@@ -82,5 +82,6 @@ txt_db.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 txt_db.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 txt_db.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 txt_db.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
-txt_db.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-txt_db.o: ../../include/openssl/txt_db.h ../cryptlib.h
+txt_db.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+txt_db.o: ../../include/openssl/stack.h ../../include/openssl/txt_db.h
+txt_db.o: ../cryptlib.h
diff --git a/src/lib/libcrypto/txt_db/txt_db.c b/src/lib/libcrypto/txt_db/txt_db.c
index 9a9fa5ce55..33acc81f3f 100644
--- a/src/lib/libcrypto/txt_db/txt_db.c
+++ b/src/lib/libcrypto/txt_db/txt_db.c
@@ -181,7 +181,7 @@ err:
 #endif
                 if (ret->data != NULL) sk_free(ret->data);
                 if (ret->index != NULL) Free(ret->index);
-                if (ret->qual != NULL) Free((char *)ret->qual);
+                if (ret->qual != NULL) Free(ret->qual);
                 if (ret != NULL) Free(ret);
                 return(NULL);
                 }
@@ -205,7 +205,7 @@ char **TXT_DB_get_by_index(TXT_DB *db, int idx, char **value)
                 db->error=DB_ERROR_NO_INDEX;
                 return(NULL);
                 }
-        ret=(char **)lh_retrieve(lh,(char *)value);
+        ret=(char **)lh_retrieve(lh,value);
         db->error=DB_ERROR_OK;
         return(ret);
         }
@@ -306,7 +306,7 @@ int TXT_DB_insert(TXT_DB *db, char **row)
                         {
                         if ((db->qual[i] != NULL) &&
                                 (db->qual[i](row) == 0)) continue;
-                        r=(char **)lh_retrieve(db->index[i],(char *)row);
+                        r=(char **)lh_retrieve(db->index[i],row);
                         if (r != NULL)
                                 {
                                 db->error=DB_ERROR_INDEX_CLASH;
@@ -329,7 +329,7 @@ int TXT_DB_insert(TXT_DB *db, char **row)
                         {
                         if ((db->qual[i] != NULL) &&
                                 (db->qual[i](row) == 0)) continue;
-                        lh_insert(db->index[i],(char *)row);
+                        lh_insert(db->index[i],row);
                         }
                 }
         return(1);
diff --git a/src/lib/libcrypto/util/domd b/src/lib/libcrypto/util/domd
index 324051f60b..9f75131f22 100644
--- a/src/lib/libcrypto/util/domd
+++ b/src/lib/libcrypto/util/domd
@@ -7,5 +7,5 @@ shift
 
 cp Makefile.ssl Makefile.save
 makedepend -f Makefile.ssl $@
-$TOP/util/clean-depend.pl < Makefile.ssl > Makefile.new
+perl $TOP/util/clean-depend.pl < Makefile.ssl > Makefile.new
 mv Makefile.new Makefile.ssl
diff --git a/src/lib/libcrypto/util/libeay.num b/src/lib/libcrypto/util/libeay.num
index 59c2040a29..e3818ef6e4 100644
--- a/src/lib/libcrypto/util/libeay.num
+++ b/src/lib/libcrypto/util/libeay.num
@@ -499,9 +499,9 @@ SHA1_Update				504
 SHA_Final                               505
 SHA_Init                                506
 SHA_Update                              507
-SSLeay_add_all_algorithms               508
-SSLeay_add_all_ciphers                  509
-SSLeay_add_all_digests                  510
+OpenSSL_add_all_algorithms              508
+OpenSSL_add_all_ciphers                 509
+OpenSSL_add_all_digests                 510
 TXT_DB_create_index                     511
 TXT_DB_free                             512
 TXT_DB_get_by_index                     513
@@ -1304,13 +1304,12 @@ i2d_SXNETID                             1329
 d2i_SXNETID                             1330
 SXNETID_new                             1331
 SXNETID_free                            1332
-DSA_SIG_new                                                             1333
-DSA_SIG_free                                                    1334
-DSA_do_sign                                                             1335
-DSA_do_verify                                                   1336
-d2i_DSA_SIG                                                             1337
-i2d_DSA_SIG                                                             1338
-
+DSA_SIG_new                             1333
+DSA_SIG_free                            1334
+DSA_do_sign                             1335
+DSA_do_verify                           1336
+d2i_DSA_SIG                             1337
+i2d_DSA_SIG                             1338
 i2d_ASN1_VISIBLESTRING                  1339
 d2i_ASN1_VISIBLESTRING                  1340
 i2d_ASN1_UTF8STRING                     1341
@@ -1844,3 +1843,387 @@ sk_DIST_POINT_sort                      1868
 RSA_check_key                           1869
 OBJ_obj2txt                             1870
 DSA_dup_DH                              1871
+X509_REQ_get_extensions                 1872
+X509_REQ_set_extension_nids             1873
+BIO_nwrite                              1874
+X509_REQ_extension_nid                  1875
+BIO_nread                               1876
+X509_REQ_get_extension_nids              1877
+BIO_nwrite0                             1878
+X509_REQ_add_extensions_nid             1879
+BIO_nread0                              1880
+X509_REQ_add_extensions                 1881
+BIO_new_mem_buf                         1882
+DH_set_ex_data                          1883
+DH_set_method                           1884
+DSA_OpenSSL                             1885
+DH_get_ex_data                          1886
+DH_get_ex_new_index                     1887
+DSA_new_method                          1888
+DH_new_method                           1889
+DH_OpenSSL                              1890
+DSA_get_ex_new_index                    1891
+DH_get_default_method                   1892
+DSA_set_ex_data                         1893
+DH_set_default_method                   1894
+DSA_get_ex_data                         1895
+X509V3_EXT_REQ_add_conf                 1896
+NETSCAPE_SPKI_print                     1897
+NETSCAPE_SPKI_set_pubkey                1898
+NETSCAPE_SPKI_b64_encode                1899
+NETSCAPE_SPKI_get_pubkey                1900
+NETSCAPE_SPKI_b64_decode                1901
+UTF8_putc                               1902
+UTF8_getc                               1903
+RSA_null_method                         1904
+ASN1_tag2str                            1905
+BIO_ctrl_reset_read_request             1906
+DISPLAYTEXT_new                         1907
+ASN1_GENERALIZEDTIME_free               1908
+X509_REVOKED_get_ext_d2i                1909
+X509_set_ex_data                        1910
+X509_reject_set_bit_asc                 1911
+X509_NAME_add_entry_by_txt              1912
+sk_X509_TRUST_pop                       1913
+X509_NAME_add_entry_by_NID              1914
+X509_PURPOSE_get0                       1915
+sk_ACCESS_DESCRIPTION_shift             1916
+PEM_read_X509_AUX                       1917
+d2i_AUTHORITY_INFO_ACCESS               1918
+sk_X509_TRUST_set_cmp_func              1919
+sk_X509_TRUST_free                      1920
+PEM_write_PUBKEY                        1921
+sk_X509_TRUST_num                       1922
+sk_ACCESS_DESCRIPTION_delete            1923
+sk_ASN1_STRING_TABLE_value              1924
+ACCESS_DESCRIPTION_new                  1925
+X509_CERT_AUX_free                      1926
+d2i_ACCESS_DESCRIPTION                  1927
+X509_trust_clear                        1928
+sk_X509_PURPOSE_value                   1929
+sk_X509_PURPOSE_zero                    1930
+X509_TRUST_add                          1931
+ASN1_VISIBLESTRING_new                  1932
+X509_alias_set1                         1933
+ASN1_PRINTABLESTRING_free               1934
+EVP_PKEY_get1_DSA                       1935
+ASN1_BMPSTRING_new                      1936
+ASN1_mbstring_copy                      1937
+ASN1_UTF8STRING_new                     1938
+sk_ACCESS_DESCRIPTION_set               1939
+sk_X509_PURPOSE_pop                     1940
+DSA_get_default_method                  1941
+sk_X509_PURPOSE_push                    1942
+sk_X509_PURPOSE_delete                  1943
+sk_X509_PURPOSE_num                     1944
+i2d_ASN1_SET_OF_ACCESS_DESCRIPTION      1945
+ASN1_T61STRING_free                     1946
+sk_ACCESS_DESCRIPTION_free              1947
+sk_ASN1_STRING_TABLE_pop                1948
+DSA_set_method                          1949
+X509_get_ex_data                        1950
+ASN1_STRING_type                        1951
+X509_PURPOSE_get_by_sname               1952
+sk_X509_PURPOSE_find                    1953
+ASN1_TIME_free                          1954
+ASN1_OCTET_STRING_cmp                   1955
+sk_ACCESS_DESCRIPTION_value             1956
+ASN1_BIT_STRING_new                     1957
+X509_get_ext_d2i                        1958
+PEM_read_bio_X509_AUX                   1959
+ASN1_STRING_set_default_mask_asc        1960
+PEM_write_bio_RSA_PUBKEY                1961
+sk_ASN1_STRING_TABLE_num                1962
+ASN1_INTEGER_cmp                        1963
+d2i_RSA_PUBKEY_fp                       1964
+sk_ACCESS_DESCRIPTION_unshift           1965
+sk_ASN1_STRING_TABLE_delete_ptr         1966
+X509_trust_set_bit_asc                  1967
+PEM_write_bio_DSA_PUBKEY                1968
+X509_STORE_CTX_free                     1969
+EVP_PKEY_set1_DSA                       1970
+i2d_DSA_PUBKEY_fp                       1971
+X509_load_cert_crl_file                 1972
+ASN1_TIME_new                           1973
+i2d_RSA_PUBKEY                          1974
+sk_X509_TRUST_pop_free                  1975
+X509_STORE_CTX_purpose_inherit          1976
+PEM_read_RSA_PUBKEY                     1977
+sk_X509_TRUST_zero                      1978
+sk_ACCESS_DESCRIPTION_pop_free          1979
+d2i_X509_AUX                            1980
+i2d_DSA_PUBKEY                          1981
+X509_CERT_AUX_print                     1982
+sk_X509_PURPOSE_new_null                1983
+PEM_read_DSA_PUBKEY                     1984
+i2d_RSA_PUBKEY_bio                      1985
+ASN1_BIT_STRING_num_asc                 1986
+i2d_PUBKEY                              1987
+ASN1_UTCTIME_free                       1988
+DSA_set_default_method                  1989
+X509_PURPOSE_get_by_id                  1990
+sk_X509_TRUST_push                      1991
+sk_ASN1_STRING_TABLE_sort               1992
+sk_X509_PURPOSE_set_cmp_func            1993
+ACCESS_DESCRIPTION_free                 1994
+PEM_read_bio_PUBKEY                     1995
+ASN1_STRING_set_by_NID                  1996
+X509_PURPOSE_get_id                     1997
+DISPLAYTEXT_free                        1998
+OTHERNAME_new                           1999
+sk_X509_TRUST_find                      2000
+X509_CERT_AUX_new                       2001
+sk_ACCESS_DESCRIPTION_dup               2002
+sk_ASN1_STRING_TABLE_pop_free           2003
+sk_ASN1_STRING_TABLE_unshift            2004
+sk_X509_TRUST_shift                     2005
+sk_ACCESS_DESCRIPTION_zero              2006
+X509_TRUST_cleanup                      2007
+X509_NAME_add_entry_by_OBJ              2008
+X509_CRL_get_ext_d2i                    2009
+sk_X509_TRUST_set                       2010
+X509_PURPOSE_get0_name                  2011
+PEM_read_PUBKEY                         2012
+sk_ACCESS_DESCRIPTION_new               2013
+i2d_DSA_PUBKEY_bio                      2014
+i2d_OTHERNAME                           2015
+ASN1_OCTET_STRING_free                  2016
+ASN1_BIT_STRING_set_asc                 2017
+sk_ACCESS_DESCRIPTION_push              2018
+X509_get_ex_new_index                   2019
+ASN1_STRING_TABLE_cleanup               2020
+X509_TRUST_get_by_id                    2021
+X509_PURPOSE_get_trust                  2022
+ASN1_STRING_length                      2023
+d2i_ASN1_SET_OF_ACCESS_DESCRIPTION      2024
+ASN1_PRINTABLESTRING_new                2025
+X509V3_get_d2i                          2026
+ASN1_ENUMERATED_free                    2027
+i2d_X509_CERT_AUX                       2028
+sk_ACCESS_DESCRIPTION_find              2029
+X509_STORE_CTX_set_trust                2030
+sk_X509_PURPOSE_unshift                 2031
+ASN1_STRING_set_default_mask            2032
+X509_STORE_CTX_new                      2033
+EVP_PKEY_get1_RSA                       2034
+sk_X509_PURPOSE_set                     2035
+sk_ASN1_STRING_TABLE_insert             2036
+sk_X509_PURPOSE_sort                    2037
+DIRECTORYSTRING_free                    2038
+PEM_write_X509_AUX                      2039
+ASN1_OCTET_STRING_set                   2040
+d2i_DSA_PUBKEY_fp                       2041
+sk_ASN1_STRING_TABLE_free               2042
+sk_X509_TRUST_value                     2043
+d2i_RSA_PUBKEY                          2044
+sk_ASN1_STRING_TABLE_set                2045
+X509_TRUST_get0_name                    2046
+X509_TRUST_get0                         2047
+AUTHORITY_INFO_ACCESS_free              2048
+ASN1_IA5STRING_new                      2049
+d2i_DSA_PUBKEY                          2050
+X509_check_purpose                      2051
+ASN1_ENUMERATED_new                     2052
+d2i_RSA_PUBKEY_bio                      2053
+d2i_PUBKEY                              2054
+X509_TRUST_get_trust                    2055
+X509_TRUST_get_flags                    2056
+ASN1_BMPSTRING_free                     2057
+ASN1_T61STRING_new                      2058
+sk_X509_TRUST_unshift                   2059
+ASN1_UTCTIME_new                        2060
+sk_ACCESS_DESCRIPTION_pop               2061
+i2d_AUTHORITY_INFO_ACCESS               2062
+EVP_PKEY_set1_RSA                       2063
+X509_STORE_CTX_set_purpose              2064
+ASN1_IA5STRING_free                     2065
+PEM_write_bio_X509_AUX                  2066
+X509_PURPOSE_get_count                  2067
+CRYPTO_add_info                         2068
+sk_ACCESS_DESCRIPTION_num               2069
+sk_ASN1_STRING_TABLE_set_cmp_func       2070
+X509_NAME_ENTRY_create_by_txt           2071
+ASN1_STRING_get_default_mask            2072
+sk_X509_TRUST_dup                       2073
+X509_alias_get0                         2074
+ASN1_STRING_data                        2075
+sk_X509_TRUST_insert                    2076
+i2d_ACCESS_DESCRIPTION                  2077
+X509_trust_set_bit                      2078
+sk_X509_PURPOSE_delete_ptr              2079
+ASN1_BIT_STRING_free                    2080
+PEM_read_bio_RSA_PUBKEY                 2081
+X509_add1_reject_object                 2082
+X509_check_trust                        2083
+sk_X509_TRUST_new_null                  2084
+sk_ACCESS_DESCRIPTION_new_null          2085
+sk_ACCESS_DESCRIPTION_delete_ptr        2086
+sk_X509_TRUST_sort                      2087
+PEM_read_bio_DSA_PUBKEY                 2088
+sk_X509_TRUST_new                       2089
+X509_PURPOSE_add                        2090
+ASN1_STRING_TABLE_get                   2091
+ASN1_UTF8STRING_free                    2092
+d2i_DSA_PUBKEY_bio                      2093
+sk_ASN1_STRING_TABLE_delete             2094
+PEM_write_RSA_PUBKEY                    2095
+d2i_OTHERNAME                           2096
+sk_ACCESS_DESCRIPTION_insert            2097
+X509_reject_set_bit                     2098
+sk_X509_TRUST_delete_ptr                2099
+sk_X509_PURPOSE_pop_free                2100
+PEM_write_DSA_PUBKEY                    2101
+sk_X509_PURPOSE_free                    2102
+sk_X509_PURPOSE_dup                     2103
+sk_ASN1_STRING_TABLE_zero               2104
+X509_PURPOSE_get0_sname                 2105
+sk_ASN1_STRING_TABLE_shift              2106
+EVP_PKEY_set1_DH                        2107
+ASN1_OCTET_STRING_dup                   2108
+ASN1_BIT_STRING_set                     2109
+X509_TRUST_get_count                    2110
+ASN1_INTEGER_free                       2111
+OTHERNAME_free                          2112
+i2d_RSA_PUBKEY_fp                       2113
+ASN1_INTEGER_dup                        2114
+d2i_X509_CERT_AUX                       2115
+sk_ASN1_STRING_TABLE_new_null           2116
+PEM_write_bio_PUBKEY                    2117
+ASN1_VISIBLESTRING_free                 2118
+X509_PURPOSE_cleanup                    2119
+sk_ASN1_STRING_TABLE_push               2120
+sk_ASN1_STRING_TABLE_dup                2121
+sk_X509_PURPOSE_shift                   2122
+ASN1_mbstring_ncopy                     2123
+sk_X509_PURPOSE_new                     2124
+sk_X509_PURPOSE_insert                  2125
+ASN1_GENERALIZEDTIME_new                2126
+sk_ACCESS_DESCRIPTION_sort              2127
+EVP_PKEY_get1_DH                        2128
+sk_ACCESS_DESCRIPTION_set_cmp_func      2129
+ASN1_OCTET_STRING_new                   2130
+ASN1_INTEGER_new                        2131
+i2d_X509_AUX                            2132
+sk_ASN1_STRING_TABLE_find               2133
+ASN1_BIT_STRING_name_print              2134
+X509_cmp                                2135
+ASN1_STRING_length_set                  2136
+DIRECTORYSTRING_new                     2137
+sk_ASN1_STRING_TABLE_new                2138
+sk_X509_TRUST_delete                    2139
+X509_add1_trust_object                  2140
+PKCS12_newpass                          2141
+SMIME_write_PKCS7                       2142
+SMIME_read_PKCS7                        2143
+des_set_key_checked                     2144
+PKCS7_verify                            2145
+PKCS7_encrypt                           2146
+des_set_key_unchecked                   2147
+SMIME_crlf_copy                         2148
+i2d_ASN1_PRINTABLESTRING                2149
+PKCS7_get0_signers                      2150
+PKCS7_decrypt                           2151
+SMIME_text                              2152
+PKCS7_simple_smimecap                   2153
+PKCS7_get_smimecap                      2154
+PKCS7_sign                              2155
+PKCS7_add_attrib_smimecap               2156
+CRYPTO_dbg_set_options                  2157
+CRYPTO_remove_all_info                  2158
+CRYPTO_get_mem_debug_functions          2159
+CRYPTO_is_mem_check_on                  2160
+CRYPTO_set_mem_debug_functions          2161
+CRYPTO_pop_info                         2162
+CRYPTO_push_info_                       2163
+CRYPTO_set_mem_debug_options            2164
+PEM_write_PKCS8PrivateKey_nid           2165
+PEM_write_bio_PKCS8PrivateKey_nid       2166
+d2i_PKCS8PrivateKey_bio                 2167
+ASN1_NULL_free                          2168
+d2i_ASN1_NULL                           2169
+ASN1_NULL_new                           2170
+i2d_PKCS8PrivateKey_bio                 2171
+i2d_PKCS8PrivateKey_fp                  2172
+i2d_ASN1_NULL                           2173
+i2d_PKCS8PrivateKey_nid_fp              2174
+d2i_PKCS8PrivateKey_fp                  2175
+i2d_PKCS8PrivateKey_nid_bio             2176
+i2d_PKCS8PrivateKeyInfo_fp              2177
+i2d_PKCS8PrivateKeyInfo_bio             2178
+PEM_cb                                  2179
+i2d_PrivateKey_fp                       2180
+d2i_PrivateKey_bio                      2181
+d2i_PrivateKey_fp                       2182
+i2d_PrivateKey_bio                      2183
+X509_reject_clear                       2184
+X509_TRUST_set_default                  2185
+d2i_AutoPrivateKey                      2186
+X509_ATTRIBUTE_get0_type                2187
+X509_ATTRIBUTE_set1_data                2188
+X509at_get_attr                         2189
+X509at_get_attr_count                   2190
+X509_ATTRIBUTE_create_by_NID            2191
+X509_ATTRIBUTE_set1_object              2192
+X509_ATTRIBUTE_count                    2193
+X509_ATTRIBUTE_create_by_OBJ            2194
+X509_ATTRIBUTE_get0_object              2195
+X509at_get_attr_by_NID                  2196
+X509at_add1_attr                        2197
+X509_ATTRIBUTE_get0_data                2198
+X509at_delete_attr                      2199
+X509at_get_attr_by_OBJ                  2200
+RAND_add                                2201
+BIO_number_written                      2202
+BIO_number_read                         2203
+X509_STORE_CTX_get1_chain               2204
+ERR_load_RAND_strings                   2205
+RAND_pseudo_bytes                       2206
+X509_REQ_get_attr_by_NID                2207
+X509_REQ_get_attr                       2208
+X509_REQ_add1_attr_by_NID               2209
+X509_REQ_get_attr_by_OBJ                2210
+X509at_add1_attr_by_NID                 2211
+X509_REQ_add1_attr_by_OBJ               2212
+X509_REQ_get_attr_count                 2213
+X509_REQ_add1_attr                      2214
+X509_REQ_delete_attr                    2215
+X509at_add1_attr_by_OBJ                 2216
+X509_REQ_add1_attr_by_txt               2217
+X509_ATTRIBUTE_create_by_txt            2218
+X509at_add1_attr_by_txt                 2219
+sk_CRYPTO_EX_DATA_FUNCS_delete          2220
+sk_CRYPTO_EX_DATA_FUNCS_set             2221
+sk_CRYPTO_EX_DATA_FUNCS_unshift         2222
+sk_CRYPTO_EX_DATA_FUNCS_new_null        2223
+sk_CRYPTO_EX_DATA_FUNCS_set_cmp_func    2224
+sk_CRYPTO_EX_DATA_FUNCS_sort            2225
+sk_CRYPTO_EX_DATA_FUNCS_dup             2226
+sk_CRYPTO_EX_DATA_FUNCS_shift           2227
+sk_CRYPTO_EX_DATA_FUNCS_value           2228
+sk_CRYPTO_EX_DATA_FUNCS_pop             2229
+sk_CRYPTO_EX_DATA_FUNCS_push            2230
+sk_CRYPTO_EX_DATA_FUNCS_find            2231
+sk_CRYPTO_EX_DATA_FUNCS_new             2232
+sk_CRYPTO_EX_DATA_FUNCS_free            2233
+sk_CRYPTO_EX_DATA_FUNCS_delete_ptr      2234
+sk_CRYPTO_EX_DATA_FUNCS_num             2235
+sk_CRYPTO_EX_DATA_FUNCS_pop_free        2236
+sk_CRYPTO_EX_DATA_FUNCS_insert          2237
+sk_CRYPTO_EX_DATA_FUNCS_zero            2238
+BN_pseudo_rand                          2239
+BN_is_prime_fasttest                    2240
+BN_CTX_end                              2241
+BN_CTX_start                            2242
+BN_CTX_get                              2243
+EVP_PKEY2PKCS8_broken                   2244
+ASN1_STRING_TABLE_add                   2245
+CRYPTO_dbg_get_options                  2246
+AUTHORITY_INFO_ACCESS_new               2247
+CRYPTO_get_mem_debug_options            2248
+des_crypt                               2249
+PEM_write_bio_X509_REQ_NEW              2250
+PEM_write_X509_REQ_NEW                  2251
+BIO_callback_ctrl                       2252
+RAND_egd                                2253
+RAND_status                             2254
+bn_dump1                                2255
diff --git a/src/lib/libcrypto/util/mkdef.pl b/src/lib/libcrypto/util/mkdef.pl
index 80384af325..4e2845a4e1 100644
--- a/src/lib/libcrypto/util/mkdef.pl
+++ b/src/lib/libcrypto/util/mkdef.pl
@@ -6,26 +6,34 @@
 # prototyped functions: it then prunes the output.
 #
 
-$crypto_num="util/libeay.num";
-$ssl_num=   "util/ssleay.num";
+my $crypto_num="util/libeay.num";
+my $ssl_num=   "util/ssleay.num";
 
 my $do_update = 0;
 my $do_crypto = 0;
 my $do_ssl = 0;
-$rsaref = 0;
+my $do_ctest = 0;
+my $rsaref = 0;
 
-$W32=1;
-$NT=0;
+my $W32=1;
+my $NT=0;
 # Set this to make typesafe STACK definitions appear in DEF
-$safe_stack_def = 1;
+my $safe_stack_def = 1;
 
-$options="";
+my $options="";
 open(IN,"<Makefile.ssl") || die "unable to open Makefile.ssl!\n";
 while(<IN>) {
     $options=$1 if (/^OPTIONS=(.*)$/);
 }
 close(IN);
 
+# The following ciphers may be excluded (by Configure). This means functions
+# defined with ifndef(NO_XXX) are not included in the .def file, and everything
+# in directory xxx is ignored.
+my $no_rc2; my $no_rc4; my $no_rc5; my $no_idea; my $no_des; my $no_bf;
+my $no_cast; my $no_md2; my $no_md5; my $no_sha; my $no_ripemd; my $no_mdc2;
+my $no_rsa; my $no_dsa; my $no_dh; my $no_hmac=0;
+
 foreach (@ARGV, split(/ /, $options))
         {
         $W32=1 if $_ eq "32";
@@ -39,6 +47,7 @@ foreach (@ARGV, split(/ /, $options))
         $do_crypto=1 if $_ eq "libeay";
         $do_crypto=1 if $_ eq "crypto";
         $do_update=1 if $_ eq "update";
+        $do_ctest=1 if $_ eq "ctest";
         $rsaref=1 if $_ eq "rsaref";
 
         if    (/^no-rc2$/)      { $no_rc2=1; }
@@ -59,6 +68,7 @@ foreach (@ARGV, split(/ /, $options))
         elsif (/^no-hmac$/)     { $no_hmac=1; }
         }
 
+
 if (!$do_ssl && !$do_crypto)
         {
         print STDERR "usage: $0 ( ssl | crypto ) [ 16 | 32 | NT ] [rsaref]\n";
@@ -70,9 +80,9 @@ $max_ssl = $max_num;
 %crypto_list=&load_numbers($crypto_num);
 $max_crypto = $max_num;
 
-$ssl="ssl/ssl.h";
+my $ssl="ssl/ssl.h";
 
-$crypto ="crypto/crypto.h";
+my $crypto ="crypto/crypto.h";
 $crypto.=" crypto/des/des.h" unless $no_des;
 $crypto.=" crypto/idea/idea.h" unless $no_idea;
 $crypto.=" crypto/rc4/rc4.h" unless $no_rc4;
@@ -115,8 +125,8 @@ $crypto.=" crypto/rand/rand.h";
 $crypto.=" crypto/comp/comp.h";
 $crypto.=" crypto/tmdiff.h";
 
-@ssl_func = &do_defs("SSLEAY", $ssl);
-@crypto_func = &do_defs("LIBEAY", $crypto);
+my @ssl_func = &do_defs("SSLEAY", $ssl);
+my @crypto_func = &do_defs("LIBEAY", $crypto);
 
 
 if ($do_update) {
@@ -131,7 +141,26 @@ if($do_crypto == 1) {
         open(OUT, ">>$crypto_num");
         &update_numbers(*OUT,"LIBEAY",*crypto_list,$max_crypto, @crypto_func);
         close OUT;
-}
+} 
+
+} elsif ($do_ctest) {
+
+        print <<"EOF";
+
+/* Test file to check all DEF file symbols are present by trying
+ * to link to all of them. This is *not* intended to be run!
+ */
+
+int main()
+{
+EOF
+        &print_test_file(*STDOUT,"SSLEAY",*ssl_list,@ssl_func)
+                if $do_ssl == 1;
+
+        &print_test_file(*STDOUT,"LIBEAY",*crypto_list,@crypto_func)
+                if $do_crypto == 1;
+
+        print "}\n";
 
 } else {
 
@@ -147,14 +176,15 @@ if($do_crypto == 1) {
 sub do_defs
 {
         my($name,$files)=@_;
+        my $file;
         my @ret;
         my %funcs;
+        my $cpp;
 
         foreach $file (split(/\s+/,$files))
                 {
                 open(IN,"<$file") || die "unable to open $file:$!\n";
-
-                my $line = "", $def= "";
+                my $line = "", my $def= "";
                 my %tag = (
                         FreeBSD         => 0,
                         NOPROTO         => 0,
@@ -164,6 +194,22 @@ sub do_defs
                         NO_FP_API       => 0,
                         CONST_STRICT    => 0,
                         TRUE            => 1,
+                        NO_RC2          => 0,
+                        NO_RC4          => 0,
+                        NO_RC5          => 0,
+                        NO_IDEA         => 0,
+                        NO_DES          => 0,
+                        NO_BF           => 0,
+                        NO_CAST         => 0,
+                        NO_MD2          => 0,
+                        NO_MD5          => 0,
+                        NO_SHA          => 0,
+                        NO_RIPEMD       => 0,
+                        NO_MDC2         => 0,
+                        NO_RSA          => 0,
+                        NO_DSA          => 0,
+                        NO_DH           => 0,
+                        NO_HMAC         => 0,
                 );
                 while(<IN>) {
                         last if (/BEGIN ERROR CODES/);
@@ -214,6 +260,11 @@ sub do_defs
                                 push(@tag,"TRUE");
                                 $tag{"TRUE"}=1;
                                 next;
+                        } elsif (/^\#\s*if\s+0/) {
+                                # Dummy tag
+                                push(@tag,"TRUE");
+                                $tag{"TRUE"}=-1;
+                                next;
                         } elsif (/^\#/) {
                                 next;
                         }
@@ -250,7 +301,20 @@ sub do_defs
                                 }
                                 $funcs{"PEM_read_bio_${1}"} = 1;
                                 $funcs{"PEM_write_bio_${1}"} = 1;
-                        } elsif ( 
+                        } elsif (/^DECLARE_PEM_write\s*\(\s*(\w*)\s*,/ ||
+                                     /^DECLARE_PEM_write_cb\s*\(\s*(\w*)\s*,/ ) {
+                                if($W32) {
+                                        $funcs{"PEM_write_${1}"} = 1;
+                                }
+                                $funcs{"PEM_write_bio_${1}"} = 1;
+                        } elsif (/^DECLARE_PEM_read\s*\(\s*(\w*)\s*,/ ||
+                                     /^DECLARE_PEM_read_cb\s*\(\s*(\w*)\s*,/ ) {
+                                if($W32) {
+                                        $funcs{"PEM_read_${1}"} = 1;
+                                }
+                                $funcs{"PEM_read_bio_${1}"} = 1;
+                        } elsif (
+                                ($tag{'TRUE'} != -1) &&
                                 ($tag{'FreeBSD'} != 1) &&
                                 ($tag{'CONST_STRICT'} != 1) &&
                                 (($W32 && ($tag{'WIN16'} != 1)) ||
@@ -260,7 +324,23 @@ sub do_defs
                                 ((!$W32 && $tag{'_WINDLL'} != -1) ||
                                  ($W32 && $tag{'_WINDLL'} != 1)) &&
                                 ((($tag{'NO_FP_API'} != 1) && $W32) ||
-                                 (($tag{'NO_FP_API'} != -1) && !$W32)))
+                                 (($tag{'NO_FP_API'} != -1) && !$W32)) &&
+                                ($tag{'NO_RC2'} == 0  || !$no_rc2) &&
+                                ($tag{'NO_RC4'} == 0  || !$no_rc4) &&
+                                ($tag{'NO_RC5'} == 0  || !$no_rc5) &&
+                                ($tag{'NO_IDEA'} == 0 || !$no_idea) &&
+                                ($tag{'NO_DES'} == 0  || !$no_des) &&
+                                ($tag{'NO_BF'} == 0   || !$no_bf) &&
+                                ($tag{'NO_CAST'} == 0 || !$no_cast) &&
+                                ($tag{'NO_MD2'} == 0  || !$no_md2) &&
+                                ($tag{'NO_MD5'} == 0  || !$no_md5) &&
+                                ($tag{'NO_SHA'} == 0  || !$no_sha) &&
+                                ($tag{'NO_RIPEMD'} == 0 || !$no_ripemd) &&
+                                ($tag{'NO_MDC2'} == 0 || !$no_mdc2) &&
+                                ($tag{'NO_RSA'} == 0  || !$no_rsa) &&
+                                ($tag{'NO_DSA'} == 0  || !$no_dsa) &&
+                                ($tag{'NO_DH'} == 0   || !$no_dh) &&
+                                ($tag{'NO_HMAC'} == 0 || !$no_hmac))
                                 {
                                         if (/{|\/\*/) { # }
                                                 $line = $_;
@@ -309,8 +389,8 @@ sub do_defs
         # Prune the returned functions
 
         delete $funcs{"SSL_add_dir_cert_subjects_to_stack"};
-        delete $funcs{"des_crypt"};
         delete $funcs{"RSA_PKCS1_RSAref"} unless $rsaref;
+        delete $funcs{"bn_dump1"};
 
         if($W32) {
                 delete $funcs{"BIO_s_file_internal"};
@@ -334,10 +414,31 @@ sub do_defs
         return(@ret);
 }
 
+sub print_test_file
+{
+        (*OUT,my $name,*nums,my @functions)=@_;
+        my $n = 1; my @e; my @r;
+        my $func;
+
+        (@e)=grep(/^SSLeay/,@functions);
+        (@r)=grep(!/^SSLeay/,@functions);
+        @functions=((sort @e),(sort @r));
+
+        foreach $func (@functions) {
+                if (!defined($nums{$func})) {
+                        printf STDERR "$func does not have a number assigned\n"
+                                        if(!$do_update);
+                } else {
+                        $n=$nums{$func};
+                        print OUT "\t$func();\n";
+                }
+        }
+}
+
 sub print_def_file
 {
-        (*OUT,my $name,*nums,@functions)=@_;
-        my $n =1;
+        (*OUT,my $name,*nums,my @functions)=@_;
+        my $n = 1; my @e; my @r;
 
         if ($W32)
                 { $name.="32"; }
diff --git a/src/lib/libcrypto/util/mkerr.pl b/src/lib/libcrypto/util/mkerr.pl
index 4b3bccb13e..ebc059ef22 100644
--- a/src/lib/libcrypto/util/mkerr.pl
+++ b/src/lib/libcrypto/util/mkerr.pl
@@ -450,7 +450,7 @@ void ERR_load_${lib}_strings(void)
 #ifdef ${lib}_LIB_NAME
                 ${lib}_lib_name->error = ERR_PACK(${lib}_lib_error_code,0,0);
                 ERR_load_strings(0,${lib}_lib_name);
-#endif;
+#endif
                 }
         }
 
diff --git a/src/lib/libcrypto/util/pl/BC-32.pl b/src/lib/libcrypto/util/pl/BC-32.pl
index 09c45a21a6..df6e2c742e 100644
--- a/src/lib/libcrypto/util/pl/BC-32.pl
+++ b/src/lib/libcrypto/util/pl/BC-32.pl
@@ -19,7 +19,7 @@ $out_def="out32";
 $tmp_def="tmp32";
 $inc_def="inc32";
 #enable max error messages, disable most common warnings
-$cflags="-DWIN32_LEAN_AND_MEAN -j255 -w-aus -w-par -w-inl  -c -tWC -tWM -DWINDOWS -DWIN32 -DL_ENDIAN ";
+$cflags="-DWIN32_LEAN_AND_MEAN -q -w-aus -w-par -w-inl  -c -tWC -tWM -DWINDOWS -DWIN32 -DL_ENDIAN ";
 if ($debug)
 {
     $cflags.="-Od -y -v -vi- -D_DEBUG";
diff --git a/src/lib/libcrypto/util/pl/Mingw32.pl b/src/lib/libcrypto/util/pl/Mingw32.pl
index 84c2a22db3..585cacd820 100644
--- a/src/lib/libcrypto/util/pl/Mingw32.pl
+++ b/src/lib/libcrypto/util/pl/Mingw32.pl
@@ -17,7 +17,7 @@ $mkdir='gmkdir';
 
 $cc='gcc';
 if ($debug)
-        { $cflags="-g2 -ggdb"; }
+        { $cflags="-DL_ENDIAN -g2 -ggdb"; }
 else
         { $cflags="-DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall"; }
 
diff --git a/src/lib/libcrypto/util/pl/VC-32.pl b/src/lib/libcrypto/util/pl/VC-32.pl
index 6db1c9fe23..046f0e253c 100644
--- a/src/lib/libcrypto/util/pl/VC-32.pl
+++ b/src/lib/libcrypto/util/pl/VC-32.pl
@@ -22,7 +22,7 @@ $inc_def="inc32";
 
 if ($debug)
         {
-        $cflags=" /MDd /W3 /WX /Zi /Yd /Od /nologo -DWINDOWS -DWIN32 -D_DEBUG -DL_ENDIAN -DWIN32_LEAN_AND_MEAN -DDEBUG";
+        $cflags=" /MDd /W3 /WX /Zi /Yd /Od /nologo -DWIN32 -D_DEBUG -DL_ENDIAN -DWIN32_LEAN_AND_MEAN -DDEBUG";
         $lflags.=" /debug";
         $mlflags.=' /debug';
         }
diff --git a/src/lib/libcrypto/util/pod2man.pl b/src/lib/libcrypto/util/pod2man.pl
new file mode 100644
index 0000000000..f5ec0767ed
--- /dev/null
+++ b/src/lib/libcrypto/util/pod2man.pl
@@ -0,0 +1,1181 @@
+: #!/usr/bin/perl-5.005
+    eval 'exec /usr/bin/perl -S $0 ${1+"$@"}'
+        if $running_under_some_shell;
+
+$DEF_PM_SECTION = '3pm' || '3';
+
+=head1 NAME
+
+pod2man - translate embedded Perl pod directives into man pages
+
+=head1 SYNOPSIS
+
+B<pod2man>
+[ B<--section=>I<manext> ]
+[ B<--release=>I<relpatch> ]
+[ B<--center=>I<string> ]
+[ B<--date=>I<string> ]
+[ B<--fixed=>I<font> ]
+[ B<--official> ]
+[ B<--lax> ]
+I<inputfile>
+
+=head1 DESCRIPTION
+
+B<pod2man> converts its input file containing embedded pod directives (see
+L<perlpod>) into nroff source suitable for viewing with nroff(1) or
+troff(1) using the man(7) macro set.
+
+Besides the obvious pod conversions, B<pod2man> also takes care of
+func(), func(n), and simple variable references like $foo or @bar so
+you don't have to use code escapes for them; complex expressions like
+C<$fred{'stuff'}> will still need to be escaped, though.  Other nagging
+little roffish things that it catches include translating the minus in
+something like foo-bar, making a long dash--like this--into a real em
+dash, fixing up "paired quotes", putting a little space after the
+parens in something like func(), making C++ and PI look right, making
+double underbars have a little tiny space between them, making ALLCAPS
+a teeny bit smaller in troff(1), and escaping backslashes so you don't
+have to.
+
+=head1 OPTIONS
+
+=over 8
+
+=item center
+
+Set the centered header to a specific string.  The default is
+"User Contributed Perl Documentation", unless the C<--official> flag is
+given, in which case the default is "Perl Programmers Reference Guide".
+
+=item date
+
+Set the left-hand footer string to this value.  By default,
+the modification date of the input file will be used.
+
+=item fixed
+
+The fixed font to use for code refs.  Defaults to CW.
+
+=item official
+
+Set the default header to indicate that this page is of
+the standard release in case C<--center> is not given.
+
+=item release
+
+Set the centered footer.  By default, this is the current
+perl release.
+
+=item section
+
+Set the section for the C<.TH> macro.  The standard conventions on
+sections are to use 1 for user commands,  2 for system calls, 3 for
+functions, 4 for devices, 5 for file formats, 6 for games, 7 for
+miscellaneous information, and 8 for administrator commands.  This works
+best if you put your Perl man pages in a separate tree, like
+F</usr/local/perl/man/>.  By default, section 1 will be used
+unless the file ends in F<.pm> in which case section 3 will be selected.
+
+=item lax
+
+Don't complain when required sections aren't present.
+
+=back
+
+=head1 Anatomy of a Proper Man Page
+
+For those not sure of the proper layout of a man page, here's
+an example of the skeleton of a proper man page.  Head of the
+major headers should be setout as a C<=head1> directive, and
+are historically written in the rather startling ALL UPPER CASE
+format, although this is not mandatory.
+Minor headers may be included using C<=head2>, and are
+typically in mixed case.
+
+=over 10
+
+=item NAME
+
+Mandatory section; should be a comma-separated list of programs or
+functions documented by this podpage, such as:
+
+    foo, bar - programs to do something
+
+=item SYNOPSIS
+
+A short usage summary for programs and functions, which
+may someday be deemed mandatory.
+
+=item DESCRIPTION
+
+Long drawn out discussion of the program.  It's a good idea to break this
+up into subsections using the C<=head2> directives, like
+
+    =head2 A Sample Subection
+
+    =head2 Yet Another Sample Subection
+
+=item OPTIONS
+
+Some people make this separate from the description.
+
+=item RETURN VALUE
+
+What the program or function returns if successful.
+
+=item ERRORS
+
+Exceptions, return codes, exit stati, and errno settings.
+
+=item EXAMPLES
+
+Give some example uses of the program.
+
+=item ENVIRONMENT
+
+Envariables this program might care about.
+
+=item FILES
+
+All files used by the program.  You should probably use the FE<lt>E<gt>
+for these.
+
+=item SEE ALSO
+
+Other man pages to check out, like man(1), man(7), makewhatis(8), or catman(8).
+
+=item NOTES
+
+Miscellaneous commentary.
+
+=item CAVEATS
+
+Things to take special care with; sometimes called WARNINGS.
+
+=item DIAGNOSTICS
+
+All possible messages the program can print out--and
+what they mean.
+
+=item BUGS
+
+Things that are broken or just don't work quite right.
+
+=item RESTRICTIONS
+
+Bugs you don't plan to fix :-)
+
+=item AUTHOR
+
+Who wrote it (or AUTHORS if multiple).
+
+=item HISTORY
+
+Programs derived from other sources sometimes have this, or
+you might keep a modification log here.
+
+=back
+
+=head1 EXAMPLES
+
+    pod2man program > program.1
+    pod2man some_module.pm > /usr/perl/man/man3/some_module.3
+    pod2man --section=7 note.pod > note.7
+
+=head1 DIAGNOSTICS
+
+The following diagnostics are generated by B<pod2man>.  Items
+marked "(W)" are non-fatal, whereas the "(F)" errors will cause
+B<pod2man> to immediately exit with a non-zero status.
+
+=over 4
+
+=item bad option in paragraph %d of %s: ``%s'' should be [%s]<%s>
+
+(W) If you start include an option, you should set it off
+as bold, italic, or code.
+
+=item can't open %s: %s
+
+(F) The input file wasn't available for the given reason.
+
+=item Improper man page - no dash in NAME header in paragraph %d of %s
+
+(W) The NAME header did not have an isolated dash in it.  This is
+considered important.
+
+=item Invalid man page - no NAME line in %s
+
+(F) You did not include a NAME header, which is essential.
+
+=item roff font should be 1 or 2 chars, not `%s'  (F)
+
+(F) The font specified with the C<--fixed> option was not
+a one- or two-digit roff font.
+
+=item %s is missing required section: %s
+
+(W) Required sections include NAME, DESCRIPTION, and if you're
+using a section starting with a 3, also a SYNOPSIS.  Actually,
+not having a NAME is a fatal.
+
+=item Unknown escape: %s in %s
+
+(W) An unknown HTML entity (probably for an 8-bit character) was given via
+a C<EE<lt>E<gt>> directive.  Besides amp, lt, gt, and quot, recognized
+entities are Aacute, aacute, Acirc, acirc, AElig, aelig, Agrave, agrave,
+Aring, aring, Atilde, atilde, Auml, auml, Ccedil, ccedil, Eacute, eacute,
+Ecirc, ecirc, Egrave, egrave, ETH, eth, Euml, euml, Iacute, iacute, Icirc,
+icirc, Igrave, igrave, Iuml, iuml, Ntilde, ntilde, Oacute, oacute, Ocirc,
+ocirc, Ograve, ograve, Oslash, oslash, Otilde, otilde, Ouml, ouml, szlig,
+THORN, thorn, Uacute, uacute, Ucirc, ucirc, Ugrave, ugrave, Uuml, uuml,
+Yacute, yacute, and yuml.
+
+=item Unmatched =back
+
+(W) You have a C<=back> without a corresponding C<=over>.
+
+=item Unrecognized pod directive: %s
+
+(W) You specified a pod directive that isn't in the known list of
+C<=head1>, C<=head2>, C<=item>, C<=over>, C<=back>, or C<=cut>.
+
+
+=back
+
+=head1 NOTES
+
+If you would like to print out a lot of man page continuously, you
+probably want to set the C and D registers to set contiguous page
+numbering and even/odd paging, at least on some versions of man(7).
+Settting the F register will get you some additional experimental
+indexing:
+
+    troff -man -rC1 -rD1 -rF1 perl.1 perldata.1 perlsyn.1 ...
+
+The indexing merely outputs messages via C<.tm> for each
+major page, section, subsection, item, and any C<XE<lt>E<gt>>
+directives.
+
+
+=head1 RESTRICTIONS
+
+None at this time.
+
+=head1 BUGS
+
+The =over and =back directives don't really work right.  They
+take absolute positions instead of offsets, don't nest well, and
+making people count is suboptimal in any event.
+
+=head1 AUTHORS
+
+Original prototype by Larry Wall, but so massively hacked over by
+Tom Christiansen such that Larry probably doesn't recognize it anymore.
+
+=cut
+
+$/ = "";
+$cutting = 1;
+@Indices = ();
+
+# We try first to get the version number from a local binary, in case we're
+# running an installed version of Perl to produce documentation from an
+# uninstalled newer version's pod files.
+if ($^O ne 'plan9' and $^O ne 'dos' and $^O ne 'os2' and $^O ne 'MSWin32') {
+  my $perl = (-x './perl' && -f './perl' ) ?
+                 './perl' :
+                 ((-x '../perl' && -f '../perl') ?
+                      '../perl' :
+                      '');
+  ($version,$patch) = `$perl -e 'print $]'` =~ /^(\d\.\d{3})(\d{2})?/ if $perl;
+}
+# No luck; we'll just go with the running Perl's version
+($version,$patch) = $] =~ /^(.{5})(\d{2})?/ unless $version;
+$DEF_RELEASE  = "perl $version";
+$DEF_RELEASE .= ", patch $patch" if $patch;
+
+
+sub makedate {
+    my $secs = shift;
+    my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime($secs);
+    my $mname = (qw{Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec})[$mon];
+    $year += 1900;
+    return "$mday/$mname/$year";
+}
+
+use Getopt::Long;
+
+$DEF_SECTION = 1;
+$DEF_CENTER = "User Contributed Perl Documentation";
+$STD_CENTER = "Perl Programmers Reference Guide";
+$DEF_FIXED = 'CW';
+$DEF_LAX = 0;
+
+sub usage {
+    warn "$0: @_\n" if @_;
+    die <<EOF;
+usage: $0 [options] podpage
+Options are:
+        --section=manext      (default "$DEF_SECTION")
+        --release=relpatch    (default "$DEF_RELEASE")
+        --center=string       (default "$DEF_CENTER")
+        --date=string         (default "$DEF_DATE")
+        --fixed=font          (default "$DEF_FIXED")
+        --official            (default NOT)
+        --lax                 (default NOT)
+EOF
+}
+
+$uok = GetOptions( qw(
+        section=s
+        release=s
+        center=s
+        date=s
+        fixed=s
+        official
+        lax
+        help));
+
+$DEF_DATE = makedate((stat($ARGV[0]))[9] || time());
+
+usage("Usage error!") unless $uok;
+usage() if $opt_help;
+usage("Need one and only one podpage argument") unless @ARGV == 1;
+
+$section = $opt_section || ($ARGV[0] =~ /\.pm$/
+                                ? $DEF_PM_SECTION : $DEF_SECTION);
+$RP = $opt_release || $DEF_RELEASE;
+$center = $opt_center || ($opt_official ? $STD_CENTER : $DEF_CENTER);
+$lax = $opt_lax || $DEF_LAX;
+
+$CFont = $opt_fixed || $DEF_FIXED;
+
+if (length($CFont) == 2) {
+    $CFont_embed = "\\f($CFont";
+}
+elsif (length($CFont) == 1) {
+    $CFont_embed = "\\f$CFont";
+}
+else {
+    die "roff font should be 1 or 2 chars, not `$CFont_embed'";
+}
+
+$date = $opt_date || $DEF_DATE;
+
+for (qw{NAME DESCRIPTION}) {
+# for (qw{NAME DESCRIPTION AUTHOR}) {
+    $wanna_see{$_}++;
+}
+$wanna_see{SYNOPSIS}++ if $section =~ /^3/;
+
+
+$name = @ARGV ? $ARGV[0] : "<STDIN>";
+$Filename = $name;
+if ($section =~ /^1/) {
+    require File::Basename;
+    $name = uc File::Basename::basename($name);
+}
+$name =~ s/\.(pod|p[lm])$//i;
+
+# Lose everything up to the first of
+#     */lib/*perl*      standard or site_perl module
+#     */*perl*/lib      from -D prefix=/opt/perl
+#     */*perl*/         random module hierarchy
+# which works.
+$name =~ s-//+-/-g;
+if ($name =~ s-^.*?/lib/[^/]*perl[^/]*/--i
+        or $name =~ s-^.*?/[^/]*perl[^/]*/lib/--i
+        or $name =~ s-^.*?/[^/]*perl[^/]*/--i) {
+    # Lose ^site(_perl)?/.
+    $name =~ s-^site(_perl)?/--;
+    # Lose ^arch/.      (XXX should we use Config? Just for archname?)
+    $name =~ s~^(.*-$^O|$^O-.*)/~~o;
+    # Lose ^version/.
+    $name =~ s-^\d+\.\d+/--;
+}
+
+# Translate Getopt/Long to Getopt::Long, etc.
+$name =~ s(/)(::)g;
+
+if ($name ne 'something') {
+    FCHECK: {
+        open(F, "< $ARGV[0]") || die "can't open $ARGV[0]: $!";
+        while (<F>) {
+            next unless /^=\b/;
+            if (/^=head1\s+NAME\s*$/) {  # an /m would forgive mistakes
+                $_ = <F>;
+                unless (/\s*-+\s+/) {
+                    $oops++;
+                    warn "$0: Improper man page - no dash in NAME header in paragraph $. of $ARGV[0]\n"
+                } else {
+                    my @n = split /\s+-+\s+/;
+                    if (@n != 2) {
+                        $oops++;
+                        warn "$0: Improper man page - malformed NAME header in paragraph $. of $ARGV[0]\n"
+                    }
+                    else {
+                        %namedesc = @n;
+                    }
+                }
+                last FCHECK;
+            }
+            next if /^=cut\b/;  # DB_File and Net::Ping have =cut before NAME
+            next if /^=pod\b/;  # It is OK to have =pod before NAME
+            die "$0: Invalid man page - 1st pod line is not NAME in $ARGV[0]\n" unless $lax;
+        }
+        die "$0: Invalid man page - no documentation in $ARGV[0]\n" unless $lax;
+    }
+    close F;
+}
+
+print <<"END";
+.rn '' }`
+''' \$RCSfile\$\$Revision\$\$Date\$
+'''
+''' \$Log\$
+'''
+.de Sh
+.br
+.if t .Sp
+.ne 5
+.PP
+\\fB\\\\\$1\\fR
+.PP
+..
+.de Sp
+.if t .sp .5v
+.if n .sp
+..
+.de Ip
+.br
+.ie \\\\n(.\$>=3 .ne \\\\\$3
+.el .ne 3
+.IP "\\\\\$1" \\\\\$2
+..
+.de Vb
+.ft $CFont
+.nf
+.ne \\\\\$1
+..
+.de Ve
+.ft R
+
+.fi
+..
+'''
+'''
+'''     Set up \\*(-- to give an unbreakable dash;
+'''     string Tr holds user defined translation string.
+'''     Bell System Logo is used as a dummy character.
+'''
+.tr \\(*W-|\\(bv\\*(Tr
+.ie n \\{\\
+.ds -- \\(*W-
+.ds PI pi
+.if (\\n(.H=4u)&(1m=24u) .ds -- \\(*W\\h'-12u'\\(*W\\h'-12u'-\\" diablo 10 pitch
+.if (\\n(.H=4u)&(1m=20u) .ds -- \\(*W\\h'-12u'\\(*W\\h'-8u'-\\" diablo 12 pitch
+.ds L" ""
+.ds R" ""
+'''   \\*(M", \\*(S", \\*(N" and \\*(T" are the equivalent of
+'''   \\*(L" and \\*(R", except that they are used on ".xx" lines,
+'''   such as .IP and .SH, which do another additional levels of
+'''   double-quote interpretation
+.ds M" """
+.ds S" """
+.ds N" """""
+.ds T" """""
+.ds L' '
+.ds R' '
+.ds M' '
+.ds S' '
+.ds N' '
+.ds T' '
+'br\\}
+.el\\{\\
+.ds -- \\(em\\|
+.tr \\*(Tr
+.ds L" ``
+.ds R" ''
+.ds M" ``
+.ds S" ''
+.ds N" ``
+.ds T" ''
+.ds L' `
+.ds R' '
+.ds M' `
+.ds S' '
+.ds N' `
+.ds T' '
+.ds PI \\(*p
+'br\\}
+END
+
+print <<'END';
+.\"     If the F register is turned on, we'll generate
+.\"     index entries out stderr for the following things:
+.\"             TH      Title 
+.\"             SH      Header
+.\"             Sh      Subsection 
+.\"             Ip      Item
+.\"             X<>     Xref  (embedded
+.\"     Of course, you have to process the output yourself
+.\"     in some meaninful fashion.
+.if \nF \{
+.de IX
+.tm Index:\\$1\t\\n%\t"\\$2"
+..
+.nr % 0
+.rr F
+.\}
+END
+
+print <<"END";
+.TH $name $section "$RP" "$date" "$center"
+.UC
+END
+
+push(@Indices, qq{.IX Title "$name $section"});
+
+while (($name, $desc) = each %namedesc) {
+    for ($name, $desc) { s/^\s+//; s/\s+$//; }
+    push(@Indices, qq(.IX Name "$name - $desc"\n));
+}
+
+print <<'END';
+.if n .hy 0
+.if n .na
+.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
+.de CQ          \" put $1 in typewriter font
+END
+print ".ft $CFont\n";
+print <<'END';
+'if n "\c
+'if t \\&\\$1\c
+'if n \\&\\$1\c
+'if n \&"
+\\&\\$2 \\$3 \\$4 \\$5 \\$6 \\$7
+'.ft R
+..
+.\" @(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2
+.       \" AM - accent mark definitions
+.bd B 3
+.       \" fudge factors for nroff and troff
+.if n \{\
+.       ds #H 0
+.       ds #V .8m
+.       ds #F .3m
+.       ds #[ \f1
+.       ds #] \fP
+.\}
+.if t \{\
+.       ds #H ((1u-(\\\\n(.fu%2u))*.13m)
+.       ds #V .6m
+.       ds #F 0
+.       ds #[ \&
+.       ds #] \&
+.\}
+.       \" simple accents for nroff and troff
+.if n \{\
+.       ds ' \&
+.       ds ` \&
+.       ds ^ \&
+.       ds , \&
+.       ds ~ ~
+.       ds ? ?
+.       ds ! !
+.       ds /
+.       ds q
+.\}
+.if t \{\
+.       ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
+.       ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
+.       ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
+.       ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
+.       ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
+.       ds ? \s-2c\h'-\w'c'u*7/10'\u\h'\*(#H'\zi\d\s+2\h'\w'c'u*8/10'
+.       ds ! \s-2\(or\s+2\h'-\w'\(or'u'\v'-.8m'.\v'.8m'
+.       ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
+.       ds q o\h'-\w'o'u*8/10'\s-4\v'.4m'\z\(*i\v'-.4m'\s+4\h'\w'o'u*8/10'
+.\}
+.       \" troff and (daisy-wheel) nroff accents
+.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
+.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
+.ds v \\k:\h'-(\\n(.wu*9/10-\*(#H)'\v'-\*(#V'\*(#[\s-4v\s0\v'\*(#V'\h'|\\n:u'\*(#]
+.ds _ \\k:\h'-(\\n(.wu*9/10-\*(#H+(\*(#F*2/3))'\v'-.4m'\z\(hy\v'.4m'\h'|\\n:u'
+.ds . \\k:\h'-(\\n(.wu*8/10)'\v'\*(#V*4/10'\z.\v'-\*(#V*4/10'\h'|\\n:u'
+.ds 3 \*(#[\v'.2m'\s-2\&3\s0\v'-.2m'\*(#]
+.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
+.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
+.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
+.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
+.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
+.ds ae a\h'-(\w'a'u*4/10)'e
+.ds Ae A\h'-(\w'A'u*4/10)'E
+.ds oe o\h'-(\w'o'u*4/10)'e
+.ds Oe O\h'-(\w'O'u*4/10)'E
+.       \" corrections for vroff
+.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
+.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
+.       \" for low resolution devices (crt and lpr)
+.if \n(.H>23 .if \n(.V>19 \
+\{\
+.       ds : e
+.       ds 8 ss
+.       ds v \h'-1'\o'\(aa\(ga'
+.       ds _ \h'-1'^
+.       ds . \h'-1'.
+.       ds 3 3
+.       ds o a
+.       ds d- d\h'-1'\(ga
+.       ds D- D\h'-1'\(hy
+.       ds th \o'bp'
+.       ds Th \o'LP'
+.       ds ae ae
+.       ds Ae AE
+.       ds oe oe
+.       ds Oe OE
+.\}
+.rm #[ #] #H #V #F C
+END
+
+$indent = 0;
+
+$begun = "";
+
+# Unrolling [^A-Z>]|[A-Z](?!<) gives:    // MRE pp 165.
+my $nonest = '(?:[^A-Z>]*(?:[A-Z](?!<)[^A-Z>]*)*)';
+
+while (<>) {
+    if ($cutting) {
+        next unless /^=/;
+        $cutting = 0;
+    }
+    if ($begun) {
+        if (/^=end\s+$begun/) {
+            $begun = "";
+        }
+        elsif ($begun =~ /^(roff|man)$/) {
+            print STDOUT $_;
+        }
+        next;
+    }
+    chomp;
+
+    # Translate verbatim paragraph
+
+    if (/^\s/) {
+        @lines = split(/\n/);
+        for (@lines) {
+            1 while s
+                {^( [^\t]* ) \t ( \t* ) }
+                { $1 . ' ' x (8 - (length($1)%8) + 8 * (length($2))) }ex;
+            s/\\/\\e/g;
+            s/\A/\\&/s;
+        }
+        $lines = @lines;
+        makespace() unless $verbatim++;
+        print ".Vb $lines\n";
+        print join("\n", @lines), "\n";
+        print ".Ve\n";
+        $needspace = 0;
+        next;
+    }
+
+    $verbatim = 0;
+
+    if (/^=for\s+(\S+)\s*/s) {
+        if ($1 eq "man" or $1 eq "roff") {
+            print STDOUT $',"\n\n";
+        } else {
+            # ignore unknown for
+        }
+        next;
+    }
+    elsif (/^=begin\s+(\S+)\s*/s) {
+        $begun = $1;
+        if ($1 eq "man" or $1 eq "roff") {
+            print STDOUT $'."\n\n";
+        }
+        next;
+    }
+
+    # check for things that'll hosed our noremap scheme; affects $_
+    init_noremap();
+
+    if (!/^=item/) {
+
+        # trofficate backslashes; must do it before what happens below
+        s/\\/noremap('\\e')/ge;
+
+        # protect leading periods and quotes against *roff
+        # mistaking them for directives
+        s/^(?:[A-Z]<)?[.']/\\&$&/gm;
+
+        # first hide the escapes in case we need to
+        # intuit something and get it wrong due to fmting
+
+        1 while s/([A-Z]<$nonest>)/noremap($1)/ge;
+
+        # func() is a reference to a perl function
+        s{
+            \b
+            (
+                [:\w]+ \(\)
+            )
+        } {I<$1>}gx;
+
+        # func(n) is a reference to a perl function or a man page
+        s{
+            ([:\w]+)
+            (
+                \( [^\051]+ \)
+            )
+        } {I<$1>\\|$2}gx;
+
+        # convert simple variable references
+        s/(\s+)([\$\@%][\w:]+)(?!\()/${1}C<$2>/g;
+
+        if (m{ (
+                    [\-\w]+
+                    \(
+                        [^\051]*?
+                        [\@\$,]
+                        [^\051]*?
+                    \)
+                )
+            }x && $` !~ /([LCI]<[^<>]*|-)$/ && !/^=\w/)
+        {
+            warn "$0: bad option in paragraph $. of $ARGV: ``$1'' should be [LCI]<$1>\n";
+            $oops++;
+        }
+
+        while (/(-[a-zA-Z])\b/g && $` !~ /[\w\-]$/) {
+            warn "$0: bad option in paragraph $. of $ARGV: ``$1'' should be [CB]<$1>\n";
+            $oops++;
+        }
+
+        # put it back so we get the <> processed again;
+        clear_noremap(0); # 0 means leave the E's
+
+    } else {
+        # trofficate backslashes
+        s/\\/noremap('\\e')/ge;
+
+    }
+
+    # need to hide E<> first; they're processed in clear_noremap
+    s/(E<[^<>]+>)/noremap($1)/ge;
+
+
+    $maxnest = 10;
+    while ($maxnest-- && /[A-Z]</) {
+
+        # can't do C font here
+        s/([BI])<($nonest)>/font($1) . $2 . font('R')/eg;
+
+        # files and filelike refs in italics
+        s/F<($nonest)>/I<$1>/g;
+
+        # no break -- usually we want C<> for this
+        s/S<($nonest)>/nobreak($1)/eg;
+
+        # LREF: a la HREF L<show this text|man/section>
+        s:L<([^|>]+)\|[^>]+>:$1:g;
+
+        # LREF: a manpage(3f)
+        s:L<([a-zA-Z][^\s\/]+)(\([^\)]+\))?>:the I<$1>$2 manpage:g;
+
+        # LREF: an =item on another manpage
+        s{
+            L<
+                ([^/]+)
+                /
+                (
+                    [:\w]+
+                    (\(\))?
+                )
+            >
+        } {the C<$2> entry in the I<$1> manpage}gx;
+
+        # LREF: an =item on this manpage
+        s{
+           ((?:
+            L<
+                /
+                (
+                    [:\w]+
+                    (\(\))?
+                )
+            >
+            (,?\s+(and\s+)?)?
+          )+)
+        } { internal_lrefs($1) }gex;
+
+        # LREF: a =head2 (head1?), maybe on a manpage, maybe right here
+        # the "func" can disambiguate
+        s{
+            L<
+                (?:
+                    ([a-zA-Z]\S+?) /
+                )?
+                "?(.*?)"?
+            >
+        }{
+            do {
+                $1      # if no $1, assume it means on this page.
+                    ?  "the section on I<$2> in the I<$1> manpage"
+                    :  "the section on I<$2>"
+            }
+        }gesx; # s in case it goes over multiple lines, so . matches \n
+
+        s/Z<>/\\&/g;
+
+        # comes last because not subject to reprocessing
+        s/C<($nonest)>/noremap("${CFont_embed}${1}\\fR")/eg;
+    }
+
+    if (s/^=//) {
+        $needspace = 0;         # Assume this.
+
+        s/\n/ /g;
+
+        ($Cmd, $_) = split(' ', $_, 2);
+
+        $dotlevel = 1;
+        if ($Cmd eq 'head1') {
+           $dotlevel = 1;
+        }
+        elsif ($Cmd eq 'head2') {
+           $dotlevel = 1;
+        }
+        elsif ($Cmd eq 'item') {
+           $dotlevel = 2;
+        }
+
+        if (defined $_) {
+            &escapes($dotlevel);
+            s/"/""/g;
+        }
+
+        clear_noremap(1);
+
+        if ($Cmd eq 'cut') {
+            $cutting = 1;
+        }
+        elsif ($Cmd eq 'head1') {
+            s/\s+$//;
+            delete $wanna_see{$_} if exists $wanna_see{$_};
+            print qq{.SH "$_"\n};
+      push(@Indices, qq{.IX Header "$_"\n});
+        }
+        elsif ($Cmd eq 'head2') {
+            print qq{.Sh "$_"\n};
+      push(@Indices, qq{.IX Subsection "$_"\n});
+        }
+        elsif ($Cmd eq 'over') {
+            push(@indent,$indent);
+            $indent += ($_ + 0) || 5;
+        }
+        elsif ($Cmd eq 'back') {
+            $indent = pop(@indent);
+            warn "$0: Unmatched =back in paragraph $. of $ARGV\n" unless defined $indent;
+            $needspace = 1;
+        }
+        elsif ($Cmd eq 'item') {
+            s/^\*( |$)/\\(bu$1/g;
+            # if you know how to get ":s please do
+            s/\\\*\(L"([^"]+?)\\\*\(R"/'$1'/g;
+            s/\\\*\(L"([^"]+?)""/'$1'/g;
+            s/[^"]""([^"]+?)""[^"]/'$1'/g;
+            # here do something about the $" in perlvar?
+            print STDOUT qq{.Ip "$_" $indent\n};
+      push(@Indices, qq{.IX Item "$_"\n});
+        }
+        elsif ($Cmd eq 'pod') {
+            # this is just a comment
+        } 
+        else {
+            warn "$0: Unrecognized pod directive in paragraph $. of $ARGV: $Cmd\n";
+        }
+    }
+    else {
+        if ($needspace) {
+            &makespace;
+        }
+        &escapes(0);
+        clear_noremap(1);
+        print $_, "\n";
+        $needspace = 1;
+    }
+}
+
+print <<"END";
+
+.rn }` ''
+END
+
+if (%wanna_see && !$lax) {
+    @missing = keys %wanna_see;
+    warn "$0: $Filename is missing required section"
+        .  (@missing > 1 && "s")
+        .  ": @missing\n";
+    $oops++;
+}
+
+foreach (@Indices) { print "$_\n"; }
+
+exit;
+#exit ($oops != 0);
+
+#########################################################################
+
+sub nobreak {
+    my $string = shift;
+    $string =~ s/ /\\ /g;
+    $string;
+}
+
+sub escapes {
+    my $indot = shift;
+
+    s/X<(.*?)>/mkindex($1)/ge;
+
+    # translate the minus in foo-bar into foo\-bar for roff
+    s/([^0-9a-z-])-([^-])/$1\\-$2/g;
+
+    # make -- into the string version \*(-- (defined above)
+    s/\b--\b/\\*(--/g;
+    s/"--([^"])/"\\*(--$1/g;  # should be a better way
+    s/([^"])--"/$1\\*(--"/g;
+
+    # fix up quotes; this is somewhat tricky
+    my $dotmacroL = 'L';
+    my $dotmacroR = 'R';
+    if ( $indot == 1 ) {
+        $dotmacroL = 'M';
+        $dotmacroR = 'S';
+    }  
+    elsif ( $indot >= 2 ) {
+        $dotmacroL = 'N';
+        $dotmacroR = 'T';
+    }  
+    if (!/""/) {
+        s/(^|\s)(['"])/noremap("$1\\*($dotmacroL$2")/ge;
+        s/(['"])($|[\-\s,;\\!?.])/noremap("\\*($dotmacroR$1$2")/ge;
+    }
+
+    #s/(?!")(?:.)--(?!")(?:.)/\\*(--/g;
+    #s/(?:(?!")(?:.)--(?:"))|(?:(?:")--(?!")(?:.))/\\*(--/g;
+
+
+    # make sure that func() keeps a bit a space tween the parens
+    ### s/\b\(\)/\\|()/g;
+    ### s/\b\(\)/(\\|)/g;
+
+    # make C++ into \*C+, which is a squinched version (defined above)
+    s/\bC\+\+/\\*(C+/g;
+
+    # make double underbars have a little tiny space between them
+    s/__/_\\|_/g;
+
+    # PI goes to \*(PI (defined above)
+    s/\bPI\b/noremap('\\*(PI')/ge;
+
+    # make all caps a teeny bit smaller, but don't muck with embedded code literals
+    my $hidCFont = font('C');
+    if ($Cmd !~ /^head1/) { # SH already makes smaller
+        # /g isn't enough; 1 while or we'll be off
+
+#       1 while s{
+#           (?!$hidCFont)(..|^.|^)
+#           \b
+#           (
+#               [A-Z][\/A-Z+:\-\d_$.]+
+#           )
+#           (s?)                
+#           \b
+#       } {$1\\s-1$2\\s0}gmox;
+
+        1 while s{
+            (?!$hidCFont)(..|^.|^)
+            (
+                \b[A-Z]{2,}[\/A-Z+:\-\d_\$]*\b
+            )
+        } {
+            $1 . noremap( '\\s-1' .  $2 . '\\s0' )
+        }egmox;
+
+    }
+}
+
+# make troff just be normal, but make small nroff get quoted
+# decided to just put the quotes in the text; sigh;
+sub ccvt {
+    local($_,$prev) = @_;
+    noremap(qq{.CQ "$_" \n\\&});
+}
+
+sub makespace {
+    if ($indent) {
+        print ".Sp\n";
+    }
+    else {
+        print ".PP\n";
+    }
+}
+
+sub mkindex {
+    my ($entry) = @_;
+    my @entries = split m:\s*/\s*:, $entry;
+    push @Indices, ".IX Xref " . join ' ', map {qq("$_")} @entries;
+    return '';
+}
+
+sub font {
+    local($font) = shift;
+    return '\\f' . noremap($font);
+}
+
+sub noremap {
+    local($thing_to_hide) = shift;
+    $thing_to_hide =~ tr/\000-\177/\200-\377/;
+    return $thing_to_hide;
+}
+
+sub init_noremap {
+        # escape high bit characters in input stream
+        s/([\200-\377])/"E<".ord($1).">"/ge;
+}
+
+sub clear_noremap {
+    my $ready_to_print = $_[0];
+
+    tr/\200-\377/\000-\177/;
+
+    # trofficate backslashes
+    # s/(?!\\e)(?:..|^.|^)\\/\\e/g;
+
+    # now for the E<>s, which have been hidden until now
+    # otherwise the interative \w<> processing would have
+    # been hosed by the E<gt>
+    s {
+            E<
+            (
+                ( \d + ) 
+                | ( [A-Za-z]+ ) 
+            )
+            >   
+    } {
+         do {
+             defined $2
+                ? chr($2)
+                :       
+             exists $HTML_Escapes{$3}
+                ? do { $HTML_Escapes{$3} }
+                : do {
+                    warn "$0: Unknown escape in paragraph $. of $ARGV: ``$&''\n";
+                    "E<$1>";
+                }
+         }
+    }egx if $ready_to_print;
+}
+
+sub internal_lrefs {
+    local($_) = shift;
+    local $trailing_and = s/and\s+$// ? "and " : "";
+
+    s{L</([^>]+)>}{$1}g;
+    my(@items) = split( /(?:,?\s+(?:and\s+)?)/ );
+    my $retstr = "the ";
+    my $i;
+    for ($i = 0; $i <= $#items; $i++) {
+        $retstr .= "C<$items[$i]>";
+        $retstr .= ", " if @items > 2 && $i != $#items;
+        $retstr .= " and " if $i+2 == @items;
+    }
+
+    $retstr .= " entr" . ( @items > 1  ? "ies" : "y" )
+            .  " elsewhere in this document";
+    # terminal space to avoid words running together (pattern used
+    # strips terminal spaces)
+    $retstr .= " " if length $trailing_and;
+    $retstr .=  $trailing_and;
+
+    return $retstr;
+
+}
+
+BEGIN {
+%HTML_Escapes = (
+    'amp'       =>      '&',    #   ampersand
+    'lt'        =>      '<',    #   left chevron, less-than
+    'gt'        =>      '>',    #   right chevron, greater-than
+    'quot'      =>      '"',    #   double quote
+
+    "Aacute"    =>      "A\\*'",        #   capital A, acute accent
+    "aacute"    =>      "a\\*'",        #   small a, acute accent
+    "Acirc"     =>      "A\\*^",        #   capital A, circumflex accent
+    "acirc"     =>      "a\\*^",        #   small a, circumflex accent
+    "AElig"     =>      '\*(AE',        #   capital AE diphthong (ligature)
+    "aelig"     =>      '\*(ae',        #   small ae diphthong (ligature)
+    "Agrave"    =>      "A\\*`",        #   capital A, grave accent
+    "agrave"    =>      "A\\*`",        #   small a, grave accent
+    "Aring"     =>      'A\\*o',        #   capital A, ring
+    "aring"     =>      'a\\*o',        #   small a, ring
+    "Atilde"    =>      'A\\*~',        #   capital A, tilde
+    "atilde"    =>      'a\\*~',        #   small a, tilde
+    "Auml"      =>      'A\\*:',        #   capital A, dieresis or umlaut mark
+    "auml"      =>      'a\\*:',        #   small a, dieresis or umlaut mark
+    "Ccedil"    =>      'C\\*,',        #   capital C, cedilla
+    "ccedil"    =>      'c\\*,',        #   small c, cedilla
+    "Eacute"    =>      "E\\*'",        #   capital E, acute accent
+    "eacute"    =>      "e\\*'",        #   small e, acute accent
+    "Ecirc"     =>      "E\\*^",        #   capital E, circumflex accent
+    "ecirc"     =>      "e\\*^",        #   small e, circumflex accent
+    "Egrave"    =>      "E\\*`",        #   capital E, grave accent
+    "egrave"    =>      "e\\*`",        #   small e, grave accent
+    "ETH"       =>      '\\*(D-',       #   capital Eth, Icelandic
+    "eth"       =>      '\\*(d-',       #   small eth, Icelandic
+    "Euml"      =>      "E\\*:",        #   capital E, dieresis or umlaut mark
+    "euml"      =>      "e\\*:",        #   small e, dieresis or umlaut mark
+    "Iacute"    =>      "I\\*'",        #   capital I, acute accent
+    "iacute"    =>      "i\\*'",        #   small i, acute accent
+    "Icirc"     =>      "I\\*^",        #   capital I, circumflex accent
+    "icirc"     =>      "i\\*^",        #   small i, circumflex accent
+    "Igrave"    =>      "I\\*`",        #   capital I, grave accent
+    "igrave"    =>      "i\\*`",        #   small i, grave accent
+    "Iuml"      =>      "I\\*:",        #   capital I, dieresis or umlaut mark
+    "iuml"      =>      "i\\*:",        #   small i, dieresis or umlaut mark
+    "Ntilde"    =>      'N\*~',         #   capital N, tilde
+    "ntilde"    =>      'n\*~',         #   small n, tilde
+    "Oacute"    =>      "O\\*'",        #   capital O, acute accent
+    "oacute"    =>      "o\\*'",        #   small o, acute accent
+    "Ocirc"     =>      "O\\*^",        #   capital O, circumflex accent
+    "ocirc"     =>      "o\\*^",        #   small o, circumflex accent
+    "Ograve"    =>      "O\\*`",        #   capital O, grave accent
+    "ograve"    =>      "o\\*`",        #   small o, grave accent
+    "Oslash"    =>      "O\\*/",        #   capital O, slash
+    "oslash"    =>      "o\\*/",        #   small o, slash
+    "Otilde"    =>      "O\\*~",        #   capital O, tilde
+    "otilde"    =>      "o\\*~",        #   small o, tilde
+    "Ouml"      =>      "O\\*:",        #   capital O, dieresis or umlaut mark
+    "ouml"      =>      "o\\*:",        #   small o, dieresis or umlaut mark
+    "szlig"     =>      '\*8',          #   small sharp s, German (sz ligature)
+    "THORN"     =>      '\\*(Th',       #   capital THORN, Icelandic
+    "thorn"     =>      '\\*(th',,      #   small thorn, Icelandic
+    "Uacute"    =>      "U\\*'",        #   capital U, acute accent
+    "uacute"    =>      "u\\*'",        #   small u, acute accent
+    "Ucirc"     =>      "U\\*^",        #   capital U, circumflex accent
+    "ucirc"     =>      "u\\*^",        #   small u, circumflex accent
+    "Ugrave"    =>      "U\\*`",        #   capital U, grave accent
+    "ugrave"    =>      "u\\*`",        #   small u, grave accent
+    "Uuml"      =>      "U\\*:",        #   capital U, dieresis or umlaut mark
+    "uuml"      =>      "u\\*:",        #   small u, dieresis or umlaut mark
+    "Yacute"    =>      "Y\\*'",        #   capital Y, acute accent
+    "yacute"    =>      "y\\*'",        #   small y, acute accent
+    "yuml"      =>      "y\\*:",        #   small y, dieresis or umlaut mark
+);
+}
+
diff --git a/src/lib/libcrypto/util/selftest.pl b/src/lib/libcrypto/util/selftest.pl
new file mode 100644
index 0000000000..91e962a312
--- /dev/null
+++ b/src/lib/libcrypto/util/selftest.pl
@@ -0,0 +1,174 @@
+#!/usr/local/bin/perl -w
+#
+# Run the test suite and generate a report
+#
+
+if (! -f "Configure") {
+    print "Please run perl util/selftest.pl in the OpenSSL directory.\n";
+    exit 1;
+}
+
+my $report="testlog";
+my $os="??";
+my $version="??";
+my $platform0="??";
+my $platform="??";
+my $options="??";
+my $last="??";
+my $ok=0;
+my $cc="cc";
+my $cversion="??";
+my $sep="-----------------------------------------------------------------------------\n";
+
+open(OUT,">$report") or die;
+
+print OUT "OpenSSL self-test report:\n\n";
+
+$uname=`uname -a`;
+$uname="??" if $uname eq "";
+
+$c=`sh config -t`;
+foreach $_ (split("\n",$c)) {
+    $os=$1 if (/Operating system: (.*)$/);
+    $platform0=$1 if (/Configuring for (.*)$/);
+}
+
+system "sh config" if (! -f "Makefile.ssl");
+
+if (open(IN,"<Makefile.ssl")) {
+    while (<IN>) {
+        $version=$1 if (/^VERSION=(.*)$/);
+        $platform=$1 if (/^PLATFORM=(.*)$/);
+        $options=$1 if (/^OPTIONS=(.*)$/);
+        $cc=$1 if (/^CC= *(.*)$/);
+    }
+    close(IN);
+} else {
+    print OUT "Error running config!\n";
+}
+
+$cversion=`$cc -v 2>&1`;
+$cversion=`$cc -V 2>&1` if $cversion =~ "usage";
+$cversion=`$cc --version` if $cversion eq "";
+$cversion =~ s/Reading specs.*\n//;
+$cversion =~ s/usage.*\n//;
+chomp $cversion;
+
+if (open(IN,"<CHANGES")) {
+    while(<IN>) {
+        if (/\*\) (.{0,55})/) {
+            $last=$1;
+            last;
+        }
+    }
+    close(IN);
+}
+
+print OUT "OpenSSL version:  $version\n";
+print OUT "Last change:      $last...\n";
+print OUT "Options:          $options\n" if $options ne "";
+print OUT "OS (uname):       $uname";
+print OUT "OS (config):      $os\n";
+print OUT "Target (default): $platform0\n";
+print OUT "Target:           $platform\n";
+print OUT "Compiler:         $cversion\n";
+print OUT "\n";
+
+print "Checking compiler...\n";
+if (open(TEST,">cctest.c")) {
+    print TEST "#include <stdio.h>\nmain(){printf(\"Hello world\\n\");}\n";
+    close(TEST);
+    system("$cc -o cctest cctest.c");
+    if (`./cctest` !~ /Hello world/) {
+        print OUT "Compiler doesn't work.\n";
+        goto err;
+    }
+} else {
+    print OUT "Can't create cctest.c\n";
+}
+if (open(TEST,">cctest.c")) {
+    print TEST "#include <openssl/opensslv.h>\nmain(){printf(OPENSSL_VERSION_TEXT);}\n";
+    close(TEST);
+    system("$cc -o cctest -Iinclude cctest.c");
+    $cctest = `./cctest`;
+    if ($cctest !~ /OpenSSL $version/) {
+        if ($cctest =~ /OpenSSL/) {
+            print OUT "#include uses headers from different OpenSSL version!\n";
+        } else {
+            print OUT "Can't compile test program!\n";
+        }
+        goto err;
+    }
+} else {
+    print OUT "Can't create cctest.c\n";
+}
+
+print "Running make...\n";
+if (system("make 2>&1 | tee make.log") > 255) {
+
+    print OUT "make failed!\n";
+    if (open(IN,"<make.log")) {
+        print OUT $sep;
+        while (<IN>) {
+            print OUT;
+        }
+        close(IN);
+        print OUT $sep;
+    } else {
+        print OUT "make.log not found!\n";
+    }
+    goto err;
+}
+
+$_=$options;
+s/no-asm//;
+if (/no-/)
+{
+    print OUT "Test skipped.\n";
+    goto err;
+}
+
+print "Running make test...\n";
+if (system("make test 2>&1 | tee make.log") > 255)
+ {
+    print OUT "make test failed!\n";
+} else {
+    $ok=1;
+}
+
+if ($ok and open(IN,"<make.log")) {
+    while (<IN>) {
+        $ok=2 if /^platform: $platform/;
+    }
+    close(IN);
+}
+
+if ($ok != 2) {
+    print OUT "Failure!\n";
+    if (open(IN,"<make.log")) {
+        print OUT $sep;
+        while (<IN>) {
+            print OUT;
+        }
+        close(IN);
+        print OUT $sep;
+    } else {
+        print OUT "make.log not found!\n";
+    }
+} else {
+    print OUT "Test passed.\n";
+}
+err:
+close(OUT);
+
+print "\n";
+open(IN,"<$report") or die;
+while (<IN>) {
+    if (/$sep/) {
+        print "[...]\n";
+        last;
+    }
+    print;
+}
+print "\nTest report in file $report\n";
+
diff --git a/src/lib/libcrypto/util/ssleay.num b/src/lib/libcrypto/util/ssleay.num
index 8121738bd6..32b2e960c4 100644
--- a/src/lib/libcrypto/util/ssleay.num
+++ b/src/lib/libcrypto/util/ssleay.num
@@ -215,3 +215,13 @@ SSL_CTX_set_cert_verify_callback        232
 sk_SSL_COMP_sort                        233
 sk_SSL_CIPHER_sort                      234
 SSL_CTX_set_default_passwd_cb_userdata  235
+SSL_set_purpose                         236
+SSL_CTX_set_trust                       237
+SSL_CTX_set_purpose                     238
+SSL_set_trust                           239
+SSL_get_finished                        240
+SSL_get_peer_finished                   241
+SSL_get1_session                        242
+SSL_CTX_callback_ctrl                   243
+SSL_callback_ctrl                       244
+SSL_CTX_sessions                        245
diff --git a/src/lib/libcrypto/x509/Makefile.ssl b/src/lib/libcrypto/x509/Makefile.ssl
index c7ac35f6cc..48937b43af 100644
--- a/src/lib/libcrypto/x509/Makefile.ssl
+++ b/src/lib/libcrypto/x509/Makefile.ssl
@@ -23,17 +23,17 @@ APPS=
 
 LIB=$(TOP)/libcrypto.a
 LIBSRC= x509_def.c x509_d2.c x509_r2x.c x509_cmp.c \
-        x509_obj.c x509_req.c x509_vfy.c \
+        x509_obj.c x509_req.c x509spki.c x509_vfy.c \
         x509_set.c x509rset.c x509_err.c \
-        x509name.c x509_v3.c x509_ext.c \
+        x509name.c x509_v3.c x509_ext.c x509_att.c \
         x509type.c x509_lu.c x_all.c x509_txt.c \
-        by_file.c by_dir.c 
+        x509_trs.c by_file.c by_dir.c 
 LIBOBJ= x509_def.o x509_d2.o x509_r2x.o x509_cmp.o \
-        x509_obj.o x509_req.o x509_vfy.o \
+        x509_obj.o x509_req.o x509spki.o x509_vfy.o \
         x509_set.o x509rset.o x509_err.o \
-        x509name.o x509_v3.o x509_ext.o \
+        x509name.o x509_v3.o x509_ext.o x509_att.o \
         x509type.o x509_lu.o x_all.o x509_txt.o \
-        by_file.o by_dir.o
+        x509_trs.o by_file.o by_dir.o
 
 SRC= $(LIBSRC)
 
@@ -123,14 +123,33 @@ by_file.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 by_file.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 by_file.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
 by_file.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+x509_att.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+x509_att.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+x509_att.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+x509_att.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_att.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_att.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_att.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_att.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_att.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+x509_att.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+x509_att.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+x509_att.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+x509_att.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+x509_att.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+x509_att.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+x509_att.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+x509_att.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+x509_att.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_cmp.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_cmp.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_cmp.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-x509_cmp.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-x509_cmp.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-x509_cmp.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-x509_cmp.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-x509_cmp.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+x509_cmp.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_cmp.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_cmp.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_cmp.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_cmp.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_cmp.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 x509_cmp.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 x509_cmp.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 x509_cmp.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -139,7 +158,7 @@ x509_cmp.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 x509_cmp.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_cmp.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_cmp.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-x509_cmp.o: ../cryptlib.h
+x509_cmp.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_d2.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_d2.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_d2.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -192,11 +211,12 @@ x509_err.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 x509_ext.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_ext.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_ext.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-x509_ext.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-x509_ext.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-x509_ext.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-x509_ext.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-x509_ext.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+x509_ext.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_ext.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_ext.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_ext.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_ext.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_ext.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 x509_ext.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 x509_ext.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 x509_ext.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -205,7 +225,7 @@ x509_ext.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 x509_ext.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_ext.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_ext.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-x509_ext.o: ../cryptlib.h
+x509_ext.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_lu.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_lu.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_lu.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -293,6 +313,24 @@ x509_set.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_set.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_set.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 x509_set.o: ../cryptlib.h
+x509_trs.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+x509_trs.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+x509_trs.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+x509_trs.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_trs.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_trs.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_trs.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_trs.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_trs.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+x509_trs.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+x509_trs.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+x509_trs.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+x509_trs.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+x509_trs.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+x509_trs.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+x509_trs.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+x509_trs.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+x509_trs.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_txt.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_txt.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_txt.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -314,11 +352,12 @@ x509_txt.o: ../cryptlib.h
 x509_v3.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_v3.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_v3.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-x509_v3.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-x509_v3.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-x509_v3.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-x509_v3.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-x509_v3.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+x509_v3.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_v3.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_v3.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_v3.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_v3.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_v3.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 x509_v3.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 x509_v3.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 x509_v3.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -327,25 +366,25 @@ x509_v3.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 x509_v3.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_v3.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_v3.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-x509_v3.o: ../cryptlib.h
+x509_v3.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_vfy.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_vfy.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_vfy.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-x509_vfy.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-x509_vfy.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-x509_vfy.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-x509_vfy.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-x509_vfy.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
-x509_vfy.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
-x509_vfy.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
-x509_vfy.o: ../../include/openssl/opensslconf.h
+x509_vfy.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_vfy.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_vfy.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_vfy.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_vfy.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_vfy.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+x509_vfy.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+x509_vfy.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 x509_vfy.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
 x509_vfy.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
 x509_vfy.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 x509_vfy.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_vfy.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_vfy.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-x509_vfy.o: ../cryptlib.h
+x509_vfy.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509name.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509name.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509name.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -380,6 +419,24 @@ x509rset.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509rset.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509rset.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 x509rset.o: ../cryptlib.h
+x509spki.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+x509spki.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+x509spki.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+x509spki.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+x509spki.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509spki.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509spki.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509spki.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509spki.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+x509spki.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+x509spki.o: ../../include/openssl/opensslconf.h
+x509spki.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+x509spki.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+x509spki.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+x509spki.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+x509spki.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+x509spki.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+x509spki.o: ../cryptlib.h
 x509type.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509type.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509type.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
diff --git a/src/lib/libcrypto/x509/by_dir.c b/src/lib/libcrypto/x509/by_dir.c
index 734e39ac77..14d12c56bd 100644
--- a/src/lib/libcrypto/x509/by_dir.c
+++ b/src/lib/libcrypto/x509/by_dir.c
@@ -59,10 +59,18 @@
 #include <stdio.h>
 #include <time.h>
 #include <errno.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifdef MAC_OS_pre_X
+# include <stat.h>
+#else
+# include <sys/stat.h>
+#endif
+
 #include <openssl/lhash.h>
 #include <openssl/x509.h>
 
@@ -210,9 +218,9 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
                                 memcpy(ip,ctx->dirs_type,(ctx->num_dirs_alloced-10)*
                                         sizeof(int));
                                 if (ctx->dirs != NULL)
-                                        Free((char *)ctx->dirs);
+                                        Free(ctx->dirs);
                                 if (ctx->dirs_type != NULL)
-                                        Free((char *)ctx->dirs_type);
+                                        Free(ctx->dirs_type);
                                 ctx->dirs=pp;
                                 ctx->dirs_type=ip;
                                 }
@@ -318,8 +326,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                 /* we have added it to the cache so now pull
                  * it out again */
                 CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
-                tmp=(X509_OBJECT *)lh_retrieve(xl->store_ctx->certs,
-                        (char *)&stmp);
+                tmp=(X509_OBJECT *)lh_retrieve(xl->store_ctx->certs,&stmp);
                 CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
 
                 if (tmp != NULL)
diff --git a/src/lib/libcrypto/x509/by_file.c b/src/lib/libcrypto/x509/by_file.c
index 00ee5e8bbc..78e9240a8d 100644
--- a/src/lib/libcrypto/x509/by_file.c
+++ b/src/lib/libcrypto/x509/by_file.c
@@ -59,8 +59,6 @@
 #include <stdio.h>
 #include <time.h>
 #include <errno.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
 #include <openssl/lhash.h>
@@ -94,7 +92,7 @@ X509_LOOKUP_METHOD *X509_LOOKUP_file(void)
 static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
              char **ret)
         {
-        int ok=0,ok2=0;
+        int ok=0;
         char *file;
 
         switch (cmd)
@@ -102,31 +100,30 @@ static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
         case X509_L_FILE_LOAD:
                 if (argl == X509_FILETYPE_DEFAULT)
                         {
-                        ok=X509_load_cert_file(ctx,X509_get_default_cert_file(),
-                                X509_FILETYPE_PEM);
-                        ok2=X509_load_crl_file(ctx,X509_get_default_cert_file(),
-                                X509_FILETYPE_PEM);
-                        if (!ok || !ok2)
+                        ok = (X509_load_cert_crl_file(ctx,X509_get_default_cert_file(),
+                                X509_FILETYPE_PEM) != 0);
+                        if (!ok)
                                 {
                                 X509err(X509_F_BY_FILE_CTRL,X509_R_LOADING_DEFAULTS);
                                 }
                         else
                                 {
                                 file=(char *)Getenv(X509_get_default_cert_file_env());
-                                ok=X509_load_cert_file(ctx,file,
-                                        X509_FILETYPE_PEM);
-                                ok2=X509_load_crl_file(ctx,file,
-                                        X509_FILETYPE_PEM);
+                                ok = (X509_load_cert_crl_file(ctx,file,
+                                        X509_FILETYPE_PEM) != 0);
                                 }
                         }
                 else
                         {
-                        ok=X509_load_cert_file(ctx,argp,(int)argl);
-                        ok2=X509_load_crl_file(ctx,argp,(int)argl);
+                        if(argl == X509_FILETYPE_PEM)
+                                ok = (X509_load_cert_crl_file(ctx,argp,
+                                        X509_FILETYPE_PEM) != 0);
+                        else
+                                ok = (X509_load_cert_file(ctx,argp,(int)argl) != 0);
                         }
                 break;
                 }
-        return((ok && ok2)?ok:0);
+        return(ok);
         }
 
 int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type)
@@ -149,7 +146,7 @@ int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type)
                 {
                 for (;;)
                         {
-                        x=PEM_read_bio_X509(in,NULL,NULL,NULL);
+                        x=PEM_read_bio_X509_AUX(in,NULL,NULL,NULL);
                         if (x == NULL)
                                 {
                                 if ((ERR_GET_REASON(ERR_peek_error()) ==
@@ -263,5 +260,39 @@ err:
         return(ret);
         }
 
+int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type)
+{
+        STACK_OF(X509_INFO) *inf;
+        X509_INFO *itmp;
+        BIO *in;
+        int i, count = 0;
+        if(type != X509_FILETYPE_PEM)
+                return X509_load_cert_file(ctx, file, type);
+        in = BIO_new_file(file, "r");
+        if(!in) {
+                X509err(X509_F_X509_LOAD_CERT_CRL_FILE,ERR_R_SYS_LIB);
+                return 0;
+        }
+        inf = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
+        BIO_free(in);
+        if(!inf) {
+                X509err(X509_F_X509_LOAD_CERT_CRL_FILE,ERR_R_PEM_LIB);
+                return 0;
+        }
+        for(i = 0; i < sk_X509_INFO_num(inf); i++) {
+                itmp = sk_X509_INFO_value(inf, i);
+                if(itmp->x509) {
+                        X509_STORE_add_cert(ctx->store_ctx, itmp->x509);
+                        count++;
+                } else if(itmp->crl) {
+                        X509_STORE_add_crl(ctx->store_ctx, itmp->crl);
+                        count++;
+                }
+        }
+        sk_X509_INFO_pop_free(inf, X509_INFO_free);
+        return count;
+}
+
+
 #endif /* NO_STDIO */
 
diff --git a/src/lib/libcrypto/x509/x509.h b/src/lib/libcrypto/x509/x509.h
index 35f9484f8b..d3336d9ceb 100644
--- a/src/lib/libcrypto/x509/x509.h
+++ b/src/lib/libcrypto/x509/x509.h
@@ -176,9 +176,8 @@ typedef struct X509_extension_st
         short critical;
         short netscape_hack;
         ASN1_OCTET_STRING *value;
-        long argl;                      /* used when decoding */
-        char *argp;                     /* used when decoding */
-        void (*ex_free)();              /* clear argp stuff */
+        struct v3_ext_method *method;   /* V3 method to use */
+        void *ext_val;                  /* extension value */
         } X509_EXTENSION;
 
 DECLARE_STACK_OF(X509_EXTENSION)
@@ -231,6 +230,21 @@ typedef struct x509_cinf_st
         STACK_OF(X509_EXTENSION) *extensions;   /* [ 3 ] optional in v3 */
         } X509_CINF;
 
+/* This stuff is certificate "auxiliary info"
+ * it contains details which are useful in certificate
+ * stores and databases. When used this is tagged onto
+ * the end of the certificate itself
+ */
+
+typedef struct x509_cert_aux_st
+        {
+        STACK_OF(ASN1_OBJECT) *trust;           /* trusted uses */
+        STACK_OF(ASN1_OBJECT) *reject;          /* rejected uses */
+        ASN1_UTF8STRING *alias;                 /* "friendly name" */
+        ASN1_OCTET_STRING *keyid;               /* key id of private key */
+        STACK_OF(X509_ALGOR) *other;            /* other unspecified info */
+        } X509_CERT_AUX;
+
 typedef struct x509_st
         {
         X509_CINF *cert_info;
@@ -239,11 +253,58 @@ typedef struct x509_st
         int valid;
         int references;
         char *name;
+        CRYPTO_EX_DATA ex_data;
+        /* These contain copies of various extension values */
+        long ex_pathlen;
+        unsigned long ex_flags;
+        unsigned long ex_kusage;
+        unsigned long ex_xkusage;
+        unsigned long ex_nscert;
+#ifndef NO_SHA
+        unsigned char sha1_hash[SHA_DIGEST_LENGTH];
+#endif
+        X509_CERT_AUX *aux;
         } X509;
 
 DECLARE_STACK_OF(X509)
 DECLARE_ASN1_SET_OF(X509)
 
+/* This is used for a table of trust checking functions */
+
+typedef struct x509_trust_st {
+        int trust;
+        int flags;
+        int (*check_trust)(struct x509_trust_st *, X509 *, int);
+        char *name;
+        int arg1;
+        void *arg2;
+} X509_TRUST;
+
+DECLARE_STACK_OF(X509_TRUST)
+
+/* standard trust ids */
+
+#define X509_TRUST_ANY          1
+#define X509_TRUST_SSL_CLIENT   2
+#define X509_TRUST_SSL_SERVER   3
+#define X509_TRUST_EMAIL        4
+#define X509_TRUST_OBJECT_SIGN  5
+
+/* Keep these up to date! */
+#define X509_TRUST_MIN          1
+#define X509_TRUST_MAX          5
+
+
+/* trust_flags values */
+#define X509_TRUST_DYNAMIC      1
+#define X509_TRUST_DYNAMIC_NAME 2
+
+/* check_trust return codes */
+
+#define X509_TRUST_TRUSTED      1
+#define X509_TRUST_REJECTED     2
+#define X509_TRUST_UNTRUSTED    3
+
 typedef struct X509_revoked_st
         {
         ASN1_INTEGER *serialNumber;
@@ -318,7 +379,7 @@ DECLARE_STACK_OF(X509_INFO)
 
 /* The next 2 structures and their 8 routines were sent to me by
  * Pat Richard <patr@x509.com> and are used to manipulate
- * Netscapes spki strucutres - usefull if you are writing a CA web page
+ * Netscapes spki structures - useful if you are writing a CA web page
  */
 typedef struct Netscape_spkac_st
         {
@@ -372,8 +433,10 @@ X509_ALGOR *prf;
 typedef struct pkcs8_priv_key_info_st
         {
         int broken;     /* Flag for various broken formats */
-#define PKCS8_OK        0
-#define PKCS8_NO_OCTET  1
+#define PKCS8_OK                0
+#define PKCS8_NO_OCTET          1
+#define PKCS8_EMBEDDED_PARAM    2
+#define PKCS8_NS_DB             3
         ASN1_INTEGER *version;
         X509_ALGOR *pkeyalg;
         ASN1_TYPE *pkey; /* Should be OCTET STRING but some are broken */
@@ -552,13 +615,20 @@ int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r);
 int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r);
 int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r);
 
+NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(const char *str, int len);
+char * NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *x);
+EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x);
+int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey);
+
+int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki);
+
 int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
 int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
 int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md);
 
-int X509_digest(X509 *data,EVP_MD *type,unsigned char *md,unsigned int *len);
-int X509_NAME_digest(X509_NAME *data,EVP_MD *type,
+int X509_digest(X509 *data,const EVP_MD *type,unsigned char *md,unsigned int *len);
+int X509_NAME_digest(X509_NAME *data,const EVP_MD *type,
         unsigned char *md,unsigned int *len);
 #endif
 
@@ -574,16 +644,23 @@ RSA *d2i_RSAPrivateKey_fp(FILE *fp,RSA **rsa);
 int i2d_RSAPrivateKey_fp(FILE *fp,RSA *rsa);
 RSA *d2i_RSAPublicKey_fp(FILE *fp,RSA **rsa);
 int i2d_RSAPublicKey_fp(FILE *fp,RSA *rsa);
+RSA *d2i_RSA_PUBKEY_fp(FILE *fp,RSA **rsa);
+int i2d_RSA_PUBKEY_fp(FILE *fp,RSA *rsa);
 #endif
 #ifndef NO_DSA
+DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa);
+int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa);
 DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa);
 int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa);
+#endif
 X509_SIG *d2i_PKCS8_fp(FILE *fp,X509_SIG **p8);
 int i2d_PKCS8_fp(FILE *fp,X509_SIG *p8);
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,
                                                 PKCS8_PRIV_KEY_INFO **p8inf);
 int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,PKCS8_PRIV_KEY_INFO *p8inf);
-#endif
+int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key);
+int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey);
+EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a);
 #endif
 
 #ifdef HEADER_BIO_H
@@ -598,8 +675,12 @@ RSA *d2i_RSAPrivateKey_bio(BIO *bp,RSA **rsa);
 int i2d_RSAPrivateKey_bio(BIO *bp,RSA *rsa);
 RSA *d2i_RSAPublicKey_bio(BIO *bp,RSA **rsa);
 int i2d_RSAPublicKey_bio(BIO *bp,RSA *rsa);
+RSA *d2i_RSA_PUBKEY_bio(BIO *bp,RSA **rsa);
+int i2d_RSA_PUBKEY_bio(BIO *bp,RSA *rsa);
 #endif
 #ifndef NO_DSA
+DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa);
+int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa);
 DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa);
 int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa);
 #endif
@@ -608,6 +689,9 @@ int i2d_PKCS8_bio(BIO *bp,X509_SIG *p8);
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
                                                 PKCS8_PRIV_KEY_INFO **p8inf);
 int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,PKCS8_PRIV_KEY_INFO *p8inf);
+int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key);
+int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey);
+EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a);
 #endif
 
 X509 *X509_dup(X509 *x509);
@@ -635,7 +719,7 @@ const char *	X509_get_default_cert_dir_env(void );
 const char *    X509_get_default_cert_file_env(void );
 const char *    X509_get_default_private_dir(void );
 
-X509_REQ *      X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md);
+X509_REQ *      X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
 X509 *          X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey);
 void ERR_load_X509_strings(void );
 
@@ -660,7 +744,19 @@ int		X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey);
 EVP_PKEY *      X509_PUBKEY_get(X509_PUBKEY *key);
 int             X509_get_pubkey_parameters(EVP_PKEY *pkey,
                                            STACK_OF(X509) *chain);
-
+int             i2d_PUBKEY(EVP_PKEY *a,unsigned char **pp);
+EVP_PKEY *      d2i_PUBKEY(EVP_PKEY **a,unsigned char **pp,
+                        long length);
+#ifndef NO_RSA
+int             i2d_RSA_PUBKEY(RSA *a,unsigned char **pp);
+RSA *           d2i_RSA_PUBKEY(RSA **a,unsigned char **pp,
+                        long length);
+#endif
+#ifndef NO_DSA
+int             i2d_DSA_PUBKEY(DSA *a,unsigned char **pp);
+DSA *           d2i_DSA_PUBKEY(DSA **a,unsigned char **pp,
+                        long length);
+#endif
 
 X509_SIG *      X509_SIG_new(void );
 void            X509_SIG_free(X509_SIG *a);
@@ -714,6 +810,25 @@ X509 *		X509_new(void);
 void            X509_free(X509 *a);
 int             i2d_X509(X509 *a,unsigned char **pp);
 X509 *          d2i_X509(X509 **a,unsigned char **pp,long length);
+int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int X509_set_ex_data(X509 *r, int idx, void *arg);
+void *X509_get_ex_data(X509 *r, int idx);
+int             i2d_X509_AUX(X509 *a,unsigned char **pp);
+X509 *          d2i_X509_AUX(X509 **a,unsigned char **pp,long length);
+
+X509_CERT_AUX * X509_CERT_AUX_new(void);
+void            X509_CERT_AUX_free(X509_CERT_AUX *a);
+int             i2d_X509_CERT_AUX(X509_CERT_AUX *a,unsigned char **pp);
+X509_CERT_AUX * d2i_X509_CERT_AUX(X509_CERT_AUX **a,unsigned char **pp,
+                                                                long length);
+int X509_alias_set1(X509 *x, unsigned char *name, int len);
+unsigned char * X509_alias_get0(X509 *x, int *len);
+int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int);
+int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj);
+int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj);
+void X509_trust_clear(X509 *x);
+void X509_reject_clear(X509 *x);
 
 X509_REVOKED *  X509_REVOKED_new(void);
 void            X509_REVOKED_free(X509_REVOKED *a);
@@ -762,7 +877,7 @@ char *		X509_NAME_oneline(X509_NAME *a,char *buf,int size);
 int ASN1_verify(int (*i2d)(), X509_ALGOR *algor1,
         ASN1_BIT_STRING *signature,char *data,EVP_PKEY *pkey);
 
-int ASN1_digest(int (*i2d)(),EVP_MD *type,char *data,
+int ASN1_digest(int (*i2d)(),const EVP_MD *type,char *data,
         unsigned char *md,unsigned int *len);
 
 int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
@@ -787,6 +902,30 @@ int		X509_REQ_set_version(X509_REQ *x,long version);
 int             X509_REQ_set_subject_name(X509_REQ *req,X509_NAME *name);
 int             X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey);
 EVP_PKEY *      X509_REQ_get_pubkey(X509_REQ *req);
+int             X509_REQ_extension_nid(int nid);
+int *           X509_REQ_get_extension_nids(void);
+void            X509_REQ_set_extension_nids(int *nids);
+STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req);
+int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
+                                int nid);
+int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts);
+int X509_REQ_get_attr_count(const X509_REQ *req);
+int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
+                          int lastpos);
+int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,
+                          int lastpos);
+X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc);
+X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc);
+int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr);
+int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len);
+int X509_REQ_add1_attr_by_NID(X509_REQ *req,
+                        int nid, int type,
+                        unsigned char *bytes, int len);
+int X509_REQ_add1_attr_by_txt(X509_REQ *req,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len);
 
 int             X509_check_private_key(X509 *x509,EVP_PKEY *pkey);
 
@@ -799,6 +938,7 @@ unsigned long	X509_issuer_name_hash(X509 *a);
 int             X509_subject_name_cmp(X509 *a,X509 *b);
 unsigned long   X509_subject_name_hash(X509 *x);
 
+int             X509_cmp (X509 *a, X509 *b);
 int             X509_NAME_cmp (X509_NAME *a, X509_NAME *b);
 unsigned long   X509_NAME_hash(X509_NAME *x);
 
@@ -812,6 +952,7 @@ int		X509_REQ_print_fp(FILE *bp,X509_REQ *req);
 #ifdef HEADER_BIO_H
 int             X509_NAME_print(BIO *bp, X509_NAME *name, int obase);
 int             X509_print(BIO *bp,X509 *x);
+int             X509_CERT_AUX_print(BIO *bp,X509_CERT_AUX *x, int indent);
 int             X509_CRL_print(BIO *bp,X509_CRL *x);
 int             X509_REQ_print(BIO *bp,X509_REQ *req);
 #endif
@@ -823,7 +964,7 @@ int		X509_NAME_get_text_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj,
                         char *buf,int len);
 
 /* NOTE: you should be passsing -1, not 0 as lastpos.  The functions that use
- * lastpos, seach after that position on. */
+ * lastpos, search after that position on. */
 int             X509_NAME_get_index_by_NID(X509_NAME *name,int nid,int lastpos);
 int             X509_NAME_get_index_by_OBJ(X509_NAME *name,ASN1_OBJECT *obj,
                         int lastpos);
@@ -831,8 +972,16 @@ X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc);
 X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc);
 int             X509_NAME_add_entry(X509_NAME *name,X509_NAME_ENTRY *ne,
                         int loc, int set);
+int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len, int loc, int set);
+int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
+                        unsigned char *bytes, int len, int loc, int set);
+X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
+                char *field, int type, unsigned char *bytes, int len);
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
                         int type,unsigned char *bytes, int len);
+int X509_NAME_add_entry_by_txt(X509_NAME *name, char *field, int type,
+                        unsigned char *bytes, int len, int loc, int set);
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
                         ASN1_OBJECT *obj, int type,unsigned char *bytes,
                         int len);
@@ -862,6 +1011,7 @@ int		X509_get_ext_by_critical(X509 *x, int crit, int lastpos);
 X509_EXTENSION *X509_get_ext(X509 *x, int loc);
 X509_EXTENSION *X509_delete_ext(X509 *x, int loc);
 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
+void    *       X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx);
 
 int             X509_CRL_get_ext_count(X509_CRL *x);
 int             X509_CRL_get_ext_by_NID(X509_CRL *x, int nid, int lastpos);
@@ -870,6 +1020,7 @@ int		X509_CRL_get_ext_by_critical(X509_CRL *x, int crit, int lastpos);
 X509_EXTENSION *X509_CRL_get_ext(X509_CRL *x, int loc);
 X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc);
 int             X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc);
+void    *       X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx);
 
 int             X509_REVOKED_get_ext_count(X509_REVOKED *x);
 int             X509_REVOKED_get_ext_by_NID(X509_REVOKED *x, int nid, int lastpos);
@@ -878,6 +1029,7 @@ int		X509_REVOKED_get_ext_by_critical(X509_REVOKED *x, int crit, int lastpos);
 X509_EXTENSION *X509_REVOKED_get_ext(X509_REVOKED *x, int loc);
 X509_EXTENSION *X509_REVOKED_delete_ext(X509_REVOKED *x, int loc);
 int             X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc);
+void    *       X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx);
 
 X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
                         int nid, int crit, ASN1_OCTET_STRING *data);
@@ -891,6 +1043,38 @@ ASN1_OBJECT *	X509_EXTENSION_get_object(X509_EXTENSION *ex);
 ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ne);
 int             X509_EXTENSION_get_critical(X509_EXTENSION *ex);
 
+int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x);
+int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
+                          int lastpos);
+int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,
+                          int lastpos);
+X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc);
+X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc);
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
+                                         X509_ATTRIBUTE *attr);
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_OBJ(STACK_OF(X509_ATTRIBUTE) **x,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len);
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x,
+                        int nid, int type,
+                        unsigned char *bytes, int len);
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len);
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
+             int atrtype, void *data, int len);
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr,
+             ASN1_OBJECT *obj, int atrtype, void *data, int len);
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr,
+                char *atrname, int type, unsigned char *bytes, int len);
+int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, ASN1_OBJECT *obj);
+int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, void *data, int len);
+void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx,
+                                        int atrtype, void *data);
+int X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr);
+ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr);
+ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx);
+
 int             X509_verify_cert(X509_STORE_CTX *ctx);
 
 /* lookup a cert from a X509 STACK */
@@ -926,8 +1110,20 @@ void PKCS8_PRIV_KEY_INFO_free(PKCS8_PRIV_KEY_INFO *a);
 
 EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8);
 PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey);
+PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken);
 PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 
+int X509_check_trust(X509 *x, int id, int flags);
+int X509_TRUST_get_count(void);
+X509_TRUST * X509_TRUST_get0(int idx);
+int X509_TRUST_get_by_id(int id);
+int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
+                                        char *name, int arg1, void *arg2);
+void X509_TRUST_cleanup(void);
+int X509_TRUST_get_flags(X509_TRUST *xp);
+char *X509_TRUST_get0_name(X509_TRUST *xp);
+int X509_TRUST_get_trust(X509_TRUST *xp);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -940,15 +1136,25 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 #define X509_F_BY_FILE_CTRL                              101
 #define X509_F_DIR_CTRL                                  102
 #define X509_F_GET_CERT_BY_SUBJECT                       103
+#define X509_F_NETSCAPE_SPKI_B64_DECODE                  129
+#define X509_F_NETSCAPE_SPKI_B64_ENCODE                  130
 #define X509_F_X509V3_ADD_EXT                            104
+#define X509_F_X509_ADD_ATTR                             135
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_NID              136
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ              137
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_TXT              140
+#define X509_F_X509_ATTRIBUTE_GET0_DATA                  139
+#define X509_F_X509_ATTRIBUTE_SET1_DATA                  138
 #define X509_F_X509_CHECK_PRIVATE_KEY                    128
 #define X509_F_X509_EXTENSION_CREATE_BY_NID              108
 #define X509_F_X509_EXTENSION_CREATE_BY_OBJ              109
 #define X509_F_X509_GET_PUBKEY_PARAMETERS                110
+#define X509_F_X509_LOAD_CERT_CRL_FILE                   132
 #define X509_F_X509_LOAD_CERT_FILE                       111
 #define X509_F_X509_LOAD_CRL_FILE                        112
 #define X509_F_X509_NAME_ADD_ENTRY                       113
 #define X509_F_X509_NAME_ENTRY_CREATE_BY_NID             114
+#define X509_F_X509_NAME_ENTRY_CREATE_BY_TXT             131
 #define X509_F_X509_NAME_ENTRY_SET_OBJECT                115
 #define X509_F_X509_NAME_ONELINE                         116
 #define X509_F_X509_NAME_PRINT                           117
@@ -960,15 +1166,19 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 #define X509_F_X509_REQ_TO_X509                          123
 #define X509_F_X509_STORE_ADD_CERT                       124
 #define X509_F_X509_STORE_ADD_CRL                        125
+#define X509_F_X509_STORE_CTX_PURPOSE_INHERIT            134
 #define X509_F_X509_TO_X509_REQ                          126
+#define X509_F_X509_TRUST_ADD                            133
 #define X509_F_X509_VERIFY_CERT                          127
 
 /* Reason codes. */
 #define X509_R_BAD_X509_FILETYPE                         100
+#define X509_R_BASE64_DECODE_ERROR                       118
 #define X509_R_CANT_CHECK_DH_KEY                         114
 #define X509_R_CERT_ALREADY_IN_HASH_TABLE                101
 #define X509_R_ERR_ASN1_LIB                              102
 #define X509_R_INVALID_DIRECTORY                         113
+#define X509_R_INVALID_FIELD_NAME                        119
 #define X509_R_KEY_TYPE_MISMATCH                         115
 #define X509_R_KEY_VALUES_MISMATCH                       116
 #define X509_R_LOADING_CERT_DIR                          103
@@ -979,8 +1189,11 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 #define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY            108
 #define X509_R_UNKNOWN_KEY_TYPE                          117
 #define X509_R_UNKNOWN_NID                               109
+#define X509_R_UNKNOWN_PURPOSE_ID                        121
+#define X509_R_UNKNOWN_TRUST_ID                          120
 #define X509_R_UNSUPPORTED_ALGORITHM                     111
 #define X509_R_WRONG_LOOKUP_TYPE                         112
+#define X509_R_WRONG_TYPE                                122
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libcrypto/x509/x509_att.c b/src/lib/libcrypto/x509/x509_att.c
new file mode 100644
index 0000000000..caafde658f
--- /dev/null
+++ b/src/lib/libcrypto/x509/x509_att.c
@@ -0,0 +1,326 @@
+/* crypto/x509/x509_att.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <openssl/stack.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x)
+{
+        if (!x) return 0;
+        return(sk_X509_ATTRIBUTE_num(x));
+}
+
+int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
+                          int lastpos)
+{
+        ASN1_OBJECT *obj;
+
+        obj=OBJ_nid2obj(nid);
+        if (obj == NULL) return(-2);
+        return(X509at_get_attr_by_OBJ(x,obj,lastpos));
+}
+
+int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,
+                          int lastpos)
+{
+        int n;
+        X509_ATTRIBUTE *ex;
+
+        if (sk == NULL) return(-1);
+        lastpos++;
+        if (lastpos < 0)
+                lastpos=0;
+        n=sk_X509_ATTRIBUTE_num(sk);
+        for ( ; lastpos < n; lastpos++)
+                {
+                ex=sk_X509_ATTRIBUTE_value(sk,lastpos);
+                if (OBJ_cmp(ex->object,obj) == 0)
+                        return(lastpos);
+                }
+        return(-1);
+}
+
+X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
+{
+        if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
+                return NULL;
+        else
+                return sk_X509_ATTRIBUTE_value(x,loc);
+}
+
+X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc)
+{
+        X509_ATTRIBUTE *ret;
+
+        if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
+                return(NULL);
+        ret=sk_X509_ATTRIBUTE_delete(x,loc);
+        return(ret);
+}
+
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
+                                         X509_ATTRIBUTE *attr)
+{
+        X509_ATTRIBUTE *new_attr=NULL;
+        STACK_OF(X509_ATTRIBUTE) *sk=NULL;
+
+        if ((x != NULL) && (*x == NULL))
+                {
+                if ((sk=sk_X509_ATTRIBUTE_new_null()) == NULL)
+                        goto err;
+                }
+        else
+                sk= *x;
+
+        if ((new_attr=X509_ATTRIBUTE_dup(attr)) == NULL)
+                goto err2;
+        if (!sk_X509_ATTRIBUTE_push(sk,new_attr))
+                goto err;
+        if ((x != NULL) && (*x == NULL))
+                *x=sk;
+        return(sk);
+err:
+        X509err(X509_F_X509_ADD_ATTR,ERR_R_MALLOC_FAILURE);
+err2:
+        if (new_attr != NULL) X509_ATTRIBUTE_free(new_attr);
+        if (sk != NULL) sk_X509_ATTRIBUTE_free(sk);
+        return(NULL);
+}
+
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_OBJ(STACK_OF(X509_ATTRIBUTE) **x,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *ret;
+        attr = X509_ATTRIBUTE_create_by_OBJ(NULL, obj, type, bytes, len);
+        if(!attr) return 0;
+        ret = X509at_add1_attr(x, attr);
+        X509_ATTRIBUTE_free(attr);
+        return ret;
+}
+
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x,
+                        int nid, int type,
+                        unsigned char *bytes, int len)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *ret;
+        attr = X509_ATTRIBUTE_create_by_NID(NULL, nid, type, bytes, len);
+        if(!attr) return 0;
+        ret = X509at_add1_attr(x, attr);
+        X509_ATTRIBUTE_free(attr);
+        return ret;
+}
+
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *ret;
+        attr = X509_ATTRIBUTE_create_by_txt(NULL, attrname, type, bytes, len);
+        if(!attr) return 0;
+        ret = X509at_add1_attr(x, attr);
+        X509_ATTRIBUTE_free(attr);
+        return ret;
+}
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
+             int atrtype, void *data, int len)
+{
+        ASN1_OBJECT *obj;
+        X509_ATTRIBUTE *ret;
+
+        obj=OBJ_nid2obj(nid);
+        if (obj == NULL)
+                {
+                X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_NID,X509_R_UNKNOWN_NID);
+                return(NULL);
+                }
+        ret=X509_ATTRIBUTE_create_by_OBJ(attr,obj,atrtype,data,len);
+        if (ret == NULL) ASN1_OBJECT_free(obj);
+        return(ret);
+}
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr,
+             ASN1_OBJECT *obj, int atrtype, void *data, int len)
+{
+        X509_ATTRIBUTE *ret;
+
+        if ((attr == NULL) || (*attr == NULL))
+                {
+                if ((ret=X509_ATTRIBUTE_new()) == NULL)
+                        {
+                        X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ,ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                }
+        else
+                ret= *attr;
+
+        if (!X509_ATTRIBUTE_set1_object(ret,obj))
+                goto err;
+        if (!X509_ATTRIBUTE_set1_data(ret,atrtype,data,len))
+                goto err;
+        
+        if ((attr != NULL) && (*attr == NULL)) *attr=ret;
+        return(ret);
+err:
+        if ((attr == NULL) || (ret != *attr))
+                X509_ATTRIBUTE_free(ret);
+        return(NULL);
+}
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr,
+                char *atrname, int type, unsigned char *bytes, int len)
+        {
+        ASN1_OBJECT *obj;
+        X509_ATTRIBUTE *nattr;
+
+        obj=OBJ_txt2obj(atrname, 0);
+        if (obj == NULL)
+                {
+                X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT,
+                                                X509_R_INVALID_FIELD_NAME);
+                ERR_add_error_data(2, "name=", atrname);
+                return(NULL);
+                }
+        nattr = X509_ATTRIBUTE_create_by_OBJ(attr,obj,type,bytes,len);
+        ASN1_OBJECT_free(obj);
+        return nattr;
+        }
+
+int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, ASN1_OBJECT *obj)
+{
+        if ((attr == NULL) || (obj == NULL))
+                return(0);
+        ASN1_OBJECT_free(attr->object);
+        attr->object=OBJ_dup(obj);
+        return(1);
+}
+
+int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, void *data, int len)
+{
+        ASN1_TYPE *ttmp;
+        ASN1_STRING *stmp;
+        int atype;
+        if (!attr) return 0;
+        if(attrtype & MBSTRING_FLAG) {
+                stmp = ASN1_STRING_set_by_NID(NULL, data, len, attrtype,
+                                                OBJ_obj2nid(attr->object));
+                if(!stmp) {
+                        X509err(X509_F_X509_ATTRIBUTE_SET1_DATA, ERR_R_ASN1_LIB);
+                        return 0;
+                }
+                atype = stmp->type;
+        } else {
+                if(!(stmp = ASN1_STRING_type_new(attrtype))) goto err;
+                if(!ASN1_STRING_set(stmp, data, len)) goto err;
+                atype = attrtype;
+        }
+        if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err;
+        if(!(ttmp = ASN1_TYPE_new())) goto err;
+        if(!sk_ASN1_TYPE_push(attr->value.set, ttmp)) goto err;
+        attr->set = 1;
+        ASN1_TYPE_set(ttmp, atype, stmp);
+        return 1;
+        err:
+        X509err(X509_F_X509_ATTRIBUTE_SET1_DATA, ERR_R_MALLOC_FAILURE);
+        return 0;
+}
+
+int X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr)
+{
+        if(attr->set) return sk_ASN1_TYPE_num(attr->value.set);
+        if(attr->value.single) return 1;
+        return 0;
+}
+
+ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr)
+{
+        if (attr == NULL) return(NULL);
+        return(attr->object);
+}
+
+void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx,
+                                        int atrtype, void *data)
+{
+        ASN1_TYPE *ttmp;
+        ttmp = X509_ATTRIBUTE_get0_type(attr, idx);
+        if(!ttmp) return NULL;
+        if(atrtype != ASN1_TYPE_get(ttmp)){
+                X509err(X509_F_X509_ATTRIBUTE_GET0_DATA, X509_R_WRONG_TYPE);
+                return NULL;
+        }
+        return ttmp->value.ptr;
+}
+
+ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx)
+{
+        if (attr == NULL) return(NULL);
+        if(idx >= X509_ATTRIBUTE_count(attr)) return NULL;
+        if(attr->set) return sk_ASN1_TYPE_value(attr->value.set, idx);
+        else return attr->value.single;
+}
diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
index 9a93bae3ff..a8a5ca8b03 100644
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ b/src/lib/libcrypto/x509/x509_cmp.c
@@ -57,12 +57,11 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 int X509_issuer_and_serial_cmp(X509 *a, X509 *b)
         {
@@ -71,7 +70,7 @@ int X509_issuer_and_serial_cmp(X509 *a, X509 *b)
 
         ai=a->cert_info;
         bi=b->cert_info;
-        i=ASN1_INTEGER_cmp(ai->serialNumber,bi->serialNumber);
+        i=M_ASN1_INTEGER_cmp(ai->serialNumber,bi->serialNumber);
         if (i) return(i);
         return(X509_NAME_cmp(ai->issuer,bi->issuer));
         }
@@ -138,6 +137,20 @@ unsigned long X509_subject_name_hash(X509 *x)
         return(X509_NAME_hash(x->cert_info->subject));
         }
 
+#ifndef NO_SHA
+/* Compare two certificates: they must be identical for
+ * this to work.
+ */
+int X509_cmp(X509 *a, X509 *b)
+{
+        /* ensure hash is valid */
+        X509_check_purpose(a, -1, 0);
+        X509_check_purpose(b, -1, 0);
+
+        return memcmp(a->sha1_hash, b->sha1_hash, SHA_DIGEST_LENGTH);
+}
+#endif
+
 int X509_NAME_cmp(X509_NAME *a, X509_NAME *b)
         {
         int i,j;
@@ -175,7 +188,7 @@ int X509_NAME_cmp(X509_NAME *a, X509_NAME *b)
 
 #ifndef NO_MD5
 /* I now DER encode the name and hash it.  Since I cache the DER encoding,
- * this is reasonably effiecent. */
+ * this is reasonably efficient. */
 unsigned long X509_NAME_hash(X509_NAME *x)
         {
         unsigned long ret=0;
@@ -209,6 +222,8 @@ X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk, X509_NAME *name,
         X509_CINF cinf;
         X509 x,*x509=NULL;
 
+        if(!sk) return NULL;
+
         x.cert_info= &cinf;
         cinf.serialNumber=serial;
         cinf.issuer=name;
diff --git a/src/lib/libcrypto/x509/x509_d2.c b/src/lib/libcrypto/x509/x509_d2.c
index 3e7ec5b432..753d53eb43 100644
--- a/src/lib/libcrypto/x509/x509_d2.c
+++ b/src/lib/libcrypto/x509/x509_d2.c
@@ -57,8 +57,6 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
@@ -91,13 +89,15 @@ int X509_STORE_load_locations(X509_STORE *ctx, const char *file,
                 {
                 lookup=X509_STORE_add_lookup(ctx,X509_LOOKUP_file());
                 if (lookup == NULL) return(0);
-                X509_LOOKUP_load_file(lookup,file,X509_FILETYPE_PEM);
+                if (X509_LOOKUP_load_file(lookup,file,X509_FILETYPE_PEM) != 1)
+                    return(0);
                 }
         if (path != NULL)
                 {
                 lookup=X509_STORE_add_lookup(ctx,X509_LOOKUP_hash_dir());
                 if (lookup == NULL) return(0);
-                X509_LOOKUP_add_dir(lookup,path,X509_FILETYPE_PEM);
+                if (X509_LOOKUP_add_dir(lookup,path,X509_FILETYPE_PEM) != 1)
+                    return(0);
                 }
         if ((path == NULL) && (file == NULL))
                 return(0);
diff --git a/src/lib/libcrypto/x509/x509_def.c b/src/lib/libcrypto/x509/x509_def.c
index c4bee71569..e0ac151a76 100644
--- a/src/lib/libcrypto/x509/x509_def.c
+++ b/src/lib/libcrypto/x509/x509_def.c
@@ -57,8 +57,6 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
diff --git a/src/lib/libcrypto/x509/x509_err.c b/src/lib/libcrypto/x509/x509_err.c
index 9afd4ccde5..fdedbdac34 100644
--- a/src/lib/libcrypto/x509/x509_err.c
+++ b/src/lib/libcrypto/x509/x509_err.c
@@ -69,15 +69,25 @@ static ERR_STRING_DATA X509_str_functs[]=
 {ERR_PACK(0,X509_F_BY_FILE_CTRL,0),     "BY_FILE_CTRL"},
 {ERR_PACK(0,X509_F_DIR_CTRL,0), "DIR_CTRL"},
 {ERR_PACK(0,X509_F_GET_CERT_BY_SUBJECT,0),      "GET_CERT_BY_SUBJECT"},
+{ERR_PACK(0,X509_F_NETSCAPE_SPKI_B64_DECODE,0), "NETSCAPE_SPKI_b64_decode"},
+{ERR_PACK(0,X509_F_NETSCAPE_SPKI_B64_ENCODE,0), "NETSCAPE_SPKI_b64_encode"},
 {ERR_PACK(0,X509_F_X509V3_ADD_EXT,0),   "X509v3_add_ext"},
+{ERR_PACK(0,X509_F_X509_ADD_ATTR,0),    "X509_ADD_ATTR"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_CREATE_BY_NID,0),     "X509_ATTRIBUTE_create_by_NID"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ,0),     "X509_ATTRIBUTE_create_by_OBJ"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_CREATE_BY_TXT,0),     "X509_ATTRIBUTE_create_by_txt"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_GET0_DATA,0), "X509_ATTRIBUTE_get0_data"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_SET1_DATA,0), "X509_ATTRIBUTE_set1_data"},
 {ERR_PACK(0,X509_F_X509_CHECK_PRIVATE_KEY,0),   "X509_check_private_key"},
 {ERR_PACK(0,X509_F_X509_EXTENSION_CREATE_BY_NID,0),     "X509_EXTENSION_create_by_NID"},
 {ERR_PACK(0,X509_F_X509_EXTENSION_CREATE_BY_OBJ,0),     "X509_EXTENSION_create_by_OBJ"},
 {ERR_PACK(0,X509_F_X509_GET_PUBKEY_PARAMETERS,0),       "X509_get_pubkey_parameters"},
+{ERR_PACK(0,X509_F_X509_LOAD_CERT_CRL_FILE,0),  "X509_load_cert_crl_file"},
 {ERR_PACK(0,X509_F_X509_LOAD_CERT_FILE,0),      "X509_load_cert_file"},
 {ERR_PACK(0,X509_F_X509_LOAD_CRL_FILE,0),       "X509_load_crl_file"},
 {ERR_PACK(0,X509_F_X509_NAME_ADD_ENTRY,0),      "X509_NAME_add_entry"},
 {ERR_PACK(0,X509_F_X509_NAME_ENTRY_CREATE_BY_NID,0),    "X509_NAME_ENTRY_create_by_NID"},
+{ERR_PACK(0,X509_F_X509_NAME_ENTRY_CREATE_BY_TXT,0),    "X509_NAME_ENTRY_create_by_txt"},
 {ERR_PACK(0,X509_F_X509_NAME_ENTRY_SET_OBJECT,0),       "X509_NAME_ENTRY_set_object"},
 {ERR_PACK(0,X509_F_X509_NAME_ONELINE,0),        "X509_NAME_oneline"},
 {ERR_PACK(0,X509_F_X509_NAME_PRINT,0),  "X509_NAME_print"},
@@ -89,7 +99,9 @@ static ERR_STRING_DATA X509_str_functs[]=
 {ERR_PACK(0,X509_F_X509_REQ_TO_X509,0), "X509_REQ_to_X509"},
 {ERR_PACK(0,X509_F_X509_STORE_ADD_CERT,0),      "X509_STORE_add_cert"},
 {ERR_PACK(0,X509_F_X509_STORE_ADD_CRL,0),       "X509_STORE_add_crl"},
+{ERR_PACK(0,X509_F_X509_STORE_CTX_PURPOSE_INHERIT,0),   "X509_STORE_CTX_purpose_inherit"},
 {ERR_PACK(0,X509_F_X509_TO_X509_REQ,0), "X509_to_X509_REQ"},
+{ERR_PACK(0,X509_F_X509_TRUST_ADD,0),   "X509_TRUST_add"},
 {ERR_PACK(0,X509_F_X509_VERIFY_CERT,0), "X509_verify_cert"},
 {0,NULL}
         };
@@ -97,10 +109,12 @@ static ERR_STRING_DATA X509_str_functs[]=
 static ERR_STRING_DATA X509_str_reasons[]=
         {
 {X509_R_BAD_X509_FILETYPE                ,"bad x509 filetype"},
+{X509_R_BASE64_DECODE_ERROR              ,"base64 decode error"},
 {X509_R_CANT_CHECK_DH_KEY                ,"cant check dh key"},
 {X509_R_CERT_ALREADY_IN_HASH_TABLE       ,"cert already in hash table"},
 {X509_R_ERR_ASN1_LIB                     ,"err asn1 lib"},
 {X509_R_INVALID_DIRECTORY                ,"invalid directory"},
+{X509_R_INVALID_FIELD_NAME               ,"invalid field name"},
 {X509_R_KEY_TYPE_MISMATCH                ,"key type mismatch"},
 {X509_R_KEY_VALUES_MISMATCH              ,"key values mismatch"},
 {X509_R_LOADING_CERT_DIR                 ,"loading cert dir"},
@@ -111,8 +125,11 @@ static ERR_STRING_DATA X509_str_reasons[]=
 {X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY   ,"unable to get certs public key"},
 {X509_R_UNKNOWN_KEY_TYPE                 ,"unknown key type"},
 {X509_R_UNKNOWN_NID                      ,"unknown nid"},
+{X509_R_UNKNOWN_PURPOSE_ID               ,"unknown purpose id"},
+{X509_R_UNKNOWN_TRUST_ID                 ,"unknown trust id"},
 {X509_R_UNSUPPORTED_ALGORITHM            ,"unsupported algorithm"},
 {X509_R_WRONG_LOOKUP_TYPE                ,"wrong lookup type"},
+{X509_R_WRONG_TYPE                       ,"wrong type"},
 {0,NULL}
         };
 
diff --git a/src/lib/libcrypto/x509/x509_ext.c b/src/lib/libcrypto/x509/x509_ext.c
index f8565a60b2..2955989807 100644
--- a/src/lib/libcrypto/x509/x509_ext.c
+++ b/src/lib/libcrypto/x509/x509_ext.c
@@ -63,6 +63,8 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
 
 int X509_CRL_get_ext_count(X509_CRL *x)
         {
@@ -94,6 +96,11 @@ X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc)
         return(X509v3_delete_ext(x->crl->extensions,loc));
         }
 
+void *X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx)
+{
+        return X509V3_get_d2i(x->crl->extensions, nid, crit, idx);
+}
+
 int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc)
         {
         return(X509v3_add_ext(&(x->crl->extensions),ex,loc) != NULL);
@@ -134,6 +141,11 @@ int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc)
         return(X509v3_add_ext(&(x->cert_info->extensions),ex,loc) != NULL);
         }
 
+void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
+{
+        return X509V3_get_d2i(x->cert_info->extensions, nid, crit, idx);
+}
+
 int X509_REVOKED_get_ext_count(X509_REVOKED *x)
         {
         return(X509v3_get_ext_count(x->extensions));
@@ -170,5 +182,10 @@ int X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc)
         return(X509v3_add_ext(&(x->extensions),ex,loc) != NULL);
         }
 
+void *X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx)
+{
+        return X509V3_get_d2i(x->extensions, nid, crit, idx);
+}
+
 IMPLEMENT_STACK_OF(X509_EXTENSION)
 IMPLEMENT_ASN1_SET_OF(X509_EXTENSION)
diff --git a/src/lib/libcrypto/x509/x509_lu.c b/src/lib/libcrypto/x509/x509_lu.c
index 18bfecb11e..a20006d67e 100644
--- a/src/lib/libcrypto/x509/x509_lu.c
+++ b/src/lib/libcrypto/x509/x509_lu.c
@@ -61,8 +61,8 @@
 #include <openssl/lhash.h>
 #include <openssl/x509.h>
 
-static STACK *x509_store_meth=NULL;
-static STACK *x509_store_ctx_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_store_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_store_ctx_meth=NULL;
 
 X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method)
         {
@@ -244,7 +244,7 @@ void X509_STORE_free(X509_STORE *vfy)
                 }
         sk_X509_LOOKUP_free(sk);
 
-        CRYPTO_free_ex_data(x509_store_meth,(char *)vfy,&vfy->ex_data);
+        CRYPTO_free_ex_data(x509_store_meth,vfy,&vfy->ex_data);
         lh_doall(vfy->certs,cleanup);
         lh_free(vfy->certs);
         Free(vfy);
@@ -377,10 +377,24 @@ X509_OBJECT *X509_OBJECT_retrieve_by_subject(LHASH *h, int type,
                 abort();
                 }
 
-        tmp=(X509_OBJECT *)lh_retrieve(h,(char *)&stmp);
+        tmp=(X509_OBJECT *)lh_retrieve(h,&stmp);
         return(tmp);
         }
 
+X509_STORE_CTX *X509_STORE_CTX_new(void)
+{
+        X509_STORE_CTX *ctx;
+        ctx = (X509_STORE_CTX *)Malloc(sizeof(X509_STORE_CTX));
+        if(ctx) memset(ctx, 0, sizeof(X509_STORE_CTX));
+        return ctx;
+}
+
+void X509_STORE_CTX_free(X509_STORE_CTX *ctx)
+{
+        X509_STORE_CTX_cleanup(ctx);
+        Free(ctx);
+}
+
 void X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
              STACK_OF(X509) *chain)
         {
@@ -389,6 +403,8 @@ void X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
         ctx->cert=x509;
         ctx->untrusted=chain;
         ctx->last_untrusted=0;
+        ctx->purpose=0;
+        ctx->trust=0;
         ctx->valid=0;
         ctx->chain=NULL;
         ctx->depth=9;
@@ -404,7 +420,7 @@ void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
                 sk_X509_pop_free(ctx->chain,X509_free);
                 ctx->chain=NULL;
                 }
-        CRYPTO_free_ex_data(x509_store_ctx_meth,(char *)ctx,&(ctx->ex_data));
+        CRYPTO_free_ex_data(x509_store_ctx_meth,ctx,&(ctx->ex_data));
         memset(&ctx->ex_data,0,sizeof(CRYPTO_EX_DATA));
         }
 
diff --git a/src/lib/libcrypto/x509/x509_r2x.c b/src/lib/libcrypto/x509/x509_r2x.c
index bb4697ae60..db051033d9 100644
--- a/src/lib/libcrypto/x509/x509_r2x.c
+++ b/src/lib/libcrypto/x509/x509_r2x.c
@@ -82,7 +82,7 @@ X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
 
         if (sk_X509_ATTRIBUTE_num(r->req_info->attributes) != 0)
                 {
-                if ((xi->version=ASN1_INTEGER_new()) == NULL) goto err;
+                if ((xi->version=M_ASN1_INTEGER_new()) == NULL) goto err;
                 if (!ASN1_INTEGER_set(xi->version,2)) goto err;
 /*              xi->extensions=ri->attributes; <- bad, should not ever be done
                 ri->attributes=NULL; */
diff --git a/src/lib/libcrypto/x509/x509_req.c b/src/lib/libcrypto/x509/x509_req.c
index 2ef94decd1..baef8790eb 100644
--- a/src/lib/libcrypto/x509/x509_req.c
+++ b/src/lib/libcrypto/x509/x509_req.c
@@ -66,7 +66,7 @@
 #include <openssl/buffer.h>
 #include <openssl/pem.h>
 
-X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md)
+X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
         {
         X509_REQ *ret;
         X509_REQ_INFO *ri;
@@ -113,3 +113,166 @@ EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
         return(X509_PUBKEY_get(req->req_info->pubkey));
         }
 
+/* It seems several organisations had the same idea of including a list of
+ * extensions in a certificate request. There are at least two OIDs that are
+ * used and there may be more: so the list is configurable.
+ */
+
+static int ext_nid_list[] = { NID_ms_ext_req, NID_ext_req, NID_undef};
+
+static int *ext_nids = ext_nid_list;
+
+int X509_REQ_extension_nid(int req_nid)
+{
+        int i, nid;
+        for(i = 0; ; i++) {
+                nid = ext_nids[i];
+                if(nid == NID_undef) return 0;
+                else if (req_nid == nid) return 1;
+        }
+}
+
+int *X509_REQ_get_extension_nids(void)
+{
+        return ext_nids;
+}
+        
+void X509_REQ_set_extension_nids(int *nids)
+{
+        ext_nids = nids;
+}
+
+STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *sk;
+        ASN1_TYPE *ext = NULL;
+        int i;
+        unsigned char *p;
+        if ((req == NULL) || (req->req_info == NULL))
+                return(NULL);
+        sk=req->req_info->attributes;
+        if (!sk) return NULL;
+        for(i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) {
+                attr = sk_X509_ATTRIBUTE_value(sk, i);
+                if(X509_REQ_extension_nid(OBJ_obj2nid(attr->object))) {
+                        if(attr->set && sk_ASN1_TYPE_num(attr->value.set))
+                                ext = sk_ASN1_TYPE_value(attr->value.set, 0);
+                        else ext = attr->value.single;
+                        break;
+                }
+        }
+        if(!ext || (ext->type != V_ASN1_SEQUENCE)) return NULL;
+        p = ext->value.sequence->data;
+        return d2i_ASN1_SET_OF_X509_EXTENSION(NULL, &p,
+                        ext->value.sequence->length,
+                        d2i_X509_EXTENSION, X509_EXTENSION_free,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+}
+
+/* Add a STACK_OF extensions to a certificate request: allow alternative OIDs
+ * in case we want to create a non standard one.
+ */
+
+int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
+                                int nid)
+{
+        unsigned char *p = NULL, *q;
+        long len;
+        ASN1_TYPE *at = NULL;
+        X509_ATTRIBUTE *attr = NULL;
+        if(!(at = ASN1_TYPE_new()) ||
+                !(at->value.sequence = ASN1_STRING_new())) goto err;
+
+        at->type = V_ASN1_SEQUENCE;
+        /* Generate encoding of extensions */
+        len = i2d_ASN1_SET_OF_X509_EXTENSION(exts, NULL, i2d_X509_EXTENSION,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        if(!(p = Malloc(len))) goto err;
+        q = p;
+        i2d_ASN1_SET_OF_X509_EXTENSION(exts, &q, i2d_X509_EXTENSION,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        at->value.sequence->data = p;
+        p = NULL;
+        at->value.sequence->length = len;
+        if(!(attr = X509_ATTRIBUTE_new())) goto err;
+        if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err;
+        if(!sk_ASN1_TYPE_push(attr->value.set, at)) goto err;
+        at = NULL;
+        attr->set = 1;
+        attr->object = OBJ_nid2obj(nid);
+        if(!sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr)) goto err;
+        return 1;
+        err:
+        if(p) Free(p);
+        X509_ATTRIBUTE_free(attr);
+        ASN1_TYPE_free(at);
+        return 0;
+}
+/* This is the normal usage: use the "official" OID */
+int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts)
+{
+        return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
+}
+
+/* Request attribute functions */
+
+int X509_REQ_get_attr_count(const X509_REQ *req)
+{
+        return X509at_get_attr_count(req->req_info->attributes);
+}
+
+int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
+                          int lastpos)
+{
+        return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
+}
+
+int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,
+                          int lastpos)
+{
+        return X509at_get_attr_by_OBJ(req->req_info->attributes, obj, lastpos);
+}
+
+X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
+{
+        return X509at_get_attr(req->req_info->attributes, loc);
+}
+
+X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)
+{
+        return X509at_delete_attr(req->req_info->attributes, loc);
+}
+
+int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
+{
+        if(X509at_add1_attr(&req->req_info->attributes, attr)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_OBJ(&req->req_info->attributes, obj,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_NID(X509_REQ *req,
+                        int nid, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_NID(&req->req_info->attributes, nid,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_txt(X509_REQ *req,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_txt(&req->req_info->attributes, attrname,
+                                type, bytes, len)) return 1;
+        return 0;
+}
diff --git a/src/lib/libcrypto/x509/x509_set.c b/src/lib/libcrypto/x509/x509_set.c
index 5a6f7b414f..add842d17a 100644
--- a/src/lib/libcrypto/x509/x509_set.c
+++ b/src/lib/libcrypto/x509/x509_set.c
@@ -68,7 +68,7 @@ int X509_set_version(X509 *x, long version)
         if (x == NULL) return(0);
         if (x->cert_info->version == NULL)
                 {
-                if ((x->cert_info->version=ASN1_INTEGER_new()) == NULL)
+                if ((x->cert_info->version=M_ASN1_INTEGER_new()) == NULL)
                         return(0);
                 }
         return(ASN1_INTEGER_set(x->cert_info->version,version));
@@ -82,10 +82,10 @@ int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial)
         in=x->cert_info->serialNumber;
         if (in != serial)
                 {
-                in=ASN1_INTEGER_dup(serial);
+                in=M_ASN1_INTEGER_dup(serial);
                 if (in != NULL)
                         {
-                        ASN1_INTEGER_free(x->cert_info->serialNumber);
+                        M_ASN1_INTEGER_free(x->cert_info->serialNumber);
                         x->cert_info->serialNumber=in;
                         }
                 }
@@ -112,10 +112,10 @@ int X509_set_notBefore(X509 *x, ASN1_UTCTIME *tm)
         in=x->cert_info->validity->notBefore;
         if (in != tm)
                 {
-                in=ASN1_UTCTIME_dup(tm);
+                in=M_ASN1_UTCTIME_dup(tm);
                 if (in != NULL)
                         {
-                        ASN1_UTCTIME_free(x->cert_info->validity->notBefore);
+                        M_ASN1_UTCTIME_free(x->cert_info->validity->notBefore);
                         x->cert_info->validity->notBefore=in;
                         }
                 }
@@ -130,10 +130,10 @@ int X509_set_notAfter(X509 *x, ASN1_UTCTIME *tm)
         in=x->cert_info->validity->notAfter;
         if (in != tm)
                 {
-                in=ASN1_UTCTIME_dup(tm);
+                in=M_ASN1_UTCTIME_dup(tm);
                 if (in != NULL)
                         {
-                        ASN1_UTCTIME_free(x->cert_info->validity->notAfter);
+                        M_ASN1_UTCTIME_free(x->cert_info->validity->notAfter);
                         x->cert_info->validity->notAfter=in;
                         }
                 }
diff --git a/src/lib/libcrypto/x509/x509_trs.c b/src/lib/libcrypto/x509/x509_trs.c
new file mode 100644
index 0000000000..9f7d67952d
--- /dev/null
+++ b/src/lib/libcrypto/x509/x509_trs.c
@@ -0,0 +1,263 @@
+/* x509_trs.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509v3.h>
+
+
+static int tr_cmp(X509_TRUST **a, X509_TRUST **b);
+static void trtable_free(X509_TRUST *p);
+
+static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
+static int trust_any(X509_TRUST *trust, X509 *x, int flags);
+
+static int obj_trust(int id, X509 *x, int flags);
+static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;
+
+/* WARNING: the following table should be kept in order of trust
+ * and without any gaps so we can just subtract the minimum trust
+ * value to get an index into the table
+ */
+
+static X509_TRUST trstandard[] = {
+{X509_TRUST_ANY, 0, trust_any, "Any", 0, NULL},
+{X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
+{X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Client", NID_server_auth, NULL},
+{X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
+};
+
+#define X509_TRUST_COUNT        (sizeof(trstandard)/sizeof(X509_TRUST))
+
+IMPLEMENT_STACK_OF(X509_TRUST)
+
+static STACK_OF(X509_TRUST) *trtable = NULL;
+
+static int tr_cmp(X509_TRUST **a, X509_TRUST **b)
+{
+        return (*a)->trust - (*b)->trust;
+}
+
+int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
+{
+int (*oldtrust)(int , X509 *, int);
+oldtrust = default_trust;
+default_trust = trust;
+return oldtrust;
+}
+
+
+int X509_check_trust(X509 *x, int id, int flags)
+{
+        X509_TRUST *pt;
+        int idx;
+        if(id == -1) return 1;
+        if(!(idx = X509_TRUST_get_by_id(id)))
+                        return default_trust(id, x, flags);
+        pt = X509_TRUST_get0(idx);
+        return pt->check_trust(pt, x, flags);
+}
+
+int X509_TRUST_get_count(void)
+{
+        if(!trtable) return X509_TRUST_COUNT;
+        return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
+}
+
+X509_TRUST * X509_TRUST_get0(int idx)
+{
+        if(idx < 0) return NULL;
+        if(idx < X509_TRUST_COUNT) return trstandard + idx;
+        return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
+}
+
+int X509_TRUST_get_by_id(int id)
+{
+        X509_TRUST tmp;
+        int idx;
+        if((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
+                                 return id - X509_TRUST_MIN;
+        tmp.trust = id;
+        if(!trtable) return -1;
+        idx = sk_X509_TRUST_find(trtable, &tmp);
+        if(idx == -1) return -1;
+        return idx + X509_TRUST_COUNT;
+}
+
+int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
+                                        char *name, int arg1, void *arg2)
+{
+        int idx;
+        X509_TRUST *trtmp;
+        /* This is set according to what we change: application can't set it */
+        flags &= ~X509_TRUST_DYNAMIC;
+        /* This will always be set for application modified trust entries */
+        flags |= X509_TRUST_DYNAMIC_NAME;
+        /* Get existing entry if any */
+        idx = X509_TRUST_get_by_id(id);
+        /* Need a new entry */
+        if(idx == -1) {
+                if(!(trtmp = Malloc(sizeof(X509_TRUST)))) {
+                        X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                trtmp->flags = X509_TRUST_DYNAMIC;
+        } else trtmp = X509_TRUST_get0(idx);
+
+        /* Free existing name if dynamic */
+        if(trtmp->flags & X509_TRUST_DYNAMIC_NAME) Free(trtmp->name);
+        /* dup supplied name */
+        if(!(trtmp->name = BUF_strdup(name))) {
+                X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        /* Keep the dynamic flag of existing entry */
+        trtmp->flags &= X509_TRUST_DYNAMIC;
+        /* Set all other flags */
+        trtmp->flags |= flags;
+
+        trtmp->trust = id;
+        trtmp->check_trust = ck;
+        trtmp->arg1 = arg1;
+        trtmp->arg2 = arg2;
+
+        /* If its a new entry manage the dynamic table */
+        if(idx == -1) {
+                if(!trtable && !(trtable = sk_X509_TRUST_new(tr_cmp))) {
+                        X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if (!sk_X509_TRUST_push(trtable, trtmp)) {
+                        X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+static void trtable_free(X509_TRUST *p)
+        {
+        if(!p) return;
+        if (p->flags & X509_TRUST_DYNAMIC) 
+                {
+                if (p->flags & X509_TRUST_DYNAMIC_NAME)
+                        Free(p->name);
+                Free(p);
+                }
+        }
+
+void X509_TRUST_cleanup(void)
+{
+        int i;
+        for(i = 0; i < X509_TRUST_COUNT; i++) trtable_free(trstandard + i);
+        sk_X509_TRUST_pop_free(trtable, trtable_free);
+        trtable = NULL;
+}
+
+int X509_TRUST_get_flags(X509_TRUST *xp)
+{
+        return xp->flags;
+}
+
+char *X509_TRUST_get0_name(X509_TRUST *xp)
+{
+        return xp->name;
+}
+
+int X509_TRUST_get_trust(X509_TRUST *xp)
+{
+        return xp->trust;
+}
+
+static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
+{
+        if(x->aux) return obj_trust(trust->arg1, x, flags);
+        /* we don't have any trust settings: for compatibility
+         * we return trusted if it is self signed
+         */
+        X509_check_purpose(x, -1, 0);
+        if(x->ex_flags & EXFLAG_SS) return X509_TRUST_TRUSTED;
+        else return X509_TRUST_UNTRUSTED;
+}
+
+static int obj_trust(int id, X509 *x, int flags)
+{
+        ASN1_OBJECT *obj;
+        int i;
+        X509_CERT_AUX *ax;
+        ax = x->aux;
+        if(!ax) return X509_TRUST_UNTRUSTED;
+        if(ax->reject) {
+                for(i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
+                        obj = sk_ASN1_OBJECT_value(ax->reject, i);
+                        if(OBJ_obj2nid(obj) == id) return X509_TRUST_REJECTED;
+                }
+        }       
+        if(ax->trust) {
+                for(i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
+                        obj = sk_ASN1_OBJECT_value(ax->trust, i);
+                        if(OBJ_obj2nid(obj) == id) return X509_TRUST_TRUSTED;
+                }
+        }
+        return X509_TRUST_UNTRUSTED;
+}
+
+static int trust_any(X509_TRUST *trust, X509 *x, int flags)
+{
+        return X509_TRUST_TRUSTED;
+}
diff --git a/src/lib/libcrypto/x509/x509_txt.c b/src/lib/libcrypto/x509/x509_txt.c
index 11a3d2012f..209cf53191 100644
--- a/src/lib/libcrypto/x509/x509_txt.c
+++ b/src/lib/libcrypto/x509/x509_txt.c
@@ -59,7 +59,6 @@
 #include <stdio.h>
 #include <time.h>
 #include <errno.h>
-#include <sys/types.h>
 
 #include "cryptlib.h"
 #include <openssl/lhash.h>
@@ -121,6 +120,16 @@ const char *X509_verify_cert_error_string(long n)
                 return("certificate chain too long");
         case X509_V_ERR_CERT_REVOKED:
                 return("certificate revoked");
+        case X509_V_ERR_INVALID_CA:
+                return ("invalid CA certificate");
+        case X509_V_ERR_PATH_LENGTH_EXCEEDED:
+                return ("path length constraint exceeded");
+        case X509_V_ERR_INVALID_PURPOSE:
+                return ("unsupported certificate purpose");
+        case X509_V_ERR_CERT_UNTRUSTED:
+                return ("certificate not trusted");
+        case X509_V_ERR_CERT_REJECTED:
+                return ("certificate rejected");
         case X509_V_ERR_APPLICATION_VERIFICATION:
                 return("application verification failure");
         default:
diff --git a/src/lib/libcrypto/x509/x509_v3.c b/src/lib/libcrypto/x509/x509_v3.c
index dd2f9f1b17..52887986fe 100644
--- a/src/lib/libcrypto/x509/x509_v3.c
+++ b/src/lib/libcrypto/x509/x509_v3.c
@@ -63,6 +63,7 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 int X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x)
         {
@@ -242,7 +243,7 @@ int X509_EXTENSION_set_data(X509_EXTENSION *ex, ASN1_OCTET_STRING *data)
         int i;
 
         if (ex == NULL) return(0);
-        i=ASN1_OCTET_STRING_set(ex->value,data->data,data->length);
+        i=M_ASN1_OCTET_STRING_set(ex->value,data->data,data->length);
         if (!i) return(0);
         return(1);
         }
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index c72ee4a385..4fdff54124 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -59,23 +59,24 @@
 #include <stdio.h>
 #include <time.h>
 #include <errno.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
-#include <openssl/crypto.h>
 #include "cryptlib.h"
+#include <openssl/crypto.h>
 #include <openssl/lhash.h>
 #include <openssl/buffer.h>
 #include <openssl/evp.h>
 #include <openssl/asn1.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 #include <openssl/objects.h>
 
 static int null_callback(int ok,X509_STORE_CTX *e);
+static int check_chain_purpose(X509_STORE_CTX *ctx);
+static int check_trust(X509_STORE_CTX *ctx);
 static int internal_verify(X509_STORE_CTX *ctx);
 const char *X509_version="X.509" OPENSSL_VERSION_PTEXT;
 
-static STACK *x509_store_ctx_method=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_store_ctx_method=NULL;
 static int x509_store_ctx_num=0;
 #if 0
 static int x509_store_num=1;
@@ -127,7 +128,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                 ctx->last_untrusted=1;
                 }
 
-        /* We use a temporary so we can chop and hack at it */
+        /* We use a temporary STACK so we can chop and hack at it */
         if (ctx->untrusted != NULL
             && (sktmp=sk_X509_dup(ctx->untrusted)) == NULL)
                 {
@@ -184,17 +185,37 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
 
         i=sk_X509_num(ctx->chain);
         x=sk_X509_value(ctx->chain,i-1);
-        if (X509_NAME_cmp(X509_get_subject_name(x),X509_get_issuer_name(x))
+        xn = X509_get_subject_name(x);
+        if (X509_NAME_cmp(xn,X509_get_issuer_name(x))
                 == 0)
                 {
                 /* we have a self signed certificate */
                 if (sk_X509_num(ctx->chain) == 1)
                         {
-                        ctx->error=X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
-                        ctx->current_cert=x;
-                        ctx->error_depth=i-1;
-                        ok=cb(0,ctx);
-                        if (!ok) goto end;
+                        /* We have a single self signed certificate: see if
+                         * we can find it in the store. We must have an exact
+                         * match to avoid possible impersonation.
+                         */
+                        ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
+                        if ((ok != X509_LU_X509) || X509_cmp(x, obj.data.x509)) 
+                                {
+                                ctx->error=X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
+                                ctx->current_cert=x;
+                                ctx->error_depth=i-1;
+                                if(ok == X509_LU_X509) X509_OBJECT_free_contents(&obj);
+                                ok=cb(0,ctx);
+                                if (!ok) goto end;
+                                }
+                        else 
+                                {
+                                /* We have a match: replace certificate with store version
+                                 * so we get any trust settings.
+                                 */
+                                X509_free(x);
+                                x = obj.data.x509;
+                                sk_X509_set(ctx->chain, i - 1, x);
+                                ctx->last_untrusted=0;
+                                }
                         }
                 else
                         {
@@ -272,6 +293,17 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                 if (!ok) goto end;
                 }
 
+        /* We have the chain complete: now we need to check its purpose */
+        if(ctx->purpose > 0) ok = check_chain_purpose(ctx);
+
+        if(!ok) goto end;
+
+        /* The chain extensions are OK: check trust */
+
+        if(ctx->trust > 0) ok = check_trust(ctx);
+
+        if(!ok) goto end;
+
         /* We may as well copy down any DSA parameters that are required */
         X509_get_pubkey_parameters(NULL,ctx->chain);
 
@@ -290,6 +322,71 @@ end:
         return(ok);
         }
 
+/* Check a certificate chains extensions for consistency
+ * with the supplied purpose
+ */
+
+static int check_chain_purpose(X509_STORE_CTX *ctx)
+{
+#ifdef NO_CHAIN_VERIFY
+        return 1;
+#else
+        int i, ok=0;
+        X509 *x;
+        int (*cb)();
+        cb=ctx->ctx->verify_cb;
+        if (cb == NULL) cb=null_callback;
+        /* Check all untrusted certificates */
+        for(i = 0; i < ctx->last_untrusted; i++) {
+                x = sk_X509_value(ctx->chain, i);
+                if(!X509_check_purpose(x, ctx->purpose, i)) {
+                        if(i) ctx->error = X509_V_ERR_INVALID_CA;
+                        else ctx->error = X509_V_ERR_INVALID_PURPOSE;
+                        ctx->error_depth = i;
+                        ctx->current_cert = x;
+                        ok=cb(0,ctx);
+                        if(!ok) goto end;
+                }
+                /* Check pathlen */
+                if((i > 1) && (x->ex_pathlen != -1)
+                                        && (i > (x->ex_pathlen + 1))) {
+                        ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
+                        ctx->error_depth = i;
+                        ctx->current_cert = x;
+                        ok=cb(0,ctx);
+                        if(!ok) goto end;
+                }
+        }
+        ok = 1;
+        end:
+        return(ok);
+#endif
+}
+
+static int check_trust(X509_STORE_CTX *ctx)
+{
+#ifdef NO_CHAIN_VERIFY
+        return 1;
+#else
+        int i, ok;
+        X509 *x;
+        int (*cb)();
+        cb=ctx->ctx->verify_cb;
+        if (cb == NULL) cb=null_callback;
+/* For now just check the last certificate in the chain */
+        i = sk_X509_num(ctx->chain) - 1;
+        x = sk_X509_value(ctx->chain, i);
+        ok = X509_check_trust(x, ctx->trust, 0);
+        if(ok == X509_TRUST_TRUSTED) return 1;
+        ctx->error_depth = sk_X509_num(ctx->chain) - 1;
+        ctx->current_cert = x;
+        if(ok == X509_TRUST_REJECTED) ctx->error = X509_V_ERR_CERT_REJECTED;
+        else ctx->error = X509_V_ERR_CERT_UNTRUSTED;
+        ok = cb(0, ctx);
+        return(ok);
+#endif
+}
+
 static int internal_verify(X509_STORE_CTX *ctx)
         {
         int i,ok=0,n;
@@ -439,7 +536,7 @@ int X509_cmp_current_time(ASN1_UTCTIME *ctm)
         atm.length=sizeof(buff2);
         atm.data=(unsigned char *)buff2;
 
-        X509_gmtime_adj(&atm,-offset);
+        X509_gmtime_adj(&atm,-offset*60);
 
         i=(buff1[0]-'0')*10+(buff1[1]-'0');
         if (i < 50) i+=100; /* cf. RFC 2459 */
@@ -525,13 +622,13 @@ int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
 
         X509_OBJECT_up_ref_count(obj);
 
-        r=(X509_OBJECT *)lh_insert(ctx->certs,(char *)obj);
+        r=(X509_OBJECT *)lh_insert(ctx->certs,obj);
         if (r != NULL)
                 { /* oops, put it back */
-                lh_delete(ctx->certs,(char *)obj);
+                lh_delete(ctx->certs,obj);
                 X509_OBJECT_free_contents(obj);
                 Free(obj);
-                lh_insert(ctx->certs,(char *)r);
+                lh_insert(ctx->certs,r);
                 X509err(X509_F_X509_STORE_ADD_CERT,X509_R_CERT_ALREADY_IN_HASH_TABLE);
                 ret=0;
                 }
@@ -560,13 +657,13 @@ int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
 
         X509_OBJECT_up_ref_count(obj);
 
-        r=(X509_OBJECT *)lh_insert(ctx->certs,(char *)obj);
+        r=(X509_OBJECT *)lh_insert(ctx->certs,obj);
         if (r != NULL)
                 { /* oops, put it back */
-                lh_delete(ctx->certs,(char *)obj);
+                lh_delete(ctx->certs,obj);
                 X509_OBJECT_free_contents(obj);
                 Free(obj);
-                lh_insert(ctx->certs,(char *)r);
+                lh_insert(ctx->certs,r);
                 X509err(X509_F_X509_STORE_ADD_CRL,X509_R_CERT_ALREADY_IN_HASH_TABLE);
                 ret=0;
                 }
@@ -576,8 +673,8 @@ int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
         return(ret);    
         }
 
-int X509_STORE_CTX_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-             int (*dup_func)(), void (*free_func)())
+int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         x509_store_ctx_num++;
         return(CRYPTO_get_ex_new_index(x509_store_ctx_num-1,
@@ -620,6 +717,19 @@ STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx)
         return(ctx->chain);
         }
 
+STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx)
+        {
+        int i;
+        X509 *x;
+        STACK_OF(X509) *chain;
+        if(!ctx->chain || !(chain = sk_X509_dup(ctx->chain))) return NULL;
+        for(i = 0; i < sk_X509_num(chain); i++) {
+                x = sk_X509_value(chain, i);
+                CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
+        }
+        return(chain);
+        }
+
 void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x)
         {
         ctx->cert=x;
@@ -630,6 +740,62 @@ void X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
         ctx->untrusted=sk;
         }
 
+int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose)
+        {
+        return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0);
+        }
+
+int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust)
+        {
+        return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust);
+        }
+
+/* This function is used to set the X509_STORE_CTX purpose and trust
+ * values. This is intended to be used when another structure has its
+ * own trust and purpose values which (if set) will be inherited by
+ * the ctx. If they aren't set then we will usually have a default
+ * purpose in mind which should then be used to set the trust value.
+ * An example of this is SSL use: an SSL structure will have its own
+ * purpose and trust settings which the application can set: if they
+ * aren't set then we use the default of SSL client/server.
+ */
+
+int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
+                                int purpose, int trust)
+{
+        int idx;
+        /* If purpose not set use default */
+        if(!purpose) purpose = def_purpose;
+        /* If we have a purpose then check it is valid */
+        if(purpose) {
+                idx = X509_PURPOSE_get_by_id(purpose);
+                if(idx == -1) {
+                        X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
+                                                X509_R_UNKNOWN_PURPOSE_ID);
+                        return 0;
+                }
+                /* If trust not set then get from purpose default */
+                if(!trust) {
+                        X509_PURPOSE *ptmp;
+                        ptmp = X509_PURPOSE_get0(idx);
+                        trust = ptmp->trust;
+                }
+        }
+        if(trust) {
+                idx = X509_TRUST_get_by_id(trust);
+                if(idx == -1) {
+                        X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
+                                                X509_R_UNKNOWN_TRUST_ID);
+                        return 0;
+                }
+        }
+
+        if(purpose) ctx->purpose = purpose;
+        if(trust) ctx->trust = trust;
+        return 1;
+}
+
+
 IMPLEMENT_STACK_OF(X509)
 IMPLEMENT_ASN1_SET_OF(X509)
 
diff --git a/src/lib/libcrypto/x509/x509_vfy.h b/src/lib/libcrypto/x509/x509_vfy.h
index ecfd4cf9ed..4637aecedf 100644
--- a/src/lib/libcrypto/x509/x509_vfy.h
+++ b/src/lib/libcrypto/x509/x509_vfy.h
@@ -202,6 +202,8 @@ struct x509_store_state_st      /* X509_STORE_CTX */
         /* The following are set by the caller */
         X509 *cert;             /* The cert to check */
         STACK_OF(X509) *untrusted;      /* chain of X509s - untrusted - passed in */
+        int purpose;            /* purpose to check untrusted certificates */
+        int trust;              /* trust setting to check */
 
         /* The following is built up */
         int depth;              /* how far to go looking up certs */
@@ -234,6 +236,7 @@ struct x509_store_state_st      /* X509_STORE_CTX */
                 X509_LOOKUP_ctrl((x),X509_L_ADD_DIR,(name),(long)(type),NULL)
 
 #define         X509_V_OK                                       0
+/* illegal error (for uninitialized values, to avoid X509_V_OK): 1 */
 
 #define         X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT            2
 #define         X509_V_ERR_UNABLE_TO_GET_CRL                    3
@@ -257,6 +260,11 @@ struct x509_store_state_st      /* X509_STORE_CTX */
 #define         X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE      21
 #define         X509_V_ERR_CERT_CHAIN_TOO_LONG                  22
 #define         X509_V_ERR_CERT_REVOKED                         23
+#define         X509_V_ERR_INVALID_CA                           24
+#define         X509_V_ERR_PATH_LENGTH_EXCEEDED                 25
+#define         X509_V_ERR_INVALID_PURPOSE                      26
+#define         X509_V_ERR_CERT_UNTRUSTED                       27
+#define         X509_V_ERR_CERT_REJECTED                        28
 
 /* The application is not happy */
 #define         X509_V_ERR_APPLICATION_VERIFICATION             50
@@ -284,6 +292,8 @@ void X509_OBJECT_free_contents(X509_OBJECT *a);
 X509_STORE *X509_STORE_new(void );
 void X509_STORE_free(X509_STORE *v);
 
+X509_STORE_CTX *X509_STORE_CTX_new(void);
+void X509_STORE_CTX_free(X509_STORE_CTX *ctx);
 void X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store,
                          X509 *x509, STACK_OF(X509) *chain);
 void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
@@ -305,6 +315,7 @@ int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
 #ifndef NO_STDIO
 int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type);
 int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type);
+int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type);
 #endif
 
 
@@ -327,8 +338,8 @@ int	X509_STORE_load_locations (X509_STORE *ctx,
 int     X509_STORE_set_default_paths(X509_STORE *ctx);
 #endif
 
-int X509_STORE_CTX_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 int     X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx,int idx,void *data);
 void *  X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx,int idx);
 int     X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
@@ -336,8 +347,13 @@ void	X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s);
 int     X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
 X509 *  X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
 STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);
+STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
 void    X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x);
 void    X509_STORE_CTX_set_chain(X509_STORE_CTX *c,STACK_OF(X509) *sk);
+int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose);
+int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);
+int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
+                                int purpose, int trust);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libcrypto/x509/x509name.c b/src/lib/libcrypto/x509/x509name.c
index 2a422be350..cf2382d42c 100644
--- a/src/lib/libcrypto/x509/x509name.c
+++ b/src/lib/libcrypto/x509/x509name.c
@@ -171,6 +171,42 @@ X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc)
         return(ret);
         }
 
+int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len, int loc, int set)
+{
+        X509_NAME_ENTRY *ne;
+        int ret;
+        ne = X509_NAME_ENTRY_create_by_OBJ(NULL, obj, type, bytes, len);
+        if(!ne) return 0;
+        ret = X509_NAME_add_entry(name, ne, loc, set);
+        X509_NAME_ENTRY_free(ne);
+        return ret;
+}
+
+int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
+                        unsigned char *bytes, int len, int loc, int set)
+{
+        X509_NAME_ENTRY *ne;
+        int ret;
+        ne = X509_NAME_ENTRY_create_by_NID(NULL, nid, type, bytes, len);
+        if(!ne) return 0;
+        ret = X509_NAME_add_entry(name, ne, loc, set);
+        X509_NAME_ENTRY_free(ne);
+        return ret;
+}
+
+int X509_NAME_add_entry_by_txt(X509_NAME *name, char *field, int type,
+                        unsigned char *bytes, int len, int loc, int set)
+{
+        X509_NAME_ENTRY *ne;
+        int ret;
+        ne = X509_NAME_ENTRY_create_by_txt(NULL, field, type, bytes, len);
+        if(!ne) return 0;
+        ret = X509_NAME_add_entry(name, ne, loc, set);
+        X509_NAME_ENTRY_free(ne);
+        return ret;
+}
+
 /* if set is -1, append to previous set, 0 'a new one', and 1,
  * prepend to the guy we are about to stomp on. */
 int X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, int loc,
@@ -236,10 +272,30 @@ err:
         return(0);
         }
 
+X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
+                char *field, int type, unsigned char *bytes, int len)
+        {
+        ASN1_OBJECT *obj;
+        X509_NAME_ENTRY *nentry;
+
+        obj=OBJ_txt2obj(field, 0);
+        if (obj == NULL)
+                {
+                X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_TXT,
+                                                X509_R_INVALID_FIELD_NAME);
+                ERR_add_error_data(2, "name=", field);
+                return(NULL);
+                }
+        nentry = X509_NAME_ENTRY_create_by_OBJ(ne,obj,type,bytes,len);
+        ASN1_OBJECT_free(obj);
+        return nentry;
+        }
+
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
              int type, unsigned char *bytes, int len)
         {
         ASN1_OBJECT *obj;
+        X509_NAME_ENTRY *nentry;
 
         obj=OBJ_nid2obj(nid);
         if (obj == NULL)
@@ -247,7 +303,9 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
                 X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_NID,X509_R_UNKNOWN_NID);
                 return(NULL);
                 }
-        return(X509_NAME_ENTRY_create_by_OBJ(ne,obj,type,bytes,len));
+        nentry = X509_NAME_ENTRY_create_by_OBJ(ne,obj,type,bytes,len);
+        ASN1_OBJECT_free(obj);
+        return nentry;
         }
 
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
@@ -267,7 +325,7 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
                 goto err;
         if (!X509_NAME_ENTRY_set_data(ret,type,bytes,len))
                 goto err;
-        
+
         if ((ne != NULL) && (*ne == NULL)) *ne=ret;
         return(ret);
 err:
@@ -294,6 +352,10 @@ int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
         int i;
 
         if ((ne == NULL) || ((bytes == NULL) && (len != 0))) return(0);
+        if(type & MBSTRING_FLAG) 
+                return ASN1_STRING_set_by_NID(&ne->value, bytes,
+                                                len, type,
+                                        OBJ_obj2nid(ne->object)) ? 1 : 0;
         if (len < 0) len=strlen((char *)bytes);
         i=ASN1_STRING_set(ne->value,bytes,len);
         if (!i) return(0);
diff --git a/src/lib/libcrypto/x509/x509spki.c b/src/lib/libcrypto/x509/x509spki.c
new file mode 100644
index 0000000000..b35c3f92e7
--- /dev/null
+++ b/src/lib/libcrypto/x509/x509spki.c
@@ -0,0 +1,121 @@
+/* x509spki.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/asn1_mac.h>
+
+int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey)
+{
+        if ((x == NULL) || (x->spkac == NULL)) return(0);
+        return(X509_PUBKEY_set(&(x->spkac->pubkey),pkey));
+}
+
+EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x)
+{
+        if ((x == NULL) || (x->spkac == NULL))
+                return(NULL);
+        return(X509_PUBKEY_get(x->spkac->pubkey));
+}
+
+/* Load a Netscape SPKI from a base64 encoded string */
+
+NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(const char *str, int len)
+{
+        unsigned char *spki_der, *p;
+        int spki_len;
+        NETSCAPE_SPKI *spki;
+        if(len <= 0) len = strlen(str);
+        if (!(spki_der = Malloc(len + 1))) {
+                X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+        spki_len = EVP_DecodeBlock(spki_der, (const unsigned char *)str, len);
+        if(spki_len < 0) {
+                X509err(X509_F_NETSCAPE_SPKI_B64_DECODE,
+                                                X509_R_BASE64_DECODE_ERROR);
+                Free(spki_der);
+                return NULL;
+        }
+        p = spki_der;
+        spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
+        Free(spki_der);
+        return spki;
+}
+
+/* Generate a base64 encoded string from an SPKI */
+
+char * NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *spki)
+{
+        unsigned char *der_spki, *p;
+        char *b64_str;
+        int der_len;
+        der_len = i2d_NETSCAPE_SPKI(spki, NULL);
+        der_spki = Malloc(der_len);
+        b64_str = Malloc(der_len * 2);
+        if(!der_spki || !b64_str) {
+                X509err(X509_F_NETSCAPE_SPKI_B64_ENCODE, ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+        p = der_spki;
+        i2d_NETSCAPE_SPKI(spki, &p);
+        EVP_EncodeBlock((unsigned char *)b64_str, der_spki, der_len);
+        Free(der_spki);
+        return b64_str;
+}
diff --git a/src/lib/libcrypto/x509/x_all.c b/src/lib/libcrypto/x509/x_all.c
index f2af895df0..d2bf3c8e1c 100644
--- a/src/lib/libcrypto/x509/x_all.c
+++ b/src/lib/libcrypto/x509/x_all.c
@@ -285,10 +285,22 @@ RSA *d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa)
                 (unsigned char **)(rsa)));
         }
 
+RSA *d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa)
+        {
+        return((RSA *)ASN1_d2i_fp((char *(*)())
+                RSA_new,(char *(*)())d2i_RSA_PUBKEY, (fp),
+                (unsigned char **)(rsa)));
+        }
+
 int i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa)
         {
         return(ASN1_i2d_fp(i2d_RSAPublicKey,fp,(unsigned char *)rsa));
         }
+
+int i2d_RSA_PUBKEY_fp(FILE *fp, RSA *rsa)
+        {
+        return(ASN1_i2d_fp(i2d_RSA_PUBKEY,fp,(unsigned char *)rsa));
+        }
 #endif
 
 RSA *d2i_RSAPrivateKey_bio(BIO *bp, RSA **rsa)
@@ -310,10 +322,22 @@ RSA *d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa)
                 (unsigned char **)(rsa)));
         }
 
+RSA *d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa)
+        {
+        return((RSA *)ASN1_d2i_bio((char *(*)())
+                RSA_new,(char *(*)())d2i_RSA_PUBKEY, (bp),
+                (unsigned char **)(rsa)));
+        }
+
 int i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa)
         {
         return(ASN1_i2d_bio(i2d_RSAPublicKey,bp,(unsigned char *)rsa));
         }
+
+int i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa)
+        {
+        return(ASN1_i2d_bio(i2d_RSA_PUBKEY,bp,(unsigned char *)rsa));
+        }
 #endif
 
 #ifndef NO_DSA
@@ -329,6 +353,18 @@ int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa)
         {
         return(ASN1_i2d_fp(i2d_DSAPrivateKey,fp,(unsigned char *)dsa));
         }
+
+DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa)
+        {
+        return((DSA *)ASN1_d2i_fp((char *(*)())
+                DSA_new,(char *(*)())d2i_DSA_PUBKEY, (fp),
+                (unsigned char **)(dsa)));
+        }
+
+int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa)
+        {
+        return(ASN1_i2d_fp(i2d_DSA_PUBKEY,fp,(unsigned char *)dsa));
+        }
 #endif
 
 DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa)
@@ -342,6 +378,19 @@ int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa)
         {
         return(ASN1_i2d_bio(i2d_DSAPrivateKey,bp,(unsigned char *)dsa));
         }
+
+DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa)
+        {
+        return((DSA *)ASN1_d2i_bio((char *(*)())
+                DSA_new,(char *(*)())d2i_DSA_PUBKEY, (bp),
+                (unsigned char **)(dsa)));
+        }
+
+int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa)
+        {
+        return(ASN1_i2d_bio(i2d_DSA_PUBKEY,bp,(unsigned char *)dsa));
+        }
+
 #endif
 
 X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn)
@@ -362,19 +411,19 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne)
                 (char *(*)())d2i_X509_NAME_ENTRY,(char *)ne));
         }
 
-int X509_digest(X509 *data, EVP_MD *type, unsigned char *md,
+int X509_digest(X509 *data, const EVP_MD *type, unsigned char *md,
              unsigned int *len)
         {
         return(ASN1_digest((int (*)())i2d_X509,type,(char *)data,md,len));
         }
 
-int X509_NAME_digest(X509_NAME *data, EVP_MD *type, unsigned char *md,
+int X509_NAME_digest(X509_NAME *data, const EVP_MD *type, unsigned char *md,
              unsigned int *len)
         {
         return(ASN1_digest((int (*)())i2d_X509_NAME,type,(char *)data,md,len));
         }
 
-int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, EVP_MD *type,
+int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, const EVP_MD *type,
              unsigned char *md, unsigned int *len)
         {
         return(ASN1_digest((int (*)())i2d_PKCS7_ISSUER_AND_SERIAL,type,
@@ -420,6 +469,29 @@ int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, PKCS8_PRIV_KEY_INFO *p8inf)
         {
         return(ASN1_i2d_fp(i2d_PKCS8_PRIV_KEY_INFO,fp,(unsigned char *)p8inf));
         }
+
+int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key)
+        {
+        PKCS8_PRIV_KEY_INFO *p8inf;
+        int ret;
+        p8inf = EVP_PKEY2PKCS8(key);
+        if(!p8inf) return 0;
+        ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf);
+        PKCS8_PRIV_KEY_INFO_free(p8inf);
+        return ret;
+        }
+
+int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey)
+        {
+        return(ASN1_i2d_fp(i2d_PrivateKey,fp,(unsigned char *)pkey));
+        }
+
+EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a)
+{
+        return((EVP_PKEY *)ASN1_d2i_fp((char *(*)())EVP_PKEY_new,
+                (char *(*)())d2i_AutoPrivateKey, (fp),(unsigned char **)(a)));
+}
+
 #endif
 
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
@@ -435,3 +507,25 @@ int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, PKCS8_PRIV_KEY_INFO *p8inf)
         {
         return(ASN1_i2d_bio(i2d_PKCS8_PRIV_KEY_INFO,bp,(unsigned char *)p8inf));
         }
+
+int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key)
+        {
+        PKCS8_PRIV_KEY_INFO *p8inf;
+        int ret;
+        p8inf = EVP_PKEY2PKCS8(key);
+        if(!p8inf) return 0;
+        ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
+        PKCS8_PRIV_KEY_INFO_free(p8inf);
+        return ret;
+        }
+
+int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey)
+        {
+        return(ASN1_i2d_bio(i2d_PrivateKey,bp,(unsigned char *)pkey));
+        }
+
+EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a)
+        {
+        return((EVP_PKEY *)ASN1_d2i_bio((char *(*)())EVP_PKEY_new,
+                (char *(*)())d2i_AutoPrivateKey, (bp),(unsigned char **)(a)));
+        }
diff --git a/src/lib/libcrypto/x509v3/Makefile.ssl b/src/lib/libcrypto/x509v3/Makefile.ssl
index 72871edbc1..1bb746d52d 100644
--- a/src/lib/libcrypto/x509v3/Makefile.ssl
+++ b/src/lib/libcrypto/x509v3/Makefile.ssl
@@ -24,10 +24,10 @@ APPS=
 LIB=$(TOP)/libcrypto.a
 LIBSRC= v3_bcons.c v3_bitst.c v3_conf.c v3_extku.c v3_ia5.c \
 v3_lib.c v3_prn.c v3_utl.c v3err.c v3_genn.c v3_alt.c v3_skey.c v3_akey.c \
-v3_pku.c v3_int.c v3_enum.c v3_sxnet.c v3_cpols.c v3_crld.c
+v3_pku.c v3_int.c v3_enum.c v3_sxnet.c v3_cpols.c v3_crld.c v3_purp.c v3_info.c
 LIBOBJ= v3_bcons.o v3_bitst.o v3_conf.o v3_extku.o v3_ia5.o v3_lib.o \
 v3_prn.o v3_utl.o v3err.o v3_genn.o v3_alt.o v3_skey.o v3_akey.o v3_pku.o \
-v3_int.o v3_enum.o v3_sxnet.o v3_cpols.o v3_crld.o
+v3_int.o v3_enum.o v3_sxnet.o v3_cpols.o v3_crld.o v3_purp.o v3_info.o
 
 SRC= $(LIBSRC)
 
@@ -285,6 +285,25 @@ v3_ia5.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 v3_ia5.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 v3_ia5.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 v3_ia5.o: ../../include/openssl/x509v3.h ../cryptlib.h
+v3_info.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+v3_info.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+v3_info.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+v3_info.o: ../../include/openssl/cast.h ../../include/openssl/conf.h
+v3_info.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+v3_info.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+v3_info.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+v3_info.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+v3_info.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+v3_info.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+v3_info.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+v3_info.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+v3_info.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+v3_info.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+v3_info.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+v3_info.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+v3_info.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+v3_info.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+v3_info.o: ../cryptlib.h
 v3_int.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 v3_int.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 v3_int.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -320,7 +339,7 @@ v3_lib.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 v3_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 v3_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 v3_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-v3_lib.o: ../../include/openssl/x509v3.h ../cryptlib.h
+v3_lib.o: ../../include/openssl/x509v3.h ../cryptlib.h ext_dat.h
 v3_pku.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 v3_pku.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 v3_pku.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
@@ -358,6 +377,24 @@ v3_prn.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 v3_prn.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 v3_prn.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 v3_prn.o: ../../include/openssl/x509v3.h ../cryptlib.h
+v3_purp.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+v3_purp.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+v3_purp.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+v3_purp.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+v3_purp.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+v3_purp.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+v3_purp.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+v3_purp.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+v3_purp.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+v3_purp.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+v3_purp.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+v3_purp.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+v3_purp.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+v3_purp.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+v3_purp.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+v3_purp.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+v3_purp.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+v3_purp.o: ../../include/openssl/x509v3.h ../cryptlib.h
 v3_skey.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 v3_skey.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 v3_skey.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
diff --git a/src/lib/libcrypto/x509v3/README b/src/lib/libcrypto/x509v3/README
index 3b2cc047be..e69de29bb2 100644
--- a/src/lib/libcrypto/x509v3/README
+++ b/src/lib/libcrypto/x509v3/README
@@ -1,4 +0,0 @@
-WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
-
-This is ***VERY*** new experimental code and is likely to change
-considerably or vanish altogether.
diff --git a/src/lib/libcrypto/x509v3/ext_dat.h b/src/lib/libcrypto/x509v3/ext_dat.h
new file mode 100644
index 0000000000..801a585a52
--- /dev/null
+++ b/src/lib/libcrypto/x509v3/ext_dat.h
@@ -0,0 +1,97 @@
+/* ext_dat.h */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* This file contains a table of "standard" extensions */
+
+extern X509V3_EXT_METHOD v3_bcons, v3_nscert, v3_key_usage, v3_ext_ku;
+extern X509V3_EXT_METHOD v3_pkey_usage_period, v3_sxnet, v3_info;
+extern X509V3_EXT_METHOD v3_ns_ia5_list[], v3_alt[], v3_skey_id, v3_akey_id;
+extern X509V3_EXT_METHOD v3_crl_num, v3_crl_reason, v3_cpols, v3_crld;
+
+/* This table will be searched using OBJ_bsearch so it *must* kept in
+ * order of the ext_nid values.
+ */
+
+static X509V3_EXT_METHOD *standard_exts[] = {
+&v3_nscert,
+&v3_ns_ia5_list[0],
+&v3_ns_ia5_list[1],
+&v3_ns_ia5_list[2],
+&v3_ns_ia5_list[3],
+&v3_ns_ia5_list[4],
+&v3_ns_ia5_list[5],
+&v3_ns_ia5_list[6],
+&v3_skey_id,
+&v3_key_usage,
+&v3_pkey_usage_period,
+&v3_alt[0],
+&v3_alt[1],
+&v3_bcons,
+&v3_crl_num,
+&v3_cpols,
+&v3_akey_id,
+&v3_crld,
+&v3_ext_ku,
+&v3_crl_reason,
+&v3_sxnet,
+&v3_info,
+};
+
+/* Number of standard extensions */
+
+#define STANDARD_EXTENSION_COUNT (sizeof(standard_exts)/sizeof(X509V3_EXT_METHOD *))
+
diff --git a/src/lib/libcrypto/x509v3/tabtest.c b/src/lib/libcrypto/x509v3/tabtest.c
new file mode 100644
index 0000000000..dad0d38dd5
--- /dev/null
+++ b/src/lib/libcrypto/x509v3/tabtest.c
@@ -0,0 +1,88 @@
+/* tabtest.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* Simple program to check the ext_dat.h is correct and print out
+ * problems if it is not.
+ */
+
+#include <stdio.h>
+
+#include <openssl/x509v3.h>
+
+#include "ext_dat.h"
+
+main()
+{
+        int i, prev = -1, bad = 0;
+        X509V3_EXT_METHOD **tmp;
+        i = sizeof(standard_exts) / sizeof(X509V3_EXT_METHOD *);
+        if(i != STANDARD_EXTENSION_COUNT)
+                fprintf(stderr, "Extension number invalid expecting %d\n", i);
+        tmp = standard_exts;
+        for(i = 0; i < STANDARD_EXTENSION_COUNT; i++, tmp++) {
+                if((*tmp)->ext_nid < prev) bad = 1;
+                prev = (*tmp)->ext_nid;
+                
+        }
+        if(bad) {
+                tmp = standard_exts;
+                fprintf(stderr, "Extensions out of order!\n");
+                for(i = 0; i < STANDARD_EXTENSION_COUNT; i++, tmp++)
+                printf("%d : %s\n", (*tmp)->ext_nid, OBJ_nid2sn((*tmp)->ext_nid));
+        } else fprintf(stderr, "Order OK\n");
+}
diff --git a/src/lib/libcrypto/x509v3/v3_akey.c b/src/lib/libcrypto/x509v3/v3_akey.c
index 4099e6019e..96c04fe4f5 100644
--- a/src/lib/libcrypto/x509v3/v3_akey.c
+++ b/src/lib/libcrypto/x509v3/v3_akey.c
@@ -129,10 +129,10 @@ AUTHORITY_KEYID *d2i_AUTHORITY_KEYID(AUTHORITY_KEYID **a, unsigned char **pp,
 void AUTHORITY_KEYID_free(AUTHORITY_KEYID *a)
 {
         if (a == NULL) return;
-        ASN1_OCTET_STRING_free(a->keyid);
+        M_ASN1_OCTET_STRING_free(a->keyid);
         sk_GENERAL_NAME_pop_free(a->issuer, GENERAL_NAME_free);
-        ASN1_INTEGER_free (a->serial);
-        Free ((char *)a);
+        M_ASN1_INTEGER_free (a->serial);
+        Free (a);
 }
 
 static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
@@ -214,7 +214,7 @@ if(keyid) {
 
 if((issuer && !ikeyid) || (issuer == 2)) {
         isname = X509_NAME_dup(X509_get_issuer_name(cert));
-        serial = ASN1_INTEGER_dup(X509_get_serialNumber(cert));
+        serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(cert));
         if(!isname || !serial) {
                 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS);
                 goto err;
@@ -241,8 +241,8 @@ return akeyid;
 
 err:
 X509_NAME_free(isname);
-ASN1_INTEGER_free(serial);
-ASN1_OCTET_STRING_free(ikeyid);
+M_ASN1_INTEGER_free(serial);
+M_ASN1_OCTET_STRING_free(ikeyid);
 return NULL;
 
 }
diff --git a/src/lib/libcrypto/x509v3/v3_alt.c b/src/lib/libcrypto/x509v3/v3_alt.c
index b5e1f8af96..5ccd1e0e3d 100644
--- a/src/lib/libcrypto/x509v3/v3_alt.c
+++ b/src/lib/libcrypto/x509v3/v3_alt.c
@@ -84,7 +84,6 @@ NULL, NULL,
 (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
 (X509V3_EXT_V2I)v2i_issuer_alt,
 NULL, NULL, NULL},
-EXT_END
 };
 
 STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method,
@@ -273,7 +272,7 @@ static int copy_email(X509V3_CTX *ctx, STACK_OF(GENERAL_NAME) *gens)
         while((i = X509_NAME_get_index_by_NID(nm,
                                          NID_pkcs9_emailAddress, i)) > 0) {
                 ne = X509_NAME_get_entry(nm, i);
-                email = ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
+                email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
                 if(!email || !(gen = GENERAL_NAME_new())) {
                         X509V3err(X509V3_F_COPY_EMAIL,ERR_R_MALLOC_FAILURE);
                         goto err;
@@ -293,7 +292,7 @@ static int copy_email(X509V3_CTX *ctx, STACK_OF(GENERAL_NAME) *gens)
                 
         err:
         GENERAL_NAME_free(gen);
-        ASN1_IA5STRING_free(email);
+        M_ASN1_IA5STRING_free(email);
         return 0;
         
 }
@@ -371,7 +370,7 @@ if(!name_cmp(name, "email")) {
                 goto err;
         }
         ip[0] = i1; ip[1] = i2 ; ip[2] = i3 ; ip[3] = i4;
-        if(!(gen->d.ip = ASN1_OCTET_STRING_new()) ||
+        if(!(gen->d.ip = M_ASN1_OCTET_STRING_new()) ||
                 !ASN1_STRING_set(gen->d.ip, ip, 4)) {
                         X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
                         goto err;
@@ -384,7 +383,7 @@ if(!name_cmp(name, "email")) {
 }
 
 if(is_string) {
-        if(!(gen->d.ia5 = ASN1_IA5STRING_new()) ||
+        if(!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
                       !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value,
                                        strlen(value))) {
                 X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libcrypto/x509v3/v3_bcons.c b/src/lib/libcrypto/x509v3/v3_bcons.c
index de2f855c35..1e3edc205f 100644
--- a/src/lib/libcrypto/x509v3/v3_bcons.c
+++ b/src/lib/libcrypto/x509v3/v3_bcons.c
@@ -122,8 +122,8 @@ BASIC_CONSTRAINTS *d2i_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS **a,
 void BASIC_CONSTRAINTS_free(BASIC_CONSTRAINTS *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free (a->pathlen);
-        Free ((char *)a);
+        M_ASN1_INTEGER_free (a->pathlen);
+        Free (a);
 }
 
 static STACK_OF(CONF_VALUE) *i2v_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method,
diff --git a/src/lib/libcrypto/x509v3/v3_bitst.c b/src/lib/libcrypto/x509v3/v3_bitst.c
index 9828ba15b3..0e1167d05c 100644
--- a/src/lib/libcrypto/x509v3/v3_bitst.c
+++ b/src/lib/libcrypto/x509v3/v3_bitst.c
@@ -61,7 +61,6 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
-static ASN1_BIT_STRING *asn1_bit_string_new(void);
 static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
 static STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
@@ -97,11 +96,6 @@ static BIT_STRING_BITNAME key_usage_type_table[] = {
 X509V3_EXT_METHOD v3_nscert = EXT_BITSTRING(NID_netscape_cert_type, ns_cert_type_table);
 X509V3_EXT_METHOD v3_key_usage = EXT_BITSTRING(NID_key_usage, key_usage_type_table);
 
-static ASN1_BIT_STRING *asn1_bit_string_new(void)
-{
-        return ASN1_BIT_STRING_new();
-}
-
 static STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
              ASN1_BIT_STRING *bits, STACK_OF(CONF_VALUE) *ret)
 {
@@ -120,7 +114,7 @@ static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
         ASN1_BIT_STRING *bs;
         int i;
         BIT_STRING_BITNAME *bnam;
-        if(!(bs = ASN1_BIT_STRING_new())) {
+        if(!(bs = M_ASN1_BIT_STRING_new())) {
                 X509V3err(X509V3_F_V2I_ASN1_BIT_STRING,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -137,7 +131,7 @@ static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
                         X509V3err(X509V3_F_V2I_ASN1_BIT_STRING,
                                         X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT);
                         X509V3_conf_err(val);
-                        ASN1_BIT_STRING_free(bs);
+                        M_ASN1_BIT_STRING_free(bs);
                         return NULL;
                 }
         }
diff --git a/src/lib/libcrypto/x509v3/v3_conf.c b/src/lib/libcrypto/x509v3/v3_conf.c
index f19bb3ad84..b2f03010cc 100644
--- a/src/lib/libcrypto/x509v3/v3_conf.c
+++ b/src/lib/libcrypto/x509v3/v3_conf.c
@@ -170,13 +170,13 @@ static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid,
         if(!(ext_der = Malloc(ext_len))) goto merr;
         p = ext_der;
         method->i2d(ext_struc, &p);
-        if(!(ext_oct = ASN1_OCTET_STRING_new())) goto merr;
+        if(!(ext_oct = M_ASN1_OCTET_STRING_new())) goto merr;
         ext_oct->data = ext_der;
         ext_oct->length = ext_len;
         
         ext = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);
         if(!ext) goto merr;
-        ASN1_OCTET_STRING_free(ext_oct);
+        M_ASN1_OCTET_STRING_free(ext_oct);
 
         return ext;
 
@@ -220,7 +220,7 @@ static int v3_check_generic(char **value)
         return 1;
 }
 
-/* Create a generic extension: for now just handle RAW type */
+/* Create a generic extension: for now just handle DER type */
 static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
              int crit, int type)
 {
@@ -241,7 +241,7 @@ if(!(ext_der = string_to_hex(value, &ext_len))) {
         goto err;
 }
 
-if(!(oct = ASN1_OCTET_STRING_new())) {
+if(!(oct = M_ASN1_OCTET_STRING_new())) {
         X509V3err(X509V3_F_V3_GENERIC_EXTENSION,ERR_R_MALLOC_FAILURE);
         goto err;
 }
@@ -254,7 +254,7 @@ extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);
 
 err:
 ASN1_OBJECT_free(obj);
-ASN1_OCTET_STRING_free(oct);
+M_ASN1_OCTET_STRING_free(oct);
 if(ext_der) Free(ext_der);
 return extension;
 }
@@ -302,6 +302,30 @@ int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
         return 1;
 }
 
+/* Add extensions to certificate request */
+
+int X509V3_EXT_REQ_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
+             X509_REQ *req)
+{
+        X509_EXTENSION *ext;
+        STACK_OF(X509_EXTENSION) *extlist = NULL;
+        STACK_OF(CONF_VALUE) *nval;
+        CONF_VALUE *val;        
+        int i;
+        if(!(nval = CONF_get_section(conf, section))) return 0;
+        for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
+                val = sk_CONF_VALUE_value(nval, i);
+                if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))
+                                                                return 0;
+                if(!extlist) extlist = sk_X509_EXTENSION_new_null();
+                sk_X509_EXTENSION_push(extlist, ext);
+        }
+        if(req) i = X509_REQ_add_extensions(req, extlist);
+        else i = 1;
+        sk_X509_EXTENSION_pop_free(extlist, X509_EXTENSION_free);
+        return i;
+}
+
 /* Config database functions */
 
 char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section)
diff --git a/src/lib/libcrypto/x509v3/v3_cpols.c b/src/lib/libcrypto/x509v3/v3_cpols.c
index b4d4883545..466713b50d 100644
--- a/src/lib/libcrypto/x509v3/v3_cpols.c
+++ b/src/lib/libcrypto/x509v3/v3_cpols.c
@@ -169,7 +169,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx,
                         if(!sk_POLICYQUALINFO_push(pol->qualifiers, qual))
                                                                  goto merr;
                         qual->pqualid = OBJ_nid2obj(NID_id_qt_cps);
-                        qual->d.cpsuri = ASN1_IA5STRING_new();
+                        qual->d.cpsuri = M_ASN1_IA5STRING_new();
                         if(!ASN1_STRING_set(qual->d.cpsuri, cnf->value,
                                                  strlen(cnf->value))) goto merr;
                 } else if(!name_cmp(cnf->name, "userNotice")) {
@@ -229,7 +229,7 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
         for(i = 0; i < sk_CONF_VALUE_num(unot); i++) {
                 cnf = sk_CONF_VALUE_value(unot, i);
                 if(!strcmp(cnf->name, "explicitText")) {
-                        not->exptext = ASN1_VISIBLESTRING_new();
+                        not->exptext = M_ASN1_VISIBLESTRING_new();
                         if(!ASN1_STRING_set(not->exptext, cnf->value,
                                                  strlen(cnf->value))) goto merr;
                 } else if(!strcmp(cnf->name, "organization")) {
@@ -238,8 +238,8 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
                                 if(!(nref = NOTICEREF_new())) goto merr;
                                 not->noticeref = nref;
                         } else nref = not->noticeref;
-                        if(ia5org) nref->organization = ASN1_IA5STRING_new();
-                        else nref->organization = ASN1_VISIBLESTRING_new();
+                        if(ia5org) nref->organization = M_ASN1_IA5STRING_new();
+                        else nref->organization = M_ASN1_VISIBLESTRING_new();
                         if(!ASN1_STRING_set(nref->organization, cnf->value,
                                                  strlen(cnf->value))) goto merr;
                 } else if(!strcmp(cnf->name, "noticeNumbers")) {
@@ -538,7 +538,7 @@ void POLICYQUALINFO_free(POLICYQUALINFO *a)
         if (a == NULL) return;
         switch(OBJ_obj2nid(a->pqualid)) {
                 case NID_id_qt_cps:
-                ASN1_IA5STRING_free(a->d.cpsuri);
+                M_ASN1_IA5STRING_free(a->d.cpsuri);
                 break;
 
                 case NID_id_qt_unotice:
@@ -596,7 +596,7 @@ void USERNOTICE_free(USERNOTICE *a)
 {
         if (a == NULL) return;
         NOTICEREF_free(a->noticeref);
-        DISPLAYTEXT_free(a->exptext);
+        M_DISPLAYTEXT_free(a->exptext);
         Free (a);
 }
 
@@ -646,7 +646,7 @@ NOTICEREF *d2i_NOTICEREF(NOTICEREF **a, unsigned char **pp,long length)
 void NOTICEREF_free(NOTICEREF *a)
 {
         if (a == NULL) return;
-        DISPLAYTEXT_free(a->organization);
+        M_DISPLAYTEXT_free(a->organization);
         sk_pop_free(a->noticenos, ASN1_STRING_free);
         Free (a);
 }
diff --git a/src/lib/libcrypto/x509v3/v3_crld.c b/src/lib/libcrypto/x509v3/v3_crld.c
index 897ffb63e4..e459d2595a 100644
--- a/src/lib/libcrypto/x509v3/v3_crld.c
+++ b/src/lib/libcrypto/x509v3/v3_crld.c
@@ -211,20 +211,20 @@ void DIST_POINT_free(DIST_POINT *a)
 {
         if (a == NULL) return;
         DIST_POINT_NAME_free(a->distpoint);
-        ASN1_BIT_STRING_free(a->reasons);
+        M_ASN1_BIT_STRING_free(a->reasons);
         sk_GENERAL_NAME_pop_free(a->CRLissuer, GENERAL_NAME_free);
-        Free ((char *)a);
+        Free (a);
 }
 
 int i2d_DIST_POINT_NAME(DIST_POINT_NAME *a, unsigned char **pp)
 {
-        int v = 0;
         M_ASN1_I2D_vars(a);
 
         if(a->fullname) {
                 M_ASN1_I2D_len_IMP_opt (a->fullname, i2d_GENERAL_NAMES);
         } else {
-                M_ASN1_I2D_len_EXP_opt (a->relativename, i2d_X509_NAME, 1, v);
+                M_ASN1_I2D_len_IMP_SET_opt_type(X509_NAME_ENTRY,
+                                a->relativename, i2d_X509_NAME_ENTRY, 1);
         }
 
         /* Don't want a SEQUENCE so... */
@@ -234,7 +234,8 @@ int i2d_DIST_POINT_NAME(DIST_POINT_NAME *a, unsigned char **pp)
         if(a->fullname) {
                 M_ASN1_I2D_put_IMP_opt (a->fullname, i2d_GENERAL_NAMES, 0);
         } else {
-                M_ASN1_I2D_put_EXP_opt (a->relativename, i2d_X509_NAME, 1, v);
+                M_ASN1_I2D_put_IMP_SET_opt_type(X509_NAME_ENTRY,
+                                a->relativename, i2d_X509_NAME_ENTRY, 1);
         }
         M_ASN1_I2D_finish();
 }
@@ -253,9 +254,9 @@ DIST_POINT_NAME *DIST_POINT_NAME_new(void)
 void DIST_POINT_NAME_free(DIST_POINT_NAME *a)
 {
         if (a == NULL) return;
-        X509_NAME_free(a->relativename);
+        sk_X509_NAME_ENTRY_pop_free(a->relativename, X509_NAME_ENTRY_free);
         sk_GENERAL_NAME_pop_free(a->fullname, GENERAL_NAME_free);
-        Free ((char *)a);
+        Free (a);
 }
 
 DIST_POINT_NAME *d2i_DIST_POINT_NAME(DIST_POINT_NAME **a, unsigned char **pp,
@@ -273,7 +274,8 @@ DIST_POINT_NAME *d2i_DIST_POINT_NAME(DIST_POINT_NAME **a, unsigned char **pp,
                 M_ASN1_D2I_get_imp(ret->fullname, d2i_GENERAL_NAMES,
                                                         V_ASN1_SEQUENCE);
         } else if (tag == (1|V_ASN1_CONTEXT_SPECIFIC)) {
-                M_ASN1_D2I_get_EXP_opt (ret->relativename, d2i_X509_NAME, 1);
+                M_ASN1_D2I_get_IMP_set_opt_type (X509_NAME_ENTRY,
+                        ret->relativename, d2i_X509_NAME_ENTRY, X509_NAME_ENTRY_free, 1);
         } else {
                 c.error = ASN1_R_BAD_TAG;
                 goto err;
diff --git a/src/lib/libcrypto/x509v3/v3_enum.c b/src/lib/libcrypto/x509v3/v3_enum.c
index db423548ff..aecfdc87f8 100644
--- a/src/lib/libcrypto/x509v3/v3_enum.c
+++ b/src/lib/libcrypto/x509v3/v3_enum.c
@@ -60,8 +60,6 @@
 #include "cryptlib.h"
 #include <openssl/x509v3.h>
 
-static ASN1_ENUMERATED *asn1_enumerated_new(void);
-
 static ENUMERATED_NAMES crl_reasons[] = {
 {0, "Unspecified", "unspecified"},
 {1, "Key Compromise", "keyCompromise"},
@@ -76,20 +74,15 @@ static ENUMERATED_NAMES crl_reasons[] = {
 
 X509V3_EXT_METHOD v3_crl_reason = { 
 NID_crl_reason, 0,
-(X509V3_EXT_NEW)asn1_enumerated_new,
-(X509V3_EXT_FREE)ASN1_STRING_free,
+(X509V3_EXT_NEW)ASN1_ENUMERATED_new,
+(X509V3_EXT_FREE)ASN1_ENUMERATED_free,
 (X509V3_EXT_D2I)d2i_ASN1_ENUMERATED,
 (X509V3_EXT_I2D)i2d_ASN1_ENUMERATED,
 (X509V3_EXT_I2S)i2s_ASN1_ENUMERATED_TABLE,
-(X509V3_EXT_S2I)NULL,
+(X509V3_EXT_S2I)0,
 NULL, NULL, NULL, NULL, crl_reasons};
 
 
-static ASN1_ENUMERATED *asn1_enumerated_new(void)
-{
-        return ASN1_ENUMERATED_new();
-}
-
 char *i2s_ASN1_ENUMERATED_TABLE(X509V3_EXT_METHOD *method,
              ASN1_ENUMERATED *e)
 {
diff --git a/src/lib/libcrypto/x509v3/v3_genn.c b/src/lib/libcrypto/x509v3/v3_genn.c
index af716232f8..894afa7e03 100644
--- a/src/lib/libcrypto/x509v3/v3_genn.c
+++ b/src/lib/libcrypto/x509v3/v3_genn.c
@@ -88,12 +88,15 @@ int i2d_GENERAL_NAME(GENERAL_NAME *a, unsigned char **pp)
 
         switch(a->type) {
 
-                case GEN_OTHERNAME:
                 case GEN_X400:
                 case GEN_EDIPARTY:
                 ret = i2d_ASN1_TYPE(a->d.other, pp);
                 break;
 
+                case GEN_OTHERNAME:
+                ret = i2d_OTHERNAME(a->d.otherName, pp);
+                break;
+
                 case GEN_EMAIL:
                 case GEN_DNS:
                 case GEN_URI:
@@ -137,12 +140,15 @@ GENERAL_NAME *d2i_GENERAL_NAME(GENERAL_NAME **a, unsigned char **pp,
 
         switch(ret->type) {
                 /* Just put these in a "blob" for now */
-                case GEN_OTHERNAME:
                 case GEN_X400:
                 case GEN_EDIPARTY:
                 M_ASN1_D2I_get_imp(ret->d.other, d2i_ASN1_TYPE,V_ASN1_SEQUENCE);
                 break;
 
+                case GEN_OTHERNAME:
+                M_ASN1_D2I_get_imp(ret->d.otherName, d2i_OTHERNAME,V_ASN1_SEQUENCE);
+                break;
+
                 case GEN_EMAIL:
                 case GEN_DNS:
                 case GEN_URI:
@@ -176,17 +182,20 @@ void GENERAL_NAME_free(GENERAL_NAME *a)
 {
         if (a == NULL) return;
         switch(a->type) {
-                case GEN_OTHERNAME:
                 case GEN_X400:
                 case GEN_EDIPARTY:
                 ASN1_TYPE_free(a->d.other);
                 break;
 
+                case GEN_OTHERNAME:
+                OTHERNAME_free(a->d.otherName);
+                break;
+
                 case GEN_EMAIL:
                 case GEN_DNS:
                 case GEN_URI:
 
-                ASN1_IA5STRING_free(a->d.ia5);
+                M_ASN1_IA5STRING_free(a->d.ia5);
                 break;
 
                 case GEN_DIRNAME:
@@ -194,7 +203,7 @@ void GENERAL_NAME_free(GENERAL_NAME *a)
                 break;
 
                 case GEN_IPADD:
-                ASN1_OCTET_STRING_free(a->d.ip);
+                M_ASN1_OCTET_STRING_free(a->d.ip);
                 break;
         
                 case GEN_RID:
@@ -202,11 +211,11 @@ void GENERAL_NAME_free(GENERAL_NAME *a)
                 break;
 
         }
-        Free ((char *)a);
+        Free (a);
 }
 
-/* Now the GeneralNames versions: a SEQUENCE OF GeneralName These are needed as
- * an explicit functions.
+/* Now the GeneralNames versions: a SEQUENCE OF GeneralName. These are needed as
+ * explicit functions.
  */
 
 STACK_OF(GENERAL_NAME) *GENERAL_NAMES_new()
@@ -235,3 +244,48 @@ return i2d_ASN1_SET_OF_GENERAL_NAME(a, pp, i2d_GENERAL_NAME, V_ASN1_SEQUENCE,
 IMPLEMENT_STACK_OF(GENERAL_NAME)
 IMPLEMENT_ASN1_SET_OF(GENERAL_NAME)
 
+int i2d_OTHERNAME(OTHERNAME *a, unsigned char **pp)
+{
+        int v = 0;
+        M_ASN1_I2D_vars(a);
+
+        M_ASN1_I2D_len(a->type_id, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_len_EXP_opt(a->value, i2d_ASN1_TYPE, 0, v);
+
+        M_ASN1_I2D_seq_total();
+
+        M_ASN1_I2D_put(a->type_id, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_put_EXP_opt(a->value, i2d_ASN1_TYPE, 0, v);
+
+        M_ASN1_I2D_finish();
+}
+
+OTHERNAME *OTHERNAME_new(void)
+{
+        OTHERNAME *ret=NULL;
+        ASN1_CTX c;
+        M_ASN1_New_Malloc(ret, OTHERNAME);
+        ret->type_id = OBJ_nid2obj(NID_undef);
+        M_ASN1_New(ret->value, ASN1_TYPE_new);
+        return (ret);
+        M_ASN1_New_Error(ASN1_F_OTHERNAME_NEW);
+}
+
+OTHERNAME *d2i_OTHERNAME(OTHERNAME **a, unsigned char **pp, long length)
+{
+        M_ASN1_D2I_vars(a,OTHERNAME *,OTHERNAME_new);
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+        M_ASN1_D2I_get(ret->type_id, d2i_ASN1_OBJECT);
+        M_ASN1_D2I_get_EXP_opt(ret->value, d2i_ASN1_TYPE, 0);
+        M_ASN1_D2I_Finish(a, OTHERNAME_free, ASN1_F_D2I_OTHERNAME);
+}
+
+void OTHERNAME_free(OTHERNAME *a)
+{
+        if (a == NULL) return;
+        ASN1_OBJECT_free(a->type_id);
+        ASN1_TYPE_free(a->value);
+        Free (a);
+}
+
diff --git a/src/lib/libcrypto/x509v3/v3_ia5.c b/src/lib/libcrypto/x509v3/v3_ia5.c
index 3446c5cd6a..af3525f33e 100644
--- a/src/lib/libcrypto/x509v3/v3_ia5.c
+++ b/src/lib/libcrypto/x509v3/v3_ia5.c
@@ -63,7 +63,6 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
-static ASN1_IA5STRING *ia5string_new(void);
 static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method, ASN1_IA5STRING *ia5);
 static ASN1_IA5STRING *s2i_ASN1_IA5STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
 X509V3_EXT_METHOD v3_ns_ia5_list[] = { 
@@ -78,11 +77,6 @@ EXT_END
 };
 
 
-static ASN1_IA5STRING *ia5string_new(void)
-{
-        return ASN1_IA5STRING_new();
-}
-
 static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method,
              ASN1_IA5STRING *ia5)
 {
@@ -102,12 +96,15 @@ static ASN1_IA5STRING *s2i_ASN1_IA5STRING(X509V3_EXT_METHOD *method,
                 X509V3err(X509V3_F_S2I_ASN1_IA5STRING,X509V3_R_INVALID_NULL_ARGUMENT);
                 return NULL;
         }
-        if(!(ia5 = ASN1_IA5STRING_new())) goto err;
+        if(!(ia5 = M_ASN1_IA5STRING_new())) goto err;
         if(!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char*)str,
                             strlen(str))) {
-                ASN1_IA5STRING_free(ia5);
+                M_ASN1_IA5STRING_free(ia5);
                 goto err;
         }
+#ifdef CHARSET_EBCDIC
+        ebcdic2ascii(ia5->data, ia5->data, ia5->length);
+#endif /*CHARSET_EBCDIC*/
         return ia5;
         err:
         X509V3err(X509V3_F_S2I_ASN1_IA5STRING,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libcrypto/x509v3/v3_info.c b/src/lib/libcrypto/x509v3/v3_info.c
new file mode 100644
index 0000000000..78d2135046
--- /dev/null
+++ b/src/lib/libcrypto/x509v3/v3_info.c
@@ -0,0 +1,236 @@
+/* v3_info.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/conf.h>
+#include <openssl/asn1.h>
+#include <openssl/asn1_mac.h>
+#include <openssl/x509v3.h>
+
+static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
+                                STACK_OF(ACCESS_DESCRIPTION) *ainfo,
+                                                STACK_OF(CONF_VALUE) *ret);
+static STACK_OF(ACCESS_DESCRIPTION) *v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
+                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
+
+X509V3_EXT_METHOD v3_info =
+{ NID_info_access, X509V3_EXT_MULTILINE,
+(X509V3_EXT_NEW)AUTHORITY_INFO_ACCESS_new,
+(X509V3_EXT_FREE)AUTHORITY_INFO_ACCESS_free,
+(X509V3_EXT_D2I)d2i_AUTHORITY_INFO_ACCESS,
+(X509V3_EXT_I2D)i2d_AUTHORITY_INFO_ACCESS,
+NULL, NULL,
+(X509V3_EXT_I2V)i2v_AUTHORITY_INFO_ACCESS,
+(X509V3_EXT_V2I)v2i_AUTHORITY_INFO_ACCESS,
+NULL, NULL, NULL};
+
+static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
+                                STACK_OF(ACCESS_DESCRIPTION) *ainfo,
+                                                STACK_OF(CONF_VALUE) *ret)
+{
+        ACCESS_DESCRIPTION *desc;
+        int i;
+        char objtmp[80], *ntmp;
+        CONF_VALUE *vtmp;
+        for(i = 0; i < sk_ACCESS_DESCRIPTION_num(ainfo); i++) {
+                desc = sk_ACCESS_DESCRIPTION_value(ainfo, i);
+                ret = i2v_GENERAL_NAME(method, desc->location, ret);
+                if(!ret) break;
+                vtmp = sk_CONF_VALUE_value(ret, i);
+                i2t_ASN1_OBJECT(objtmp, 80, desc->method);
+                ntmp = Malloc(strlen(objtmp) + strlen(vtmp->name) + 5);
+                if(!ntmp) {
+                        X509V3err(X509V3_F_I2V_AUTHORITY_INFO_ACCESS,
+                                        ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                }
+                strcpy(ntmp, objtmp);
+                strcat(ntmp, " - ");
+                strcat(ntmp, vtmp->name);
+                Free(vtmp->name);
+                vtmp->name = ntmp;
+                
+        }
+        if(!ret) return sk_CONF_VALUE_new_null();
+        return ret;
+}
+
+static STACK_OF(ACCESS_DESCRIPTION) *v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
+                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
+{
+        STACK_OF(ACCESS_DESCRIPTION) *ainfo = NULL;
+        CONF_VALUE *cnf, ctmp;
+        ACCESS_DESCRIPTION *acc;
+        int i, objlen;
+        char *objtmp, *ptmp;
+        if(!(ainfo = sk_ACCESS_DESCRIPTION_new(NULL))) {
+                X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+        for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
+                cnf = sk_CONF_VALUE_value(nval, i);
+                if(!(acc = ACCESS_DESCRIPTION_new())
+                        || !sk_ACCESS_DESCRIPTION_push(ainfo, acc)) {
+                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+                ptmp = strchr(cnf->name, ';');
+                if(!ptmp) {
+                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,X509V3_R_INVALID_SYNTAX);
+                        goto err;
+                }
+                objlen = ptmp - cnf->name;
+                ctmp.name = ptmp + 1;
+                ctmp.value = cnf->value;
+                if(!(acc->location = v2i_GENERAL_NAME(method, ctx, &ctmp)))
+                                                                 goto err; 
+                if(!(objtmp = Malloc(objlen + 1))) {
+                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+                strncpy(objtmp, cnf->name, objlen);
+                objtmp[objlen] = 0;
+                acc->method = OBJ_txt2obj(objtmp, 0);
+                if(!acc->method) {
+                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,X509V3_R_BAD_OBJECT);
+                        ERR_add_error_data(2, "value=", objtmp);
+                        Free(objtmp);
+                        goto err;
+                }
+                Free(objtmp);
+
+        }
+        return ainfo;
+        err:
+        sk_ACCESS_DESCRIPTION_pop_free(ainfo, ACCESS_DESCRIPTION_free);
+        return NULL;
+}
+
+int i2d_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION *a, unsigned char **pp)
+{
+        M_ASN1_I2D_vars(a);
+
+        M_ASN1_I2D_len(a->method, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_len(a->location, i2d_GENERAL_NAME);
+
+        M_ASN1_I2D_seq_total();
+
+        M_ASN1_I2D_put(a->method, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_put(a->location, i2d_GENERAL_NAME);
+
+        M_ASN1_I2D_finish();
+}
+
+ACCESS_DESCRIPTION *ACCESS_DESCRIPTION_new(void)
+{
+        ACCESS_DESCRIPTION *ret=NULL;
+        ASN1_CTX c;
+        M_ASN1_New_Malloc(ret, ACCESS_DESCRIPTION);
+        ret->method = OBJ_nid2obj(NID_undef);
+        ret->location = NULL;
+        return (ret);
+        M_ASN1_New_Error(ASN1_F_ACCESS_DESCRIPTION_NEW);
+}
+
+ACCESS_DESCRIPTION *d2i_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION **a, unsigned char **pp,
+             long length)
+{
+        M_ASN1_D2I_vars(a,ACCESS_DESCRIPTION *,ACCESS_DESCRIPTION_new);
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+        M_ASN1_D2I_get(ret->method, d2i_ASN1_OBJECT);
+        M_ASN1_D2I_get(ret->location, d2i_GENERAL_NAME);
+        M_ASN1_D2I_Finish(a, ACCESS_DESCRIPTION_free, ASN1_F_D2I_ACCESS_DESCRIPTION);
+}
+
+void ACCESS_DESCRIPTION_free(ACCESS_DESCRIPTION *a)
+{
+        if (a == NULL) return;
+        ASN1_OBJECT_free(a->method);
+        GENERAL_NAME_free(a->location);
+        Free (a);
+}
+
+STACK_OF(ACCESS_DESCRIPTION) *AUTHORITY_INFO_ACCESS_new(void)
+{
+        return sk_ACCESS_DESCRIPTION_new(NULL);
+}
+
+void AUTHORITY_INFO_ACCESS_free(STACK_OF(ACCESS_DESCRIPTION) *a)
+{
+        sk_ACCESS_DESCRIPTION_pop_free(a, ACCESS_DESCRIPTION_free);
+}
+
+STACK_OF(ACCESS_DESCRIPTION) *d2i_AUTHORITY_INFO_ACCESS(STACK_OF(ACCESS_DESCRIPTION) **a,
+                                         unsigned char **pp, long length)
+{
+return d2i_ASN1_SET_OF_ACCESS_DESCRIPTION(a, pp, length, d2i_ACCESS_DESCRIPTION,
+                         ACCESS_DESCRIPTION_free, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+}
+
+int i2d_AUTHORITY_INFO_ACCESS(STACK_OF(ACCESS_DESCRIPTION) *a, unsigned char **pp)
+{
+return i2d_ASN1_SET_OF_ACCESS_DESCRIPTION(a, pp, i2d_ACCESS_DESCRIPTION, V_ASN1_SEQUENCE,
+                                                 V_ASN1_UNIVERSAL, IS_SEQUENCE);
+}
+
+IMPLEMENT_STACK_OF(ACCESS_DESCRIPTION)
+IMPLEMENT_ASN1_SET_OF(ACCESS_DESCRIPTION)
+
+
diff --git a/src/lib/libcrypto/x509v3/v3_int.c b/src/lib/libcrypto/x509v3/v3_int.c
index 637dd5e128..63c201e5f4 100644
--- a/src/lib/libcrypto/x509v3/v3_int.c
+++ b/src/lib/libcrypto/x509v3/v3_int.c
@@ -60,20 +60,13 @@
 #include "cryptlib.h"
 #include <openssl/x509v3.h>
 
-static ASN1_INTEGER *asn1_integer_new(void);
-
 X509V3_EXT_METHOD v3_crl_num = { 
 NID_crl_number, 0,
-(X509V3_EXT_NEW)asn1_integer_new,
-(X509V3_EXT_FREE)ASN1_STRING_free,
+(X509V3_EXT_NEW)ASN1_INTEGER_new,
+(X509V3_EXT_FREE)ASN1_INTEGER_free,
 (X509V3_EXT_D2I)d2i_ASN1_INTEGER,
 (X509V3_EXT_I2D)i2d_ASN1_INTEGER,
 (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
-(X509V3_EXT_S2I)NULL,
+(X509V3_EXT_S2I)0,
 NULL, NULL, NULL, NULL, NULL};
 
-
-static ASN1_INTEGER *asn1_integer_new(void)
-{
-        return ASN1_INTEGER_new();
-}
diff --git a/src/lib/libcrypto/x509v3/v3_lib.c b/src/lib/libcrypto/x509v3/v3_lib.c
index a0aa5de794..4242d130a2 100644
--- a/src/lib/libcrypto/x509v3/v3_lib.c
+++ b/src/lib/libcrypto/x509v3/v3_lib.c
@@ -62,6 +62,8 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
+#include "ext_dat.h"
+
 static STACK *ext_list = NULL;
 
 static int ext_cmp(X509V3_EXT_METHOD **a, X509V3_EXT_METHOD **b);
@@ -87,10 +89,15 @@ static int ext_cmp(X509V3_EXT_METHOD **a, X509V3_EXT_METHOD **b)
 
 X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
 {
-        X509V3_EXT_METHOD tmp;
+        X509V3_EXT_METHOD tmp, *t = &tmp, **ret;
         int idx;
+        if(nid < 0) return NULL;
         tmp.ext_nid = nid;
-        if(!ext_list || (tmp.ext_nid < 0) ) return NULL;
+        ret = (X509V3_EXT_METHOD **) OBJ_bsearch((char *)&t,
+                        (char *)standard_exts, STANDARD_EXTENSION_COUNT,
+                        sizeof(X509V3_EXT_METHOD *), (int (*)())ext_cmp);
+        if(ret) return *ret;
+        if(!ext_list) return NULL;
         idx = sk_find(ext_list, (char *)&tmp);
         if(idx == -1) return NULL;
         return (X509V3_EXT_METHOD *)sk_value(ext_list, idx);
@@ -125,7 +132,7 @@ int X509V3_EXT_add_alias(int nid_to, int nid_from)
         *tmpext = *ext;
         tmpext->ext_nid = nid_to;
         tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
-        return 1;
+        return X509V3_EXT_add(tmpext);
 }
 
 void X509V3_EXT_cleanup(void)
@@ -139,28 +146,12 @@ static void ext_list_free(X509V3_EXT_METHOD *ext)
         if(ext->ext_flags & X509V3_EXT_DYNAMIC) Free(ext);
 }
 
-extern X509V3_EXT_METHOD v3_bcons, v3_nscert, v3_key_usage, v3_ext_ku;
-extern X509V3_EXT_METHOD v3_pkey_usage_period, v3_sxnet;
-extern X509V3_EXT_METHOD v3_ns_ia5_list[], v3_alt[], v3_skey_id, v3_akey_id;
-
-extern X509V3_EXT_METHOD v3_crl_num, v3_crl_reason, v3_cpols, v3_crld;
+/* Legacy function: we don't need to add standard extensions
+ * any more because they are now kept in ext_dat.h.
+ */
 
 int X509V3_add_standard_extensions(void)
 {
-        X509V3_EXT_add_list(v3_ns_ia5_list);
-        X509V3_EXT_add_list(v3_alt);
-        X509V3_EXT_add(&v3_bcons);
-        X509V3_EXT_add(&v3_nscert);
-        X509V3_EXT_add(&v3_key_usage);
-        X509V3_EXT_add(&v3_ext_ku);
-        X509V3_EXT_add(&v3_skey_id);
-        X509V3_EXT_add(&v3_akey_id);
-        X509V3_EXT_add(&v3_pkey_usage_period);
-        X509V3_EXT_add(&v3_crl_num);
-        X509V3_EXT_add(&v3_sxnet);
-        X509V3_EXT_add(&v3_crl_reason);
-        X509V3_EXT_add(&v3_cpols);
-        X509V3_EXT_add(&v3_crld);
         return 1;
 }
 
@@ -175,3 +166,56 @@ void *X509V3_EXT_d2i(X509_EXTENSION *ext)
         return method->d2i(NULL, &p, ext->value->length);
 }
 
+/* Get critical flag and decoded version of extension from a NID.
+ * The "idx" variable returns the last found extension and can
+ * be used to retrieve multiple extensions of the same NID.
+ * However multiple extensions with the same NID is usually
+ * due to a badly encoded certificate so if idx is NULL we
+ * choke if multiple extensions exist.
+ * The "crit" variable is set to the critical value.
+ * The return value is the decoded extension or NULL on
+ * error. The actual error can have several different causes,
+ * the value of *crit reflects the cause:
+ * >= 0, extension found but not decoded (reflects critical value).
+ * -1 extension not found.
+ * -2 extension occurs more than once.
+ */
+
+void *X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx)
+{
+        int lastpos, i;
+        X509_EXTENSION *ex, *found_ex = NULL;
+        if(!x) {
+                if(idx) *idx = -1;
+                if(crit) *crit = -1;
+                return NULL;
+        }
+        if(idx) lastpos = *idx + 1;
+        else lastpos = 0;
+        if(lastpos < 0) lastpos = 0;
+        for(i = lastpos; i < sk_X509_EXTENSION_num(x); i++)
+        {
+                ex = sk_X509_EXTENSION_value(x, i);
+                if(OBJ_obj2nid(ex->object) == nid) {
+                        if(idx) {
+                                *idx = i;
+                                break;
+                        } else if(found_ex) {
+                                /* Found more than one */
+                                if(crit) *crit = -2;
+                                return NULL;
+                        }
+                        found_ex = ex;
+                }
+        }
+        if(found_ex) {
+                /* Found it */
+                if(crit) *crit = found_ex->critical;
+                return X509V3_EXT_d2i(found_ex);
+        }
+        
+        /* Extension not found */
+        if(idx) *idx = -1;
+        if(crit) *crit = -1;
+        return NULL;
+}
diff --git a/src/lib/libcrypto/x509v3/v3_pku.c b/src/lib/libcrypto/x509v3/v3_pku.c
index c13e7d8f45..30a62c6090 100644
--- a/src/lib/libcrypto/x509v3/v3_pku.c
+++ b/src/lib/libcrypto/x509v3/v3_pku.c
@@ -119,9 +119,9 @@ PKEY_USAGE_PERIOD *d2i_PKEY_USAGE_PERIOD(PKEY_USAGE_PERIOD **a,
 void PKEY_USAGE_PERIOD_free(PKEY_USAGE_PERIOD *a)
 {
         if (a == NULL) return;
-        ASN1_GENERALIZEDTIME_free(a->notBefore);
-        ASN1_GENERALIZEDTIME_free(a->notAfter);
-        Free ((char *)a);
+        M_ASN1_GENERALIZEDTIME_free(a->notBefore);
+        M_ASN1_GENERALIZEDTIME_free(a->notAfter);
+        Free (a);
 }
 
 static int i2r_PKEY_USAGE_PERIOD(X509V3_EXT_METHOD *method,
diff --git a/src/lib/libcrypto/x509v3/v3_prn.c b/src/lib/libcrypto/x509v3/v3_prn.c
index dc20c6bdba..bee624c6be 100644
--- a/src/lib/libcrypto/x509v3/v3_prn.c
+++ b/src/lib/libcrypto/x509v3/v3_prn.c
@@ -81,7 +81,15 @@ void X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent, int ml)
                 nval = sk_CONF_VALUE_value(val, i);
                 if(!nval->name) BIO_puts(out, nval->value);
                 else if(!nval->value) BIO_puts(out, nval->name);
+#ifndef CHARSET_EBCDIC
                 else BIO_printf(out, "%s:%s", nval->name, nval->value);
+#else
+                else {
+                        char tmp[10240]; /* 10k is BIO_printf's limit anyway */
+                        ascii2ebcdic(tmp, nval->value, strlen(nval->value)+1);
+                        BIO_printf(out, "%s:%s", nval->name, tmp);
+                }
+#endif
                 if(ml) BIO_puts(out, "\n");
         }
 }
@@ -103,7 +111,15 @@ int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, int flag, int indent)
                         ok = 0;
                         goto err;
                 }
+#ifndef CHARSET_EBCDIC
                 BIO_printf(out, "%*s%s", indent, "", value);
+#else
+                {
+                        char tmp[10240]; /* 10k is BIO_printf's limit anyway */
+                        ascii2ebcdic(tmp, value, strlen(value)+1);
+                        BIO_printf(out, "%*s%s", indent, "", tmp);
+                }
+#endif
         } else if(method->i2v) {
                 if(!(nval = method->i2v(method, ext_str, NULL))) {
                         ok = 0;
diff --git a/src/lib/libcrypto/x509v3/v3_purp.c b/src/lib/libcrypto/x509v3/v3_purp.c
new file mode 100644
index 0000000000..b7494ebcd5
--- /dev/null
+++ b/src/lib/libcrypto/x509v3/v3_purp.c
@@ -0,0 +1,456 @@
+/* v3_purp.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509v3.h>
+
+
+static void x509v3_cache_extensions(X509 *x);
+
+static int ca_check(X509 *x);
+static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca);
+static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
+static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
+static int purpose_smime(X509 *x, int ca);
+static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca);
+static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca);
+static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca);
+
+static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b);
+static void xptable_free(X509_PURPOSE *p);
+
+static X509_PURPOSE xstandard[] = {
+        {X509_PURPOSE_SSL_CLIENT, X509_TRUST_SSL_CLIENT, 0, check_purpose_ssl_client, "SSL client", "sslclient", NULL},
+        {X509_PURPOSE_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ssl_server, "SSL server", "sslserver", NULL},
+        {X509_PURPOSE_NS_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ns_ssl_server, "Netscape SSL server", "nssslserver", NULL},
+        {X509_PURPOSE_SMIME_SIGN, X509_TRUST_EMAIL, 0, check_purpose_smime_sign, "S/MIME signing", "smimesign", NULL},
+        {X509_PURPOSE_SMIME_ENCRYPT, X509_TRUST_EMAIL, 0, check_purpose_smime_encrypt, "S/MIME encryption", "smimeencrypt", NULL},
+        {X509_PURPOSE_CRL_SIGN, X509_TRUST_ANY, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
+};
+
+#define X509_PURPOSE_COUNT (sizeof(xstandard)/sizeof(X509_PURPOSE))
+
+IMPLEMENT_STACK_OF(X509_PURPOSE)
+
+static STACK_OF(X509_PURPOSE) *xptable = NULL;
+
+static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b)
+{
+        return (*a)->purpose - (*b)->purpose;
+}
+
+int X509_check_purpose(X509 *x, int id, int ca)
+{
+        int idx;
+        X509_PURPOSE *pt;
+        if(!(x->ex_flags & EXFLAG_SET)) {
+                CRYPTO_w_lock(CRYPTO_LOCK_X509);
+                x509v3_cache_extensions(x);
+                CRYPTO_w_unlock(CRYPTO_LOCK_X509);
+        }
+        if(id == -1) return 1;
+        idx = X509_PURPOSE_get_by_id(id);
+        if(idx == -1) return -1;
+        pt = X509_PURPOSE_get0(idx);
+        return pt->check_purpose(pt, x, ca);
+}
+
+int X509_PURPOSE_get_count(void)
+{
+        if(!xptable) return X509_PURPOSE_COUNT;
+        return sk_X509_PURPOSE_num(xptable) + X509_PURPOSE_COUNT;
+}
+
+X509_PURPOSE * X509_PURPOSE_get0(int idx)
+{
+        if(idx < 0) return NULL;
+        if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
+        return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
+}
+
+int X509_PURPOSE_get_by_sname(char *sname)
+{
+        int i;
+        X509_PURPOSE *xptmp;
+        for(i = 0; i < X509_PURPOSE_get_count(); i++) {
+                xptmp = X509_PURPOSE_get0(i);
+                if(!strcmp(xptmp->sname, sname)) return i;
+        }
+        return -1;
+}
+
+
+int X509_PURPOSE_get_by_id(int purpose)
+{
+        X509_PURPOSE tmp;
+        int idx;
+        if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
+                return purpose - X509_PURPOSE_MIN;
+        tmp.purpose = purpose;
+        if(!xptable) return -1;
+        idx = sk_X509_PURPOSE_find(xptable, &tmp);
+        if(idx == -1) return -1;
+        return idx + X509_PURPOSE_COUNT;
+}
+
+int X509_PURPOSE_add(int id, int trust, int flags,
+                        int (*ck)(X509_PURPOSE *, X509 *, int),
+                                        char *name, char *sname, void *arg)
+{
+        int idx;
+        X509_PURPOSE *ptmp;
+        /* This is set according to what we change: application can't set it */
+        flags &= ~X509_PURPOSE_DYNAMIC;
+        /* This will always be set for application modified trust entries */
+        flags |= X509_PURPOSE_DYNAMIC_NAME;
+        /* Get existing entry if any */
+        idx = X509_PURPOSE_get_by_id(id);
+        /* Need a new entry */
+        if(idx == -1) {
+                if(!(ptmp = Malloc(sizeof(X509_PURPOSE)))) {
+                        X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                ptmp->flags = X509_PURPOSE_DYNAMIC;
+        } else ptmp = X509_PURPOSE_get0(idx);
+
+        /* Free existing name if dynamic */
+        if(ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
+                Free(ptmp->name);
+                Free(ptmp->sname);
+        }
+        /* dup supplied name */
+        ptmp->name = BUF_strdup(name);
+        ptmp->sname = BUF_strdup(sname);
+        if(!ptmp->name || !ptmp->sname) {
+                X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        /* Keep the dynamic flag of existing entry */
+        ptmp->flags &= X509_PURPOSE_DYNAMIC;
+        /* Set all other flags */
+        ptmp->flags |= flags;
+
+        ptmp->purpose = id;
+        ptmp->trust = trust;
+        ptmp->check_purpose = ck;
+        ptmp->usr_data = arg;
+
+        /* If its a new entry manage the dynamic table */
+        if(idx == -1) {
+                if(!xptable && !(xptable = sk_X509_PURPOSE_new(xp_cmp))) {
+                        X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if (!sk_X509_PURPOSE_push(xptable, ptmp)) {
+                        X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+static void xptable_free(X509_PURPOSE *p)
+        {
+        if(!p) return;
+        if (p->flags & X509_PURPOSE_DYNAMIC) 
+                {
+                if (p->flags & X509_PURPOSE_DYNAMIC_NAME) {
+                        Free(p->name);
+                        Free(p->sname);
+                }
+                Free(p);
+                }
+        }
+
+void X509_PURPOSE_cleanup(void)
+{
+        int i;
+        sk_X509_PURPOSE_pop_free(xptable, xptable_free);
+        for(i = 0; i < X509_PURPOSE_COUNT; i++) xptable_free(xstandard + i);
+        xptable = NULL;
+}
+
+int X509_PURPOSE_get_id(X509_PURPOSE *xp)
+{
+        return xp->purpose;
+}
+
+char *X509_PURPOSE_get0_name(X509_PURPOSE *xp)
+{
+        return xp->name;
+}
+
+char *X509_PURPOSE_get0_sname(X509_PURPOSE *xp)
+{
+        return xp->sname;
+}
+
+int X509_PURPOSE_get_trust(X509_PURPOSE *xp)
+{
+        return xp->trust;
+}
+
+#ifndef NO_SHA
+static void x509v3_cache_extensions(X509 *x)
+{
+        BASIC_CONSTRAINTS *bs;
+        ASN1_BIT_STRING *usage;
+        ASN1_BIT_STRING *ns;
+        STACK_OF(ASN1_OBJECT) *extusage;
+        int i;
+        if(x->ex_flags & EXFLAG_SET) return;
+        X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
+        /* Does subject name match issuer ? */
+        if(!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
+                         x->ex_flags |= EXFLAG_SS;
+        /* V1 should mean no extensions ... */
+        if(!X509_get_version(x)) x->ex_flags |= EXFLAG_V1;
+        /* Handle basic constraints */
+        if((bs=X509_get_ext_d2i(x, NID_basic_constraints, NULL, NULL))) {
+                if(bs->ca) x->ex_flags |= EXFLAG_CA;
+                if(bs->pathlen) {
+                        if((bs->pathlen->type == V_ASN1_NEG_INTEGER)
+                                                || !bs->ca) {
+                                x->ex_flags |= EXFLAG_INVALID;
+                                x->ex_pathlen = 0;
+                        } else x->ex_pathlen = ASN1_INTEGER_get(bs->pathlen);
+                } else x->ex_pathlen = -1;
+                BASIC_CONSTRAINTS_free(bs);
+                x->ex_flags |= EXFLAG_BCONS;
+        }
+        /* Handle key usage */
+        if((usage=X509_get_ext_d2i(x, NID_key_usage, NULL, NULL))) {
+                if(usage->length > 0) {
+                        x->ex_kusage = usage->data[0];
+                        if(usage->length > 1) 
+                                x->ex_kusage |= usage->data[1] << 8;
+                } else x->ex_kusage = 0;
+                x->ex_flags |= EXFLAG_KUSAGE;
+                ASN1_BIT_STRING_free(usage);
+        }
+        x->ex_xkusage = 0;
+        if((extusage=X509_get_ext_d2i(x, NID_ext_key_usage, NULL, NULL))) {
+                x->ex_flags |= EXFLAG_XKUSAGE;
+                for(i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
+                        switch(OBJ_obj2nid(sk_ASN1_OBJECT_value(extusage,i))) {
+                                case NID_server_auth:
+                                x->ex_xkusage |= XKU_SSL_SERVER;
+                                break;
+
+                                case NID_client_auth:
+                                x->ex_xkusage |= XKU_SSL_CLIENT;
+                                break;
+
+                                case NID_email_protect:
+                                x->ex_xkusage |= XKU_SMIME;
+                                break;
+
+                                case NID_code_sign:
+                                x->ex_xkusage |= XKU_CODE_SIGN;
+                                break;
+
+                                case NID_ms_sgc:
+                                case NID_ns_sgc:
+                                x->ex_xkusage |= XKU_SGC;
+                        }
+                }
+                sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
+        }
+
+        if((ns=X509_get_ext_d2i(x, NID_netscape_cert_type, NULL, NULL))) {
+                if(ns->length > 0) x->ex_nscert = ns->data[0];
+                else x->ex_nscert = 0;
+                x->ex_flags |= EXFLAG_NSCERT;
+                ASN1_BIT_STRING_free(ns);
+        }
+        x->ex_flags |= EXFLAG_SET;
+}
+#endif
+
+/* CA checks common to all purposes
+ * return codes:
+ * 0 not a CA
+ * 1 is a CA
+ * 2 basicConstraints absent so "maybe" a CA
+ * 3 basicConstraints absent but self signed V1.
+ */
+
+#define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
+#define ku_reject(x, usage) \
+        (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
+#define xku_reject(x, usage) \
+        (((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
+#define ns_reject(x, usage) \
+        (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
+
+static int ca_check(X509 *x)
+{
+        /* keyUsage if present should allow cert signing */
+        if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;
+        if(x->ex_flags & EXFLAG_BCONS) {
+                if(x->ex_flags & EXFLAG_CA) return 1;
+                /* If basicConstraints says not a CA then say so */
+                else return 0;
+        } else {
+                if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;
+                else return 2;
+        }
+}
+
+
+static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
+        if(ca) {
+                int ca_ret;
+                ca_ret = ca_check(x);
+                if(!ca_ret) return 0;
+                /* check nsCertType if present */
+                if(x->ex_flags & EXFLAG_NSCERT) {
+                        if(x->ex_nscert & NS_SSL_CA) return ca_ret;
+                        return 0;
+                }
+                if(ca_ret != 2) return ca_ret;
+                else return 0;
+        }
+        /* We need to do digital signatures with it */
+        if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0;
+        /* nsCertType if present should allow SSL client use */ 
+        if(ns_reject(x, NS_SSL_CLIENT)) return 0;
+        return 1;
+}
+
+static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        if(xku_reject(x,XKU_SSL_SERVER|XKU_SGC)) return 0;
+        /* Otherwise same as SSL client for a CA */
+        if(ca) return check_purpose_ssl_client(xp, x, 1);
+
+        if(ns_reject(x, NS_SSL_SERVER)) return 0;
+        /* Now as for keyUsage: we'll at least need to sign OR encipher */
+        if(ku_reject(x, KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT)) return 0;
+        
+        return 1;
+
+}
+
+static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        int ret;
+        ret = check_purpose_ssl_server(xp, x, ca);
+        if(!ret || ca) return ret;
+        /* We need to encipher or Netscape complains */
+        if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
+        return ret;
+}
+
+/* common S/MIME checks */
+static int purpose_smime(X509 *x, int ca)
+{
+        if(xku_reject(x,XKU_SMIME)) return 0;
+        if(ca) {
+                int ca_ret;
+                ca_ret = ca_check(x);
+                if(!ca_ret) return 0;
+                /* check nsCertType if present */
+                if(x->ex_flags & EXFLAG_NSCERT) {
+                        if(x->ex_nscert & NS_SMIME_CA) return ca_ret;
+                        return 0;
+                }
+                if(ca_ret != 2) return ca_ret;
+                else return 0;
+        }
+        if(x->ex_flags & EXFLAG_NSCERT) {
+                if(x->ex_nscert & NS_SMIME) return 1;
+                /* Workaround for some buggy certificates */
+                if(x->ex_nscert & NS_SSL_CLIENT) return 2;
+                return 0;
+        }
+        return 1;
+}
+
+static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        int ret;
+        ret = purpose_smime(x, ca);
+        if(!ret || ca) return ret;
+        if(ku_reject(x, KU_DIGITAL_SIGNATURE)) return 0;
+        return ret;
+}
+
+static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        int ret;
+        ret = purpose_smime(x, ca);
+        if(!ret || ca) return ret;
+        if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
+        return ret;
+}
+
+static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        if(ca) {
+                int ca_ret;
+                if((ca_ret = ca_check(x)) != 2) return ca_ret;
+                else return 0;
+        }
+        if(ku_reject(x, KU_CRL_SIGN)) return 0;
+        return 1;
+}
diff --git a/src/lib/libcrypto/x509v3/v3_skey.c b/src/lib/libcrypto/x509v3/v3_skey.c
index fb3e36014d..939845fa8f 100644
--- a/src/lib/libcrypto/x509v3/v3_skey.c
+++ b/src/lib/libcrypto/x509v3/v3_skey.c
@@ -61,24 +61,17 @@
 #include "cryptlib.h"
 #include <openssl/x509v3.h>
 
-static ASN1_OCTET_STRING *octet_string_new(void);
 static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
 X509V3_EXT_METHOD v3_skey_id = { 
 NID_subject_key_identifier, 0,
-(X509V3_EXT_NEW)octet_string_new,
-(X509V3_EXT_FREE)ASN1_STRING_free,
+(X509V3_EXT_NEW)ASN1_OCTET_STRING_new,
+(X509V3_EXT_FREE)ASN1_OCTET_STRING_free,
 (X509V3_EXT_D2I)d2i_ASN1_OCTET_STRING,
 (X509V3_EXT_I2D)i2d_ASN1_OCTET_STRING,
 (X509V3_EXT_I2S)i2s_ASN1_OCTET_STRING,
 (X509V3_EXT_S2I)s2i_skey_id,
 NULL, NULL, NULL, NULL, NULL};
 
-
-static ASN1_OCTET_STRING *octet_string_new(void)
-{
-        return ASN1_OCTET_STRING_new();
-}
-
 char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method,
              ASN1_OCTET_STRING *oct)
 {
@@ -91,13 +84,13 @@ ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method,
         ASN1_OCTET_STRING *oct;
         long length;
 
-        if(!(oct = ASN1_OCTET_STRING_new())) {
+        if(!(oct = M_ASN1_OCTET_STRING_new())) {
                 X509V3err(X509V3_F_S2I_ASN1_OCTET_STRING,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
 
         if(!(oct->data = string_to_hex(str, &length))) {
-                ASN1_OCTET_STRING_free(oct);
+                M_ASN1_OCTET_STRING_free(oct);
                 return NULL;
         }
 
@@ -118,7 +111,7 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
 
         if(strcmp(str, "hash")) return s2i_ASN1_OCTET_STRING(method, ctx, str);
 
-        if(!(oct = ASN1_OCTET_STRING_new())) {
+        if(!(oct = M_ASN1_OCTET_STRING_new())) {
                 X509V3err(X509V3_F_S2I_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -143,7 +136,7 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
         EVP_DigestUpdate(&md, pk->data, pk->length);
         EVP_DigestFinal(&md, pkey_dig, &diglen);
 
-        if(!ASN1_OCTET_STRING_set(oct, pkey_dig, diglen)) {
+        if(!M_ASN1_OCTET_STRING_set(oct, pkey_dig, diglen)) {
                 X509V3err(X509V3_F_S2I_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
@@ -151,6 +144,6 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
         return oct;
         
         err:
-        ASN1_OCTET_STRING_free(oct);
+        M_ASN1_OCTET_STRING_free(oct);
         return NULL;
 }
diff --git a/src/lib/libcrypto/x509v3/v3_sxnet.c b/src/lib/libcrypto/x509v3/v3_sxnet.c
index 0687bb4e3d..20ba8ac8d6 100644
--- a/src/lib/libcrypto/x509v3/v3_sxnet.c
+++ b/src/lib/libcrypto/x509v3/v3_sxnet.c
@@ -111,7 +111,7 @@ SXNET *SXNET_new(void)
         SXNET *ret=NULL;
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, SXNET);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->ids,sk_SXNETID_new_null);
         return (ret);
         M_ASN1_New_Error(ASN1_F_SXNET_NEW);
@@ -130,7 +130,7 @@ SXNET *d2i_SXNET(SXNET **a, unsigned char **pp, long length)
 void SXNET_free(SXNET *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         sk_SXNETID_pop_free(a->ids, SXNETID_free);
         Free (a);
 }
@@ -156,7 +156,7 @@ SXNETID *SXNETID_new(void)
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, SXNETID);
         ret->zone = NULL;
-        M_ASN1_New(ret->user,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->user,M_ASN1_OCTET_STRING_new);
         return (ret);
         M_ASN1_New_Error(ASN1_F_SXNETID_NEW);
 }
@@ -174,8 +174,8 @@ SXNETID *d2i_SXNETID(SXNETID **a, unsigned char **pp, long length)
 void SXNETID_free(SXNETID *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->zone);
-        ASN1_OCTET_STRING_free(a->user);
+        M_ASN1_INTEGER_free(a->zone);
+        M_ASN1_OCTET_STRING_free(a->user);
         Free (a);
 }
 
@@ -193,7 +193,7 @@ static int sxnet_i2r(X509V3_EXT_METHOD *method, SXNET *sx, BIO *out,
                 tmp = i2s_ASN1_INTEGER(NULL, id->zone);
                 BIO_printf(out, "\n%*sZone: %s, User: ", indent, "", tmp);
                 Free(tmp);
-                ASN1_OCTET_STRING_print(out, id->user);
+                M_ASN1_OCTET_STRING_print(out, id->user);
         }
         return 1;
 }
@@ -244,9 +244,9 @@ int SXNET_add_id_ulong(SXNET **psx, unsigned long lzone, char *user,
              int userlen)
 {
         ASN1_INTEGER *izone = NULL;
-        if(!(izone = ASN1_INTEGER_new()) || !ASN1_INTEGER_set(izone, lzone)) {
+        if(!(izone = M_ASN1_INTEGER_new()) || !ASN1_INTEGER_set(izone, lzone)) {
                 X509V3err(X509V3_F_SXNET_ADD_ID_ULONG,ERR_R_MALLOC_FAILURE);
-                ASN1_INTEGER_free(izone);
+                M_ASN1_INTEGER_free(izone);
                 return 0;
         }
         return SXNET_add_id_INTEGER(psx, izone, user, userlen);
@@ -285,7 +285,7 @@ int SXNET_add_id_INTEGER(SXNET **psx, ASN1_INTEGER *zone, char *user,
         if(!(id = SXNETID_new())) goto err;
         if(userlen == -1) userlen = strlen(user);
                 
-        if(!ASN1_OCTET_STRING_set(id->user, user, userlen)) goto err;
+        if(!M_ASN1_OCTET_STRING_set(id->user, user, userlen)) goto err;
         if(!sk_SXNETID_push(sx->ids, id)) goto err;
         id->zone = zone;
         return 1;
@@ -307,7 +307,7 @@ ASN1_OCTET_STRING *SXNET_get_id_asc(SXNET *sx, char *zone)
                 return NULL;
         }
         oct = SXNET_get_id_INTEGER(sx, izone);
-        ASN1_INTEGER_free(izone);
+        M_ASN1_INTEGER_free(izone);
         return oct;
 }
 
@@ -315,13 +315,13 @@ ASN1_OCTET_STRING *SXNET_get_id_ulong(SXNET *sx, unsigned long lzone)
 {
         ASN1_INTEGER *izone = NULL;
         ASN1_OCTET_STRING *oct;
-        if(!(izone = ASN1_INTEGER_new()) || !ASN1_INTEGER_set(izone, lzone)) {
+        if(!(izone = M_ASN1_INTEGER_new()) || !ASN1_INTEGER_set(izone, lzone)) {
                 X509V3err(X509V3_F_SXNET_GET_ID_ULONG,ERR_R_MALLOC_FAILURE);
-                ASN1_INTEGER_free(izone);
+                M_ASN1_INTEGER_free(izone);
                 return NULL;
         }
         oct = SXNET_get_id_INTEGER(sx, izone);
-        ASN1_INTEGER_free(izone);
+        M_ASN1_INTEGER_free(izone);
         return oct;
 }
 
@@ -331,7 +331,7 @@ ASN1_OCTET_STRING *SXNET_get_id_INTEGER(SXNET *sx, ASN1_INTEGER *zone)
         int i;
         for(i = 0; i < sk_SXNETID_num(sx->ids); i++) {
                 id = sk_SXNETID_value(sx->ids, i);
-                if(!ASN1_INTEGER_cmp(id->zone, zone)) return id->user;
+                if(!M_ASN1_INTEGER_cmp(id->zone, zone)) return id->user;
         }
         return NULL;
 }
diff --git a/src/lib/libcrypto/x509v3/v3_utl.c b/src/lib/libcrypto/x509v3/v3_utl.c
index 40f71c71b4..4c2c4a9483 100644
--- a/src/lib/libcrypto/x509v3/v3_utl.c
+++ b/src/lib/libcrypto/x509v3/v3_utl.c
@@ -104,7 +104,7 @@ void X509V3_conf_free(CONF_VALUE *conf)
         if(conf->name) Free(conf->name);
         if(conf->value) Free(conf->value);
         if(conf->section) Free(conf->section);
-        Free((char *)conf);
+        Free(conf);
 }
 
 int X509V3_add_value_bool(const char *name, int asn1_bool,
diff --git a/src/lib/libcrypto/x509v3/v3err.c b/src/lib/libcrypto/x509v3/v3err.c
index 50efa8d99d..b7d4e350c4 100644
--- a/src/lib/libcrypto/x509v3/v3err.c
+++ b/src/lib/libcrypto/x509v3/v3err.c
@@ -72,6 +72,7 @@ static ERR_STRING_DATA X509V3_str_functs[]=
 {ERR_PACK(0,X509V3_F_HEX_TO_STRING,0),  "hex_to_string"},
 {ERR_PACK(0,X509V3_F_I2S_ASN1_ENUMERATED,0),    "i2s_ASN1_ENUMERATED"},
 {ERR_PACK(0,X509V3_F_I2S_ASN1_INTEGER,0),       "i2s_ASN1_INTEGER"},
+{ERR_PACK(0,X509V3_F_I2V_AUTHORITY_INFO_ACCESS,0),      "I2V_AUTHORITY_INFO_ACCESS"},
 {ERR_PACK(0,X509V3_F_NOTICE_SECTION,0), "NOTICE_SECTION"},
 {ERR_PACK(0,X509V3_F_NREF_NOS,0),       "NREF_NOS"},
 {ERR_PACK(0,X509V3_F_POLICY_SECTION,0), "POLICY_SECTION"},
@@ -87,6 +88,7 @@ static ERR_STRING_DATA X509V3_str_functs[]=
 {ERR_PACK(0,X509V3_F_SXNET_ADD_ID_ULONG,0),     "SXNET_add_id_ulong"},
 {ERR_PACK(0,X509V3_F_SXNET_GET_ID_ASC,0),       "SXNET_get_id_asc"},
 {ERR_PACK(0,X509V3_F_SXNET_GET_ID_ULONG,0),     "SXNET_get_id_ulong"},
+{ERR_PACK(0,X509V3_F_V2I_ACCESS_DESCRIPTION,0), "V2I_ACCESS_DESCRIPTION"},
 {ERR_PACK(0,X509V3_F_V2I_ASN1_BIT_STRING,0),    "V2I_ASN1_BIT_STRING"},
 {ERR_PACK(0,X509V3_F_V2I_AUTHORITY_KEYID,0),    "V2I_AUTHORITY_KEYID"},
 {ERR_PACK(0,X509V3_F_V2I_BASIC_CONSTRAINTS,0),  "V2I_BASIC_CONSTRAINTS"},
@@ -102,6 +104,7 @@ static ERR_STRING_DATA X509V3_str_functs[]=
 {ERR_PACK(0,X509V3_F_X509V3_EXT_I2D,0), "X509V3_EXT_i2d"},
 {ERR_PACK(0,X509V3_F_X509V3_GET_VALUE_BOOL,0),  "X509V3_get_value_bool"},
 {ERR_PACK(0,X509V3_F_X509V3_PARSE_LIST,0),      "X509V3_parse_list"},
+{ERR_PACK(0,X509V3_F_X509_PURPOSE_ADD,0),       "X509_PURPOSE_add"},
 {0,NULL}
         };
 
@@ -132,6 +135,7 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {X509V3_R_INVALID_OPTION                 ,"invalid option"},
 {X509V3_R_INVALID_POLICY_IDENTIFIER      ,"invalid policy identifier"},
 {X509V3_R_INVALID_SECTION                ,"invalid section"},
+{X509V3_R_INVALID_SYNTAX                 ,"invalid syntax"},
 {X509V3_R_ISSUER_DECODE_ERROR            ,"issuer decode error"},
 {X509V3_R_MISSING_VALUE                  ,"missing value"},
 {X509V3_R_NEED_ORGANIZATION_AND_NUMBERS  ,"need organization and numbers"},
diff --git a/src/lib/libcrypto/x509v3/x509v3.h b/src/lib/libcrypto/x509v3/x509v3.h
index 4eb04a5a89..fe01755797 100644
--- a/src/lib/libcrypto/x509v3/x509v3.h
+++ b/src/lib/libcrypto/x509v3/x509v3.h
@@ -136,12 +136,6 @@ typedef struct v3_ext_ctx X509V3_CTX;
 #define X509V3_EXT_CTX_DEP      0x2
 #define X509V3_EXT_MULTILINE    0x4
 
-typedef struct BIT_STRING_BITNAME_st {
-int bitnum;
-const char *lname;
-const char *sname;
-} BIT_STRING_BITNAME;
-
 typedef BIT_STRING_BITNAME ENUMERATED_NAMES;
 
 typedef struct BASIC_CONSTRAINTS_st {
@@ -155,6 +149,11 @@ ASN1_GENERALIZEDTIME *notBefore;
 ASN1_GENERALIZEDTIME *notAfter;
 } PKEY_USAGE_PERIOD;
 
+typedef struct otherName_st {
+ASN1_OBJECT *type_id;
+ASN1_TYPE *value;
+} OTHERNAME;
+
 typedef struct GENERAL_NAME_st {
 
 #define GEN_OTHERNAME   (0|V_ASN1_CONTEXT_SPECIFIC)
@@ -174,17 +173,26 @@ union {
         ASN1_OCTET_STRING *ip; /* iPAddress */
         X509_NAME *dirn;                /* dirn */
         ASN1_OBJECT *rid; /* registeredID */
-        ASN1_TYPE *other; /* otherName, ediPartyName, x400Address */
+        OTHERNAME *otherName; /* otherName */
+        ASN1_TYPE *other; /* ediPartyName, x400Address */
 } d;
 } GENERAL_NAME;
 
+typedef struct ACCESS_DESCRIPTION_st {
+ASN1_OBJECT *method;
+GENERAL_NAME *location;
+} ACCESS_DESCRIPTION;
+
 DECLARE_STACK_OF(GENERAL_NAME)
 DECLARE_ASN1_SET_OF(GENERAL_NAME)
 
+DECLARE_STACK_OF(ACCESS_DESCRIPTION)
+DECLARE_ASN1_SET_OF(ACCESS_DESCRIPTION)
+
 typedef struct DIST_POINT_NAME_st {
 /* NB: this is a CHOICE type and only one of these should be set */
 STACK_OF(GENERAL_NAME) *fullname;
-X509_NAME *relativename;
+STACK_OF(X509_NAME_ENTRY) *relativename;
 } DIST_POINT_NAME;
 
 typedef struct DIST_POINT_st {
@@ -255,8 +263,8 @@ DECLARE_ASN1_SET_OF(POLICYINFO)
 #define X509V3_set_ctx_nodb(ctx) ctx->db = NULL;
 
 #define EXT_BITSTRING(nid, table) { nid, 0, \
-                        (X509V3_EXT_NEW)asn1_bit_string_new, \
-                        (X509V3_EXT_FREE)ASN1_STRING_free, \
+                        (X509V3_EXT_NEW)ASN1_BIT_STRING_new, \
+                        (X509V3_EXT_FREE)ASN1_BIT_STRING_free, \
                         (X509V3_EXT_D2I)d2i_ASN1_BIT_STRING, \
                         (X509V3_EXT_I2D)i2d_ASN1_BIT_STRING, \
                         NULL, NULL, \
@@ -266,8 +274,8 @@ DECLARE_ASN1_SET_OF(POLICYINFO)
                         (char *)table}
 
 #define EXT_IA5STRING(nid) { nid, 0, \
-                        (X509V3_EXT_NEW)ia5string_new, \
-                        (X509V3_EXT_FREE)ASN1_STRING_free, \
+                        (X509V3_EXT_NEW)ASN1_IA5STRING_new, \
+                        (X509V3_EXT_FREE)ASN1_IA5STRING_free, \
                         (X509V3_EXT_D2I)d2i_ASN1_IA5STRING, \
                         (X509V3_EXT_I2D)i2d_ASN1_IA5STRING, \
                         (X509V3_EXT_I2S)i2s_ASN1_IA5STRING, \
@@ -279,6 +287,69 @@ DECLARE_ASN1_SET_OF(POLICYINFO)
                          NULL, NULL, NULL, NULL, \
                          NULL}
 
+
+/* X509_PURPOSE stuff */
+
+#define EXFLAG_BCONS            0x1
+#define EXFLAG_KUSAGE           0x2
+#define EXFLAG_XKUSAGE          0x4
+#define EXFLAG_NSCERT           0x8
+
+#define EXFLAG_CA               0x10
+#define EXFLAG_SS               0x20
+#define EXFLAG_V1               0x40
+#define EXFLAG_INVALID          0x80
+#define EXFLAG_SET              0x100
+
+#define KU_DIGITAL_SIGNATURE    0x0080
+#define KU_NON_REPUDIATION      0x0040
+#define KU_KEY_ENCIPHERMENT     0x0020
+#define KU_DATA_ENCIPHERMENT    0x0010
+#define KU_KEY_AGREEMENT        0x0008
+#define KU_KEY_CERT_SIGN        0x0004
+#define KU_CRL_SIGN             0x0002
+#define KU_ENCIPHER_ONLY        0x0001
+#define KU_DECIPHER_ONLY        0x8000
+
+#define NS_SSL_CLIENT           0x80
+#define NS_SSL_SERVER           0x40
+#define NS_SMIME                0x20
+#define NS_OBJSIGN              0x10
+#define NS_SSL_CA               0x04
+#define NS_SMIME_CA             0x02
+#define NS_OBJSIGN_CA           0x01
+
+#define XKU_SSL_SERVER          0x1     
+#define XKU_SSL_CLIENT          0x2
+#define XKU_SMIME               0x4
+#define XKU_CODE_SIGN           0x8
+#define XKU_SGC                 0x10
+
+#define X509_PURPOSE_DYNAMIC    0x1
+#define X509_PURPOSE_DYNAMIC_NAME       0x2
+
+typedef struct x509_purpose_st {
+        int purpose;
+        int trust;              /* Default trust ID */
+        int flags;
+        int (*check_purpose)(struct x509_purpose_st *, X509 *, int);
+        char *name;
+        char *sname;
+        void *usr_data;
+} X509_PURPOSE;
+
+#define X509_PURPOSE_SSL_CLIENT         1
+#define X509_PURPOSE_SSL_SERVER         2
+#define X509_PURPOSE_NS_SSL_SERVER      3
+#define X509_PURPOSE_SMIME_SIGN         4
+#define X509_PURPOSE_SMIME_ENCRYPT      5
+#define X509_PURPOSE_CRL_SIGN           6
+
+#define X509_PURPOSE_MIN                1
+#define X509_PURPOSE_MAX                6
+
+DECLARE_STACK_OF(X509_PURPOSE)
+
 void ERR_load_X509V3_strings(void);
 int i2d_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS *a, unsigned char **pp);
 BASIC_CONSTRAINTS *d2i_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS **a, unsigned char **pp, long length);
@@ -328,6 +399,11 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method,
 STACK_OF(GENERAL_NAME) *v2i_GENERAL_NAMES(X509V3_EXT_METHOD *method,
                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
 
+int i2d_OTHERNAME(OTHERNAME *a, unsigned char **pp);
+OTHERNAME *OTHERNAME_new(void);
+OTHERNAME *d2i_OTHERNAME(OTHERNAME **a, unsigned char **pp, long length);
+void OTHERNAME_free(OTHERNAME *a);
+
 char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *ia5);
 ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
 
@@ -380,12 +456,27 @@ void DIST_POINT_NAME_free(DIST_POINT_NAME *a);
 DIST_POINT_NAME *d2i_DIST_POINT_NAME(DIST_POINT_NAME **a, unsigned char **pp,
              long length);
 
+int i2d_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION *a, unsigned char **pp);
+ACCESS_DESCRIPTION *ACCESS_DESCRIPTION_new(void);
+void ACCESS_DESCRIPTION_free(ACCESS_DESCRIPTION *a);
+ACCESS_DESCRIPTION *d2i_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION **a, unsigned char **pp,
+             long length);
+
+STACK_OF(ACCESS_DESCRIPTION) *AUTHORITY_INFO_ACCESS_new(void);
+void AUTHORITY_INFO_ACCESS_free(STACK_OF(ACCESS_DESCRIPTION) *a);
+STACK_OF(ACCESS_DESCRIPTION) *d2i_AUTHORITY_INFO_ACCESS(STACK_OF(ACCESS_DESCRIPTION) **a,
+                                         unsigned char **pp, long length);
+int i2d_AUTHORITY_INFO_ACCESS(STACK_OF(ACCESS_DESCRIPTION) *a, unsigned char **pp);
+
+
+
 #ifdef HEADER_CONF_H
 GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, CONF_VALUE *cnf);
 void X509V3_conf_free(CONF_VALUE *val);
 X509_EXTENSION *X509V3_EXT_conf_nid(LHASH *conf, X509V3_CTX *ctx, int ext_nid, char *value);
 X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name, char *value);
 int X509V3_EXT_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509 *cert);
+int X509V3_EXT_REQ_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509_REQ *req);
 int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509_CRL *crl);
 int X509V3_add_value_bool_nf(char *name, int asn1_bool,
                                                 STACK_OF(CONF_VALUE) **extlist);
@@ -423,6 +514,8 @@ X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid);
 int X509V3_add_standard_extensions(void);
 STACK_OF(CONF_VALUE) *X509V3_parse_list(char *line);
 void *X509V3_EXT_d2i(X509_EXTENSION *ext);
+void *X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx);
+
 X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc);
 
 char *hex_to_string(unsigned char *buffer, long len);
@@ -434,6 +527,20 @@ void X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent,
 int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, int flag, int indent);
 int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 
+int X509_check_purpose(X509 *x, int id, int ca);
+int X509_PURPOSE_get_count(void);
+X509_PURPOSE * X509_PURPOSE_get0(int idx);
+int X509_PURPOSE_get_by_sname(char *sname);
+int X509_PURPOSE_get_by_id(int id);
+int X509_PURPOSE_add(int id, int trust, int flags,
+                        int (*ck)(X509_PURPOSE *, X509 *, int),
+                                char *name, char *sname, void *arg);
+char *X509_PURPOSE_get0_name(X509_PURPOSE *xp);
+char *X509_PURPOSE_get0_sname(X509_PURPOSE *xp);
+int X509_PURPOSE_get_trust(X509_PURPOSE *xp);
+void X509_PURPOSE_cleanup(void);
+int X509_PURPOSE_get_id(X509_PURPOSE *);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -449,6 +556,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 #define X509V3_F_HEX_TO_STRING                           111
 #define X509V3_F_I2S_ASN1_ENUMERATED                     121
 #define X509V3_F_I2S_ASN1_INTEGER                        120
+#define X509V3_F_I2V_AUTHORITY_INFO_ACCESS               138
 #define X509V3_F_NOTICE_SECTION                          132
 #define X509V3_F_NREF_NOS                                133
 #define X509V3_F_POLICY_SECTION                          131
@@ -464,6 +572,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 #define X509V3_F_SXNET_ADD_ID_ULONG                      127
 #define X509V3_F_SXNET_GET_ID_ASC                        128
 #define X509V3_F_SXNET_GET_ID_ULONG                      129
+#define X509V3_F_V2I_ACCESS_DESCRIPTION                  139
 #define X509V3_F_V2I_ASN1_BIT_STRING                     101
 #define X509V3_F_V2I_AUTHORITY_KEYID                     119
 #define X509V3_F_V2I_BASIC_CONSTRAINTS                   102
@@ -479,6 +588,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 #define X509V3_F_X509V3_EXT_I2D                          136
 #define X509V3_F_X509V3_GET_VALUE_BOOL                   110
 #define X509V3_F_X509V3_PARSE_LIST                       109
+#define X509V3_F_X509_PURPOSE_ADD                        137
 
 /* Reason codes. */
 #define X509V3_R_BAD_IP_ADDRESS                          118
@@ -506,6 +616,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 #define X509V3_R_INVALID_OPTION                          138
 #define X509V3_R_INVALID_POLICY_IDENTIFIER               134
 #define X509V3_R_INVALID_SECTION                         135
+#define X509V3_R_INVALID_SYNTAX                          143
 #define X509V3_R_ISSUER_DECODE_ERROR                     126
 #define X509V3_R_MISSING_VALUE                           124
 #define X509V3_R_NEED_ORGANIZATION_AND_NUMBERS           142
diff --git a/src/lib/libssl/LICENSE b/src/lib/libssl/LICENSE
index b9e18d5e7b..bdd5f7bdd0 100644
--- a/src/lib/libssl/LICENSE
+++ b/src/lib/libssl/LICENSE
@@ -12,7 +12,7 @@
   ---------------
 
 /* ====================================================================
- * Copyright (c) 1998-1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/src/lib/libssl/bio_ssl.c b/src/lib/libssl/bio_ssl.c
index f62cde4e5d..d73c41adcd 100644
--- a/src/lib/libssl/bio_ssl.c
+++ b/src/lib/libssl/bio_ssl.c
@@ -71,6 +71,7 @@ static int ssl_puts(BIO *h,char *str);
 static long ssl_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int ssl_new(BIO *h);
 static int ssl_free(BIO *data);
+static long ssl_callback_ctrl(BIO *h,int cmd,void (*fp)());
 typedef struct bio_ssl_st
         {
         SSL *ssl; /* The ssl handle :-) */
@@ -92,6 +93,7 @@ static BIO_METHOD methods_sslp=
         ssl_ctrl,
         ssl_new,
         ssl_free,
+        ssl_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_ssl(void)
@@ -444,7 +446,14 @@ static long ssl_ctrl(BIO *b, int cmd, long num, char *ptr)
                 ret=BIO_ctrl(ssl->rbio,cmd,num,ptr);
                 break;
         case BIO_CTRL_SET_CALLBACK:
-                SSL_set_info_callback(ssl,(void (*)())ptr);
+                {
+#if 0 /* FIXME: Should this be used?  -- Richard Levitte */
+                BIOerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ret = -1;
+#else
+                ret=0;
+#endif
+                }
                 break;
         case BIO_CTRL_GET_CALLBACK:
                 {
@@ -461,6 +470,28 @@ static long ssl_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long ssl_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        SSL *ssl;
+        BIO_SSL *bs;
+        long ret=1;
+
+        bs=(BIO_SSL *)b->ptr;
+        ssl=bs->ssl;
+        switch (cmd)
+                {
+        case BIO_CTRL_SET_CALLBACK:
+                {
+                SSL_set_info_callback(ssl,fp);
+                }
+                break;
+        default:
+                ret=BIO_callback_ctrl(ssl->rbio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int ssl_puts(BIO *bp, char *str)
         {
         int n,ret;
diff --git a/src/lib/libssl/crypto-patent/Makefile b/src/lib/libssl/crypto-patent/Makefile
index 3d792a5a52..d97dd41bbd 100644
--- a/src/lib/libssl/crypto-patent/Makefile
+++ b/src/lib/libssl/crypto-patent/Makefile
@@ -18,13 +18,13 @@ CFLAGS+= -DL_ENDIAN
 CFLAGS+= -DB_ENDIAN
 .endif
 .endif
-.endif
+.endif 
 
 CFLAGS+= -DNO_IDEA -DTERMIOS -DANSI_SOURCE -DNO_ERR -DNO_WINDOWS_BRAINDEATH
 CFLAGS+= -I${.CURDIR}/../${SSLEAYDIST}
 CFLAGS+= -I${LCRYPTO_SRC}
 CFLAGS+= -I${LCRYPTO_INC}
-SRCS+=  cryptlib.c ex_data.c cpt_err.c mem.c tmdiff.c cversion.c
+SRCS+=  cryptlib.c ex_data.c cpt_err.c mem.c mem_dbg.c tmdiff.c cversion.c
 CFLAGS+= -I${LCRYPTO_SRC}/md2
 SRCS+=  md2_dgst.c md2_one.c                                    
 CFLAGS+= -I${LCRYPTO_SRC}/md5
@@ -66,14 +66,14 @@ SRCS+=	bn_mul.c bn_print.c bn_rand.c bn_shift.c
 SRCS+=  bn_word.c bn_blind.c bn_gcd.c bn_prime.c bn_err.c
 SRCS+=  bn_sqr.c bn_recp.c bn_mont.c bn_mpi.c bn_asm.c 
 #SRCS+= bn_comba.c d.c exp.c
-SRCS+=  bn_exp2.c
+SRCS+=  bn_exp2.c bn_ctx.c
 CFLAGS+= -I${LCRYPTO_SRC}/rsa
 SRCS+=  rsa_eay.c rsa_gen.c rsa_lib.c rsa_sign.c
 SRCS+=  rsa_saos.c rsa_err.c rsa_pk1.c rsa_ssl.c
-SRCS+=  rsa_none.c rsa_chk.c rsa_oaep.c
+SRCS+=  rsa_none.c rsa_chk.c rsa_oaep.c rsa_null.c
 CFLAGS+= -I${LCRYPTO_SRC}/dsa
 SRCS+=  dsa_gen.c dsa_key.c dsa_lib.c dsa_vrf.c         
-SRCS+=  dsa_sign.c dsa_err.c dsa_asn1.c                                 
+SRCS+=  dsa_sign.c dsa_err.c dsa_asn1.c dsa_ossl.c
 CFLAGS+= -I${LCRYPTO_SRC}/dh
 SRCS+=  dh_gen.c dh_key.c dh_lib.c dh_check.c dh_err.c  
 CFLAGS+= -I${LCRYPTO_SRC}/buffer
@@ -89,7 +89,7 @@ SRCS+=	stack.c
 CFLAGS+= -I${LCRYPTO_SRC}/lhash
 SRCS+=  lhash.c lh_stats.c                                      
 CFLAGS+= -I${LCRYPTO_SRC}/rand
-SRCS+=  md_rand.c randfile.c rand_lib.c                                 
+SRCS+=  md_rand.c randfile.c rand_lib.c rand_egd.c rand_err.c
 CFLAGS+= -I${LCRYPTO_SRC}/err
 SRCS+=  err.c err_all.c err_prn.c                               
 CFLAGS+= -I${LCRYPTO_SRC}/objects
@@ -108,7 +108,7 @@ SRCS+=	m_md2.c m_md5.c m_sha.c m_sha1.c m_dss.c
 SRCS+=  m_dss1.c m_mdc2.c m_ripemd.c p_open.c           
 SRCS+=  p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c
 SRCS+=  p_dec.c bio_md.c bio_b64.c bio_enc.c            
-SRCS+=  evp_err.c e_null.c c_all.c evp_lib.c
+SRCS+=  evp_err.c e_null.c c_all.c c_allc.c c_alld.c evp_lib.c
 SRCS+=  bio_ok.c evp_pbe.c evp_pkey.c p5_crpt.c p5_crpt2.c
 CFLAGS+= -I${LCRYPTO_SRC}/pem
 SRCS+=  pem_sign.c pem_seal.c pem_info.c pem_lib.c      
@@ -133,30 +133,32 @@ SRCS+=	a_bool.c x_exten.c asn1_par.c asn1_lib.c
 SRCS+=  asn1_err.c a_meth.c a_bytes.c evp_asn1.c
 SRCS+=  a_enum.c a_gentm.c a_time.c a_utf8.c a_vis.c 
 SRCS+=  asn_pack.c f_enum.c nsseq.c p5_pbe.c p5_pbev2.c 
-SRCS+=  p8_pkey.c t_crl.c
+SRCS+=  p8_pkey.c t_crl.c a_meth.c a_null.c a_strnid.c a_mbstr.c
+#SRCS+= p8_key.c t_bitst.c t_spki.c t_x509a.c x_x509a.c
+SRCS+=  t_bitst.c t_spki.c t_x509a.c x_x509a.c
 CFLAGS+= -I${LCRYPTO_SRC}/x509
 SRCS+=  x509_def.c x509_d2.c x509_r2x.c x509_cmp.c      
 SRCS+=  x509_obj.c x509_req.c x509_vfy.c x509_set.c     
 SRCS+=  x509rset.c x509_err.c x509name.c x509_v3.c      
-SRCS+=  x509_ext.c x509type.c x509_lu.c 
+SRCS+=  x509_ext.c x509type.c x509_lu.c x509_trs.c x509spki.c
 SRCS+=  x_all.c x509_txt.c by_file.c by_dir.c   
 CFLAGS+= -I${LCRYPTO_SRC}/x509v3
 SRCS+=  v3_akey.c v3_alt.c v3_bcons.c v3_bitst.c v3_conf.c v3_cpols.c
 SRCS+=  v3_crld.c v3_enum.c v3_extku.c v3_genn.c v3_ia5.c v3_int.c
 SRCS+=  v3_lib.c v3_pku.c v3_prn.c v3_skey.c v3_sxnet.c v3_utl.c
-SRCS+=  v3err.c
+SRCS+=  v3err.c v3_info.c v3_purp.c
 CFLAGS+= -I${LCRYPTO_SRC}/conf
 SRCS+=  conf.c conf_err.c                                       
 CFLAGS+= -I${LCRYPTO_SRC}/txt_db
 SRCS+=  txt_db.c                                                        
 CFLAGS+= -I${LCRYPTO_SRC}/pkcs7
-SRCS+=  pk7_lib.c pkcs7err.c pk7_doit.c 
+SRCS+=  pk7_lib.c pkcs7err.c pk7_doit.c pk7_attr.c pk7_mime.c pk7_smime.c
 CFLAGS+= -I${LCRYPTO_SRC}/comp
 SRCS+=  c_rle.c c_zlib.c comp_err.c comp_lib.c
 CFLAGS+= -I${LCRYPTO_SRC}/pkcs12
 SRCS+=  p12_add.c p12_attr.c p12_bags.c p12_crpt.c p12_crt.c
 SRCS+=  p12_decr.c p12_init.c p12_key.c p12_kiss.c p12_lib.c p12_mac.c
-SRCS+=  p12_mutl.c p12_sbag.c p12_utl.c pk12err.c
+SRCS+=  p12_mutl.c p12_sbag.c p12_utl.c pk12err.c p12_npas.c
 
 HDRS= asn1.h dh.h md5.h rc4.h stack.h asn1_mac.h dsa.h mdc2.h rc5.h     \
       tls1.h bio.h e_os.h objects.h ripemd.h tmdiff.h blowfish.h        \
diff --git a/src/lib/libssl/crypto-patent/shlib_version b/src/lib/libssl/crypto-patent/shlib_version
index c6e3f4d3fc..b363be4447 100644
--- a/src/lib/libssl/crypto-patent/shlib_version
+++ b/src/lib/libssl/crypto-patent/shlib_version
@@ -1,2 +1,2 @@
 major=2
-minor=1
+minor=3
diff --git a/src/lib/libssl/crypto/Makefile b/src/lib/libssl/crypto/Makefile
index 1dea336f27..516217e648 100644
--- a/src/lib/libssl/crypto/Makefile
+++ b/src/lib/libssl/crypto/Makefile
@@ -24,7 +24,7 @@ CFLAGS+= -DNO_IDEA -DTERMIOS -DANSI_SOURCE -DNO_ERR -DNO_WINDOWS_BRAINDEATH
 CFLAGS+= -I${.CURDIR}/../${SSLEAYDIST}
 CFLAGS+= -I${LCRYPTO_SRC}
 CFLAGS+= -I${LCRYPTO_INC}
-SRCS+=  cryptlib.c ex_data.c cpt_err.c mem.c tmdiff.c cversion.c
+SRCS+=  cryptlib.c ex_data.c cpt_err.c mem.c mem_dbg.c tmdiff.c cversion.c
 CFLAGS+= -I${LCRYPTO_SRC}/md2
 SRCS+=  md2_dgst.c md2_one.c                                    
 CFLAGS+= -I${LCRYPTO_SRC}/md5
@@ -66,14 +66,14 @@ SRCS+=	bn_mul.c bn_print.c bn_rand.c bn_shift.c
 SRCS+=  bn_word.c bn_blind.c bn_gcd.c bn_prime.c bn_err.c
 SRCS+=  bn_sqr.c bn_recp.c bn_mont.c bn_mpi.c bn_asm.c 
 #SRCS+= bn_comba.c d.c exp.c
-SRCS+=  bn_exp2.c
+SRCS+=  bn_exp2.c bn_ctx.c
 CFLAGS+= -I${LCRYPTO_SRC}/rsa
 SRCS+=  rsa_eay.c rsa_gen.c rsa_lib.c rsa_sign.c
 SRCS+=  rsa_saos.c rsa_err.c rsa_pk1.c rsa_ssl.c
-SRCS+=  rsa_none.c rsa_chk.c rsa_oaep.c
+SRCS+=  rsa_none.c rsa_chk.c rsa_oaep.c rsa_null.c
 CFLAGS+= -I${LCRYPTO_SRC}/dsa
 SRCS+=  dsa_gen.c dsa_key.c dsa_lib.c dsa_vrf.c         
-SRCS+=  dsa_sign.c dsa_err.c dsa_asn1.c                                 
+SRCS+=  dsa_sign.c dsa_err.c dsa_asn1.c dsa_ossl.c
 CFLAGS+= -I${LCRYPTO_SRC}/dh
 SRCS+=  dh_gen.c dh_key.c dh_lib.c dh_check.c dh_err.c  
 CFLAGS+= -I${LCRYPTO_SRC}/buffer
@@ -89,7 +89,7 @@ SRCS+=	stack.c
 CFLAGS+= -I${LCRYPTO_SRC}/lhash
 SRCS+=  lhash.c lh_stats.c                                      
 CFLAGS+= -I${LCRYPTO_SRC}/rand
-SRCS+=  md_rand.c randfile.c rand_lib.c                                 
+SRCS+=  md_rand.c randfile.c rand_lib.c rand_egd.c rand_err.c
 CFLAGS+= -I${LCRYPTO_SRC}/err
 SRCS+=  err.c err_all.c err_prn.c                               
 CFLAGS+= -I${LCRYPTO_SRC}/objects
@@ -108,7 +108,7 @@ SRCS+=	m_md2.c m_md5.c m_sha.c m_sha1.c m_dss.c
 SRCS+=  m_dss1.c m_mdc2.c m_ripemd.c p_open.c           
 SRCS+=  p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c
 SRCS+=  p_dec.c bio_md.c bio_b64.c bio_enc.c            
-SRCS+=  evp_err.c e_null.c c_all.c evp_lib.c
+SRCS+=  evp_err.c e_null.c c_all.c c_allc.c c_alld.c evp_lib.c
 SRCS+=  bio_ok.c evp_pbe.c evp_pkey.c p5_crpt.c p5_crpt2.c
 CFLAGS+= -I${LCRYPTO_SRC}/pem
 SRCS+=  pem_sign.c pem_seal.c pem_info.c pem_lib.c      
@@ -133,30 +133,32 @@ SRCS+=	a_bool.c x_exten.c asn1_par.c asn1_lib.c
 SRCS+=  asn1_err.c a_meth.c a_bytes.c evp_asn1.c
 SRCS+=  a_enum.c a_gentm.c a_time.c a_utf8.c a_vis.c 
 SRCS+=  asn_pack.c f_enum.c nsseq.c p5_pbe.c p5_pbev2.c 
-SRCS+=  p8_pkey.c t_crl.c
+SRCS+=  p8_pkey.c t_crl.c a_meth.c a_null.c a_strnid.c a_mbstr.c
+#SRCS+= p8_key.c t_bitst.c t_spki.c t_x509a.c x_x509a.c
+SRCS+=  t_bitst.c t_spki.c t_x509a.c x_x509a.c
 CFLAGS+= -I${LCRYPTO_SRC}/x509
 SRCS+=  x509_def.c x509_d2.c x509_r2x.c x509_cmp.c      
 SRCS+=  x509_obj.c x509_req.c x509_vfy.c x509_set.c     
 SRCS+=  x509rset.c x509_err.c x509name.c x509_v3.c      
-SRCS+=  x509_ext.c x509type.c x509_lu.c 
+SRCS+=  x509_ext.c x509type.c x509_lu.c x509_trs.c x509spki.c
 SRCS+=  x_all.c x509_txt.c by_file.c by_dir.c   
 CFLAGS+= -I${LCRYPTO_SRC}/x509v3
 SRCS+=  v3_akey.c v3_alt.c v3_bcons.c v3_bitst.c v3_conf.c v3_cpols.c
 SRCS+=  v3_crld.c v3_enum.c v3_extku.c v3_genn.c v3_ia5.c v3_int.c
 SRCS+=  v3_lib.c v3_pku.c v3_prn.c v3_skey.c v3_sxnet.c v3_utl.c
-SRCS+=  v3err.c
+SRCS+=  v3err.c v3_info.c v3_purp.c
 CFLAGS+= -I${LCRYPTO_SRC}/conf
 SRCS+=  conf.c conf_err.c                                       
 CFLAGS+= -I${LCRYPTO_SRC}/txt_db
 SRCS+=  txt_db.c                                                        
 CFLAGS+= -I${LCRYPTO_SRC}/pkcs7
-SRCS+=  pk7_lib.c pkcs7err.c pk7_doit.c 
+SRCS+=  pk7_lib.c pkcs7err.c pk7_doit.c pk7_attr.c pk7_mime.c pk7_smime.c
 CFLAGS+= -I${LCRYPTO_SRC}/comp
 SRCS+=  c_rle.c c_zlib.c comp_err.c comp_lib.c
 CFLAGS+= -I${LCRYPTO_SRC}/pkcs12
 SRCS+=  p12_add.c p12_attr.c p12_bags.c p12_crpt.c p12_crt.c
 SRCS+=  p12_decr.c p12_init.c p12_key.c p12_kiss.c p12_lib.c p12_mac.c
-SRCS+=  p12_mutl.c p12_sbag.c p12_utl.c pk12err.c
+SRCS+=  p12_mutl.c p12_sbag.c p12_utl.c pk12err.c p12_npas.c
 
 HDRS= asn1.h dh.h md5.h rc4.h stack.h asn1_mac.h dsa.h mdc2.h rc5.h     \
       tls1.h bio.h e_os.h objects.h ripemd.h tmdiff.h blowfish.h        \
diff --git a/src/lib/libssl/crypto/shlib_version b/src/lib/libssl/crypto/shlib_version
index b52599a164..ba5a3fee58 100644
--- a/src/lib/libssl/crypto/shlib_version
+++ b/src/lib/libssl/crypto/shlib_version
@@ -1,2 +1,2 @@
 major=2
-minor=0
+minor=2
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf
index d70dd25622..dbe8cbefe0 100644
--- a/src/lib/libssl/doc/openssl.cnf
+++ b/src/lib/libssl/doc/openssl.cnf
@@ -3,8 +3,13 @@
 # This is mostly being used for generation of certificate requests.
 #
 
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME                    = .
 RANDFILE                = $ENV::HOME/.rnd
-oid_file                = $ENV::HOME/.oid
+
+# Extra OBJECT IDENTIFIER info:
+#oid_file               = $ENV::HOME/.oid
 oid_section             = new_oids
 
 # To use this configuration file with the "-extfile" option of the
@@ -86,6 +91,22 @@ distinguished_name	= req_distinguished_name
 attributes              = req_attributes
 x509_extensions = v3_ca # The extentions to add to the self signed cert
 
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options. 
+# default: PrintableString, T61String, BMPString.
+# pkix   : PrintableString, BMPString.
+# utf8only: only UTF8Strings.
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
+# so use this option with caution!
+string_mask = nombstr
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
 [ req_distinguished_name ]
 countryName                     = Country Name (2 letter code)
 countryName_default             = AU
@@ -170,8 +191,16 @@ authorityKeyIdentifier=keyid,issuer:always
 #nsCaPolicyUrl
 #nsSslServerName
 
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
 [ v3_ca ]
 
+
 # Extensions for a typical CA
 
 
@@ -200,10 +229,11 @@ basicConstraints = CA:true
 # Copy issuer details
 # issuerAltName=issuer:copy
 
-# RAW DER hex encoding of an extension: beware experts only!
-# 1.2.3.5=RAW:02:03
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
 # You can even override a supported extension:
-# basicConstraints= critical, RAW:30:03:01:01:FF
+# basicConstraints= critical, DER:30:03:01:01:FF
 
 [ crl_ext ]
 
diff --git a/src/lib/libssl/doc/openssl.txt b/src/lib/libssl/doc/openssl.txt
index 91b85e5f14..880eace4da 100644
--- a/src/lib/libssl/doc/openssl.txt
+++ b/src/lib/libssl/doc/openssl.txt
@@ -1,53 +1,12 @@
 
 This is some preliminary documentation for OpenSSL.
 
-==============================================================================
-                            BUFFER Library
-==============================================================================
-
-The buffer library handles simple character arrays. Buffers are used for
-various purposes in the library, most notably memory BIOs.
-
-The library uses the BUF_MEM structure defined in buffer.h:
-
-typedef struct buf_mem_st
-{
-        int length;     /* current number of bytes */
-        char *data;
-        int max;        /* size of buffer */
-} BUF_MEM;
-
-'length' is the current size of the buffer in bytes, 'max' is the amount of
-memory allocated to the buffer. There are three functions which handle these
-and one "miscellaneous" function.
-
-BUF_MEM *BUF_MEM_new()
-
-This allocates a new buffer of zero size. Returns the buffer or NULL on error.
-
-void BUF_MEM_free(BUF_MEM *a)
-
-This frees up an already existing buffer. The data is zeroed before freeing
-up in case the buffer contains sensitive data.
-
-int BUF_MEM_grow(BUF_MEM *str, int len)
-
-This changes the size of an already existing buffer. It returns zero on error
-or the new size (i.e. 'len'). Any data already in the buffer is preserved if
-it increases in size.
-
-char * BUF_strdup(char *str)
+Contents:
 
-This is the previously mentioned strdup function: like the standard library
-strdup() it copies a null terminated string into a block of allocated memory
-and returns a pointer to the allocated block.
+ OpenSSL X509V3 extension configuration
+ X509V3 Extension code: programmers guide
+ PKCS#12 Library
 
-Unlike the standard C library strdup() this function uses Malloc() and so
-should be used in preference to the standard library strdup() because it can
-be used for memory leak checking or replacing the malloc() function.
-
-The memory allocated from BUF_strdup() should be freed up using the Free()
-function.
 
 ==============================================================================
                OpenSSL X509V3 extension configuration
@@ -188,7 +147,7 @@ email.1=steve@here
 email.2=steve@there
 
 This is because the configuration file code cannot handle the same name
-occurring twice in the same extension.
+occurring twice in the same section.
 
 The syntax of raw extensions is governed by the extension code: it can
 for example contain data in multiple sections. The correct syntax to
@@ -315,6 +274,41 @@ TRUE. An end user certificate MUST NOT have the CA value set to true.
 According to PKIX recommendations it should exclude the extension entirely,
 however some software may require CA set to FALSE for end entity certificates.
 
+Extended Key Usage.
+
+This extensions consists of a list of usages.
+
+These can either be object short names of the dotted numerical form of OIDs.
+While any OID can be used only certain values make sense. In particular the
+following PKIX, NS and MS values are meaningful:
+
+Value                   Meaning
+-----                   -------
+serverAuth              SSL/TLS Web Server Authentication.
+clientAuth              SSL/TLS Web Client Authentication.
+codeSigning             Code signing.
+emailProtection         E-mail Protection (S/MIME).
+timeStamping            Trusted Timestamping
+msCodeInd               Microsoft Individual Code Signing (authenticode)
+msCodeCom               Microsoft Commercial Code Signing (authenticode)
+msCTLSign               Microsoft Trust List Signing
+msSGC                   Microsoft Server Gated Crypto
+msEFS                   Microsoft Encrypted File System
+nsSGC                   Netscape Server Gated Crypto
+
+For example, under IE5 a CA can be used for any purpose: by including a list
+of the above usages the CA can be restricted to only authorised uses.
+
+Note: software packages may place additional interpretations on certificate 
+use, in particular some usages may only work for selected CAs. Don't for example
+expect just including msSGC or nsSGC will automatically mean that a certificate
+can be used for SGC ("step up" encryption) otherwise anyone could use it.
+
+Examples:
+
+extendedKeyUsage=critical,codeSigning,1.2.3.4
+extendedKeyUsage=nsSGC,msSGC
+
 Subject Key Identifier.
 
 This is really a string extension and can take two possible values. Either
@@ -459,16 +453,16 @@ extension in a human or machine readable form.
 
 1. Initialisation and cleanup.
 
-X509V3_add_standard_extensions();
-
-This function should be called before any other extension code. It adds support
-for some common PKIX and Netscape extensions. Additional custom extensions can
-be added as well (see later).
+No special initialisation is needed before calling the extension functions.
+You used to have to call X509V3_add_standard_extensions(); but this is no longer
+required and this function no longer does anything.
 
 void X509V3_EXT_cleanup(void);
 
-This function should be called last to cleanup the extension code. After this
-call no other extension calls should be made.
+This function should be called to cleanup the extension code if any custom
+extensions have been added. If no custom extensions have been added then this
+call does nothing. After this call all custom extension code is freed up but
+you can still use the standard extensions.
 
 2. Printing and parsing extensions.
 
@@ -512,7 +506,7 @@ or CRL is due to be signed. Both return 0 on error on non zero for success.
 In each case 'conf' is the LHASH pointer of the configuration file to use
 and 'section' is the section containing the extension details.
 
-See the 'context functions' section for a description of the ctx paramater.
+See the 'context functions' section for a description of the ctx parameter.
 
 
 X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name,
@@ -531,7 +525,7 @@ takes the NID of the extension rather than its name.
 For example to produce basicConstraints with the CA flag and a path length of
 10:
 
-x = X509V3_EXT_conf_nid(NULL, NULL, NID_basicConstraints, "CA:TRUE,pathlen:10");
+x = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints,"CA:TRUE,pathlen:10");
 
 
 X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc);
@@ -659,7 +653,7 @@ The same as above but for an unsigned character value.
 int X509V3_add_value_bool(const char *name, int asn1_bool,
                                                 STACK_OF(CONF_VALUE) **extlist);
 
-This adds either "TRUE" or "FALSE" depending on the value of 'ans1_bool'
+This adds either "TRUE" or "FALSE" depending on the value of 'asn1_bool'
 
 int X509V3_add_value_bool_nf(char *name, int asn1_bool,
                                                 STACK_OF(CONF_VALUE) **extlist);
@@ -686,7 +680,7 @@ Multi value extensions are passed a STACK_OF(CONF_VALUE) name and value pairs
 or return a STACK_OF(CONF_VALUE).
 
 Raw extensions are just passed a BIO or a value and it is the extensions
-responsiblity to handle all the necessary printing.
+responsibility to handle all the necessary printing.
 
 There are two ways to add an extension. One is simply as an alias to an already
 existing extension. An alias is an extension that is identical in ASN1 structure
@@ -811,7 +805,7 @@ int i2r(struct v3_ext_method *method, void *ext, BIO *out, int indent);
 
 This function is passed the internal extension structure in the ext parameter
 and sends out a human readable version of the extension to out. The 'indent'
-paremeter should be noted to determine the necessary amount of indentation
+parameter should be noted to determine the necessary amount of indentation
 needed on the output.
 
 void * r2i(struct v3_ext_method *method, struct v3_ext_ctx *ctx, char *str);
@@ -882,7 +876,7 @@ d2i_PKCS12_fp(fp, p12)
 
 This is the same but for a FILE pointer.
 
-3. Parsing and creation functions.
+3. High level functions.
 
 3.1 Parsing with PKCS12_parse().
 
@@ -920,6 +914,14 @@ p12 = PKCS12_create(pass, "My Certificate", pkey, cert, NULL, 0,0,0,0,0);
 i2d_PKCS12_fp(fp, p12);
 PKCS12_free(p12);
 
+3.3 Changing a PKCS#12 structure password.
+
+int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass);
+
+This changes the password of an already existing PKCS#12 structure. oldpass
+is the old password and newpass is the new one. An error occurs if the old
+password is incorrect.
+
 LOW LEVEL FUNCTIONS.
 
 In some cases the high level functions do not provide the necessary
diff --git a/src/lib/libssl/s23_clnt.c b/src/lib/libssl/s23_clnt.c
index 299d2ae5d2..aaedf6a9bb 100644
--- a/src/lib/libssl/s23_clnt.c
+++ b/src/lib/libssl/s23_clnt.c
@@ -68,8 +68,10 @@ static int ssl23_client_hello(SSL *s);
 static int ssl23_get_server_hello(SSL *s);
 static SSL_METHOD *ssl23_get_client_method(int ver)
         {
+#ifndef NO_SSL2
         if (ver == SSL2_VERSION)
                 return(SSLv2_client_method());
+#endif
         if (ver == SSL3_VERSION)
                 return(SSLv3_client_method());
         else if (ver == TLS1_VERSION)
@@ -102,7 +104,7 @@ int ssl23_connect(SSL *s)
         int ret= -1;
         int new_state,state;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -222,7 +224,7 @@ static int ssl23_client_hello(SSL *s)
 #endif
 
                 p=s->s3->client_random;
-                RAND_bytes(p,SSL3_RANDOM_SIZE);
+                RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE);
 
                 /* Do the message type and length last */
                 d= &(buf[2]);
@@ -283,7 +285,7 @@ static int ssl23_client_hello(SSL *s)
                         i=ch_len;
                 s2n(i,d);
                 memset(&(s->s3->client_random[0]),0,SSL3_RANDOM_SIZE);
-                RAND_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
+                RAND_pseudo_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
                 memcpy(p,&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
                 p+=i;
 
@@ -307,7 +309,7 @@ static int ssl23_get_server_hello(SSL *s)
         {
         char buf[8];
         unsigned char *p;
-        int i,ch_len;
+        int i;
         int n;
 
         n=ssl23_read_bytes(s,7);
@@ -320,9 +322,14 @@ static int ssl23_get_server_hello(SSL *s)
         if ((p[0] & 0x80) && (p[2] == SSL2_MT_SERVER_HELLO) &&
                 (p[5] == 0x00) && (p[6] == 0x02))
                 {
+#ifdef NO_SSL2
+                SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
+                goto err;
+#else
                 /* we are talking sslv2 */
                 /* we need to clean up the SSLv3 setup and put in the
                  * sslv2 stuff. */
+                int ch_len;
 
                 if (s->options & SSL_OP_NO_SSLv2)
                         {
@@ -375,6 +382,7 @@ static int ssl23_get_server_hello(SSL *s)
 
                 s->method=SSLv2_client_method();
                 s->handshake_func=s->method->ssl_connect;
+#endif
                 }
         else if ((p[0] == SSL3_RT_HANDSHAKE) &&
                  (p[1] == SSL3_VERSION_MAJOR) &&
diff --git a/src/lib/libssl/s23_lib.c b/src/lib/libssl/s23_lib.c
index 822a395837..dded7a19c5 100644
--- a/src/lib/libssl/s23_lib.c
+++ b/src/lib/libssl/s23_lib.c
@@ -67,7 +67,7 @@ static int ssl23_write(SSL *s, const void *buf, int len);
 static long ssl23_default_timeout(void );
 static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
 static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p);
-char *SSL23_version_str="SSLv2/3 compatibility" OPENSSL_VERSION_PTEXT;
+const char *SSL23_version_str="SSLv2/3 compatibility" OPENSSL_VERSION_PTEXT;
 
 static SSL_METHOD SSLv23_data= {
         TLS1_VERSION,
@@ -92,6 +92,9 @@ static SSL_METHOD SSLv23_data= {
         ssl_bad_method,
         ssl23_default_timeout,
         &ssl3_undef_enc_method,
+        ssl_undefined_function,
+        ssl3_callback_ctrl,
+        ssl3_ctx_callback_ctrl,
         };
 
 static long ssl23_default_timeout(void)
@@ -106,7 +109,11 @@ SSL_METHOD *sslv23_base_method(void)
 
 static int ssl23_num_ciphers(void)
         {
-        return(ssl3_num_ciphers()+ssl2_num_ciphers());
+        return(ssl3_num_ciphers()
+#ifndef NO_SSL2
+               + ssl2_num_ciphers()
+#endif
+            );
         }
 
 static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
@@ -116,7 +123,11 @@ static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
         if (u < uu)
                 return(ssl3_get_cipher(u));
         else
+#ifndef NO_SSL2
                 return(ssl2_get_cipher(u-uu));
+#else
+                return(NULL);
+#endif
         }
 
 /* This function needs to check if the ciphers required are actually
@@ -132,8 +143,10 @@ static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
                 ((unsigned long)p[1]<<8L)|(unsigned long)p[2];
         c.id=id;
         cp=ssl3_get_cipher_by_char(p);
+#ifndef NO_SSL2
         if (cp == NULL)
                 cp=ssl2_get_cipher_by_char(p);
+#endif
         return(cp);
         }
 
diff --git a/src/lib/libssl/s23_pkt.c b/src/lib/libssl/s23_pkt.c
index 8370ea508c..f45e1ce3d8 100644
--- a/src/lib/libssl/s23_pkt.c
+++ b/src/lib/libssl/s23_pkt.c
@@ -89,7 +89,7 @@ int ssl23_write_bytes(SSL *s)
                 }
         }
 
-/* only return when we have read 'n' bytes */
+/* return regularly only when we have read (at least) 'n' bytes */
 int ssl23_read_bytes(SSL *s, int n)
         {
         unsigned char *p;
diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c
index e4122f2d78..6a3bbb10b9 100644
--- a/src/lib/libssl/s23_srvr.c
+++ b/src/lib/libssl/s23_srvr.c
@@ -67,8 +67,10 @@ static SSL_METHOD *ssl23_get_server_method(int ver);
 int ssl23_get_client_hello(SSL *s);
 static SSL_METHOD *ssl23_get_server_method(int ver)
         {
+#ifndef NO_SSL2
         if (ver == SSL2_VERSION)
                 return(SSLv2_server_method());
+#endif
         if (ver == SSL3_VERSION)
                 return(SSLv3_server_method());
         else if (ver == TLS1_VERSION)
@@ -101,7 +103,7 @@ int ssl23_accept(SSL *s)
         int ret= -1;
         int new_state,state;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -186,23 +188,39 @@ end:
 
 int ssl23_get_client_hello(SSL *s)
         {
-        char buf_space[8];
+        char buf_space[11]; /* Request this many bytes in initial read.
+                             * We can detect SSL 3.0/TLS 1.0 Client Hellos
+                             * ('type == 3') correctly only when the following
+                             * is in a single record, which is not guaranteed by
+                             * the protocol specification:
+                             * Byte  Content
+                             *  0     type            \
+                             *  1/2   version          > record header
+                             *  3/4   length          /
+                             *  5     msg_type        \
+                             *  6-8   length           > Client Hello message
+                             *  9/10  client_version  /
+                             */
         char *buf= &(buf_space[0]);
         unsigned char *p,*d,*dd;
         unsigned int i;
         unsigned int csl,sil,cl;
-        int n=0,j,tls1=0;
-        int type=0,use_sslv2_strong=0;
+        int n=0,j;
+        int type=0;
         int v[2];
+#ifndef NO_RSA
+        int use_sslv2_strong=0;
+#endif
 
-        /* read the initial header */
-        v[0]=v[1]=0;
         if (s->state == SSL23_ST_SR_CLNT_HELLO_A)
                 {
+                /* read the initial header */
+                v[0]=v[1]=0;
+
                 if (!ssl3_setup_buffers(s)) goto err;
 
-                n=ssl23_read_bytes(s,7);
-                if (n != 7) return(n); /* n == -1 || n == 0 */
+                n=ssl23_read_bytes(s, sizeof buf_space);
+                if (n != sizeof buf_space) return(n); /* n == -1 || n == 0 */
 
                 p=s->packet;
 
@@ -210,7 +228,9 @@ int ssl23_get_client_hello(SSL *s)
 
                 if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO))
                         {
-                        /* SSLv2 header */
+                        /*
+                         * SSLv2 header
+                         */
                         if ((p[3] == 0x00) && (p[4] == 0x02))
                                 {
                                 v[0]=p[3]; v[1]=p[4];
@@ -226,11 +246,14 @@ int ssl23_get_client_hello(SSL *s)
                                         {
                                         if (!(s->options & SSL_OP_NO_TLSv1))
                                                 {
-                                                tls1=1;
+                                                s->version=TLS1_VERSION;
+                                                /* type=2; */ /* done later to survive restarts */
                                                 s->state=SSL23_ST_SR_CLNT_HELLO_B;
                                                 }
                                         else if (!(s->options & SSL_OP_NO_SSLv3))
                                                 {
+                                                s->version=SSL3_VERSION;
+                                                /* type=2; */
                                                 s->state=SSL23_ST_SR_CLNT_HELLO_B;
                                                 }
                                         else if (!(s->options & SSL_OP_NO_SSLv2))
@@ -239,12 +262,26 @@ int ssl23_get_client_hello(SSL *s)
                                                 }
                                         }
                                 else if (!(s->options & SSL_OP_NO_SSLv3))
+                                        {
+                                        s->version=SSL3_VERSION;
+                                        /* type=2; */
                                         s->state=SSL23_ST_SR_CLNT_HELLO_B;
+                                        }
                                 else if (!(s->options & SSL_OP_NO_SSLv2))
                                         type=1;
 
                                 if (s->options & SSL_OP_NON_EXPORT_FIRST)
+                                        /* Not only utterly confusing, but broken
+                                         * ('fractured programming'?) -- the details
+                                         * of this block nearly make it work
+                                         * as intended in this environment, but on one
+                                         * of the fine points (w.r.t. restarts) it fails.
+                                         * The obvious fix would be even more devastating
+                                         * to program structure; if you want the functionality,
+                                         * throw this away and implement it in a way
+                                         * that makes sense */
                                         {
+#if 0
                                         STACK_OF(SSL_CIPHER) *sk;
                                         SSL_CIPHER *c;
                                         int ne2,ne3;
@@ -294,27 +331,51 @@ int ssl23_get_client_hello(SSL *s)
                                                         goto next_bit;
                                                         }
                                                 }
+#else
+                                        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_OPTION);
+                                        goto err;
+#endif
                                         }
                                 }
                         }
                 else if ((p[0] == SSL3_RT_HANDSHAKE) &&
                          (p[1] == SSL3_VERSION_MAJOR) &&
-                         (p[5] == SSL3_MT_CLIENT_HELLO))
+                         (p[5] == SSL3_MT_CLIENT_HELLO) &&
+                         ((p[3] == 0 && p[4] < 5 /* silly record length? */)
+                                || (p[9] == p[1])))
                         {
-                        v[0]=p[1]; v[1]=p[2];
-                        /* true SSLv3 or tls1 */
-                        if (p[2] >= TLS1_VERSION_MINOR)
+                        /*
+                         * SSLv3 or tls1 header
+                         */
+                        
+                        v[0]=p[1]; /* major version */
+                        /* We must look at client_version inside the Client Hello message
+                         * to get the correct minor version: */
+                        v[1]=p[10];
+                        /* However if we have only a pathologically small fragment of the
+                         * Client Hello message, we simply use the version from the
+                         * record header -- this is incorrect but unlikely to fail in
+                         * practice */
+                        if (p[3] == 0 && p[4] < 6)
+                                v[1]=p[2];
+                        if (v[1] >= TLS1_VERSION_MINOR)
                                 {
                                 if (!(s->options & SSL_OP_NO_TLSv1))
                                         {
+                                        s->version=TLS1_VERSION;
                                         type=3;
-                                        tls1=1;
                                         }
                                 else if (!(s->options & SSL_OP_NO_SSLv3))
+                                        {
+                                        s->version=SSL3_VERSION;
                                         type=3;
+                                        }
                                 }
                         else if (!(s->options & SSL_OP_NO_SSLv3))
+                                {
+                                s->version=SSL3_VERSION;
                                 type=3;
+                                }
                         }
                 else if ((strncmp("GET ", (char *)p,4) == 0) ||
                          (strncmp("POST ",(char *)p,5) == 0) ||
@@ -331,12 +392,16 @@ int ssl23_get_client_hello(SSL *s)
                         }
                 }
 
-next_bit:
         if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
                 {
-                /* we have a SSLv3/TLSv1 in a SSLv2 header */
+                /* we have SSLv3/TLSv1 in an SSLv2 header
+                 * (other cases skip this state) */
+
                 type=2;
                 p=s->packet;
+                v[0] = p[3]; /* == SSL3_VERSION_MAJOR */
+                v[1] = p[4];
+
                 n=((p[0]&0x7f)<<8)|p[1];
                 if (n > (1024*4))
                         {
@@ -361,14 +426,11 @@ next_bit:
                         goto err;
                         }
 
-                *(d++)=SSL3_VERSION_MAJOR;
-                if (tls1)
-                        *(d++)=TLS1_VERSION_MINOR;
-                else
-                        *(d++)=SSL3_VERSION_MINOR;
+                *(d++) = SSL3_VERSION_MAJOR; /* == v[0] */
+                *(d++) = v[1];
 
                 /* lets populate the random area */
-                /* get the chalenge_length */
+                /* get the challenge_length */
                 i=(cl > SSL3_RANDOM_SIZE)?SSL3_RANDOM_SIZE:cl;
                 memset(d,0,SSL3_RANDOM_SIZE);
                 memcpy(&(d[SSL3_RANDOM_SIZE-i]),&(p[csl+sil]),i);
@@ -402,8 +464,15 @@ next_bit:
                 s->s3->tmp.message_size=i;
                 }
 
+        /* imaginary new state (for program structure): */
+        /* s->state = SSL23_SR_CLNT_HELLO_C */
+
         if (type == 1)
                 {
+#ifdef NO_SSL2
+                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
+                goto err;
+#else
                 /* we are talking sslv2 */
                 /* we need to clean up the SSLv3/TLSv1 setup and put in the
                  * sslv2 stuff. */
@@ -431,7 +500,7 @@ next_bit:
                 else
                         s->s2->ssl2_rollback=1;
 
-                /* setup the 5 bytes we have read so we get them from
+                /* setup the n bytes we have read so we get them from
                  * the sslv2 buffer */
                 s->rstate=SSL_ST_READ_HEADER;
                 s->packet_length=n;
@@ -442,11 +511,12 @@ next_bit:
 
                 s->method=SSLv2_server_method();
                 s->handshake_func=s->method->ssl_accept;
+#endif
                 }
 
         if ((type == 2) || (type == 3))
                 {
-                /* we have SSLv3/TLSv1 */
+                /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */
 
                 if (!ssl_init_wbio_buffer(s,1)) goto err;
 
@@ -471,17 +541,13 @@ next_bit:
                         s->s3->rbuf.offset=0;
                         }
 
-                if (tls1)
-                        {
-                        s->version=TLS1_VERSION;
-                        s->method=TLSv1_server_method();
-                        }
+                if (s->version == TLS1_VERSION)
+                        s->method = TLSv1_server_method();
                 else
-                        {
-                        s->version=SSL3_VERSION;
-                        s->method=SSLv3_server_method();
-                        }
+                        s->method = SSLv3_server_method();
+#if 0 /* ssl3_get_client_hello does this */
                 s->client_version=(v[0]<<8)|v[1];
+#endif
                 s->handshake_func=s->method->ssl_accept;
                 }
         
@@ -500,4 +566,3 @@ err:
         if (buf != buf_space) Free(buf);
         return(-1);
         }
-
diff --git a/src/lib/libssl/s3_both.c b/src/lib/libssl/s3_both.c
index f3f27715d5..03e0c38770 100644
--- a/src/lib/libssl/s3_both.c
+++ b/src/lib/libssl/s3_both.c
@@ -55,7 +55,61 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
+#include <string.h>
 #include <stdio.h>
 #include <openssl/buffer.h>
 #include <openssl/rand.h>
@@ -64,8 +118,27 @@
 #include <openssl/x509.h>
 #include "ssl_locl.h"
 
-int ssl3_send_finished(SSL *s, int a, int b, unsigned char *sender,
-             int slen)
+/* send s->init_buf in records of type 'type' */
+int ssl3_do_write(SSL *s, int type)
+        {
+        int ret;
+
+        ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
+                             s->init_num);
+        if (ret < 0) return(-1);
+        if (type == SSL3_RT_HANDSHAKE)
+                /* should not be done for 'Hello Request's, but in that case
+                 * we'll ignore the result anyway */
+                ssl3_finish_mac(s,(unsigned char *)&s->init_buf->data[s->init_off],ret);
+        
+        if (ret == s->init_num)
+                return(1);
+        s->init_off+=ret;
+        s->init_num-=ret;
+        return(0);
+        }
+
+int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
         {
         unsigned char *p,*d;
         int i;
@@ -79,7 +152,9 @@ int ssl3_send_finished(SSL *s, int a, int b, unsigned char *sender,
                 i=s->method->ssl3_enc->final_finish_mac(s,
                         &(s->s3->finish_dgst1),
                         &(s->s3->finish_dgst2),
-                        sender,slen,p);
+                        sender,slen,s->s3->tmp.finish_md);
+                s->s3->tmp.finish_md_len = i;
+                memcpy(p, s->s3->tmp.finish_md, i);
                 p+=i;
                 l=i;
 
@@ -109,7 +184,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
         unsigned char *p;
 
         /* the mac has already been generated when we received the
-         * change cipher spec message and is in s->s3->tmp.in_dgst[12]
+         * change cipher spec message and is in s->s3->tmp.peer_finish_md
          */ 
 
         n=ssl3_get_message(s,
@@ -121,7 +196,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
 
         if (!ok) return((int)n);
 
-        /* If this occurs if we has missed a message */
+        /* If this occurs, we have missed a message */
         if (!s->s3->change_cipher_spec)
                 {
                 al=SSL_AD_UNEXPECTED_MESSAGE;
@@ -130,9 +205,8 @@ int ssl3_get_finished(SSL *s, int a, int b)
                 }
         s->s3->change_cipher_spec=0;
 
-        p=(unsigned char *)s->init_buf->data;
-
-        i=s->method->ssl3_enc->finish_mac_length;
+        p = (unsigned char *)s->init_buf->data;
+        i = s->s3->tmp.peer_finish_md_len;
 
         if (i != n)
                 {
@@ -141,7 +215,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
                 goto f_err;
                 }
 
-        if (memcmp(  p,    (char *)&(s->s3->tmp.finish_md[0]),i) != 0)
+        if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
                 {
                 al=SSL_AD_DECRYPT_ERROR;
                 SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
@@ -255,6 +329,11 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
         return(l);
         }
 
+/* Obtain handshake message of message type 'mt' (any if mt == -1),
+ * maximum acceptable body length 'max'.
+ * The first four bytes (msg_type and length) are read in state 'st1',
+ * the body is read in state 'stn'.
+ */
 long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         {
         unsigned char *p;
@@ -277,15 +356,38 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
 
         p=(unsigned char *)s->init_buf->data;
 
-        if (s->state == st1)
+        if (s->state == st1) /* s->init_num < 4 */
                 {
-                i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
-                                  4-s->init_num);
-                if (i < (4-s->init_num))
+                int skip_message;
+
+                do
                         {
-                        *ok=0;
-                        return(ssl3_part_read(s,i));
+                        while (s->init_num < 4)
+                                {
+                                i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
+                                        4 - s->init_num);
+                                if (i <= 0)
+                                        {
+                                        s->rwstate=SSL_READING;
+                                        *ok = 0;
+                                        return i;
+                                        }
+                                s->init_num+=i;
+                                }
+                        
+                        skip_message = 0;
+                        if (!s->server)
+                                if (p[0] == SSL3_MT_HELLO_REQUEST)
+                                        /* The server may always send 'Hello Request' messages --
+                                         * we are doing a handshake anyway now, so ignore them
+                                         * if their format is correct. Does not count for
+                                         * 'Finished' MAC. */
+                                        if (p[1] == 0 && p[2] == 0 &&p[3] == 0)
+                                                skip_message = 1;
                         }
+                while (skip_message);
+
+                /* s->init_num == 4 */
 
                 if ((mt >= 0) && (*p != mt))
                         {
@@ -293,6 +395,20 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
                         SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
                         goto f_err;
                         }
+                if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) &&
+                                        (st1 == SSL3_ST_SR_CERT_A) &&
+                                        (stn == SSL3_ST_SR_CERT_B))
+                        {
+                        /* At this point we have got an MS SGC second client
+                         * hello (maybe we should always allow the client to
+                         * start a new handshake?). We need to restart the mac.
+                         * Don't increment {num,total}_renegotiations because
+                         * we have not completed the handshake. */
+                        ssl3_init_finished_mac(s);
+                        }
+
+                ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, 4);
+                        
                 s->s3->tmp.message_type= *(p++);
 
                 n2l3(p,l);
@@ -316,17 +432,21 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         /* next state (stn) */
         p=(unsigned char *)s->init_buf->data;
         n=s->s3->tmp.message_size;
-        if (n > 0)
+        while (n > 0)
                 {
                 i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n);
-                if (i != (int)n)
+                if (i <= 0)
                         {
-                        *ok=0;
-                        return(ssl3_part_read(s,i));
+                        s->rwstate=SSL_READING;
+                        *ok = 0;
+                        return i;
                         }
+                s->init_num += i;
+                n -= i;
                 }
+        ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num);
         *ok=1;
-        return(n);
+        return s->init_num;
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 err:
@@ -447,7 +567,7 @@ int ssl3_setup_buffers(SSL *s)
                         extra=SSL3_RT_MAX_EXTRA;
                 else
                         extra=0;
-                if ((p=(unsigned char *)Malloc(SSL3_RT_MAX_PACKET_SIZE+extra))
+                if ((p=Malloc(SSL3_RT_MAX_PACKET_SIZE+extra))
                         == NULL)
                         goto err;
                 s->s3->rbuf.buf=p;
@@ -455,7 +575,7 @@ int ssl3_setup_buffers(SSL *s)
 
         if (s->s3->wbuf.buf == NULL)
                 {
-                if ((p=(unsigned char *)Malloc(SSL3_RT_MAX_PACKET_SIZE))
+                if ((p=Malloc(SSL3_RT_MAX_PACKET_SIZE))
                         == NULL)
                         goto err;
                 s->s3->wbuf.buf=p;
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index d3e6b4d1e5..279d2c0198 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -110,7 +110,7 @@ int ssl3_connect(SSL *s)
         int ret= -1;
         int new_state,state,skip=0;;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -325,8 +325,8 @@ int ssl3_connect(SSL *s)
                 case SSL3_ST_CW_FINISHED_B:
                         ret=ssl3_send_finished(s,
                                 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
-                                s->method->ssl3_enc->client_finished,
-                                s->method->ssl3_enc->client_finished_len);
+                                s->method->ssl3_enc->client_finished_label,
+                                s->method->ssl3_enc->client_finished_label_len);
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_CW_FLUSH;
 
@@ -466,7 +466,7 @@ static int ssl3_client_hello(SSL *s)
                 p=s->s3->client_random;
                 Time=time(NULL);                        /* Time */
                 l2n(Time,p);
-                RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
+                RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
 
                 /* Do the message type and length last */
                 d=p= &(buf[4]);
@@ -1053,15 +1053,15 @@ static int ssl3_get_key_exchange(SSL *s)
                                 q+=i;
                                 j+=i;
                                 }
-                        i=RSA_public_decrypt((int)n,p,p,pkey->pkey.rsa,
-                                RSA_PKCS1_PADDING);
-                        if (i <= 0)
+                        i=RSA_verify(NID_md5_sha1, md_buf, j, p, n,
+                                                                pkey->pkey.rsa);
+                        if (i < 0)
                                 {
                                 al=SSL_AD_DECRYPT_ERROR;
                                 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
                                 goto f_err;
                                 }
-                        if ((j != i) || (memcmp(p,md_buf,i) != 0))
+                        if (i == 0)
                                 {
                                 /* bad signature */
                                 al=SSL_AD_DECRYPT_ERROR;
@@ -1225,7 +1225,7 @@ fclose(out);
 
                 if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL)
                         {
-                        /* If netscape tollerance is on, ignore errors */
+                        /* If netscape tolerance is on, ignore errors */
                         if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG)
                                 goto cont;
                         else
@@ -1258,7 +1258,7 @@ cont:
                 ERR_clear_error();
                 }
 
-        /* we should setup a certficate to return.... */
+        /* we should setup a certificate to return.... */
         s->s3->tmp.cert_req=1;
         s->s3->tmp.ctype_num=ctype_num;
         if (s->s3->tmp.ca_names != NULL)
@@ -1341,7 +1341,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                 
                         tmp_buf[0]=s->client_version>>8;
                         tmp_buf[1]=s->client_version&0xff;
-                        RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
+                        if (RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2) <= 0)
+                                        goto err;
 
                         s->session->master_key_length=SSL_MAX_MASTER_KEY_LENGTH;
 
@@ -1460,7 +1461,7 @@ static int ssl3_send_client_verify(SSL *s)
         unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
         EVP_PKEY *pkey;
 #ifndef NO_RSA
-        int i=0;
+        unsigned u=0;
 #endif
         unsigned long n;
 #ifndef NO_DSA
@@ -1481,17 +1482,15 @@ static int ssl3_send_client_verify(SSL *s)
                         {
                         s->method->ssl3_enc->cert_verify_mac(s,
                                 &(s->s3->finish_dgst1),&(data[0]));
-                        i=RSA_private_encrypt(
-                                MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
-                                data,&(p[2]),pkey->pkey.rsa,
-                                RSA_PKCS1_PADDING);
-                        if (i <= 0)
+                        if (RSA_sign(NID_md5_sha1, data,
+                                         MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
+                                        &(p[2]), &u, pkey->pkey.rsa) <= 0 )
                                 {
                                 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
                                 goto err;
                                 }
-                        s2n(i,p);
-                        n=i+2;
+                        s2n(u,p);
+                        n=u+2;
                         }
                 else
 #endif
@@ -1689,13 +1688,13 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
 #endif
 #endif
 
-        if (SSL_IS_EXPORT(algs) && !has_bits(i,EVP_PKT_EXP))
+        if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
                 {
 #ifndef NO_RSA
                 if (algs & SSL_kRSA)
                         {
                         if (rsa == NULL
-                            || RSA_size(rsa) > SSL_EXPORT_PKEYLENGTH(algs))
+                            || RSA_size(rsa) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
                                 {
                                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
                                 goto f_err;
@@ -1707,7 +1706,7 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
                         if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                             {
                             if (dh == NULL
-                                || DH_size(dh) > SSL_EXPORT_PKEYLENGTH(algs))
+                                || DH_size(dh) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
                                 {
                                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
                                 goto f_err;
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index aeff6b5c5b..c4b49aaedf 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -75,18 +75,26 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         SSL3_TXT_RSA_NULL_MD5,
         SSL3_CK_RSA_NULL_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_SSLV3,
+        SSL_NOT_EXP,
+        0,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 02 */
         {
         1,
         SSL3_TXT_RSA_NULL_SHA,
         SSL3_CK_RSA_NULL_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
+        0,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* anon DH */
@@ -95,45 +103,65 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         SSL3_TXT_ADH_RC4_40_MD5,
         SSL3_CK_ADH_RC4_40_MD5,
-        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 18 */
         {
         1,
         SSL3_TXT_ADH_RC4_128_MD5,
         SSL3_CK_ADH_RC4_128_MD5,
-        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_NOT_EXP,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 19 */
         {
         1,
         SSL3_TXT_ADH_DES_40_CBC_SHA,
         SSL3_CK_ADH_DES_40_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 1A */
         {
         1,
         SSL3_TXT_ADH_DES_64_CBC_SHA,
         SSL3_CK_ADH_DES_64_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 1B */
         {
         1,
         SSL3_TXT_ADH_DES_192_CBC_SHA,
         SSL3_CK_ADH_DES_192_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* RSA again */
@@ -142,72 +170,104 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         SSL3_TXT_RSA_RC4_40_MD5,
         SSL3_CK_RSA_RC4_40_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 04 */
         {
         1,
         SSL3_TXT_RSA_RC4_128_MD5,
         SSL3_CK_RSA_RC4_128_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_MD5|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 05 */
         {
         1,
         SSL3_TXT_RSA_RC4_128_SHA,
         SSL3_CK_RSA_RC4_128_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 06 */
         {
         1,
         SSL3_TXT_RSA_RC2_40_MD5,
         SSL3_CK_RSA_RC2_40_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC2  |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_RC2  |SSL_MD5 |SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 07 */
         {
         1,
         SSL3_TXT_RSA_IDEA_128_SHA,
         SSL3_CK_RSA_IDEA_128_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 08 */
         {
         1,
         SSL3_TXT_RSA_DES_40_CBC_SHA,
         SSL3_CK_RSA_DES_40_CBC_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 09 */
         {
         1,
         SSL3_TXT_RSA_DES_64_CBC_SHA,
         SSL3_CK_RSA_DES_64_CBC_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kRSA|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0A */
         {
         1,
         SSL3_TXT_RSA_DES_192_CBC3_SHA,
         SSL3_CK_RSA_DES_192_CBC3_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /*  The DH ciphers */
@@ -216,54 +276,78 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
         SSL3_CK_DH_DSS_DES_40_CBC_SHA,
-        SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0C */
         {
         0,
         SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
         SSL3_CK_DH_DSS_DES_64_CBC_SHA,
-        SSL_kDHd |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kDHd |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0D */
         {
         0,
         SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
         SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
-        SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0E */
         {
         0,
         SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
         SSL3_CK_DH_RSA_DES_40_CBC_SHA,
-        SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0F */
         {
         0,
         SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
         SSL3_CK_DH_RSA_DES_64_CBC_SHA,
-        SSL_kDHr |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kDHr |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 10 */
         {
         0,
         SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
         SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
-        SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* The Ephemeral DH ciphers */
@@ -272,54 +356,78 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
         SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
-        SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 12 */
         {
         1,
         SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
         SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
-        SSL_kEDH|SSL_aDSS|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kEDH|SSL_aDSS|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 13 */
         {
         1,
         SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
         SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
-        SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 14 */
         {
         1,
         SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
         SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
-        SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 15 */
         {
         1,
         SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
         SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
-        SSL_kEDH|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kEDH|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 16 */
         {
         1,
         SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
         SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
-        SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* Fortezza */
@@ -328,9 +436,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         SSL3_TXT_FZA_DMS_NULL_SHA,
         SSL3_CK_FZA_DMS_NULL_SHA,
-        SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
+        0,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* Cipher 1D */
@@ -338,9 +450,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         SSL3_TXT_FZA_DMS_FZA_SHA,
         SSL3_CK_FZA_DMS_FZA_SHA,
-        SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
+        0,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* Cipher 1E */
@@ -348,9 +464,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         SSL3_TXT_FZA_DMS_RC4_SHA,
         SSL3_CK_FZA_DMS_RC4_SHA,
-        SSL_kFZA|SSL_aFZA |SSL_RC4  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kFZA|SSL_aFZA |SSL_RC4  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
@@ -360,54 +480,78 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
             TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
-            SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_EXP56|SSL_TLSV1,
+            SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 61 */
             {
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
             TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
-            SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_EXP56|SSL_TLSV1,
+            SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 62 */
             {
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
             TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
-            SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_EXP56|SSL_TLSV1,
+            SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            56,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 63 */
             {
             1,
             TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
             TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
-            SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_EXP56|SSL_TLSV1,
+            SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            56,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 64 */
             {
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
             TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
-            SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_EXP56|SSL_TLSV1,
+            SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 65 */
             {
             1,
             TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
             TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
-            SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_EXP56|SSL_TLSV1,
+            SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 66 */
             {
@@ -415,8 +559,12 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
             TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
             SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
             0,
-            SSL_ALL_CIPHERS
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS
             },
 #endif
 
@@ -460,6 +608,9 @@ static SSL_METHOD SSLv3_data= {
         ssl_bad_method,
         ssl3_default_timeout,
         &SSLv3_enc_data,
+        ssl_undefined_function,
+        ssl3_callback_ctrl,
+        ssl3_ctx_callback_ctrl,
         };
 
 static long ssl3_default_timeout(void)
@@ -495,19 +646,12 @@ int ssl3_pending(SSL *s)
 
 int ssl3_new(SSL *s)
         {
-        SSL3_CTX *s3;
+        SSL3_STATE *s3;
 
-        if ((s3=(SSL3_CTX *)Malloc(sizeof(SSL3_CTX))) == NULL) goto err;
-        memset(s3,0,sizeof(SSL3_CTX));
+        if ((s3=Malloc(sizeof *s3)) == NULL) goto err;
+        memset(s3,0,sizeof *s3);
 
         s->s3=s3;
-        /*
-        s->s3->tmp.ca_names=NULL;
-        s->s3->tmp.key_block=NULL;
-        s->s3->tmp.key_block_length=0;
-        s->s3->rbuf.buf=NULL;
-        s->s3->wbuf.buf=NULL;
-        */
 
         s->method->ssl_clear(s);
         return(1);
@@ -533,7 +677,7 @@ void ssl3_free(SSL *s)
 #endif
         if (s->s3->tmp.ca_names != NULL)
                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
-        memset(s->s3,0,sizeof(SSL3_CTX));
+        memset(s->s3,0,sizeof *s->s3);
         Free(s->s3);
         s->s3=NULL;
         }
@@ -551,11 +695,15 @@ void ssl3_clear(SSL *s)
                 Free(s->s3->rrec.comp);
                 s->s3->rrec.comp=NULL;
                 }
+#ifndef NO_DH
+        if (s->s3->tmp.dh != NULL)
+                DH_free(s->s3->tmp.dh);
+#endif
 
         rp=s->s3->rbuf.buf;
         wp=s->s3->wbuf.buf;
 
-        memset(s->s3,0,sizeof(SSL3_CTX));
+        memset(s->s3,0,sizeof *s->s3);
         if (rp != NULL) s->s3->rbuf.buf=rp;
         if (wp != NULL) s->s3->wbuf.buf=wp;
 
@@ -638,7 +786,10 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg)
                 }
                 break;
         case SSL_CTRL_SET_TMP_RSA_CB:
-                s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))parg;
+                {
+                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(ret);
+                }
                 break;
 #endif
 #ifndef NO_DH
@@ -665,7 +816,54 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg)
                 }
                 break;
         case SSL_CTRL_SET_TMP_DH_CB:
-                s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))parg;
+                {
+                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(ret);
+                }
+                break;
+#endif
+        default:
+                break;
+                }
+        return(ret);
+        }
+
+long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)())
+        {
+        int ret=0;
+
+#if !defined(NO_DSA) || !defined(NO_RSA)
+        if (
+#ifndef NO_RSA
+            cmd == SSL_CTRL_SET_TMP_RSA_CB ||
+#endif
+#ifndef NO_DSA
+            cmd == SSL_CTRL_SET_TMP_DH_CB ||
+#endif
+                0)
+                {
+                if (!ssl_cert_inst(&s->cert))
+                        {
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
+                        return(0);
+                        }
+                }
+#endif
+
+        switch (cmd)
+                {
+#ifndef NO_RSA
+        case SSL_CTRL_SET_TMP_RSA_CB:
+                {
+                s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+#ifndef NO_DH
+        case SSL_CTRL_SET_TMP_DH_CB:
+                {
+                s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
+                }
                 break;
 #endif
         default:
@@ -721,7 +919,10 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
                 }
                 /* break; */
         case SSL_CTRL_SET_TMP_RSA_CB:
-                cert->rsa_tmp_cb=(RSA *(*)(SSL *, int, int))parg;
+                {
+                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(0);
+                }
                 break;
 #endif
 #ifndef NO_DH
@@ -748,7 +949,10 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
                 }
                 /*break; */
         case SSL_CTRL_SET_TMP_DH_CB:
-                cert->dh_tmp_cb=(DH *(*)(SSL *, int, int))parg;
+                {
+                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(0);
+                }
                 break;
 #endif
         /* A Thawte special :-) */
@@ -767,6 +971,34 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
         return(1);
         }
 
+long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+        {
+        CERT *cert;
+
+        cert=ctx->cert;
+
+        switch (cmd)
+                {
+#ifndef NO_RSA
+        case SSL_CTRL_SET_TMP_RSA_CB:
+                {
+                cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+#ifndef NO_DH
+        case SSL_CTRL_SET_TMP_DH_CB:
+                {
+                cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+        default:
+                return(0);
+                }
+        return(1);
+        }
+
 /* This function needs to check if the ciphers required are actually
  * available */
 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
@@ -819,21 +1051,6 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
         return(2);
         }
 
-int ssl3_part_read(SSL *s, int i)
-        {
-        s->rwstate=SSL_READING;
-
-        if (i < 0)
-                {
-                return(i);
-                }
-        else
-                {
-                s->init_num+=i;
-                return(0);
-                }
-        }
-
 SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *have,
              STACK_OF(SSL_CIPHER) *pref)
         {
@@ -865,7 +1082,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *have,
                 emask=cert->export_mask;
                         
                 alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK);
-                if (SSL_IS_EXPORT(c->algorithms))
+                if (SSL_C_IS_EXPORT(c))
                         {
                         ok=((alg & emask) == alg)?1:0;
 #ifdef CIPHER_DEBUG
@@ -1034,8 +1251,12 @@ int ssl3_read(SSL *s, void *buf, int len)
         ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len);
         if ((ret == -1) && (s->s3->in_read_app_data == 0))
                 {
-                ERR_get_error(); /* clear the error */
-                s->s3->in_read_app_data=0;
+                /* ssl3_read_bytes decided to call s->handshake_func, which
+                 * called ssl3_read_bytes to read handshake data.
+                 * However, ssl3_read_bytes actually found application data
+                 * and thinks that application data makes sense here (signalled
+                 * by resetting 'in_read_app_data', strangely); so disable
+                 * handshake processing and try to read application data again. */
                 s->in_handshake++;
                 ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len);
                 s->in_handshake--;
@@ -1092,7 +1313,7 @@ int ssl3_renegotiate_check(SSL *s)
                         {
 /*
 if we are the server, and we have sent a 'RENEGOTIATE' message, we
-need to go to SSL_ST_ACCEPT.
+need to go to SSL_ST_ACCEPT.
 */
                         /* SSL_ST_ACCEPT */
                         s->state=SSL_ST_RENEGOTIATE;
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index 7893d03123..eb965310d9 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -55,6 +55,59 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
 #include <stdio.h>
 #include <errno.h>
@@ -71,104 +124,98 @@ static int ssl3_get_record(SSL *s);
 static int do_compress(SSL *ssl);
 static int do_uncompress(SSL *ssl);
 static int do_change_cipher_spec(SSL *ssl);
+
+/* used only by ssl3_get_record */
 static int ssl3_read_n(SSL *s, int n, int max, int extend)
         {
+        /* If extend == 0, obtain new n-byte packet; if extend == 1, increase
+         * packet by another n bytes.
+         * The packet will be in the sub-array of s->s3->rbuf.buf specified
+         * by s->packet and s->packet_length.
+         * (If s->read_ahead is set, 'max' bytes may be stored in rbuf
+         * [plus s->packet_length bytes if extend == 1].)
+         */
         int i,off,newb;
 
-        /* if there is stuff still in the buffer from a previous read,
-         * and there is more than we want, take some. */
+        if (!extend)
+                {
+                /* start with empty packet ... */
+                if (s->s3->rbuf.left == 0)
+                        s->s3->rbuf.offset = 0;
+                s->packet = s->s3->rbuf.buf + s->s3->rbuf.offset;
+                s->packet_length = 0;
+                /* ... now we can act as if 'extend' was set */
+                }
+
+        /* if there is enough in the buffer from a previous read, take some */
         if (s->s3->rbuf.left >= (int)n)
                 {
-                if (extend)
-                        s->packet_length+=n;
-                else
-                        {
-                        s->packet= &(s->s3->rbuf.buf[s->s3->rbuf.offset]);
-                        s->packet_length=n;
-                        }
+                s->packet_length+=n;
                 s->s3->rbuf.left-=n;
                 s->s3->rbuf.offset+=n;
                 return(n);
                 }
 
         /* else we need to read more data */
-        if (!s->read_ahead) max=n;
-        if (max > SSL3_RT_MAX_PACKET_SIZE)
-                max=SSL3_RT_MAX_PACKET_SIZE;
-
-        /* First check if there is some left or we want to extend */
-        off=0;
-        if (    (s->s3->rbuf.left != 0) ||
-                ((s->packet_length != 0) && extend))
-                {
-                newb=s->s3->rbuf.left;
-                if (extend)
-                        {
-                        /* Copy bytes back to the front of the buffer 
-                         * Take the bytes already pointed to by 'packet'
-                         * and take the extra ones on the end. */
-                        off=s->packet_length;
-                        if (s->packet != s->s3->rbuf.buf)
-                                memcpy(s->s3->rbuf.buf,s->packet,newb+off);
-                        }
-                else if (s->s3->rbuf.offset != 0)
-                        { /* so the data is not at the start of the buffer */
-                        memcpy(s->s3->rbuf.buf,
-                                &(s->s3->rbuf.buf[s->s3->rbuf.offset]),newb);
-                        s->s3->rbuf.offset=0;
-                        }
+        if (!s->read_ahead)
+                max=n;
 
-                s->s3->rbuf.left=0;
+        {
+                /* avoid buffer overflow */
+                int max_max = SSL3_RT_MAX_PACKET_SIZE - s->packet_length;
+                if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
+                        max_max += SSL3_RT_MAX_EXTRA;
+                if (max > max_max)
+                        max = max_max;
+        }
+        if (n > max) /* does not happen */
+                {
+                SSLerr(SSL_F_SSL3_READ_N,SSL_R_INTERNAL_ERROR);
+                return -1;
                 }
-        else
-                newb=0;
 
-        /* So we now have 'newb' bytes at the front of 
-         * s->s3->rbuf.buf and need to read some more in on the end
-         * We start reading into the buffer at 's->s3->rbuf.offset'
-         */
-        s->packet=s->s3->rbuf.buf;
+        off = s->packet_length;
+        newb = s->s3->rbuf.left;
+        /* Move any available bytes to front of buffer:
+         * 'off' bytes already pointed to by 'packet',
+         * 'newb' extra ones at the end */
+        if (s->packet != s->s3->rbuf.buf)
+                {
+                /*  off > 0 */
+                memmove(s->s3->rbuf.buf, s->packet, off+newb);
+                s->packet = s->s3->rbuf.buf;
+                }
 
         while (newb < n)
                 {
+                /* Now we have off+newb bytes at the front of s->s3->rbuf.buf and need
+                 * to read in more until we have off+n (up to off+max if possible) */
+
                 clear_sys_error();
                 if (s->rbio != NULL)
                         {
                         s->rwstate=SSL_READING;
-                        i=BIO_read(s->rbio,
-                                (char *)&(s->s3->rbuf.buf[off+newb]),
-                                max-newb);
+                        i=BIO_read(s->rbio,     &(s->s3->rbuf.buf[off+newb]), max-newb);
                         }
                 else
                         {
                         SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET);
-                        i= -1;
+                        i = -1;
                         }
 
                 if (i <= 0)
                         {
-                        s->s3->rbuf.left+=newb;
+                        s->s3->rbuf.left = newb;
                         return(i);
                         }
                 newb+=i;
                 }
 
-        /* record used data read */
-        if (newb > n)
-                {
-                s->s3->rbuf.offset=n+off;
-                s->s3->rbuf.left=newb-n;
-                }
-        else
-                {
-                s->s3->rbuf.offset=0;
-                s->s3->rbuf.left=0;
-                }
-
-        if (extend)
-                s->packet_length+=n;
-        else
-                s->packet_length+=n;
+        /* done reading, now the book-keeping */
+        s->s3->rbuf.offset = off + n;
+        s->s3->rbuf.left = newb - n;
+        s->packet_length += n;
+        s->rwstate=SSL_NOTHING;
         return(n);
         }
 
@@ -176,15 +223,15 @@ static int ssl3_read_n(SSL *s, int n, int max, int extend)
  * It will return <= 0 if more data is needed, normally due to an error
  * or non-blocking IO.
  * When it finishes, one packet has been decoded and can be found in
- * ssl->s3->rrec.type   - is the type of record
- * ssl->s3->rrec.data,  - data
+ * ssl->s3->rrec.type    - is the type of record
+ * ssl->s3->rrec.data,   - data
  * ssl->s3->rrec.length, - number of bytes
  */
+/* used only by ssl3_read_bytes */
 static int ssl3_get_record(SSL *s)
         {
         int ssl_major,ssl_minor,al;
         int n,i,ret= -1;
-        SSL3_BUFFER *rb;
         SSL3_RECORD *rr;
         SSL_SESSION *sess;
         unsigned char *p;
@@ -194,7 +241,6 @@ static int ssl3_get_record(SSL *s)
         int clear=0,extra;
 
         rr= &(s->s3->rrec);
-        rb= &(s->s3->rbuf);
         sess=s->session;
 
         if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
@@ -253,27 +299,26 @@ again:
                         goto f_err;
                         }
 
-                s->rstate=SSL_ST_READ_BODY;
+                /* now s->rstate == SSL_ST_READ_BODY */
                 }
 
-        /* get and decode the data */
-        if (s->rstate == SSL_ST_READ_BODY)
+        /* s->rstate == SSL_ST_READ_BODY, get and decode the data */
+
+        if (rr->length > (s->packet_length-SSL3_RT_HEADER_LENGTH))
                 {
-                if (rr->length > (s->packet_length-SSL3_RT_HEADER_LENGTH))
-                        {
-                        i=rr->length;
-                        /*-(s->packet_length-SSL3_RT_HEADER_LENGTH); */
-                        n=ssl3_read_n(s,i,i,1);
-                        if (n <= 0) return(n); /* error or non-blocking io */
-                        }
-                s->rstate=SSL_ST_READ_HEADER;
+                /* now s->packet_length == SSL3_RT_HEADER_LENGTH */
+                i=rr->length;
+                n=ssl3_read_n(s,i,i,1);
+                if (n <= 0) return(n); /* error or non-blocking io */
+                /* now n == rr->length,
+                 * and s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length */
                 }
 
-        /* At this point, we have the data in s->packet and there should be
-         * s->packet_length bytes, we must not 'overrun' this buffer :-)
-         * One of the following functions will copy the data from the
-         * s->packet buffer */
+        s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */
 
+        /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
+         * and we have that many bytes in s->packet
+         */
         rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);
 
         /* ok, we can now read from 's->packet' data into 'rr'
@@ -283,13 +328,10 @@ again:
          * When the data is 'copied' into the rr->data buffer,
          * rr->input will be pointed at the new buffer */ 
 
-        /* Set the state for the following operations */
-        s->rstate=SSL_ST_READ_HEADER;
-
         /* We now have - encrypted [ MAC [ compressed [ plain ] ] ]
          * rr->length bytes of encrypted compressed stuff. */
 
-        /* check is not needed I belive */
+        /* check is not needed I believe */
         if (rr->length > (unsigned int)SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)
                 {
                 al=SSL_AD_RECORD_OVERFLOW;
@@ -326,7 +368,7 @@ printf("\n");
                         SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
                         goto f_err;
                         }
-                /* check MAC for rr->input' */
+                /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
                 if (rr->length < mac_size)
                         {
                         al=SSL_AD_DECODE_ERROR;
@@ -426,12 +468,12 @@ static int do_compress(SSL *ssl)
         return(1);
         }
 
-/* Call this to write data
+/* Call this to write data in records of type 'type'
  * It will return <= 0 if not all data has been sent or non-blocking IO.
  */
-int ssl3_write_bytes(SSL *s, int type, const void *_buf, int len)
+int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
         {
-        const unsigned char *buf=_buf;
+        const unsigned char *buf=buf_;
         unsigned int tot,n,nw;
         int i;
 
@@ -457,7 +499,7 @@ int ssl3_write_bytes(SSL *s, int type, const void *_buf, int len)
                         nw=SSL3_RT_MAX_PLAIN_LENGTH;
                 else
                         nw=n;
-                        
+
                 i=do_ssl3_write(s,type,&(buf[tot]),nw);
                 if (i <= 0)
                         {
@@ -465,9 +507,6 @@ int ssl3_write_bytes(SSL *s, int type, const void *_buf, int len)
                         return(i);
                         }
 
-                if (type == SSL3_RT_HANDSHAKE)
-                        ssl3_finish_mac(s,&(buf[tot]),i);
-
                 if ((i == (int)n) ||
                         (type == SSL3_RT_APPLICATION_DATA &&
                          (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)))
@@ -503,8 +542,8 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                 /* if it went, fall through and send more stuff */
                 }
 
-        if (len <= 0) return(len);
-        
+        if (len == 0) return(len);
+
         wr= &(s->s3->wrec);
         wb= &(s->s3->wbuf);
         sess=s->session;
@@ -527,11 +566,11 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
 
         *(p++)=(s->version>>8);
         *(p++)=s->version&0xff;
-        
+
         /* record where we are to write out packet length */
         plen=p; 
         p+=2;
-        
+
         /* lets setup the record stuff. */
         wr->data=p;
         wr->length=(int)len;
@@ -638,19 +677,75 @@ static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
                 }
         }
 
+/* Return up to 'len' payload bytes received in 'type' records.
+ * 'type' is one of the following:
+ *
+ *   -  SSL3_RT_HANDSHAKE (when ssl3_get_message calls us)
+ *   -  SSL3_RT_APPLICATION_DATA (when ssl3_read calls us)
+ *   -  0 (during a shutdown, no data has to be returned)
+ *
+ * If we don't have stored data to work from, read a SSL/TLS record first
+ * (possibly multiple records if we still don't have anything to return).
+ *
+ * This function must handle any surprises the peer may have for us, such as
+ * Alert records (e.g. close_notify), ChangeCipherSpec records (not really
+ * a surprise, but handled as if it were), or renegotiation requests.
+ * Also if record payloads contain fragments too small to process, we store
+ * them until there is enough for the respective protocol (the record protocol
+ * may use arbitrary fragmentation and even interleaving):
+ *     Change cipher spec protocol
+ *             just 1 byte needed, no need for keeping anything stored
+ *     Alert protocol
+ *             2 bytes needed (AlertLevel, AlertDescription)
+ *     Handshake protocol
+ *             4 bytes needed (HandshakeType, uint24 length) -- we just have
+ *             to detect unexpected Client Hello and Hello Request messages
+ *             here, anything else is handled by higher layers
+ *     Application data protocol
+ *             none of our business
+ */
 int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len)
         {
-        int al,i,j,n,ret;
+        int al,i,j,ret;
+        unsigned int n;
         SSL3_RECORD *rr;
         void (*cb)()=NULL;
-        BIO *bio;
 
-        if (s->s3->rbuf.buf == NULL) /* Not initialize yet */
+        if (s->s3->rbuf.buf == NULL) /* Not initialized yet */
                 if (!ssl3_setup_buffers(s))
                         return(-1);
 
+        if ((type != SSL3_RT_APPLICATION_DATA) && (type != SSL3_RT_HANDSHAKE) && type)
+                {
+                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_INTERNAL_ERROR);
+                return -1;
+                }
+
+        if ((type == SSL3_RT_HANDSHAKE) && (s->s3->handshake_fragment_len > 0))
+                /* (partially) satisfy request from storage */
+                {
+                unsigned char *src = s->s3->handshake_fragment;
+                unsigned char *dst = buf;
+                unsigned int k;
+
+                n = 0;
+                while ((len > 0) && (s->s3->handshake_fragment_len > 0))
+                        {
+                        *dst++ = *src++;
+                        len--; s->s3->handshake_fragment_len--;
+                        n++;
+                        }
+                /* move any remaining fragment bytes: */
+                for (k = 0; k < s->s3->handshake_fragment_len; k++)
+                        s->s3->handshake_fragment[k] = *src++;
+                return n;
+        }
+
+        /* Now s->s3->handshake_fragment_len == 0 if type == SSL3_RT_HANDSHAKE. */
+
         if (!s->in_handshake && SSL_in_init(s))
                 {
+                /* type == SSL3_RT_APPLICATION_DATA */
                 i=s->handshake_func(s);
                 if (i < 0) return(i);
                 if (i == 0)
@@ -662,11 +757,11 @@ int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len)
 start:
         s->rwstate=SSL_NOTHING;
 
-        /* s->s3->rrec.type     - is the type of record
-         * s->s3->rrec.data,    - data
-         * s->s3->rrec.off,     - ofset into 'data' for next read
-         * s->s3->rrec.length,  - number of bytes. */
-        rr= &(s->s3->rrec);
+        /* s->s3->rrec.type         - is the type of record
+         * s->s3->rrec.data,    - data
+         * s->s3->rrec.off,     - offset into 'data' for next read
+         * s->s3->rrec.length,  - number of bytes. */
+        rr = &(s->s3->rrec);
 
         /* get new packet */
         if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY))
@@ -677,7 +772,9 @@ start:
 
         /* we now have a packet which can be read and processed */
 
-        if (s->s3->change_cipher_spec && (rr->type != SSL3_RT_HANDSHAKE))
+        if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,
+                                       * reset by ssl3_get_finished */
+                && (rr->type != SSL3_RT_HANDSHAKE))
                 {
                 al=SSL_AD_UNEXPECTED_MESSAGE;
                 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
@@ -692,16 +789,98 @@ start:
                 return(0);
                 }
 
-        /* Check for an incoming 'Client Request' message */
-        if ((rr->type == SSL3_RT_HANDSHAKE) && (rr->length == 4) &&
-                (rr->data[0] == SSL3_MT_CLIENT_REQUEST) &&
+
+        if (type == rr->type) /* SSL3_RT_APPLICATION_DATA or SSL3_RT_HANDSHAKE */
+                {
+                /* make sure that we are not getting application data when we
+                 * are doing a handshake for the first time */
+                if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
+                        (s->enc_read_ctx == NULL))
+                        {
+                        al=SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);
+                        goto f_err;
+                        }
+
+                if (len <= 0) return(len);
+
+                if ((unsigned int)len > rr->length)
+                        n = rr->length;
+                else
+                        n = (unsigned int)len;
+
+                memcpy(buf,&(rr->data[rr->off]),n);
+                rr->length-=n;
+                rr->off+=n;
+                if (rr->length == 0)
+                        {
+                        s->rstate=SSL_ST_READ_HEADER;
+                        rr->off=0;
+                        }
+                return(n);
+                }
+
+
+        /* If we get here, then type != rr->type; if we have a handshake
+         * message, then it was unexpected (Hello Request or Client Hello). */
+
+        /* In case of record types for which we have 'fragment' storage,
+         * fill that so that we can process the data at a fixed place.
+         */
+                {
+                unsigned int dest_maxlen = 0;
+                unsigned char *dest = NULL;
+                unsigned int *dest_len = NULL;
+
+                if (rr->type == SSL3_RT_HANDSHAKE)
+                        {
+                        dest_maxlen = sizeof s->s3->handshake_fragment;
+                        dest = s->s3->handshake_fragment;
+                        dest_len = &s->s3->handshake_fragment_len;
+                        }
+                else if (rr->type == SSL3_RT_ALERT)
+                        {
+                        dest_maxlen = sizeof s->s3->alert_fragment;
+                        dest = s->s3->alert_fragment;
+                        dest_len = &s->s3->alert_fragment_len;
+                        }
+
+                if (dest_maxlen > 0)
+                        {
+                        n = dest_maxlen - *dest_len; /* available space in 'dest' */
+                        if (rr->length < n)
+                                n = rr->length; /* available bytes */
+
+                        /* now move 'n' bytes: */
+                        while (n-- > 0)
+                                {
+                                dest[(*dest_len)++] = rr->data[rr->off++];
+                                rr->length--;
+                                }
+
+                        if (*dest_len < dest_maxlen)
+                                goto start; /* fragment was too small */
+                        }
+                }
+
+        /* s->s3->handshake_fragment_len == 4  iff  rr->type == SSL3_RT_HANDSHAKE;
+         * s->s3->alert_fragment_len == 2      iff  rr->type == SSL3_RT_ALERT.
+         * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */
+
+        /* If we are a client, check for an incoming 'Hello Request': */
+        if ((!s->server) &&
+                (s->s3->handshake_fragment_len >= 4) &&
+                (s->s3->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&
                 (s->session != NULL) && (s->session->cipher != NULL))
                 {
-                if ((rr->data[1] != 0) || (rr->data[2] != 0) ||
-                        (rr->data[3] != 0))
+                s->s3->handshake_fragment_len = 0;
+
+                if ((s->s3->handshake_fragment[1] != 0) ||
+                        (s->s3->handshake_fragment[2] != 0) ||
+                        (s->s3->handshake_fragment[3] != 0))
                         {
                         al=SSL_AD_DECODE_ERROR;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CLIENT_REQUEST);
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_HELLO_REQUEST);
                         goto err;
                         }
 
@@ -712,220 +891,209 @@ start:
                         ssl3_renegotiate(s);
                         if (ssl3_renegotiate_check(s))
                                 {
-                                n=s->handshake_func(s);
-                                if (n < 0) return(n);
-                                if (n == 0)
+                                i=s->handshake_func(s);
+                                if (i < 0) return(i);
+                                if (i == 0)
                                         {
                                         SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
                                         return(-1);
                                         }
+
+                                if (s->s3->rbuf.left == 0) /* no read-ahead left? */
+                                        {
+                                        BIO *bio;
+                                        /* In the case where we try to read application data
+                                         * the first time, but we trigger an SSL handshake, we
+                                         * return -1 with the retry option set.  I do this
+                                         * otherwise renegotiation can cause nasty problems 
+                                         * in the blocking world */ /* ? */
+                                        s->rwstate=SSL_READING;
+                                        bio=SSL_get_rbio(s);
+                                        BIO_clear_retry_flags(bio);
+                                        BIO_set_retry_read(bio);
+                                        return(-1);
+                                        }
                                 }
                         }
-                rr->length=0;
-/* ZZZ */       goto start;
+                /* we either finished a handshake or ignored the request,
+                 * now try again to obtain the (application) data we were asked for */
+                goto start;
                 }
 
-        /* if it is not the type we want, or we have shutdown and want
-         * the peer shutdown */
-        if ((rr->type != type) || (s->shutdown & SSL_SENT_SHUTDOWN))
+        if (s->s3->alert_fragment_len >= 2)
                 {
-                if (rr->type == SSL3_RT_ALERT)
-                        {
-                        if ((rr->length != 2) || (rr->off != 0))
-                                {
-                                al=SSL_AD_DECODE_ERROR;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_ALERT_RECORD);
-                                goto f_err;
-                                }
+                int alert_level = s->s3->alert_fragment[0];
+                int alert_descr = s->s3->alert_fragment[1];
 
-                        i=rr->data[0];
-                        n=rr->data[1];
+                s->s3->alert_fragment_len = 0;
 
-                        /* clear from buffer */
-                        rr->length=0;
-
-                        if (s->info_callback != NULL)
-                                cb=s->info_callback;
-                        else if (s->ctx->info_callback != NULL)
-                                cb=s->ctx->info_callback;
+                if (s->info_callback != NULL)
+                        cb=s->info_callback;
+                else if (s->ctx->info_callback != NULL)
+                        cb=s->ctx->info_callback;
 
-                        if (cb != NULL)
-                                {
-                                j=(i<<8)|n;
-                                cb(s,SSL_CB_READ_ALERT,j);
-                                }
+                if (cb != NULL)
+                        {
+                        j = (alert_level << 8) | alert_descr;
+                        cb(s, SSL_CB_READ_ALERT, j);
+                        }
 
-                        if (i == 1)
-                                {
-                                s->s3->warn_alert=n;
-                                if (n == SSL_AD_CLOSE_NOTIFY)
-                                        {
-                                        s->shutdown|=SSL_RECEIVED_SHUTDOWN;
-                                        return(0);
-                                        }
-                                }
-                        else if (i == 2)
+                if (alert_level == 1) /* warning */
+                        {
+                        s->s3->warn_alert = alert_descr;
+                        if (alert_descr == SSL_AD_CLOSE_NOTIFY)
                                 {
-                                char tmp[16];
-
-                                s->rwstate=SSL_NOTHING;
-                                s->s3->fatal_alert=n;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,
-                                        SSL_AD_REASON_OFFSET+n);
-                                sprintf(tmp,"%d",n);
-                                ERR_add_error_data(2,"SSL alert number ",tmp);
-                                s->shutdown|=SSL_RECEIVED_SHUTDOWN;
-                                SSL_CTX_remove_session(s->ctx,s->session);
+                                s->shutdown |= SSL_RECEIVED_SHUTDOWN;
                                 return(0);
                                 }
-                        else
-                                {
-                                al=SSL_AD_ILLEGAL_PARAMETER;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);
-                                goto f_err;
-                                }
-
-                        rr->length=0;
-                        goto start;
                         }
-
-                if (s->shutdown & SSL_SENT_SHUTDOWN)
+                else if (alert_level == 2) /* fatal */
                         {
+                        char tmp[16];
+
                         s->rwstate=SSL_NOTHING;
-                        rr->length=0;
+                        s->s3->fatal_alert = alert_descr;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
+                        sprintf(tmp,"%d",alert_descr);
+                        ERR_add_error_data(2,"SSL alert number ",tmp);
+                        s->shutdown|=SSL_RECEIVED_SHUTDOWN;
+                        SSL_CTX_remove_session(s->ctx,s->session);
                         return(0);
                         }
-
-                if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
+                else
                         {
-                        if (    (rr->length != 1) || (rr->off != 0) ||
-                                (rr->data[0] != SSL3_MT_CCS))
-                                {
-                                i=SSL_AD_ILLEGAL_PARAMETER;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
-                                goto err;
-                                }
+                        al=SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);
+                        goto f_err;
+                        }
 
-                        rr->length=0;
-                        s->s3->change_cipher_spec=1;
-                        if (!do_change_cipher_spec(s))
-                                goto err;
-                        else
-                                goto start;
+                goto start;
+                }
+
+        if (s->shutdown & SSL_SENT_SHUTDOWN) /* but we have not received a shutdown */
+                {
+                s->rwstate=SSL_NOTHING;
+                rr->length=0;
+                return(0);
+                }
+
+        if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
+                {
+                /* 'Change Cipher Spec' is just a single byte, so we know
+                 * exactly what the record payload has to look like */
+                if (    (rr->length != 1) || (rr->off != 0) ||
+                        (rr->data[0] != SSL3_MT_CCS))
+                        {
+                        i=SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
+                        goto err;
                         }
 
-                /* else we have a handshake */
-                if ((rr->type == SSL3_RT_HANDSHAKE) &&
-                        !s->in_handshake)
+                rr->length=0;
+                s->s3->change_cipher_spec=1;
+                if (!do_change_cipher_spec(s))
+                        goto err;
+                else
+                        goto start;
+                }
+
+        /* Unexpected handshake message (Client Hello, or protocol violation) */
+        if ((s->s3->handshake_fragment_len >= 4) &&     !s->in_handshake)
+                {
+                if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
+                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))
                         {
-                        if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
-                                !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))
-                                {
-                                s->state=SSL_ST_BEFORE|(s->server)
-                                                ?SSL_ST_ACCEPT
-                                                :SSL_ST_CONNECT;
-                                s->new_session=1;
-                                }
-                        n=s->handshake_func(s);
-                        if (n < 0) return(n);
-                        if (n == 0)
-                                {
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
-                                return(-1);
-                                }
+#if 0 /* worked only because C operator preferences are not as expected (and
+       * because this is not really needed for clients except for detecting
+       * protocol violations): */
+                        s->state=SSL_ST_BEFORE|(s->server)
+                                ?SSL_ST_ACCEPT
+                                :SSL_ST_CONNECT;
+#else
+                        s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
+#endif
+                        s->new_session=1;
+                        }
+                i=s->handshake_func(s);
+                if (i < 0) return(i);
+                if (i == 0)
+                        {
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return(-1);
+                        }
 
+                if (s->s3->rbuf.left == 0) /* no read-ahead left? */
+                        {
+                        BIO *bio;
                         /* In the case where we try to read application data
                          * the first time, but we trigger an SSL handshake, we
                          * return -1 with the retry option set.  I do this
                          * otherwise renegotiation can cause nasty problems 
-                         * in the non-blocking world */
-
+                         * in the blocking world */ /* ? */
                         s->rwstate=SSL_READING;
                         bio=SSL_get_rbio(s);
                         BIO_clear_retry_flags(bio);
                         BIO_set_retry_read(bio);
                         return(-1);
                         }
+                goto start;
+                }
 
-                switch (rr->type)
-                        {
-                default:
+        switch (rr->type)
+                {
+        default:
 #ifndef NO_TLS
-                        /* TLS just ignores unknown message types */
-                        if (s->version == TLS1_VERSION)
-                                {
-                                goto start;
-                                }
+                /* TLS just ignores unknown message types */
+                if (s->version == TLS1_VERSION)
+                        {
+                        goto start;
+                        }
 #endif
-                case SSL3_RT_CHANGE_CIPHER_SPEC:
-                case SSL3_RT_ALERT:
-                case SSL3_RT_HANDSHAKE:
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                goto f_err;
+        case SSL3_RT_CHANGE_CIPHER_SPEC:
+        case SSL3_RT_ALERT:
+        case SSL3_RT_HANDSHAKE:
+                /* we already handled all of these, with the possible exception
+                 * of SSL3_RT_HANDSHAKE when s->in_handshake is set, but that
+                 * should not happen when type != rr->type */
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_INTERNAL_ERROR);
+                goto f_err;
+        case SSL3_RT_APPLICATION_DATA:
+                /* At this point, we were expecting handshake data,
+                 * but have application data.  If the library was
+                 * running inside ssl3_read() (i.e. in_read_app_data
+                 * is set) and it makes sense to read application data
+                 * at this point (session renegotiation not yet started),
+                 * we will indulge it.
+                 */
+                if (s->s3->in_read_app_data &&
+                        (s->s3->total_renegotiations != 0) &&
+                        ((
+                                (s->state & SSL_ST_CONNECT) &&
+                                (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
+                                (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
+                                ) || (
+                                        (s->state & SSL_ST_ACCEPT) &&
+                                        (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
+                                        (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
+                                        )
+                                ))
+                        {
+                        s->s3->in_read_app_data=0;
+                        return(-1);
+                        }
+                else
+                        {
                         al=SSL_AD_UNEXPECTED_MESSAGE;
                         SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
                         goto f_err;
-                case SSL3_RT_APPLICATION_DATA:
-                        /* At this point, we were expecting something else,
-                         * but have application data.  What we do is set the
-                         * error, and return -1.  On the way out, if the
-                         * library was running inside ssl3_read() and it makes
-                         * sense to read application data at this point, we
-                         * will indulge it.  This will mostly happen during
-                         * session renegotiation.
-                         */
-                        if (s->s3->in_read_app_data &&
-                                (s->s3->total_renegotiations != 0) &&
-                                ((
-                                  (s->state & SSL_ST_CONNECT) &&
-                                  (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
-                                  (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
-                                 ) || (
-                                  (s->state & SSL_ST_ACCEPT) &&
-                                  (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
-                                  (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
-                                 )
-                                ))
-                                {
-                                s->s3->in_read_app_data=0;
-                                return(-1);
-                                }
-                        else
-                                {
-                                al=SSL_AD_UNEXPECTED_MESSAGE;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
-                                goto f_err;
-                                }
                         }
                 }
+        /* not reached */
 
-        /* make sure that we are not getting application data when we
-         * are doing a handshake for the first time */
-        if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
-                (s->enc_read_ctx == NULL))
-                {
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);
-                goto f_err;
-                }
-
-        if (len <= 0) return(len);
-
-        if ((unsigned int)len > rr->length)
-                n=rr->length;
-        else
-                n=len;
-
-        memcpy(buf,&(rr->data[rr->off]),(unsigned int)n);
-        rr->length-=n;
-        rr->off+=n;
-        if (rr->length <= 0)
-                {
-                s->rstate=SSL_ST_READ_HEADER;
-                rr->off=0;
-                }
-
-        if (type == SSL3_RT_HANDSHAKE)
-                ssl3_finish_mac(s,buf,n);
-        return(n);
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 err:
@@ -935,7 +1103,7 @@ err:
 static int do_change_cipher_spec(SSL *s)
         {
         int i;
-        unsigned char *sender;
+        const char *sender;
         int slen;
 
         if (s->state & SSL_ST_ACCEPT)
@@ -957,37 +1125,23 @@ static int do_change_cipher_spec(SSL *s)
          * the finished message */
         if (s->state & SSL_ST_CONNECT)
                 {
-                sender=s->method->ssl3_enc->server_finished;
-                slen=s->method->ssl3_enc->server_finished_len;
+                sender=s->method->ssl3_enc->server_finished_label;
+                slen=s->method->ssl3_enc->server_finished_label_len;
                 }
         else
                 {
-                sender=s->method->ssl3_enc->client_finished;
-                slen=s->method->ssl3_enc->client_finished_len;
+                sender=s->method->ssl3_enc->client_finished_label;
+                slen=s->method->ssl3_enc->client_finished_label_len;
                 }
 
-        s->method->ssl3_enc->final_finish_mac(s,
+        s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
                 &(s->s3->finish_dgst1),
                 &(s->s3->finish_dgst2),
-                sender,slen,&(s->s3->tmp.finish_md[0]));
+                sender,slen,s->s3->tmp.peer_finish_md);
 
         return(1);
         }
 
-int ssl3_do_write(SSL *s, int type)
-        {
-        int ret;
-
-        ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
-                             s->init_num);
-        if (ret == s->init_num)
-                return(1);
-        if (ret < 0) return(-1);
-        s->init_off+=ret;
-        s->init_num-=ret;
-        return(0);
-        }
-
 void ssl3_send_alert(SSL *s, int level, int desc)
         {
         /* Map tls/ssl alert value to correct one */
@@ -1029,7 +1183,7 @@ int ssl3_dispatch_alert(SSL *s)
                         cb=s->info_callback;
                 else if (s->ctx->info_callback != NULL)
                         cb=s->ctx->info_callback;
-                
+
                 if (cb != NULL)
                         {
                         j=(s->s3->send_alert[0]<<8)|s->s3->send_alert[1];
@@ -1038,4 +1192,3 @@ int ssl3_dispatch_alert(SSL *s)
                 }
         return(i);
         }
-
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index e003d88357..90806e2d99 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -57,6 +57,8 @@
  */
 
 #define REUSE_CIPHER_BUG
+#define NETSCAPE_HANG_BUG
+
 
 #include <stdio.h>
 #include <openssl/buffer.h>
@@ -70,13 +72,14 @@
 
 static SSL_METHOD *ssl3_get_server_method(int ver);
 static int ssl3_get_client_hello(SSL *s);
+static int ssl3_check_client_hello(SSL *s);
 static int ssl3_send_server_hello(SSL *s);
 static int ssl3_send_server_key_exchange(SSL *s);
 static int ssl3_send_certificate_request(SSL *s);
 static int ssl3_send_server_done(SSL *s);
-static int ssl3_get_cert_verify(SSL *s);
 static int ssl3_get_client_key_exchange(SSL *s);
 static int ssl3_get_client_certificate(SSL *s);
+static int ssl3_get_cert_verify(SSL *s);
 static int ssl3_send_hello_request(SSL *s);
 
 static SSL_METHOD *ssl3_get_server_method(int ver)
@@ -112,7 +115,7 @@ int ssl3_accept(SSL *s)
         int ret= -1;
         int new_state,state,skip=0;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -151,7 +154,6 @@ int ssl3_accept(SSL *s)
 
                         if ((s->version>>8) != 3)
                                 abort();
-                        /* s->version=SSL3_VERSION; */
                         s->type=SSL_ST_ACCEPT;
 
                         if (s->init_buf == NULL)
@@ -184,8 +186,8 @@ int ssl3_accept(SSL *s)
 
                         if (s->state != SSL_ST_RENEGOTIATE)
                                 {
-                                s->state=SSL3_ST_SR_CLNT_HELLO_A;
                                 ssl3_init_finished_mac(s);
+                                s->state=SSL3_ST_SR_CLNT_HELLO_A;
                                 s->ctx->stats.sess_accept++;
                                 }
                         else
@@ -268,8 +270,8 @@ int ssl3_accept(SSL *s)
                             || (l & (SSL_DH|SSL_kFZA))
                             || ((l & SSL_kRSA)
                                 && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
-                                    || (SSL_IS_EXPORT(l)
-                                        && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_EXPORT_PKEYLENGTH(l)
+                                    || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)
+                                        && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)
                                         )
                                     )
                                 )
@@ -287,9 +289,19 @@ int ssl3_accept(SSL *s)
 
                 case SSL3_ST_SW_CERT_REQ_A:
                 case SSL3_ST_SW_CERT_REQ_B:
-                        if (!(s->verify_mode & SSL_VERIFY_PEER) ||
+                        if (/* don't request cert unless asked for it: */
+                                !(s->verify_mode & SSL_VERIFY_PEER) ||
+                                /* if SSL_VERIFY_CLIENT_ONCE is set,
+                                 * don't request cert during re-negotiation: */
                                 ((s->session->peer != NULL) &&
-                                 (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)))
+                                 (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
+                                /* never request cert in anonymous ciphersuites
+                                 * (see section "Certificate request" in SSL 3 drafts
+                                 * and in RFC 2246): */
+                                ((s->s3->tmp.new_cipher->algorithms & SSL_aNULL) &&
+                                 /* ... except when the application insists on verification
+                                  * (against the specs, but s3_clnt.c accepts this for SSL 3) */
+                                 !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))
                                 {
                                 /* no cert request */
                                 skip=1;
@@ -301,7 +313,12 @@ int ssl3_accept(SSL *s)
                                 s->s3->tmp.cert_request=1;
                                 ret=ssl3_send_certificate_request(s);
                                 if (ret <= 0) goto end;
+#ifndef NETSCAPE_HANG_BUG
                                 s->state=SSL3_ST_SW_SRVR_DONE_A;
+#else
+                                s->state=SSL3_ST_SW_FLUSH;
+                                s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
+#endif
                                 s->init_num=0;
                                 }
                         break;
@@ -331,12 +348,20 @@ int ssl3_accept(SSL *s)
 
                 case SSL3_ST_SR_CERT_A:
                 case SSL3_ST_SR_CERT_B:
-                        /* could be sent for a DH cert, even if we
-                         * have not asked for it :-) */
-                        ret=ssl3_get_client_certificate(s);
-                        if (ret <= 0) goto end;
-                        s->init_num=0;
-                        s->state=SSL3_ST_SR_KEY_EXCH_A;
+                        /* Check for second client hello (MS SGC) */
+                        ret = ssl3_check_client_hello(s);
+                        if (ret <= 0)
+                                goto end;
+                        if (ret == 2)
+                                s->state = SSL3_ST_SR_CLNT_HELLO_C;
+                        else {
+                                /* could be sent for a DH cert, even if we
+                                 * have not asked for it :-) */
+                                ret=ssl3_get_client_certificate(s);
+                                if (ret <= 0) goto end;
+                                s->init_num=0;
+                                s->state=SSL3_ST_SR_KEY_EXCH_A;
+                        }
                         break;
 
                 case SSL3_ST_SR_KEY_EXCH_A:
@@ -350,10 +375,10 @@ int ssl3_accept(SSL *s)
                          * a client cert, it can be verified */ 
                         s->method->ssl3_enc->cert_verify_mac(s,
                                 &(s->s3->finish_dgst1),
-                                &(s->s3->tmp.finish_md[0]));
+                                &(s->s3->tmp.cert_verify_md[0]));
                         s->method->ssl3_enc->cert_verify_mac(s,
                                 &(s->s3->finish_dgst2),
-                                &(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]));
+                                &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
 
                         break;
 
@@ -407,8 +432,8 @@ int ssl3_accept(SSL *s)
                 case SSL3_ST_SW_FINISHED_B:
                         ret=ssl3_send_finished(s,
                                 SSL3_ST_SW_FINISHED_A,SSL3_ST_SW_FINISHED_B,
-                                s->method->ssl3_enc->server_finished,
-                                s->method->ssl3_enc->server_finished_len);
+                                s->method->ssl3_enc->server_finished_label,
+                                s->method->ssl3_enc->server_finished_label_len);
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_SW_FLUSH;
                         if (s->hit)
@@ -485,7 +510,7 @@ static int ssl3_send_hello_request(SSL *s)
         if (s->state == SSL3_ST_SW_HELLO_REQ_A)
                 {
                 p=(unsigned char *)s->init_buf->data;
-                *(p++)=SSL3_MT_CLIENT_REQUEST;
+                *(p++)=SSL3_MT_HELLO_REQUEST;
                 *(p++)=0;
                 *(p++)=0;
                 *(p++)=0;
@@ -500,6 +525,37 @@ static int ssl3_send_hello_request(SSL *s)
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
 
+static int ssl3_check_client_hello(SSL *s)
+        {
+        int ok;
+        long n;
+
+        n=ssl3_get_message(s,
+                SSL3_ST_SR_CERT_A,
+                SSL3_ST_SR_CERT_B,
+                -1,
+                SSL3_RT_MAX_PLAIN_LENGTH,
+                &ok);
+        if (!ok) return((int)n);
+        s->s3->tmp.reuse_message = 1;
+        if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
+                {
+                /* Throw away what we have done so far in the current handshake,
+                 * which will now be aborted. (A full SSL_clear would be too much.)
+                 * I hope that tmp.dh is the only thing that may need to be cleared
+                 * when a handshake is not completed ... */
+#ifndef NO_DH
+                if (s->s3->tmp.dh != NULL)
+                        {
+                        DH_free(s->s3->tmp.dh);
+                        s->s3->tmp.dh = NULL;
+                        }
+#endif
+                return 2;
+                }
+        return 1;
+}
+
 static int ssl3_get_client_hello(SSL *s)
         {
         int i,j,ok,al,ret= -1;
@@ -531,10 +587,9 @@ static int ssl3_get_client_hello(SSL *s)
         if (!ok) return((int)n);
         d=p=(unsigned char *)s->init_buf->data;
 
-        /* The version number has already been checked in ssl3_get_message.
-         * I a native TLSv1/SSLv3 method, the match must be correct except
-         * perhaps for the first message */
-/*      s->client_version=(((int)p[0])<<8)|(int)p[1]; */
+        /* use version from inside client hello, not from record header
+         * (may differ: see RFC 2246, Appendix E, second paragraph) */
+        s->client_version=(((int)p[0])<<8)|(int)p[1];
         p+=2;
 
         /* load the client random */
@@ -754,7 +809,7 @@ static int ssl3_get_client_hello(SSL *s)
          * compression          - basically ignored right now
          * ssl version is set   - sslv3
          * s->session           - The ssl session has been setup.
-         * s->hit               - sesson reuse flag
+         * s->hit               - session reuse flag
          * s->tmp.new_cipher    - the new cipher to use.
          */
 
@@ -782,7 +837,7 @@ static int ssl3_send_server_hello(SSL *s)
                 p=s->s3->server_random;
                 Time=time(NULL);                        /* Time */
                 l2n(Time,p);
-                RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
+                RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
                 /* Do the message type and length last */
                 d=p= &(buf[4]);
 
@@ -866,9 +921,10 @@ static int ssl3_send_server_key_exchange(SSL *s)
         int j,num;
         RSA *rsa;
         unsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
+        unsigned int u;
 #endif
 #ifndef NO_DH
-        DH *dh,*dhp;
+        DH *dh=NULL,*dhp;
 #endif
         EVP_PKEY *pkey;
         unsigned char *p,*d;
@@ -899,6 +955,12 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                 rsa=s->cert->rsa_tmp_cb(s,
                                       SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
                                       SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
+                                if(rsa == NULL)
+                                {
+                                        al=SSL_AD_HANDSHAKE_FAILURE;
+                                        SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_ERROR_GENERATING_TMP_RSA_KEY);
+                                        goto f_err;
+                                }
                                 CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
                                 cert->rsa_tmp=rsa;
                                 }
@@ -928,6 +990,14 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
                                 goto f_err;
                                 }
+
+                        if (s->s3->tmp.dh != NULL)
+                                {
+                                DH_free(dh);
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, SSL_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
                         if ((dh=DHparams_dup(dhp)) == NULL)
                                 {
                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
@@ -1027,15 +1097,14 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                         q+=i;
                                         j+=i;
                                         }
-                                i=RSA_private_encrypt(j,md_buf,&(p[2]),
-                                        pkey->pkey.rsa,RSA_PKCS1_PADDING);
-                                if (i <= 0)
+                                if (RSA_sign(NID_md5_sha1, md_buf, j,
+                                        &(p[2]), &u, pkey->pkey.rsa) <= 0)
                                         {
                                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA);
                                         goto err;
                                         }
-                                s2n(i,p);
-                                n+=i+2;
+                                s2n(u,p);
+                                n+=u+2;
                                 }
                         else
 #endif
@@ -1075,7 +1144,7 @@ static int ssl3_send_server_key_exchange(SSL *s)
                 s->init_off=0;
                 }
 
-        /* SSL3_ST_SW_KEY_EXCH_B */
+        s->state = SSL3_ST_SW_KEY_EXCH_B;
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
@@ -1152,6 +1221,17 @@ static int ssl3_send_certificate_request(SSL *s)
 
                 s->init_num=n+4;
                 s->init_off=0;
+#ifdef NETSCAPE_HANG_BUG
+                p=(unsigned char *)s->init_buf->data + s->init_num;
+
+                /* do the header */
+                *(p++)=SSL3_MT_SERVER_DONE;
+                *(p++)=0;
+                *(p++)=0;
+                *(p++)=0;
+                s->init_num += 4;
+#endif
+
                 }
 
         /* SSL3_ST_SW_CERT_REQ_B */
@@ -1239,31 +1319,6 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                 i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING);
 
-#if 1
-                /* If a bad decrypt, use a random master key */
-                if ((i != SSL_MAX_MASTER_KEY_LENGTH) ||
-                        ((p[0] != (s->client_version>>8)) ||
-                         (p[1] != (s->client_version & 0xff))))
-                        {
-                        int bad=1;
-
-                        if ((i == SSL_MAX_MASTER_KEY_LENGTH) &&
-                                (p[0] == (s->version>>8)) &&
-                                (p[1] == 0))
-                                {
-                                if (s->options & SSL_OP_TLS_ROLLBACK_BUG)
-                                        bad=0;
-                                }
-                        if (bad)
-                                {
-                                p[0]=(s->version>>8);
-                                p[1]=(s->version & 0xff);
-                                RAND_bytes(&(p[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
-                                i=SSL_MAX_MASTER_KEY_LENGTH;
-                                }
-                        /* else, an SSLeay bug, ssl only server, tls client */
-                        }
-#else
                 if (i != SSL_MAX_MASTER_KEY_LENGTH)
                         {
                         al=SSL_AD_DECODE_ERROR;
@@ -1271,13 +1326,12 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         goto f_err;
                         }
 
-                if ((p[0] != (s->version>>8)) || (p[1] != (s->version & 0xff)))
+                if ((p[0] != (s->client_version>>8)) || (p[1] != (s->client_version & 0xff)))
                         {
                         al=SSL_AD_DECODE_ERROR;
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
                         goto f_err;
                         }
-#endif
 
                 s->session->master_key_length=
                         s->method->ssl3_enc->generate_master_secret(s,
@@ -1450,16 +1504,16 @@ static int ssl3_get_cert_verify(SSL *s)
 #ifndef NO_RSA 
         if (pkey->type == EVP_PKEY_RSA)
                 {
-                i=RSA_public_decrypt(i,p,p,pkey->pkey.rsa,RSA_PKCS1_PADDING);
+                i=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,
+                        MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i, 
+                                                        pkey->pkey.rsa);
                 if (i < 0)
                         {
                         al=SSL_AD_DECRYPT_ERROR;
                         SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
                         goto f_err;
                         }
-                if ((i != (MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH)) ||
-                        memcmp(&(s->s3->tmp.finish_md[0]),p,
-                                MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH))
+                if (i == 0)
                         {
                         al=SSL_AD_DECRYPT_ERROR;
                         SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
@@ -1472,7 +1526,7 @@ static int ssl3_get_cert_verify(SSL *s)
                 if (pkey->type == EVP_PKEY_DSA)
                 {
                 j=DSA_verify(pkey->save_type,
-                        &(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]),
+                        &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
                         SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
                 if (j <= 0)
                         {
@@ -1532,7 +1586,7 @@ static int ssl3_get_client_certificate(SSL *s)
                         al=SSL_AD_HANDSHAKE_FAILURE;
                         goto f_err;
                         }
-                /* If tls asked for a client cert we must return a 0 list */
+                /* If tls asked for a client cert, the client must return a 0 list */
                 if ((s->version > SSL3_VERSION) && s->s3->tmp.cert_request)
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST);
@@ -1628,6 +1682,7 @@ static int ssl3_get_client_certificate(SSL *s)
         if (s->session->peer != NULL) /* This should not be needed */
                 X509_free(s->session->peer);
         s->session->peer=sk_X509_shift(sk);
+        s->session->verify_result = s->verify_result;
 
         /* With the current implementation, sess_cert will always be NULL
          * when we arrive here. */
diff --git a/src/lib/libssl/shlib_version b/src/lib/libssl/shlib_version
index b52599a164..ba5a3fee58 100644
--- a/src/lib/libssl/shlib_version
+++ b/src/lib/libssl/shlib_version
@@ -1,2 +1,2 @@
 major=2
-minor=0
+minor=2
diff --git a/src/lib/libssl/src/CHANGES b/src/lib/libssl/src/CHANGES
index d0db7eaf61..bf61913d7b 100644
--- a/src/lib/libssl/src/CHANGES
+++ b/src/lib/libssl/src/CHANGES
@@ -2,6 +2,1104 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 0.9.4 and 0.9.5  [28 Feb 2000]
+
+  *) PKCS7_encrypt() was adding text MIME headers twice because they
+     were added manually and by SMIME_crlf_copy().
+     [Steve Henson]
+
+  *) In bntest.c don't call BN_rand with zero bits argument.
+     [Steve Henson, pointed out by Andrew W. Gray <agray@iconsinc.com>]
+
+  *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n]
+     case was implemented. This caused BN_div_recp() to fail occasionally.
+     [Ulf Möller]
+
+  *) Add an optional second argument to the set_label() in the perl
+     assembly language builder. If this argument exists and is set
+     to 1 it signals that the assembler should use a symbol whose 
+     scope is the entire file, not just the current function. This
+     is needed with MASM which uses the format label:: for this scope.
+     [Steve Henson, pointed out by Peter Runestig <peter@runestig.com>]
+
+  *) Change the ASN1 types so they are typedefs by default. Before
+     almost all types were #define'd to ASN1_STRING which was causing
+     STACK_OF() problems: you couldn't declare STACK_OF(ASN1_UTF8STRING)
+     for example.
+     [Steve Henson]
+
+  *) Change names of new functions to the new get1/get0 naming
+     convention: After 'get1', the caller owns a reference count
+     and has to call ..._free; 'get0' returns a pointer to some
+     data structure without incrementing reference counters.
+     (Some of the existing 'get' functions increment a reference
+     counter, some don't.)
+     Similarly, 'set1' and 'add1' functions increase reference
+     counters or duplicate objects.
+     [Steve Henson]
+
+  *) Allow for the possibility of temp RSA key generation failure:
+     the code used to assume it always worked and crashed on failure.
+     [Steve Henson]
+
+  *) Fix potential buffer overrun problem in BIO_printf().
+     [Ulf Möller, using public domain code by Patrick Powell; problem
+      pointed out by David Sacerdote <das33@cornell.edu>]
+
+  *) Support EGD <http://www.lothar.com/tech/crypto/>.  New functions
+     RAND_egd() and RAND_status().  In the command line application,
+     the EGD socket can be specified like a seed file using RANDFILE
+     or -rand.
+     [Ulf Möller]
+
+  *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures.
+     Some CAs (e.g. Verisign) distribute certificates in this form.
+     [Steve Henson]
+
+  *) Remove the SSL_ALLOW_ADH compile option and set the default cipher
+     list to exclude them. This means that no special compilation option
+     is needed to use anonymous DH: it just needs to be included in the
+     cipher list.
+     [Steve Henson]
+
+  *) Change the EVP_MD_CTX_type macro so its meaning consistent with
+     EVP_MD_type. The old functionality is available in a new macro called
+     EVP_MD_md(). Change code that uses it and update docs.
+     [Steve Henson]
+
+  *) ..._ctrl functions now have corresponding ..._callback_ctrl functions
+     where the 'void *' argument is replaced by a function pointer argument.
+     Previously 'void *' was abused to point to functions, which works on
+     many platforms, but is not correct.  As these functions are usually
+     called by macros defined in OpenSSL header files, most source code
+     should work without changes.
+     [Richard Levitte]
+
+  *) <openssl/opensslconf.h> (which is created by Configure) now contains
+     sections with information on -D... compiler switches used for
+     compiling the library so that applications can see them.  To enable
+     one of these sections, a pre-processor symbol OPENSSL_..._DEFINES
+     must be defined.  E.g.,
+        #define OPENSSL_ALGORITHM_DEFINES
+        #include <openssl/opensslconf.h>
+     defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc.
+     [Richard Levitte, Ulf and Bodo Möller]
+
+  *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS
+     record layer.
+     [Bodo Moeller]
+
+  *) Change the 'other' type in certificate aux info to a STACK_OF
+     X509_ALGOR. Although not an AlgorithmIdentifier as such it has
+     the required ASN1 format: arbitrary types determined by an OID.
+     [Steve Henson]
+
+  *) Add some PEM_write_X509_REQ_NEW() functions and a command line
+     argument to 'req'. This is not because the function is newer or
+     better than others it just uses the work 'NEW' in the certificate
+     request header lines. Some software needs this.
+     [Steve Henson]
+
+  *) Reorganise password command line arguments: now passwords can be
+     obtained from various sources. Delete the PEM_cb function and make
+     it the default behaviour: i.e. if the callback is NULL and the
+     usrdata argument is not NULL interpret it as a null terminated pass
+     phrase. If usrdata and the callback are NULL then the pass phrase
+     is prompted for as usual.
+     [Steve Henson]
+
+  *) Add support for the Compaq Atalla crypto accelerator. If it is installed,
+     the support is automatically enabled. The resulting binaries will
+     autodetect the card and use it if present.
+     [Ben Laurie and Compaq Inc.]
+
+  *) Work around for Netscape hang bug. This sends certificate request
+     and server done in one record. Since this is perfectly legal in the
+     SSL/TLS protocol it isn't a "bug" option and is on by default. See
+     the bugs/SSLv3 entry for more info.
+     [Steve Henson]
+
+  *) HP-UX tune-up: new unified configs, HP C compiler bug workaround.
+     [Andy Polyakov]
+
+  *) Add -rand argument to smime and pkcs12 applications and read/write
+     of seed file.
+     [Steve Henson]
+
+  *) New 'passwd' tool for crypt(3) and apr1 password hashes.
+     [Bodo Moeller]
+
+  *) Add command line password options to the remaining applications.
+     [Steve Henson]
+
+  *) Bug fix for BN_div_recp() for numerators with an even number of
+     bits.
+     [Ulf Möller]
+
+  *) More tests in bntest.c, and changed test_bn output.
+     [Ulf Möller]
+
+  *) ./config recognizes MacOS X now.
+     [Andy Polyakov]
+
+  *) Bug fix for BN_div() when the first words of num and divsor are
+     equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0).
+     [Ulf Möller]
+
+  *) Add support for various broken PKCS#8 formats, and command line
+     options to produce them.
+     [Steve Henson]
+
+  *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to
+     get temporary BIGNUMs from a BN_CTX.
+     [Ulf Möller]
+
+  *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont()
+     for p == 0.
+     [Ulf Möller]
+
+  *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and
+     include a #define from the old name to the new. The original intent
+     was that statically linked binaries could for example just call
+     SSLeay_add_all_ciphers() to just add ciphers to the table and not
+     link with digests. This never worked becayse SSLeay_add_all_digests()
+     and SSLeay_add_all_ciphers() were in the same source file so calling
+     one would link with the other. They are now in separate source files.
+     [Steve Henson]
+
+  *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'.
+     [Steve Henson]
+
+  *) Use a less unusual form of the Miller-Rabin primality test (it used
+     a binary algorithm for exponentiation integrated into the Miller-Rabin
+     loop, our standard modexp algorithms are faster).
+     [Bodo Moeller]
+
+  *) Support for the EBCDIC character set completed.
+     [Martin Kraemer <Martin.Kraemer@Mch.SNI.De>]
+
+  *) Source code cleanups: use const where appropriate, eliminate casts,
+     use void * instead of char * in lhash.
+     [Ulf Möller] 
+
+  *) Bugfix: ssl3_send_server_key_exchange was not restartable
+     (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of
+     this the server could overwrite ephemeral keys that the client
+     has already seen).
+     [Bodo Moeller]
+
+  *) Turn DSA_is_prime into a macro that calls BN_is_prime,
+     using 50 iterations of the Rabin-Miller test.
+
+     DSA_generate_parameters now uses BN_is_prime_fasttest (with 50
+     iterations of the Rabin-Miller test as required by the appendix
+     to FIPS PUB 186[-1]) instead of DSA_is_prime.
+     As BN_is_prime_fasttest includes trial division, DSA parameter
+     generation becomes much faster.
+
+     This implies a change for the callback functions in DSA_is_prime
+     and DSA_generate_parameters: The callback function is called once
+     for each positive witness in the Rabin-Miller test, not just
+     occasionally in the inner loop; and the parameters to the
+     callback function now provide an iteration count for the outer
+     loop rather than for the current invocation of the inner loop.
+     DSA_generate_parameters additionally can call the callback
+     function with an 'iteration count' of -1, meaning that a
+     candidate has passed the trial division test (when q is generated 
+     from an application-provided seed, trial division is skipped).
+     [Bodo Moeller]
+
+  *) New function BN_is_prime_fasttest that optionally does trial
+     division before starting the Rabin-Miller test and has
+     an additional BN_CTX * argument (whereas BN_is_prime always
+     has to allocate at least one BN_CTX).
+     'callback(1, -1, cb_arg)' is called when a number has passed the
+     trial division stage.
+     [Bodo Moeller]
+
+  *) Fix for bug in CRL encoding. The validity dates weren't being handled
+     as ASN1_TIME.
+     [Steve Henson]
+
+  *) New -pkcs12 option to CA.pl script to write out a PKCS#12 file.
+     [Steve Henson]
+
+  *) New function BN_pseudo_rand().
+     [Ulf Möller]
+
+  *) Clean up BN_mod_mul_montgomery(): replace the broken (and unreadable)
+     bignum version of BN_from_montgomery() with the working code from
+     SSLeay 0.9.0 (the word based version is faster anyway), and clean up
+     the comments.
+     [Ulf Möller]
+
+  *) Avoid a race condition in s2_clnt.c (function get_server_hello) that
+     made it impossible to use the same SSL_SESSION data structure in
+     SSL2 clients in multiple threads.
+     [Bodo Moeller]
+
+  *) The return value of RAND_load_file() no longer counts bytes obtained
+     by stat().  RAND_load_file(..., -1) is new and uses the complete file
+     to seed the PRNG (previously an explicit byte count was required).
+     [Ulf Möller, Bodo Möller]
+
+  *) Clean up CRYPTO_EX_DATA functions, some of these didn't have prototypes
+     used (char *) instead of (void *) and had casts all over the place.
+     [Steve Henson]
+
+  *) Make BN_generate_prime() return NULL on error if ret!=NULL.
+     [Ulf Möller]
+
+  *) Retain source code compatibility for BN_prime_checks macro:
+     BN_is_prime(..., BN_prime_checks, ...) now uses
+     BN_prime_checks_for_size to determine the appropriate number of
+     Rabin-Miller iterations.
+     [Ulf Möller]
+
+  *) Diffie-Hellman uses "safe" primes: DH_check() return code renamed to
+     DH_CHECK_P_NOT_SAFE_PRIME.
+     (Check if this is true? OpenPGP calls them "strong".)
+     [Ulf Möller]
+
+  *) Merge the functionality of "dh" and "gendh" programs into a new program
+     "dhparam". The old programs are retained for now but will handle DH keys
+     (instead of parameters) in future.
+     [Steve Henson]
+
+  *) Make the ciphers, s_server and s_client programs check the return values
+     when a new cipher list is set.
+     [Steve Henson]
+
+  *) Enhance the SSL/TLS cipher mechanism to correctly handle the TLS 56bit
+     ciphers. Before when the 56bit ciphers were enabled the sorting was
+     wrong.
+
+     The syntax for the cipher sorting has been extended to support sorting by
+     cipher-strength (using the strength_bits hard coded in the tables).
+     The new command is "@STRENGTH" (see also doc/apps/ciphers.pod).
+
+     Fix a bug in the cipher-command parser: when supplying a cipher command
+     string with an "undefined" symbol (neither command nor alphanumeric
+     [A-Za-z0-9], ssl_set_cipher_list used to hang in an endless loop. Now
+     an error is flagged.
+
+     Due to the strength-sorting extension, the code of the
+     ssl_create_cipher_list() function was completely rearranged. I hope that
+     the readability was also increased :-)
+     [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE>]
+
+  *) Minor change to 'x509' utility. The -CAcreateserial option now uses 1
+     for the first serial number and places 2 in the serial number file. This
+     avoids problems when the root CA is created with serial number zero and
+     the first user certificate has the same issuer name and serial number
+     as the root CA.
+     [Steve Henson]
+
+  *) Fixes to X509_ATTRIBUTE utilities, change the 'req' program so it uses
+     the new code. Add documentation for this stuff.
+     [Steve Henson]
+
+  *) Changes to X509_ATTRIBUTE utilities. These have been renamed from
+     X509_*() to X509at_*() on the grounds that they don't handle X509
+     structures and behave in an analagous way to the X509v3 functions:
+     they shouldn't be called directly but wrapper functions should be used
+     instead.
+
+     So we also now have some wrapper functions that call the X509at functions
+     when passed certificate requests. (TO DO: similar things can be done with
+     PKCS#7 signed and unsigned attributes, PKCS#12 attributes and a few other
+     things. Some of these need some d2i or i2d and print functionality
+     because they handle more complex structures.)
+     [Steve Henson]
+
+  *) Add missing #ifndefs that caused missing symbols when building libssl
+     as a shared library without RSA.  Use #ifndef NO_SSL2 instead of
+     NO_RSA in ssl/s2*.c. 
+     [Kris Kennaway <kris@hub.freebsd.org>, modified by Ulf Möller]
+
+  *) Precautions against using the PRNG uninitialized: RAND_bytes() now
+     has a return value which indicates the quality of the random data
+     (1 = ok, 0 = not seeded).  Also an error is recorded on the thread's
+     error queue. New function RAND_pseudo_bytes() generates output that is
+     guaranteed to be unique but not unpredictable. RAND_add is like
+     RAND_seed, but takes an extra argument for an entropy estimate
+     (RAND_seed always assumes full entropy).
+     [Ulf Möller]
+
+  *) Do more iterations of Rabin-Miller probable prime test (specifically,
+     3 for 1024-bit primes, 6 for 512-bit primes, 12 for 256-bit primes
+     instead of only 2 for all lengths; see BN_prime_checks_for_size definition
+     in crypto/bn/bn_prime.c for the complete table).  This guarantees a
+     false-positive rate of at most 2^-80 for random input.
+     [Bodo Moeller]
+
+  *) Rewrite ssl3_read_n (ssl/s3_pkt.c) avoiding a couple of bugs.
+     [Bodo Moeller]
+
+  *) New function X509_CTX_rget_chain() (renamed to X509_CTX_get1_chain
+     in the 0.9.5 release), this returns the chain
+     from an X509_CTX structure with a dup of the stack and all
+     the X509 reference counts upped: so the stack will exist
+     after X509_CTX_cleanup() has been called. Modify pkcs12.c
+     to use this.
+
+     Also make SSL_SESSION_print() print out the verify return
+     code.
+     [Steve Henson]
+
+  *) Add manpage for the pkcs12 command. Also change the default
+     behaviour so MAC iteration counts are used unless the new
+     -nomaciter option is used. This improves file security and
+     only older versions of MSIE (4.0 for example) need it.
+     [Steve Henson]
+
+  *) Honor the no-xxx Configure options when creating .DEF files.
+     [Ulf Möller]
+
+  *) Add PKCS#10 attributes to field table: challengePassword, 
+     unstructuredName and unstructuredAddress. These are taken from
+     draft PKCS#9 v2.0 but are compatible with v1.2 provided no 
+     international characters are used.
+
+     More changes to X509_ATTRIBUTE code: allow the setting of types
+     based on strings. Remove the 'loc' parameter when adding
+     attributes because these will be a SET OF encoding which is sorted
+     in ASN1 order.
+     [Steve Henson]
+
+  *) Initial changes to the 'req' utility to allow request generation
+     automation. This will allow an application to just generate a template
+     file containing all the field values and have req construct the
+     request.
+
+     Initial support for X509_ATTRIBUTE handling. Stacks of these are
+     used all over the place including certificate requests and PKCS#7
+     structures. They are currently handled manually where necessary with
+     some primitive wrappers for PKCS#7. The new functions behave in a
+     manner analogous to the X509 extension functions: they allow
+     attributes to be looked up by NID and added.
+
+     Later something similar to the X509V3 code would be desirable to
+     automatically handle the encoding, decoding and printing of the
+     more complex types. The string types like challengePassword can
+     be handled by the string table functions.
+
+     Also modified the multi byte string table handling. Now there is
+     a 'global mask' which masks out certain types. The table itself
+     can use the flag STABLE_NO_MASK to ignore the mask setting: this
+     is useful when for example there is only one permissible type
+     (as in countryName) and using the mask might result in no valid
+     types at all.
+     [Steve Henson]
+
+  *) Clean up 'Finished' handling, and add functions SSL_get_finished and
+     SSL_get_peer_finished to allow applications to obtain the latest
+     Finished messages sent to the peer or expected from the peer,
+     respectively.  (SSL_get_peer_finished is usually the Finished message
+     actually received from the peer, otherwise the protocol will be aborted.)
+
+     As the Finished message are message digests of the complete handshake
+     (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
+     be used for external authentication procedures when the authentication
+     provided by SSL/TLS is not desired or is not enough.
+     [Bodo Moeller]
+
+  *) Enhanced support for Alpha Linux is added. Now ./config checks if
+     the host supports BWX extension and if Compaq C is present on the
+     $PATH. Just exploiting of the BWX extension results in 20-30%
+     performance kick for some algorithms, e.g. DES and RC4 to mention
+     a couple. Compaq C in turn generates ~20% faster code for MD5 and
+     SHA1.
+     [Andy Polyakov]
+
+  *) Add support for MS "fast SGC". This is arguably a violation of the
+     SSL3/TLS protocol. Netscape SGC does two handshakes: the first with
+     weak crypto and after checking the certificate is SGC a second one
+     with strong crypto. MS SGC stops the first handshake after receiving
+     the server certificate message and sends a second client hello. Since
+     a server will typically do all the time consuming operations before
+     expecting any further messages from the client (server key exchange
+     is the most expensive) there is little difference between the two.
+
+     To get OpenSSL to support MS SGC we have to permit a second client
+     hello message after we have sent server done. In addition we have to
+     reset the MAC if we do get this second client hello.
+     [Steve Henson]
+
+  *) Add a function 'd2i_AutoPrivateKey()' this will automatically decide
+     if a DER encoded private key is RSA or DSA traditional format. Changed
+     d2i_PrivateKey_bio() to use it. This is only needed for the "traditional"
+     format DER encoded private key. Newer code should use PKCS#8 format which
+     has the key type encoded in the ASN1 structure. Added DER private key
+     support to pkcs8 application.
+     [Steve Henson]
+
+  *) SSL 3/TLS 1 servers now don't request certificates when an anonymous
+     ciphersuites has been selected (as required by the SSL 3/TLS 1
+     specifications).  Exception: When SSL_VERIFY_FAIL_IF_NO_PEER_CERT
+     is set, we interpret this as a request to violate the specification
+     (the worst that can happen is a handshake failure, and 'correct'
+     behaviour would result in a handshake failure anyway).
+     [Bodo Moeller]
+
+  *) In SSL_CTX_add_session, take into account that there might be multiple
+     SSL_SESSION structures with the same session ID (e.g. when two threads
+     concurrently obtain them from an external cache).
+     The internal cache can handle only one SSL_SESSION with a given ID,
+     so if there's a conflict, we now throw out the old one to achieve
+     consistency.
+     [Bodo Moeller]
+
+  *) Add OIDs for idea and blowfish in CBC mode. This will allow both
+     to be used in PKCS#5 v2.0 and S/MIME.  Also add checking to
+     some routines that use cipher OIDs: some ciphers do not have OIDs
+     defined and so they cannot be used for S/MIME and PKCS#5 v2.0 for
+     example.
+     [Steve Henson]
+
+  *) Simplify the trust setting structure and code. Now we just have
+     two sequences of OIDs for trusted and rejected settings. These will
+     typically have values the same as the extended key usage extension
+     and any application specific purposes.
+
+     The trust checking code now has a default behaviour: it will just
+     check for an object with the same NID as the passed id. Functions can
+     be provided to override either the default behaviour or the behaviour
+     for a given id. SSL client, server and email already have functions
+     in place for compatibility: they check the NID and also return "trusted"
+     if the certificate is self signed.
+     [Steve Henson]
+
+  *) Add d2i,i2d bio/fp functions for PrivateKey: these convert the
+     traditional format into an EVP_PKEY structure.
+     [Steve Henson]
+
+  *) Add a password callback function PEM_cb() which either prompts for
+     a password if usr_data is NULL or otherwise assumes it is a null
+     terminated password. Allow passwords to be passed on command line
+     environment or config files in a few more utilities.
+     [Steve Henson]
+
+  *) Add a bunch of DER and PEM functions to handle PKCS#8 format private
+     keys. Add some short names for PKCS#8 PBE algorithms and allow them
+     to be specified on the command line for the pkcs8 and pkcs12 utilities.
+     Update documentation.
+     [Steve Henson]
+
+  *) Support for ASN1 "NULL" type. This could be handled before by using
+     ASN1_TYPE but there wasn't any function that would try to read a NULL
+     and produce an error if it couldn't. For compatibility we also have
+     ASN1_NULL_new() and ASN1_NULL_free() functions but these are faked and
+     don't allocate anything because they don't need to.
+     [Steve Henson]
+
+  *) Initial support for MacOS is now provided. Examine INSTALL.MacOS
+     for details.
+     [Andy Polyakov, Roy Woods <roy@centicsystems.ca>]
+
+  *) Rebuild of the memory allocation routines used by OpenSSL code and
+     possibly others as well.  The purpose is to make an interface that
+     provide hooks so anyone can build a separate set of allocation and
+     deallocation routines to be used by OpenSSL, for example memory
+     pool implementations, or something else, which was previously hard
+     since Malloc(), Realloc() and Free() were defined as macros having
+     the values malloc, realloc and free, respectively (except for Win32
+     compilations).  The same is provided for memory debugging code.
+     OpenSSL already comes with functionality to find memory leaks, but
+     this gives people a chance to debug other memory problems.
+
+     With these changes, a new set of functions and macros have appeared:
+
+       CRYPTO_set_mem_debug_functions()         [F]
+       CRYPTO_get_mem_debug_functions()         [F]
+       CRYPTO_dbg_set_options()                 [F]
+       CRYPTO_dbg_get_options()                 [F]
+       CRYPTO_malloc_debug_init()               [M]
+
+     The memory debug functions are NULL by default, unless the library
+     is compiled with CRYPTO_MDEBUG or friends is defined.  If someone
+     wants to debug memory anyway, CRYPTO_malloc_debug_init() (which
+     gives the standard debugging functions that come with OpenSSL) or
+     CRYPTO_set_mem_debug_functions() (tells OpenSSL to use functions
+     provided by the library user) must be used.  When the standard
+     debugging functions are used, CRYPTO_dbg_set_options can be used to
+     request additional information:
+     CRYPTO_dbg_set_options(V_CYRPTO_MDEBUG_xxx) corresponds to setting
+     the CRYPTO_MDEBUG_xxx macro when compiling the library.   
+
+     Also, things like CRYPTO_set_mem_functions will always give the
+     expected result (the new set of functions is used for allocation
+     and deallocation) at all times, regardless of platform and compiler
+     options.
+
+     To finish it up, some functions that were never use in any other
+     way than through macros have a new API and new semantic:
+
+       CRYPTO_dbg_malloc()
+       CRYPTO_dbg_realloc()
+       CRYPTO_dbg_free()
+
+     All macros of value have retained their old syntax.
+     [Richard Levitte and Bodo Moeller]
+
+  *) Some S/MIME fixes. The OID for SMIMECapabilities was wrong, the
+     ordering of SMIMECapabilities wasn't in "strength order" and there
+     was a missing NULL in the AlgorithmIdentifier for the SHA1 signature
+     algorithm.
+     [Steve Henson]
+
+  *) Some ASN1 types with illegal zero length encoding (INTEGER,
+     ENUMERATED and OBJECT IDENTIFIER) choked the ASN1 routines.
+     [Frans Heymans <fheymans@isaserver.be>, modified by Steve Henson]
+
+  *) Merge in my S/MIME library for OpenSSL. This provides a simple
+     S/MIME API on top of the PKCS#7 code, a MIME parser (with enough
+     functionality to handle multipart/signed properly) and a utility
+     called 'smime' to call all this stuff. This is based on code I
+     originally wrote for Celo who have kindly allowed it to be
+     included in OpenSSL.
+     [Steve Henson]
+
+  *) Add variants des_set_key_checked and des_set_key_unchecked of
+     des_set_key (aka des_key_sched).  Global variable des_check_key
+     decides which of these is called by des_set_key; this way
+     des_check_key behaves as it always did, but applications and
+     the library itself, which was buggy for des_check_key == 1,
+     have a cleaner way to pick the version they need.
+     [Bodo Moeller]
+
+  *) New function PKCS12_newpass() which changes the password of a
+     PKCS12 structure.
+     [Steve Henson]
+
+  *) Modify X509_TRUST and X509_PURPOSE so it also uses a static and
+     dynamic mix. In both cases the ids can be used as an index into the
+     table. Also modified the X509_TRUST_add() and X509_PURPOSE_add()
+     functions so they accept a list of the field values and the
+     application doesn't need to directly manipulate the X509_TRUST
+     structure.
+     [Steve Henson]
+
+  *) Modify the ASN1_STRING_TABLE stuff so it also uses bsearch and doesn't
+     need initialising.
+     [Steve Henson]
+
+  *) Modify the way the V3 extension code looks up extensions. This now
+     works in a similar way to the object code: we have some "standard"
+     extensions in a static table which is searched with OBJ_bsearch()
+     and the application can add dynamic ones if needed. The file
+     crypto/x509v3/ext_dat.h now has the info: this file needs to be
+     updated whenever a new extension is added to the core code and kept
+     in ext_nid order. There is a simple program 'tabtest.c' which checks
+     this. New extensions are not added too often so this file can readily
+     be maintained manually.
+
+     There are two big advantages in doing things this way. The extensions
+     can be looked up immediately and no longer need to be "added" using
+     X509V3_add_standard_extensions(): this function now does nothing.
+     [Side note: I get *lots* of email saying the extension code doesn't
+      work because people forget to call this function]
+     Also no dynamic allocation is done unless new extensions are added:
+     so if we don't add custom extensions there is no need to call
+     X509V3_EXT_cleanup().
+     [Steve Henson]
+
+  *) Modify enc utility's salting as follows: make salting the default. Add a
+     magic header, so unsalted files fail gracefully instead of just decrypting
+     to garbage. This is because not salting is a big security hole, so people
+     should be discouraged from doing it.
+     [Ben Laurie]
+
+  *) Fixes and enhancements to the 'x509' utility. It allowed a message
+     digest to be passed on the command line but it only used this
+     parameter when signing a certificate. Modified so all relevant
+     operations are affected by the digest parameter including the
+     -fingerprint and -x509toreq options. Also -x509toreq choked if a
+     DSA key was used because it didn't fix the digest.
+     [Steve Henson]
+
+  *) Initial certificate chain verify code. Currently tests the untrusted
+     certificates for consistency with the verify purpose (which is set
+     when the X509_STORE_CTX structure is set up) and checks the pathlength.
+
+     There is a NO_CHAIN_VERIFY compilation option to keep the old behaviour:
+     this is because it will reject chains with invalid extensions whereas
+     every previous version of OpenSSL and SSLeay made no checks at all.
+
+     Trust code: checks the root CA for the relevant trust settings. Trust
+     settings have an initial value consistent with the verify purpose: e.g.
+     if the verify purpose is for SSL client use it expects the CA to be
+     trusted for SSL client use. However the default value can be changed to
+     permit custom trust settings: one example of this would be to only trust
+     certificates from a specific "secure" set of CAs.
+
+     Also added X509_STORE_CTX_new() and X509_STORE_CTX_free() functions
+     which should be used for version portability: especially since the
+     verify structure is likely to change more often now.
+
+     SSL integration. Add purpose and trust to SSL_CTX and SSL and functions
+     to set them. If not set then assume SSL clients will verify SSL servers
+     and vice versa.
+
+     Two new options to the verify program: -untrusted allows a set of
+     untrusted certificates to be passed in and -purpose which sets the
+     intended purpose of the certificate. If a purpose is set then the
+     new chain verify code is used to check extension consistency.
+     [Steve Henson]
+
+  *) Support for the authority information access extension.
+     [Steve Henson]
+
+  *) Modify RSA and DSA PEM read routines to transparently handle
+     PKCS#8 format private keys. New *_PUBKEY_* functions that handle
+     public keys in a format compatible with certificate
+     SubjectPublicKeyInfo structures. Unfortunately there were already
+     functions called *_PublicKey_* which used various odd formats so
+     these are retained for compatibility: however the DSA variants were
+     never in a public release so they have been deleted. Changed dsa/rsa
+     utilities to handle the new format: note no releases ever handled public
+     keys so we should be OK.
+
+     The primary motivation for this change is to avoid the same fiasco
+     that dogs private keys: there are several incompatible private key
+     formats some of which are standard and some OpenSSL specific and
+     require various evil hacks to allow partial transparent handling and
+     even then it doesn't work with DER formats. Given the option anything
+     other than PKCS#8 should be dumped: but the other formats have to
+     stay in the name of compatibility.
+
+     With public keys and the benefit of hindsight one standard format 
+     is used which works with EVP_PKEY, RSA or DSA structures: though
+     it clearly returns an error if you try to read the wrong kind of key.
+
+     Added a -pubkey option to the 'x509' utility to output the public key.
+     Also rename the EVP_PKEY_get_*() to EVP_PKEY_rget_*()
+     (renamed to EVP_PKEY_get1_*() in the OpenSSL 0.9.5 release) and add
+     EVP_PKEY_rset_*() functions (renamed to EVP_PKEY_set1_*())
+     that do the same as the EVP_PKEY_assign_*() except they up the
+     reference count of the added key (they don't "swallow" the
+     supplied key).
+     [Steve Henson]
+
+  *) Fixes to crypto/x509/by_file.c the code to read in certificates and
+     CRLs would fail if the file contained no certificates or no CRLs:
+     added a new function to read in both types and return the number
+     read: this means that if none are read it will be an error. The
+     DER versions of the certificate and CRL reader would always fail
+     because it isn't possible to mix certificates and CRLs in DER format
+     without choking one or the other routine. Changed this to just read
+     a certificate: this is the best we can do. Also modified the code
+     in apps/verify.c to take notice of return codes: it was previously
+     attempting to read in certificates from NULL pointers and ignoring
+     any errors: this is one reason why the cert and CRL reader seemed
+     to work. It doesn't check return codes from the default certificate
+     routines: these may well fail if the certificates aren't installed.
+     [Steve Henson]
+
+  *) Code to support otherName option in GeneralName.
+     [Steve Henson]
+
+  *) First update to verify code. Change the verify utility
+     so it warns if it is passed a self signed certificate:
+     for consistency with the normal behaviour. X509_verify
+     has been modified to it will now verify a self signed
+     certificate if *exactly* the same certificate appears
+     in the store: it was previously impossible to trust a
+     single self signed certificate. This means that:
+     openssl verify ss.pem
+     now gives a warning about a self signed certificate but
+     openssl verify -CAfile ss.pem ss.pem
+     is OK.
+     [Steve Henson]
+
+  *) For servers, store verify_result in SSL_SESSION data structure
+     (and add it to external session representation).
+     This is needed when client certificate verifications fails,
+     but an application-provided verification callback (set by
+     SSL_CTX_set_cert_verify_callback) allows accepting the session
+     anyway (i.e. leaves x509_store_ctx->error != X509_V_OK
+     but returns 1): When the session is reused, we have to set
+     ssl->verify_result to the appropriate error code to avoid
+     security holes.
+     [Bodo Moeller, problem pointed out by Lutz Jaenicke]
+
+  *) Fix a bug in the new PKCS#7 code: it didn't consider the
+     case in PKCS7_dataInit() where the signed PKCS7 structure
+     didn't contain any existing data because it was being created.
+     [Po-Cheng Chen <pocheng@nst.com.tw>, slightly modified by Steve Henson]
+
+  *) Add a salt to the key derivation routines in enc.c. This
+     forms the first 8 bytes of the encrypted file. Also add a
+     -S option to allow a salt to be input on the command line.
+     [Steve Henson]
+
+  *) New function X509_cmp(). Oddly enough there wasn't a function
+     to compare two certificates. We do this by working out the SHA1
+     hash and comparing that. X509_cmp() will be needed by the trust
+     code.
+     [Steve Henson]
+
+  *) SSL_get1_session() is like SSL_get_session(), but increments
+     the reference count in the SSL_SESSION returned.
+     [Geoff Thorpe <geoff@eu.c2.net>]
+
+  *) Fix for 'req': it was adding a null to request attributes.
+     Also change the X509_LOOKUP and X509_INFO code to handle
+     certificate auxiliary information.
+     [Steve Henson]
+
+  *) Add support for 40 and 64 bit RC2 and RC4 algorithms: document
+     the 'enc' command.
+     [Steve Henson]
+
+  *) Add the possibility to add extra information to the memory leak
+     detecting output, to form tracebacks, showing from where each
+     allocation was originated: CRYPTO_push_info("constant string") adds
+     the string plus current file name and line number to a per-thread
+     stack, CRYPTO_pop_info() does the obvious, CRYPTO_remove_all_info()
+     is like calling CYRPTO_pop_info() until the stack is empty.
+     Also updated memory leak detection code to be multi-thread-safe.
+     [Richard Levitte]
+
+  *) Add options -text and -noout to pkcs7 utility and delete the
+     encryption options which never did anything. Update docs.
+     [Steve Henson]
+
+  *) Add options to some of the utilities to allow the pass phrase
+     to be included on either the command line (not recommended on
+     OSes like Unix) or read from the environment. Update the
+     manpages and fix a few bugs.
+     [Steve Henson]
+
+  *) Add a few manpages for some of the openssl commands.
+     [Steve Henson]
+
+  *) Fix the -revoke option in ca. It was freeing up memory twice,
+     leaking and not finding already revoked certificates.
+     [Steve Henson]
+
+  *) Extensive changes to support certificate auxiliary information.
+     This involves the use of X509_CERT_AUX structure and X509_AUX
+     functions. An X509_AUX function such as PEM_read_X509_AUX()
+     can still read in a certificate file in the usual way but it
+     will also read in any additional "auxiliary information". By
+     doing things this way a fair degree of compatibility can be
+     retained: existing certificates can have this information added
+     using the new 'x509' options. 
+
+     Current auxiliary information includes an "alias" and some trust
+     settings. The trust settings will ultimately be used in enhanced
+     certificate chain verification routines: currently a certificate
+     can only be trusted if it is self signed and then it is trusted
+     for all purposes.
+     [Steve Henson]
+
+  *) Fix assembler for Alpha (tested only on DEC OSF not Linux or *BSD).
+     The problem was that one of the replacement routines had not been working
+     since SSLeay releases.  For now the offending routine has been replaced
+     with non-optimised assembler.  Even so, this now gives around 95%
+     performance improvement for 1024 bit RSA signs.
+     [Mark Cox]
+
+  *) Hack to fix PKCS#7 decryption when used with some unorthodox RC2 
+     handling. Most clients have the effective key size in bits equal to
+     the key length in bits: so a 40 bit RC2 key uses a 40 bit (5 byte) key.
+     A few however don't do this and instead use the size of the decrypted key
+     to determine the RC2 key length and the AlgorithmIdentifier to determine
+     the effective key length. In this case the effective key length can still
+     be 40 bits but the key length can be 168 bits for example. This is fixed
+     by manually forcing an RC2 key into the EVP_PKEY structure because the
+     EVP code can't currently handle unusual RC2 key sizes: it always assumes
+     the key length and effective key length are equal.
+     [Steve Henson]
+
+  *) Add a bunch of functions that should simplify the creation of 
+     X509_NAME structures. Now you should be able to do:
+     X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC, "Steve", -1, -1, 0);
+     and have it automatically work out the correct field type and fill in
+     the structures. The more adventurous can try:
+     X509_NAME_add_entry_by_txt(nm, field, MBSTRING_UTF8, str, -1, -1, 0);
+     and it will (hopefully) work out the correct multibyte encoding.
+     [Steve Henson]
+
+  *) Change the 'req' utility to use the new field handling and multibyte
+     copy routines. Before the DN field creation was handled in an ad hoc
+     way in req, ca, and x509 which was rather broken and didn't support
+     BMPStrings or UTF8Strings. Since some software doesn't implement
+     BMPStrings or UTF8Strings yet, they can be enabled using the config file
+     using the dirstring_type option. See the new comment in the default
+     openssl.cnf for more info.
+     [Steve Henson]
+
+  *) Make crypto/rand/md_rand.c more robust:
+     - Assure unique random numbers after fork().
+     - Make sure that concurrent threads access the global counter and
+       md serializably so that we never lose entropy in them
+       or use exactly the same state in multiple threads.
+       Access to the large state is not always serializable because
+       the additional locking could be a performance killer, and
+       md should be large enough anyway.
+     [Bodo Moeller]
+
+  *) New file apps/app_rand.c with commonly needed functionality
+     for handling the random seed file.
+
+     Use the random seed file in some applications that previously did not:
+          ca,
+          dsaparam -genkey (which also ignored its '-rand' option), 
+          s_client,
+          s_server,
+          x509 (when signing).
+     Except on systems with /dev/urandom, it is crucial to have a random
+     seed file at least for key creation, DSA signing, and for DH exchanges;
+     for RSA signatures we could do without one.
+
+     gendh and gendsa (unlike genrsa) used to read only the first byte
+     of each file listed in the '-rand' option.  The function as previously
+     found in genrsa is now in app_rand.c and is used by all programs
+     that support '-rand'.
+     [Bodo Moeller]
+
+  *) In RAND_write_file, use mode 0600 for creating files;
+     don't just chmod when it may be too late.
+     [Bodo Moeller]
+
+  *) Report an error from X509_STORE_load_locations
+     when X509_LOOKUP_load_file or X509_LOOKUP_add_dir failed.
+     [Bill Perry]
+
+  *) New function ASN1_mbstring_copy() this copies a string in either
+     ASCII, Unicode, Universal (4 bytes per character) or UTF8 format
+     into an ASN1_STRING type. A mask of permissible types is passed
+     and it chooses the "minimal" type to use or an error if not type
+     is suitable.
+     [Steve Henson]
+
+  *) Add function equivalents to the various macros in asn1.h. The old
+     macros are retained with an M_ prefix. Code inside the library can
+     use the M_ macros. External code (including the openssl utility)
+     should *NOT* in order to be "shared library friendly".
+     [Steve Henson]
+
+  *) Add various functions that can check a certificate's extensions
+     to see if it usable for various purposes such as SSL client,
+     server or S/MIME and CAs of these types. This is currently 
+     VERY EXPERIMENTAL but will ultimately be used for certificate chain
+     verification. Also added a -purpose flag to x509 utility to
+     print out all the purposes.
+     [Steve Henson]
+
+  *) Add a CRYPTO_EX_DATA to X509 certificate structure and associated
+     functions.
+     [Steve Henson]
+
+  *) New X509V3_{X509,CRL,REVOKED}_get_d2i() functions. These will search
+     for, obtain and decode and extension and obtain its critical flag.
+     This allows all the necessary extension code to be handled in a
+     single function call.
+     [Steve Henson]
+
+  *) RC4 tune-up featuring 30-40% performance improvement on most RISC
+     platforms. See crypto/rc4/rc4_enc.c for further details.
+     [Andy Polyakov]
+
+  *) New -noout option to asn1parse. This causes no output to be produced
+     its main use is when combined with -strparse and -out to extract data
+     from a file (which may not be in ASN.1 format).
+     [Steve Henson]
+
+  *) Fix for pkcs12 program. It was hashing an invalid certificate pointer
+     when producing the local key id.
+     [Richard Levitte <levitte@stacken.kth.se>]
+
+  *) New option -dhparam in s_server. This allows a DH parameter file to be
+     stated explicitly. If it is not stated then it tries the first server
+     certificate file. The previous behaviour hard coded the filename
+     "server.pem".
+     [Steve Henson]
+
+  *) Add -pubin and -pubout options to the rsa and dsa commands. These allow
+     a public key to be input or output. For example:
+     openssl rsa -in key.pem -pubout -out pubkey.pem
+     Also added necessary DSA public key functions to handle this.
+     [Steve Henson]
+
+  *) Fix so PKCS7_dataVerify() doesn't crash if no certificates are contained
+     in the message. This was handled by allowing
+     X509_find_by_issuer_and_serial() to tolerate a NULL passed to it.
+     [Steve Henson, reported by Sampo Kellomaki <sampo@mail.neuronio.pt>]
+
+  *) Fix for bug in d2i_ASN1_bytes(): other ASN1 functions add an extra null
+     to the end of the strings whereas this didn't. This would cause problems
+     if strings read with d2i_ASN1_bytes() were later modified.
+     [Steve Henson, reported by Arne Ansper <arne@ats.cyber.ee>]
+
+  *) Fix for base64 decode bug. When a base64 bio reads only one line of
+     data and it contains EOF it will end up returning an error. This is
+     caused by input 46 bytes long. The cause is due to the way base64
+     BIOs find the start of base64 encoded data. They do this by trying a
+     trial decode on each line until they find one that works. When they
+     do a flag is set and it starts again knowing it can pass all the
+     data directly through the decoder. Unfortunately it doesn't reset
+     the context it uses. This means that if EOF is reached an attempt
+     is made to pass two EOFs through the context and this causes the
+     resulting error. This can also cause other problems as well. As is
+     usual with these problems it takes *ages* to find and the fix is
+     trivial: move one line.
+     [Steve Henson, reported by ian@uns.ns.ac.yu (Ivan Nejgebauer) ]
+
+  *) Ugly workaround to get s_client and s_server working under Windows. The
+     old code wouldn't work because it needed to select() on sockets and the
+     tty (for keypresses and to see if data could be written). Win32 only
+     supports select() on sockets so we select() with a 1s timeout on the
+     sockets and then see if any characters are waiting to be read, if none
+     are present then we retry, we also assume we can always write data to
+     the tty. This isn't nice because the code then blocks until we've
+     received a complete line of data and it is effectively polling the
+     keyboard at 1s intervals: however it's quite a bit better than not
+     working at all :-) A dedicated Windows application might handle this
+     with an event loop for example.
+     [Steve Henson]
+
+  *) Enhance RSA_METHOD structure. Now there are two extra methods, rsa_sign
+     and rsa_verify. When the RSA_FLAGS_SIGN_VER option is set these functions
+     will be called when RSA_sign() and RSA_verify() are used. This is useful
+     if rsa_pub_dec() and rsa_priv_enc() equivalents are not available.
+     For this to work properly RSA_public_decrypt() and RSA_private_encrypt()
+     should *not* be used: RSA_sign() and RSA_verify() must be used instead.
+     This necessitated the support of an extra signature type NID_md5_sha1
+     for SSL signatures and modifications to the SSL library to use it instead
+     of calling RSA_public_decrypt() and RSA_private_encrypt().
+     [Steve Henson]
+
+  *) Add new -verify -CAfile and -CApath options to the crl program, these
+     will lookup a CRL issuers certificate and verify the signature in a
+     similar way to the verify program. Tidy up the crl program so it
+     no longer accesses structures directly. Make the ASN1 CRL parsing a bit
+     less strict. It will now permit CRL extensions even if it is not
+     a V2 CRL: this will allow it to tolerate some broken CRLs.
+     [Steve Henson]
+
+  *) Initialize all non-automatic variables each time one of the openssl
+     sub-programs is started (this is necessary as they may be started
+     multiple times from the "OpenSSL>" prompt).
+     [Lennart Bang, Bodo Moeller]
+
+  *) Preliminary compilation option RSA_NULL which disables RSA crypto without
+     removing all other RSA functionality (this is what NO_RSA does). This
+     is so (for example) those in the US can disable those operations covered
+     by the RSA patent while allowing storage and parsing of RSA keys and RSA
+     key generation.
+     [Steve Henson]
+
+  *) Non-copying interface to BIO pairs.
+     (still largely untested)
+     [Bodo Moeller]
+
+  *) New function ANS1_tag2str() to convert an ASN1 tag to a descriptive
+     ASCII string. This was handled independently in various places before.
+     [Steve Henson]
+
+  *) New functions UTF8_getc() and UTF8_putc() that parse and generate
+     UTF8 strings a character at a time.
+     [Steve Henson]
+
+  *) Use client_version from client hello to select the protocol
+     (s23_srvr.c) and for RSA client key exchange verification
+     (s3_srvr.c), as required by the SSL 3.0/TLS 1.0 specifications.
+     [Bodo Moeller]
+
+  *) Add various utility functions to handle SPKACs, these were previously
+     handled by poking round in the structure internals. Added new function
+     NETSCAPE_SPKI_print() to print out SPKAC and a new utility 'spkac' to
+     print, verify and generate SPKACs. Based on an original idea from
+     Massimiliano Pala <madwolf@comune.modena.it> but extensively modified.
+     [Steve Henson]
+
+  *) RIPEMD160 is operational on all platforms and is back in 'make test'.
+     [Andy Polyakov]
+
+  *) Allow the config file extension section to be overwritten on the
+     command line. Based on an original idea from Massimiliano Pala
+     <madwolf@comune.modena.it>. The new option is called -extensions
+     and can be applied to ca, req and x509. Also -reqexts to override
+     the request extensions in req and -crlexts to override the crl extensions
+     in ca.
+     [Steve Henson]
+
+  *) Add new feature to the SPKAC handling in ca.  Now you can include
+     the same field multiple times by preceding it by "XXXX." for example:
+     1.OU="Unit name 1"
+     2.OU="Unit name 2"
+     this is the same syntax as used in the req config file.
+     [Steve Henson]
+
+  *) Allow certificate extensions to be added to certificate requests. These
+     are specified in a 'req_extensions' option of the req section of the
+     config file. They can be printed out with the -text option to req but
+     are otherwise ignored at present.
+     [Steve Henson]
+
+  *) Fix a horrible bug in enc_read() in crypto/evp/bio_enc.c: if the first
+     data read consists of only the final block it would not decrypted because
+     EVP_CipherUpdate() would correctly report zero bytes had been decrypted.
+     A misplaced 'break' also meant the decrypted final block might not be
+     copied until the next read.
+     [Steve Henson]
+
+  *) Initial support for DH_METHOD. Again based on RSA_METHOD. Also added
+     a few extra parameters to the DH structure: these will be useful if
+     for example we want the value of 'q' or implement X9.42 DH.
+     [Steve Henson]
+
+  *) Initial support for DSA_METHOD. This is based on the RSA_METHOD and
+     provides hooks that allow the default DSA functions or functions on a
+     "per key" basis to be replaced. This allows hardware acceleration and
+     hardware key storage to be handled without major modification to the
+     library. Also added low level modexp hooks and CRYPTO_EX structure and 
+     associated functions.
+     [Steve Henson]
+
+  *) Add a new flag to memory BIOs, BIO_FLAG_MEM_RDONLY. This marks the BIO
+     as "read only": it can't be written to and the buffer it points to will
+     not be freed. Reading from a read only BIO is much more efficient than
+     a normal memory BIO. This was added because there are several times when
+     an area of memory needs to be read from a BIO. The previous method was
+     to create a memory BIO and write the data to it, this results in two
+     copies of the data and an O(n^2) reading algorithm. There is a new
+     function BIO_new_mem_buf() which creates a read only memory BIO from
+     an area of memory. Also modified the PKCS#7 routines to use read only
+     memory BIOs.
+     [Steve Henson]
+
+  *) Bugfix: ssl23_get_client_hello did not work properly when called in
+     state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of
+     a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
+     but a retry condition occured while trying to read the rest.
+     [Bodo Moeller]
+
+  *) The PKCS7_ENC_CONTENT_new() function was setting the content type as
+     NID_pkcs7_encrypted by default: this was wrong since this should almost
+     always be NID_pkcs7_data. Also modified the PKCS7_set_type() to handle
+     the encrypted data type: this is a more sensible place to put it and it
+     allows the PKCS#12 code to be tidied up that duplicated this
+     functionality.
+     [Steve Henson]
+
+  *) Changed obj_dat.pl script so it takes its input and output files on
+     the command line. This should avoid shell escape redirection problems
+     under Win32.
+     [Steve Henson]
+
+  *) Initial support for certificate extension requests, these are included
+     in things like Xenroll certificate requests. Included functions to allow
+     extensions to be obtained and added.
+     [Steve Henson]
+
+  *) -crlf option to s_client and s_server for sending newlines as
+     CRLF (as required by many protocols).
+     [Bodo Moeller]
+
  Changes between 0.9.3a and 0.9.4  [09 Aug 1999]
   
   *) Install libRSAglue.a when OpenSSL is built with RSAref.
@@ -49,9 +1147,9 @@
      method only got called if p,q,dmp1,dmq1,iqmp components were present,
      otherwise bn_mod_exp was called. In the case of hardware keys for example
      no private key components need be present and it might store extra data
-     in the RSA structure, which cannot be accessed from bn_mod_exp. By setting
-     RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for private key
-     operations.
+     in the RSA structure, which cannot be accessed from bn_mod_exp.
+     By setting RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for
+     private key operations.
      [Steve Henson]
 
   *) Added support for SPARC Linux.
@@ -65,7 +1163,7 @@
      The PEM[_ASN1]_{read,write}... functions and macros now take an
      additional void * argument, which is just handed through whenever
      the password callback is called.
-     [Damien Miller <dmiller@ilogic.com.au>, with tiny changes by Bodo Moeller]
+     [Damien Miller <dmiller@ilogic.com.au>; tiny changes by Bodo Moeller]
 
      New function SSL_CTX_set_default_passwd_cb_userdata.
 
diff --git a/src/lib/libssl/src/Configure b/src/lib/libssl/src/Configure
index fdad0c238c..8c795f9799 100644
--- a/src/lib/libssl/src/Configure
+++ b/src/lib/libssl/src/Configure
@@ -51,6 +51,10 @@ my $usage="Usage: Configure [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [rsaref] [no
 # RC4_LONG      use 'long' instead of 'int' for RC4_INT in crypto/rc4/rc4.h
 # RC4_INDEX     define RC4_INDEX in crypto/rc4/rc4_locl.h.  This turns on
 #               array lookups instead of pointer use.
+# RC4_CHUNK     enables code that handles data aligned at long (natural CPU
+#               word) boundary.
+# RC4_CHUNK_LL  enables code that handles data aligned at long long boundary
+#               (intended for 64-bit CPUs running 32-bit OS).
 # BF_PTR        use 'pointer arithmatic' for Blowfish (unsafe on Alpha).
 # BF_PTR2       intel specific version (generic version is more efficient).
 # MD5_ASM       use some extra md5 assember,
@@ -82,8 +86,8 @@ my $x86_bsdi_asm="asm/bn86bsdi.o asm/co86bsdi.o:asm/dx86bsdi.o asm/yx86bsdi.o:as
 # -DB_ENDIAN slows things down on a sparc for md5, but helps sha1.
 # So the md5_locl.h file has an undef B_ENDIAN if sun is defined
 
-#config-string  CC : CFLAGS : LDFLAGS : special header file mods:bn_asm \
-# des_asm:bf_asm
+#config-string  $cc : $cflags : $unistd : $thread_cflag : $lflags : $bn_ops : $bn_obj : $des_obj : $bf_obj : $md5_obj : $sha1_obj : $cast_obj : $rc4_obj : $rmd160_obj : $rc5_obj
+
 my %table=(
 #"b",           "$tcc:$tflags::$tlib:$bits1:$tbn_mul::",
 #"bl-4c-2c",    "$tcc:$tflags::$tlib:${bits1}BN_LLONG RC4_CHAR MD2_CHAR:$tbn_mul::",
@@ -92,80 +96,123 @@ my %table=(
 
 # Our development configs
 "purify",       "purify gcc:-g -DPURIFY -Wall::(unknown):-lsocket -lnsl::::",
-"debug",        "gcc:-DBN_DEBUG -DREF_CHECK -DCRYPTO_MDEBUG -ggdb -g2 -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror::(unknown):-lefence::::",
-"debug-ben",    "gcc:-DBN_DEBUG -DREF_CHECK -DCRYPTO_MDEBUG -DPEDANTIC -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::",
-"debug-ben-debug",      "gcc:-DBN_DEBUG -DREF_CHECK -DCRYPTO_MDEBUG -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::",
-"debug-ben-strict",     "gcc:-DBN_DEBUG -DREF_CHECK -DCRYPTO_MDEBUG -DCONST_STRICT -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe::(unknown):::::",
+"debug",        "gcc:-DBN_DEBUG -DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -ggdb -g2 -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror::(unknown):-lefence::::",
+"debug-ben",    "gcc:-DBN_DEBUG -DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::",
+"debug-ben-debug",      "gcc:-DBN_DEBUG -DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::",
+"debug-ben-strict",     "gcc:-DBN_DEBUG -DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DCONST_STRICT -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe::(unknown):::::",
 "debug-rse","cc:-DTERMIOS -DL_ENDIAN -pipe -O -g -ggdb3 -Wall::(unknown)::BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
-"debug-bodo",   "gcc:-DBIO_PAIR_DEBUG -DL_ENDIAN -DREF_CHECK -DCRYPTO_MDEBUG_ALL -g -m486 -Wall::-D_REENTRANT::BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
+"debug-bodo",   "gcc:-DBIO_PAIR_DEBUG -DL_ENDIAN -DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -g -m486 -pedantic -Wshadow -Wall::-D_REENTRANT::BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
+"debug-ulf",    "gcc:-DL_ENDIAN -DREF_CHECK -DBN_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -g -O2 -m486 -Wall -Werror -Wshadow -pipe::-D_REENTRANT::$x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
+"debug-steve",  "gcc:-DL_ENDIAN -DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -DPEDANTIC -g -O2 -m486 -pedantic -Wall -Werror -Wshadow -pipe::-D_REENTRANT::$x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
+"debug-levitte-linux-elf","gcc:-DRL_DEBUG -DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DNO_ASM -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -ggdb -g3 -m486 -pedantic -ansi -Wall -Wshadow -Wid-clash-31 -pipe::-D_REENTRANT:::",
 "dist",         "cc:-O::(unknown):::::",
 
-# Basic configs that should work on any box
+# Basic configs that should work on any (32 and less bit) box
 "gcc",          "gcc:-O3::(unknown)::BN_LLONG:::",
 "cc",           "cc:-O::(unknown):::::",
 
 #### Solaris x86 setups
-"solaris-x86-gcc","gcc:-O3 -fomit-frame-pointer -m486 -Wall -DL_ENDIAN::-D_REENTRANT:-lsocket -lnsl:BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_sol_asm",
+# -DNO_INLINE_ASM switches off inline assembler. We have to do it
+# here because whenever GNU C instantiates an assembler template it
+# surrounds it with #APP #NO_APP comment pair which (at least Solaris
+# 7_x86) /usr/ccs/bin/as fails to assemble with "Illegal mnemonic"
+# error message.
+"solaris-x86-gcc","gcc:-O3 -fomit-frame-pointer -m486 -Wall -DL_ENDIAN -DNO_INLINE_ASM::-D_REENTRANT:-lsocket -lnsl:BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_sol_asm",
 
 #### SPARC Solaris with GNU C setups
-"solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_UNROLL BF_PTR:::",
-"solaris-sparcv8-gcc","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_UNROLL BF_PTR:asm/sparcv8.o::",
-"solaris-sparcv9-gcc","gcc:-mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o:",
+"solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:::",
+"solaris-sparcv8-gcc","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o::",
+"solaris-sparcv9-gcc","gcc:-mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o:",
 # gcc pre-2.8 doesn't understand -mcpu=ultrasparc, so fall down to -mv8
 # but keep the assembler modules.
-"solaris-sparcv9-gcc27","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_UNROLL BF_PTR:asm/sparcv8plus-gcc27.o:::asm/md5-sparcv8plus-gcc27.o:",
+"solaris-sparcv9-gcc27","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus-gcc27.o:::asm/md5-sparcv8plus-gcc27.o:",
 ####
-"debug-solaris-sparcv8-gcc","gcc:-DREF_CHECK -DCRYPTO_MDEBUG_ALL -O -g -mv8 -Wall -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_UNROLL BF_PTR:::",
-"debug-solaris-sparcv9-gcc","gcc:-DREF_CHECK -DCRYPTO_MDEBUG_ALL -O -g -mcpu=ultrasparc -Wall -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_UNROLL BF_PTR:asm/sparcv8plus.o::",
+"debug-solaris-sparcv8-gcc","gcc:-DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -O -g -mv8 -Wall -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o::",
+"debug-solaris-sparcv9-gcc","gcc:-DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -O -g -mcpu=ultrasparc -Wall -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o::",
 
 #### SPARC Solaris with Sun C setups
 # DO NOT use /xO[34] on sparc with SC3.0.  It is broken, and will not pass the tests
-"solaris-sparc-sc3","cc:-fast -O -Xa -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_PTR DES_UNROLL BF_PTR:::",
+"solaris-sparc-sc3","cc:-fast -O -Xa -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR:::",
 # SC4.0 doesn't pass 'make test', upgrade to SC5.0 or SC4.2.
 # SC4.2 is ok, better than gcc even on bn as long as you tell it -xarch=v8
 # SC5.0 note: Compiler common patch 107357-01 or later is required!
-"solaris-sparcv7-cc","cc:-xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_PTR DES_RISC1 DES_UNROLL BF_PTR:::",
-"solaris-sparcv8-cc","cc:-xarch=v8 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8.o::",
-"solaris-sparcv9-cc","cc:-xtarget=ultra -xarch=v8plus -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o:",
-"solaris64-sparcv9-cc","cc:-xtarget=ultra -xarch=v9 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:SIXTY_FOUR_BIT_LONG RC4_CHAR DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::asm/md5-sparcv9.o:",
+"solaris-sparcv7-cc","cc:-xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:::",
+"solaris-sparcv8-cc","cc:-xarch=v8 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8.o::",
+"solaris-sparcv9-cc","cc:-xtarget=ultra -xarch=v8plus -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o:",
+"solaris64-sparcv9-cc","cc:-xtarget=ultra -xarch=v9 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::asm/md5-sparcv9.o:",
+####
+"debug-solaris-sparcv8-cc","cc:-DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -xarch=v8 -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8.o::",
+"debug-solaris-sparcv9-cc","cc:-DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -xtarget=ultra -xarch=v8plus -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o:",
 
 #### SPARC Linux setups
-"linux-sparcv7","gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::BN_LLONG RC4_CHAR DES_UNROLL BF_PTR::",
+"linux-sparcv7","gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::",
 # Ray Miller <ray.miller@computing-services.oxford.ac.uk> has patiently
 # assisted with debugging of following two configs.
-"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR DES_UNROLL BF_PTR:asm/sparcv8.o::::",
+"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o::::",
 # it's a real mess with -mcpu=ultrasparc option under Linux, but
 # -Wa,-Av8plus should do the trick no matter what.
-"linux-sparcv9","gcc:-mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DULTRASPARC -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o:",
+"linux-sparcv9","gcc:-mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DULTRASPARC -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o:",
 # !!!Folowing can't be even tested yet!!!
 #    We have to wait till 64-bit glibc for SPARC is operational!!!
-#"linux64-sparcv9","sparc64-linux-gcc:-m64 -mcpu=v9 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DULTRASPARC -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR DES_UNROLL BF_PTR::::asm/md5-sparcv9.o:",
+#"linux64-sparcv9","sparc64-linux-gcc:-m64 -mcpu=v9 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DULTRASPARC -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::asm/md5-sparcv9.o:",
 
 # Sunos configs, assuming sparc for the gcc one.
 ##"sunos-cc", "cc:-O4 -DNOPROTO -DNOCONST::(unknown)::DES_UNROLL:::",
-"sunos-gcc","gcc:-O3 -mv8::(unknown)::BN_LLONG RC4_CHAR DES_UNROLL DES_PTR DES_RISC1:::",
+"sunos-gcc","gcc:-O3 -mv8::(unknown)::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL DES_PTR DES_RISC1:::",
 
 #### IRIX 5.x configs
 # -mips2 flag is added by ./config when appropriate.
-"irix-gcc","gcc:-O3 -DTERMIOS -DB_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC2 DES_PTR BF_PTR:::",
-"irix-cc", "cc:-O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown)::BN_LLONG DES_PTR DES_RISC2 DES_UNROLL BF_PTR:::",
+"irix-gcc","gcc:-O3 -DTERMIOS -DB_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK DES_UNROLL DES_RISC2 DES_PTR BF_PTR:::",
+"irix-cc", "cc:-O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown)::BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC2 DES_UNROLL BF_PTR:::",
 #### IRIX 6.x configs
 # Only N32 and N64 ABIs are supported. If you need O32 ABI build, invoke
 # './Configure irix-[g]cc' manually.
 # -mips4 flag is added by ./config when appropriate.
-"irix-mips3-gcc","gcc:-mabi=n32 -mmips-as -O3 -DTERMIOS -DB_ENDIAN::(unknown)::MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC2 DES_PTR BF_PTR SIXTY_FOUR_BIT:asm/mips3.o::",
-"irix-mips3-cc", "cc:-n32 -O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown)::DES_PTR DES_RISC2 DES_UNROLL BF_PTR SIXTY_FOUR_BIT:asm/mips3.o::",
+"irix-mips3-gcc","gcc:-mabi=n32 -mmips-as -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::(unknown)::MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK_LL DES_UNROLL DES_RISC2 DES_PTR BF_PTR SIXTY_FOUR_BIT:asm/mips3.o::",
+"irix-mips3-cc", "cc:-n32 -O2 -use_readonly_const -DTERMIOS -DB_ENDIAN -DBN_DIV3W::(unknown)::DES_PTR RC4_CHAR RC4_CHUNK_LL DES_RISC2 DES_UNROLL BF_PTR SIXTY_FOUR_BIT:asm/mips3.o::",
 # N64 ABI builds.
-"irix64-mips4-gcc","gcc:-mabi=64 -mips4 -mmips-as -O3 -DTERMIOS -DB_ENDIAN::(unknown)::DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:asm/mips3.o::",
-"irix64-mips4-cc", "cc:-64 -mips4 -O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown)::DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:asm/mips3.o::",
+"irix64-mips4-gcc","gcc:-mabi=64 -mips4 -mmips-as -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::(unknown)::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:asm/mips3.o::",
+"irix64-mips4-cc", "cc:-64 -mips4 -O2 -use_readonly_const -DTERMIOS -DB_ENDIAN -DBN_DIV3W::(unknown)::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:asm/mips3.o::",
+
+#### Unified HP-UX ANSI C configs.
+# Special notes:
+# - Originally we were optimizing at +O4 level. It should be noted
+#   that the only difference between +O3 and +O4 is global inter-
+#   procedural analysis. As it has to be performed during the link
+#   stage the compiler leaves behind certain pseudo-code in lib*.a
+#   which might be release or even patch level specific. Generating
+#   the machine code for and analyzing the *whole* program appears
+#   to be *extremely* memory demanding while the performance gain is
+#   actually questionable. The situation is intensified by the default
+#   HP-UX data set size limit (infamous 'maxdsiz' tunable) of 64MB
+#   which is way too low for +O4. In other words, doesn't +O3 make
+#   more sense?
+# - Keep in mind that the HP compiler by default generates code
+#   suitable for execution on the host you're currently compiling at.
+#   If the toolkit is ment to be used on various PA-RISC processors
+#   consider './config +Dportable'.
+# - +DD64 is chosen in favour of +DA2.0W because it's ment to be
+#   compatible with *future* releases.
+# - If you run ./Configure hpux-parisc-[g]cc manually don't forget to
+#   pass -D_REENTRANT on HP-UX 10 and later.
+# - -DMD32_XARRAY triggers workaround for compiler bug we ran into in
+#   32-bit message digests. (For the moment of this writing) HP C
+#   doesn't seem to "digest" too many local variables (they make "him"
+#   chew forever:-). For more details look-up MD32_XARRAY comment in
+#   crypto/sha/sha_lcl.h.
+#                                       <appro@fy.chalmers.se>
+#
+"hpux-parisc-cc","cc:-Ae +O3 +ESlit -z -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY::::BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
+"hpux-parisc-gcc","gcc:-O3 -DB_ENDIAN -DBN_DIV2W::::BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
+"hpux64-parisc-cc","cc:-Ae +DD64 +O3 +ESlit -z -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT::SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:::",
 
 # HPUX 9.X config.
 # Don't use the bundled cc.  It is broken.  Use HP ANSI C if possible, or
 # egcs.  gcc 2.8.1 is also broken.
 
-"hpux-cc",      "cc:-DB_ENDIAN -DBN_DIV2W -Ae +ESlit +O4 -z::(unknown)::BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
+"hpux-cc",      "cc:-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY -Ae +ESlit +O3 -z::(unknown)::BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
 # If hpux-cc fails (e.g. during "make test"), try the next one; otherwise,
-# please report your OS and compiler version to the bugs@openssl.org
+# please report your OS and compiler version to the openssl-bugs@openssl.org
 # mailing list.
 "hpux-brokencc",        "cc:-DB_ENDIAN -DBN_DIV2W -Ae +ESlit +O2 -z::(unknown)::DES_PTR DES_UNROLL DES_RISC1:::",
 
@@ -174,7 +221,7 @@ my %table=(
 "hpux-brokengcc",       "gcc:-DB_ENDIAN -DBN_DIV2W -O3::(unknown)::DES_PTR DES_UNROLL DES_RISC1:::",
 
 # HPUX 10.X config.  Supports threads.
-"hpux10-cc",    "cc:-DB_ENDIAN -DBN_DIV2W -Ae +ESlit +O4 -z::-D_REENTRANT::BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
+"hpux10-cc",    "cc:-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY -Ae +ESlit +O3 -z::-D_REENTRANT::BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
 # If hpux10-cc fails, try this one (if still fails, try deleting BN_LLONG):
 "hpux10-brokencc",      "cc:-DB_ENDIAN -DBN_DIV2W -Ae +ESlit +O2 -z::-D_REENTRANT::BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
 
@@ -184,30 +231,46 @@ my %table=(
 
 # HPUX 11.X from www.globus.org.
 # Only works on PA-RISC 2.0 cpus, and not optimized.  Why?
-"hpux11-32bit-cc","cc:+DA2.0 -DB_ENDIAN -D_HPUX_SOURCE -Aa -Ae +ESlit::-D_REENTRANT::DES_PTR DES_UNROLL DES_RISC1:::",
-"hpux11-64bit-cc","cc:+DA2.0W -g -D_HPUX_SOURCE -Aa -Ae +ESlit::-D_REENTRANT::SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT :::",
+#"hpux11-32bit-cc","cc:+DA2.0 -DB_ENDIAN -D_HPUX_SOURCE -Aa -Ae +ESlit::-D_REENTRANT::DES_PTR DES_UNROLL DES_RISC1:::",
+#"hpux11-64bit-cc","cc:+DA2.0W -g -D_HPUX_SOURCE -Aa -Ae +ESlit::-D_REENTRANT::SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT :::",
+# Use unified settings above instead.
 
 # Dec Alpha, OSF/1 - the alpha164-cc is the flags for a 21164A with
 # the new compiler
 # For gcc, the following gave a %50 speedup on a 164 over the 'DES_INT' version
-"alpha-gcc","gcc:-O3::(unknown)::SIXTY_FOUR_BIT_LONG DES_UNROLL DES_RISC1:::",
-"alpha-cc", "cc:-std1 -tune host -O4 -readonly_strings::(unknown)::SIXTY_FOUR_BIT_LONG:::",
-"alpha164-cc", "cc:-std1 -tune host -fast -readonly_strings::(unknown)::SIXTY_FOUR_BIT_LONG:::",
-"FreeBSD-alpha","gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown)::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2:::",
+"alpha-gcc","gcc:-O3::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_RISC1:asm/alpha.o::",
+"alpha-cc", "cc:-std1 -tune host -O4 -readonly_strings::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK:asm/alpha.o::",
+"alpha164-cc", "cc:-std1 -tune host -fast -readonly_strings::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK:asm/alpha.o::",
+"FreeBSD-alpha","gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC2:::",
+
+#### Alpha Linux with GNU C and Compaq C setups
+# Special notes:
+# - linux-alpha+bwx-gcc is ment to be used from ./config only. If you
+#   ought to run './Configure linux-alpha+bwx-gcc' manually, do
+#   complement the command line with -mcpu=ev56, -mcpu=ev6 or whatever
+#   which is appropriate.
+# - If you use ccc keep in mind that -fast implies -arch host and the
+#   compiler is free to issue instructions which gonna make elder CPU
+#   choke. If you wish to build "blended" toolkit, add -arch generic
+#   *after* -fast and invoke './Configure linux-alpha-ccc' manually.
+#
+#                                       <appro@fy.chalmers.se>
+#
+"linux-alpha-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:asm/alpha.o::",
+"linux-alpha+bwx-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:asm/alpha.o::",
+"linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:asm/alpha.o::",
+"linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:asm/alpha.o::",
 
 # assembler versions -- currently defunct:
-##"alpha-gcc","gcc:-O3::(unknown)::SIXTY_FOUR_BIT_LONG DES_UNROLL DES_RISC1:asm/alpha.o::",
-##"alpha-cc", "cc:-tune host -O4 -readonly_strings::(unknown)::SIXTY_FOUR_BIT_LONG:asm/alpha.o::",
-##"alpha164-cc", "cc:-tune host -fast -readonly_strings::(unknown)::SIXTY_FOUR_BIT_LONG:asm/alpha.o::",
 ##"OpenBSD-alpha","gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2:asm/alpha.o::",
 
 # The intel boxes :-), It would be worth seeing if bsdi-gcc can use the
 # bn86-elf.o file file since it is hand tweaked assembler.
 "linux-elf",    "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall::-D_REENTRANT::BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
-"debug-linux-elf","gcc:-DREF_CHECK -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -m486 -Wall::-D_REENTRANT:-lefence:BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
+"debug-linux-elf","gcc:-DREF_CHECK -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -m486 -Wall::-D_REENTRANT:-lefence:BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
 "linux-aout",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall::(unknown)::BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_out_asm",
 "linux-mips",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::(unknown)::BN_LLONG:::",
-"linux-ppc",    "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::(unknown)::::",
+"linux-ppc",    "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::BN_LLONG::",
 "NetBSD-sparc", "gcc:-DTERMIOS -O3 -fomit-frame-pointer -mv8 -Wall -DB_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL:::",
 "NetBSD-m68",   "gcc:-DTERMIOS -O3 -fomit-frame-pointer -Wall -DB_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL:::",
 "NetBSD-x86",   "gcc:-DTERMIOS -O3 -fomit-frame-pointer -m486 -Wall::(unknown)::BN_LLONG $x86_gcc_des $x86_gcc_opts:",
@@ -224,6 +287,9 @@ my %table=(
 "unixware-2.0","cc:-O -DFILIO_H::(unknown):-lsocket -lnsl:$x86_gcc_des ${x86_gcc_opts}:::",
 "unixware-2.0-pentium","cc:-O -DFILIO_H -Kpentium -Kthread::(unknown):-lsocket -lnsl:MD2_CHAR RC4_INDEX ${x86_gcc_des}::",
 
+# UnixWare 7
+"unixware-7","cc:-O -DFILIO_H -Kalloca::-Kthread:-lsocket -lnsl:MD2_CHAR RC4_INDEX ${x86_gcc_des}::",
+
 # IBM's AIX.
 "aix-cc",   "cc:-O -DAIX -DB_ENDIAN::(unknown)::BN_LLONG RC4_CHAR:::",
 "aix-gcc",  "gcc:-O3 -DAIX -DB_ENDIAN::(unknown)::BN_LLONG RC4_CHAR:::",
@@ -249,7 +315,7 @@ my %table=(
 # for some st_addr stuff, and then sizeof and address-of fails
 # I could not use the ams/alpha.o option because the Cray assembler, 'cam'
 # did not like it.
-"cray-t3e", "cc: -DBIT_FIELD_LIMITS -DTERMIOS::(unknown)::SIXTY_FOUR_BIT_LONG DES_INT:::",
+"cray-t3e", "cc: -DBIT_FIELD_LIMITS -DTERMIOS::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT:::",
 
 # DGUX, 88100.
 "dgux-R3-gcc",  "gcc:-O3 -fomit-frame-pointer::(unknown)::RC4_INDEX DES_UNROLL:::",
@@ -268,7 +334,7 @@ my %table=(
 "SINIX-N","/usr/ucb/cc:-O2 -misaligned::(unknown):-lucb:RC4_INDEX RC4_CHAR:::",
 
 # SIEMENS BS2000/OSD: an EBCDIC-based mainframe
-"BS2000-OSD","c89:-XLLML -XLLMK -XL -DB_ENDIAN -DTERMIOS -DCHARSET_EBCDIC::(unknown):-lsocket -lnsl:THIRTY_TWO_BIT DES_PTR DES_UNROLL MD2_CHAR RC4_INDEX RC4_CHAR BF_PTR:::",
+"BS2000-OSD","c89:-O -XLLML -XLLMK -XL -DB_ENDIAN -DTERMIOS -DCHARSET_EBCDIC::(unknown):-lsocket -lnsl:THIRTY_TWO_BIT DES_PTR DES_UNROLL MD2_CHAR RC4_INDEX RC4_CHAR BF_PTR:::",
 
 # Windows NT, Microsoft Visual C++ 4.0
 
@@ -301,6 +367,9 @@ my %table=(
 "OpenBSD",      "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown)::BN_LLONG RC2_CHAR RC4_INDEX DES_UNROLL:::",
 "OpenBSD-mips","gcc:-O2 -DL_ENDIAN::(unknown):BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC2 DES_PTR BF_PTR::::",
 
+##### MacOS X (a.k.a. Rhapsody) setup
+"rhapsody-ppc-cc","cc:-O3 -DB_ENDIAN::(unknown)::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:::",
+
 );
 
 my @WinTargets=qw(VC-NT VC-WIN32 VC-WIN16 VC-W31-16 VC-W31-32 VC-MSDOS BC-32
@@ -337,12 +406,16 @@ my $ranlib;
 my $perl;
 
 $ranlib=&which("ranlib") or $ranlib="true";
-$perl=&which("perl5") or $perl=&which("perl") or $perl="perl";
+$perl=$ENV{'PERL'} or $perl=&which("perl5") or $perl=&which("perl")
+  or $perl="perl";
 
 &usage if ($#ARGV < 0);
 
 my $flags="";
 my $depflags="";
+my $openssl_algorithm_defines="";
+my $openssl_thread_defines="";
+my $openssl_other_defines="";
 my $libs="";
 my $target="";
 my $options="";
@@ -352,6 +425,7 @@ foreach (@ARGV)
                 {
                 $no_asm=1;
                 $flags .= "-DNO_ASM ";
+                $openssl_other_defines .= "#define NO_ASM\n";
                 }
         elsif (/^no-threads$/)
                 { $no_threads=1; }
@@ -364,11 +438,14 @@ foreach (@ARGV)
                 $algo =~ tr/[a-z]/[A-Z]/;
                 $flags .= "-DNO_$algo ";
                 $depflags .= "-DNO_$algo ";
+                $openssl_algorithm_defines .= "#define NO_$algo\n";
                 if ($algo eq "DES")
                         {
+                        push @skip, "mdc2";
                         $options .= " no-mdc2";
                         $flags .= "-DNO_MDC2 ";
                         $depflags .= "-DNO_MDC2 ";
+                        $openssl_algorithm_defines .= "#define NO_MDC2\n";
                         }
                 }
         elsif (/^386$/)
@@ -377,6 +454,7 @@ foreach (@ARGV)
                 {
                 $libs.= "-lRSAglue -lrsaref ";
                 $flags.= "-DRSAref ";
+                $openssl_other_defines .= "#define RSAref\n";
                 }
         elsif (/^[-+]/)
                 {
@@ -432,6 +510,14 @@ if ($target eq "TABLE") {
         exit 0;
 }
 
+if ($target eq "LIST") {
+        foreach (sort keys %table) {
+                print;
+                print "\n";
+        }
+        exit 0;
+}
+
 &usage if (!defined($table{$target}));
 
 my $IsWindows=scalar grep /^$target$/,@WinTargets;
@@ -454,6 +540,7 @@ print "IsWindows=$IsWindows\n";
 $cflags="$flags$cflags" if ($flags ne "");
 
 my $thread_cflags;
+my $thread_defines;
 if ($thread_cflag ne "(unknown)" && !$no_threads)
         {
         # If we know how to do it, support threads by default.
@@ -463,11 +550,21 @@ if ($thread_cflag eq "(unknown)")
         {
         # If the user asked for "threads", hopefully they also provided
         # any system-dependent compiler options that are necessary.
-        $thread_cflags="-DTHREADS $cflags" 
+        $thread_cflags="-DTHREADS $cflags" ;
+        $thread_defines .= "#define THREADS\n";
         }
 else
         {
-        $thread_cflags="-DTHREADS $thread_cflag $cflags" 
+        $thread_cflags="-DTHREADS $thread_cflag $cflags";
+        $thread_defines .= "#define THREADS\n";
+#       my $def;
+#       foreach $def (split ' ',$thread_cflag)
+#               {
+#               if ($def =~ s/^-D// && $def !~ /^_/)
+#                       {
+#                       $thread_defines .= "#define $def\n";
+#                       }
+#               }
         }       
 
 $lflags="$libs$lflags"if ($libs ne "");
@@ -481,6 +578,7 @@ if ($no_asm)
 if ($threads)
         {
                 $cflags=$thread_cflags;
+                $openssl_thread_defines .= $thread_defines;
         }
 
 #my ($bn1)=split(/\s+/,$bn_obj);
@@ -530,6 +628,7 @@ if ($version =~ /(^[0-9]*)\.([0-9\.]*)/)
 
 open(IN,'<Makefile.org') || die "unable to read Makefile.org:$!\n";
 open(OUT,">$Makefile") || die "unable to create $Makefile:$!\n";
+print OUT "### Generated automatically from Makefile.org by Configure.\n\n";
 my $sdirs=0;
 while (<IN>)
         {
@@ -598,6 +697,7 @@ my $md2_int=$def_int;
 my $idea_int=$def_int;
 my $rc2_int=$def_int;
 my $rc4_idx=0;
+my $rc4_chunk=0;
 my $bf_ptr=0;
 my @type=("char","short","int","long");
 my ($b64l,$b64,$b32,$b16,$b8)=(0,0,1,0,0);
@@ -615,6 +715,8 @@ foreach (sort split(/\s+/,$bn_ops))
         $rc4_int=0 if /RC4_CHAR/;
         $rc4_int=3 if /RC4_LONG/;
         $rc4_idx=1 if /RC4_INDEX/;
+        $rc4_chunk=1 if /RC4_CHUNK/;
+        $rc4_chunk=2 if /RC4_CHUNK_LL/;
         $md2_int=0 if /MD2_CHAR/;
         $md2_int=3 if /MD2_LONG/;
         $idea_int=1 if /IDEA_SHORT/;
@@ -632,6 +734,18 @@ foreach (sort split(/\s+/,$bn_ops))
 
 open(IN,'<crypto/opensslconf.h.in') || die "unable to read crypto/opensslconf.h.in:$!\n";
 open(OUT,'>crypto/opensslconf.h') || die "unable to create crypto/opensslconf.h:$!\n";
+print OUT "/* opensslconf.h */\n";
+print OUT "/* WARNING: Generated automatically from opensslconf.h.in by Configure. */\n\n";
+
+print OUT "/* OpenSSL was configured with the following options: */\n";
+$openssl_algorithm_defines =~ s/^\s*#\s*define\s+(.*)/# ifndef $1\n#  define $1\n# endif/mg;
+$openssl_algorithm_defines = "   /* no ciphers excluded */\n" if $openssl_algorithm_defines eq "";
+$openssl_thread_defines =~ s/^\s*#\s*define\s+(.*)/# ifndef $1\n#  define $1\n# endif/mg;
+$openssl_other_defines =~ s/^\s*#\s*define\s+(.*)/# ifndef $1\n#  define $1\n# endif/mg;
+print OUT "#ifdef OPENSSL_ALGORITHM_DEFINES\n$openssl_algorithm_defines#endif\n";
+print OUT "#ifdef OPENSSL_THREAD_DEFINES\n$openssl_thread_defines#endif\n";
+print OUT "#ifdef OPENSSL_OTHER_DEFINES\n$openssl_other_defines#endif\n\n";
+
 while (<IN>)
         {
         if      (/^#define\s+OPENSSLDIR/)
@@ -666,6 +780,12 @@ while (<IN>)
                 { printf OUT "#%s DES_UNROLL\n",($des_unroll)?'define':'undef'; }
         elsif   (/^#define\s+RC4_INT\s/)
                 { printf OUT "#define RC4_INT unsigned %s\n",$type[$rc4_int]; }
+        elsif   (/^#undef\s+RC4_CHUNK/)
+                {
+                printf OUT "#undef RC4_CHUNK\n" if $rc4_chunk==0;
+                printf OUT "#define RC4_CHUNK unsigned long\n" if $rc4_chunk==1;
+                printf OUT "#define RC4_CHUNK unsigned long long\n" if $rc4_chunk==2;
+                }
         elsif   (/^#((define)|(undef))\s+RC4_INDEX/)
                 { printf OUT "#%s RC4_INDEX\n",($rc4_idx)?"define":"undef"; }
         elsif (/^#(define|undef)\s+I386_ONLY/)
@@ -705,6 +825,9 @@ print "DES_INT used\n" if $des_int;
 print "BN_LLONG mode\n" if $bn_ll;
 print "RC4 uses u$type[$rc4_int]\n" if $rc4_int != $def_int;
 print "RC4_INDEX mode\n" if $rc4_idx;
+print "RC4_CHUNK is undefined\n" if $rc4_chunk==0;
+print "RC4_CHUNK is unsigned long\n" if $rc4_chunk==1;
+print "RC4_CHUNK is unsigned long long\n" if $rc4_chunk==2;
 print "MD2 uses u$type[$md2_int]\n" if $md2_int != $def_int;
 print "IDEA uses u$type[$idea_int]\n" if $idea_int != $def_int;
 print "RC2 uses u$type[$rc2_int]\n" if $rc2_int != $def_int;
@@ -723,8 +846,6 @@ if($IsWindows) {
 #endif
 EOF
         close(OUT);
-
-        system "perl crypto/objects/obj_dat.pl <crypto\\objects\\objects.h >crypto\\objects\\obj_dat.h";
 } else {
         (system "make -f Makefile.ssl PERL=\'$perl\' links") == 0 or exit $?;
         ### (system 'make depend') == 0 or exit $? if $depflags ne "";
@@ -733,43 +854,20 @@ EOF
         &dofile("tools/c_rehash",$openssldir,'^DIR=',   'DIR=%s',);
         if ( $perl =~ m@^/@) {
             &dofile("apps/der_chop",$perl,'^#!/', '#!%s');
+            &dofile("apps/CA.pl",$perl,'^#!/', '#!%s');
         } else {
             # No path for Perl known ...
             &dofile("apps/der_chop",'/usr/local/bin/perl','^#!/', '#!%s');
+            &dofile("apps/CA.pl",'/usr/local/bin/perl','^#!/', '#!%s');
         }           
 }
 
-my $pwd;
-
-if($IsWindows) {
-        $pwd="(current directory)";
-} else {
-        $pwd =`pwd`;
-        chop($pwd);
-}
 print <<EOF;
 
-NOTE: The OpenSSL header files have been moved from include/*.h
-to include/openssl/*.h.  To include OpenSSL header files, now
-directives of the form
-     #include <openssl/foo.h>
-should be used instead of #include <foo.h>.
-These new file locations allow installing the OpenSSL header
-files in /usr/local/include/openssl/ and should help avoid
-conflicts with other libraries.
-
-To compile programs that use the old form <foo.h>,
-usually an additional compiler option will suffice: E.g., add
-     -I$prefix/include/openssl
-or
-     -I$pwd/include/openssl
-to the CFLAGS in the Makefile of the program that you want to compile
-(and leave all the original -I...'s in place!).
-
-Please make sure that no old OpenSSL header files are around:
-The include directory should now be empty except for the openssl
-subdirectory.
+Configured for $target.
 
+NOTE: OpenSSL header files were moved from <*.h> to <openssl/*.h>;
+see file INSTALL for hints on coping with compatibility problems.
 EOF
 
 print <<\EOF if (!$no_threads && !$threads);
@@ -777,7 +875,6 @@ print <<\EOF if (!$no_threads && !$threads);
 The library could not be configured for supporting multi-threaded
 applications as the compiler options required on this system are not known.
 See file INSTALL for details if you need multi-threading.
-
 EOF
 
 exit(0);
@@ -785,22 +882,33 @@ exit(0);
 sub usage
         {
         print STDERR $usage;
-        print STDERR "pick os/compiler from:";
+        print STDERR "\npick os/compiler from:\n";
         my $j=0;
         my $i;
+        my $k=0;
         foreach $i (sort keys %table)
                 {
                 next if $i =~ /^debug/;
-                print STDERR "\n" if ($j++ % 4) == 0;
-                printf(STDERR "%-18s ",$i);
+                $k += length($i) + 1;
+                if ($k > 78)
+                        {
+                        print STDERR "\n";
+                        $k=length($i);
+                        }
+                print STDERR $i . " ";
                 }
         foreach $i (sort keys %table)
                 {
                 next if $i !~ /^debug/;
-                print STDERR "\n" if ($j++ % 4) == 0;
-                printf(STDERR "%-18s ",$i);
+                $k += length($i) + 1;
+                if ($k > 78)
+                        {
+                        print STDERR "\n";
+                        $k=length($i);
+                        }
+                print STDERR $i . " ";
                 }
-        print STDERR "\n";
+        print STDERR "\n\nNOTE: If in doubt, on Unix-ish systems use './config'.\n";
         exit(1);
         }
 
diff --git a/src/lib/libssl/src/FAQ b/src/lib/libssl/src/FAQ
new file mode 100644
index 0000000000..ab84a3f9e8
--- /dev/null
+++ b/src/lib/libssl/src/FAQ
@@ -0,0 +1,130 @@
+OpenSSL  -  Frequently Asked Questions
+--------------------------------------
+
+* Which is the current version of OpenSSL?
+* Where is the documentation?
+* How can I contact the OpenSSL developers?
+* Do I need patent licenses to use OpenSSL?
+* Is OpenSSL thread-safe?
+* Why do I get a "PRNG not seeded" error message?
+* Why does the linker complain about undefined symbols?
+* Where can I get a compiled version of OpenSSL?
+
+
+* Which is the current version of OpenSSL?
+
+The current version is available from <URL: http://www.openssl.org>.
+OpenSSL 0.9.5 was released on February 28th, 2000.
+
+In addition to the current stable release, you can also access daily
+snapshots of the OpenSSL development version at <URL:
+ftp://ftp.openssl.org/snapshot/>, or get it by anonymous CVS access.
+
+
+* Where is the documentation?
+
+OpenSSL is a library that provides cryptographic functionality to
+applications such as secure web servers.  Be sure to read the
+documentation of the application you want to use.  The INSTALL file
+explains how to install this library.
+
+OpenSSL includes a command line utility that can be used to perform a
+variety of cryptographic functions.  It is described in the openssl(1)
+manpage.  Documentation for developers is currently being written.  A
+few manual pages already are available; overviews over libcrypto and
+libssl are given in the crypto(3) and ssl(3) manpages.
+
+The OpenSSL manpages are installed in /usr/local/ssl/man/ (or a
+different directory if you specified one as described in INSTALL).
+In addition, you can read the most current versions at
+<URL: http://www.openssl.org/docs/>.
+
+For information on parts of libcrypto that are not yet documented, you
+might want to read Ariel Glenn's documentation on SSLeay 0.9, OpenSSL's
+predecessor, at <URL: http://www.columbia.edu/~ariel/ssleay/>.  Much
+of this still applies to OpenSSL.
+
+There is some documentation about certificate extensions and PKCS#12
+in doc/openssl.txt
+
+The original SSLeay documentation is included in OpenSSL as
+doc/ssleay.txt.  It may be useful when none of the other resources
+help, but please note that it reflects the obsolete version SSLeay
+0.6.6.
+
+
+* How can I contact the OpenSSL developers?
+
+The README file describes how to submit bug reports and patches to
+OpenSSL.  Information on the OpenSSL mailing lists is available from
+<URL: http://www.openssl.org>.
+
+
+* Do I need patent licenses to use OpenSSL?
+
+The patents section of the README file lists patents that may apply to
+you if you want to use OpenSSL.  For information on intellectual
+property rights, please consult a lawyer.  The OpenSSL team does not
+offer legal advice.
+
+You can configure OpenSSL so as not to use RC5 and IDEA by using
+ ./config no-rc5 no-idea
+
+Until the RSA patent expires, U.S. users may want to use
+ ./config no-rc5 no-idea no-rsa
+
+Please note that you will *not* be able to communicate with most of
+the popular web browsers without RSA support.
+
+
+* Is OpenSSL thread-safe?
+
+Yes.  On Windows and many Unix systems, OpenSSL automatically uses the
+multi-threaded versions of the standard libraries.  If your platform
+is not one of these, consult the INSTALL file.
+
+Multi-threaded applications must provide two callback functions to
+OpenSSL.  This is described in the threads(3) manpage.
+
+
+* Why do I get a "PRNG not seeded" error message?
+
+Cryptographic software needs a source of unpredictable data to work
+correctly.  Many open source operating systems provide a "randomness
+device" that serves this purpose.  On other systems, applications have
+to call the RAND_add() or RAND_seed() function with appropriate data
+before generating keys or performing public key encryption.
+
+Some broken applications do not do this.  As of version 0.9.5, the
+OpenSSL functions that need randomness report an error if the random
+number generator has not been seeded with at least 128 bits of
+randomness.  If this error occurs, please contact the author of the
+application you are using.  It is likely that it never worked
+correctly.  OpenSSL 0.9.5 makes the error visible by refusing to
+perform potentially insecure encryption.
+
+
+* Why does the linker complain about undefined symbols?
+
+Maybe the compilation was interrupted, and make doesn't notice that
+something is missing.  Run "make clean; make".
+
+If you used ./Configure instead of ./config, make sure that you
+selected the right target.  File formats may differ slightly between
+OS versions (for example sparcv8/sparcv9, or a.out/elf).
+
+If that doesn't help, you may want to try using the current snapshot.
+If the problem persists, please submit a bug report.
+
+
+* Where can I get a compiled version of OpenSSL?
+
+Some applications that use OpenSSL are distributed in binary form.
+When using such an application, you don't need to install OpenSSL
+yourself; the application will include the required parts (e.g. DLLs).
+
+If you want to install OpenSSL on a Windows system and you don't have
+a C compiler, read the "Mingw32" section of INSTALL.W32 for information
+on how to obtain and install the free GNU C compiler.
+
+A number of Linux and *BSD distributions include OpenSSL.
diff --git a/src/lib/libssl/src/INSTALL b/src/lib/libssl/src/INSTALL
index 6066fddc4a..57a6c808d8 100644
--- a/src/lib/libssl/src/INSTALL
+++ b/src/lib/libssl/src/INSTALL
@@ -77,8 +77,9 @@
 
      This guesses at your operating system (and compiler, if necessary) and
      configures OpenSSL based on this guess. Run ./config -t to see
-     if it guessed correctly. If it did not get it correct or you want to
-     use a different compiler then go to step 1b. Otherwise go to step 2.
+     if it guessed correctly. If you want to use a different compiler, you
+     are cross-compiling for another platform, or the ./config guess was
+     wrong for other reasons, go to step 1b. Otherwise go to step 2.
 
      On some systems, you can include debugging information as follows:
 
@@ -101,7 +102,8 @@
 
      If your system is not available, you will have to edit the Configure
      program and add the correct configuration for your system. The
-     generic configurations "cc" or "gcc" should usually work.
+     generic configurations "cc" or "gcc" should usually work on 32 bit
+     systems.
 
      Configure creates the file Makefile.ssl from Makefile.org and
      defines various macros in crypto/opensslconf.h (generated from
@@ -115,14 +117,12 @@
      OpenSSL binary ("openssl"). The libraries will be built in the top-level
      directory, and the binary will be in the "apps" directory.
 
-     If "make" fails, please report the problem to <openssl-bugs@openssl.org>.
-     Include the output of "./config -t" and the OpenSSL version
-     number in your message.
+     If "make" fails, please report the problem to <openssl-bugs@openssl.org>
+     (note that your message will be forwarded to a public mailing list).
+     Include the output of "make report" in your message.
 
      [If you encounter assembler error messages, try the "no-asm"
-     configuration option as an immediate fix.  Note that on Solaris x86
-     (not on Sparcs!) you may have to install the GNU assembler to use
-     OpenSSL assembler code -- /usr/ccs/bin/as won't do.]
+     configuration option as an immediate fix.]
 
      Compiling parts of OpenSSL with gcc and others with the system
      compiler will result in unresolved symbols on some systems.
@@ -134,7 +134,7 @@
     If a test fails, try removing any compiler optimization flags from
     the CFLAGS line in Makefile.ssl and run "make clean; make". Please
     send a bug report to <openssl-bugs@openssl.org>, including the
-    output of "openssl version -a" and of the failed test.
+    output of "make report".
 
   4. If everything tests ok, install OpenSSL with
 
@@ -145,11 +145,13 @@
 
        certs           Initially empty, this is the default location
                        for certificate files.
+       man/man1        Manual pages for the 'openssl' command line tool
+       man/man3        Manual pages for the libraries (very incomplete)
        misc            Various scripts.
        private         Initially empty, this is the default location
                        for private key files.
 
-     If you didn't chose a different installation prefix, the
+     If you didn't choose a different installation prefix, the
      following additional subdirectories will be created:
 
        bin             Contains the openssl binary and a few other 
@@ -250,138 +252,3 @@
  you can still use "no-threads" to suppress an annoying warning message
  from the Configure script.)
 
-
---------------------------------------------------------------------------------
-The orignal Unix build instructions from SSLeay follow. 
-Note: some of this may be out of date and no longer applicable
---------------------------------------------------------------------------------
-
-# When bringing the SSLeay distribution back from the evil intel world
-# of Windows NT, do the following to make it nice again under unix :-)
-# You don't normally need to run this.
-sh util/fixNT.sh        # This only works for NT now - eay - 21-Jun-1996
-
-# If you have perl, and it is not in /usr/local/bin, you can run
-perl util/perlpath.pl /new/path
-# and this will fix the paths in all the scripts.  DO NOT put
-# /new/path/perl, just /new/path. The build
-# environment always run scripts as 'perl perlscript.pl' but some of the
-# 'applications' are easier to usr with the path fixed.
-
-# Edit crypto/cryptlib.h, tools/c_rehash, and Makefile.ssl
-# to set the install locations if you don't like
-# the default location of /usr/local/ssl
-# Do this by running
-perl util/ssldir.pl /new/ssl/home
-# if you have perl, or by hand if not.
-
-# If things have been stuffed up with the sym links, run
-make -f Makefile.ssl links
-# This will re-populate lib/include with symlinks and for each
-# directory, link Makefile to Makefile.ssl
-
-# Setup the machine dependent stuff for the top level makefile
-# and some select .h files
-# If you don't have perl, this will bomb, in which case just edit the
-# top level Makefile.ssl
-./Configure 'system type'
-
-# The 'Configure' command contains default configuration parameters
-# for lots of machines.  Configure edits 5 lines in the top level Makefile
-# It modifies the following values in the following files
-Makefile.ssl            CC CFLAG EX_LIBS BN_MULW
-crypto/des/des.h        DES_LONG
-crypto/des/des_locl.h   DES_PTR
-crypto/md2/md2.h        MD2_INT
-crypto/rc4/rc4.h        RC4_INT
-crypto/rc4/rc4_enc.c    RC4_INDEX
-crypto/rc2/rc2.h        RC2_INT
-crypto/bf/bf_locl.h     BF_INT
-crypto/idea/idea.h      IDEA_INT
-crypto/bn/bn.h          BN_LLONG (and defines one of SIXTY_FOUR_BIT,
-                                  SIXTY_FOUR_BIT_LONG, THIRTY_TWO_BIT,
-                                  SIXTEEN_BIT or EIGHT_BIT)
-Please remember that all these files are actually copies of the file with
-a .org extention.  So if you change crypto/des/des.h, the next time
-you run Configure, it will be runover by a 'configured' version of
-crypto/des/des.org.  So to make the changer the default, change the .org
-files.  The reason these files have to be edited is because most of
-these modifications change the size of fundamental data types.
-While in theory this stuff is optional, it often makes a big
-difference in performance and when using assember, it is importaint
-for the 'Bignum bits' match those required by the assember code.
-A warning for people using gcc with sparc cpu's.  Gcc needs the -mv8
-flag to use the hardware multiply instruction which was not present in
-earlier versions of the sparc CPU.  I define it by default.  If you
-have an old sparc, and it crashes, try rebuilding with this flag
-removed.  I am leaving this flag on by default because it makes
-things run 4 times faster :-)
-
-# clean out all the old stuff
-make clean
-
-# Do a make depend only if you have the makedepend command installed
-# This is not needed but it does make things nice when developing.
-make depend
-
-# make should build everything
-make
-
-# fix up the demo certificate hash directory if it has been stuffed up.
-make rehash
-
-# test everything
-make test
-
-# install the lot
-make install
-
-# It is worth noting that all the applications are built into the one
-# program, ssleay, which is then has links from the other programs
-# names to it.
-# The applicatons can be built by themselves, just don't define the
-# 'MONOLITH' flag.  So to build the 'enc' program stand alone,
-gcc -O2 -Iinclude apps/enc.c apps/apps.c libcrypto.a
-
-# Other useful make options are
-make makefile.one
-# which generate a 'makefile.one' file which will build the complete
-# SSLeay distribution with temp. files in './tmp' and 'installable' files
-# in './out'
-
-# Have a look at running
-perl util/mk1mf.pl help
-# this can be used to generate a single makefile and is about the only
-# way to generate makefiles for windows.
-
-# There is actually a final way of building SSLeay.
-gcc -O2 -c -Icrypto -Iinclude crypto/crypto.c
-gcc -O2 -c -Issl -Iinclude ssl/ssl.c
-# and you now have the 2 libraries as single object files :-).
-# If you want to use the assember code for your particular platform
-# (DEC alpha/x86 are the main ones, the other assember is just the
-# output from gcc) you will need to link the assember with the above generated
-# object file and also do the above compile as
-gcc -O2 -DBN_ASM -c -Icrypto -Iinclude crypto/crypto.c
-
-This last option is probably the best way to go when porting to another
-platform or building shared libraries.  It is not good for development so
-I don't normally use it.
-
-To build shared libararies under unix, have a look in shlib, basically 
-you are on your own, but it is quite easy and all you have to do
-is compile 2 (or 3) files.
-
-For mult-threading, have a read of doc/threads.doc.  Again it is quite
-easy and normally only requires some extra callbacks to be defined
-by the application.
-The examples for solaris and windows NT/95 are in the mt directory.
-
-have fun
-
-eric 25-Jun-1997
-
-IRIX 5.x will build as a 32 bit system with mips1 assember.
-IRIX 6.x will build as a 64 bit system with mips3 assember.  It conforms
-to n32 standards. In theory you can compile the 64 bit assember under
-IRIX 5.x but you will have to have the correct system software installed.
diff --git a/src/lib/libssl/src/INSTALL.MacOS b/src/lib/libssl/src/INSTALL.MacOS
new file mode 100644
index 0000000000..a8c4f7f1da
--- /dev/null
+++ b/src/lib/libssl/src/INSTALL.MacOS
@@ -0,0 +1,72 @@
+OpenSSL - Port To The Macintosh
+===============================
+
+Thanks to Roy Wood <roy@centricsystems.ca> initial support for MacOS (pre
+X) is now provided. "Initial" means that unlike other platforms where you
+get an SDK and a "swiss army" openssl application, on Macintosh you only
+get one sample application which fetches a page over HTTPS(*) and dumps it
+in a window. We don't even build the test applications so that we can't
+guarantee that all algorithms are operational.
+
+Required software:
+
+- StuffIt Expander 5.5 or later, alternatively MacGzip and SUNtar;
+- Scriptable Finder;
+- CodeWarrior Pro 5;
+
+Installation procedure:
+
+- fetch the source at ftp://ftp.openssl.org/ (well, you probably already
+  did, huh?)
+- unpack the .tar.gz file:
+        - if you have StuffIt Expander then just drag it over it;
+        - otherwise uncompress it with MacGzip and then unpack with SUNtar;
+- locate MacOS folder in OpenSSL source tree and open it;
+- unbinhex mklinks.as.hqx and OpenSSL.mcp.hqx if present (**), do it
+  "in-place", i.e. unpacked files should end-up in the very same folder;
+- execute mklinks.as;
+- open OpenSSL.mcp(***) and build 'GetHTTPS PPC' target(****);
+- that's it for now;
+
+(*)     URL is hardcoded into ./MacOS/GetHTTPS.src/GetHTTPS.cpp, lines 40
+        to 42, change appropriately.
+(**)    If you use SUNtar, then it might have already unbinhexed the files
+        in question.
+(***)   The project file was saved with CW Pro 5.3. If you have earlier
+        version and it refuses to open it, then download
+        http://www.openssl.org/~appro/OpenSSL.mcp.xml and import it
+        overwriting the original OpenSSL.mcp.
+(****)  Other targets are work in progress. If you feel like giving 'em a
+        shot, then you should know that OpenSSL* and Lib* targets are
+        supposed to be built with the GUSI, MacOS library which mimics
+        BSD sockets and some other POSIX APIs. The GUSI distribution is
+        expected to be found in the same directory as openssl source tree,
+        i.e. in the parent directory to the one where this very file,
+        namely INSTALL.MacOS. For more informations about GUSI, see
+        http://www.iis.ee.ethz.ch/~neeri/macintosh/gusi-qa.html
+
+Finally some essential comments from our generous contributor:-)
+
+"I've gotten OpenSSL working on the Macintosh. It's probably a bit of a
+hack, but it works for what I'm doing. If you don't like the way I've done
+it, then feel free to change what I've done. I freely admit that I've done
+some less-than-ideal things in my port, and if you don't like the way I've
+done something, then feel free to change it-- I won't be offended!
+
+... I've tweaked "bss_sock.c" a little to call routines in a "MacSocket"
+library I wrote. My MacSocket library is a wrapper around OpenTransport,
+handling stuff like endpoint creation, reading, writing, etc. It is not
+designed as a high-performance package such as you'd use in a webserver,
+but is fine for lots of other applications. MacSocket also uses some other
+code libraries I've written to deal with string manipulations and error
+handling. Feel free to use these things in your own code, but give me
+credit and/or send me free stuff in appreciation! :-)
+
+...
+
+If you have any questions, feel free to email me as the following:
+
+roy@centricsystems.ca
+
+-Roy Wood"
+
diff --git a/src/lib/libssl/src/INSTALL.VMS b/src/lib/libssl/src/INSTALL.VMS
index 4c01560d3d..0a25324033 100644
--- a/src/lib/libssl/src/INSTALL.VMS
+++ b/src/lib/libssl/src/INSTALL.VMS
@@ -8,13 +8,44 @@ Intro:
 
 This file is divided in the following parts:
 
+  Checking the distribution     - Mandatory reading.
   Compilation                   - Mandatory reading.
+  Logical names                 - Mandatory reading.
   Test                          - Mandatory reading.
   Installation                  - Mandatory reading.
   Backward portability          - Read if it's an issue.
   Possible bugs or quirks       - A few warnings on things that
                                   may go wrong or may surprise you.
-  Report                        - How to get in touch with me.
+  TODO                          - Things that are to come.
+
+
+Checking the distribution:
+==========================
+
+There have been reports of places where the distribution didn't quite get
+through, for example if you've copied the tree from a NFS-mounted unix
+mount point.
+
+The easiest way to check if everything got through as it should is to check
+for oen of the following files:
+
+        [.CRYPTO]OPENSSLCONF.H_IN
+        [.CRYPTO]OPENSSLCONF_H.IN
+
+They should never exist both at once, but one of them should (preferably
+the first variant).  If you can't find any of those two, something went
+wrong.
+
+The best way to get a correct distribution is to download the gzipped tar
+file from ftp://ftp.openssl.org/source/, use GUNZIP to uncompress it and
+use VMSTAR to unpack the resulting tar file.
+
+GUNZIP is available in many places on the net.  One of the distribution
+points is the WKU software archive, ftp://ftp.wku.edu/vms/fileserv/ .
+
+VMSTAR is also available in many places on the net.  The recommended place
+to find information about it is http://www.free.lp.se/vmstar/ .
+
 
 Compilation:
 ============
@@ -35,26 +66,28 @@ directory.  The syntax is trhe following:
 <option> must be one of the following:
 
       ALL       Just build "everything".
-      DATE      Just build the "[.INCLUDE]DATE.H" file.
+      CONFIG    Just build the "[.CRYPTO]OPENSSLCONF.H" file.
+      BUILDINF  Just build the "[.INCLUDE]BUILDINF.H" file.
       SOFTLINKS Just copies some files, to simulate Unix soft links.
+      BUILDALL  Same as ALL, except CONFIG, BUILDINF and SOFTILNKS aren't done.
       RSAREF    Just build the "[.xxx.EXE.RSAREF]LIBRSAGLUE.OLB" library.
       CRYPTO    Just build the "[.xxx.EXE.CRYPTO]LIBCRYPTO.OLB" library.
       SSL       Just build the "[.xxx.EXE.SSL]LIBSSL.OLB" library.
       SSL_TASK  Just build the "[.xxx.EXE.SSL]SSL_TASK.EXE" program.
-      TEST      Just build the "test" programs for OpenSSL.
-      APPS      Just build the "application" programs for OpenSSL.
+      TEST      Just build the "[.xxx.EXE.TEST]" test programs for OpenSSL.
+      APPS      Just build the "[.xxx.EXE.APPS]" application programs for OpenSSL.
 
 <rsaref-p> must be one of the following:
 
       RSAREF    compile using the RSAREF Library
       NORSAREF  compile without using RSAREF
 
-Note: The RSAREF libraries are NOT INCLUDED and you have to
-      download it from "ftp://ftp.rsa.com/rsaref".  You have to
-      get the ".tar-Z" file as the ".zip" file dosen't have the
-      directory structure stored.  You have to extract the file
-      into the [.RSAREF] directory as that is where the scripts
-      will look for the files.
+Note 1: The RSAREF libraries are NOT INCLUDED and you have to
+        download it from "ftp://ftp.rsa.com/rsaref".  You have to
+        get the ".tar-Z" file as the ".zip" file doesn't have the
+        directory structure stored.  You have to extract the file
+        into the [.RSAREF] directory as that is where the scripts
+        will look for the files.
 
 Note 2: I have never done this, so I've no idea if it works or not.
 
@@ -65,7 +98,6 @@ Note 2: I have never done this, so I've no idea if it works or not.
 
 <compiler> must be one of the following:
 
-      VAXC      For VAX C.
       DECC      For DEC C.
       GNUC      For GNU C.
 
@@ -77,15 +109,33 @@ named LIBSSL.OLB, and you will find a bunch of useful programs in
 just to test them.  For production use, make sure you install first, see
 Installation below.
 
-Note: Some programs in this package require a TCP/IP library.
+Note 1: Some programs in this package require a TCP/IP library.
 
 Note 2: if you want to compile the crypto library only, please make sure
-        you have at least done a @MAKEVMS DATE and a @MAKEVMS SOFTLINKS.
-        A lot of things will break if you don't.
+        you have at least done a @MAKEVMS CONFIG, a @MAKEVMS BUILDINF and
+        a @MAKEVMS SOFTLINKS.  A lot of things will break if you don't.
+
+
+Logical names:
+==============
+
+There are a few things that can't currently be given through the command
+line.  Instead, logical names are used.
+
+Currently, the logical names supported are:
+
+      OPENSSL_NO_ASM    with value YES, the assembler parts of OpenSSL will
+                        not be used.  Instead, plain C implementations are
+                        used.  This is good to try if something doesn't work.
+      OPENSSL_NO_'alg'  with value YES, the corresponding crypto algorithm
+                        will not be implemented.  Supported algorithms to
+                        do this with are: RSA, DSA, DH, MD2, MD5, RIPEMD,
+                        SHA, DES, MDC2, CR2, RC4, RC5, IDEA, BF, CAST, HMAC,
+                        SSL2.  So, for example, having the logical name
+                        OPENSSL_NO_RSA with the value YES means that the
+                        LIBCRYPTO.OLB library will not contain an RSA
+                        implementation.
 
-Note 3: Alpha users will get a number of informational messages when
-        compiling the [.asm]vms.mar file in the BN (bignum) part of
-        the crypto library.  These can be safely ignored.
 
 Test:
 =====
@@ -99,6 +149,7 @@ it's an ugly hack!) and rebuild. Please send a bug report to
 <openssl-bugs@openssl.org>, including the output of "openssl version -a"
 and of the failed test.
 
+
 Installation:
 =============
 
@@ -158,6 +209,7 @@ The logical names that are set up are the following:
                 (the NOTE in section 4 of "Installation in Detail").
                 You don't need to "deleting old header files"!!!
 
+
 Backward portability:
 =====================
 
@@ -175,7 +227,7 @@ dependent on the OpenVMS version or the C library version, *and* you
 can use those macros to simulate older OpenVMS or C library versions,
 by defining the macros _VMS_V6_SOURCE, __VMS_VER and __CTRL_VER with
 correct values.  In the compilation scripts, I've provided the possibility
-for the user to influense the creation of such macros, through a bunch of
+for the user to influence the creation of such macros, through a bunch of
 symbols, all having names starting with USER_.  Here's the list of them:
 
   USER_CCFLAGS           - Used to give additional qualifiers to the
@@ -212,19 +264,6 @@ directory by default, it may very well be that you have to give them
 extra arguments.  Please experiment.
 
 
-Report:
-=======
-
-I maintain a few mailinglists for bug reports and such on software that
-I develop/port/enhance/destroy.  Please look at http://www.free.lp.se/
-for further info.
-
-
--- 
-Richard Levitte <richard@levitte.org>
-1999-03-09
-
-
 TODO:
 =====
 
@@ -242,4 +281,4 @@ have any ideas.
 
 --
 Richard Levitte <richard@levitte.org>
-1999-05-24
+2000-02-27
diff --git a/src/lib/libssl/src/INSTALL.W32 b/src/lib/libssl/src/INSTALL.W32
index 4550aa0621..8c8008b4ad 100644
--- a/src/lib/libssl/src/INSTALL.W32
+++ b/src/lib/libssl/src/INSTALL.W32
@@ -4,7 +4,7 @@
 
  Heres a few comments about building OpenSSL in Windows environments. Most of
  this is tested on Win32 but it may also work in Win 3.1 with some
- modification.  See the end of this file for Eric's original comments.
+ modification.
 
  You need Perl for Win32 (available from http://www.activestate.com/ActivePerl)
  and one of the following C compilers:
@@ -21,10 +21,12 @@
   * Microsoft MASM (aka "ml")
   * Free Netwide Assembler NASM.
 
- MASM was I believe distributed in the past with VC++ and it is also part of
- the MSDN SDKs. It is no longer distributed as part of VC++ and can be hard
- to get hold of. It can be purchased: see Microsoft's site for details at:
- http://www.microsoft.com/
+ MASM was at one point distributed with VC++. It is now distributed with some
+ Microsoft DDKs, for example the Windows NT 4.0 DDK and the Windows 98 DDK. If
+ you do not have either of these DDKs then you can just download the binaries
+ for the Windows 98 DDK and extract and rename the two files XXXXXml.exe and
+ XXXXXml.err, to ml.exe and ml.err and install somewhere on your PATH. Both
+ DDKs can be downloaded from the Microsoft developers site www.msdn.com.
 
  NASM is freely available. Version 0.98 was used during testing: other versions
  may also work. It is available from many places, see for example:
@@ -59,7 +61,7 @@
    > ms\do_ms
 
  If you get errors about things not having numbers assigned then check the
- troubleshooting section: you probably wont be able to compile it as it
+ troubleshooting section: you probably won't be able to compile it as it
  stands.
 
  Then from the VC++ environment at a prompt do:
@@ -145,12 +147,16 @@
  assigned in the CVS tree: so anything linked against this version of the
  library may need to be recompiled.
 
- If you get errors about unresolved externals then this means that either you
- didn't read the note above about functions not having numbers assigned or
- someone forgot to add a function to the header file.
+ If you get errors about unresolved symbols there are several possible
+ causes.
 
- In this latter case check out the header file to see if the function is
- defined in the header file.
+ If this happens when the DLL is being linked and you have disabled some
+ ciphers then it is possible the DEF file generator hasn't removed all
+ the disabled symbols: the easiest solution is to edit the DEF files manually
+ to delete them. The DEF files are ms\libeay32.def ms\ssleay32.def.
+
+ Another cause is if you missed or ignored the errors about missing numbers
+ mentioned above.
 
  If you get warnings in the code then the compilation will halt.
 
@@ -165,159 +171,13 @@
 
  One final comment about compiling applications linked to the OpenSSL library.
  If you don't use the multithreaded DLL runtime library (/MD option) your
- program will almost certainly crash: see the original SSLeay description
- below for more details.
-
---------------------------------------------------------------------------------
-The orignal Windows build instructions from SSLeay follow. 
-Note: some of this may be out of date and no longer applicable. In particular
-the Crypto_malloc_init() comment appears to be wrong: you always need to use
-the same runtime library as the DLL itself.
---------------------------------------------------------------------------------
-
-The Microsoft World.
-
-The good news, to build SSLeay for the Microsft World
-
-Windows 3.1 DLL's
-perl Configure VC-WIN16
-nmake -f ms\w31dll.mak
-
-Windows NT/95 DLL's
-perl Configure VC-WIN32
-nmake -f ms\ntdll.mak
-
-Now the bad news
-All builds were done using Microsofts Visual C++ 1.52c and [45].x.
-If you are a borland person, you are probably going to have to help me
-finish the stuff in util/pl/BC*pl
-
-All builds were made under Windows NT - this means long filenames, so
-you may have problems under Windows 3.1 but probably not under 95.
-
-Because file pointers don't work in DLL's under Windows 3.1 (well at
-least stdin/stdout don't and I don't like having to differentiate
-between these and other file pointers), I now use the BIO file-pointer
-module, which needs to be linked into your application.  You can either
-use the memory buffer BIO for IO, or compile bss_file.c into your
-application, it is in the apps directory and is just a copy of
-crypto/buffer/bss_file.c with #define APPS_WIN16 added.
-I have not yet automated the makefile to automatically copy it into 'out'
-for a win 3.1 build....
-
-All callbacks passed into SSLeay for Windows 3.1 need to be of type
-_far _loadds.
-
-I don't support building with the pascal calling convention.
-
-The DLL and static builds are large memory model.
-
-To build static libraries for NT/95 or win 3.1
-
-perl util/mk1mf.pl VC-WIN32 > mf-stat.nt
-perl util/mk1mf.pl VC-WIN16 > mf-stat.w31
-for DLL's
-perl util/mk1mf.pl dll VC-WIN32 > mf-dll.nt
-perl util/mk1mf.pl dll VC-WIN16 > mf-dll.w31
-
-Again you will notice that if you dont have perl, you cannot do this.
-
-Now the next importaint issue.  Running Configure!
-I have small assember code files for critical big number library operation
-in crypto/bn/asm.  There is, asm code, object files and uuencode
-object files.  They are
-x86nt32.asm     - 32bit flat memory model assember - suitable Win32
-x86w16.asm      - 16bit assember - used in the msdos build.
-x86w32.asm      - 32bit assember, win 3.1 segments, used for win16 build.
-
-If you feel compelled to build the 16bit maths routines in the windows 3.1
-build,
-perl Configure VC-W31-16
-perl util/mk1mf.pl dll VC-W31-16 > mf-dll.w31
-
-If you hate assember and don't want anything to do with it,
-perl util/mk1mf.pl no-asm VC-WIN16 > mf-dll.w31
-will work for any of the makefile generations.
-
-There are more options to mk1mf.pl but these all leave the temporary
-files in 'tmp' and the output files in 'out' by default.
-
-The NT build is done for console mode.
-
-The Windows 3.1 version of SSLeay uses quickwin, the interface is ugly
-but it is better than nothing.  If you want ugly, try doing anything
-that involves getting a password.  I decided to be ugly instead of
-echoing characters.  For Windows 3.1 I would just sugest using the
-msdos version of the ssleay application for command line work.
-The QuickWin build is primarily for testing.
-
-For both NT and Windows 3.1, I have not written the code so that
-s_client, s_server can take input from the keyboard.  You can happily
-start applications up in separate windows, watch them handshake, and then sit
-there for-ever.  I have not had the time to get this working, and I've
-been able to test things from a unix box to the NT box :-).
-Try running ssleay s_server on the windows box
-(with either -cert ../apps/server.pem -www)
-and run ssleay s_time from another window.
-This often stuffs up on Windows 3.1, but I'm not worried since this is
-probably a problem with my demo applications, not the libraries.
-
-After a build of one of the version of microsoft SSLeay,
-'cd ms' and then run 'test'.  This should check everything out and
-even does a trial run of generating certificates.
-'test.bat' requires that perl be install, you be in the ms directory
-(not the test directory, thats for unix so stay out :-) and that the
-build output directory be ../out 
-
-On a last note, you will probably get division by zero errors and
-stuff after a build.  This is due to your own inability to follow
-instructions :-).
-
-The reasons for the problem is probably one of the following.
-
-1)      You did not run Configure.  This is critical for windows 3.1 when
-        using assember.  The values in crypto/bn/bn.h must match the
-        ones requred for the assember code.  (remember that if you
-        edit crypto/bn/bn.h by hand, it will be clobered the next time
-        you run Configure by the contents of crypto/bn/bn.org).
-        SSLeay version -o will list the compile options.
-        For VC-WIN32 you need bn(64,32) or bn(32,32)
-        For VC-W31-32/VC-WIN16 you need bn(32,32)
-        For VC-W31-16 you need bn(32,16) or bn(16,16)
-        For VC-MSDOS you need bn(32,16) or bn(16,16).
-
-        The first number will be 2 times bigger than the second if
-        BN_LLONG is defined in bn.h and the size of the second number
-        depends on the 'bits' defined at the start of bn.h.  Have a
-        look, it's all reasonably clear.
-        If you want to start messing with 8 bit builds and things like
-        that, build without the assember by re-generating a makefile
-        via 'perl util/mk1mf.pl no-asm'.
-2)      You tried to build under MS-DOS or Windows 3.1 using the /G3
-        option.  Don't.  It is buggy (thats why you just got that
-        error) and unless you want to work out which optimising flag
-        to turn off, I'm not going to help you :-).  I also noticed
-        that code often ran slower when compiled with /G3.
-3)      Under NT/95, malloc goes stupid.  You are probably linking with
-        the wrong library, there are problems if you mix the threaded
-        and non-threaded libraries (due to the DLL being staticly
-        linked with one and the applicaion using another.
-
-Well hopefully thats most of the MS issues handled, see you in ssl-users :-).
-
-eric 30-Aug-1996
-
-SSLeay 0.6.5
-For Windows 95/NT, add CRYPTO_malloc_init() to your program before any
-calls to the SSLeay libraries.  This function will insert callbacks so that
-the SSLeay libraries will use the same malloc(), free() and realloc() as
-your application so 'problem 3)' mentioned above will go away.
-
-There is now DES assember for Windows NT/95.  The file is
-crypto/des/asm/win32.asm and replaces crypto/des/des_enc.c in the build.
-
-There is also Blowfish assember for Windows NT/95.  The file is
-crypto/bf/asm/win32.asm and replaces crypto/bf/bf_enc.c in the build.
-
-eric 25-Jun-1997
-
+ program will almost certainly crash because malloc gets confused -- the
+ OpenSSL DLLs are statically linked to one version, the application must
+ not use a different one.  You might be able to work around such problems
+ by adding CRYPTO_malloc_init() to your program before any calls to the
+ OpenSSL libraries: This tells the OpenSSL libraries to use the same
+ malloc(), free() and realloc() as the application.  However there are many
+ standard library functions used by OpenSSL that call malloc() internally
+ (e.g. fopen()), and OpenSSL cannot change these; so in general you cannot
+ rely on CYRPTO_malloc_init() solving your problem, and you should
+ consistently use the multithreaded library.
diff --git a/src/lib/libssl/src/LICENSE b/src/lib/libssl/src/LICENSE
index b9e18d5e7b..bdd5f7bdd0 100644
--- a/src/lib/libssl/src/LICENSE
+++ b/src/lib/libssl/src/LICENSE
@@ -12,7 +12,7 @@
   ---------------
 
 /* ====================================================================
- * Copyright (c) 1998-1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/src/lib/libssl/src/MacOS/GUSI_Init.cpp b/src/lib/libssl/src/MacOS/GUSI_Init.cpp
new file mode 100644
index 0000000000..d8223dba2c
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/GUSI_Init.cpp
@@ -0,0 +1,62 @@
+/**************** BEGIN GUSI CONFIGURATION ****************************
+ *
+ * GUSI Configuration section generated by GUSI Configurator
+ * last modified: Wed Jan  5 20:33:51 2000
+ *
+ * This section will be overwritten by the next run of Configurator.
+ */
+
+#define GUSI_SOURCE
+#include <GUSIConfig.h>
+#include <sys/cdefs.h>
+
+/* Declarations of Socket Factories */
+
+__BEGIN_DECLS
+void GUSIwithInetSockets();
+void GUSIwithLocalSockets();
+void GUSIwithMTInetSockets();
+void GUSIwithMTTcpSockets();
+void GUSIwithMTUdpSockets();
+void GUSIwithOTInetSockets();
+void GUSIwithOTTcpSockets();
+void GUSIwithOTUdpSockets();
+void GUSIwithPPCSockets();
+void GUSISetupFactories();
+__END_DECLS
+
+/* Configure Socket Factories */
+
+void GUSISetupFactories()
+{
+#ifdef GUSISetupFactories_BeginHook
+        GUSISetupFactories_BeginHook
+#endif
+        GUSIwithInetSockets();
+#ifdef GUSISetupFactories_EndHook
+        GUSISetupFactories_EndHook
+#endif
+}
+
+/* Declarations of File Devices */
+
+__BEGIN_DECLS
+void GUSIwithDConSockets();
+void GUSIwithNullSockets();
+void GUSISetupDevices();
+__END_DECLS
+
+/* Configure File Devices */
+
+void GUSISetupDevices()
+{
+#ifdef GUSISetupDevices_BeginHook
+        GUSISetupDevices_BeginHook
+#endif
+        GUSIwithNullSockets();
+#ifdef GUSISetupDevices_EndHook
+        GUSISetupDevices_EndHook
+#endif
+}
+
+/**************** END GUSI CONFIGURATION *************************/
diff --git a/src/lib/libssl/src/MacOS/GetHTTPS.src/CPStringUtils.cpp b/src/lib/libssl/src/MacOS/GetHTTPS.src/CPStringUtils.cpp
new file mode 100644
index 0000000000..617aae2c70
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/GetHTTPS.src/CPStringUtils.cpp
@@ -0,0 +1,2753 @@
+/* ====================================================================
+ * Copyright (c) 1998-1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+ 
+ 
+ 
+ #include "CPStringUtils.hpp"
+#include "ErrorHandling.hpp"
+
+
+
+#define kNumberFormatString                     "\p########0.00#######;-########0.00#######"
+
+
+
+//      Useful utility functions which could be optimized a whole lot
+
+
+void CopyPStrToCStr(const unsigned char *thePStr,char *theCStr,const int maxCStrLength)
+{
+int             i,numPChars;
+
+
+        if (thePStr != nil && theCStr != nil && maxCStrLength > 0)
+        {
+                numPChars = thePStr[0];
+                
+                for (i = 0;;i++)
+                {
+                        if (i >= numPChars || i >= maxCStrLength - 1)
+                        {
+                                theCStr[i] = 0;
+                                
+                                break;
+                        }
+                        
+                        else
+                        {
+                                theCStr[i] = thePStr[i + 1];
+                        }
+                }
+        }
+}
+
+
+void CopyPStrToPStr(const unsigned char *theSrcPStr,unsigned char *theDstPStr,const int maxDstStrLength)
+{
+int             theMaxDstStrLength;
+
+        
+        theMaxDstStrLength = maxDstStrLength;
+        
+        
+        if (theDstPStr != nil && theSrcPStr != nil && theMaxDstStrLength > 0)
+        {
+                if (theMaxDstStrLength > 255)
+                {
+                        theMaxDstStrLength = 255;
+                }
+                
+                
+                if (theMaxDstStrLength - 1 < theSrcPStr[0])
+                {
+                        BlockMove(theSrcPStr + 1,theDstPStr + 1,theMaxDstStrLength - 1);
+                        
+                        theDstPStr[0] = theMaxDstStrLength - 1;
+                }
+                
+                else
+                {
+                        BlockMove(theSrcPStr,theDstPStr,theSrcPStr[0] + 1);
+                }
+        }
+}
+
+
+void CopyCStrToCStr(const char *theSrcCStr,char *theDstCStr,const int maxDstStrLength)
+{
+int             i;
+
+
+        if (theDstCStr != nil && theSrcCStr != nil && maxDstStrLength > 0)
+        {
+                for (i = 0;;i++)
+                {
+                        if (theSrcCStr[i] == 0 || i >= maxDstStrLength - 1)
+                        {
+                                theDstCStr[i] = 0;
+                                
+                                break;
+                        }
+                        
+                        else
+                        {
+                                theDstCStr[i] = theSrcCStr[i];
+                        }
+                }
+        }
+}
+
+
+
+void CopyCSubstrToCStr(const char *theSrcCStr,const int maxCharsToCopy,char *theDstCStr,const int maxDstStrLength)
+{
+int             i;
+
+
+        if (theDstCStr != nil && theSrcCStr != nil && maxDstStrLength > 0)
+        {
+                for (i = 0;;i++)
+                {
+                        if (theSrcCStr[i] == 0 || i >= maxDstStrLength - 1 || i >= maxCharsToCopy)
+                        {
+                                theDstCStr[i] = 0;
+                                
+                                break;
+                        }
+                        
+                        else
+                        {
+                                theDstCStr[i] = theSrcCStr[i];
+                        }
+                }
+        }
+}
+
+
+
+void CopyCSubstrToPStr(const char *theSrcCStr,const int maxCharsToCopy,unsigned char *theDstPStr,const int maxDstStrLength)
+{
+int             i;
+int             theMaxDstStrLength;
+
+        
+        theMaxDstStrLength = maxDstStrLength;
+
+        if (theDstPStr != nil && theSrcCStr != nil && theMaxDstStrLength > 0)
+        {
+                if (theMaxDstStrLength > 255)
+                {
+                        theMaxDstStrLength = 255;
+                }
+                
+                
+                for (i = 0;;i++)
+                {
+                        if (theSrcCStr[i] == 0 || i >= theMaxDstStrLength - 1 || i >= maxCharsToCopy)
+                        {
+                                theDstPStr[0] = i;
+                                
+                                break;
+                        }
+                        
+                        else
+                        {
+                                theDstPStr[i + 1] = theSrcCStr[i];
+                        }
+                }
+        }
+}
+
+
+
+void CopyCStrToPStr(const char *theSrcCStr,unsigned char *theDstPStr,const int maxDstStrLength)
+{
+int             i;
+int             theMaxDstStrLength;
+
+        
+        theMaxDstStrLength = maxDstStrLength;
+
+        if (theDstPStr != nil && theSrcCStr != nil && theMaxDstStrLength > 0)
+        {
+                if (theMaxDstStrLength > 255)
+                {
+                        theMaxDstStrLength = 255;
+                }
+                
+                
+                for (i = 0;;i++)
+                {
+                        if (i >= theMaxDstStrLength - 1 || theSrcCStr[i] == 0)
+                        {
+                                theDstPStr[0] = i;
+                                
+                                break;
+                        }
+                        
+                        else
+                        {
+                                theDstPStr[i + 1] = theSrcCStr[i];
+                        }
+                }
+        }
+}
+
+
+void ConcatPStrToCStr(const unsigned char *thePStr,char *theCStr,const int maxCStrLength)
+{
+int             i,numPChars,cStrLength;
+
+
+        if (thePStr != nil && theCStr != nil && maxCStrLength > 0)
+        {
+                for (cStrLength = 0;theCStr[cStrLength] != 0;cStrLength++)
+                {
+                
+                }
+                
+
+                numPChars = thePStr[0];
+                
+                
+                for (i = 0;;i++)
+                {
+                        if (i >= numPChars || cStrLength >= maxCStrLength - 1)
+                        {
+                                theCStr[cStrLength++] = 0;
+                                
+                                break;
+                        }
+                        
+                        else
+                        {
+                                theCStr[cStrLength++] = thePStr[i + 1];
+                        }
+                }
+        }
+}
+
+
+
+void ConcatPStrToPStr(const unsigned char *theSrcPStr,unsigned char *theDstPStr,const int maxDstStrLength)
+{
+int             theMaxDstStrLength;
+
+        
+        theMaxDstStrLength = maxDstStrLength;
+        
+        if (theSrcPStr != nil && theDstPStr != nil && theMaxDstStrLength > 0)
+        {
+                if (theMaxDstStrLength > 255)
+                {
+                        theMaxDstStrLength = 255;
+                }
+                
+                
+                if (theMaxDstStrLength - theDstPStr[0] - 1 < theSrcPStr[0])
+                {
+                        BlockMove(theSrcPStr + 1,theDstPStr + theDstPStr[0] + 1,theMaxDstStrLength - 1 - theDstPStr[0]);
+                        
+                        theDstPStr[0] = theMaxDstStrLength - 1;
+                }
+                
+                else
+                {
+                        BlockMove(theSrcPStr + 1,theDstPStr + theDstPStr[0] + 1,theSrcPStr[0]);
+                        
+                        theDstPStr[0] += theSrcPStr[0];
+                }
+        }
+}
+
+
+
+void ConcatCStrToPStr(const char *theSrcCStr,unsigned char *theDstPStr,const int maxDstStrLength)
+{
+int             i,thePStrLength;
+int             theMaxDstStrLength;
+
+        
+        theMaxDstStrLength = maxDstStrLength;
+
+        if (theSrcCStr != nil && theDstPStr != nil && theMaxDstStrLength > 0)
+        {
+                if (theMaxDstStrLength > 255)
+                {
+                        theMaxDstStrLength = 255;
+                }
+                
+                
+                thePStrLength = theDstPStr[0];
+                
+                for (i = 0;;i++)
+                {
+                        if (theSrcCStr[i] == 0 || thePStrLength >= theMaxDstStrLength - 1)
+                        {
+                                theDstPStr[0] = thePStrLength;
+                                
+                                break;
+                        }
+                        
+                        else
+                        {
+                                theDstPStr[thePStrLength + 1] = theSrcCStr[i];
+                                
+                                thePStrLength++;
+                        }
+                }
+        }
+}
+
+
+
+void ConcatCStrToCStr(const char *theSrcCStr,char *theDstCStr,const int maxCStrLength)
+{
+int             cStrLength;
+
+
+        if (theSrcCStr != nil && theDstCStr != nil && maxCStrLength > 0)
+        {
+                for (cStrLength = 0;theDstCStr[cStrLength] != 0;cStrLength++)
+                {
+                
+                }
+                
+
+                for (;;)
+                {
+                        if (*theSrcCStr == 0 || cStrLength >= maxCStrLength - 1)
+                        {
+                                theDstCStr[cStrLength++] = 0;
+                                
+                                break;
+                        }
+                        
+                        else
+                        {
+                                theDstCStr[cStrLength++] = *theSrcCStr++;
+                        }
+                }
+        }
+}
+
+
+
+void ConcatCharToCStr(const char theChar,char *theDstCStr,const int maxCStrLength)
+{
+int             cStrLength;
+
+
+        if (theDstCStr != nil && maxCStrLength > 0)
+        {
+                cStrLength = CStrLength(theDstCStr);
+                
+                if (cStrLength < maxCStrLength - 1)
+                {
+                        theDstCStr[cStrLength++] = theChar;
+                        theDstCStr[cStrLength++] = '\0';
+                }
+        }
+}
+
+
+
+void ConcatCharToPStr(const char theChar,unsigned char *theDstPStr,const int maxPStrLength)
+{
+int             pStrLength;
+
+
+        if (theDstPStr != nil && maxPStrLength > 0)
+        {
+                pStrLength = PStrLength(theDstPStr);
+                
+                if (pStrLength < maxPStrLength - 1 && pStrLength < 255)
+                {
+                        theDstPStr[pStrLength + 1] = theChar;
+                        theDstPStr[0] += 1;
+                }
+        }
+}
+
+
+
+
+int CompareCStrs(const char *theFirstCStr,const char *theSecondCStr,const Boolean ignoreCase)
+{
+int             returnValue;
+char    firstChar,secondChar;
+
+        
+        returnValue = 0;
+        
+        
+        if (theFirstCStr != nil && theSecondCStr != nil)
+        {
+                for (;;)
+                {
+                        firstChar = *theFirstCStr;
+                        secondChar = *theSecondCStr;
+                        
+                        if (ignoreCase == true)
+                        {
+                                if (firstChar >= 'A' && firstChar <= 'Z')
+                                {
+                                        firstChar = 'a' + (firstChar - 'A');
+                                }
+                                
+                                if (secondChar >= 'A' && secondChar <= 'Z')
+                                {
+                                        secondChar = 'a' + (secondChar - 'A');
+                                }
+                        }
+                        
+                        
+                        if (firstChar == 0 && secondChar != 0)
+                        {
+                                returnValue = -1;
+                                
+                                break;
+                        }
+                        
+                        else if (firstChar != 0 && secondChar == 0)
+                        {
+                                returnValue = 1;
+                                
+                                break;
+                        }
+                        
+                        else if (firstChar == 0 && secondChar == 0)
+                        {
+                                returnValue = 0;
+                                
+                                break;
+                        }
+                        
+                        else if (firstChar < secondChar)
+                        {
+                                returnValue = -1;
+                                
+                                break;
+                        }
+                        
+                        else if (firstChar > secondChar)
+                        {
+                                returnValue = 1;
+                                
+                                break;
+                        }
+                        
+                        theFirstCStr++;
+                        theSecondCStr++;
+                }
+        }
+        
+        
+        return(returnValue);
+}
+
+
+
+Boolean CStrsAreEqual(const char *theFirstCStr,const char *theSecondCStr,const Boolean ignoreCase)
+{
+        if (CompareCStrs(theFirstCStr,theSecondCStr,ignoreCase) == 0)
+        {
+                return true;
+        }
+        
+        else
+        {
+                return false;
+        }
+}
+
+
+Boolean PStrsAreEqual(const unsigned char *theFirstPStr,const unsigned char *theSecondPStr,const Boolean ignoreCase)
+{
+        if (ComparePStrs(theFirstPStr,theSecondPStr,ignoreCase) == 0)
+        {
+                return true;
+        }
+        
+        else
+        {
+                return false;
+        }
+}
+
+
+
+int ComparePStrs(const unsigned char *theFirstPStr,const unsigned char *theSecondPStr,const Boolean ignoreCase)
+{
+int             i,returnValue;
+char    firstChar,secondChar;
+
+        
+        returnValue = 0;
+        
+        
+        if (theFirstPStr != nil && theSecondPStr != nil)
+        {
+                for (i = 1;;i++)
+                {
+                        firstChar = theFirstPStr[i];
+                        secondChar = theSecondPStr[i];
+
+                        if (ignoreCase == true)
+                        {
+                                if (firstChar >= 'A' && firstChar <= 'Z')
+                                {
+                                        firstChar = 'a' + (firstChar - 'A');
+                                }
+                                
+                                if (secondChar >= 'A' && secondChar <= 'Z')
+                                {
+                                        secondChar = 'a' + (secondChar - 'A');
+                                }
+                        }
+
+
+                        if (theFirstPStr[0] < i && theSecondPStr[0] >= i)
+                        {
+                                returnValue = -1;
+                                
+                                break;
+                        }
+                        
+                        else if (theFirstPStr[0] >= i && theSecondPStr[0] < i)
+                        {
+                                returnValue = 1;
+                                
+                                break;
+                        }
+                        
+                        else if (theFirstPStr[0] < i && theSecondPStr[0] < i)
+                        {
+                                returnValue = 0;
+                                
+                                break;
+                        }
+                        
+                        else if (firstChar < secondChar)
+                        {
+                                returnValue = -1;
+                                
+                                break;
+                        }
+                        
+                        else if (firstChar > secondChar)
+                        {
+                                returnValue = 1;
+                                
+                                break;
+                        }
+                }
+        }
+        
+        
+        return(returnValue);
+}
+
+
+
+int CompareCStrToPStr(const char *theCStr,const unsigned char *thePStr,const Boolean ignoreCase)
+{
+int             returnValue;
+char    tempString[256];
+
+        
+        returnValue = 0;
+        
+        if (theCStr != nil && thePStr != nil)
+        {
+                CopyPStrToCStr(thePStr,tempString,sizeof(tempString));
+                
+                returnValue = CompareCStrs(theCStr,tempString,ignoreCase);
+        }
+        
+        
+        return(returnValue);
+}
+
+
+
+void ConcatLongIntToCStr(const long theNum,char *theCStr,const int maxCStrLength,const int numDigits)
+{
+Str255          theStr255;
+
+
+        NumToString(theNum,theStr255);
+
+
+        if (numDigits > 0)
+        {
+        int     charsToInsert;
+        
+                
+                charsToInsert = numDigits - PStrLength(theStr255);
+                
+                if (charsToInsert > 0)
+                {
+                char    tempString[256];
+                        
+                        CopyCStrToCStr("",tempString,sizeof(tempString));
+                        
+                        for (;charsToInsert > 0;charsToInsert--)
+                        {
+                                ConcatCStrToCStr("0",tempString,sizeof(tempString));
+                        }
+                        
+                        ConcatPStrToCStr(theStr255,tempString,sizeof(tempString));
+                        
+                        CopyCStrToPStr(tempString,theStr255,sizeof(theStr255));
+                }
+        }
+
+
+        ConcatPStrToCStr(theStr255,theCStr,maxCStrLength);
+}
+
+
+
+
+void ConcatLongIntToPStr(const long theNum,unsigned char *thePStr,const int maxPStrLength,const int numDigits)
+{
+Str255          theStr255;
+
+
+        NumToString(theNum,theStr255);
+
+
+        if (numDigits > 0)
+        {
+        int     charsToInsert;
+        
+                
+                charsToInsert = numDigits - PStrLength(theStr255);
+                
+                if (charsToInsert > 0)
+                {
+                char    tempString[256];
+                        
+                        CopyCStrToCStr("",tempString,sizeof(tempString));
+                        
+                        for (;charsToInsert > 0;charsToInsert--)
+                        {
+                                ConcatCStrToCStr("0",tempString,sizeof(tempString));
+                        }
+                        
+                        ConcatPStrToCStr(theStr255,tempString,sizeof(tempString));
+                        
+                        CopyCStrToPStr(tempString,theStr255,sizeof(theStr255));
+                }
+        }
+
+
+        ConcatPStrToPStr(theStr255,thePStr,maxPStrLength);
+}
+
+
+
+void CopyCStrAndConcatLongIntToCStr(const char *theSrcCStr,const long theNum,char *theDstCStr,const int maxDstStrLength)
+{
+        CopyCStrToCStr(theSrcCStr,theDstCStr,maxDstStrLength);
+        
+        ConcatLongIntToCStr(theNum,theDstCStr,maxDstStrLength);
+}
+
+
+
+void CopyLongIntToCStr(const long theNum,char *theCStr,const int maxCStrLength,const int numDigits)
+{
+Str255          theStr255;
+
+
+        NumToString(theNum,theStr255);
+
+
+        if (numDigits > 0)
+        {
+        int     charsToInsert;
+        
+                
+                charsToInsert = numDigits - PStrLength(theStr255);
+                
+                if (charsToInsert > 0)
+                {
+                char    tempString[256];
+                        
+                        CopyCStrToCStr("",tempString,sizeof(tempString));
+                        
+                        for (;charsToInsert > 0;charsToInsert--)
+                        {
+                                ConcatCStrToCStr("0",tempString,sizeof(tempString));
+                        }
+                        
+                        ConcatPStrToCStr(theStr255,tempString,sizeof(tempString));
+                        
+                        CopyCStrToPStr(tempString,theStr255,sizeof(theStr255));
+                }
+        }
+
+
+        CopyPStrToCStr(theStr255,theCStr,maxCStrLength);
+}
+
+
+
+
+
+void CopyUnsignedLongIntToCStr(const unsigned long theNum,char *theCStr,const int maxCStrLength)
+{
+char                    tempString[256];
+int                             srcCharIndex,dstCharIndex;
+unsigned long   tempNum,quotient,remainder;
+
+        
+        if (theNum == 0)
+        {
+                CopyCStrToCStr("0",theCStr,maxCStrLength);
+        }
+        
+        else
+        {
+                srcCharIndex = 0;
+                
+                tempNum = theNum;
+                
+                for (;;)
+                {
+                        if (srcCharIndex >= sizeof(tempString) - 1 || tempNum == 0)
+                        {
+                                for (dstCharIndex = 0;;)
+                                {
+                                        if (dstCharIndex >= maxCStrLength - 1 || srcCharIndex <= 0)
+                                        {
+                                                theCStr[dstCharIndex] = 0;
+                                                
+                                                break;
+                                        }
+                                        
+                                        theCStr[dstCharIndex++] = tempString[--srcCharIndex];
+                                }
+                                
+                                break;
+                        }
+                        
+
+                        quotient = tempNum / 10;
+                        
+                        remainder = tempNum - (quotient * 10);
+                        
+                        tempString[srcCharIndex] = '0' + remainder;
+                        
+                        srcCharIndex++;
+                        
+                        tempNum = quotient;
+                }
+        }
+}
+
+
+
+
+void CopyLongIntToPStr(const long theNum,unsigned char *thePStr,const int maxPStrLength,const int numDigits)
+{
+char    tempString[256];
+
+
+        CopyLongIntToCStr(theNum,tempString,sizeof(tempString),numDigits);
+        
+        CopyCStrToPStr(tempString,thePStr,maxPStrLength);
+}
+
+
+
+OSErr CopyLongIntToNewHandle(const long inTheLongInt,Handle *theHandle)
+{
+OSErr           errCode = noErr;
+char            tempString[32];
+        
+        
+        CopyLongIntToCStr(inTheLongInt,tempString,sizeof(tempString));
+        
+        errCode = CopyCStrToNewHandle(tempString,theHandle);
+
+        return(errCode);
+}
+
+
+OSErr CopyLongIntToExistingHandle(const long inTheLongInt,Handle theHandle)
+{
+OSErr           errCode = noErr;
+char            tempString[32];
+        
+        
+        CopyLongIntToCStr(inTheLongInt,tempString,sizeof(tempString));
+        
+        errCode = CopyCStrToExistingHandle(tempString,theHandle);
+
+        return(errCode);
+}
+
+
+
+
+OSErr CopyCStrToExistingHandle(const char *theCString,Handle theHandle)
+{
+OSErr   errCode = noErr;
+long    stringLength;
+
+        
+        if (theCString == nil)
+        {
+                SetErrorMessageAndBail(("CopyCStrToExistingHandle: Bad parameter, theCString == nil"));
+        }
+
+        if (theHandle == nil)
+        {
+                SetErrorMessageAndBail(("CopyCStrToExistingHandle: Bad parameter, theHandle == nil"));
+        }
+
+        if (*theHandle == nil)
+        {
+                SetErrorMessageAndBail(("CopyCStrToExistingHandle: Bad parameter, *theHandle == nil"));
+        }
+
+
+
+        stringLength = CStrLength(theCString) + 1;
+        
+        SetHandleSize(theHandle,stringLength);
+        
+        if (GetHandleSize(theHandle) < stringLength)
+        {
+                SetErrorMessageAndLongIntAndBail("CopyCStrToExistingHandle: Can't set Handle size, MemError() = ",MemError());
+        }
+        
+        
+        ::BlockMove(theCString,*theHandle,stringLength);
+        
+
+EXITPOINT:
+        
+        return(errCode);
+}
+
+
+
+
+
+OSErr CopyCStrToNewHandle(const char *theCString,Handle *theHandle)
+{
+OSErr   errCode = noErr;
+long    stringLength;
+
+        
+        if (theCString == nil)
+        {
+                SetErrorMessageAndBail(("CopyCStrToNewHandle: Bad parameter, theCString == nil"));
+        }
+
+        if (theHandle == nil)
+        {
+                SetErrorMessageAndBail(("CopyCStrToNewHandle: Bad parameter, theHandle == nil"));
+        }
+
+
+
+        stringLength = CStrLength(theCString) + 1;
+        
+        *theHandle = NewHandle(stringLength);
+        
+        if (*theHandle == nil)
+        {
+                SetErrorMessageAndLongIntAndBail("CopyCStrToNewHandle: Can't allocate Handle, MemError() = ",MemError());
+        }
+        
+        
+        ::BlockMove(theCString,**theHandle,stringLength);
+        
+
+EXITPOINT:
+        
+        return(errCode);
+}
+
+
+
+OSErr CopyPStrToNewHandle(const unsigned char *thePString,Handle *theHandle)
+{
+OSErr   errCode = noErr;
+long    stringLength;
+
+        
+        if (thePString == nil)
+        {
+                SetErrorMessageAndBail(("CopyPStrToNewHandle: Bad parameter, thePString == nil"));
+        }
+
+        if (theHandle == nil)
+        {
+                SetErrorMessageAndBail(("CopyPStrToNewHandle: Bad parameter, theHandle == nil"));
+        }
+
+
+
+        stringLength = PStrLength(thePString) + 1;
+        
+        *theHandle = NewHandle(stringLength);
+        
+        if (*theHandle == nil)
+        {
+                SetErrorMessageAndLongIntAndBail("CopyPStrToNewHandle: Can't allocate Handle, MemError() = ",MemError());
+        }
+        
+        
+        if (stringLength > 1)
+        {
+                BlockMove(thePString + 1,**theHandle,stringLength - 1);
+        }
+        
+        (**theHandle)[stringLength - 1] = 0;
+        
+
+EXITPOINT:
+        
+        return(errCode);
+}
+
+
+OSErr AppendPStrToHandle(const unsigned char *thePString,Handle theHandle,long *currentLength)
+{
+OSErr           errCode = noErr;
+char            tempString[256];
+
+        
+        CopyPStrToCStr(thePString,tempString,sizeof(tempString));
+        
+        errCode = AppendCStrToHandle(tempString,theHandle,currentLength);
+        
+
+EXITPOINT:
+        
+        return(errCode);
+}
+
+
+
+OSErr AppendCStrToHandle(const char *theCString,Handle theHandle,long *currentLength,long *maxLength)
+{
+OSErr           errCode = noErr;
+long            handleMaxLength,handleCurrentLength,stringLength,byteCount;
+
+
+        if (theCString == nil)
+        {
+                SetErrorMessageAndBail(("AppendCStrToHandle: Bad parameter, theCString == nil"));
+        }
+
+        if (theHandle == nil)
+        {
+                SetErrorMessageAndBail(("AppendCStrToHandle: Bad parameter, theHandle == nil"));
+        }
+        
+        
+        if (maxLength != nil)
+        {
+                handleMaxLength = *maxLength;
+        }
+        
+        else
+        {
+                handleMaxLength = GetHandleSize(theHandle);
+        }
+        
+        
+        if (currentLength != nil && *currentLength >= 0)
+        {
+                handleCurrentLength = *currentLength;
+        }
+        
+        else
+        {
+                handleCurrentLength = CStrLength(*theHandle);
+        }
+        
+        
+        stringLength = CStrLength(theCString);
+        
+        byteCount = handleCurrentLength + stringLength + 1;
+        
+        if (byteCount > handleMaxLength)
+        {
+                SetHandleSize(theHandle,handleCurrentLength + stringLength + 1);
+                
+                if (maxLength != nil)
+                {
+                        *maxLength = GetHandleSize(theHandle);
+                        
+                        handleMaxLength = *maxLength;
+                }
+                
+                else
+                {
+                        handleMaxLength = GetHandleSize(theHandle);
+                }
+
+                if (byteCount > handleMaxLength)
+                {
+                        SetErrorMessageAndLongIntAndBail("AppendCStrToHandle: Can't increase Handle allocation, MemError() = ",MemError());
+                }
+        }
+        
+        
+        BlockMove(theCString,*theHandle + handleCurrentLength,stringLength + 1);
+        
+        
+        if (currentLength != nil)
+        {
+                *currentLength += stringLength;
+        }
+
+
+        errCode = noErr;
+        
+        
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+OSErr AppendCharsToHandle(const char *theChars,const int numChars,Handle theHandle,long *currentLength,long *maxLength)
+{
+OSErr           errCode = noErr;
+long            handleMaxLength,handleCurrentLength,byteCount;
+
+
+        if (theChars == nil)
+        {
+                SetErrorMessageAndBail(("AppendCharsToHandle: Bad parameter, theChars == nil"));
+        }
+
+        if (theHandle == nil)
+        {
+                SetErrorMessageAndBail(("AppendCharsToHandle: Bad parameter, theHandle == nil"));
+        }
+        
+        
+        if (maxLength != nil)
+        {
+                handleMaxLength = *maxLength;
+        }
+        
+        else
+        {
+                handleMaxLength = GetHandleSize(theHandle);
+        }
+        
+        
+        if (currentLength != nil && *currentLength >= 0)
+        {
+                handleCurrentLength = *currentLength;
+        }
+        
+        else
+        {
+                handleCurrentLength = CStrLength(*theHandle);
+        }
+        
+        
+        byteCount = handleCurrentLength + numChars + 1;
+        
+        if (byteCount > handleMaxLength)
+        {
+                SetHandleSize(theHandle,handleCurrentLength + numChars + 1);
+                
+                if (maxLength != nil)
+                {
+                        *maxLength = GetHandleSize(theHandle);
+                        
+                        handleMaxLength = *maxLength;
+                }
+                
+                else
+                {
+                        handleMaxLength = GetHandleSize(theHandle);
+                }
+
+                if (byteCount > handleMaxLength)
+                {
+                        SetErrorMessageAndLongIntAndBail("AppendCharsToHandle: Can't increase Handle allocation, MemError() = ",MemError());
+                }
+        }
+        
+        
+        BlockMove(theChars,*theHandle + handleCurrentLength,numChars);
+        
+        (*theHandle)[handleCurrentLength + numChars] = '\0';
+        
+        if (currentLength != nil)
+        {
+                *currentLength += numChars;
+        }
+
+
+        errCode = noErr;
+        
+        
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+OSErr AppendLongIntToHandle(const long inTheLongInt,Handle theHandle,long *currentLength)
+{
+OSErr           errCode = noErr;
+char            tempString[32];
+        
+        
+        CopyLongIntToCStr(inTheLongInt,tempString,sizeof(tempString));
+        
+        errCode = AppendCStrToHandle(tempString,theHandle,currentLength);
+
+        return(errCode);
+}
+
+
+
+
+long CStrLength(const char *theCString)
+{
+long    cStrLength = 0;
+
+        
+        if (theCString != nil)
+        {
+                for (cStrLength = 0;theCString[cStrLength] != 0;cStrLength++)
+                {
+                
+                }
+        }
+        
+        
+        return(cStrLength);
+}
+
+
+
+long PStrLength(const unsigned char *thePString)
+{
+long    pStrLength = 0;
+
+        
+        if (thePString != nil)
+        {
+                pStrLength = thePString[0];
+        }
+        
+        
+        return(pStrLength);
+}
+
+
+
+
+
+void ZeroMem(void *theMemPtr,const unsigned long numBytes)
+{
+unsigned char   *theBytePtr;
+unsigned long   *theLongPtr;
+unsigned long   numSingleBytes;
+unsigned long   theNumBytes;
+
+        
+        theNumBytes = numBytes;
+        
+        if (theMemPtr != nil && theNumBytes > 0)
+        {
+                theBytePtr = (unsigned char     *) theMemPtr;
+                
+                numSingleBytes = (unsigned long) theBytePtr & 0x0003;
+                
+                while (numSingleBytes > 0)
+                {
+                        *theBytePtr++ = 0;
+                        
+                        theNumBytes--;
+                        numSingleBytes--;
+                }
+                
+
+                theLongPtr = (unsigned long     *) theBytePtr;
+                
+                while (theNumBytes >= 4)
+                {
+                        *theLongPtr++ = 0;
+                        
+                        theNumBytes -= 4;
+                }
+                
+                
+                theBytePtr = (unsigned char     *) theLongPtr;
+                
+                while (theNumBytes > 0)
+                {
+                        *theBytePtr++ = 0;
+                        
+                        theNumBytes--;
+                }
+        }
+}
+
+
+
+
+char *FindCharInCStr(const char theChar,const char *theCString)
+{
+char    *theStringSearchPtr;
+
+        
+        theStringSearchPtr = (char      *) theCString;
+        
+        if (theStringSearchPtr != nil)
+        {
+                while (*theStringSearchPtr != '\0' && *theStringSearchPtr != theChar)
+                {
+                        theStringSearchPtr++;
+                }
+                
+                if (*theStringSearchPtr == '\0')
+                {
+                        theStringSearchPtr = nil;
+                }
+        }
+        
+        return(theStringSearchPtr);
+}
+
+
+
+long FindCharOffsetInCStr(const char theChar,const char *theCString,const Boolean inIgnoreCase)
+{
+long    theOffset = -1;
+
+
+        if (theCString != nil)
+        {
+                theOffset = 0;
+                
+
+                if (inIgnoreCase)
+                {
+                char    searchChar = theChar;
+                
+                        if (searchChar >= 'a' && searchChar <= 'z')
+                        {
+                                searchChar = searchChar - 'a' + 'A';
+                        }
+                        
+                        
+                        while (*theCString != 0)
+                        {
+                        char    currentChar = *theCString;
+                        
+                                if (currentChar >= 'a' && currentChar <= 'z')
+                                {
+                                        currentChar = currentChar - 'a' + 'A';
+                                }
+                        
+                                if (currentChar == searchChar)
+                                {
+                                        break;
+                                }
+                                
+                                theCString++;
+                                theOffset++;
+                        }
+                }
+                
+                else
+                {
+                        while (*theCString != 0 && *theCString != theChar)
+                        {
+                                theCString++;
+                                theOffset++;
+                        }
+                }
+                
+                if (*theCString == 0)
+                {
+                        theOffset = -1;
+                }
+        }
+        
+        return(theOffset);
+}
+
+
+long FindCStrOffsetInCStr(const char *theCSubstring,const char *theCString,const Boolean inIgnoreCase)
+{
+long    theOffset = -1;
+
+
+        if (theCSubstring != nil && theCString != nil)
+        {
+                for (theOffset = 0;;theOffset++)
+                {
+                        if (theCString[theOffset] == 0)
+                        {
+                                theOffset = -1;
+                                
+                                goto EXITPOINT;
+                        }
+                        
+                        
+                        for (const char *tempSubstringPtr = theCSubstring,*tempCStringPtr = theCString + theOffset;;tempSubstringPtr++,tempCStringPtr++)
+                        {
+                                if (*tempSubstringPtr == 0)
+                                {
+                                        goto EXITPOINT;
+                                }
+                                
+                                else if (*tempCStringPtr == 0)
+                                {
+                                        break;
+                                }
+                        
+                        char    searchChar = *tempSubstringPtr;
+                        char    currentChar = *tempCStringPtr;
+                        
+                                if (inIgnoreCase && searchChar >= 'a' && searchChar <= 'z')
+                                {
+                                        searchChar = searchChar - 'a' + 'A';
+                                }
+                                
+                                if (inIgnoreCase && currentChar >= 'a' && currentChar <= 'z')
+                                {
+                                        currentChar = currentChar - 'a' + 'A';
+                                }
+                                
+                                if (currentChar != searchChar)
+                                {
+                                        break;
+                                }
+                        }
+                }
+                
+                theOffset = -1;
+        }
+
+
+EXITPOINT:
+        
+        return(theOffset);
+}
+
+
+
+void InsertCStrIntoCStr(const char *theSrcCStr,const int theInsertionOffset,char *theDstCStr,const int maxDstStrLength)
+{
+int             currentLength;
+int             insertLength;
+int             numCharsToInsert;
+int             numCharsToShift;
+
+        
+        if (theDstCStr != nil && theSrcCStr != nil && maxDstStrLength > 0 && theInsertionOffset < maxDstStrLength - 1)
+        {
+                currentLength = CStrLength(theDstCStr);
+                
+                insertLength = CStrLength(theSrcCStr);
+                
+
+                if (theInsertionOffset + insertLength < maxDstStrLength - 1)
+                {
+                        numCharsToInsert = insertLength;
+                }
+                
+                else
+                {
+                        numCharsToInsert = maxDstStrLength - 1 - theInsertionOffset;
+                }
+                
+
+                if (numCharsToInsert + currentLength < maxDstStrLength - 1)
+                {
+                        numCharsToShift = currentLength - theInsertionOffset;
+                }
+                
+                else
+                {
+                        numCharsToShift = maxDstStrLength - 1 - theInsertionOffset - numCharsToInsert;
+                }
+
+                
+                if (numCharsToShift > 0)
+                {
+                        BlockMove(theDstCStr + theInsertionOffset,theDstCStr + theInsertionOffset + numCharsToInsert,numCharsToShift);
+                }
+                
+                if (numCharsToInsert > 0)
+                {
+                        BlockMove(theSrcCStr,theDstCStr + theInsertionOffset,numCharsToInsert);
+                }
+                
+                theDstCStr[theInsertionOffset + numCharsToInsert + numCharsToShift] = 0;
+        }
+}
+
+
+
+void InsertPStrIntoCStr(const unsigned char *theSrcPStr,const int theInsertionOffset,char *theDstCStr,const int maxDstStrLength)
+{
+int             currentLength;
+int             insertLength;
+int             numCharsToInsert;
+int             numCharsToShift;
+
+        
+        if (theDstCStr != nil && theSrcPStr != nil && maxDstStrLength > 0 && theInsertionOffset < maxDstStrLength - 1)
+        {
+                currentLength = CStrLength(theDstCStr);
+                
+                insertLength = PStrLength(theSrcPStr);
+                
+
+                if (theInsertionOffset + insertLength < maxDstStrLength - 1)
+                {
+                        numCharsToInsert = insertLength;
+                }
+                
+                else
+                {
+                        numCharsToInsert = maxDstStrLength - 1 - theInsertionOffset;
+                }
+                
+
+                if (numCharsToInsert + currentLength < maxDstStrLength - 1)
+                {
+                        numCharsToShift = currentLength - theInsertionOffset;
+                }
+                
+                else
+                {
+                        numCharsToShift = maxDstStrLength - 1 - theInsertionOffset - numCharsToInsert;
+                }
+
+                
+                if (numCharsToShift > 0)
+                {
+                        BlockMove(theDstCStr + theInsertionOffset,theDstCStr + theInsertionOffset + numCharsToInsert,numCharsToShift);
+                }
+                
+                if (numCharsToInsert > 0)
+                {
+                        BlockMove(theSrcPStr + 1,theDstCStr + theInsertionOffset,numCharsToInsert);
+                }
+                
+                theDstCStr[theInsertionOffset + numCharsToInsert + numCharsToShift] = 0;
+        }
+}
+
+
+
+OSErr InsertCStrIntoHandle(const char *theCString,Handle theHandle,const long inInsertOffset)
+{
+OSErr   errCode;
+int             currentLength;
+int             insertLength;
+
+        
+        SetErrorMessageAndBailIfNil(theCString,"InsertCStrIntoHandle: Bad parameter, theCString == nil");
+
+        SetErrorMessageAndBailIfNil(theHandle,"InsertCStrIntoHandle: Bad parameter, theHandle == nil");
+        
+        currentLength = CStrLength(*theHandle);
+        
+        if (currentLength + 1 > ::GetHandleSize(theHandle))
+        {
+                SetErrorMessageAndBail("InsertCStrIntoHandle: Handle has been overflowed");
+        }
+        
+        if (inInsertOffset > currentLength)
+        {
+                SetErrorMessageAndBail("InsertCStrIntoHandle: Insertion offset is greater than string length");
+        }
+        
+        insertLength = CStrLength(theCString);
+        
+        ::SetHandleSize(theHandle,currentLength + 1 + insertLength);
+        
+        if (::GetHandleSize(theHandle) < currentLength + 1 + insertLength)
+        {
+                SetErrorMessageAndLongIntAndBail("InsertCStrIntoHandle: Can't expand storage for Handle, MemError() = ",MemError());
+        }
+        
+        ::BlockMove(*theHandle + inInsertOffset,*theHandle + inInsertOffset + insertLength,currentLength - inInsertOffset + 1);
+        
+        ::BlockMove(theCString,*theHandle + inInsertOffset,insertLength);
+
+
+        errCode = noErr;
+        
+        
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+
+void CopyCStrAndInsert1LongIntIntoCStr(const char *theSrcCStr,const long theNum,char *theDstCStr,const int maxDstStrLength)
+{
+        CopyCStrAndInsertCStrLongIntIntoCStr(theSrcCStr,nil,theNum,theDstCStr,maxDstStrLength);
+}
+
+
+void CopyCStrAndInsert2LongIntsIntoCStr(const char *theSrcCStr,const long long1,const long long2,char *theDstCStr,const int maxDstStrLength)
+{
+const long      theLongInts[] = { long1,long2 };
+
+        CopyCStrAndInsertCStrsLongIntsIntoCStr(theSrcCStr,nil,theLongInts,theDstCStr,maxDstStrLength);
+}
+
+
+void CopyCStrAndInsert3LongIntsIntoCStr(const char *theSrcCStr,const long long1,const long long2,const long long3,char *theDstCStr,const int maxDstStrLength)
+{
+const long      theLongInts[] = { long1,long2,long3 };
+
+        CopyCStrAndInsertCStrsLongIntsIntoCStr(theSrcCStr,nil,theLongInts,theDstCStr,maxDstStrLength);
+}
+
+
+void CopyCStrAndInsertCStrIntoCStr(const char *theSrcCStr,const char *theInsertCStr,char *theDstCStr,const int maxDstStrLength)
+{
+const char      *theCStrs[2] = { theInsertCStr,nil };
+
+        CopyCStrAndInsertCStrsLongIntsIntoCStr(theSrcCStr,theCStrs,nil,theDstCStr,maxDstStrLength);
+}
+
+
+
+void CopyCStrAndInsertCStrLongIntIntoCStr(const char *theSrcCStr,const char *theInsertCStr,const long theNum,char *theDstCStr,const int maxDstStrLength)
+{
+const char      *theCStrs[2] = { theInsertCStr,nil };
+const long      theLongInts[1] = { theNum };
+
+        CopyCStrAndInsertCStrsLongIntsIntoCStr(theSrcCStr,theCStrs,theLongInts,theDstCStr,maxDstStrLength);
+}
+
+
+
+void CopyCStrAndInsertCStrsLongIntsIntoCStr(const char *theSrcCStr,const char **theInsertCStrs,const long *theLongInts,char *theDstCStr,const int maxDstStrLength)
+{
+int                     dstCharIndex,srcCharIndex,theMaxDstStrLength;
+int                     theCStrIndex = 0;
+int                     theLongIntIndex = 0;
+
+        
+        theMaxDstStrLength = maxDstStrLength;
+        
+        if (theDstCStr != nil && theSrcCStr != nil && theMaxDstStrLength > 0)
+        {
+                dstCharIndex = 0;
+                
+                srcCharIndex = 0;
+                
+                
+                //      Allow room for NULL at end of string
+                
+                theMaxDstStrLength--;
+                
+                
+                for (;;)
+                {
+                        //      Hit end of buffer?
+                        
+                        if (dstCharIndex >= theMaxDstStrLength)
+                        {
+                                theDstCStr[dstCharIndex++] = 0;
+                                
+                                goto EXITPOINT;
+                        }
+                        
+                        //      End of source string?
+                        
+                        else if (theSrcCStr[srcCharIndex] == 0)
+                        {
+                                theDstCStr[dstCharIndex++] = 0;
+                                
+                                goto EXITPOINT;
+                        }
+                        
+                        //      Did we find a '%s'?
+                        
+                        else if (theInsertCStrs != nil && theInsertCStrs[theCStrIndex] != nil && theSrcCStr[srcCharIndex] == '%' && theSrcCStr[srcCharIndex + 1] == 's')
+                        {
+                                //      Skip over the '%s'
+                                
+                                srcCharIndex += 2;
+                                
+                                
+                                //      Terminate the dest string and then concat the string
+                                
+                                theDstCStr[dstCharIndex] = 0;
+                                
+                                ConcatCStrToCStr(theInsertCStrs[theCStrIndex],theDstCStr,theMaxDstStrLength);
+                                
+                                dstCharIndex = CStrLength(theDstCStr);
+                                
+                                theCStrIndex++;
+                        }
+                        
+                        //      Did we find a '%ld'?
+                        
+                        else if (theLongInts != nil && theSrcCStr[srcCharIndex] == '%' && theSrcCStr[srcCharIndex + 1] == 'l' && theSrcCStr[srcCharIndex + 2] == 'd')
+                        {
+                                //      Skip over the '%ld'
+                                
+                                srcCharIndex += 3;
+                                
+                                
+                                //      Terminate the dest string and then concat the number
+                                
+                                theDstCStr[dstCharIndex] = 0;
+                                
+                                ConcatLongIntToCStr(theLongInts[theLongIntIndex],theDstCStr,theMaxDstStrLength);
+                                
+                                theLongIntIndex++;
+                                
+                                dstCharIndex = CStrLength(theDstCStr);
+                        }
+                        
+                        else
+                        {
+                                theDstCStr[dstCharIndex++] = theSrcCStr[srcCharIndex++];
+                        }
+                }
+        }
+
+
+
+EXITPOINT:
+
+        return;
+}
+
+
+
+
+
+OSErr CopyCStrAndInsertCStrLongIntIntoHandle(const char *theSrcCStr,const char *theInsertCStr,const long theNum,Handle *theHandle)
+{
+OSErr   errCode;
+long    byteCount;
+
+        
+        if (theHandle != nil)
+        {
+                byteCount = CStrLength(theSrcCStr) + CStrLength(theInsertCStr) + 32;
+                
+                *theHandle = NewHandle(byteCount);
+                
+                if (*theHandle == nil)
+                {
+                        SetErrorMessageAndLongIntAndBail("CopyCStrAndInsertCStrLongIntIntoHandle: Can't allocate Handle, MemError() = ",MemError());
+                }
+                
+                
+                HLock(*theHandle);
+                
+                CopyCStrAndInsertCStrLongIntIntoCStr(theSrcCStr,theInsertCStr,theNum,**theHandle,byteCount);
+                
+                HUnlock(*theHandle);
+        }
+        
+        errCode = noErr;
+        
+        
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+
+
+OSErr CopyIndexedWordToCStr(char *theSrcCStr,int whichWord,char *theDstCStr,int maxDstCStrLength)
+{
+OSErr           errCode;
+char            *srcCharPtr,*dstCharPtr;
+int                     wordCount;
+int                     byteCount;
+
+
+        if (theSrcCStr == nil)
+        {
+                SetErrorMessageAndBail(("CopyIndexedWordToCStr: Bad parameter, theSrcCStr == nil"));
+        }
+        
+        if (theDstCStr == nil)
+        {
+                SetErrorMessageAndBail(("CopyIndexedWordToCStr: Bad parameter, theDstCStr == nil"));
+        }
+        
+        if (whichWord < 0)
+        {
+                SetErrorMessageAndBail(("CopyIndexedWordToCStr: Bad parameter, whichWord < 0"));
+        }
+        
+        if (maxDstCStrLength <= 0)
+        {
+                SetErrorMessageAndBail(("CopyIndexedWordToCStr: Bad parameter, maxDstCStrLength <= 0"));
+        }
+
+        
+        *theDstCStr = '\0';
+        
+        srcCharPtr = theSrcCStr;
+
+        while (*srcCharPtr == ' ' || *srcCharPtr == '\t')
+        {
+                srcCharPtr++;
+        }
+        
+
+        for (wordCount = 0;wordCount < whichWord;wordCount++)
+        {
+                while (*srcCharPtr != ' ' && *srcCharPtr != '\t' && *srcCharPtr != '\r' && *srcCharPtr != '\n' && *srcCharPtr != '\0')
+                {
+                        srcCharPtr++;
+                }
+                
+                if (*srcCharPtr == '\r' || *srcCharPtr == '\n' || *srcCharPtr == '\0')
+                {
+                        errCode = noErr;
+                        
+                        goto EXITPOINT;
+                }
+
+                while (*srcCharPtr == ' ' || *srcCharPtr == '\t')
+                {
+                        srcCharPtr++;
+                }
+                
+                if (*srcCharPtr == '\r' || *srcCharPtr == '\n' || *srcCharPtr == '\0')
+                {
+                        errCode = noErr;
+                        
+                        goto EXITPOINT;
+                }
+        }
+
+
+        dstCharPtr = theDstCStr;
+        byteCount = 0;
+        
+        
+        for(;;)
+        {
+                if (byteCount >= maxDstCStrLength - 1 || *srcCharPtr == '\0' || *srcCharPtr == ' ' || *srcCharPtr == '\t' || *srcCharPtr == '\r' || *srcCharPtr == '\n')
+                {
+                        *dstCharPtr = '\0';
+                        break;
+                }
+                
+                *dstCharPtr++ = *srcCharPtr++;
+                
+                byteCount++;
+        }
+
+
+        errCode = noErr;
+
+
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+
+
+OSErr CopyIndexedWordToNewHandle(char *theSrcCStr,int whichWord,Handle *outTheHandle)
+{
+OSErr           errCode;
+char            *srcCharPtr;
+int                     wordCount;
+int                     byteCount;
+
+
+        if (theSrcCStr == nil)
+        {
+                SetErrorMessageAndBail(("CopyIndexedWordToNewHandle: Bad parameter, theSrcCStr == nil"));
+        }
+        
+        if (outTheHandle == nil)
+        {
+                SetErrorMessageAndBail(("CopyIndexedWordToNewHandle: Bad parameter, outTheHandle == nil"));
+        }
+        
+        if (whichWord < 0)
+        {
+                SetErrorMessageAndBail(("CopyIndexedWordToNewHandle: Bad parameter, whichWord < 0"));
+        }
+
+        
+        *outTheHandle = nil;
+        
+
+        srcCharPtr = theSrcCStr;
+
+        while (*srcCharPtr == ' ' || *srcCharPtr == '\t')
+        {
+                srcCharPtr++;
+        }
+        
+
+        for (wordCount = 0;wordCount < whichWord;wordCount++)
+        {
+                while (*srcCharPtr != ' ' && *srcCharPtr != '\t' && *srcCharPtr != '\r' && *srcCharPtr != '\n' && *srcCharPtr != '\0')
+                {
+                        srcCharPtr++;
+                }
+                
+                if (*srcCharPtr == '\r' || *srcCharPtr == '\n' || *srcCharPtr == '\0')
+                {
+                        break;
+                }
+
+                while (*srcCharPtr == ' ' || *srcCharPtr == '\t')
+                {
+                        srcCharPtr++;
+                }
+                
+                if (*srcCharPtr == '\r' || *srcCharPtr == '\n' || *srcCharPtr == '\0')
+                {
+                        break;
+                }
+        }
+
+
+        for (byteCount = 0;;byteCount++)
+        {
+                if (srcCharPtr[byteCount] == ' ' || srcCharPtr[byteCount] == '\t' || srcCharPtr[byteCount] == '\r' || srcCharPtr[byteCount] == '\n' || srcCharPtr[byteCount] == '\0')
+                {
+                        break;
+                }
+        }
+
+        
+        *outTheHandle = NewHandle(byteCount + 1);
+        
+        if (*outTheHandle == nil)
+        {
+                SetErrorMessageAndLongIntAndBail("CopyIndexedWordToNewHandle: Can't allocate Handle, MemError() = ",MemError());
+        }
+        
+        
+        ::BlockMove(srcCharPtr,**outTheHandle,byteCount);
+        
+        (**outTheHandle)[byteCount] = '\0';
+
+        errCode = noErr;
+
+
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+OSErr CopyIndexedLineToCStr(const char *theSrcCStr,int inWhichLine,int *lineEndIndex,Boolean *gotLastLine,char *theDstCStr,const int maxDstCStrLength)
+{
+OSErr           errCode;
+int                     theCurrentLine;
+int                     theCurrentLineOffset;
+int                     theEOSOffset;
+
+
+        if (theSrcCStr == nil)
+        {
+                SetErrorMessageAndBail(("CopyIndexedLineToCStr: Bad parameter, theSrcCStr == nil"));
+        }
+        
+        if (theDstCStr == nil)
+        {
+                SetErrorMessageAndBail(("CopyIndexedLineToCStr: Bad parameter, theDstCStr == nil"));
+        }
+        
+        if (inWhichLine < 0)
+        {
+                SetErrorMessageAndBail(("CopyIndexedLineToCStr: Bad parameter, inWhichLine < 0"));
+        }
+        
+        if (maxDstCStrLength <= 0)
+        {
+                SetErrorMessageAndBail(("CopyIndexedLineToCStr: Bad parameter, maxDstCStrLength <= 0"));
+        }
+        
+        
+        if (gotLastLine != nil)
+        {
+                *gotLastLine = false;
+        }
+
+        
+        *theDstCStr = 0;
+        
+        theCurrentLineOffset = 0;
+        
+        theCurrentLine = 0;
+        
+        
+        while (theCurrentLine < inWhichLine)
+        {
+                while (theSrcCStr[theCurrentLineOffset] != '\r' && theSrcCStr[theCurrentLineOffset] != 0)
+                {
+                        theCurrentLineOffset++;
+                }
+                
+                if (theSrcCStr[theCurrentLineOffset] == 0)
+                {
+                        break;
+                }
+                
+                theCurrentLineOffset++;
+                theCurrentLine++;
+        }
+                
+        if (theSrcCStr[theCurrentLineOffset] == 0)
+        {
+                SetErrorMessageAndLongIntAndBail("CopyIndexedLineToCStr: Too few lines in source text, can't get line ",inWhichLine);
+        }
+
+
+        theEOSOffset = FindCharOffsetInCStr('\r',theSrcCStr + theCurrentLineOffset);
+        
+        if (theEOSOffset >= 0)
+        {
+                CopyCSubstrToCStr(theSrcCStr + theCurrentLineOffset,theEOSOffset,theDstCStr,maxDstCStrLength);
+                
+                if (gotLastLine != nil)
+                {
+                        *gotLastLine = false;
+                }
+        
+                if (lineEndIndex != nil)
+                {
+                        *lineEndIndex = theEOSOffset;
+                }
+        }
+        
+        else
+        {
+                theEOSOffset = CStrLength(theSrcCStr + theCurrentLineOffset);
+
+                CopyCSubstrToCStr(theSrcCStr + theCurrentLineOffset,theEOSOffset,theDstCStr,maxDstCStrLength);
+                
+                if (gotLastLine != nil)
+                {
+                        *gotLastLine = true;
+                }
+        
+                if (lineEndIndex != nil)
+                {
+                        *lineEndIndex = theEOSOffset;
+                }
+        }
+        
+
+        errCode = noErr;
+
+
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+OSErr CopyIndexedLineToNewHandle(const char *theSrcCStr,int inWhichLine,Handle *outNewHandle)
+{
+OSErr           errCode;
+int                     theCurrentLine;
+int                     theCurrentLineOffset;
+int                     byteCount;
+
+
+        SetErrorMessageAndBailIfNil(theSrcCStr,"CopyIndexedLineToNewHandle: Bad parameter, theSrcCStr == nil");
+        SetErrorMessageAndBailIfNil(outNewHandle,"CopyIndexedLineToNewHandle: Bad parameter, outNewHandle == nil");
+        
+        if (inWhichLine < 0)
+        {
+                SetErrorMessageAndBail(("CopyIndexedLineToNewHandle: Bad parameter, inWhichLine < 0"));
+        }
+        
+
+        theCurrentLineOffset = 0;
+        
+        theCurrentLine = 0;
+        
+        
+        while (theCurrentLine < inWhichLine)
+        {
+                while (theSrcCStr[theCurrentLineOffset] != '\r' && theSrcCStr[theCurrentLineOffset] != '\0')
+                {
+                        theCurrentLineOffset++;
+                }
+                
+                if (theSrcCStr[theCurrentLineOffset] == '\0')
+                {
+                        break;
+                }
+                
+                theCurrentLineOffset++;
+                theCurrentLine++;
+        }
+                
+        if (theSrcCStr[theCurrentLineOffset] == '\0')
+        {
+                SetErrorMessageAndLongIntAndBail("CopyIndexedLineToNewHandle: Too few lines in source text, can't get line #",inWhichLine);
+        }
+
+        
+        byteCount = 0;
+        
+        while (theSrcCStr[theCurrentLineOffset + byteCount] != '\r' && theSrcCStr[theCurrentLineOffset + byteCount] != '\0')
+        {
+                byteCount++;
+        }
+                
+        
+        *outNewHandle = NewHandle(byteCount + 1);
+        
+        if (*outNewHandle == nil)
+        {
+                SetErrorMessageAndLongIntAndBail("CopyIndexedLineToNewHandle: Can't allocate Handle, MemError() = ",MemError());
+        }
+        
+        ::BlockMove(theSrcCStr + theCurrentLineOffset,**outNewHandle,byteCount);
+        
+        (**outNewHandle)[byteCount] = '\0';
+
+        errCode = noErr;
+
+
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+
+OSErr CountDigits(const char *inCStr,int *outNumIntegerDigits,int *outNumFractDigits)
+{
+OSErr   errCode = noErr;
+int             numIntDigits = 0;
+int             numFractDigits = 0;
+int     digitIndex = 0;
+
+        
+        SetErrorMessageAndBailIfNil(inCStr,"CountDigits: Bad parameter, theSrcCStr == nil");
+        SetErrorMessageAndBailIfNil(outNumIntegerDigits,"CountDigits: Bad parameter, outNumIntegerDigits == nil");
+        SetErrorMessageAndBailIfNil(outNumFractDigits,"CountDigits: Bad parameter, outNumFractDigits == nil");
+        
+        digitIndex = 0;
+        
+        while (inCStr[digitIndex] >= '0' && inCStr[digitIndex] <= '9')
+        {
+                digitIndex++;
+                numIntDigits++;
+        }
+        
+        if (inCStr[digitIndex] == '.')
+        {
+                digitIndex++;
+                
+                while (inCStr[digitIndex] >= '0' && inCStr[digitIndex] <= '9')
+                {
+                        digitIndex++;
+                        numFractDigits++;
+                }
+        }
+        
+        *outNumIntegerDigits = numIntDigits;
+        
+        *outNumFractDigits = numFractDigits;
+        
+        errCode = noErr;
+        
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+OSErr ExtractIntFromCStr(const char *theSrcCStr,int *outInt,Boolean skipLeadingSpaces)
+{
+OSErr           errCode;
+int                     theCharIndex;
+
+
+        if (theSrcCStr == nil)
+        {
+                SetErrorMessageAndBail(("ExtractIntFromCStr: Bad parameter, theSrcCStr == nil"));
+        }
+        
+        if (outInt == nil)
+        {
+                SetErrorMessageAndBail(("ExtractIntFromCStr: Bad parameter, outInt == nil"));
+        }       
+
+        
+        *outInt = 0;
+        
+        theCharIndex = 0;
+        
+        if (skipLeadingSpaces == true)
+        {
+                while (theSrcCStr[theCharIndex] == ' ')
+                {
+                        theCharIndex++;
+                }
+        }
+        
+        if (theSrcCStr[theCharIndex] < '0' || theSrcCStr[theCharIndex] > '9')
+        {
+                SetErrorMessageAndBail(("ExtractIntFromCStr: Bad parameter, theSrcCStr contains a bogus numeric representation"));
+        }
+
+
+        while (theSrcCStr[theCharIndex] >= '0' && theSrcCStr[theCharIndex] <= '9')
+        {
+                *outInt = (*outInt * 10) + (theSrcCStr[theCharIndex] - '0');
+                
+                theCharIndex++;
+        }
+        
+
+        errCode = noErr;
+
+
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+OSErr ExtractIntFromPStr(const unsigned char *theSrcPStr,int *outInt,Boolean skipLeadingSpaces)
+{
+OSErr           errCode;
+char            theCStr[256];
+
+
+        if (theSrcPStr == nil)
+        {
+                SetErrorMessageAndBail(("ExtractIntFromPStr: Bad parameter, theSrcPStr == nil"));
+        }
+        
+        if (outInt == nil)
+        {
+                SetErrorMessageAndBail(("ExtractIntFromPStr: Bad parameter, outInt == nil"));
+        }
+        
+        
+        CopyPStrToCStr(theSrcPStr,theCStr,sizeof(theCStr));
+        
+        
+        errCode = ExtractIntFromCStr(theCStr,outInt,skipLeadingSpaces);
+
+
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+int CountOccurencesOfCharInCStr(const char inChar,const char *inSrcCStr)
+{
+int             theSrcCharIndex;
+int             numOccurrences = -1;
+
+
+        if (inSrcCStr != nil && inChar != '\0')
+        {
+                numOccurrences = 0;
+                
+                for (theSrcCharIndex = 0;inSrcCStr[theSrcCharIndex] != '\0';theSrcCharIndex++)
+                {
+                        if (inSrcCStr[theSrcCharIndex] == inChar)
+                        {
+                                numOccurrences++;
+                        }
+                }
+        }
+        
+        return(numOccurrences);
+}
+
+
+int CountWordsInCStr(const char *inSrcCStr)
+{
+int             numWords = -1;
+
+
+        if (inSrcCStr != nil)
+        {
+                numWords = 0;
+                
+                //      Skip lead spaces
+                
+                while (*inSrcCStr == ' ')
+                {
+                        inSrcCStr++;
+                }
+
+                while (*inSrcCStr != '\0')
+                {
+                        numWords++;
+
+                        while (*inSrcCStr != ' ' && *inSrcCStr != '\0')
+                        {
+                                inSrcCStr++;
+                        }
+                        
+                        while (*inSrcCStr == ' ')
+                        {
+                                inSrcCStr++;
+                        }
+                }
+        }
+        
+        return(numWords);
+}
+
+
+
+
+void ConvertCStrToUpperCase(char *theSrcCStr)
+{
+char            *theCharPtr;
+
+
+        if (theSrcCStr != nil)
+        {
+                theCharPtr = theSrcCStr;
+                
+                while (*theCharPtr != 0)
+                {
+                        if (*theCharPtr >= 'a' && *theCharPtr <= 'z')
+                        {
+                                *theCharPtr = *theCharPtr - 'a' + 'A';
+                        }
+                        
+                        theCharPtr++;
+                }
+        }
+}
+
+
+
+
+
+
+
+void ExtractCStrItemFromCStr(const char *inSrcCStr,const char inItemDelimiter,const int inItemNumber,Boolean *foundItem,char *outDstCharPtr,const int inDstCharPtrMaxLength,const Boolean inTreatMultipleDelimsAsSingleDelim)
+{
+int             theItem;
+int             theSrcCharIndex;
+int             theDstCharIndex;
+
+
+        if (foundItem != nil)
+        {
+                *foundItem = false;
+        }
+        
+        
+        if (outDstCharPtr != nil && inDstCharPtrMaxLength > 0 && inItemNumber >= 0 && inItemDelimiter != 0)
+        {
+                *outDstCharPtr = 0;
+                
+
+                theSrcCharIndex = 0;
+                
+                for (theItem = 0;theItem < inItemNumber;theItem++)
+                {
+                        while (inSrcCStr[theSrcCharIndex] != inItemDelimiter && inSrcCStr[theSrcCharIndex] != '\0')
+                        {
+                                theSrcCharIndex++;
+                        }
+                        
+                        if (inSrcCStr[theSrcCharIndex] == inItemDelimiter)
+                        {
+                                theSrcCharIndex++;
+                                
+                                if (inTreatMultipleDelimsAsSingleDelim)
+                                {
+                                        while (inSrcCStr[theSrcCharIndex] == inItemDelimiter)
+                                        {
+                                                theSrcCharIndex++;
+                                        }
+                                }
+                        }
+                        
+                        
+                        if (inSrcCStr[theSrcCharIndex] == '\0')
+                        {
+                                goto EXITPOINT;
+                        }
+                }
+                
+
+                if (foundItem != nil)
+                {
+                        *foundItem = true;
+                }
+                
+                
+                theDstCharIndex = 0;
+                
+                for (;;)
+                {
+                        if (inSrcCStr[theSrcCharIndex] == 0 || inSrcCStr[theSrcCharIndex] == inItemDelimiter || theDstCharIndex >= inDstCharPtrMaxLength - 1)
+                        {
+                                outDstCharPtr[theDstCharIndex] = 0;
+                                
+                                break;
+                        }
+                        
+                        outDstCharPtr[theDstCharIndex++] = inSrcCStr[theSrcCharIndex++];
+                }
+        }
+        
+        
+EXITPOINT:
+
+        return;
+}
+
+
+
+OSErr ExtractCStrItemFromCStrIntoNewHandle(const char *inSrcCStr,const char inItemDelimiter,const int inItemNumber,Boolean *foundItem,Handle *outNewHandle,const Boolean inTreatMultipleDelimsAsSingleDelim)
+{
+OSErr   errCode;
+int             theItem;
+int             theSrcCharIndex;
+int             theItemLength;
+
+
+        if (inSrcCStr == nil)
+        {
+                SetErrorMessage("ExtractCStrItemFromCStrIntoNewHandle: Bad parameter, inSrcCStr == nil");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+        if (outNewHandle == nil)
+        {
+                SetErrorMessage("ExtractCStrItemFromCStrIntoNewHandle: Bad parameter, outNewHandle == nil");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+        if (foundItem == nil)
+        {
+                SetErrorMessage("ExtractCStrItemFromCStrIntoNewHandle: Bad parameter, foundItem == nil");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+        if (inItemNumber < 0)
+        {
+                SetErrorMessage("ExtractCStrItemFromCStrIntoNewHandle: Bad parameter, inItemNumber < 0");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+        if (inItemDelimiter == 0)
+        {
+                SetErrorMessage("ExtractCStrItemFromCStrIntoNewHandle: Bad parameter, inItemDelimiter == 0");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+
+
+        *foundItem = false;
+        
+        theSrcCharIndex = 0;
+        
+        for (theItem = 0;theItem < inItemNumber;theItem++)
+        {
+                while (inSrcCStr[theSrcCharIndex] != inItemDelimiter && inSrcCStr[theSrcCharIndex] != '\0')
+                {
+                        theSrcCharIndex++;
+                }
+                
+                if (inSrcCStr[theSrcCharIndex] == inItemDelimiter)
+                {
+                        theSrcCharIndex++;
+                        
+                        if (inTreatMultipleDelimsAsSingleDelim)
+                        {
+                                while (inSrcCStr[theSrcCharIndex] == inItemDelimiter)
+                                {
+                                        theSrcCharIndex++;
+                                }
+                        }
+                }
+                
+                
+                if (inSrcCStr[theSrcCharIndex] == '\0')
+                {
+                        errCode = noErr;
+                        
+                        goto EXITPOINT;
+                }
+        }
+        
+
+        *foundItem = true;
+        
+        
+        for (theItemLength = 0;;theItemLength++)
+        {
+                if (inSrcCStr[theSrcCharIndex + theItemLength] == 0 || inSrcCStr[theSrcCharIndex + theItemLength] == inItemDelimiter)
+                {
+                        break;
+                }
+        }
+        
+
+        *outNewHandle = NewHandle(theItemLength + 1);
+        
+        if (*outNewHandle == nil)
+        {
+                SetErrorMessageAndLongIntAndBail("ExtractCStrItemFromCStrIntoNewHandle: Can't allocate Handle, MemError() = ",MemError());
+        }
+        
+        
+        BlockMove(inSrcCStr + theSrcCharIndex,**outNewHandle,theItemLength);
+        
+        (**outNewHandle)[theItemLength] = 0;
+        
+        errCode = noErr;
+        
+        
+EXITPOINT:
+
+        return(errCode);
+}
+
+
+
+
+
+
+OSErr ExtractFloatFromCStr(const char *inCString,extended80 *outFloat)
+{
+OSErr                           errCode;
+Str255                          theStr255;
+Handle                          theNumberPartsTableHandle = nil;
+long                            theNumberPartsOffset,theNumberPartsLength;
+FormatResultType        theFormatResultType;
+NumberParts                     theNumberPartsTable;
+NumFormatStringRec      theNumFormatStringRec;
+
+
+        if (inCString == nil)
+        {
+                SetErrorMessage("ExtractFloatFromCStr: Bad parameter, inCString == nil");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+
+        if (outFloat == nil)
+        {
+                SetErrorMessage("ExtractFloatFromCStr: Bad parameter, outFloat == nil");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+        
+//      GetIntlResourceTable(smRoman,smNumberPartsTable,&theNumberPartsTableHandle,&theNumberPartsOffset,&theNumberPartsLength);
+
+        GetIntlResourceTable(GetScriptManagerVariable(smSysScript),smNumberPartsTable,&theNumberPartsTableHandle,&theNumberPartsOffset,&theNumberPartsLength);  
+        
+        if (theNumberPartsTableHandle == nil)
+        {
+                SetErrorMessage("ExtractFloatFromCStr: Can't get number parts table for converting string representations to/from numeric representations");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+        if (theNumberPartsLength > sizeof(theNumberPartsTable))
+        {
+                SetErrorMessage("ExtractFloatFromCStr: Number parts table has bad length");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+
+        BlockMove(*theNumberPartsTableHandle + theNumberPartsOffset,&theNumberPartsTable,theNumberPartsLength);
+        
+        
+        theFormatResultType = (FormatResultType) StringToFormatRec(kNumberFormatString,&theNumberPartsTable,&theNumFormatStringRec);
+        
+        if (theFormatResultType != fFormatOK)
+        {
+                SetErrorMessage("ExtractFloatFromCStr: StringToFormatRec() != fFormatOK");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+
+        
+        CopyCStrToPStr(inCString,theStr255,sizeof(theStr255));
+
+
+        theFormatResultType = (FormatResultType) StringToExtended(theStr255,&theNumFormatStringRec,&theNumberPartsTable,outFloat);
+        
+        if (theFormatResultType != fFormatOK && theFormatResultType != fBestGuess)
+        {
+                SetErrorMessageAndLongIntAndBail("ExtractFloatFromCStr: StringToExtended() = ",theFormatResultType);
+        }
+
+        
+        errCode = noErr;
+        
+
+EXITPOINT:
+        
+        return(errCode);
+}
+
+
+
+OSErr CopyFloatToCStr(const extended80 *theFloat,char *theCStr,const int maxCStrLength,const int inMaxNumIntDigits,const int inMaxNumFractDigits)
+{
+OSErr                           errCode;
+Str255                          theStr255;
+Handle                          theNumberPartsTableHandle = nil;
+long                            theNumberPartsOffset,theNumberPartsLength;
+FormatResultType        theFormatResultType;
+NumberParts                     theNumberPartsTable;
+NumFormatStringRec      theNumFormatStringRec;
+
+
+        if (theCStr == nil)
+        {
+                SetErrorMessage("CopyFloatToCStr: Bad parameter, theCStr == nil");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+
+        if (theFloat == nil)
+        {
+                SetErrorMessage("CopyFloatToCStr: Bad parameter, theFloat == nil");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+
+//      GetIntlResourceTable(smRoman,smNumberPartsTable,&theNumberPartsTableHandle,&theNumberPartsOffset,&theNumberPartsLength);
+
+        GetIntlResourceTable(GetScriptManagerVariable(smSysScript),smNumberPartsTable,&theNumberPartsTableHandle,&theNumberPartsOffset,&theNumberPartsLength);  
+        
+        if (theNumberPartsTableHandle == nil)
+        {
+                SetErrorMessage("CopyFloatToCStr: Can't get number parts table for converting string representations to/from numeric representations");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+        if (theNumberPartsLength > sizeof(theNumberPartsTable))
+        {
+                SetErrorMessage("CopyFloatToCStr: Number parts table has bad length");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+        
+        
+        BlockMove(*theNumberPartsTableHandle + theNumberPartsOffset,&theNumberPartsTable,theNumberPartsLength);
+        
+        
+        if (inMaxNumIntDigits >= 0 || inMaxNumFractDigits >= 0)
+        {
+        char    numberFormat[64];
+        int             numberFormatLength = 0;
+        
+                for (int i = 0;i < inMaxNumIntDigits && numberFormatLength < sizeof(numberFormat) - 1;i++)
+                {
+                        numberFormat[numberFormatLength++] = '0';
+                }
+                
+                if (inMaxNumFractDigits > 0 && numberFormatLength < sizeof(numberFormat) - 1)
+                {
+                        numberFormat[numberFormatLength++] = '.';
+                        
+                        for (int i = 0;i < inMaxNumFractDigits && numberFormatLength < sizeof(numberFormat) - 1;i++)
+                        {
+                                numberFormat[numberFormatLength++] = '0';
+                        }
+                }
+
+                
+                if (numberFormatLength < sizeof(numberFormat) - 1)
+                {
+                        numberFormat[numberFormatLength++] = ';';
+                }
+                
+                if (numberFormatLength < sizeof(numberFormat) - 1)
+                {
+                        numberFormat[numberFormatLength++] = '-';
+                }
+                
+
+                for (int i = 0;i < inMaxNumIntDigits && numberFormatLength < sizeof(numberFormat) - 1;i++)
+                {
+                        numberFormat[numberFormatLength++] = '0';
+                }
+                
+                if (inMaxNumFractDigits > 0 && numberFormatLength < sizeof(numberFormat) - 1)
+                {
+                        numberFormat[numberFormatLength++] = '.';
+                        
+                        for (int i = 0;i < inMaxNumFractDigits && numberFormatLength < sizeof(numberFormat) - 1;i++)
+                        {
+                                numberFormat[numberFormatLength++] = '0';
+                        }
+                }
+                
+                numberFormat[numberFormatLength] = '\0';
+
+
+        Str255  tempStr255;
+        
+                CopyCStrToPStr(numberFormat,tempStr255,sizeof(tempStr255));
+                
+                theFormatResultType = (FormatResultType) StringToFormatRec(tempStr255,&theNumberPartsTable,&theNumFormatStringRec);
+        }
+        
+        else
+        {
+                theFormatResultType = (FormatResultType) StringToFormatRec(kNumberFormatString,&theNumberPartsTable,&theNumFormatStringRec);
+        }
+        
+        if (theFormatResultType != fFormatOK)
+        {
+                SetErrorMessage("CopyFloatToCStr: StringToFormatRec() != fFormatOK");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+
+
+        theFormatResultType = (FormatResultType) ExtendedToString(theFloat,&theNumFormatStringRec,&theNumberPartsTable,theStr255);
+        
+        if (theFormatResultType != fFormatOK)
+        {
+                SetErrorMessage("CopyFloatToCStr: ExtendedToString() != fFormatOK");
+                errCode = kGenericError;
+                goto EXITPOINT;
+        }
+
+        
+        CopyPStrToCStr(theStr255,theCStr,maxCStrLength);
+        
+        errCode = noErr;
+        
+
+EXITPOINT:
+        
+        return(errCode);
+}
+
+
+
+
+
+void SkipWhiteSpace(char **ioSrcCharPtr,const Boolean inStopAtEOL)
+{
+        if (ioSrcCharPtr != nil && *ioSrcCharPtr != nil)
+        {
+                if (inStopAtEOL)
+                {
+                        while ((**ioSrcCharPtr == ' ' || **ioSrcCharPtr == '\t') && **ioSrcCharPtr != '\r' && **ioSrcCharPtr != '\n')
+                        {
+                                *ioSrcCharPtr++;
+                        }
+                }
+                
+                else
+                {
+                        while (**ioSrcCharPtr == ' ' || **ioSrcCharPtr == '\t')
+                        {
+                                *ioSrcCharPtr++;
+                        }
+                }
+        }
+}
diff --git a/src/lib/libssl/src/MacOS/GetHTTPS.src/CPStringUtils.hpp b/src/lib/libssl/src/MacOS/GetHTTPS.src/CPStringUtils.hpp
new file mode 100644
index 0000000000..5045c41019
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/GetHTTPS.src/CPStringUtils.hpp
@@ -0,0 +1,104 @@
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void CopyPStrToCStr(const unsigned char *thePStr,char *theCStr,const int maxCStrLength);
+void CopyPStrToPStr(const unsigned char *theSrcPStr,unsigned char *theDstPStr,const int maxDstStrLength);
+void CopyCStrToCStr(const char *theSrcCStr,char *theDstCStr,const int maxDstStrLength);
+void CopyCStrToPStr(const char *theSrcCStr,unsigned char *theDstPStr,const int maxDstStrLength);
+void ConcatPStrToCStr(const unsigned char *thePStr,char *theCStr,const int maxCStrLength);
+void ConcatPStrToPStr(const unsigned char *theSrcPStr,unsigned char *theDstPStr,const int maxDstStrLength);
+void ConcatCStrToPStr(const char *theSrcCStr,unsigned char *theDstPStr,const int maxDstStrLength);
+void ConcatCStrToCStr(const char *theSrcCStr,char *theDstCStr,const int maxCStrLength);
+
+void ConcatCharToCStr(const char theChar,char *theDstCStr,const int maxCStrLength);
+void ConcatCharToPStr(const char theChar,unsigned char *theDstPStr,const int maxPStrLength);
+
+int ComparePStrs(const unsigned char *theFirstPStr,const unsigned char *theSecondPStr,const Boolean ignoreCase = true);
+int CompareCStrs(const char *theFirstCStr,const char *theSecondCStr,const Boolean ignoreCase = true);
+int CompareCStrToPStr(const char *theCStr,const unsigned char *thePStr,const Boolean ignoreCase = true);
+
+Boolean CStrsAreEqual(const char *theFirstCStr,const char *theSecondCStr,const Boolean ignoreCase = true);
+Boolean PStrsAreEqual(const unsigned char *theFirstCStr,const unsigned char *theSecondCStr,const Boolean ignoreCase = true);
+
+void CopyLongIntToCStr(const long theNum,char *theCStr,const int maxCStrLength,const int numDigits = -1);
+void CopyUnsignedLongIntToCStr(const unsigned long theNum,char *theCStr,const int maxCStrLength);
+void ConcatLongIntToCStr(const long theNum,char *theCStr,const int maxCStrLength,const int numDigits = -1);
+void CopyCStrAndConcatLongIntToCStr(const char *theSrcCStr,const long theNum,char *theDstCStr,const int maxDstStrLength);
+
+void CopyLongIntToPStr(const long theNum,unsigned char *thePStr,const int maxPStrLength,const int numDigits = -1);
+void ConcatLongIntToPStr(const long theNum,unsigned char *thePStr,const int maxPStrLength,const int numDigits = -1);
+
+long CStrLength(const char *theCString);
+long PStrLength(const unsigned char *thePString);
+
+OSErr CopyCStrToExistingHandle(const char *theCString,Handle theHandle);
+OSErr CopyLongIntToExistingHandle(const long inTheLongInt,Handle theHandle);
+
+OSErr CopyCStrToNewHandle(const char *theCString,Handle *theHandle);
+OSErr CopyPStrToNewHandle(const unsigned char *thePString,Handle *theHandle);
+OSErr CopyLongIntToNewHandle(const long inTheLongInt,Handle *theHandle);
+
+OSErr AppendCStrToHandle(const char *theCString,Handle theHandle,long *currentLength = nil,long *maxLength = nil);
+OSErr AppendCharsToHandle(const char *theChars,const int numChars,Handle theHandle,long *currentLength = nil,long *maxLength = nil);
+OSErr AppendPStrToHandle(const unsigned char *thePString,Handle theHandle,long *currentLength = nil);
+OSErr AppendLongIntToHandle(const long inTheLongInt,Handle theHandle,long *currentLength = nil);
+
+void ZeroMem(void *theMemPtr,const unsigned long numBytes);
+
+char *FindCharInCStr(const char theChar,const char *theCString);
+long FindCharOffsetInCStr(const char theChar,const char *theCString,const Boolean inIgnoreCase = false);
+long FindCStrOffsetInCStr(const char *theCSubstring,const char *theCString,const Boolean inIgnoreCase = false);
+
+void CopyCSubstrToCStr(const char *theSrcCStr,const int maxCharsToCopy,char *theDstCStr,const int maxDstStrLength);
+void CopyCSubstrToPStr(const char *theSrcCStr,const int maxCharsToCopy,unsigned char *theDstPStr,const int maxDstStrLength);
+
+void InsertCStrIntoCStr(const char *theSrcCStr,const int theInsertionOffset,char *theDstCStr,const int maxDstStrLength);
+void InsertPStrIntoCStr(const unsigned char *theSrcPStr,const int theInsertionOffset,char *theDstCStr,const int maxDstStrLength);
+OSErr InsertCStrIntoHandle(const char *theCString,Handle theHandle,const long inInsertOffset);
+
+void CopyCStrAndInsertCStrIntoCStr(const char *theSrcCStr,const char *theInsertCStr,char *theDstCStr,const int maxDstStrLength);
+
+void CopyCStrAndInsertCStrsLongIntsIntoCStr(const char *theSrcCStr,const char **theInsertCStrs,const long *theLongInts,char *theDstCStr,const int maxDstStrLength);
+
+void CopyCStrAndInsert1LongIntIntoCStr(const char *theSrcCStr,const long theNum,char *theDstCStr,const int maxDstStrLength);
+void CopyCStrAndInsert2LongIntsIntoCStr(const char *theSrcCStr,const long long1,const long long2,char *theDstCStr,const int maxDstStrLength);
+void CopyCStrAndInsert3LongIntsIntoCStr(const char *theSrcCStr,const long long1,const long long2,const long long3,char *theDstCStr,const int maxDstStrLength);
+
+void CopyCStrAndInsertCStrLongIntIntoCStr(const char *theSrcCStr,const char *theInsertCStr,const long theNum,char *theDstCStr,const int maxDstStrLength);
+OSErr CopyCStrAndInsertCStrLongIntIntoHandle(const char *theSrcCStr,const char *theInsertCStr,const long theNum,Handle *theHandle);
+
+
+OSErr CopyIndexedWordToCStr(char *theSrcCStr,int whichWord,char *theDstCStr,int maxDstCStrLength);
+OSErr CopyIndexedWordToNewHandle(char *theSrcCStr,int whichWord,Handle *outTheHandle);
+
+OSErr CopyIndexedLineToCStr(const char *theSrcCStr,int inWhichLine,int *lineEndIndex,Boolean *gotLastLine,char *theDstCStr,const int maxDstCStrLength);
+OSErr CopyIndexedLineToNewHandle(const char *theSrcCStr,int inWhichLine,Handle *outNewHandle);
+
+OSErr ExtractIntFromCStr(const char *theSrcCStr,int *outInt,Boolean skipLeadingSpaces = true);
+OSErr ExtractIntFromPStr(const unsigned char *theSrcPStr,int *outInt,Boolean skipLeadingSpaces = true);
+
+
+void ConvertCStrToUpperCase(char *theSrcCStr);
+
+
+int CountOccurencesOfCharInCStr(const char inChar,const char *inSrcCStr);
+int CountWordsInCStr(const char *inSrcCStr);
+
+OSErr CountDigits(const char *inCStr,int *outNumIntegerDigits,int *outNumFractDigits);
+
+void ExtractCStrItemFromCStr(const char *inSrcCStr,const char inItemDelimiter,const int inItemNumber,Boolean *foundItem,char *outDstCharPtr,const int inDstCharPtrMaxLength,const Boolean inTreatMultipleDelimsAsSingleDelim = false);
+OSErr ExtractCStrItemFromCStrIntoNewHandle(const char *inSrcCStr,const char inItemDelimiter,const int inItemNumber,Boolean *foundItem,Handle *outNewHandle,const Boolean inTreatMultipleDelimsAsSingleDelim = false);
+
+
+OSErr ExtractFloatFromCStr(const char *inCString,extended80 *outFloat);
+OSErr CopyFloatToCStr(const extended80 *theFloat,char *theCStr,const int maxCStrLength,const int inMaxNumIntDigits = -1,const int inMaxNumFractDigits = -1);
+
+void SkipWhiteSpace(char **ioSrcCharPtr,const Boolean inStopAtEOL = false);
+
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/src/lib/libssl/src/MacOS/GetHTTPS.src/ErrorHandling.cpp b/src/lib/libssl/src/MacOS/GetHTTPS.src/ErrorHandling.cpp
new file mode 100644
index 0000000000..80b6a675f4
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/GetHTTPS.src/ErrorHandling.cpp
@@ -0,0 +1,170 @@
+/* ====================================================================
+ * Copyright (c) 1998-1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+ 
+ 
+ 
+ #include "ErrorHandling.hpp"
+#include "CPStringUtils.hpp"
+
+#ifdef __EXCEPTIONS_ENABLED__
+        #include "CMyException.hpp"
+#endif
+
+
+static char                                     gErrorMessageBuffer[512];
+
+char                                            *gErrorMessage = gErrorMessageBuffer;
+int                                                     gErrorMessageMaxLength = sizeof(gErrorMessageBuffer);
+
+
+
+void SetErrorMessage(const char *theErrorMessage)
+{
+        if (theErrorMessage != nil)
+        {
+                CopyCStrToCStr(theErrorMessage,gErrorMessage,gErrorMessageMaxLength);
+        }
+}
+
+
+void SetErrorMessageAndAppendLongInt(const char *theErrorMessage,const long theLongInt)
+{
+        if (theErrorMessage != nil)
+        {
+                CopyCStrAndConcatLongIntToCStr(theErrorMessage,theLongInt,gErrorMessage,gErrorMessageMaxLength);
+        }
+}
+
+void SetErrorMessageAndCStrAndLongInt(const char *theErrorMessage,const char * theCStr,const long theLongInt)
+{
+        if (theErrorMessage != nil)
+        {
+                CopyCStrAndInsertCStrLongIntIntoCStr(theErrorMessage,theCStr,theLongInt,gErrorMessage,gErrorMessageMaxLength);
+        }
+
+}
+
+void SetErrorMessageAndCStr(const char *theErrorMessage,const char * theCStr)
+{
+        if (theErrorMessage != nil)
+        {
+                CopyCStrAndInsertCStrLongIntIntoCStr(theErrorMessage,theCStr,-1,gErrorMessage,gErrorMessageMaxLength);
+        }
+}
+
+
+void AppendCStrToErrorMessage(const char *theErrorMessage)
+{
+        if (theErrorMessage != nil)
+        {
+                ConcatCStrToCStr(theErrorMessage,gErrorMessage,gErrorMessageMaxLength);
+        }
+}
+
+
+void AppendLongIntToErrorMessage(const long theLongInt)
+{
+        ConcatLongIntToCStr(theLongInt,gErrorMessage,gErrorMessageMaxLength);
+}
+
+
+
+char *GetErrorMessage(void)
+{
+        return gErrorMessage;
+}
+
+
+OSErr GetErrorMessageInNewHandle(Handle *inoutHandle)
+{
+OSErr           errCode;
+
+
+        errCode = CopyCStrToNewHandle(gErrorMessage,inoutHandle);
+        
+        return(errCode);
+}
+
+
+OSErr GetErrorMessageInExistingHandle(Handle inoutHandle)
+{
+OSErr           errCode;
+
+
+        errCode = CopyCStrToExistingHandle(gErrorMessage,inoutHandle);
+        
+        return(errCode);
+}
+
+
+
+OSErr AppendErrorMessageToHandle(Handle inoutHandle)
+{
+OSErr           errCode;
+
+
+        errCode = AppendCStrToHandle(gErrorMessage,inoutHandle,nil);
+        
+        return(errCode);
+}
+
+
+#ifdef __EXCEPTIONS_ENABLED__
+
+void ThrowErrorMessageException(void)
+{
+        ThrowDescriptiveException(gErrorMessage);
+}
+
+#endif
diff --git a/src/lib/libssl/src/MacOS/GetHTTPS.src/ErrorHandling.hpp b/src/lib/libssl/src/MacOS/GetHTTPS.src/ErrorHandling.hpp
new file mode 100644
index 0000000000..3036df7ee0
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/GetHTTPS.src/ErrorHandling.hpp
@@ -0,0 +1,147 @@
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef kGenericError
+        #define kGenericError           -1
+#endif
+
+extern char     *gErrorMessage;
+
+
+void SetErrorMessage(const char *theErrorMessage);
+void SetErrorMessageAndAppendLongInt(const char *theErrorMessage,const long theLongInt);
+void SetErrorMessageAndCStrAndLongInt(const char *theErrorMessage,const char * theCStr,const long theLongInt);
+void SetErrorMessageAndCStr(const char *theErrorMessage,const char * theCStr);
+void AppendCStrToErrorMessage(const char *theErrorMessage);
+void AppendLongIntToErrorMessage(const long theLongInt);
+
+
+char *GetErrorMessage(void);
+OSErr GetErrorMessageInNewHandle(Handle *inoutHandle);
+OSErr GetErrorMessageInExistingHandle(Handle inoutHandle);
+OSErr AppendErrorMessageToHandle(Handle inoutHandle);
+
+
+#ifdef __EXCEPTIONS_ENABLED__
+        void ThrowErrorMessageException(void);
+#endif
+
+
+
+//      A bunch of evil macros that would be uneccessary if I were always using C++ !
+
+#define SetErrorMessageAndBailIfNil(theArg,theMessage)                                                          \
+{                                                                                                                                                                       \
+        if (theArg == nil)                                                                                                                              \
+        {                                                                                                                                                               \
+                SetErrorMessage(theMessage);                                                                                            \
+                errCode = kGenericError;                                                                                                        \
+                goto EXITPOINT;                                                                                                                         \
+        }                                                                                                                                                               \
+}
+
+
+#define SetErrorMessageAndBail(theMessage)                                                                                      \
+{                                                                                                                                                                       \
+                SetErrorMessage(theMessage);                                                                                            \
+                errCode = kGenericError;                                                                                                        \
+                goto EXITPOINT;                                                                                                                         \
+}
+
+
+#define SetErrorMessageAndLongIntAndBail(theMessage,theLongInt)                                         \
+{                                                                                                                                                                       \
+                SetErrorMessageAndAppendLongInt(theMessage,theLongInt);                                         \
+                errCode = kGenericError;                                                                                                        \
+                goto EXITPOINT;                                                                                                                         \
+}
+
+
+#define SetErrorMessageAndLongIntAndBailIfError(theErrCode,theMessage,theLongInt)       \
+{                                                                                                                                                                       \
+        if (theErrCode != noErr)                                                                                                                \
+        {                                                                                                                                                               \
+                SetErrorMessageAndAppendLongInt(theMessage,theLongInt);                                         \
+                errCode = theErrCode;                                                                                                           \
+                goto EXITPOINT;                                                                                                                         \
+        }                                                                                                                                                               \
+}
+
+
+#define SetErrorMessageCStrLongIntAndBailIfError(theErrCode,theMessage,theCStr,theLongInt)      \
+{                                                                                                                                                                       \
+        if (theErrCode != noErr)                                                                                                                \
+        {                                                                                                                                                               \
+                SetErrorMessageAndCStrAndLongInt(theMessage,theCStr,theLongInt);                        \
+                errCode = theErrCode;                                                                                                           \
+                goto EXITPOINT;                                                                                                                         \
+        }                                                                                                                                                               \
+}
+
+
+#define SetErrorMessageAndCStrAndBail(theMessage,theCStr)                                                       \
+{                                                                                                                                                                       \
+        SetErrorMessageAndCStr(theMessage,theCStr);                                                                             \
+        errCode = kGenericError;                                                                                                                \
+        goto EXITPOINT;                                                                                                                                 \
+}
+
+
+#define SetErrorMessageAndBailIfError(theErrCode,theMessage)                                            \
+{                                                                                                                                                                       \
+        if (theErrCode != noErr)                                                                                                                \
+        {                                                                                                                                                               \
+                SetErrorMessage(theMessage);                                                                                            \
+                errCode = theErrCode;                                                                                                           \
+                goto EXITPOINT;                                                                                                                         \
+        }                                                                                                                                                               \
+}
+
+
+#define SetErrorMessageAndLongIntAndBailIfNil(theArg,theMessage,theLongInt)                     \
+{                                                                                                                                                                       \
+        if (theArg == nil)                                                                                                                              \
+        {                                                                                                                                                               \
+                SetErrorMessageAndAppendLongInt(theMessage,theLongInt);                                         \
+                errCode = kGenericError;                                                                                                        \
+                goto EXITPOINT;                                                                                                                         \
+        }                                                                                                                                                               \
+}
+
+
+#define BailIfError(theErrCode)                                                                                                         \
+{                                                                                                                                                                       \
+        if ((theErrCode) != noErr)                                                                                                              \
+        {                                                                                                                                                               \
+                goto EXITPOINT;                                                                                                                         \
+        }                                                                                                                                                               \
+}
+
+
+#define SetErrCodeAndBail(theErrCode)                                                                                           \
+{                                                                                                                                                                       \
+        errCode = theErrCode;                                                                                                                   \
+                                                                                                                                                                        \
+        goto EXITPOINT;                                                                                                                                 \
+}
+
+
+#define SetErrorCodeAndMessageAndBail(theErrCode,theMessage)                                            \
+{                                                                                                                                                                       \
+        SetErrorMessage(theMessage);                                                                                                    \
+        errCode = theErrCode;                                                                                                                   \
+        goto EXITPOINT;                                                                                                                                 \
+}
+
+
+#define BailNow()                                                                                                                                       \
+{                                                                                                                                                                       \
+        errCode = kGenericError;                                                                                                                \
+        goto EXITPOINT;                                                                                                                                 \
+}
+
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/src/lib/libssl/src/MacOS/GetHTTPS.src/GetHTTPS.cpp b/src/lib/libssl/src/MacOS/GetHTTPS.src/GetHTTPS.cpp
new file mode 100644
index 0000000000..ed8e1cc962
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/GetHTTPS.src/GetHTTPS.cpp
@@ -0,0 +1,215 @@
+/*
+ *      An demo illustrating how to retrieve a URI from a secure HTTP server.
+ *
+ *      Author:         Roy Wood
+ *      Date:           September 7, 1999
+ *      Comments:       This relies heavily on my MacSockets library.
+ *                              This project is also set up so that it expects the OpenSSL source folder (0.9.4 as I write this)
+ *                              to live in a folder called "OpenSSL-0.9.4" in this project's parent folder.  For example:
+ *
+ *                                      Macintosh HD:
+ *                                              Development:
+ *                                                      OpenSSL-0.9.4:
+ *                                                              (OpenSSL sources here)
+ *                                                      OpenSSL Example:
+ *                                                              (OpenSSL example junk here)
+ *
+ *
+ *                              Also-- before attempting to compile this, make sure the aliases in "OpenSSL-0.9.4:include:openssl" 
+ *                              are installed!  Use the AppleScript applet in the "openssl-0.9.4" folder to do this!
+ */
+/* modified to seed the PRNG */
+
+
+//      Include some funky libs I've developed over time
+
+#include "CPStringUtils.hpp"
+#include "ErrorHandling.hpp"
+#include "MacSocket.h"
+
+
+//      We use the OpenSSL implementation of SSL....
+//      This was a lot of work to finally get going, though you wouldn't know it by the results!
+
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+
+#include <timer.h>
+
+//      Let's try grabbing some data from here:
+
+#define kHTTPS_DNS              "www.apache-ssl.org"
+#define kHTTPS_Port             443
+#define kHTTPS_URI              "/"
+
+
+//      Forward-declare this
+
+OSErr MyMacSocket_IdleWaitCallback(void *inUserRefPtr);
+
+
+
+
+
+//      My idle-wait callback.  Doesn't do much, does it?  Silly cooperative multitasking.
+
+OSErr MyMacSocket_IdleWaitCallback(void *inUserRefPtr)
+{
+#pragma unused(inUserRefPtr)
+
+EventRecord             theEvent;
+
+        ::EventAvail(everyEvent,&theEvent);
+
+        return(noErr);
+}
+
+
+
+//      Finally!
+
+void main(void)
+{
+OSErr                           errCode;
+int                                     theSocket = -1;
+int                                     theTimeout = 30;
+
+SSL_CTX                         *ssl_ctx = nil;
+SSL                                     *ssl = nil;
+
+char                            tempString[256];
+UnsignedWide            microTickCount;
+        
+#warning   -- USE A TRUE RANDOM SEED, AND ADD ENTROPY WHENEVER POSSIBLE. --
+const char seed[] = "uyq9,7-b(VHGT^%$&^F/,876;,;./lkJHGFUY{PO*";        // Just gobbledygook
+
+        printf("OpenSSL Demo by Roy Wood, roy@centricsystems.ca\n\n");
+        
+        BailIfError(errCode = MacSocket_Startup());
+
+
+
+        //      Create a socket-like object
+        
+        BailIfError(errCode = MacSocket_socket(&theSocket,false,theTimeout * 60,MyMacSocket_IdleWaitCallback,nil));
+
+        
+        //      Set up the connect string and try to connect
+        
+        CopyCStrAndInsertCStrLongIntIntoCStr("%s:%ld",kHTTPS_DNS,kHTTPS_Port,tempString,sizeof(tempString));
+        
+        printf("Connecting to %s....\n",tempString);
+
+        BailIfError(errCode = MacSocket_connect(theSocket,tempString));
+        
+        
+        //      Init SSL stuff
+        
+        SSL_load_error_strings();
+        
+        SSLeay_add_ssl_algorithms();
+        
+        
+        //      Pick the SSL method
+        
+//      ssl_ctx = SSL_CTX_new(SSLv2_client_method());
+        ssl_ctx = SSL_CTX_new(SSLv23_client_method());
+//      ssl_ctx = SSL_CTX_new(SSLv3_client_method());
+                        
+
+        RAND_seed (seed, sizeof (seed));
+        Microseconds (&microTickCount);
+        RAND_add (&microTickCount, sizeof (microTickCount), 0);         // Entropy is actually > 0, needs an estimate
+
+        //      Create an SSL thingey and try to negotiate the connection
+        
+        ssl = SSL_new(ssl_ctx);
+        
+        SSL_set_fd(ssl,theSocket);
+        
+        errCode = SSL_connect(ssl);
+        
+        if (errCode < 0)
+        {
+                SetErrorMessageAndLongIntAndBail("OpenSSL: Can't initiate SSL connection, SSL_connect() = ",errCode);
+        }
+        
+        //      Request the URI from the host
+        
+        CopyCStrToCStr("GET ",tempString,sizeof(tempString));
+        ConcatCStrToCStr(kHTTPS_URI,tempString,sizeof(tempString));
+        ConcatCStrToCStr(" HTTP/1.0\r\n\r\n",tempString,sizeof(tempString));
+
+        
+        errCode = SSL_write(ssl,tempString,CStrLength(tempString));
+        
+        if (errCode < 0)
+        {
+                SetErrorMessageAndLongIntAndBail("OpenSSL: Error writing data via ssl, SSL_write() = ",errCode);
+        }
+        
+
+        for (;;)
+        {
+        char    tempString[256];
+        int             bytesRead;
+                
+
+                //      Read some bytes and dump them to the console
+                
+                bytesRead = SSL_read(ssl,tempString,sizeof(tempString) - 1);
+                
+                if (bytesRead == 0 && MacSocket_RemoteEndIsClosing(theSocket))
+                {
+                        break;
+                }
+                
+                else if (bytesRead < 0)
+                {
+                        SetErrorMessageAndLongIntAndBail("OpenSSL: Error reading data via ssl, SSL_read() = ",bytesRead);
+                }
+                
+                
+                tempString[bytesRead] = '\0';
+                
+                printf(tempString);
+        }
+        
+        printf("\n\n\n");
+        
+        //      All done!
+        
+        errCode = noErr;
+        
+        
+EXITPOINT:
+
+        //      Clean up and go home
+        
+        if (theSocket >= 0)
+        {
+                MacSocket_close(theSocket);
+        }
+        
+        if (ssl != nil)
+        {
+                SSL_free(ssl);
+        }
+        
+        if (ssl_ctx != nil)
+        {
+                SSL_CTX_free(ssl_ctx);
+        }
+        
+        
+        if (errCode != noErr)
+        {
+                printf("An error occurred:\n");
+                
+                printf(GetErrorMessage());
+        }
+        
+        
+        MacSocket_Shutdown();
+}
diff --git a/src/lib/libssl/src/MacOS/GetHTTPS.src/MacSocket.cpp b/src/lib/libssl/src/MacOS/GetHTTPS.src/MacSocket.cpp
new file mode 100644
index 0000000000..aaf2a68ca9
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/GetHTTPS.src/MacSocket.cpp
@@ -0,0 +1,1607 @@
+/*
+ *      A simple socket-like package.  
+ *      This could undoubtedly be improved, since it does polling and busy-waiting.  
+ *      At least it uses asynch I/O and implements timeouts!
+ *
+ *      Other funkiness includes the use of my own (possibly brain-damaged) error-handling infrastructure.
+ *
+ *      -Roy Wood (roy@centricsystems.ca)
+ *
+ */
+
+
+/* ====================================================================
+ * Copyright (c) 1998-1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+ 
+
+
+
+
+#include "MacSocket.h"
+
+#include <Threads.h>
+
+#include <OpenTransport.h>
+#include <OpenTpTInternet.h>
+#include <OpenTptClient.h>
+
+
+
+#include "CPStringUtils.hpp"
+#include "ErrorHandling.hpp"
+
+
+//      #define MACSOCKET_DEBUG         1
+
+#ifdef MACSOCKET_DEBUG
+        #include <stdio.h>
+#endif
+
+
+
+extern int errno;
+
+
+#define kMaxNumSockets                  4
+
+
+struct SocketStruct
+{
+        Boolean                                         mIsInUse;
+
+        Boolean                                         mEndpointIsBound;
+
+        Boolean                                         mLocalEndIsConnected;
+        Boolean                                         mRemoteEndIsConnected;
+
+        Boolean                                         mReceivedTOpenComplete;
+        Boolean                                         mReceivedTBindComplete;
+        Boolean                                         mReceivedTConnect;
+        Boolean                                         mReceivedTListen;
+        Boolean                                         mReceivedTPassCon;
+        Boolean                                         mReceivedTDisconnect;
+        Boolean                                         mReceivedTOrdRel;
+        Boolean                                         mReceivedTDisconnectComplete;
+        
+        long                                            mTimeoutTicks;
+        long                                            mOperationStartTicks;
+        
+        MacSocket_IdleWaitCallback      mIdleWaitCallback;
+        void                                            *mUserRefPtr;
+        
+        OTEventCode                                     mExpectedCode;
+        OTResult                                        mAsyncOperationResult;
+        
+        EndpointRef                                     mEndPointRef;
+        TBind                                           *mBindRequestedAddrInfo;
+        TBind                                           *mAssignedAddrInfo;
+        TCall                                           *mRemoteAddrInfo;
+        
+        Boolean                                         mReadyToReadData;
+        Boolean                                         mReadyToWriteData;
+        
+        Ptr                                                     mReadBuffer;
+        Ptr                                                     mWriteBuffer;
+        
+        int                                                     mLastError;
+        char                                            mErrMessage[256];
+};
+
+typedef struct SocketStruct     SocketStruct;
+
+
+static SocketStruct                     sSockets[kMaxNumSockets];
+static Boolean                          sSocketsSetup = false;
+
+
+
+
+static OSErr MyBusyWait(SocketStruct *ioSocket,Boolean returnImmediatelyOnError,OTResult *outOTResult,Boolean *inAsyncOperationCompleteFlag);
+
+static pascal void OTNonYieldingNotifier(void *contextPtr,OTEventCode code,OTResult result,void *cookie);
+
+static Boolean  SocketIndexIsValid(const int inSocketNum);
+
+static void InitSocket(SocketStruct *ioSocket);
+
+static void PrepareForAsyncOperation(SocketStruct *ioSocket,const OTEventCode inExpectedCode);
+
+static Boolean TimeoutElapsed(const SocketStruct *inSocket);
+
+static OSStatus NegotiateIPReuseAddrOption(EndpointRef inEndpoint,const Boolean inEnableReuseIP);
+
+
+
+void MacSocket_GetSocketErrorInfo(const int inSocketNum,int *outSocketErrCode,char *outSocketErrString,const int inSocketErrStringMaxLength)
+{
+        if (outSocketErrCode != nil)
+        {
+                *outSocketErrCode = -1;
+        }
+        
+        if (outSocketErrString != nil)
+        {
+                CopyCStrToCStr("",outSocketErrString,inSocketErrStringMaxLength);
+        }
+        
+        
+        if (SocketIndexIsValid(inSocketNum))
+        {
+        SocketStruct    *theSocketStruct = &(sSockets[inSocketNum]);
+        
+                
+                if (outSocketErrCode != nil)
+                {
+                        *outSocketErrCode = theSocketStruct->mLastError;
+                }
+
+                if (outSocketErrString != nil)
+                {
+                        CopyCStrToCStr(theSocketStruct->mErrMessage,outSocketErrString,inSocketErrStringMaxLength);
+                }
+        }
+}
+
+
+void MacSocket_SetUserRefPtr(const int inSocketNum,void *inNewRefPtr)
+{
+        if (SocketIndexIsValid(inSocketNum))
+        {
+        SocketStruct    *theSocketStruct = &(sSockets[inSocketNum]);
+
+                theSocketStruct->mUserRefPtr = inNewRefPtr;
+        }
+}
+
+
+
+void MacSocket_GetLocalIPAndPort(const int inSocketNum,char *outIPAndPort,const int inIPAndPortLength)
+{
+        if (outIPAndPort != nil && SocketIndexIsValid(inSocketNum))
+        {
+        char                    tempString[256];
+        SocketStruct    *theSocketStruct = &(sSockets[inSocketNum]);
+        
+                
+                CopyCStrToCStr("",tempString,sizeof(tempString));
+
+                if (theSocketStruct->mAssignedAddrInfo != nil)
+                {
+                InetAddress             *theInetAddress = (InetAddress *) theSocketStruct->mAssignedAddrInfo->addr.buf;
+                InetHost                theInetHost = theInetAddress->fHost;
+                        
+                        if (theInetHost == 0)
+                        {
+                        InetInterfaceInfo       theInetInterfaceInfo;
+                                
+                                if (::OTInetGetInterfaceInfo(&theInetInterfaceInfo,kDefaultInetInterface) == noErr)
+                                {
+                                        theInetHost = theInetInterfaceInfo.fAddress;
+                                }
+                        }
+                
+                        ::OTInetHostToString(theInetHost,tempString);
+                        
+                        ConcatCStrToCStr(":",tempString,sizeof(tempString));
+                        ConcatLongIntToCStr(theInetAddress->fPort,tempString,sizeof(tempString));
+                }
+                
+                CopyCStrToCStr(tempString,outIPAndPort,inIPAndPortLength);
+        }
+}
+
+
+
+void MacSocket_GetRemoteIPAndPort(const int inSocketNum,char *outIPAndPort,const int inIPAndPortLength)
+{
+        if (outIPAndPort != nil && SocketIndexIsValid(inSocketNum))
+        {
+        char                    tempString[256];
+        SocketStruct    *theSocketStruct = &(sSockets[inSocketNum]);
+        
+                
+                CopyCStrToCStr("",tempString,sizeof(tempString));
+
+                if (theSocketStruct->mRemoteAddrInfo != nil)
+                {
+                InetAddress             *theInetAddress = (InetAddress *) theSocketStruct->mRemoteAddrInfo->addr.buf;
+                InetHost                theInetHost = theInetAddress->fHost;
+                        
+                        if (theInetHost == 0)
+                        {
+                        InetInterfaceInfo       theInetInterfaceInfo;
+                                
+                                if (::OTInetGetInterfaceInfo(&theInetInterfaceInfo,kDefaultInetInterface) == noErr)
+                                {
+                                        theInetHost = theInetInterfaceInfo.fAddress;
+                                }
+                        }
+                
+                        ::OTInetHostToString(theInetHost,tempString);
+                        
+                        ConcatCStrToCStr(":",tempString,sizeof(tempString));
+                        ConcatLongIntToCStr(theInetAddress->fPort,tempString,sizeof(tempString));
+                }
+                
+                CopyCStrToCStr(tempString,outIPAndPort,inIPAndPortLength);
+        }
+}
+
+
+
+Boolean MacSocket_RemoteEndIsClosing(const int inSocketNum)
+{
+Boolean         theResult = false;
+
+        if (SocketIndexIsValid(inSocketNum))
+        {
+        SocketStruct    *theSocketStruct = &(sSockets[inSocketNum]);
+
+                theResult = theSocketStruct->mReceivedTOrdRel;
+        }
+
+        return(theResult);
+}
+
+
+
+Boolean MacSocket_ListenCompleted(const int inSocketNum)
+{
+Boolean         theResult = false;
+
+        if (SocketIndexIsValid(inSocketNum))
+        {
+        SocketStruct    *theSocketStruct = &(sSockets[inSocketNum]);
+
+                theResult = theSocketStruct->mReceivedTPassCon;
+        }
+
+        return(theResult);
+}
+
+
+
+Boolean MacSocket_RemoteEndIsOpen(const int inSocketNum)
+{
+        if (SocketIndexIsValid(inSocketNum))
+        {
+        SocketStruct    *theSocketStruct = &(sSockets[inSocketNum]);
+        
+                return(theSocketStruct->mRemoteEndIsConnected);
+        }
+        
+        else
+        {
+                return(false);
+        }
+}
+
+
+
+Boolean MacSocket_LocalEndIsOpen(const int inSocketNum)
+{
+        if (SocketIndexIsValid(inSocketNum))
+        {
+        SocketStruct    *theSocketStruct = &(sSockets[inSocketNum]);
+        
+                return(theSocketStruct->mLocalEndIsConnected);
+        }
+        
+        else
+        {
+                return(false);
+        }
+}
+
+
+
+static Boolean TimeoutElapsed(const SocketStruct *inSocket)
+{
+Boolean         timeIsUp = false;
+
+        if (inSocket != nil && inSocket->mTimeoutTicks > 0 && ::TickCount() > inSocket->mOperationStartTicks + inSocket->mTimeoutTicks)
+        {
+                timeIsUp = true;
+        }
+        
+        
+        return(timeIsUp);
+}
+
+
+
+static Boolean SocketIndexIsValid(const int inSocketNum)
+{
+        if (inSocketNum >= 0 && inSocketNum < kMaxNumSockets && sSockets[inSocketNum].mEndPointRef != kOTInvalidEndpointRef)
+        {
+                return(true);
+        }
+        
+        else
+        {
+                return(false);
+        }
+}
+
+
+
+static void InitSocket(SocketStruct *ioSocket)
+{
+        ioSocket->mIsInUse = false;
+        
+        ioSocket->mEndpointIsBound = false;
+        
+        ioSocket->mLocalEndIsConnected = false;
+        ioSocket->mRemoteEndIsConnected = false;
+        
+        ioSocket->mReceivedTOpenComplete = false;
+        ioSocket->mReceivedTBindComplete = false;
+        ioSocket->mReceivedTConnect = false;
+        ioSocket->mReceivedTListen = false;
+        ioSocket->mReceivedTPassCon = false;
+        ioSocket->mReceivedTDisconnect = false;
+        ioSocket->mReceivedTOrdRel = false;
+        ioSocket->mReceivedTDisconnectComplete = false;
+        
+        ioSocket->mTimeoutTicks = 30 * 60;
+        ioSocket->mOperationStartTicks = -1;
+        
+        ioSocket->mIdleWaitCallback = nil;
+        ioSocket->mUserRefPtr = nil;
+        
+        ioSocket->mExpectedCode = 0;
+        ioSocket->mAsyncOperationResult = noErr;
+        
+        ioSocket->mEndPointRef = kOTInvalidEndpointRef;
+        
+        ioSocket->mBindRequestedAddrInfo = nil;
+        ioSocket->mAssignedAddrInfo = nil;
+        ioSocket->mRemoteAddrInfo = nil;
+        
+        ioSocket->mReadyToReadData = false;
+        ioSocket->mReadyToWriteData = true;
+        
+        ioSocket->mReadBuffer = nil;
+        ioSocket->mWriteBuffer = nil;
+
+        ioSocket->mLastError = noErr;
+        CopyCStrToCStr("",ioSocket->mErrMessage,sizeof(ioSocket->mErrMessage));
+}
+
+
+
+static void PrepareForAsyncOperation(SocketStruct *ioSocket,const OTEventCode inExpectedCode)
+{
+        ioSocket->mOperationStartTicks = ::TickCount();
+        
+        ioSocket->mAsyncOperationResult = noErr;
+        
+        ioSocket->mExpectedCode = inExpectedCode;
+}
+
+
+//      The wait function....
+
+static OSErr MyBusyWait(SocketStruct *ioSocket,Boolean returnImmediatelyOnError,OTResult *outOTResult,Boolean *inAsyncOperationCompleteFlag)
+{
+OSErr           errCode = noErr;
+OTResult        theOTResult = noErr;
+
+        
+        SetErrorMessageAndBailIfNil(ioSocket,"MyBusyWait: Bad parameter, ioSocket = nil");
+        SetErrorMessageAndBailIfNil(inAsyncOperationCompleteFlag,"MyBusyWait: Bad parameter, inAsyncOperationCompleteFlag = nil");
+        
+        for (;;) 
+        {
+                if (*inAsyncOperationCompleteFlag)
+                {
+                        theOTResult = ioSocket->mAsyncOperationResult;
+                        
+                        break;
+                }
+                
+                if (ioSocket->mIdleWaitCallback != nil)
+                {
+                        theOTResult = (*(ioSocket->mIdleWaitCallback))(ioSocket->mUserRefPtr);
+                        
+                        if (theOTResult != noErr && returnImmediatelyOnError)
+                        {
+                                break;
+                        }
+                }
+                
+                if (TimeoutElapsed(ioSocket))
+                {
+                        theOTResult = kMacSocket_TimeoutErr;
+                        
+                        break;
+                }
+        }
+
+
+EXITPOINT:
+        
+        if (outOTResult != nil)
+        {
+                *outOTResult = theOTResult;
+        }
+        
+        return(errCode);
+}
+
+
+
+//      I used to do thread switching, but stopped.  It could easily be rolled back in though....
+
+static pascal void OTNonYieldingNotifier(void *contextPtr,OTEventCode code,OTResult result,void *cookie)
+{
+SocketStruct *theSocketStruct = (SocketStruct *) contextPtr;
+        
+        if (theSocketStruct != nil)
+        {
+                if (theSocketStruct->mExpectedCode != 0 && code == theSocketStruct->mExpectedCode)
+                {
+                        theSocketStruct->mAsyncOperationResult = result;
+                        
+                        theSocketStruct->mExpectedCode = 0;
+                }
+                
+                
+                switch (code) 
+                {
+                        case T_OPENCOMPLETE:
+                        {
+                                theSocketStruct->mReceivedTOpenComplete = true;
+                                
+                                theSocketStruct->mEndPointRef = (EndpointRef) cookie;
+                                
+                                break;
+                        }
+
+                        
+                        case T_BINDCOMPLETE:
+                        {
+                                theSocketStruct->mReceivedTBindComplete = true;
+                                
+                                break;
+                        }
+                        
+
+                        case T_CONNECT:
+                        {
+                                theSocketStruct->mReceivedTConnect = true;
+
+                                theSocketStruct->mLocalEndIsConnected = true;
+                                
+                                theSocketStruct->mRemoteEndIsConnected = true;
+
+                                break;
+                        }
+                        
+
+                        case T_LISTEN:
+                        {
+                                theSocketStruct->mReceivedTListen = true;
+                                
+                                break;
+                        }
+                        
+
+                        case T_PASSCON:
+                        {
+                                theSocketStruct->mReceivedTPassCon = true;
+                                
+                                theSocketStruct->mLocalEndIsConnected = true;
+                                
+                                theSocketStruct->mRemoteEndIsConnected = true;
+
+                                break;
+                        }
+
+
+                        case T_DATA:
+                        {
+                                theSocketStruct->mReadyToReadData = true;
+                                
+                                break;
+                        }
+                        
+                        case T_GODATA:
+                        {
+                                theSocketStruct->mReadyToWriteData = true;
+                                
+                                break;
+                        }
+                        
+                        case T_DISCONNECT:
+                        {
+                                theSocketStruct->mReceivedTDisconnect = true;
+                                
+                                theSocketStruct->mRemoteEndIsConnected = false;
+                                
+                                theSocketStruct->mLocalEndIsConnected = false;
+                                
+                                ::OTRcvDisconnect(theSocketStruct->mEndPointRef,nil);
+                                
+                                break;
+                        }
+
+                        case T_ORDREL:
+                        {
+                                theSocketStruct->mReceivedTOrdRel = true;
+                                
+                                //      We can still write data, so don't clear mRemoteEndIsConnected
+                                
+                                ::OTRcvOrderlyDisconnect(theSocketStruct->mEndPointRef);
+                                
+                                break;
+                        }
+                        
+                        case T_DISCONNECTCOMPLETE:
+                        {
+                                theSocketStruct->mReceivedTDisconnectComplete = true;
+                                
+                                theSocketStruct->mRemoteEndIsConnected = false;
+                                
+                                theSocketStruct->mLocalEndIsConnected = false;
+                                
+                                break;
+                        }
+                }
+        }
+/*
+T_LISTEN OTListen
+T_CONNECT OTRcvConnect
+T_DATA OTRcv, OTRcvUData
+T_DISCONNECT OTRcvDisconnect
+T_ORDREL OTRcvOrderlyDisconnect
+T_GODATA OTSnd, OTSndUData, OTLook
+T_PASSCON none
+
+T_EXDATA OTRcv
+T_GOEXDATA OTSnd, OTLook
+T_UDERR OTRcvUDErr
+*/
+}
+
+
+
+//      Initialize the main socket data structure
+
+OSErr MacSocket_Startup(void)
+{
+        if (!sSocketsSetup)
+        {
+                for (int i = 0;i < kMaxNumSockets;i++)
+                {
+                        InitSocket(&(sSockets[i]));
+                }
+
+                ::InitOpenTransport();
+                
+                sSocketsSetup = true;
+        }
+        
+        
+        return(noErr);
+}
+
+
+
+//      Cleanup before exiting
+
+OSErr MacSocket_Shutdown(void)
+{
+        if (sSocketsSetup)
+        {
+                for (int i = 0;i < kMaxNumSockets;i++)
+                {
+                SocketStruct *theSocketStruct = &(sSockets[i]);
+                
+                        if (theSocketStruct->mIsInUse)
+                        {
+                                if (theSocketStruct->mEndPointRef != kOTInvalidEndpointRef)
+                                {
+                                OTResult        theOTResult;
+                                
+                                
+                                        //      Since we're killing the endpoint, I don't bother to send the disconnect (sorry!)
+
+/*
+                                        if (theSocketStruct->mLocalEndIsConnected)
+                                        {
+                                                //      This is an abortive action, so we do a hard disconnect instead of an OTSndOrderlyDisconnect
+                                                
+                                                theOTResult = ::OTSndDisconnect(theSocketStruct->mEndPointRef, nil);
+                                                
+                                                //      Now we have to watch for T_DISCONNECTCOMPLETE event
+                                                
+                                                theSocketStruct->mLocalEndIsConnected = false;
+                                        }
+*/                                      
+                                        
+                                        theOTResult = ::OTCloseProvider(theSocketStruct->mEndPointRef);
+                                        
+                                        
+                                        theSocketStruct->mEndPointRef = kOTInvalidEndpointRef;
+                                }
+                                
+                                if (theSocketStruct->mBindRequestedAddrInfo != nil)
+                                {
+                                        ::OTFree((void *) theSocketStruct->mBindRequestedAddrInfo,T_BIND);
+                                        
+                                        theSocketStruct->mBindRequestedAddrInfo = nil;
+                                }
+                                
+                                if (theSocketStruct->mAssignedAddrInfo != nil)
+                                {
+                                        ::OTFree((void *) theSocketStruct->mAssignedAddrInfo,T_BIND);
+                                        
+                                        theSocketStruct->mAssignedAddrInfo = nil;
+                                }
+                                
+                                if (theSocketStruct->mRemoteAddrInfo != nil)
+                                {
+                                        ::OTFree((void *) theSocketStruct->mRemoteAddrInfo,T_CALL);
+                                        
+                                        theSocketStruct->mRemoteAddrInfo = nil;
+                                }
+                                
+                                
+                        }
+                }
+                
+                ::CloseOpenTransport();
+
+                sSocketsSetup = false;
+        }
+        
+        return(noErr);
+}
+
+
+
+
+
+
+//      Allocate a socket
+
+OSErr MacSocket_socket(int *outSocketNum,const Boolean inDoThreadSwitching,const long inTimeoutTicks,MacSocket_IdleWaitCallback inIdleWaitCallback,void *inUserRefPtr)
+{
+//      Gotta roll support back in for threads eventually.....
+
+#pragma unused(inDoThreadSwitching)
+
+
+OSErr   errCode = noErr;
+
+        
+        SetErrorMessageAndBailIfNil(outSocketNum,"MacSocket_socket: Bad parameter, outSocketNum == nil");
+        
+        *outSocketNum = -1;
+        
+        
+        //      Find an unused socket
+        
+        for (int i = 0;i < kMaxNumSockets;i++)
+        {
+                if (sSockets[i].mIsInUse == false)
+                {
+                OTResult                theOTResult;
+                SocketStruct    *theSocketStruct = &(sSockets[i]);
+                
+                        
+                        InitSocket(theSocketStruct);
+                        
+                        theSocketStruct->mIdleWaitCallback = inIdleWaitCallback;
+                        theSocketStruct->mUserRefPtr = inUserRefPtr;
+                        
+                        theSocketStruct->mTimeoutTicks = inTimeoutTicks;
+                        
+
+                        //      Set up OT endpoint
+                        
+                        PrepareForAsyncOperation(theSocketStruct,T_OPENCOMPLETE);
+                        
+                        theOTResult = ::OTAsyncOpenEndpoint(OTCreateConfiguration(kTCPName),0,nil,OTNonYieldingNotifier,(void *) theSocketStruct);
+                        
+                        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_socket: Can't create OT endpoint, OTAsyncOpenEndpoint() = ",theOTResult);
+                        
+                        BailIfError(MyBusyWait(theSocketStruct,false,&theOTResult,&(theSocketStruct->mReceivedTOpenComplete)));
+                                                                                                                                                                                
+                        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_socket: Can't create OT endpoint, OTAsyncOpenEndpoint() = ",theOTResult);
+                        
+                        
+                        *outSocketNum = i;
+                        
+                        errCode = noErr;
+                        
+                        theSocketStruct->mIsInUse = true;
+                        
+                        break;
+                }
+                
+                else if (i == kMaxNumSockets - 1)
+                {
+                        SetErrorMessageAndBail("MacSocket_socket: No sockets available");
+                }
+        }
+
+
+EXITPOINT:
+        
+        errno = errCode;
+        
+        return(errCode);
+}
+
+
+
+
+OSErr MacSocket_listen(const int inSocketNum,const int inPortNum)
+{
+OSErr                   errCode = noErr;
+SocketStruct    *theSocketStruct = nil;
+
+
+        if (!SocketIndexIsValid(inSocketNum))
+        {
+                SetErrorMessageAndBail("MacSocket_listen: Invalid socket number specified");
+        }
+
+
+        theSocketStruct = &(sSockets[inSocketNum]);
+
+
+OTResult                theOTResult;
+        
+        
+        if (theSocketStruct->mBindRequestedAddrInfo == nil)
+        {
+                theSocketStruct->mBindRequestedAddrInfo = (TBind *) ::OTAlloc(theSocketStruct->mEndPointRef,T_BIND,T_ADDR,&theOTResult);
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't allocate OT T_BIND structure, OTAlloc() = ",theOTResult);
+                SetErrorMessageAndBailIfNil(theSocketStruct->mBindRequestedAddrInfo,"MacSocket_listen: Can't allocate OT T_BIND structure, OTAlloc() returned nil");
+        }
+        
+        if (theSocketStruct->mAssignedAddrInfo == nil)
+        {
+                theSocketStruct->mAssignedAddrInfo = (TBind *) ::OTAlloc(theSocketStruct->mEndPointRef,T_BIND,T_ADDR,&theOTResult);
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't allocate OT T_BIND structure, OTAlloc() = ",theOTResult);
+                SetErrorMessageAndBailIfNil(theSocketStruct->mAssignedAddrInfo,"MacSocket_listen: Can't allocate OT T_BIND structure, OTAlloc() returned nil");
+        }
+        
+        if (theSocketStruct->mRemoteAddrInfo == nil)
+        {
+                theSocketStruct->mRemoteAddrInfo = (TCall *) ::OTAlloc(theSocketStruct->mEndPointRef,T_CALL,T_ADDR,&theOTResult);
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't allocate OT T_CALL structure, OTAlloc() = ",theOTResult);
+                SetErrorMessageAndBailIfNil(theSocketStruct->mRemoteAddrInfo,"MacSocket_listen: Can't allocate OT T_CALL structure, OTAlloc() returned nil");
+        }
+        
+
+        if (!theSocketStruct->mEndpointIsBound)
+        {
+        InetInterfaceInfo       theInetInterfaceInfo;
+                
+                theOTResult = ::OTInetGetInterfaceInfo(&theInetInterfaceInfo,kDefaultInetInterface);
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't determine OT interface info, OTInetGetInterfaceInfo() = ",theOTResult);
+
+
+        InetAddress     *theInetAddress = (InetAddress *) theSocketStruct->mBindRequestedAddrInfo->addr.buf;
+                
+//              theInetAddress->fAddressType = AF_INET;
+//              theInetAddress->fPort = inPortNum;
+//              theInetAddress->fHost = theInetInterfaceInfo.fAddress;
+                
+                ::OTInitInetAddress(theInetAddress,inPortNum,theInetInterfaceInfo.fAddress);
+
+                theSocketStruct->mBindRequestedAddrInfo->addr.len = sizeof(InetAddress);
+                
+                theSocketStruct->mBindRequestedAddrInfo->qlen = 1;
+                
+                
+                theOTResult = ::OTSetSynchronous(theSocketStruct->mEndPointRef);
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't set OT endpoint mode, OTSetSynchronous() = ",theOTResult);
+                
+                theOTResult = NegotiateIPReuseAddrOption(theSocketStruct->mEndPointRef,true);
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't set OT IP address reuse flag, NegotiateIPReuseAddrOption() = ",theOTResult);
+                
+                theOTResult = ::OTSetAsynchronous(theSocketStruct->mEndPointRef);
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't set OT endpoint mode, OTSetAsynchronous() = ",theOTResult);
+
+                
+                PrepareForAsyncOperation(theSocketStruct,T_BINDCOMPLETE);
+                                
+                theOTResult = ::OTBind(theSocketStruct->mEndPointRef,theSocketStruct->mBindRequestedAddrInfo,theSocketStruct->mAssignedAddrInfo);
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't bind OT endpoint, OTBind() = ",theOTResult);
+                
+                BailIfError(MyBusyWait(theSocketStruct,false,&theOTResult,&(theSocketStruct->mReceivedTBindComplete)));
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't bind OT endpoint, OTBind() = ",theOTResult);
+                
+                
+                theSocketStruct->mEndpointIsBound = true;
+        }
+
+
+        PrepareForAsyncOperation(theSocketStruct,T_LISTEN);
+
+        theOTResult = ::OTListen(theSocketStruct->mEndPointRef,theSocketStruct->mRemoteAddrInfo);
+        
+        if (theOTResult == noErr)
+        {
+                PrepareForAsyncOperation(theSocketStruct,T_PASSCON);
+                
+                theOTResult = ::OTAccept(theSocketStruct->mEndPointRef,theSocketStruct->mEndPointRef,theSocketStruct->mRemoteAddrInfo);
+                
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't begin OT accept, OTAccept() = ",theOTResult);
+                
+                BailIfError(MyBusyWait(theSocketStruct,false,&theOTResult,&(theSocketStruct->mReceivedTPassCon)));
+                                                                                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_listen: Can't accept OT connection, OTAccept() = ",theOTResult);
+        }
+        
+        else if (theOTResult == kOTNoDataErr)
+        {
+                theOTResult = noErr;
+        }
+        
+        else
+        {
+                SetErrorMessageAndLongIntAndBail("MacSocket_listen: Can't begin OT listen, OTListen() = ",theOTResult);
+        }
+
+
+        errCode = noErr;
+
+
+EXITPOINT:
+        
+        if (theSocketStruct != nil)
+        {
+                theSocketStruct->mLastError = noErr;
+                
+                CopyCStrToCStr("",theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+
+                if (errCode != noErr)
+                {
+                        theSocketStruct->mLastError = errCode;
+                        
+                        CopyCStrToCStr(GetErrorMessage(),theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+                }
+        }
+        
+        errno = errCode;
+        
+        return(errCode);
+}
+
+
+
+
+OSErr MacSocket_connect(const int inSocketNum,char *inTargetAddressAndPort)
+{
+OSErr                   errCode = noErr;
+SocketStruct    *theSocketStruct = nil;
+
+
+        if (!SocketIndexIsValid(inSocketNum))
+        {
+                SetErrorMessageAndBail("MacSocket_connect: Invalid socket number specified");
+        }
+
+        theSocketStruct = &(sSockets[inSocketNum]);
+
+        if (theSocketStruct->mEndpointIsBound)
+        {
+                SetErrorMessageAndBail("MacSocket_connect: Socket previously bound");
+        }
+
+        
+OTResult                theOTResult;
+
+        theSocketStruct->mBindRequestedAddrInfo = (TBind *) ::OTAlloc(theSocketStruct->mEndPointRef,T_BIND,T_ADDR,&theOTResult);
+                                                                                                                                                                
+        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_connect: Can't allocate OT T_BIND structure, OTAlloc() = ",theOTResult);
+        SetErrorMessageAndBailIfNil(theSocketStruct->mBindRequestedAddrInfo,"MacSocket_connect: Can't allocate OT T_BIND structure, OTAlloc() returned nil");
+        
+
+        theSocketStruct->mAssignedAddrInfo = (TBind *) ::OTAlloc(theSocketStruct->mEndPointRef,T_BIND,T_ADDR,&theOTResult);
+                                                                                                                                                                
+        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_connect: Can't allocate OT T_BIND structure, OTAlloc() = ",theOTResult);
+        SetErrorMessageAndBailIfNil(theSocketStruct->mAssignedAddrInfo,"MacSocket_connect: Can't allocate OT T_BIND structure, OTAlloc() returned nil");
+
+
+        theSocketStruct->mRemoteAddrInfo = (TCall *) ::OTAlloc(theSocketStruct->mEndPointRef,T_CALL,T_ADDR,&theOTResult);
+                                                                                                                                                                
+        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_connect: Can't allocate OT T_CALL structure, OTAlloc() = ",theOTResult);
+        SetErrorMessageAndBailIfNil(theSocketStruct->mRemoteAddrInfo,"MacSocket_connect: Can't allocate OT T_CALL structure, OTAlloc() returned nil");
+
+        
+        PrepareForAsyncOperation(theSocketStruct,T_BINDCOMPLETE);
+
+        theOTResult = ::OTBind(theSocketStruct->mEndPointRef,nil,theSocketStruct->mAssignedAddrInfo);
+                                                                                                                                                                
+        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_connect: Can't bind OT endpoint, OTBind() = ",theOTResult);
+        
+        BailIfError(MyBusyWait(theSocketStruct,false,&theOTResult,&(theSocketStruct->mReceivedTBindComplete)));
+                                                                                                                                                                
+        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_connect: Can't bind OT endpoint, OTBind() = ",theOTResult);
+        
+        theSocketStruct->mEndpointIsBound = true;
+        
+
+TCall           sndCall;
+DNSAddress      hostDNSAddress;
+        
+        //      Set up target address
+        
+        sndCall.addr.buf = (UInt8 *) &hostDNSAddress;
+        sndCall.addr.len = ::OTInitDNSAddress(&hostDNSAddress,inTargetAddressAndPort);
+        sndCall.opt.buf = nil;
+        sndCall.opt.len = 0;
+        sndCall.udata.buf = nil;
+        sndCall.udata.len = 0;
+        sndCall.sequence = 0;
+                
+        //      Connect!
+        
+        PrepareForAsyncOperation(theSocketStruct,T_CONNECT);
+
+        theOTResult = ::OTConnect(theSocketStruct->mEndPointRef,&sndCall,nil);
+        
+        if (theOTResult == kOTNoDataErr)
+        {
+                theOTResult = noErr;
+        }
+                                                                                                
+        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_connect: Can't connect OT endpoint, OTConnect() = ",theOTResult);
+        
+        BailIfError(MyBusyWait(theSocketStruct,false,&theOTResult,&(theSocketStruct->mReceivedTConnect)));
+        
+        if (theOTResult == kMacSocket_TimeoutErr)
+        {
+                SetErrorMessageAndBail("MacSocket_connect: Can't connect OT endpoint, OTConnect() = kMacSocket_TimeoutErr");
+        }
+        
+        else
+        {
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_connect: Can't connect OT endpoint, OTConnect() = ",theOTResult);
+        }
+
+        theOTResult = ::OTRcvConnect(theSocketStruct->mEndPointRef,nil);
+                                                                                                
+        SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_connect: Can't complete connect on OT endpoint, OTRcvConnect() = ",theOTResult);
+
+
+        errCode = noErr;
+
+
+#ifdef MACSOCKET_DEBUG
+        printf("MacSocket_connect: connect completed\n");
+#endif
+
+EXITPOINT:
+        
+        if (theSocketStruct != nil)
+        {
+                theSocketStruct->mLastError = noErr;
+                
+                CopyCStrToCStr("",theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+
+                if (errCode != noErr)
+                {
+                        theSocketStruct->mLastError = errCode;
+                        
+                        CopyCStrToCStr(GetErrorMessage(),theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+                }
+        }
+        
+        errno = errCode;
+        
+        return(errCode);
+}
+
+
+
+
+//      Close a connection
+
+OSErr MacSocket_close(const int inSocketNum)
+{
+OSErr                   errCode = noErr;
+SocketStruct    *theSocketStruct = nil;
+
+
+        if (!SocketIndexIsValid(inSocketNum))
+        {
+                SetErrorMessageAndBail("MacSocket_close: Invalid socket number specified");
+        }
+
+
+        theSocketStruct = &(sSockets[inSocketNum]);
+        
+        if (theSocketStruct->mEndPointRef != kOTInvalidEndpointRef)
+        {
+        OTResult                theOTResult = noErr;
+        
+                //      Try to play nice
+                
+                if (theSocketStruct->mReceivedTOrdRel)
+                {
+                        //      Already did an OTRcvOrderlyDisconnect() in the notifier
+                
+                        if (theSocketStruct->mLocalEndIsConnected)
+                        {
+                                theOTResult = ::OTSndOrderlyDisconnect(theSocketStruct->mEndPointRef);
+                                
+                                theSocketStruct->mLocalEndIsConnected = false;
+                        }
+                }
+                
+                else if (theSocketStruct->mLocalEndIsConnected)
+                {
+                        theOTResult = ::OTSndOrderlyDisconnect(theSocketStruct->mEndPointRef);
+                        
+                        theSocketStruct->mLocalEndIsConnected = false;
+                        
+                        //      Wait for other end to hang up too!
+                        
+//                      PrepareForAsyncOperation(theSocketStruct,T_ORDREL);
+//
+//                      errCode = MyBusyWait(theSocketStruct,false,&theOTResult,&(theSocketStruct->mReceivedTOrdRel));
+                }
+                
+                
+                if (theOTResult != noErr)
+                {
+                        ::OTCloseProvider(theSocketStruct->mEndPointRef);
+                }
+                
+                else
+                {
+                        theOTResult = ::OTCloseProvider(theSocketStruct->mEndPointRef);
+                }
+
+                theSocketStruct->mEndPointRef = kOTInvalidEndpointRef;
+                
+                errCode = theOTResult;
+        }
+
+
+        theSocketStruct->mIsInUse = false;
+
+        
+EXITPOINT:
+        
+        if (theSocketStruct != nil)
+        {
+                theSocketStruct->mLastError = noErr;
+                
+                CopyCStrToCStr("",theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+
+                if (errCode != noErr)
+                {
+                        theSocketStruct->mLastError = errCode;
+                        
+                        CopyCStrToCStr(GetErrorMessage(),theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+                }
+        }
+
+        errno = errCode;
+                
+        return(errCode);
+}
+
+
+
+
+//      Receive some bytes
+
+int MacSocket_recv(const int inSocketNum,void *outBuff,int outBuffLength,const Boolean inBlock)
+{
+OSErr                   errCode = noErr;
+int                             totalBytesRead = 0;
+SocketStruct    *theSocketStruct = nil;
+
+        
+        SetErrorMessageAndBailIfNil(outBuff,"MacSocket_recv: Bad parameter, outBuff = nil");
+        
+        if (outBuffLength <= 0)
+        {
+                SetErrorMessageAndBail("MacSocket_recv: Bad parameter, outBuffLength <= 0");
+        }
+        
+        if (!SocketIndexIsValid(inSocketNum))
+        {
+                SetErrorMessageAndBail("MacSocket_recv: Invalid socket number specified");
+        }
+
+        theSocketStruct = &(sSockets[inSocketNum]);
+
+        if (!theSocketStruct->mLocalEndIsConnected)
+        {
+                SetErrorMessageAndBail("MacSocket_recv: Socket not connected");
+        }
+
+        if (theSocketStruct->mReceivedTOrdRel)
+        {
+                totalBytesRead = 0;
+                
+                goto EXITPOINT;
+        }
+
+        
+        PrepareForAsyncOperation(theSocketStruct,0);
+        
+        for (;;)
+        {
+        int                     bytesRead;
+        OTResult        theOTResult;
+        
+        
+                theOTResult = ::OTRcv(theSocketStruct->mEndPointRef,(void *) ((unsigned long) outBuff + (unsigned long) totalBytesRead),outBuffLength - totalBytesRead,nil);
+                
+                if (theOTResult >= 0)
+                {
+                        bytesRead = theOTResult;
+                        
+#ifdef MACSOCKET_DEBUG
+        printf("MacSocket_recv: read %d bytes in part\n",bytesRead);
+#endif
+                }
+                
+                else if (theOTResult == kOTNoDataErr)
+                {
+                        bytesRead = 0;
+                }
+                
+                else
+                {
+                        SetErrorMessageAndLongIntAndBail("MacSocket_recv: Can't receive OT data, OTRcv() = ",theOTResult);
+                }
+                
+                
+                totalBytesRead += bytesRead;
+                
+                
+                if (totalBytesRead <= 0)
+                {
+                        if (theSocketStruct->mReceivedTOrdRel)
+                        {
+                                break;
+                        }
+                        
+                        //      This seems pretty stupid to me now.  Maybe I'll delete this blocking garbage.
+                        
+                        if (inBlock)
+                        {
+                                if (TimeoutElapsed(theSocketStruct))
+                                {
+                                        SetErrorCodeAndMessageAndBail(kMacSocket_TimeoutErr,"MacSocket_recv: Receive operation timed-out");
+                                }
+                                
+                                if (theSocketStruct->mIdleWaitCallback != nil)
+                                {
+                                        theOTResult = (*(theSocketStruct->mIdleWaitCallback))(theSocketStruct->mUserRefPtr);
+                                        
+                                        SetErrorMessageAndBailIfError(theOTResult,"MacSocket_recv: User cancelled operation");
+                                }
+                                
+                                continue;
+                        }
+                }
+                
+                
+                break;
+        }
+        
+        errCode = noErr;
+
+
+#ifdef MACSOCKET_DEBUG
+        printf("MacSocket_recv: read %d bytes in total\n",totalBytesRead);
+#endif
+        
+        
+EXITPOINT:
+        
+        if (theSocketStruct != nil)
+        {
+                theSocketStruct->mLastError = noErr;
+                
+                CopyCStrToCStr("",theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+
+                if (errCode != noErr)
+                {
+                        theSocketStruct->mLastError = errCode;
+                        
+                        CopyCStrToCStr(GetErrorMessage(),theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+                }
+        }
+
+        errno = errCode;
+        
+        return(totalBytesRead);
+}
+
+
+
+//      Send some bytes
+
+int MacSocket_send(const int inSocketNum,void *inBuff,int inBuffLength)
+{
+OSErr                   errCode = noErr;
+int                             bytesSent = 0;
+SocketStruct    *theSocketStruct = nil;
+
+
+        SetErrorMessageAndBailIfNil(inBuff,"MacSocket_send: Bad parameter, inBuff = nil");
+        
+        if (inBuffLength <= 0)
+        {
+                SetErrorMessageAndBail("MacSocket_send: Bad parameter, inBuffLength <= 0");
+        }
+
+        if (!SocketIndexIsValid(inSocketNum))
+        {
+                SetErrorMessageAndBail("MacSocket_send: Invalid socket number specified");
+        }
+        
+
+        theSocketStruct = &(sSockets[inSocketNum]);
+        
+        if (!theSocketStruct->mLocalEndIsConnected)
+        {
+                SetErrorMessageAndBail("MacSocket_send: Socket not connected");
+        }
+
+
+OTResult                theOTResult;
+        
+
+        PrepareForAsyncOperation(theSocketStruct,0);
+
+        while (bytesSent < inBuffLength)
+        {
+                if (theSocketStruct->mIdleWaitCallback != nil)
+                {
+                        theOTResult = (*(theSocketStruct->mIdleWaitCallback))(theSocketStruct->mUserRefPtr);
+                        
+                        SetErrorMessageAndBailIfError(theOTResult,"MacSocket_send: User cancelled");
+                }
+
+
+                theOTResult = ::OTSnd(theSocketStruct->mEndPointRef,(void *) ((unsigned long) inBuff + bytesSent),inBuffLength - bytesSent,0);
+                
+                if (theOTResult >= 0)
+                {
+                        bytesSent += theOTResult;
+                        
+                        theOTResult = noErr;
+                        
+                        //      Reset timer....
+                        
+                        PrepareForAsyncOperation(theSocketStruct,0);
+                }
+                
+                if (theOTResult == kOTFlowErr)
+                {
+                        if (TimeoutElapsed(theSocketStruct))
+                        {
+                                SetErrorCodeAndMessageAndBail(kMacSocket_TimeoutErr,"MacSocket_send: Send timed-out")
+                        }
+
+                        theOTResult = noErr;
+                }
+                                                                                                        
+                SetErrorMessageAndLongIntAndBailIfError(theOTResult,"MacSocket_send: Can't send OT data, OTSnd() = ",theOTResult);
+        }
+
+        
+        errCode = noErr;
+
+#ifdef MACSOCKET_DEBUG
+        printf("MacSocket_send: sent %d bytes\n",bytesSent);
+#endif
+        
+        
+EXITPOINT:
+        
+        if (theSocketStruct != nil)
+        {
+                theSocketStruct->mLastError = noErr;
+                
+                CopyCStrToCStr("",theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+
+                if (errCode != noErr)
+                {
+                        theSocketStruct->mLastError = errCode;
+                        
+                        CopyCStrToCStr(GetErrorMessage(),theSocketStruct->mErrMessage,sizeof(theSocketStruct->mErrMessage));
+                }
+        }
+        
+        if (errCode != noErr)
+        {
+                ::SysBeep(1);
+        }
+        
+        errno = errCode;
+        
+        return(bytesSent);
+}
+
+
+
+
+
+static OSStatus NegotiateIPReuseAddrOption(EndpointRef inEndpoint,const Boolean inEnableReuseIP)
+{
+OSStatus        errCode;
+UInt8           buf[kOTFourByteOptionSize];
+TOption*        theOTOption;
+TOptMgmt        theOTRequest;
+TOptMgmt        theOTResult;
+        
+
+        if (!OTIsSynchronous(inEndpoint))
+        {
+                SetErrorMessageAndBail("NegotiateIPReuseAddrOption: Open Transport endpoint is not synchronous");
+        }
+        
+        theOTRequest.opt.buf = buf;
+        theOTRequest.opt.len = sizeof(buf);
+        theOTRequest.flags = T_NEGOTIATE;
+
+        theOTResult.opt.buf = buf;
+        theOTResult.opt.maxlen = kOTFourByteOptionSize;
+
+
+        theOTOption = (TOption *) buf;
+        
+        theOTOption->level = INET_IP;
+        theOTOption->name = IP_REUSEADDR;
+        theOTOption->len = kOTFourByteOptionSize;
+        theOTOption->status = 0;
+        *((UInt32 *) (theOTOption->value)) = inEnableReuseIP;
+
+        errCode = ::OTOptionManagement(inEndpoint,&theOTRequest,&theOTResult);
+        
+        if (errCode == kOTNoError)
+        {
+                if (theOTOption->status != T_SUCCESS)
+                {
+                        errCode = theOTOption->status;
+                }
+                
+                else
+                {
+                        errCode = kOTNoError;
+                }
+        }
+                                
+
+EXITPOINT:
+        
+        errno = errCode;
+        
+        return(errCode);
+}
+
+
+
+
+
+//      Some rough notes....
+
+
+
+//      OTAckSends(ep);
+//      OTAckSends(ep) // enable AckSend option
+//      ......
+//      buf = OTAllocMem( nbytes); // Allocate nbytes of memory from OT
+//      OTSnd(ep, buf, nbytes, 0); // send a packet
+//      ......
+//      NotifyProc( .... void* theParam) // Notifier Proc
+//      case T_MEMORYRELEASED: // process event
+//      OTFreeMem( theParam); // free up memory
+//      break;
+
+
+
+/*
+struct InetInterfaceInfo
+{
+        InetHost                fAddress;
+        InetHost                fNetmask;
+        InetHost                fBroadcastAddr;
+        InetHost                fDefaultGatewayAddr;
+        InetHost                fDNSAddr;
+        UInt16                  fVersion;
+        UInt16                  fHWAddrLen;
+        UInt8*                  fHWAddr;
+        UInt32                  fIfMTU;
+        UInt8*                  fReservedPtrs[2];
+        InetDomainName  fDomainName;
+        UInt32                  fIPSecondaryCount;
+        UInt8                   fReserved[252];                 
+};
+typedef struct InetInterfaceInfo InetInterfaceInfo;
+
+
+
+((InetAddress *) addr.buf)->fHost
+
+struct TBind
+{
+        TNetbuf addr;
+        OTQLen  qlen;
+};
+
+typedef struct TBind    TBind;
+
+struct TNetbuf
+{
+        size_t  maxlen;
+        size_t  len;
+        UInt8*  buf;
+};
+
+typedef struct TNetbuf  TNetbuf;
+
+        
+        struct InetAddress
+{
+                OTAddressType   fAddressType;   // always AF_INET
+                InetPort                fPort;                  // Port number 
+                InetHost                fHost;                  // Host address in net byte order
+                UInt8                   fUnused[8];             // Traditional unused bytes
+};
+typedef struct InetAddress InetAddress;
+*/
+
+
+
+/*
+static pascal void Notifier(void* context, OTEventCode event, OTResult result, void* cookie)
+{
+EPInfo* epi = (EPInfo*) context;
+
+        switch (event)
+        {
+                case T_LISTEN:
+                {
+                        DoListenAccept();
+                        return;
+                }
+                
+                case T_ACCEPTCOMPLETE:
+                {
+                        if (result != kOTNoError)
+                                DBAlert1("Notifier: T_ACCEPTCOMPLETE - result %d",result);
+                        return;
+                }
+                
+                case T_PASSCON:
+                {
+                        if (result != kOTNoError)
+                        {
+                                DBAlert1("Notifier: T_PASSCON result %d", result);
+                                return;
+                        }
+
+                        OTAtomicAdd32(1, &gCntrConnections);
+                        OTAtomicAdd32(1, &gCntrTotalConnections);
+                        OTAtomicAdd32(1, &gCntrIntervalConnects);
+                        
+                        if ( OTAtomicSetBit(&epi->stateFlags, kPassconBit) != 0 )
+                        {
+                                ReadData(epi);
+                        }
+                        
+                        return;
+                }
+                
+                case T_DATA:
+                {
+                        if ( OTAtomicSetBit(&epi->stateFlags, kPassconBit) != 0 )
+                        {
+                                ReadData(epi);
+                        }
+                        
+                        return;
+                }
+                
+                case T_GODATA:
+                {
+                        SendData(epi);
+                        return;
+                }
+                
+                case T_DISCONNECT:
+                {
+                        DoRcvDisconnect(epi);
+                        return;
+                }
+                
+                case T_DISCONNECTCOMPLETE:
+                {
+                        if (result != kOTNoError)
+                                DBAlert1("Notifier: T_DISCONNECT_COMPLETE result %d",result);
+                                
+                        return;
+                }
+                
+                case T_MEMORYRELEASED:
+                {
+                        OTAtomicAdd32(-1, &epi->outstandingSends);
+                        return;
+                }
+                
+                default:
+                {
+                        DBAlert1("Notifier: unknown event <%x>", event);
+                        return;
+                }
+        }
+}
+*/
diff --git a/src/lib/libssl/src/MacOS/GetHTTPS.src/MacSocket.h b/src/lib/libssl/src/MacOS/GetHTTPS.src/MacSocket.h
new file mode 100644
index 0000000000..6e90a5bb44
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/GetHTTPS.src/MacSocket.h
@@ -0,0 +1,103 @@
+#pragma once
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+
+enum
+{
+        kMacSocket_TimeoutErr = -2
+};
+
+
+//      Since MacSocket does busy waiting, I do a callback while waiting
+
+typedef OSErr (*MacSocket_IdleWaitCallback)(void *);
+
+
+//      Call this before anything else!
+
+OSErr MacSocket_Startup(void);
+
+
+//      Call this to cleanup before quitting
+
+OSErr MacSocket_Shutdown(void);
+
+
+//      Call this to allocate a "socket" (reference number is returned in outSocketNum)
+//      Note that inDoThreadSwitching is pretty much irrelevant right now, since I ignore it
+//      The inTimeoutTicks parameter is applied during reads/writes of data
+//      The inIdleWaitCallback parameter specifies a callback which is called during busy-waiting periods
+//      The inUserRefPtr parameter is passed back to the idle-wait callback
+
+OSErr MacSocket_socket(int *outSocketNum,const Boolean inDoThreadSwitching,const long inTimeoutTicks,MacSocket_IdleWaitCallback inIdleWaitCallback,void *inUserRefPtr);
+
+
+//      Call this to connect to an IP/DNS address
+//      Note that inTargetAddressAndPort is in "IP:port" format-- e.g. 10.1.1.1:123
+
+OSErr MacSocket_connect(const int inSocketNum,char *inTargetAddressAndPort);
+
+
+//      Call this to listen on a port
+//      Since this a low-performance implementation, I allow a maximum of 1 (one!) incoming request when I listen
+
+OSErr MacSocket_listen(const int inSocketNum,const int inPortNum);
+
+
+//      Call this to close a socket
+
+OSErr MacSocket_close(const int inSocketNum);
+
+
+//      Call this to receive data on a socket
+//      Most parameters' purpose are obvious-- except maybe "inBlock" which controls whether I wait for data or return immediately
+
+int MacSocket_recv(const int inSocketNum,void *outBuff,int outBuffLength,const Boolean inBlock);
+
+
+//      Call this to send data on a socket
+
+int MacSocket_send(const int inSocketNum,void *inBuff,int inBuffLength);
+
+
+//      If zero bytes were read in a call to MacSocket_recv(), it may be that the remote end has done a half-close
+//      This function will let you check whether that's true or not
+
+Boolean MacSocket_RemoteEndIsClosing(const int inSocketNum);
+
+
+//      Call this to see if the listen has completed after a call to MacSocket_listen()
+
+Boolean MacSocket_ListenCompleted(const int inSocketNum);
+
+
+//      These really aren't very useful anymore
+
+Boolean MacSocket_LocalEndIsOpen(const int inSocketNum);
+Boolean MacSocket_RemoteEndIsOpen(const int inSocketNum);
+
+
+//      You may wish to change the userRefPtr for a socket callback-- use this to do it
+
+void MacSocket_SetUserRefPtr(const int inSocketNum,void *inNewRefPtr);
+
+
+//      Call these to get the socket's IP:port descriptor
+
+void MacSocket_GetLocalIPAndPort(const int inSocketNum,char *outIPAndPort,const int inIPAndPortLength);
+void MacSocket_GetRemoteIPAndPort(const int inSocketNum,char *outIPAndPort,const int inIPAndPortLength);
+
+
+//      Call this to get error info from a socket
+
+void MacSocket_GetSocketErrorInfo(const int inSocketNum,int *outSocketErrCode,char *outSocketErrString,const int inSocketErrStringMaxLength);
+
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/src/lib/libssl/src/MacOS/OpenSSL.mcp.hqx b/src/lib/libssl/src/MacOS/OpenSSL.mcp.hqx
new file mode 100644
index 0000000000..2efa49ac01
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/OpenSSL.mcp.hqx
@@ -0,0 +1,4880 @@
+(This file must be converted with BinHex 4.0)
+
+:#dp`C@j68d`ZE@0`!%e08(*$9dP&!!!!!j)H!!!!!)X-Bfp[E!!!!!-!!!%S!!0
+ipJ!$HKi!!"J!!!!"!!%#!3!!!!!!!!!!!%0[C'9ABA*bD@pb)&"bEfTPBh3!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"(CA4)9&4
+38b"38%-k4'9LG@GRCA)J8R9ZG'PYC3"(CA4)9&438b"38%-k8fpeFQ0P)&4bC@9
+c!%GPG%K89&"6)&"33cT$GA0dEfdJ5f9jGfpbC(-!4f9d5&488&-J8&"$1N&MBf9
+cFb"3BA4SF`"(CA4)9&438b"38%-k9'&bCf9d)&0PG(4TEQGc!%GPG%K89&"6)&"
+33cT'D@aP)%eKF("TEQGc!%GPG%K89&"6)&"33cT#G@PXC#"&H(4bBA-!4f9d5&4
+88&-J8&"$1N4PBR9RCf9b)&4KFQGPG!"(CA4)9&438b"38%-k0MK,)%0[C'9(C@i
+!4f9d5&488&-J8&"$1MBi5b"%DA0KFh0PE@*XCA)!4f9d5&488&-J8&"$1MBi5b"
+(E'pLB@`J6h"dD@eTHQ9b!%GPG%K89&"6)&"33cSf1%XJ6'PZDf9b!%GPG%K89&"
+6)&"33cSf1%XJ8(*[DQ9MG!"(CA4)9&438b"38%-k3bp$+bXJ3fpYF'PXCA)!4f9
+d5&488&-J8&"$1N-[3bXV)&GKFQjTEQGc!%GPG%K89&"6)&"33cT$4Ndf1%X!4f9
+d5&488&-J8&"$1NeKBdp6)%ePFQGP)&"KEQ9X!%GPG%K89&"6)&"33cT38%-J3fp
+NC8GPEJ"(CA4)9&438b"38%-k8&"$)%4TFf&cFf9YBQaPFJ"(CA4)9&438b"38%-
+k8&"$)%GXEf*KE#"2F(4TE@PkCA)!4f9d5&488&-J8&"$1P"33b"-D@jVCA)!4f9
+d5&488&-J8&"$1P"33b"348B!4f9d5&488&-J8&"$1P"33b"3FQpUC@0d!%GPG%K
+89&"6)&"33cT38%0"FfdJ8'&ZC@`!4f9d5&488&-J8&"$1P*PHL"$Efe`D@aPFJ"
+2F'9Z8e0-)&"33cT%C@*eCfGPFL"5G@jdD@eP!%p`C@j68d`J8&"$1P0[GA*MC5"
+8FQ9PF`"2F'9Z8e0-)&"33cT$GA0dEfdJ5f9jGfpbC(-!6h"PEP066#"38%-k3@0
+MCA0c)&"KG'Kc!%p`C@j68d`J8&"$1P4KFQGPG#"6CA4dD@jRF`"2F'9Z8e0-)&"
+33cT'D@aP)%eKF("TEQGc!%p`C@j68d`J8&"$1N*eD@aN)%9iG(*KF`"2F'9Z8e0
+-)&"33cT%C@*eCfGPFL"8BA*RCA3!6h"PEP066#"38%-k0MK,)%0[C'9(C@i!6h"
+PEP066#"38%-k0MK,)%4TFf&cFf9YBQaPFJ"2F'9Z8e0-)&"33cSf1%XJ4fa[BQ&
+X)%p`G'PYDATPFJ"2F'9Z8e0-)&"33cSf1%XJ6'PZDf9b!%p`C@j68d`J8&"$1MB
+i5b"3FQpUC@0d!%p`C@j68d`J8&"$1N-[3bXV)%0[EA"TE'9b!%p`C@j68d`J8&"
+$1N-[3bXV)&GKFQjTEQGc!%p`C@j68d`J8&"$1N0'66Bi5`"2F'9Z8e0-)&"33cT
+0B@028b"0CA*RC5"3B@jPE!"2F'9Z8e0-)&"33cT38%-J3fpNC8GPEJ"2F'9Z8e0
+-)&"33cT38%-J4'PcBA0cC@eLE'9b!%p`C@j68d`J8&"$1P"33b"(E'pLB@`J6h"
+dD@eTHQ9b!%p`C@j68d`J8&"$1P"33b"-D@jVCA)!6h"PEP066#"38%-k8&"$)&"
+&4J"2F'9Z8e0-)&"33cT38%-J8(*[DQ9MG!"2F'9Z8e0-)&"33cT38%0"FfdJ8'&
+ZC@`!6h"PEP066#"38%-k8Q9k)%0[EA"TE'9b!%GPG%K89&"6)$Bi5cT%C@*eCfG
+PFL"5G@jdD@eP!%GPG%K89&"6)$Bi5cT6Eh9bBf8J9(*PCA-!4f9d5&488&-J0MK
+,1N0eFh4[E5",CAPhEh*NF`"(CA4)9&438b!f1%Xk3@0MCA0c)&"KG'Kc!%GPG%K
+89&"6)$Bi5cT8BA*RCA3J8f9dG'PZCh-!4f9d5&488&-J0MK,1NCTE'8J6@&`F'P
+ZCh-!4f9d5&488&-J0MK,1N*eD@aN)%9iG(*KF`"(CA4)9&438b!f1%Xk4'9LG@G
+RCA)J9'&bCf9d!%GPG%K89&"6)$Bi5cSf1%XJ3fpNC8GPEJ"(CA4)9&438b!f1%X
+k0MK,)%4TFf&cFf9YBQaPFJ"(CA4)9&438b!f1%Xk0MK,)%GXEf*KE#"2F(4TE@P
+kCA)!4f9d5&488&-J0MK,1MBi5b"-D@jVCA)!4f9d5&488&-J0MK,1MBi5b"3FQp
+UC@0d!%GPG%K89&"6)$Bi5cT$,d-V+b"$Efe`D@aPFJ"(CA4)9&438b!f1%Xk3bp
+$+bXJ9f&bEQPZCh-!4f9d5&488&-J0MK,1N0'66Bi5`"(CA4)9&438b!f1%Xk6@&
+M6e-J6@9bCf8J8'&ZC@`!4f9d5&488&-J0MK,1P"33b"$Ef4P4f9Z!%GPG%K89&"
+6)$Bi5cT38%-J4'PcBA0cC@eLE'9b!%GPG%K89&"6)$Bi5cT38%-J4fa[BQ&X)%p
+`G'PYDATPFJ"(CA4)9&438b!f1%Xk8&"$)%aTEQYPFJ"(CA4)9&438b!f1%Xk8&"
+$)&"&4J"(CA4)9&438b!f1%Xk8&"$)&"bEfTPBh3!4f9d5&488&-J0MK,1P"33d&
+cE5"3B@jPE!"(CA4)9&438b!f1%Xk8Q9k)%0[EA"TE'9b!%aTBP066#!f1%Xk4'9
+LG@GRCA)J8R9ZG'PYC3"-D@*68d`J0MK,1P0[GA*MC5"8FQ9PF`"-D@*68d`J0MK
+,1N0eFh4[E5",CAPhEh*NF`"-D@*68d`J0MK,1N&MBf9cFb"3BA4SF`"-D@*68d`
+J0MK,1P4KFQGPG#"6CA4dD@jRF`"-D@*68d`J0MK,1NCTE'8J6@&`F'PZCh-!6'P
+L8e0-)$Bi5cT#G@PXC#"&H(4bBA-!6'PL8e0-)$Bi5cT%C@*eCfGPFL"8BA*RCA3
+!6'PL8e0-)$Bi5cSf1%XJ3fpNC8GPEJ"-D@*68d`J0MK,1MBi5b"%DA0KFh0PE@*
+XCA)!6'PL8e0-)$Bi5cSf1%XJ4fa[BQ&X)%p`G'PYDATPFJ"-D@*68d`J0MK,1MB
+i5b"-D@jVCA)!6'PL8e0-)$Bi5cSf1%XJ8(*[DQ9MG!"-D@*68d`J0MK,1N-[3bX
+V)%0[EA"TE'9b!%aTBP066#!f1%Xk3bp$+bXJ9f&bEQPZCh-!6'PL8e0-)$Bi5cT
+$4Ndf1%X!6'PL8e0-)$Bi5cT0B@028b"0CA*RC5"3B@jPE!"-D@*68d`J0MK,1P"
+33b"$Ef4P4f9Z!%aTBP066#!f1%Xk8&"$)%4TFf&cFf9YBQaPFJ"-D@*68d`J0MK
+,1P"33b"(E'pLB@`J6h"dD@eTHQ9b!%aTBP066#!f1%Xk8&"$)%aTEQYPFJ"-D@*
+68d`J0MK,1P"33b"348B!6'PL8e0-)$Bi5cT38%-J8(*[DQ9MG!"-D@*68d`J0MK
+,1P"33d&cE5"3B@jPE!"-D@*68d`J0MK,1P*PHL"$Efe`D@aPFJ"2F'9Z8e0-)$B
+iDcT%C@*eCfGPFL"5G@jdD@eP!%p`C@j68d`J0MKV1P0[GA*MC5"8FQ9PF`"2F'9
+Z8e0-)$BiDcT$GA0dEfdJ5f9jGfpbC(-!6h"PEP066#!f1'Xk3@0MCA0c)&"KG'K
+c!%p`C@j68d`J0MKV1P4KFQGPG#"6CA4dD@jRF`"2F'9Z8e0-)$BiDcT'D@aP)%e
+KF("TEQGc!%p`C@j68d`J0MKV1N*eD@aN)%9iG(*KF`"2F'9Z8e0-)$BiDcT%C@*
+eCfGPFL"8BA*RCA3!6h"PEP066#!f1'Xk0MK,)%0[C'9(C@i!6h"PEP066#!f1'X
+k0MK,)%4TFf&cFf9YBQaPFJ"2F'9Z8e0-)$BiDcSf1%XJ4fa[BQ&X)%p`G'PYDAT
+PFJ"2F'9Z8e0-)$BiDcSf1%XJ6'PZDf9b!%p`C@j68d`J0MKV1MBi5b"3FQpUC@0
+d!%p`C@j68d`J0MKV1N-[3bXV)%0[EA"TE'9b!%p`C@j68d`J0MKV1N-[3bXV)&G
+KFQjTEQGc!%p`C@j68d`J0MKV1N0'66Bi5`"2F'9Z8e0-)$BiDcT0B@028b"0CA*
+RC5"3B@jPE!"2F'9Z8e0-)$BiDcT38%-J3fpNC8GPEJ"2F'9Z8e0-)$BiDcT38%-
+J4'PcBA0cC@eLE'9b!%p`C@j68d`J0MKV1P"33b"(E'pLB@`J6h"dD@eTHQ9b!%p
+`C@j68d`J0MKV1P"33b"-D@jVCA)!6h"PEP066#!f1'Xk8&"$)&"&4J"2F'9Z8e0
+-)$BiDcT38%-J8(*[DQ9MG!"2F'9Z8e0-)$BiDcT38%0"FfdJ8'&ZC@`!6h"PEP0
+66#!f1'Xk8Q9k)%0[EA"TE'9b!%aTBP066#"38%-k4'9LG@GRCA)J8R9ZG'PYC3"
+-D@*68d`J8&"$1P0[GA*MC5"8FQ9PF`"-D@*68d`J8&"$1N0eFh4[E5",CAPhEh*
+NF`"-D@*68d`J8&"$1N&MBf9cFb"3BA4SF`"-D@*68d`J8&"$1P4KFQGPG#"6CA4
+dD@jRF`"-D@*68d`J8&"$1NCTE'8J6@&`F'PZCh-!6'PL8e0-)&"33cT#G@PXC#"
+&H(4bBA-!6'PL8e0-)&"33cT%C@*eCfGPFL"8BA*RCA3!6'PL8e0-)&"33cSf1%X
+J3fpNC8GPEJ"-D@*68d`J8&"$1MBi5b"%DA0KFh0PE@*XCA)!6'PL8e0-)&"33cS
+f1%XJ4fa[BQ&X)%p`G'PYDATPFJ"-D@*68d`J8&"$1MBi5b"-D@jVCA)!6'PL8e0
+-)&"33cSf1%XJ8(*[DQ9MG!"-D@*68d`J8&"$1N-[3bXV)%0[EA"TE'9b!%aTBP0
+66#"38%-k3bp$+bXJ9f&bEQPZCh-!6'PL8e0-)&"33cT$4Ndf1%X!6'PL8e0-)&"
+33cT0B@028b"0CA*RC5"3B@jPE!"-D@*68d`J8&"$1P"33b"$Ef4P4f9Z!%aTBP0
+66#"38%-k8&"$)%4TFf&cFf9YBQaPFJ"-D@*68d`J8&"$1P"33b"(E'pLB@`J6h"
+dD@eTHQ9b!%aTBP066#"38%-k8&"$)%aTEQYPFJ"-D@*68d`J8&"$1P"33b"348B
+!6'PL8e0-)&"33cT38%-J8(*[DQ9MG!"-D@*68d`J8&"$1P"33d&cE5"3B@jPE!"
+-D@*68d`J8&"$1P*PHL"$Efe`D@aPFJ"-D@*$FRP`G'mJ8&"$1N4PBR9RCf9b)&*
+eER4TE@8!6'PL3h*jF(4[)&"33cT6Eh9bBf8J9(*PCA-!6'PL3h*jF(4[)&"33cT
+$GA0dEfdJ5f9jGfpbC(-!6'PL3h*jF(4[)&"33cT"Bf0PFh-J8'&dD(-!6'PL3h*
+jF(4[)&"33cT8BA*RCA3J8f9dG'PZCh-!6'PL3h*jF(4[)&"33cT'D@aP)%eKF("
+TEQGc!%aTBN0bHA"dEb"38%-k3R9TE'3J4AKdFQ&c!%aTBN0bHA"dEb"38%-k4'9
+LG@GRCA)J9'&bCf9d!%aTBN0bHA"dEb"38%-k0MK,)%0[C'9(C@i!6'PL3h*jF(4
+[)&"33cSf1%XJ4'PcBA0cC@eLE'9b!%aTBN0bHA"dEb"38%-k0MK,)%GXEf*KE#"
+2F(4TE@PkCA)!6'PL3h*jF(4[)&"33cSf1%XJ6'PZDf9b!%aTBN0bHA"dEb"38%-
+k0MK,)&"bEfTPBh3!6'PL3h*jF(4[)&"33cT$,d-V+b"$Efe`D@aPFJ"-D@*$FRP
+`G'mJ8&"$1N-[3bXV)&GKFQjTEQGc!%aTBN0bHA"dEb"38%-k3dC00MK,!%aTBN0
+bHA"dEb"38%-k6@&M6e-J6@9bCf8J8'&ZC@`!6'PL3h*jF(4[)&"33cT38%-J3fp
+NC8GPEJ"-D@*$FRP`G'mJ8&"$1P"33b"%DA0KFh0PE@*XCA)!6'PL3h*jF(4[)&"
+33cT38%-J4fa[BQ&X)%p`G'PYDATPFJ"-D@*$FRP`G'mJ8&"$1P"33b"-D@jVCA)
+!6'PL3h*jF(4[)&"33cT38%-J8%9'!%aTBN0bHA"dEb"38%-k8&"$)&"bEfTPBh3
+!6'PL3h*jF(4[)&"33cT38%0"FfdJ8'&ZC@`!6'PL3h*jF(4[)&"33cT5CASJ3fp
+YF'PXCA)!6'PL3h*jF(4[)$Bi5cT%C@*eCfGPFL"5G@jdD@eP!%aTBN0bHA"dEb!
+f1%Xk8fpeFQ0P)&4bC@9c!%aTBN0bHA"dEb!f1%Xk3h9cG'pY)%YPHAG[FQ4c!%a
+TBN0bHA"dEb!f1%Xk3@0MCA0c)&"KG'Kc!%aTBN0bHA"dEb!f1%Xk9'&bCf9d)&0
+PG(4TEQGc!%aTBN0bHA"dEb!f1%Xk4QPXC5"0BA"`D@jRF`"-D@*$FRP`G'mJ0MK
+,1N*eD@aN)%9iG(*KF`"-D@*$FRP`G'mJ0MK,1N4PBR9RCf9b)&4KFQGPG!"-D@*
+$FRP`G'mJ0MK,1MBi5b"$Ef4P4f9Z!%aTBN0bHA"dEb!f1%Xk0MK,)%4TFf&cFf9
+YBQaPFJ"-D@*$FRP`G'mJ0MK,1MBi5b"(E'pLB@`J6h"dD@eTHQ9b!%aTBN0bHA"
+dEb!f1%Xk0MK,)%aTEQYPFJ"-D@*$FRP`G'mJ0MK,1MBi5b"3FQpUC@0d!%aTBN0
+bHA"dEb!f1%Xk3bp$+bXJ3fpYF'PXCA)!6'PL3h*jF(4[)$Bi5cT$,d-V+b"ABA*
+ZD@jRF`"-D@*$FRP`G'mJ0MK,1N0'66Bi5`"-D@*$FRP`G'mJ0MK,1NeKBdp6)%e
+PFQGP)&"KEQ9X!%aTBN0bHA"dEb!f1%Xk8&"$)%0[C'9(C@i!6'PL3h*jF(4[)$B
+i5cT38%-J4'PcBA0cC@eLE'9b!%aTBN0bHA"dEb!f1%Xk8&"$)%GXEf*KE#"2F(4
+TE@PkCA)!6'PL3h*jF(4[)$Bi5cT38%-J6'PZDf9b!%aTBN0bHA"dEb!f1%Xk8&"
+$)&"&4J"-D@*$FRP`G'mJ0MK,1P"33b"3FQpUC@0d!%aTBN0bHA"dEb!f1%Xk8&"
+$3A0Y)&"KEQ9X!%aTBN0bHA"dEb!f1%Xk8Q9k)%0[EA"TE'9b!&"bEfTPBh3J4QP
+XC5"-DA0d!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!3!!!!!!!!!H!!!!!J!!!!!!!!!i!!!!!`!!!!!!!!"9!!!!"!!!!!!!!!"[!!!
+!"3!!!!!!!!#-!!!!"J!!!!!!!!#R!!!!"`!!!!!!!!$"!!!!#!!!!!!!!!$H!!!
+!#3!!!!!!!!$h!!!!#J!!!!!!!!%9!!!!#`!!!!!!!!%h!!!!$!!!!!!!!!&2!!!
+!$3!!!!!!!!&S!!!!$J!!!!!!!!'%!!!!$`!!!!!!!!'J!!!!%!!!!!!!!!'d!!!
+!%3!!!!!!!!(6!!!!%J!!!!!!!!(X!!!!%`!!!!!!!!)+!!!!&!!!!!!!!!)X!!!
+!&3!!!!!!!!*%!!!!&J!!!!!!!!*C!!!!&`!!!!!!!!*b!!!!'!!!!!!!!!+-!!!
+!'3!!!!!!!!+Q!!!!'J!!!!!!!!,$!!!!'`!!!!!!!!,F!!!!(!!!!!!!!!,i!!!
+!(3!!!!!!!!-4!!!!(J!!!!!!!!-Y!!!!(`!!!!!!!!0(!!!!)!!!!!!!!!0J!!!
+!)3!!!!!!!!0m!!!!)J!!!!!!!!18!!!!)`!!!!!!!!1a!!!!*!!!!!!!!!25!!!
+!*3!!!!!!!!2T!!!!*J!!!!!!!!3"!!!!*`!!!!!!!!3F!!!!+!!!!!!!!!3h!!!
+!+3!!!!!!!!4+!!!!+J!!!!!!!!4S!!!!+`!!!!!!!!5!!!!!,!!!!!!!!!5G!!!
+!,3!!!!!!!!5q!!!!,J!!!!!!!!69!!!!,`!!!!!!!!6T!!!!-!!!!!!!!!8"!!!
+!-3!!!!!!!!8D!!!!-J!!!!!!!!8c!!!!-`!!!!!!!!94!!!!0!!!!!!!!!9V!!!
+!03!!!!!!!!@)!!!!0J!!!!!!!!@L!!!!0`!!!!!!!!@r!!!!1!!!!!!!!!AD!!!
+!13!!!!!!!!Ad!!!!1J!!!!!!!!B4!!!!1`!!!!!!!!BU!!!!2!!!!!!!!!C)!!!
+!23!!!!!!!!CU!!!!2J!!!!!!!!D#!!!!2`!!!!!!!!DE!!!!3!!!!!!!!!Dh!!!
+!33!!!!!!!!E6!!!!3J!!!!!!!!ER!!!!3`!!!!!!!!F'!!!!4!!!!!!!!!FI!!!
+!43!!!!!!!!Fp!!!!4J!!!!!!!!GI!!!!4`!!!!!!!!Gh!!!!5!!!!!!!!!H-!!!
+!53!!!!!!!!HP!!!!5J!!!!!!!!Hr!!!!5`!!!!!!!!IC!!!!6!!!!!!!!!Ie!!!
+!63!!!!!!!!J0!!!!6J!!!!!!!!JS!!!!6`!!!!!!!!K!!!!!8!!!!!!!!!KE!!!
+!83!!!!!!!!Kd!!!!8J!!!!!!!!L-!!!!8`!!!!!!!!LR!!!!9!!!!!!!!!Lq!!!
+!93!!!!!!!!MD!!!!9J!!!!!!!!Mk!!!!9`!!!!!!!!N3!!!!@!!!!!!!!!NR!!!
+!@3!!!!!!!!P"!!!!@J!!!!!!!!PE!!!!@`!!!!!!!!PY!!!!A!!!!!!!!!Q+!!!
+!A3!!!!!!!!QK!!!!AJ!!!!!!!!Qp!!!!A`!!!!!!!!RG!!!!B!!!!!!!!!Rc!!!
+!B3!!!!!!!!S'!!!!BJ!!!!!!!!SG!!!!B`!!!!!!!!Se!!!!C!!!!!!!!!T0!!!
+!C3!!!!!!!!TU!!!!CJ!!!!!!!!U$!!!!C`!!!!!!!!UI!!!!D!!!!!!!!!Ui!!!
+!D3!!!!!!!!V8!!!!DJ!!!!!!!!VZ!!!!D`!!!!!!!!X(!!!!E!!!!!!!!!XM!!!
+!E3!!!!!!!!Xl!!!!EJ!!!!!!!!YB!!!!E`!!!!!!!!Yj!!!!F!!!!!!!!!Z3!!!
+!!(%!!!!!!!!,U!!!!()!!!!!!!!,``!!!(-!!!!!!!!,hJ!!!(3!!!!!!!!,m3!
+!!(8!!!!!!!!-$`!!!(B!!!!!!!!-*`!!!(F!!!!!!!!-4!!!!(J!!!!!!!!-C3!
+!!(N!!!!!!!!-I!!!!(S!!!!!!!!-N!!!!!"l!!!!!!!!$+J!!!"m!!!!!!!!$-%
+!!!"p!!!!!!!!$0S!!!"q!!!!!!!!$2B!!!"r!!!!!!!!$3i!!!#!!!!!!!!!$5N
+!!!#"!!!!!!!!$8%!!!##!!!!!!!!$9`!!!#$!!!!!!!!$A8!!!#%!!!!!!!!$Bd
+!!!#&!!!!!!!!$DJ!!!#'!!!!!!!!$Em!!!#(!!!!!!!!$GX!!!#)!!!!!!!!$IX
+!!!#*!!!!!!!!$K%!!!#+!!!!!!!!$LJ!!!#,!!!!!!!!$N)!!!#-!!!!!!!!$P`
+!!!#0!!!!!!!!$Qi!!!#1!!!!!!!!$SX!!!#2!!!!!!!!$U)!!!#3!!!!!!!!!!k
+q!!!!N3!!!!!!!!lH!!!!NJ!!!!!!!!ld!!!!N`!!!!!!!!m(!!!!P!!!!!!!!!m
+H!!!!P3!!!!!!!!mf!!!!PJ!!!!!!!!p1!!!!P`!!!!!!!!pY!!!!Q!!!!!!!!!q
+)!!!!Q3!!!!!!!!qQ!!!!QJ!!!!!!!!r"!!!!Q`!!!!!!!!rI!!!!R!!!!!!!!!r
+l!!!!R3!!!!!!!"!@!!!!RJ!!!!!!!"!d!!!!R`!!!!!!!""1!!!!S!!!!!!!!""
+Y!!!!S3!!!!!!!"#3!!!!!+)!!!!!!!!3U3!!!+-!!!!!!!!3``!!!+3!!!!!!!!
+3i!!!!+8!!!!!!!!3r3!!!+B!!!!!!!!4%J!!!+F!!!!!!!!4-J!!!+J!!!!!!!!
+46!!!!+N!!!!!!!!4D`!!!+S!!!!!!!!4MJ!!!+X!!!!!!!!4T`!!!+`!!!!!!!!
+4[3!!!+d!!!!!!!!4e`!!!+i!!!!!!!!4mJ!!!+m!!!!!!!!5$3!!!,!!!!!!!!!
+5,!!!!,%!!!!!!!!54`!!!,)!!!!!!!!5C3!!!,-!!!!!!!!5J!!!!,3!!!!!!!!
+5RJ!!!,8!!!!!!!!5ZJ!!!,B!!!!!!!!5e3!!!,F!!!!!!!!5m`!!!,J!!!!!!!!
+6$3!!!,N!!!!!!!!6,!!!!,S!!!!!!!!66`!!!,X!!!!!!!!6D!!!!,`!!!!!!!!
+6JJ!!!,d!!!!!!!!6R`!!!,i!!!!!!!!6[!!!!,m!!!!!!!!6d3!!!-!!!!!!!!!
+6m3!!!-%!!!!!!!!8#`!!!-)!!!!!!!!8+J!!!--!!!!!!!!863!!!-3!!!!!!!!
+8CJ!!!-8!!!!!!!!8I!!!!-B!!!!!!!!8PJ!!!-F!!!!!!!!8X3!!!-J!!!!!!!!
+8c!!!!-N!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!1J!!!$X!!!!m!!!!23!!!$i!!!!e!!!!1!!!!$m!!!"!!!!!33!!!$3!!!!b!!!
+!13!!!$F!!!"#!!!!3`!!!%3!!!"&!!!!4J!!!%F!!!")!!!!53!!!%S!!!!c!!!
+!0J!!!!J!!!!*!!!!#J!!!!X!!!!-!!!!!`!!!!B!!!!0!!!!$J!!!!m!!!!#!!!
+!!!!!!!F!!!!&!!!!%!!!!"%!!!!5!!!!%`!!!"3!!!!9!!!!&J!!!"F!!!!B!!!
+!!3!!!!3!!!#h!!!!Z!!!!,N!!!#k!!!!Z`!!!,)!!!#e!!!![!!!!,d!!!#q!!!
+!X3!!!+m!!!#f!!!!Y!!!!,m!!!$!!!!!`3!!!-)!!!$$!!!!a!!!!-8!!!$'!!!
+!a`!!!,!!!!#c!!!!RJ!!!*m!!!#J!!!!S3!!!+)!!!#C!!!!R!!!!+-!!!#N!!!
+!T3!!!*J!!!#@!!!!R3!!!*X!!!#Q!!!!T`!!!+J!!!#T!!!!UJ!!!+X!!!#X!!!
+!V3!!!+i!!!#A!!!!QJ!!!&-!!!"8!!!!93!!!&B!!!"A!!!!6J!!!&%!!!"B!!!
+!@3!!!&S!!!"0!!!!5`!!!&)!!!"3!!!!@`!!!&`!!!"G!!!!AJ!!!&m!!!"J!!!
+!B3!!!')!!!"M!!!!6!!!!%m!!!#&!!!!KJ!!!)F!!!#)!!!!L3!!!)!!!!#$!!!
+!LJ!!!)X!!!#-!!!!I`!!!(d!!!#%!!!!JJ!!!)d!!!#1!!!!M`!!!*!!!!!!N3!
+!!*)!!!#6!!!!P!!!!*8!!!"q!!!!J3!!!'`!!!"Y!!!!EJ!!!'m!!!"`!!!!C`!
+!!'S!!!"a!!!!FJ!!!(-!!!"Q!!!!C!!!!'X!!!"T!!!!G!!!!(8!!!"f!!!!G`!
+!!(J!!!"j!!!!HJ!!!(X!!!"m!!!!C3!!!'J!!!!K!!!!)J!!!#-!!!!N!!!!*3!
+!!"`!!!!I!!!!*J!!!#F!!!!S!!!!'`!!!"N!!!!J!!!!(J!!!#N!!!!U!!!!+`!
+!!#`!!!!Y!!!!,J!!!#m!!!!`!!!!-3!!!"S!!!!G!!!!b!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!690-)%-Z8&"$,NaTBJ"*ER4
+PFQCKBf9-D@)!6@&dD%aTBJ"08d`J8R9ZG'PYC9"33bj-D@)!6h"PEP4`G%PZCA4
+38%-ZE`"2F'9Z9("d5@jdCA*ZCA4-D@)!6h"PEP4bB@jcF'pbG%9iG'j38%-ZE`"
+2F'9Z9(*KER0`Eh*d6'PL!&4SFQ9KC(0-D@)!BQP[Ah0cE#jM!(-b-epME'jd,Q-
+!Fc)cAfaTBLjM!(-b-epYCA4S,Q-!Fc)cAh"VG#jM!(-b-epcFRCb,Q-!Fc*IBfa
+ZG#jM!(-bAf9ZBbjM!(-bAfaTBLjM!(-bAfePG'JZB`"c-Pp`Dh3ZB`"c-PpcFRC
+b,Q-!Fc0IBQpdD#jM!(-cAf0XER3ZB`"c-epPEQ-ZB`"c-epXD@)ZB`"c-epYCA4
+S,Q-!Fc0IF'Yd,Q-!Fc0IFh*fFLjM!(0cE&pKE'Gc,Q-!Fh0XAf&cEM%ZB`"cFfa
+IBf9bG#jM!(0cE&pMDA"S,Q-!Fh0XAf9bFLjM!(0cE&pPFR)b,Q-!Fh0XAfaTBLj
+M!(0cE&pbFf%ZB`"cFfaIFf9cFbjM!(0cE&pcG'&d,Q-!Fh0XAh4iG#jM!(3aAf0
+XER3ZB`"d-9pPEQ-ZB`"d-9pXD@)ZB`"d-9pYCA4S,Q-!G$&IFh*fFLjM!'&cEM&
+ICA*b,Q-!BA0Z-9pXD@)ZB`"KFfiaAh"KFLjM!'&cEPp`B@0V,Q-!B9pLDA4cG()
+ZB`"KAf*YF#jM!'&IBQp[E#jM!'&IBRPdCA-ZB`"KAf3bD9pQF#jM!'&IC'PRCA0
+d,Q-!B9pNGA!ZB`"KAf9ZG@dZB`"KAfGPER4Y,Q-!B9pSC()ZB`"KAfNbC&pQF#j
+M!'&ID@jd,Q-!B9pYCA4S,Q-!B9p[BQTPBh3ZB`"KAfpMG'9d,Q-!B9p`FQPZG#j
+M!'&IFf9d,Q-!B9pcD@GZ,Q-!B9pdD@eP,Q-!B9pdHA"P,Q-!B9peG'0dE5jM!'&
+IGA4Q1#jM!'&IGQ9bD@Cj,Q-!B9pfDA-ZB`"N-QPIC'K`,Q-!C$*TAf4cBA!ZB`"
+N-QPIF()ZB`"N-QPIF(8ZB`"N-QPIFPp`FLjM!'3bD9pbAh"e,Q-!C$*TAh0IF()
+ZB`"N-QPIFep`G5jM!'9fF&pKFfia,Q-!CPpPER9Y,Q-!CPpTER3ZB`"QAh0dFQP
+ZCbjM!'NbC&pND(!ZB`"T-Q4IC(0KF#jM!'NbC&p`FLjM!'NbC&p`G5jM!'NbC&p
+bAh"b,Q-!D6*NAh*IF(8ZB`"T-Q4IFep`FLjM!'NbC&pcAh"e,Q-!ER0cCA%ZB`"
+ZAh"VCANZB`"`09p`BQ8ZB`"`09p`BQ9f-LjM!(!hAf4RFh3ZB`"`0epPEQ-ZB`"
+`0epPEQ0IBbjM!(!hAf9fF#jM!(!hAfPIFbjM!(!hAfaTBLjM!(!hAh*PBfP`,Q-
+!F$GIFfPREQ3ZB`"`0epcD@GZD5jM!(!hAh0IC5jM!(!iAh"VCANZB`"dAf0bE#j
+M!(4IF'YPH5jM!(4IFQ9a,Q-!G&pi06!j,Q-!H&pKE'G[FLjM!(KIBA4dFQPL,Q-
+!H&pMD@jQ,Q-!H&pMFQ`ZB`"iAf9iG'9Z,Q-!H&pTEQC[,Q-!H&pZB@eP,Q-!H&p
+`Df9j,Q-!H&p`G@*VCANZB`"iAh*PF5jM!(KIFfPR,Q-!H&pcF'YT,Q-!H&pfB@`
+ZB`"iAhJe-$NZB`"LCPpMCQ)f0#jM!'*QAf9MBLjM!'*QAf9ZBbjM!'*QAfpQBMB
+d,Q-!BQCIFfYPH5jM!'*TEepPFR)ZB`"LD@pIE'PL,Q-!BR0cAh0[BfXZB`"LEPp
+KC'3ZB`"LEPpKFfdZB`"LEPpLE'PZC#jM!'*ZAf4TGLjM!'*ZAf9bFLjM!'*ZAf9
+iF#jM!'*ZAf9iF$)ZB`"LEPpRBf3ZB`"LEPpXD@)ZB`"LEPpYEfjd,Q-!BQjIEA"
+T,Q-!BQjIEA9X,Q-!BQjIF(*TE@8ZB`"LEPp`FQPZG#jM!'*ZAh*KEQ3ZB`"LEPp
+bC@0`,Q-!BQjIFfKTCR3ZB`"LEPpcFA)ZB`"LEPphEh*N,Q-!BR9QCQ9b,Q-!BR9
+QAf9bFLjM!'0IBfCL0M3ZB`"MAf9MBLjM!'0IC@jM,Q-!Bep[CQ)f0#jM!'0IFfY
+PH5jM!'0[EA"IE'PL,Q-!BepbE'8ZB`"MAhTXD@)ZB`"MEfjQ,Q-!BfpZCPpPFR)
+ZB`"MBQ0IBfYcE5jM!'0LBepPEQ-ZB`"MCQ)f0'9NC5jM!'0QBMBdC@jM,Q-!BfC
+LAf9ZBbjM!'4PFepPEQ-ZB`"PBf)cAf9ZBbjM!'9MBPpPEQ-ZB`"PC'9IBf*ME9p
+PEQ-ZB`"PEQ0IFQ9KC#jM!'CMFRP`G#jM!'CMFRP`G&pL,Q-!EfCL0M4PC'8ZB`"
+[CQ)f0'9ZBbjM!'pQBPpPEQ-ZB`"`Bf*MAf9ZBbjM!(&eC&pMDh0Y,Q-!FQ&ZC&p
+VCANZB`"bC@&N-R"hC#jM!(*PB@4IF(GN,Q-!FR"MAf9ZBbjM!(0PG&pVCANZB`"
+cG()bDf9j,Q-!Fh9`F#jM!(KMBQ0IC@jM,Q-!C'KIBfKPBfXZB`"ND&pPFR)ZB`"
+ND&pRC@iZB`"ND&pVCANZB`"ND&pXD@)ZB`"NFf&IBA0Z-5jM!'4cB9pPFR)ZB`"
+NFf&ICf9Z,Q-!C(0KAfYPH5jM!'4cB9pXD@)ZB`"NFf&IFfPRELjM!'4cB9pfFQB
+ZB`"PFR)ZB`"PFR*IB@aX,Q-!CA*bAh"bELjM!'*TEepL0M3ZB`"LD@pIC@jM,Q-
+!BQP[AfeN,Q-!BQP[AfpV,Q-!BepKE'`ZB`"ND@GPFh3ZB`"PEQ0[C'8ZB`"PGR"
+IC@jM,Q-!CAC`Af9bFLjM!'9fF&pVCANZB`"PGR"IE'PL,Q-!CAC`Ah"LC5jM!'9
+fF&p`Df9j,Q-!C9pMBQ0I-f3ZB`"PAf0LBepLCLjM!'9IBf*MAf-ZB`"PAf0LBep
+N,Q-!C9pMBQ0ID5jM!'9IBf*MAh)b,Q-!C9pMBQ0IFM8ZB`"PAf0QBPmcC#jM!'9
+IBfCLAf*Q,Q-!C9pMCQ*IBbjM!'9IBfCLAf3ZB`"PAf0QBPpT,Q-!C9pMCQ*IFM)
+ZB`"PAf0QBPpb05jM!'9IC@0LAc0N,Q-!C9pPBf*IBQBZB`"PAf9MBPpM,Q-!C9p
+PBf*IC#jM!'9IC@0LAfNZB`"PAf9MBPpb-LjM!'9IC@0LAh)e,Q-!C9pZG@aX,Q-
+!C9p[CQ*I-f3ZB`"PAfpQBPpLCLjM!'9IEfCLAf-ZB`"PAfpQBPpN,Q-!C9p[CQ*
+ID5jM!'9IEfCLAh)b,Q-!C9p[CQ*IFM8ZB`"PAh*M0#jM!'9IH'0LBepN,Q-!E9p
+NFh-ZB`"YAf4cFc%ZB`"YAfeN-LjM!'eIE@3e,Q-!E9pYC'-b,Q-!E9pZG@aX,Q-
+!E9pbDA"PE@3ZB`"YAh0SB5jM!'eIFfKK-5jM!'jKE@9c,Q-!F&pNC@-ZB`"`Af9
+ZBbjM!("IE'PL,Q-!F&p[F'9Z,Q-!F&pcC@&X,Q-!F&pcD@GZ,Q-!F&pfCA*TCRN
+ZB`"SE@&M,Q-!D9pMBQ-ZB`"TAf0QBMBd,Q-!D9pPBf)ZB`"TAfpQBMBd,Q-!D9p
+cDf9j,Q-!E'KKFfJZB`"XD&pcG'&dFbjM!'eN-PpNCh0d,Q-!E@3bAfpZC5jM!'e
+N09pNCh0d,Q-!E@3eAfpZC5jM!'eNBc*NCh0d,Q-!E@4M-Pp[EQ8ZB`"[BQTIC'&
+d,Q-!Ef*UAf9bFLjM!'pLDPpXD@)ZB`"[AfjKE@9c,Q-!F'9YAf&XE#jM!("PE9p
+PFR)ZB`"`C@eID@jQEbjM!("PE9pXD@)ZB`"`C@eIFf9KE#jM!("PE9pcD@GZ,Q-
+!F$%bAf&NC#jM!(!a-PpKG(4b,Q-!F$%bAf*KCh-ZB`"`-6*IBh*`G#jM!(!a-Pp
+MFR3ZB`"`-6*IC'9MFLjM!(!a-PpTEQPd,Q-!F$%bAfYPH5jM!(!a-PpVDA0c,Q-
+!F$%bAfaTBLjM!(!a-PpYB@-ZB`"`-6*IEA9dE#jM!(!a-PpcBQ&R,Q-!F$%bAh9
+dE#jM!("V-6*PFR)ZB`"`DcGIC'pTG#jM!("V0epXD@)ZB`"`Df0c0f9bFLjM!'e
+NAh*KEQ3ZB`"bB@jNCQPXC5jM!(*KEQ4IE'PL,Q-!FQ-bBfCL0M3ZB`"bBc*[CQ)
+f0#jM!(*M-PpMBQ-ZB`"bBc*IC@0L,Q-!FQ-bAh0VCANZB`"bBc4IC@jM,Q-!FQ-
+dAh0VCANZB`"bBc9MCQ)f0#jM!(*M0@pQBMBd,Q-!FQ-eAf9MBLjM!(*M09pPEQ-
+ZB`"bBc9IFfYPH5jM!(*YC&pNCh0d,Q-!FQeNAfpZC5jM!(*cB9pPBANZB`"bFf&
+ICA*b,Q-!FR0KAfGPELjM!(*cB9pXD@)ZB`"bFf&IEQpZC5jM!(*cB9p[B@9`,Q-
+!FR0KAh"V-5jM!(*cB9pcB@pc,Q-!FR0KAh0TCfiZB`"bFf&IFh0X,Q-!FfKK-@4
+RFh3ZB`"cD'%aAfpZC5jM!(0SB9pNCh0d,Q-!FfKKAfpZC5jM!(0dB@0V,Q-!G(K
+dAf4L,Q-!BRPIC'Pb,Q-!BRPICQPXC5jM!(Je-$PZB@eP,Q-!H$8`1A*cCA3ZB`"
+i06!jG(P`C5jM!(Je-$PIBfe`,Q-!H$8`19pN-LjM!(Je-$PIC'9Q,Q-!H$8`19p
+PFR)ZB`"i06!jAf9iG#jM!(Je-$PIE(8ZB`"i06!jAfpLDLjM!(Je-$PIFM*i,Q-
+!H$8`19pbCA%ZB`"i06!jAh0PG#jM!(Je-$PIG(Kd,Q-!H$8`19pf-bjM!(Je-$P
+IGQCj,Q-!H&pKE'`ZB`"f-f9bFLjM!(BcAf&VCANZB`"f-epKE(3ZB`"f-epLBfp
+ZFbjM!(BcAf*TG(0d,Q-!GM0IBfpZCLjM!(BcAf0`Efac,Q-!GM0IBh*XC#jM!(B
+cAf9ZG@dZB`"f-epPH(4VG5jM!(BcAfGPEQiZB`"f-epTB68ZB`"f-epTER3ZB`"
+f-epXD@)ZB`"f-ep`Dh8ZB`"f-ep`FQiZB`"f-epcDf9j,Q-!GM0IFhKZCA3ZB`"
+f-epeG'`ZB`"MF(4ICA*b,Q-!Bh*jF(4XD@)ZB`"PH&pNBA4K,Q-!E@9Y,Q-!690
+-)&0*6e9B,P"33bj-D@)!BQCIBR9QCLjM!(KIH$8`1@%ZB`"NFf&IEh0cE#jM!(J
+e-$PcF'YT,Q-!H$8`19pdFR-ZB`"f-ep`GA*`,Q-!GM0ID@jQEbjM!'*IF(*TER3
+ZB`"KAfeLFh4b,Q-!G&pcF'YT,Q-!G&pi06!jB5jM!(4IBQPdFh3ZB`"KAh0dFQj
+TC#jM!'*TEepMBLjM!'*cFepYC@dZB`"LFh0ICQ3ZB`"LFh0ICQPXC5jM!'*cFep
+ZG@aX,Q-!BQCIER9XE#jM!'*QAfjLD@mZB`"LFh0IBQP[,Q-!BPpNG@e`,Q-!C@j
+MAhGbDA3ZB`"`09pMFR"d,Q-!F$9IBh*`G$)ZB`"`-6*IER"KFbjM!("V0epKG(4
+b,Q-!F'XhAfeTE@8ZB`"`DcGIFfeTE@8ZB`"bFf&IBfKV,Q-!FR0KAfjeE'`ZB`"
+MGQ9bFfP[ELjM!%038h4bD@jR9A4TE(-ZBh"`!%9bFQpb5'&ZC'aTEQFZBh"`!%G
+PG%K89&"6,Q0`F!"0B@06Ef0VCA3ZBh"`!'ePE9pNBQFZB`"36&0dFQPZCdCeEQ0
+c8&"$,QaTBJ"LEPpMG(JZB`"bB@jNAf9bFLjM!(J!BA"`FbjM!'&`F&pbB@jN,Q-
+!BA0Z-A"KFR-ZB`"MB5jM!'0TF'KPFR-ZB`"MFQ`ZB`"MFQ`bF$FZB`"NCh0d,Q-
+!C'JZB`"NFf%ZB`"NFf&`BA*KE5jM!'9ZBbjM!'9bFR0dFLjM!'GPEQ4S,Q-!Cf9
+ZC(0K,Q-!Cf9ZFR0K,Q-!ER0PF5jM!'p`C@jcFf`ZB`"`Df0c-6)ZB`"`Df0c0bj
+M!("VBh-i,Q-!FQ9a,Q-!FR0K,Q-!Ff9cFepTC#jM!(0YD@eP,Q-!Fh"PC@3ZB`"
+cF'YKBbjM!(0IBf)ZB`"cAf0XD@9ZG#jM!(0IFf9bGQ9b,Q-!FepcEf0VCA3ZB`"
+fCA*TCRNZB`"fCA*cD@pZ,Q-!H$8`15jM!(0IG'PYC5jM!%G98dPI5@jTG#jMF(!
+!4e9659p$Eh*P,P"33bj-D@)!4e9659p08d`Z8&"$,NaTBJ"(990*Ae0*6e9B,P"
+33bj-D@)!6'PL8e0-,P"33bj-D@)!6'PL3h*jF(4[,P"33bj-D@)!6@&M6e-ZE'P
+L!%e66#"5G@jdD@eP0MK,,NaTBJ"2F'9Z9("d5@jPG#j[!%p`C@j8FQ&ZFh"[FR3
+ZE`"2F'9Z9(*KER0`Eh*d3A"`,Qm!690-)&0*6e9B,MBi5bj-D@)!690-)%-Z0MK
+,)%CK+$4TAcKN+5j-D@)!6@&dD%aTBMBi5b"'B5JdD9miC#NZ6'PL!%CTFR0d)&0
+PCfePER3!4e9659p$Eh*P,MBi5bj-D@)!4e9659p08d`Z0MK,,NaTBJ"(990*Ae0
+*6e9B,MBi5bj-D@)!6'PL3h*jF(4[,MBiDb"'B5JdD9miC#NZ6'PL!%aTBP066#i
+f1%XJ4Q%S0'PI1'3T,NaTBJ"(CA4)9&438b"38%-!6h"PEP066#"38%-!4f9d5&4
+88&-J0MK,!%aTBP066#!f1%X!6h"PEP066#!f1'X!6'PL8e0-)&"33`"-D@*$FRP
+`G'mJ8&"$!%aTBN0bHA"dEb!f1%X!1NGPG%K89&"6+&"33bN!6'PL)%PYF'pbG#"
+38%-!3Q&XE'p[EL")C@a`!%eA)%-[3bXV)&"33`"(B@eP3fpNC5"$EfjfCA*dCA)
+!4QaPH#"3FQ9`FQpMCA0cEh)!69FJ8'&cBf&X)&"33`"5CAS!8&"$3A0Y!%*TFfp
+Z)&"bCA"bEf0PFh0[FJ"B3dp'4L"*EA"[FR3J8&"$!&"&4L"*EA"[FR3J8&"$!$T
+2F'9Z8e0-!$T(CA4)9&438bJf1%XT!%aTBL"*EA"[FR3J0MK,!%e39b"*EA"[FR3
+J0MK,!%eA)%-[3bXV)$Bi5`"09b"3BA0MB@`J0MK,!&"&4L"*EA"[FR3J0MK,!$T
+-D@*68d`Z0MK,)%CK+$4TAcKN+5j-D@)!1Np`C@j68d`S0MKV+3!k6'PL8e0-,P"
+33bj-D@)!1NaTBN0bHA"dEbj38%-Z6'PL!$T-D@*$FRP`G'mZ0MKV)%CK+$4TAcK
+N+5j-D@)!6@&M6e-J8&"$)%aTEQYPFJ"0B@028b!f1%XJ6'PZDf9b!&0[GA*MC5"
+8FQ9PF`"$GA0dEfdJ5f9jGfpbC(-!3@0MCA0c)&"KG'Kc!&4KFQGPG#"6CA4dD@j
+RF`"'D@aP)%eKF("TEQGc!%*eD@aN)%9iG(*KF`"%C@*eCfGPFL"5G@jdD@eP!%4
+PBR9RCf9b)&4KFQGPG!"$,d-V+b"$Efe`D@aPFJ"$,d-V+b"ABA*ZD@jRF`"38%-
+J3fpNC8GPEJ"38%-J4'PcBA0cC@eLE'9b!&"33b"(E'pLB@`J6h"dD@eTHQ9b!&"
+33b"-D@jVCA)!8&"$)&"&4J"38%-J8(*[DQ9MG!"38%0"FfdJ8'&ZC@`!8Q9k)%0
+[EA"TE'9b!$Bi5b"$Ef4P4f9Z!$Bi5b"%DA0KFh0PE@*XCA)!0MK,)%GXEf*KE#"
+2F(4TE@PkCA)!0MK,)%aTEQYPFJ!f1%XJ8(*[DQ9MG!"$4Ndf1%X!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!!!!!!!$J!
+!!!)!!!!!!!!!'`!!!!-!!!!!!!!!)`!!!!3!!!!!!!!!0J!!!!8!!!!!!!!!4`!
+!!!B!!!!!!!!!@J!!!!F!!!!!!!!!F3!!!!J!!!!!!!!!JJ!!!!N!!!!!!!!!M3!
+!!!S!!!!!!!!!P`!!!!X!!!!!!!!!SJ!!!!`!!!!!!!!!V!!!!!d!!!!!!!!!Y`!
+!!!i!!!!!!!!!`3!!!!m!!!!!!!!!c!!!!"!!!!!!!!!!eJ!!!"%!!!!!!!!!h`!
+!!")!!!!!!!!!k!!!!"-!!!!!!!!!mJ!!!"3!!!!!!!!!q`!!!"8!!!!!!!!""3!
+!!"B!!!!!!!!"$`!!!"F!!!!!!!!"'3!!!"J!!!!!!!!")J!!!"N!!!!!!!!"+`!
+!!"S!!!!!!!!"03!!!"X!!!!!!!!"2J!!!"`!!!!!!!!"5!!!!"d!!!!!!!!"8`!
+!!"i!!!!!!!!"AJ!!!"m!!!!!!!!"D3!!!#!!!!!!!!!"G!!!!#%!!!!!!!!"IJ!
+!!#)!!!!!!!!"L3!!!#-!!!!!!!!"N`!!!#3!!!!!!!!"R3!!!#8!!!!!!!!"U!!
+!!#B!!!!!!!!"X`!!!#F!!!!!!!!"[3!!!#J!!!!!!!!"a`!!!#N!!!!!!!!"d!!
+!!#S!!!!!!!!"f3!!!#X!!!!!!!!"i`!!!#`!!!!!!!!"l3!!!#d!!!!!!!!"q!!
+!!#i!!!!!!!!#!`!!!#m!!!!!!!!#$J!!!$!!!!!!!!!#'3!!!$%!!!!!!!!#*!!
+!!$)!!!!!!!!#,!!!!$-!!!!!!!!#03!!!$3!!!!!!!!#2`!!!$8!!!!!!!!#5J!
+!!$B!!!!!!!!#93!!!$F!!!!!!!!#A3!!!$J!!!!!!!!#CJ!!!$N!!!!!!!!#F!!
+!!$S!!!!!!!!#H!!!!$X!!!!!!!!#J`!!!$`!!!!!!!!#L`!!!$d!!!!!!!!#P!!
+!!$i!!!!!!!!#R`!!!$m!!!!!!!!#U3!!!%!!!!!!!!!#X`!!!%%!!!!!!!!#Z`!
+!!%)!!!!!!!!#a!!!!%-!!!!!!!!#c3!!!%3!!!!!!!!#eJ!!!%8!!!!!!!!#i!!
+!!%B!!!!!!!!#k3!!!%F!!!!!!!!#p!!!!%J!!!!!!!!#r!!!!%N!!!!!!!!$"J!
+!!%S!!!!!!!!$%3!!!%X!!!!!!!!$'J!!!%`!!!!!!!!$)`!!!%d!!!!!!!!$,J!
+!!%i!!!!!!!!$13!!!%m!!!!!!!!$4!!!!&!!!!!!!!!$6`!!!&%!!!!!!!!$@J!
+!!&)!!!!!!!!$B`!!!&-!!!!!!!!$D`!!!&3!!!!!!!!$GJ!!!&8!!!!!!!!$J!!
+!!&B!!!!!!!!$L`!!!&F!!!!!!!!$P!!!!&J!!!!!!!!$R3!!!&N!!!!!!!!$U!!
+!!&S!!!!!!!!$X`!!!&X!!!!!!!!$[J!!!&`!!!!!!!!$b3!!!&d!!!!!!!!$d3!
+!!&i!!!!!!!!$fJ!!!&m!!!!!!!!$i`!!!'!!!!!!!!!$lJ!!!'%!!!!!!!!$q!!
+!!')!!!!!!!!%!3!!!'-!!!!!!!!%$!!!!'3!!!!!!!!%&3!!!'8!!!!!!!!%(J!
+!!'B!!!!!!!!%*`!!!'F!!!!!!!!%-J!!!'J!!!!!!!!%23!!!'N!!!!!!!!%5!!
+!!'S!!!!!!!!%83!!!'X!!!!!!!!%@`!!!'`!!!!!!!!%B`!!!'d!!!!!!!!%E!!
+!!'i!!!!!!!!%G!!!!'m!!!!!!!!%I3!!!(!!!!!!!!!%K`!!!(%!!!!!!!!%NJ!
+!!()!!!!!!!!%Q`!!!(-!!!!!!!!%S`!!!(3!!!!!!!!%V3!!!(8!!!!!!!!%YJ!
+!!(B!!!!!!!!%[`!!!(F!!!!!!!!%b!!!!(J!!!!!!!!%d`!!!(N!!!!!!!!%f`!
+!!(S!!!!!!!!%i`!!!(X!!!!!!!!%l!!!!(`!!!!!!!!%p!!!!(d!!!!!!!!%r3!
+!!(i!!!!!!!!&#!!!!(m!!!!!!!!&%3!!!)!!!!!!!!!&'J!!!)%!!!!!!!!&*3!
+!!))!!!!!!!!&,`!!!)-!!!!!!!!&13!!!)3!!!!!!!!&3`!!!)8!!!!!!!!&6J!
+!!)B!!!!!!!!&9`!!!)F!!!!!!!!&B!!!!)J!!!!!!!!&D`!!!)N!!!!!!!!&G!!
+!!)S!!!!!!!!&I3!!!)X!!!!!!!!&KJ!!!)`!!!!!!!!&N!!!!!#0!!!!!!!!"CN
+!!!#1!!!!!!!!"D)!!!#2!!!!!!!!"D`!!!#3!!!!!!!!!!@e!!!!N3!!!!!!!!@
+q!!!!NJ!!!!!!!!A*!!!!N`!!!!!!!!A8!!!!P!!!!!!!!!AH!!!!P3!!!!!!!!A
+S!!!!PJ!!!!!!!!Ac!!!!P`!!!!!!!!Am!!!!Q!!!!!!!!!B'!!!!Q3!!!!!!!!B
+2!!!!QJ!!!!!!!!BC!!!!Q`!!!!!!!!BM!!!!R!!!!!!!!!BV!!!!R3!!!!!!!!B
+c!!!!RJ!!!!!!!!Bp!!!!R`!!!!!!!!C'!!!!S!!!!!!!!!C4!!!!S3!!!!!!!!C
+C!!!!SJ!!!!!!!!CL!!!!S`!!!!!!!!CT!!!!T!!!!!!!!!Cd!!!!T3!!!!!!!!C
+r!!!!TJ!!!!!!!!D*!!!!T`!!!!!!!!D8!!!!U!!!!!!!!!DI!!!!U3!!!!!!!!D
+T!!!!UJ!!!!!!!!Dc!!!!U`!!!!!!!!Dq!!!!V!!!!!!!!!E)!!!!V3!!!!!!!!E
+A!!!!VJ!!!!!!!!EL!!!!V`!!!!!!!!EV!!!!X!!!!!!!!!Ef!!!!X3!!!!!!!!F
+"!!!!XJ!!!!!!!!F-!!!!X`!!!!!!!!F@!!!!Y!!!!!!!!!FK!!!!Y3!!!!!!!!F
+X!!!!YJ!!!!!!!!Fh!!!!Y`!!!!!!!!G#!!!!Z!!!!!!!!!G0!!!!Z3!!!!!!!!G
+A!!!!ZJ!!!!!!!!GK!!!!Z`!!!!!!!!GV!!!![!!!!!!!!!Gb!!!![3!!!!!!!!G
+p!!!![J!!!!!!!!H)!!!![`!!!!!!!!H4!!!!`!!!!!!!!!HD!!!!`3!!!!!!!!H
+M!!!!`J!!!!!!!!HX!!!!``!!!!!!!!Hh!!!!a!!!!!!!!!I"!!!!a3!!!!!!!!I
+,!!!!aJ!!!!!!!!I9!!!!a`!!!!!!!!II!!!!b!!!!!!!!!IU!!!!b3!!!!!!!!I
+d!!!!bJ!!!!!!!!Ik!!!!b`!!!!!!!!J%!!!!c!!!!!!!!!J1!!!!c3!!!!!!!!J
+B!!!!cJ!!!!!!!!JL!!!!c`!!!!!!!!JV!!!!d!!!!!!!!!Jd!!!!d3!!!!!!!!J
+m!!!!dJ!!!!!!!!K&!!!!d`!!!!!!!!K1!!!!e!!!!!!!!!KB!!!!e3!!!!!!!!K
+L!!!!eJ!!!!!!!!KX!!!!e`!!!!!!!!Kf!!!!f!!!!!!!!!L!!!!!f3!!!!!!!!L
+,!!!!fJ!!!!!!!!L@!!!!f`!!!!!!!!LK!!!!h!!!!!!!!!LV!!!!h3!!!!!!!!L
+e!!!!hJ!!!!!!!!Lr!!!!h`!!!!!!!!M+!!!!i!!!!!!!!!M9!!!!i3!!!!!!!!M
+J!!!!iJ!!!!!!!!MV!!!!i`!!!!!!!!Me!!!!j!!!!!!!!!Mr!!!!j3!!!!!!!!N
+*!!!!jJ!!!!!!!!N8!!!!j`!!!!!!!!NI!!!!k!!!!!!!!!NU!!!!k3!!!!!!!!N
+e!!!!kJ!!!!!!!!Nr!!!!k`!!!!!!!!P*!!!!l!!!!!!!!!P6!!!!l3!!!!!!!!P
+H!!!!lJ!!!!!!!!PT!!!!l`!!!!!!!!Pb!!!!m!!!!!!!!!Pp!!!!m3!!!!!!!!Q
+)!!!!mJ!!!!!!!!Q5!!!!m`!!!!!!!!QF!!!!p!!!!!!!!!QQ!!!!p3!!!!!!!!Q
+a!!!!pJ!!!!!!!!Qm!!!!p`!!!!!!!!R%!!!!q!!!!!!!!!R2!!!!q3!!!!!!!!R
+A!!!!qJ!!!!!!!!RJ!!!!q`!!!!!!!!RS!!!!r!!!!!!!!!R`!!!!r3!!!!!!!!R
+j!!!!rJ!!!!!!!!S#!!!!r`!!!!!!!!S0!!!"!!!!!!!!!!S9!!!"!3!!!!!!!!S
+H!!!"!J!!!!!!!!SQ!!!"!`!!!!!!!!SZ!!!""!!!!!!!!!Sf!!!""3!!!!!!!!S
+q!!!""J!!!!!!!!T(!!!""`!!!!!!!!T3!!!"#!!!!!!!!!TC!!!"#3!!!!!!!!T
+N!!!"#J!!!!!!!!TV!!!"#`!!!!!!!!Tc!!!"$!!!!!!!!!Tp!!!"$3!!!!!!!!U
+&!!!"$J!!!!!!!!U2!!!"$`!!!!!!!!UB!!!"%!!!!!!!!!UJ!!!"%3!!!!!!!!U
+V!!!"%J!!!!!!!!Uf!!!"%`!!!!!!!!V!!!!"&!!!!!!!!!V,!!!"&3!!!!!!!!V
+9!!!"&J!!!!!!!!VJ!!!"&`!!!!!!!!VV!!!"'!!!!!!!!!Ve!!!"'3!!!!!!!!V
+r!!!"'J!!!!!!!!X*!!!"'`!!!!!!!!X6!!!"(!!!!!!!!!XG!!!"(3!!!!!!!!X
+R!!!"(J!!!!!!!!Xb!!!"(`!!!!!!!!Xm!!!")!!!!!!!!!Y(!!!")3!!!!!!!!Y
+5!!!")J!!!!!!!!YF!!!")`!!!!!!!!YR!!!"*!!!!!!!!!Yb!!!"*3!!!!!!!!Y
+p!!!"*J!!!!!!!!Z(!!!"*`!!!!!!!!Z5!!!"+!!!!!!!!!ZG!!!"+3!!!!!!!!Z
+R!!!"+J!!!!!!!!Zb!!!"+`!!!!!!!!Zm!!!",!!!!!!!!!['!!!",3!!!!!!!![
+4!!!",J!!!!!!!![F!!!",`!!!!!!!![Q!!!"-!!!!!!!!![`!!!"-3!!!!!!!![
+l!!!"-J!!!!!!!!`&!!!"-`!!!!!!!!`3!!!"0!!!!!!!!!`D!!!"03!!!!!!!!`
+P!!!"0J!!!!!!!!``!!!"0`!!!!!!!!`l!!!"1!!!!!!!!!a'!!!"13!!!!!!!!a
+3!!!"1J!!!!!!!!aD!!!"1`!!!!!!!!aP!!!"2!!!!!!!!!a[!!!"23!!!!!!!!a
+k!!!"2J!!!!!!!!b&!!!"2`!!!!!!!!b3!!!!!8!!!!!!!!!-QJ!!!8%!!!!!!!!
+-T!!!!8)!!!!!!!!-V`!!!8-!!!!!!!!-ZJ!!!83!!!!!!!!-a!!!!88!!!!!!!!
+-cJ!!!8B!!!!!!!!-f!!!!8F!!!!!!!!-iJ!!!8J!!!!!!!!-l!!!!8N!!!!!!!!
+-p`!!!8S!!!!!!!!0!J!!!8X!!!!!!!!0$!!!!8`!!!!!!!!0&`!!!8d!!!!!!!!
+0)J!!!8i!!!!!!!!0,!!!!8m!!!!!!!!00`!!!9!!!!!!!!!03J!!!9%!!!!!!!!
+063!!!9)!!!!!!!!09`!!!9-!!!!!!!!0A`!!!93!!!!!!!!0D!!!!98!!!!!!!!
+0F3!!!9B!!!!!!!!0H`!!!9F!!!!!!!!0KJ!!!9J!!!!!!!!0N3!!!9N!!!!!!!!
+0R!!!!9S!!!!!!!!0T`!!!9X!!!!!!!!0X3!!!9`!!!!!!!!0[!!!!9d!!!!!!!!
+0a`!!!9i!!!!!!!!0dJ!!!9m!!!!!!!!0h!!!!@!!!!!!!!!0j`!!!@%!!!!!!!!
+0mJ!!!@)!!!!!!!!0r3!!!@-!!!!!!!!1#!!!!@3!!!!!!!!1%`!!!@8!!!!!!!!
+1(3!!!@B!!!!!!!!1+!!!!@F!!!!!!!!1-!!!!@J!!!!!!!!11!!!!@N!!!!!!!!
+13J!!!@S!!!!!!!!15`!!!@X!!!!!!!!19J!!!@`!!!!!!!!1B3!!!@d!!!!!!!!
+1D`!!!@i!!!!!!!!1GJ!!!@m!!!!!!!!1J!!!!A!!!!!!!!!1LJ!!!A%!!!!!!!!
+1P3!!!A)!!!!!!!!1R`!!!A-!!!!!!!!1U!!!!A3!!!!!!!!1X3!!!A8!!!!!!!!
+1ZJ!!!AB!!!!!!!!1``!!!AF!!!!!!!!1c!!!!AJ!!!!!!!!1eJ!!!AN!!!!!!!!
+1i3!!!AS!!!!!!!!1kJ!!!AX!!!!!!!!1p!!!!A`!!!!!!!!1r`!!!Ad!!!!!!!!
+2#3!!!Ai!!!!!!!!2$`!!!Am!!!!!!!!2)3!!!B!!!!!!!!!2+`!!!B%!!!!!!!!
+203!!!B)!!!!!!!!23!!!!B-!!!!!!!!25`!!!B3!!!!!!!!29J!!!B8!!!!!!!!
+2B!!!!BB!!!!!!!!2DJ!!!BF!!!!!!!!2G!!!!BJ!!!!!!!!2IJ!!!BN!!!!!!!!
+2K`!!!BS!!!!!!!!2N3!!!BX!!!!!!!!2Q`!!!B`!!!!!!!!2TJ!!!Bd!!!!!!!!
+2V`!!!Bi!!!!!!!!2Z3!!!Bm!!!!!!!!2`J!!!C!!!!!!!!!!$md!!!'4!!!!!!!
+!$pJ!!!'5!!!!!!!!$q)!!!'6!!!!!!!!$q`!!!'8!!!!!!!!$rB!!!'9!!!!!!!
+!$rm!!!'@!!!!!!!!%!S!!!'A!!!!!!!!%"3!!!'B!!!!!!!!%"m!!!'C!!!!!!!
+!%#S!!!'D!!!!!!!!%$8!!!'E!!!!!!!!%%!!!!'F!!!!!!!!%%`!!!'G!!!!!!!
+!%&B!!!'H!!!!!!!!%'%!!!'I!!!!!!!!%'`!!!'J!!!!!!!!%(i!!!'K!!!!!!!
+!%*!!!!!"SJ!!!!!!!"#G!!!"S`!!!!!!!"#V!!!"T!!!!!!!!"#e!!!"T3!!!!!
+!!"$+!!!"TJ!!!!!!!"$6!!!"T`!!!!!!!"$H!!!"U!!!!!!!!"$J!!!"U3!!!!!
+!!"$R!!!"UJ!!!!!!!"$b!!!"U`!!!!!!!"$p!!!"V!!!!!!!!"%#!!!"V3!!!!!
+!!"%-!!!"VJ!!!!!!!"%5!!!"V`!!!!!!!"%E!!!"X!!!!!!!!"%L!!!"X3!!!!!
+!!"%R!!!"XJ!!!!!!!"%Y!!!"X`!!!!!!!"%i!!!"Y!!!!!!!!"%q!!!"Y3!!!!!
+!!"&(!!!"YJ!!!!!!!"&2!!!"Y`!!!!!!!"&B!!!"Z!!!!!!!!"&K!!!"Z3!!!!!
+!!"&S!!!"ZJ!!!!!!!"&b!!!"Z`!!!!!!!"&l!!!"[!!!!!!!!"'$!!!"[3!!!!!
+!!"',!!!"[J!!!!!!!"'4!!!"[`!!!!!!!"'A!!!"`!!!!!!!!"'K!!!"`3!!!!!
+!!"'T!!!"`J!!!!!!!"'a!!!"``!!!!!!!"'j!!!"a!!!!!!!!"(!!!!"a3!!!!!
+!!"(,!!!"aJ!!!!!!!"(@!!!"a`!!!!!!!"(K!!!"b!!!!!!!!"(U!!!"b3!!!!!
+!!"(d!!!"bJ!!!!!!!"(l!!!"b`!!!!!!!")%!!!"c!!!!!!!!")5!!!"c3!!!!!
+!!")N!!!"cJ!!!!!!!")e!!!"c`!!!!!!!"*)!!!"d!!!!!!!!"*A!!!"d3!!!!!
+!!"*T!!!"dJ!!!!!!!"*c!!!"d`!!!!!!!"+'!!!"e!!!!!!!!"+8!!!"e3!!!!!
+!!"+N!!!"eJ!!!!!!!"+h!!!"e`!!!!!!!",*!!!"f!!!!!!!!",K!!!"f3!!!!!
+!!",k!!!"fJ!!!!!!!"-)!!!"f`!!!!!!!"-D!!!"h!!!!!!!!"-V!!!"h3!!!!!
+!!"-q!!!"hJ!!!!!!!"0D!!!"h`!!!!!!!"0c!!!"i!!!!!!!!"1!!!!"i3!!!!!
+!!"1-!!!"iJ!!!!!!!"1C!!!"i`!!!!!!!"1N!!!"j!!!!!!!!"1`!!!"j3!!!!!
+!!"1l!!!"jJ!!!!!!!"2*!!!"j`!!!!!!!"2A!!!"k!!!!!!!!"2Q!!!"k3!!!!!
+!!"2e!!!"kJ!!!!!!!"3#!!!"k`!!!!!!!"32!!!"l!!!!!!!!"3L!!!"l3!!!!!
+!!"3d!!!"lJ!!!!!!!"4#!!!"l`!!!!!!!"4'!!!"m!!!!!!!!"40!!!"m3!!!!!
+!!"4J!!!"mJ!!!!!!!"4a!!!"m`!!!!!!!"5!!!!"p!!!!!!!!"5*!!!"p3!!!!!
+!!"5B!!!"pJ!!!!!!!"5R!!!"p`!!!!!!!"5f!!!"q!!!!!!!!"6$!!!"q3!!!!!
+!!"64!!!"qJ!!!!!!!"6J!!!"q`!!!!!!!"6k!!!"r!!!!!!!!"8)!!!"r3!!!!!
+!!"8B!!!"rJ!!!!!!!"8V!!!"r`!!!!!!!"9)!!!#!!!!!!!!!"9C!!!#!3!!!!!
+!!"9U!!!#!J!!!!!!!"9h!!!#!`!!!!!!!"@(!!!#"!!!!!!!!"@8!!!#"3!!!!!
+!!"@N!!!#"J!!!!!!!"@b!!!#"`!!!!!!!"@r!!!##!!!!!!!!"A3!!!##3!!!!!
+!!"AJ!!!##J!!!!!!!"A[!!!##`!!!!!!!"Aq!!!#$!!!!!!!!"B+!!!#$3!!!!!
+!!"BE!!!#$J!!!!!!!"B`!!!#$`!!!!!!!"Bl!!!#%!!!!!!!!"C$!!!#%3!!!!!
+!!"C2!!!#%J!!!!!!!"CF!!!#%`!!!!!!!"CT!!!#&!!!!!!!!"Ce!!!#&3!!!!!
+!!"D'!!!#&J!!!!!!!"DE!!!#&`!!!!!!!"DQ!!!#'!!!!!!!!"Db!!!#'3!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!!)
+!!!!$!!!!"!!!!!8!!!!'!!!!"`!!!!J!!!!*!!!!,3!!!!S!!!!,!!!!$!!!!!d
+!!!!1!!!!$`!!!"!!!!!4!!!!%J!!!"-!!!!8!!!!&3!!!"B!!!!A!!!!'!!!!"N
+!!!!D!!!!'`!!!"`!!!!G!!!!(J!!!"m!!!!J!!!!)3!!!#)!!!!M!!!!*!!!!#8
+!!!!Q!!!!*`!!!#J!!!!T!!!!+J!!!#X!!!!X!!!!,J!!!#m!!!!`!!!!-3!!!$)
+!!!!c!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!0!!!!%!#!!!!!J!!0!!!!!!!!!!"!!!!!J!!!!-!!!!%!!!!"3!!!!B
+!!!!(!!!!#!!!!!N!!!!+!!!!#`!!!!`!!!!0!!!!$J!!!!m!!!!3!!!!%3!!!")
+!!!!@!!!!'`!!!"J!!!!C!!!!'J!!!"`!!!!G!!!!&`!!!"-!!!!8!!!!&3!!!"m
+!!!!H!!!!)!!!!#!&!!!!"3!!)!!!!KN!!!)J!!!@Z3!!'!!!!!)C!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!#!!!#!!!!!J%!!!&P!!!![!!!!'m!!!&Q!!!!F!!!!(%
+!!!"b!!!!F`!!!(3!!!"e!!!!GJ!!!(F!!!"i!!!!H3!!!(S!!!"l!!!!I!!!!B!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#`MlJ!!!!!!!!!3!
+#`NI`!!)!!!!!!!!!!!!!!X)fJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!)!!!%!!!!!"3!!Irm!!!!!Irm!!!!!Irm!!!!!Irm!!!!-!!%!!J!%!!!
+!"8!!!!B!!3!"1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!%!!!$rrrrr!!!!!`!"!!%k1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!3!!!2rrrrm!!!!%!!%!!6SkD@jME(9NC6S!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!rrrrrd!!!!)!!3!"1J!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$rrrrr3!!!!`!#!!%k6@&M6e-
+J8h9`F'pbG$S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!2rrrrp!!!!%!!)
+!!6T08d`k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrr
+rrd!!!!8!#J!!6@&M6e-J8&"$)%aTEQYPFJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!4f9d5&488&-J8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!%k!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!!&0B@028b"38%-J6'PZDf9b!!!
+!!!!!!!!!!!!!!!!!!!!H39"36!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!3A"`E!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"J!!!!68e-3J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!6'PL)%PYF'pbG#"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69"-4J!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!6'PL)%PYF'pbG#"38%-!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!69G$4!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!8P053`!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"J!!!!9%9B9#jLD!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!3Q&XE'p[EL")C@a`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jM!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ3bp$+bXJ8&"$!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!9%9B9#jM+bX!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!69FJ3bp$+bXJ8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jMB`!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ3bp$+bXJ8&"$!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!9%9B9#jMF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!69FJ3bp$+bXJ8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jMF(!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ3bp$+bXJ8&"$!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!9%9B9#jPH(!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jRB`!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!4f&YC80[C'8J3fpZGQ9bG'9b!!!
+!!!!!!!!!!!!!!!"!!!!!9%9B9#jS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!69FJ3bp$+bXJ8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!!9%9B9#jX!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!4QaPH#"3FQ9`FQpMCA0cEh)!!!!
+!!!!!!!!!!!!!!!#!!!!!9%9B9#j`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!69FJ8'&cBf&X)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#j`BA-
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ8'&cBf&X)&"33`!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!9%9B9#j`BfJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!69FJ3bp$+bXJ8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!#!!!!!9%9B9#j`BfJ
+V+`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ3bp$+bXJ8&"$!!!!!!!!!!!
+!!!!!!!!!!!!!!!#!!!!!9%9B9#j`F(8!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!69FJ8'&cBf&X)&"33`!!!!!!!!!!!!!!!!!!!!!!!!#!!!!!9%9B9#jb!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8Q9k!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!9%9B9#jc!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!8&"$3A0Y!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jj!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3QPcEfiJ8(*PF(*[Bf9cFfpb!!!
+!!!!!!!!!!!!!!!#!!!!!@%024J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!@%024NBJ5@e`Eh*d)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!C'pMG3!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"J!!!!FR0bB`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!FfKXBJ!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8%9')%PYF'pbG#"38%-!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!Fh4eBJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!8%9')%PYF'pbG#"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#jNEf-
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"3!!!!!!8"!3!"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!!"!!!
+!!!8!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!"!3!!E@&TEJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!3!"!!!!!3%"!3%!!3%!!!!!!!%"!!!
+"!3!"!!!"!!%!!!!!!!!!!!!)!3!"!3!"!3!!!!%!!!N!!"G0B@028b"8EfpXBQp
+i)%4&3P9()$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!r2cmr39"36!!!!B"B`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$mr2cm!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!0!!%!!!!!!""I69G&8NY6Ah"bC@CTH#jS!!!!!!!!!!!!!!!!!!!!!!!
+"!!!"!!!!!!!"!!!!!!!!!!!!!!8"!3%!!!%"!!%!!!!!"!!!!!!!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"IAh0dBA*d!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!3!!#8ePFQGP)%peG!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$m
+r2cp"8&"-!!%"!!!%)#!J)!15Jf!$G0pi!`1Yi!!&!J%!!3%!!3%"!!!"!!!!!!!
+!!!%"!3%!!3%!!3!""!!!!!!!!!!!!!!(!3%!!3!!!3!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+IAh0dBA*d!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8!!!e(CA4)9&438bK38%-T!!!!!!!
+!!!!!!!!!!!!!!!!!2cmr2d&38%`!!!3!!!!%!!!!!%!!!&M!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%r2cmr!!!!!!!
+!!!)!!!!#!!)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+#!&!!!3!"!!%!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8*d024%8R)#G%394"*b!R8%P$9#F
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!3!
+!!!%#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!)!!!!#!J%!!!!
+!!!%!!3-!!!!!!!!!!!!!!!!%!!!!!!!!!!!"!!!$!!!!!`)"!!!!!!!"!!%$!!!
+!!!!!!!!!!!!!"!!!!!!!!!!!!3!!"!!!!!3#!3!!!!!!!3!"!`!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!%!!!8!!!!&!J%!!!!!!!%!!3-!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!'!!!!"J)"!!!!!!!"!!%$!!!!!!!!!!!!!!!!"3!!!!!!!!!!!3!!"`!
+!!!F#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!!J!!!!)!J%!!!!
+!!!%!!3-!!!!!!!!!!!!!!!!&!!!!!!!!!!!"!!!*!!!!#3)"!!!!!!!"!!%$!!!
+!!!!!!!!!!!!!"3!!!!!!!!!!!3!!#J!!!!S#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!!X!!!!,!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!-!!!!$!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!$3!
+!!!d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!!i!!!!1!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!2!!!!$`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!%!!!!"!#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!"%!!!!4!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!5!!!!%J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!%`!
+!!"-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!"3!!!!8!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!9!!!!&3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!&J!!!"B#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!"F!!!!A!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!B!!!!'!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!'3!
+!!"N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!"S!!!!D!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!E!!!!'`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!(!!!!"`#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!"d!!!!G!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!H!!!!(J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!(`!
+!!"m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!#!!!!!J!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!K!!!!)3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!)J!!!#)#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!#-!!!!M!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!N!!!!*!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!*3!
+!!#8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!#B!!!!Q!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!R!!!!*`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!+!!!!#J#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!#N!!!!T!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!U!!!!+J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!+`!
+!!#X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!#`!!!!X!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!Y!!!!,3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!,J!!!#i#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!#m!!!![!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!`!!!!-!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!-3!
+!!$%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!$)!!!!b!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!c!!!!-`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!0!!!!$3#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!$8!!!!e!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!f!!!!0J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!0`!
+!!$F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!$J!!!!i!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!j!!!!13)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!1J!!!$S#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!$X!!!!l!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!m!!!!2!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!23!
+!!$d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!$i!!!!q!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!!r!!!!2`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!3!!!!%!#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!%%!!!""!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"#!!!!3J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!3`!
+!!%-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!%3!!!"%!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"&!!!!43)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!4J!!!%B#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!%F!!!"(!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!")!!!!5!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!53!
+!!%N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!%S!!!"+!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!",!!!!5`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!6!!!!%`#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!%d!!!"0!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"1!!!!6J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!6`!
+!!%m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!&!!!!"3!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"4!!!!83)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!8J!!!&)#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!&-!!!"6!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"8!!!!9!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!93!
+!!&8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!&B!!!"@!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"A!!!!9`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!@!!!!&J#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!&N!!!"C!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"D!!!!@J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!@`!
+!!&X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!&`!!!"F!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"G!!!!A3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!AJ!!!&i#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!&m!!!"I!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"J!!!!B!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!B3!
+!!'%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!')!!!"L!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"M!!!!B`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!C!!!!'3#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!'8!!!"P!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"Q!!!!CJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!C`!
+!!'F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!'J!!!"S!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"T!!!!D3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!DJ!!!'S#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!'X!!!"V!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"X!!!!E!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!E3!
+!!'d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!'i!!!"Z!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"[!!!!E`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!F!!!!(!#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!(%!!!"a!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"b!!!!FJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!F`!
+!!(-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!(3!!!"d!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"e!!!!G3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!GJ!!!(B#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!(F!!!"h!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"i!!!!H!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!H3!
+!!(N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!(S!!!"k!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!"l!!!!H`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!I!!!!(`#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!(d!!!"p!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!"q!!!!IJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!I`!
+!!(m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!)!!!!#!!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#"!!!!J3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!JJ!!!))#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!)-!!!#$!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!#%!!!!K!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!K3!
+!!)8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!)B!!!#'!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#(!!!!K`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!L!!!!)J#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!)N!!!#*!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!#+!!!!LJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!L`!
+!!)X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!)`!!!#-!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#0!!!!M3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!3!!MJ!!!)i#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!%!!)m!!!#2!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!#3!!!!!*!!!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#
+4!!!!N3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!NJ!!!*)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!*-!!!#6!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#8!!!!P!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!P3!!!*8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!*B!!!#@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#
+A!!!!P`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!Q!!!!*J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!*N!!!#C!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#D!!!!QJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!Q`!!!*X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!*`!!!#F!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#
+G!!!!R3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!RJ!!!*i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!*m!!!#I!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#J!!!!S!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!S3!!!+%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!+)!!!#L!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#
+M!!!!S`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!T!!!!+3#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!+8!!!#P!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#Q!!!!TJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!T`!!!+F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!+J!!!#S!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#
+T!!!!U3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!UJ!!!+S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!+X!!!#V!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#X!!!!V!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!V3!!!+d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!+i!!!#Z!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#
+[!!!!V`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!X!!!!,!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!,%!!!#a!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#b!!!!XJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!X`!!!,-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!,3!!!#d!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#
+e!!!!Y3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!YJ!!!,B#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!,F!!!#h!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#i!!!!Z!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!Z3!!!,N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!,S!!!#k!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#
+l!!!!Z`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!![!!!!,`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!,d!!!#p!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!#q!!!![J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!![`!!!,m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!-!!!!$!!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+"!!!!`3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!`J!!!-)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!--!!!$$!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$%!!!!a!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!a3!!!-8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!-B!!!$'!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+(!!!!a`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!b!!!!-J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!-N!!!$*!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$+!!!!bJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!b`!!!-X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!-`!!!$-!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+0!!!!c3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!cJ!!!-i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!-m!!!$2!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$3!!!!d!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!d3!!!0%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!0)!!!$5!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+6!!!!d`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!e!!!!03#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!08!!!$9!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$@!!!!eJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!e`!!!0F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!0J!!!$B!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+C!!!!f3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!fJ!!!0S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!0X!!!$E!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$F!!!!h!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!h3!!!0d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!0i!!!$H!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+I!!!!h`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!i!!!!1!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!1%!!!$K!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$L!!!!iJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!i`!!!1-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!13!!!$N!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+P!!!!j3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!jJ!!!1B#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!1F!!!$R!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$S!!!!k!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!k3!!!1N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!1S!!!$U!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+V!!!!k`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!l!!!!1`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!1d!!!$Y!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$Z!!!!lJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!l`!!!1m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!2!!!!$`!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+a!!!!m3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!mJ!!!2)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!2-!!!$c!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$d!!!!p!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!p3!!!28#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!2B!!!$f!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+h!!!!p`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!q!!!!2J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!2N!!!$j!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$k!!!!qJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!!q`!!!2X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!2`!!!$m!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!$
+p!!!!r3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!!rJ!!!2i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!2m!!!$r!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%!!!!"!!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"!3!!!3%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!3)!!!%#!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+$!!!"!`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!""!!!!33#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!38!!!%&!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%'!!!""J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!""`!!!3F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!3J!!!%)!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+*!!!"#3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"#J!!!3S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!3X!!!%,!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%-!!!"$!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"$3!!!3d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!3i!!!%1!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+2!!!"$`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"%!!!!4!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!4%!!!%4!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%5!!!"%J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"%`!!!4-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!43!!!%8!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+9!!!"&3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"&J!!!4B#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!4F!!!%A!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%B!!!"'!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"'3!!!4N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!4S!!!%D!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+E!!!"'`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"(!!!!4`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!4d!!!%G!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%H!!!"(J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"(`!!!4m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!5!!!!%J!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+K!!!")3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!")J!!!5)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!5-!!!%M!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%N!!!"*!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"*3!!!58#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!5B!!!%Q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+R!!!"*`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"+!!!!5J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!5N!!!%T!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%U!!!"+J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"+`!!!5X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!5`!!!%X!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+Y!!!",3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!",J!!!5i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!5m!!!%[!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%`!!!"-!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"-3!!!6%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!6)!!!%b!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+c!!!"-`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"0!!!!63#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!68!!!%e!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%f!!!"0J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"0`!!!6F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!6J!!!%i!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+j!!!"13)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"1J!!!6S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!6X!!!%l!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%m!!!"2!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"23!!!6d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!6i!!!%q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!%
+r!!!"2`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"3!!!!8!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!8%!!!&"!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&#!!!"3J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"3`!!!8-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!83!!!&%!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+&!!!"43)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"4J!!!8B#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!8F!!!&(!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&)!!!"5!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"53!!!8N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!8S!!!&+!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+,!!!"5`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"6!!!!8`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!8d!!!&0!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&1!!!"6J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"6`!!!8m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!9!!!!&3!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+4!!!"83)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"8J!!!9)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!9-!!!&6!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&8!!!"9!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"93!!!98#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!9B!!!&@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+A!!!"9`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"@!!!!9J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!9N!!!&C!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&D!!!"@J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"@`!!!9X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!9`!!!&F!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+G!!!"A3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"AJ!!!9i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!9m!!!&I!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&J!!!"B!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"B3!!!@%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!@)!!!&L!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+M!!!"B`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"C!!!!@3#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!@8!!!&P!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&Q!!!"CJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"C`!!!@F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!@J!!!&S!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+T!!!"D3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"DJ!!!@S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!@X!!!&V!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&X!!!"E!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"E3!!!@d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!@i!!!&Z!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+[!!!"E`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"F!!!!A!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!A%!!!&a!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&b!!!"FJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"F`!!!A-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!A3!!!&d!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+e!!!"G3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"GJ!!!AB#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!AF!!!&h!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&i!!!"H!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"H3!!!AN#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!AS!!!&k!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&
+l!!!"H`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"I!!!!A`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!Ad!!!&p!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!&q!!!"IJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"I`!!!Am#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!B!!!!'!!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'
+"!!!"J3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"JJ!!!B)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!B-!!!'$!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'%!!!"K!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"K3!!!B8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!BB!!!''!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'
+(!!!"K`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"L!!!!BJ#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!BN!!!'*!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'+!!!"LJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!3!"L`!!!BX#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!%!!B`!!!'-!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'
+0!!!"M3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"MJ!!!Bi#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!Bm!!!'2!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'3!!!!!C!!!J%!!!!!!!%!!3%!!!!!!!!
+!!!!!!!!"!!!!!!!!!!!"!!'4!!!"N3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!
+!!!!!!!!!!3!"NJ!!!C)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%
+!!C-!!!'6!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'8!!!"P!)
+"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"P3!!!C8#!3!!!!!!!3!
+"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!CB!!!'@!J%!!!!!!!%!!3%!!!!!!!!
+!!!!!!!!"!!!!!!!!!!!"!!'A!!!"P`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!
+!!!!!!!!!!3!"Q!!!!CJ#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%
+!!CN!!!'C!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'D!!!"QJ)
+"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"Q`!!!CX#!3!!!!!!!3!
+"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!C`!!!'F!J%!!!!!!!%!!3%!!!!!!!!
+!!!!!!!!"!!!!!!!!!!!"!!'G!!!"R3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!
+!!!!!!!!!!3!"RJ!!!Ci#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%
+!!Cm!!!'I!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'J!!!"S!)
+"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"S3!!!D%#!3!!!!!!!3!
+"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%!!D)!!!'L!J%!!!!!!!%!!3%!!!!!!!!
+!!!!!!!!"!!!!!!!!!!!"!!'M!!!"S`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!
+!!!!!!!!!!3!"T!!!!D3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!%
+!!D8!!!'P!J%!!!!!!!%!!3-!!!!!!!!!!!!!!!!"!!!!!!!!!!!"!!'Q!!!"TJ)
+"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!3!"T`!!!DF#!3!!!!!!!3!
+"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!!)!!!!$!!!!"!!!!!8!!!!'!!!!"`!
+!!!J!!!!*!!!!#J!!!!X!!!!-!!!!$3!!!!i!!!!2!!!!%!!!!"%!!!!5!!!!%`!
+!!"3!!!!9!!!!&J!!!"F!!!!B!!!!'3!!!"S!!!!E!!!!(!!!!"d!!!!H!!!!(`!
+!!#!!!!!K!!!!)J!!!#-!!!!N!!!!*3!!!#B!!!!R!!!!+!!!!#N!!!!U!!!!+`!
+!!#`!!!!Y!!!!,J!!!#m!!!!`!!!!-3!!!$)!!!!c!!!!0!!!!$8!!!!f!!!!0`!
+!!$J!!!!j!!!!1J!!!$X!!!!m!!!!23!!!$i!!!!r!!!!3!!!!%%!!!"#!!!!3`!
+!!%3!!!"&!!!!4J!!!%F!!!")!!!!53!!!%S!!!",!!!!6!!!!%d!!!"1!!!!6`!
+!!&!!!!"4!!!!8J!!!&-!!!"8!!!!93!!!&B!!!"A!!!!@!!!!&N!!!"D!!!!@`!
+!!&`!!!"G!!!!AJ!!!&m!!!"J!!!!B3!!!')!!!"M!!!!C!!!!'8!!!"Q!!!!C`!
+!!'J!!!"T!!!!DJ!!!'X!!!"X!!!!E3!!!'i!!!"[!!!!F!!!!(%!!!"b!!!!F`!
+!!(3!!!"e!!!!GJ!!!(F!!!"i!!!!H3!!!(S!!!"l!!!!I!!!!(d!!!"q!!!!I`!
+!!)!!!!#"!!!!JJ!!!)-!!!#%!!!!K3!!!)B!!!#(!!!!L!!!!)N!!!#+!!!!L`!
+!!)`!!!#0!!!!MJ!!!)m!!!#3!!!!!*%!!!#5!!!!N`!!!*3!!!#9!!!!PJ!!!*F
+!!!#B!!!!Q3!!!*S!!!#E!!!!R!!!!*d!!!#H!!!!R`!!!+!!!!#K!!!!SJ!!!+-
+!!!#N!!!!T3!!!+B!!!#R!!!!U!!!!+N!!!#U!!!!U`!!!+`!!!#Y!!!!VJ!!!+m
+!!!#`!!!!X3!!!,)!!!#c!!!!Y!!!!,8!!!#f!!!!Y`!!!,J!!!#j!!!!ZJ!!!,X
+!!!#m!!!![3!!!,i!!!#r!!!!`!!!!-%!!!$#!!!!``!!!-3!!!$&!!!!aJ!!!-F
+!!!$)!!!!b3!!!-S!!!$,!!!!c!!!!-d!!!$1!!!!c`!!!0!!!!$4!!!!dJ!!!0-
+!!!$8!!!!e3!!!0B!!!$A!!!!f!!!!0N!!!$D!!!!f`!!!0`!!!$G!!!!hJ!!!0m
+!!!$J!!!!i3!!!1)!!!$M!!!!j!!!!18!!!$Q!!!!j`!!!1J!!!$T!!!!kJ!!!1X
+!!!$X!!!!l3!!!1i!!!$[!!!!m!!!!2%!!!$b!!!!m`!!!23!!!$e!!!!pJ!!!2F
+!!!$i!!!!q3!!!2S!!!$l!!!!r!!!!2d!!!$q!!!!r`!!!3!!!!%"!!!"!J!!!3-
+!!!%%!!!""3!!!3B!!!%(!!!"#!!!!3N!!!%+!!!"#`!!!3`!!!%0!!!"$J!!!3m
+!!!%3!!!"%3!!!4)!!!%6!!!"&!!!!48!!!%@!!!"&`!!!4J!!!%C!!!"'J!!!4X
+!!!%F!!!"(3!!!4i!!!%I!!!")!!!!5%!!!%L!!!")`!!!53!!!%P!!!"*J!!!5F
+!!!%S!!!"+3!!!5S!!!%V!!!",!!!!5d!!!%Z!!!",`!!!6!!!!%a!!!"-J!!!6-
+!!!%d!!!"03!!!6B!!!%h!!!"1!!!!6N!!!%k!!!"1`!!!6`!!!%p!!!"2J!!!6m
+!!!&!!!!"33!!!8)!!!&$!!!"4!!!!88!!!&'!!!"4`!!!8J!!!&*!!!"5J!!!8X
+!!!&-!!!"63!!!8i!!!&2!!!"8!!!!9%!!!&5!!!"8`!!!93!!!&9!!!"9J!!!9F
+!!!&B!!!"@3!!!9S!!!&E!!!"A!!!!9d!!!&H!!!"A`!!!@!!!!&K!!!"BJ!!!@-
+!!!&N!!!"C3!!!@B!!!&R!!!"D!!!!@N!!!&U!!!"D`!!!@`!!!&Y!!!"EJ!!!@m
+!!!&`!!!"F3!!!A)!!!&c!!!"G!!!!A8!!!&f!!!"G`!!!AJ!!!&j!!!"HJ!!!AX
+!!!&m!!!"I3!!!Ai!!!&r!!!"J!!!!B%!!!'#!!!"J`!!!B3!!!'&!!!"KJ!!!BF
+!!!')!!!"L3!!!BS!!!',!!!"M!!!!Bd!!!'1!!!"M`!!!C!!!!!"N3!!!C)!!!'
+6!!!"P!!!!C8!!!'@!!!"P`!!!CJ!!!'C!!!"QJ!!!CX!!!'F!!!"R3!!!Ci!!!'
+I!!!"S!!!!D%!!!'L!!!"S`!!!D3!!!'P!!!"TJ!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'R!!!"`!%!!!!"!!'
+R!3!"SJ%!!D-"!!'K!3!"S!%!!!X"!!!-!3!!#J%!!!d"!!!1!3!!$`%!!"!"!!!
+4!3!!%J%!!"-"!!!8!3!!&3%!!"B"!!!A!3!!'!%!!"N"!!!D!3!!'`%!!"`"!!!
+G!3!!(J%!!"m"!!!J!3!!)3%!!#)"!!!M!3!!*!%!!#8"!!!Q!3!!*`%!!#J"!!!
+T!3!!+J%!!#X"!!!X!3!!,3%!!#i"!!![!3!!-!%!!$%"!!!b!3!!-`%!!$3"!!!
+e!3!!0J%!!$F"!!!i!3!!13%!!$S"!!!l!3!!2!%!!$d"!!!q!3!!2`%!!%!"!!"
+"!3!!3J%!!%-"!!"%!3!!43%!!%B"!!"(!3!!5!%!!%N"!!"+!3!!5`%!!%`"!!"
+0!3!!6J%!!%m"!!"3!3!!83%!!&)"!!"6!3!!9!%!!&8"!!"@!3!!9`%!!&J"!!"
+C!3!!@J%!!&X"!!"F!3!!A3%!!&i"!!"I!3!!B!%!!'%"!!"L!3!!B`%!!'3"!!"
+P!3!!CJ%!!'F"!!"S!3!!D3%!!'S"!!"V!3!!E!%!!'d"!!"Z!3!!E`%!!(!"!!"
+a!3!!FJ%!!(-"!!"d!3!!G3%!!(B"!!"h!3!!H!%!!(N"!!"k!3!!H`%!!(`"!!"
+p!3!!IJ%!!(m"!!#!!3!!J3%!!))"!!#$!3!!K!%!!)8"!!#'!3!!K`%!!)J"!!'
+Q!3!!L3%!!)S"!!#,!3!!M!%!!)d"!!#1!3!!M`%!!*!!!3!!N3%!!*)"!!#6!3!
+!P!%!!*8"!!#@!3!!P`%!!*J"!!#C!3!!QJ%!!*X"!!#F!3!!R3%!!*i"!!#I!3!
+!S!%!!+%"!!#L!3!!S`%!!+3"!!#P!3!!TJ%!!+F"!!#S!3!!U3%!!+S"!!#V!3!
+!V!%!!+d"!!#Z!3!!V`%!!,!"!!#a!3!!XJ%!!,-"!!#d!3!!Y3%!!,B"!!#h!3!
+!Z!%!!,N"!!#k!3!!Z`%!!,`"!!#p!3!![J%!!,m"!!$!!3!!`3%!!-)"!!$$!3!
+!a!%!!-8"!!$'!3!!a`%!!-J"!!$*!3!!bJ%!!-X"!!$-!3!!c3%!!-i"!!$2!3!
+!d!%!!0%"!!$5!3!!d`%!!03"!!$9!3!!eJ%!!0F"!!$B!3!!f3%!!0S"!!$E!3!
+!h!%!!0d"!!$H!3!!h`%!!1!"!!$K!3!!iJ%!!1-"!!$N!3!!j3%!!1B"!!$R!3!
+!k!%!!1N"!!$U!3!!k`%!!1`"!!$Y!3!!lJ%!!1m"!!$`!3!!m3%!!2)"!!$c!3!
+!p!%!!28"!!$f!3!!p`%!!2J"!!$j!3!!qJ%!!2X"!!$m!3!!r3%!!2i"!!$r!3!
+"!!%!!3%"!!%#!3!"!`%!!33"!!%&!3!""J%!!3F"!!%)!3!"#3%!!3S"!!%,!3!
+"$!%!!3d"!!%1!3!"$`%!!4!"!!%4!3!"%J%!!4-"!!%8!3!"&3%!!4B"!!%A!3!
+"'!%!!4N"!!%D!3!"'`%!!4`"!!%G!3!"(J%!!4m"!!%J!3!")3%!!5)"!!%M!3!
+"*!%!!58"!!%Q!3!"*`%!!5J"!!%T!3!"+J%!!5X"!!%X!3!",3%!!5i"!!%[!3!
+"-!%!!6%"!!%b!3!"-`%!!63"!!%e!3!"T`%!!6B"!!%h!3!"1!%!!6N"!!%k!3!
+"1`%!!6`"!!%p!3!"2J%!!6m"!!&!!3!"33%!!8)"!!&$!3!"4!%!!88"!!&'!3!
+"4`%!!8J"!!&*!3!"5J%!!8X"!!&-!3!"63%!!8i"!!&2!3!"8!%!!9%"!!&5!3!
+"8`%!!93"!!&9!3!"9J%!!9F"!!&B!3!"@3%!!9S"!!&E!3!"A!%!!9d"!!&H!3!
+"A`%!!@!"!!&K!3!"BJ%!!@-"!!&N!3!"C3%!!@B"!!&R!3!"D!%!!@N"!!&U!3!
+"D`%!!@`"!!&Y!3!"EJ%!!@m"!!&`!3!"F3%!!A)"!!&c!3!"G!%!!A8"!!&f!3!
+"G`%!!AJ"!!&j!3!"HJ%!!AX"!!&m!3!"I3%!!Ai"!!'!!3!"J3%!!B)"!!'$!3!
+"K!%!!B8"!!''!3!"K`%!!BJ"!!'*!3!"LJ%!!BX"!!'-!3!"M3%!!Bi"!!'2!3!
+"N!!"!!'4!3!"NJ%!!C-"!!'8!3!"P3%!!CB"!!'A!3!"Q!%!!CN"!!'D!3!"Q`%
+!!C`"!!'G!3!"RJ%!!Cm"!!'N!3!"I`%!!!%"!!!%!3!!!`%!!!)"!!!*!3!!"3%
+!!!B"!!!(!3!!#!%!!D8!!!'S!!%!+!!!!#!$NFQ3!$mr!!!!!!!!!!!!!!14bC!
+!!!)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!6T)HA"PFN0
+KFQ3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#`MlJ!!!!!!!!!3!#`NI
+`!!)!!!!!!!!!!!!!!X)fJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!)!!!%!!!!!"3!!Irm!!!!!Irm!!!!!Irm!!!!!Irm!!!!-!!%!!J!'!!!!"8!
+!!!J!!3!"1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%
+!!!$rrrrr!!!!!`!"!!%k1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!3!!!2rrrrm!!!!%!!%!!6SkD@jME(9NC6S!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!rrrrrd!!!!)!!3!"1J!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$rrrrr3!!!!`!"!!%k1MT(990*1QP
+ZBfaeC'8k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2rrrrp!!!!%!!%!!6S
+k1NG98dNkE'PL1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!rrrrrd!
+!!!8!!J!"1NeKBdp6)&0eF("[FR3k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%
+!!!$rrrrr3!!!"J!#!!%k690-1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!3!!!2rrrrp!!!!(!!S!!%eKBdp6)&"33b"-D@jVCA)!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%p`C@j68d`J8&"$!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!"1J!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J!"6@&M6e-
+J8&"$)%aTEQYPFJ!!!!!!!!!!!!!!!!!!!!!!(N&38%`!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!B!!!!%&`F'`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!%e06%)!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%aTBL"*EA"[FR3J8&"$!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%e36%B!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%aTBL"*EA"
+[FR3J8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA3d3!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!B!!!!&*68N-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!&4&@&3ZBQJ!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%*KE'a[EfiJ5'9XF!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&4&@&3ZB`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bX
+V)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZBbXV!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&4&@&3ZBf-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bX
+V)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZBh!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&4&@&3ZBh"`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bX
+V)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZCAK`!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&4&@&3ZCf-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%GKE@9$Ef4
+P)%0[ERCPFR4PFJ!!!!!!!!!!!!!!!!!!3!!!!&4&@&3ZD!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!
+!%!!!!&4&@&3ZE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%CXCAJJ8(*
+PF(*[Bf9cFfpb!!!!!!!!!!!!!!!!!!!!J!!!!&4&@&3ZF!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%eA)&"KFf0KE#"38%-!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&4&@&3ZF'&c!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)&"KFf0
+KE#"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZF'0S!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!
+!J!!!!&4&@&3ZF'0S+bX!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bX
+V)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!&4&@&3ZF("e!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%eA)&"KFf0KE#"38%-!!!!!!!!!!!!!!!!!!!!!!!!
+!J!!!!&4&@&3ZFJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&*PHJ!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZF`!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!&"33d&cE3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&4&@&3ZH3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%*TFfpZ)&"
+bCA"bEf0PFh0[FJ!!!!!!!!!!!!!!!!!!J!!!!&K$6dB!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!&K$6dC')%PYF'pbG#"38%-!!!!!!!!!!!!!!!!!!!!
+!!!!!!'4[Bh8!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!(*cFQ-!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!B!!!!(0SE')!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&"&4L"*EA"
+[FR3J8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(0dG@)!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!&"&4L"*EA"[FR3J8&"$!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!ZC'pM!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8!!!!!!&!3%!!3!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!B!!!!!!3!!!!!&!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!3%!!'eKD@i!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!%!!3!!!!%"!3%
+"!!%"!!!!!!!"!3!!!3%!!3!!!3!"!!!!!!!!!!!!#!%!!3%!!3%!!!!"!!!*!!!
+A6@&M6e-J9'p[E'*[H#"%48*94b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!2cmr2d&38%`!!!'!@-!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+r2cmr!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!$3!"!!!!!!!9AdeA49*,8ep(990*Ah"bC@CTH#j
+S!!!!!!!!!!!!!!!!!3!!!3!!!!!!!3!!!!!!!!!!!!!&!3%"!!!"!3!"!!!!!!3
+!!!!!!!!!!!!!!!!!!!!!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!AepcG'&bG!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!%!!!P0CA*
+RC5"2GA3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!r2cmr39"36!!"!3!!"#!J)#!$NS0J!h6IH!-$VH!!"3)"!!%
+"!!%"!3!!!3!!!!!!!!!"!3%"!!%"!!%!!33!!!!!!!!!!!!!"`%"!!%!!!%!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!AepcG'&bG!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&!!!(6h"PEP0
+66!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$mr2cp"8&"-!!!%!!!!"!!!!!"!!!"
+B`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!"2cmr2`!!!!!!!!!#!!!!!J!#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!J"3!!%!!3!"!!%!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#G$6d4&*b!
+R4%&835FJ*e"*3e3R!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!K-!!!)8!!!#&3!!!KB!!!)A!!!"p!!!!HF!!!(q!!!"r3!!!IS
+!!!(m!!!"m`!!!IX!!!)$!!!"U!!!!DN!!!'U!!!!,!!!!#d!!!!Z!!!!,`!!!$!
+!!!!a!!!!-J!!!$-!!!!d!!!!03!!!$B!!!!h!!!!1!!!!$N!!!!k!!!!1`!!!BF
+!!!!m!!!!23!!!$i!!!!r!!!!3!!!!%%!!!',!!!!3J!!!%-!!!"%!!!!43!!!%B
+!!!"(!!!"k3!!!Am!!!"p!!!!IJ!!!(m!!!'5!!!"N3!!!)!!!!#"!!!!c!!!!B`
+!!!$0!!!!JJ!!!)-!!!$1!!!!c`!!!!N!!!(`!!!!K3!!!)B!!!#(!!!"T3!!!)J
+!!!#*!!!!LJ!!!)X!!!#-!!!!M3!!!)i!!!#2!!!!N!!!!!#4!!!!NJ!!!*-!!!#
+8!!!!P3!!!*B!!!#A!!!"N`!!!Bi!!!'2!!!"M3!!!C!!!!!!K!!!!*J!!!#C!!!
+#"J!!!93!!!&9!!!"P!!!!BB!!!)*!!!##J!!!DX!!!#N!!!!T3!!!+B!!!#R!!!
+!U!!!!KJ!!!'X!!!!R`!!!+)!!!#M!!!"R`!!!AS!!!'Y!!!"VJ!!!AX!!!)#!!!
+"RJ!!!0!!!!#D!!!!Q`!!!*`!!!#G!!!!S!!!!*i!!!#K!!!!5!!!!%N!!!"+!!!
+!5`!!!%`!!!"0!!!!6J!!!%m!!!)(!!!##!!!!+N!!!'[!!!"X!!!!,d!!!#q!!!
+![`!!!-!!!!$"!!!!d3!!!E%!!!'b!!!!`J!!!--!!!$%!!!!a3!!!-B!!!'"!!!
+!a`!!!-J!!!#U!!!!U`!!!+`!!!'c!!!!dJ!!!+d!!!'9!!!!b3!!!D!!!!'d!!!
+!bJ!!!-X!!!"3!!!!d`!!!03!!!$9!!!!eJ!!!0F!!!$B!!!"I!!!!0N!!!$D!!!
+!f`!!!0`!!!$G!!!!hJ!!!0m!!!$J!!!!i3!!!1)!!!$M!!!!j!!!!18!!!$Q!!!
+!j`!!!1J!!!$T!!!!kJ!!!1X!!!$X!!!!l3!!!1i!!!$[!!!!m!!!!2%!!!$b!!!
+!m`!!!23!!!$e!!!!pJ!!!2F!!!#Z!!!!V`!!!J8!!!(C!!!"l!!!!&%!!!"5!!!
+!8`!!!HX!!!'e!!!"YJ!!!EF!!!(K!!!"h`!!!D%!!!(D!!!"c!!!!FX!!!(E!!!
+"c3!!!G`!!!(1!!!"#3!!!&3!!!"9!!!!9J!!!&F!!!"B!!!!@3!!!&S!!!"E!!!
+!!3!!!3S!!!%,!!!"$!!!!3d!!!%1!!!"$`!!!4!!!!(e!!!"k!!!!HB!!!(P!!!
+"h3!!!G!!!!(L!!!"j!!!!Gi!!!(2!!!#!!!!!Im!!!(4!!!"SJ!!!!)!!!(B!!!
+"%3!!!4)!!!%6!!!"&!!!!48!!!%@!!!"-`!!!Ad!!!'M!!!"pJ!!!GF!!!!!!!!
+"dJ!!!!-!!!(@!!!"IJ!!!IF!!!(U!!!"q!!!!Hd!!!$i!!!!q3!!!2S!!!$l!!!
+!r!!!!2d!!!$q!!!!r`!!!3!!!!%"!!!"Z!!!!&`!!!"G!!!"&`!!!4J!!!%C!!!
+!X!!!!,%!!!#b!!!"i`!!!H!!!!'j!!!"d`!!!!3!!!!&!!!"e!!!!G8!!!!'!!!
+!"`!!!4S!!!%K!!!")J!!!5-!!!%N!!!"*3!!!5B!!!%R!!!"+!!!!5N!!!%U!!!
+"+`!!!5`!!!'B!!!",3!!!5i!!!'@!!!"P`!!!&i!!!"I!!!!B!!!!'%!!!"L!!!
+!B`!!!'3!!!"P!!!!CJ!!!'F!!!"S!!!!D3!!!'S!!!#c!!!"q3!!!I)!!!%E!!!
+"(!!!!4d!!!%H!!!"(`!!!5!!!!%[!!!"Q3!!!6!!!!%a!!!"QJ!!!CX!!!'k!!!
+"Z`!!!6)!!!'m!!!"T!!!!JX!!!)-!!!#$3!!!Ji!!!)2!!!#%!!!!Hm!!!)4!!!
+"!J!!!3-!!!%%!!!""3!!!3B!!!%(!!!"#!!!!,3!!!%d!!!"TJ!!!,8!!!%e!!!
+"0J!!!6F!!!%i!!!"13!!!6S!!!%l!!!"2!!!!6d!!!%q!!!"2`!!!8!!!!&"!!!
+!YJ!!!,F!!!'p!!!"lJ!!!K)!!!&#!!!"3`!!!,J!!!'q!!!"R!!!!83!!!&&!!!
+"4J!!!8F!!!&)!!!"R3!!!8N!!!&+!!!"5`!!!8`!!!&0!!!!#J!!!!X!!!!-!!!
+!$3!!!!i!!!!2!!!!%!!!!"%!!!!5!!!!%`!!!"3!!!!9!!!!&J!!!"F!!!!B!!!
+!'3!!!"S!!!!E!!!"[`!!!,N!!!&1!!!"6`!!!9!!!!&4!!!"`!!!!J%!!!("!!!
+"`J!!!"`!!!!G!!!!(J!!!"m!!!!J!!!!)3!!!#)!!!!M!!!!*!!!!#8!!!!Q!!!
+"8J!!!,S!!!#l!!!"``!!!F3!!!(&!!!"aJ!!!FS!!!!R!!!!+!!!!#N!!!!U!!!
+!+`!!!J3!!!!)!!!"8`!!!BS!!!"V!!!!E!!!!'d!!!')!!!!EJ!!!BN!!!&R!!!
+"D!!!!@N!!!&U!!!"D`!!!@`!!!&Y!!!"EJ!!!@m!!!&`!!!"F3!!!A)!!!'&!!!
+"F`!!!A3!!!&e!!!"GJ!!!B3!!!&h!!!"H!!!!AN!!!((!!!"b!!!!DF!!!(*!!!
+"9J!!!9F!!!'#!!!"@!!!!9N!!!&D!!!"@`!!!9`!!!&G!!!"AJ!!!9m!!!&J!!!
+"B3!!!@)!!!'$!!!"B`!!!@3!!!&P!!!![!!!!I%!!!"[!!!"CJ!!!(!!!!"a!!!
+!FJ!!!(-!!!"d!!!!G3!!!(B!!!"h!!!!H!!!!(N!!!"k!!!!H`!!!(`!!!'!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!-!!!!-!!!!!`!!!!bdhb6,!!!
+qh3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!U!!!!+`!!!#`!!!!Z!!!!,`!!!$!!!!!a!!!!-J!!!$-!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!d!!!
+!3!)!!!!#!!!d!J!!(!)!!"d#!!!H!J!!(`)!!#!#!!!K!J!!)J)!!#-#!!!N!J!
+!*3)!!#B#!!!R!J!!+!)!!#N#!!!U!J!!+`)!!#`#!!!Y!J!!#`)!!!`#!!!0!J!
+!$J)!!!m#!!!3!J!!%3)!!")#!!!6!J!!&!)!!"8#!!!@!J!!&`)!!"J#!!!C!J!
+!'J)!!"X#!!!c!J!!0!)!!#m#!!!`!J!!-J)!!$%#!!!+!J!!!3)!!!3#!!!$!J!
+!!J)!!!N#!!!&!J!!"J)!!!F#!!!)!J!!,J!!!DJ!!3!S!!!!)!14bC!!2cm!!!!
+!!!!!!!!!!j(*N!!!!J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!,#2Z!
+!!!!!!!!"!!,#4r!!!J!!!!!!!!!!!!!#`MD!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!J!!!3!!!!!&!!"rr`!!!!"rr`!!!!"rr`!!!!"rr`!!!!`
+!!3!#!!3!!!!&3!!!"J!"!!%k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!3!!!2rrrrm!!!!$!!%!!6Sk!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrrrr`!!!!3!!3!"1MTTEQ0XG@4P1J!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$rrrrr3!!!!J!"!!%k!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2rrrrp!!!!$!!)
+!!6T0B@028b"6GA"`Eh*d1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrr
+rrd!!!!3!!J!"1Ne66$S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!%!!!$rrrrr3!!!"3!+!!"0B@028b!f1%XJ6'PZDf9b!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"(CA4)9&438b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!6S!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!!8eKBdp6)$Bi5b"
+-D@jVCA)!!!!!!!!!!!!!!!!!!!!!!#""8&"-!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"
+"F("X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"068a#!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"-D@)J5@e`Eh*d)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+08%a'!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"-D@)J5@e`Eh*d)$B
+i5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09d0%!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"
+23NSJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"08&FJ5@e`Eh*d)$B
+i5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"36'pL!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"
+58e*$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"849K8,Q*S!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"#B@aXEfpZ)%KPE(!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,Q-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q-V+`!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,Q0M!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q0`!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,Q0`F!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q9iF!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,QGM!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"(B@eP3fpNC5"$Efj
+fCA*dCA)!!!!!!!!!!!!!!!!!!%!!!!"849K8,QJ!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!"
+849K8,Q`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"'E'9i)&"bCA"bEf0
+PFh0[FJ!!!!!!!!!!!!!!!!!!!)!!!!"849K8,R!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"3BA0MB@`J0MK,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,R"KF`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"3BA0MB@`J0MK
+,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,R"MD!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!"
+849K8,R"MD#XV!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!"849K8,R"`G3!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"3BA0MB@`J0MK,!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!"
+849K8,R)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"5CAS!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,R0PC`!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,RN!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"#DA0[EL"3FQ9`FQp
+MCA0cEh)!!!!!!!!!!!!!!!!!!)!!!!"NEf0e!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"
+bFh*M!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"cD'aL!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"348BJ5@e`Eh*d)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+cG(9L!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"348BJ5@e`Eh*d)$B
+i5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!,Q4[B`!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&!!!!!
+!!!!!,R*cFQ-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!!!"3%"!!%!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+'!!!!!!%!!!!!"3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!%"!!"YB@PZ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J"!3%!!!!"!3%!!!%"!3!
+!!!!!!3%!!!%"!!%!!!%%!!!!!!!!!!!!!!J"!!%"!!%"!!!!!3!!#3!!$8GPG%K
+89&"6+$Bi5bN!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!$mr2cp"8&"-!!!#!&M!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2cmr2`!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!d!!3!!!!!!%&p09d955e0IF(*PCQPi,QJ!!!!!!!!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!%!!!!!!!!!!!!!"3%"!3!!!3%!!3!!!!!%!!!!!!!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&p
+IFh4KFR3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!"!!!*6@9bCf8J6h9
+d!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!2cmr2d&38%`!!3%!!!3J)#!J!j+$B!0dhhJ$!khJ!!8#!3!"!3!"!3%
+!!!%!!!!!!!!!!3%"!3!"!3!"!!%%!!!!!!!!!!!!!!F"!3!"!!!"!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!&pIFh4KFR3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"3!!#%GPG%K89&"6!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!r2cmr39"36!!!"!!!!!3!!!!!3!!!@-!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!6m
+r2cm!!!!!!!!!!J!!!!)!!J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!)!8!!"!!%!!3!"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"3R3dp%45FJ*d4"9%%
+R)#G35808*`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!$!!!"!!!!#J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!!J!
+!!!X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!!-!!!!-!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!%!!!!$3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!"3!!!!i#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!!B!!!!2!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!(!!!!%!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!#!!
+!!"%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!!N!!!!5!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!+!!!!%`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!#`!!!"3#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!!`!!!!9!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!0!!!!&J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!$J!
+!!"F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!!m!!!!B!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!3!!!!'3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!%3!!!"S#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!")!!!!E!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!6!!!!(!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!&!!
+!!"d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!"8!!!!H!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!@!!!!(`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!&`!!!#!#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!"J!!!!K!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!C!!!!)J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!'J!
+!!#-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!"X!!!!N!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!F!!!!*3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!(3!!!#B#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!"i!!!!R!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!I!!!!+!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!)!!
+!!#N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!#%!!!!U!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!L!!!!+`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!)`!!!#`#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!#3!!!!Y!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!P!!!!,J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!*J!
+!!#m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!#F!!!!`!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!S!!!!-3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!+3!!!$)#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!#S!!!!c!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!V!!!!0!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!,!!
+!!$8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!#d!!!!f!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!Z!!!!0`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!,`!!!$J#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!$!!!!!j!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!a!!!!1J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!-J!
+!!$X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!$-!!!!m!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!d!!!!23)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!03!!!$i#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!$B!!!!r!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!h!!!!3!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!1!!
+!!%%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!$N!!!"#!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!!k!!!!3`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!1`!!!%3#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!$`!!!"&!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!!p!!!!4J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!2J!
+!!%F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!$m!!!")!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"!!!!!53)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!33!!!%S#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!%)!!!",!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"$!!!!6!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!4!!
+!!%d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!%8!!!"1!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"'!!!!6`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!4`!!!&!#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!%J!!!"4!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"*!!!!8J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!5J!
+!!&-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!%X!!!"8!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"-!!!!93)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!63!!!&B#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!%i!!!"A!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"2!!!!@!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!8!!
+!!&N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!&%!!!"D!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"5!!!!@`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!8`!!!&`#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!&3!!!"G!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"9!!!!AJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!9J!
+!!&m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!&F!!!"J!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"B!!!!B3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!@3!!!')#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!&S!!!"M!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"E!!!!C!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!A!!
+!!'8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!&d!!!"Q!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"H!!!!C`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!A`!!!'J#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!'!!!!"T!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"K!!!!DJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!BJ!
+!!'X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!'-!!!"X!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"N!!!!E3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!C3!!!'i#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!'B!!!"[!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"R!!!!F!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!D!!
+!!(%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!'N!!!"b!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"U!!!!F`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!D`!!!(3#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!'`!!!"e!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"Y!!!!GJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!EJ!
+!!(F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!'m!!!"i!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"`!!!!H3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!F3!!!(S#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!()!!!"l!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"c!!!!I!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!G!!
+!!(d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!(8!!!"q!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"f!!!!I`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!G`!!!)!#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!(J!!!#"!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"j!!!!JJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!HJ!
+!!)-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!(X!!!#%!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!"m!!!!K3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!I3!!!)B#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!(i!!!#(!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!"r!!!!L!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!J!!
+!!)N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!)%!!!#+!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!##!!!!L`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!`!!J`!!!)`#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!-!!)3!!!#0!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!$!!#&!!!!MJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!KJ!
+!!)m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!)F!!!#3!!)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!L!!!!*%#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!)N!!!#5!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!$!!#+!!!!N`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!`!!L`!!!*3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!)`
+!!!#9!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#0!!!!PJ)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!MJ!!!*F#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!)m!!!#B!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!$!!#3!!!!!*N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!*%!!!#D!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#
+5!!!!Q`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!N`!!!*`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!*3!!!#G!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#9!!!!RJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!PJ!!!*m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!*F!!!#J!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#
+B!!!!S3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!Q3!!!+)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!*S!!!#M!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#E!!!!T!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!R!!!!+8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!*d!!!#Q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#
+H!!!!T`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!R`!!!+J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!+!!!!#T!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#K!!!!UJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!SJ!!!+X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!+-!!!#X!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#
+N!!!!V3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!T3!!!+i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!+B!!!#[!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#R!!!!X!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!U!!!!,%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!+N!!!#b!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#
+U!!!!X`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!U`!!!,3#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!+`!!!#e!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#Y!!!!YJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!VJ!!!,F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!+m!!!#i!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#
+`!!!!Z3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!X3!!!,S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!,)!!!#l!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#c!!!![!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!Y!!!!,d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!,8!!!#q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#
+f!!!![`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!Y`!!!-!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!,J!!!$"!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#j!!!!`J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!ZJ!!!--#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!,X!!!$%!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#
+m!!!!a3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!![3!!!-B#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!,i!!!$(!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!#r!!!!b!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!`!!!!-N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!-%!!!$+!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+#!!!!b`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!``!!!-`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!-3!!!$0!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$&!!!!cJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!aJ!!!-m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!-F!!!$3!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+)!!!!d3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!b3!!!0)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!-S!!!$6!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$,!!!!e!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!c!!!!08#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!-d!!!$@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+1!!!!e`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!c`!!!0J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!0!!!!$C!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$4!!!!fJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!dJ!!!0X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!0-!!!$F!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+8!!!!h3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!e3!!!0i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!0B!!!$I!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$A!!!!i!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!f!!!!1%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!0N!!!$L!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+D!!!!i`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!f`!!!13#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!0`!!!$P!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$G!!!!jJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!hJ!!!1F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!0m!!!$S!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+J!!!!k3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!i3!!!1S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!1)!!!$V!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$M!!!!l!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!j!!!!1d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!18!!!$Z!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+Q!!!!l`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!j`!!!2!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!1J!!!$a!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$T!!!!mJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!kJ!!!2-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!1X!!!$d!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+X!!!!p3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!l3!!!2B#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!1i!!!$h!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$[!!!!q!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!m!!!!2N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!2%!!!$k!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+b!!!!q`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!m`!!!2`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!23!!!$p!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$e!!!!rJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!pJ!!!2m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!2F!!!%!!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+i!!!"!3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!q3!!!3)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!2S!!!%$!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$l!!!""!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!!r!!!!38#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!2d!!!%'!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!$
+q!!!""`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!!r`!!!3J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!3!!!!%*!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%"!!!"#J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"!J!!!3X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!3-!!!%-!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+%!!!"$3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!""3!!!3i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!3B!!!%2!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%(!!!"%!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"#!!!!4%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!3N!!!%5!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
++!!!"%`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"#`!!!43#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!3`!!!%9!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%0!!!"&J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"$J!!!4F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!3m!!!%B!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+3!!!"'3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"%3!!!4S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!4)!!!%E!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%6!!!"(!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"&!!!!4d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!48!!!%H!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+@!!!"(`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"&`!!!5!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!4J!!!%K!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%C!!!")J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"'J!!!5-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!4X!!!%N!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+F!!!"*3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"(3!!!5B#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!4i!!!%R!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%I!!!"+!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!")!!!!5N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!5%!!!%U!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+L!!!"+`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!")`!!!5`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!53!!!%Y!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%P!!!",J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"*J!!!5m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!5F!!!%`!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+S!!!"-3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"+3!!!6)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!5S!!!%c!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%V!!!"0!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!",!!!!68#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!5d!!!%f!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+Z!!!"0`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!",`!!!6J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!6!!!!%j!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%a!!!"1J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"-J!!!6X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!6-!!!%m!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+d!!!"23)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"03!!!6i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!6B!!!%r!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%h!!!"3!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"1!!!!8%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!6N!!!&#!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%
+k!!!"3`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"1`!!!83#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!6`!!!&&!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!%p!!!"4J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"2J!!!8F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!6m!!!&)!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+!!!!"53)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"33!!!8S#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!8)!!!&,!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&$!!!"6!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"4!!!!8d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!88!!!&1!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+'!!!"6`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"4`!!!9!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!8J!!!&4!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&*!!!"8J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"5J!!!9-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!8X!!!&8!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+-!!!"93)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"63!!!9B#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!8i!!!&A!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&2!!!"@!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"8!!!!9N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!9%!!!&D!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+5!!!"@`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"8`!!!9`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!93!!!&G!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&9!!!"AJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"9J!!!9m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!9F!!!&J!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+B!!!"B3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"@3!!!@)#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!9S!!!&M!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&E!!!"C!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"A!!!!@8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!9d!!!&Q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+H!!!"C`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"A`!!!@J#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!@!!!!&T!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&K!!!"DJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"BJ!!!@X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!@-!!!&X!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+N!!!"E3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"C3!!!@i#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!@B!!!&[!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&R!!!"F!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"D!!!!A%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!@N!!!&b!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+U!!!"F`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"D`!!!A3#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!@`!!!&e!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&Y!!!"GJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"EJ!!!AF#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!@m!!!&i!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+`!!!"H3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"F3!!!AS#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!A)!!!&l!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&c!!!"I!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"G!!!!Ad#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!A8!!!&q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+f!!!"J!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"G`!!!B%#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!AJ!!!'#!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&j!!!"J`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"HJ!!!B3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!AX!!!'&!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&
+m!!!"KJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"I3!!!BF#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!Ai!!!')!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!&r!!!"L3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"J!!!!BS#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!-!!B%!!!',!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!'
+#!!!"M!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"J`!!!Bd#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!B3!!!'1!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!'&!!!"M`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!`!"KJ!!!C!!!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!
+!!!!!!!!$!!'(!!!"N3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!
+"L!!!!C)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!BN!!!'6!J%
+!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!'+!!!"P!)"!!!!!!!"!!%
+"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"L`!!!C8#!3!!!!!!!3!"!3!!!!!!!!!
+!!!!!!!%!!!!!!!!!!!-!!B`!!!'@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!
+!!!!!!!!$!!'0!!!"P`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!
+"MJ!!!CJ#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!Bm!!!'C!J%
+!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!'3!!!!!CS#!3!!!!!!!3!
+"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!C%!!!'E!J%!!!!!!!%!!3%!!!!!!!!
+!!!!!!!!"!!!!!!!!!!!$!!'5!!!"R!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!
+!!!!!!!!!!`!"N`!!!Cd#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-
+!!C3!!!'H!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!'9!!!"R`)
+"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"PJ!!!D!#!3!!!!!!!3!
+"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!CF!!!'K!J%!!!!!!!%!!3%!!!!!!!!
+!!!!!!!!"!!!!!!!!!!!$!!'B!!!"SJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!
+!!!!!!!!!!`!"Q3!!!D-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!-
+!!CS!!!(5!J%!!!!!!!%!!3-!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!'E!!!"d`)
+"!!!!!!!"!!%$!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"R!!!!G3#!3!!!!!!!3!
+"!`!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!Cd!!!(9!J%!!!!!!!%!!3-!!!!!!!!
+!!!!!!!!"!!!!!!!!!!!$!!'H!!!"T!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!
+!!!!!!!!!!`!"R`!!!GB#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!%!!!!!!!!!!!-
+!!D!!!!(A!J%!!!!!!!%!!3-!!!!!!!!!!!!!!!!"!!!!!!!!!!!$!!'K!!!"f!)
+"!!!!!!!"!!%$!!!!!!!!!!!!!!!!!3!!!!!!!!!!!`!"SJ!!!GN#!3!!!!!!!3!
+"!`!!!!!!!!!!!!!!!!%!!!!!!!!!!!-!!D-!!!'Q!J%!!!!!!!%!!3%!!!!!!!!
+!!!!!!!!"!!!!!!!!!!!$!!'N!!!"T`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!!J!!!!-!!!!%!!!!"3!
+!!!B!!!!(!!!!#!!!!!N!!!!+!!!!#`!!!!`!!!!0!!!!$J!!!!m!!!!3!!!!%3!
+!!")!!!!6!!!!&!!!!"8!!!!@!!!!&`!!!"J!!!!C!!!!'J!!!"X!!!!F!!!!(3!
+!!"i!!!!I!!!!)!!!!#%!!!!L!!!!)`!!!#3!!!!P!!!!*J!!!#F!!!!S!!!!+3!
+!!#S!!!!V!!!!,!!!!#d!!!!Z!!!!,`!!!$!!!!!a!!!!-J!!!$-!!!!d!!!!03!
+!!$B!!!!h!!!!1!!!!$N!!!!k!!!!1`!!!$`!!!!p!!!!2J!!!$m!!!"!!!!!33!
+!!%)!!!"$!!!!4!!!!%8!!!"'!!!!4`!!!%J!!!"*!!!!5J!!!%X!!!"-!!!!63!
+!!%i!!!"2!!!!8!!!!&%!!!"5!!!!8`!!!&3!!!"9!!!!9J!!!&F!!!"B!!!!@3!
+!!&S!!!"E!!!!A!!!!&d!!!"H!!!!A`!!!'!!!!"K!!!!BJ!!!'-!!!"N!!!!C3!
+!!'B!!!"R!!!!D!!!!'N!!!"U!!!!D`!!!'`!!!"Y!!!!EJ!!!'m!!!"`!!!!F3!
+!!()!!!"c!!!!G!!!!(8!!!"f!!!!G`!!!(J!!!"j!!!!HJ!!!(X!!!"m!!!!I3!
+!!(i!!!"r!!!!J!!!!)%!!!##!!!!J`!!!)3!!!#&!!!!KJ!!!)F!!!#)!!!!L3!
+!!)S!!!#,!!!!M!!!!)d!!!#1!!!!M`!!!*!!!!!!N3!!!*)!!!#6!!!!P!!!!*8
+!!!#@!!!!P`!!!*J!!!#C!!!!QJ!!!*X!!!#F!!!!R3!!!*i!!!#I!!!!S!!!!+%
+!!!#L!!!!S`!!!+3!!!#P!!!!TJ!!!+F!!!#S!!!!U3!!!+S!!!#V!!!!V!!!!+d
+!!!#Z!!!!V`!!!,!!!!#a!!!!XJ!!!,-!!!#d!!!!Y3!!!,B!!!#h!!!!Z!!!!,N
+!!!#k!!!!Z`!!!,`!!!#p!!!![J!!!,m!!!$!!!!!`3!!!-)!!!$$!!!!a!!!!-8
+!!!$'!!!!a`!!!-J!!!$*!!!!bJ!!!-X!!!$-!!!!c3!!!-i!!!$2!!!!d!!!!0%
+!!!$5!!!!d`!!!03!!!$9!!!!eJ!!!0F!!!$B!!!!f3!!!0S!!!$E!!!!h!!!!0d
+!!!$H!!!!h`!!!1!!!!$K!!!!iJ!!!1-!!!$N!!!!j3!!!1B!!!$R!!!!k!!!!1N
+!!!$U!!!!k`!!!1`!!!$Y!!!!lJ!!!1m!!!$`!!!!m3!!!2)!!!$c!!!!p!!!!28
+!!!$f!!!!p`!!!2J!!!$j!!!!qJ!!!2X!!!$m!!!!r3!!!2i!!!$r!!!"!!!!!3%
+!!!%#!!!"!`!!!33!!!%&!!!""J!!!3F!!!%)!!!"#3!!!3S!!!%,!!!"$!!!!3d
+!!!%1!!!"$`!!!4!!!!%4!!!"%J!!!4-!!!%8!!!"&3!!!4B!!!%A!!!"'!!!!4N
+!!!%D!!!"'`!!!4`!!!%G!!!"(J!!!4m!!!%J!!!")3!!!5)!!!%M!!!"*!!!!58
+!!!%Q!!!"*`!!!5J!!!%T!!!"+J!!!5X!!!%X!!!",3!!!5i!!!%[!!!"-!!!!6%
+!!!%b!!!"-`!!!63!!!%e!!!"0J!!!6F!!!%i!!!"13!!!6S!!!%l!!!"2!!!!6d
+!!!%q!!!"2`!!!8!!!!&"!!!"3J!!!8-!!!&%!!!"43!!!8B!!!&(!!!"5!!!!8N
+!!!&+!!!"5`!!!8`!!!&0!!!"6J!!!8m!!!&3!!!"83!!!9)!!!&6!!!"9!!!!98
+!!!&@!!!"9`!!!9J!!!&C!!!"@J!!!9X!!!&F!!!"A3!!!9i!!!&I!!!"B!!!!@%
+!!!&L!!!"B`!!!@3!!!&P!!!"CJ!!!@F!!!&S!!!"D3!!!@S!!!&V!!!"E!!!!@d
+!!!&Z!!!"E`!!!A!!!!&a!!!"FJ!!!A-!!!&d!!!"G3!!!AB!!!&h!!!"H!!!!AN
+!!!&k!!!"H`!!!A`!!!&p!!!"IJ!!!Am!!!'!!!!"J3!!!B)!!!'$!!!"K!!!!B8
+!!!''!!!"K`!!!BJ!!!'*!!!"LJ!!!BX!!!'-!!!"M3!!!Bi!!!'2!!!"N!!!!!'
+4!!!"NJ!!!C-!!!'8!!!"P3!!!CB!!!'A!!!"Q!!!!Cd!!!'L!!!"S`!!!CN!!!'
+D!!!"Q`!!!C`!!!'H!!!"R`!!!D!!!!'K!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!D3!!!(
+!!`!!!!-!!D3!!!(D!!%!(!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!-!!CJ$!!'
+C!`!"P`-!!CB$!!!#!`!!!`-!!!%$!!!%!`!!"3-!!!B$!!!(!`!!#!-!!!N$!!!
++!`!!#`-!!!`$!!!0!`!!$J-!!!m$!!!3!`!!%3-!!")$!!!6!`!!&!-!!"8$!!!
+@!`!!&`-!!"J$!!!C!`!!'J-!!"X$!!!F!`!!(3-!!"i$!!!I!`!!)!-!!#%$!!!
+L!`!!)`-!!#3$!!!P!`!!*J-!!#F$!!!S!`!!+3-!!#S$!!!V!`!!,!-!!#d$!!!
+Z!`!!,`-!!$!$!!!a!`!!-J-!!$-$!!!d!`!!03-!!$B$!!!h!`!!1!-!!$N$!!!
+k!`!!1`-!!$`$!!!p!`!!2J-!!$m$!!"!!`!!33-!!%)$!!"$!`!!4!-!!%8$!!"
+'!`!!4`-!!%J$!!"*!`!!5J-!!%X$!!"-!`!!63-!!%i$!!"2!`!!8!-!!&%$!!"
+5!`!!8`-!!&3$!!"9!`!!9J-!!&F$!!"B!`!!@3-!!&S$!!"E!`!!A!-!!&d$!!"
+H!`!!A`-!!'!$!!"K!`!!BJ-!!'-$!!"N!`!!C3-!!'B$!!"R!`!!D!-!!'N$!!"
+U!`!!D`-!!'`$!!"Y!`!!EJ-!!'m$!!"`!`!!F3-!!()$!!"c!`!!G!-!!(8$!!"
+f!`!!G`-!!(J$!!"j!`!!HJ-!!(X$!!"m!`!!I3-!!(i$!!"r!`!"S`-!!)!$!!#
+"!`!!JJ-!!)-$!!#%!`!!K3-!!)B$!!#(!`!!L!-!!)N$!!#+!`!!L`-!!)`$!!#
+0!`!!MJ-!!)m$!!#3!!-!!*%$!!#5!`!!N`-!!*3$!!#9!`!!PJ-!!*F$!!#B!`!
+!Q3-!!*S$!!#E!`!!R!-!!*d$!!#H!`!!R`-!!+!$!!#K!`!!SJ-!!+-$!!#N!`!
+!T3-!!+B$!!#R!`!!U!-!!+N$!!#U!`!!U`-!!+`$!!#Y!`!!VJ-!!+m$!!#`!`!
+!X3-!!,)$!!#c!`!!Y!-!!,8$!!#f!`!!Y`-!!,J$!!#j!`!!ZJ-!!,X$!!#m!`!
+![3-!!,i$!!#r!`!!`!-!!-%$!!$#!`!!``-!!-3$!!$&!`!!aJ-!!-F$!!$)!`!
+!b3-!!-S$!!$,!`!!c!-!!-d$!!$1!`!!c`-!!0!$!!$4!`!!dJ-!!0-$!!$8!`!
+!e3-!!0B$!!$A!`!!f!-!!0N$!!$D!`!!f`-!!0`$!!$G!`!!hJ-!!0m$!!$J!`!
+!i3-!!1)$!!$M!`!!j!-!!18$!!$Q!`!!j`-!!1J$!!$T!`!!kJ-!!1X$!!$X!`!
+!l3-!!1i$!!$[!`!!m!-!!2%$!!$b!`!!m`-!!23$!!$e!`!!pJ-!!2F$!!$i!`!
+!q3-!!2S$!!$l!`!!r!-!!2d$!!$q!`!!r`-!!3!$!!%"!`!"!J-!!3-$!!%%!`!
+""3-!!3B$!!%(!`!"#!-!!3N$!!%+!`!"#`-!!3`$!!%0!`!"$J-!!3m$!!%3!`!
+"%3-!!4)$!!%6!`!"&!-!!48$!!%@!`!"&`-!!4J$!!%C!`!"'J-!!4X$!!%F!`!
+"(3-!!4i$!!%I!`!")!-!!5%$!!%L!`!")`-!!53$!!%P!`!"*J-!!5F$!!%S!`!
+"+3-!!5S$!!%V!`!",!-!!D3$!!%Y!`!",J-!!5m$!!%`!`!"-3-!!6)$!!%c!`!
+"0!-!!68$!!%f!`!"0`-!!6J$!!%j!`!"1J-!!6X$!!%m!`!"23-!!6i$!!%r!`!
+"3!-!!8%$!!&#!`!"3`-!!83$!!&&!`!"4J-!!8F$!!&)!`!"53-!!8S$!!&,!`!
+"6!-!!8d$!!&1!`!"6`-!!9!$!!&4!`!"8J-!!9-$!!&8!`!"93-!!9B$!!&A!`!
+"@!-!!9N$!!&D!`!"@`-!!9`$!!&G!`!"AJ-!!9m$!!&J!`!"B3-!!@)$!!&M!`!
+"C!-!!@8$!!&Q!`!"C`-!!@J$!!&T!`!"DJ-!!@X$!!&X!`!"E3-!!@i$!!&[!`!
+"F!-!!A%$!!&b!`!"F`-!!A3$!!&e!`!"GJ-!!AF$!!&i!`!"H3-!!AS$!!&l!`!
+"I!-!!Ad$!!&q!`!"I`-!!B!$!!'"!`!"JJ-!!B-$!!'%!`!"K3-!!BB$!!'(!`!
+"L!-!!BN$!!'+!`!"L`-!!B`$!!'0!`!"MJ-!!Bm$!!'3!!-!!C%$!!'5!`!"N`-
+!!C3$!!'9!`!"RJ-!!D!$!!'K!`!"Q`-!!D)$!!'D!`!"R!-!!Cd$!!'I!!)!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#`MlJ!!!!!!!!!3!#`NI`!!)!!!!
+!!!!!!!!!!X)fJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!%
+!!!!!"3!!Irm!!!!!Irm!!!!!Irm!!!!!Irm!!!!-!!%!!J!'!!!!"8!!!!J!!3!
+"1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!$rrrr
+r!!!!!`!"!!%k1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!3!!!2rrrrm!!!!%!!%!!6SkD@jME(9NC6S!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!rrrrrd!!!!)!!3!"1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!$rrrrr3!!!!`!"!!%k1MT(990*1QPZBfaeC'8
+k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2rrrrp!!!!%!!%!!6Sk1NG98dN
+kE'PL1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!rrrrrd!!!!8!!J!
+"1NeKBdp6)&0eF("[FR3k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!$rrrr
+r3!!!"J!#!!%k690-1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!3!!!2rrrrp!!!!(!!S!!%eKBdp6)$Bi5b"-D@jVCA)!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%aTBP066#!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!"1J!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J!"6@&M6e-J0MK,)%a
+TEQYPFJ!!!!!!!!!!!!!!!!!!!!!!)%&38%`!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!%&
+`F'`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!%e06%)!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%aTBL"*EA"[FR3J0MK,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%e
+36%B!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%aTBL"*EA"[FR3J0MK
+,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA3d3!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!%p
+#5L!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%e39b"*EA"[FR3J0MK
+,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&"-Ef)!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!&*
+68N-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!&4&@&3ZBQJ!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%*KE'a[EfiJ5'9XF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4
+&@&3ZB`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)$Bi5`!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZBbXV!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%eA)%-[3bXV)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4
+&@&3ZBf-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)$Bi5`!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZBh!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%eA)%-[3bXV)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4
+&@&3ZBh"`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)$Bi5`!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZCAK`!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4
+&@&3ZCf-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%GKE@9$Ef4P)%0[ERC
+PFR4PFJ!!!!!!!!!!!!!!!!!!3!!!!&4&@&3ZD!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%eA)%-[3bXV)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!!&4
+&@&3ZE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%CXCAJJ8(*PF(*[Bf9
+cFfpb!!!!!!!!!!!!!!!!!!!!J!!!!&4&@&3ZF!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%eA)&"KFf0KE#!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4
+&@&3ZF'&c!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)&"KFf0KE#!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZF'0S!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%eA)%-[3bXV)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!&4
+&@&3ZF'0S+bX!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)$Bi5`!
+!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!&4&@&3ZF("e!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%eA)&"KFf0KE#!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!&4
+&@&3ZFJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&*PHJ!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZFf9R!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4
+&@&3ZH3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%*TFfpZ)&"bCA"bEf0
+PFh0[FJ!!!!!!!!!!!!!!!!!!J!!!!'4[Bh8!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!(*
+cFQ-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!(0SE')!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!&"&4L"*EA"[FR3J0MK,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(0
+dG@)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&"&4L"*EA"[FR3J0MK
+,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!ZC'pM!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8!!!!!!
+!!!!ZFR0bB`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!!!&!3%!!3!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B
+!!!!!!3!!!!!&!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!3%!!'eKD@i!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!%"!3!!!!%"!3!!!3%"!!!
+!!!!"!3!!!3%!!3!!!33!!!!!!!!!!!!!#!%!!3%!!3%!!!!"!!!*!!-B6'PL8e0
+-,MBi5b"'B5JdD9miC#NZ6'PL!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!2cmr2cmr2cm!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!r2cmr!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!$3!"!!!!!!!9AdeA49*,8ep(990*Ah"bC@CTH#jS!!!!!!!
+!!!!!!!!!!3!!!!!!!!!!!3!!!!!!!!!!!!!&!3%"!!!"!3!"!!!!!!3!!!!!!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Aep
+cG'&bG!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!%!!!P0CA*RC5"2GA3
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!r2cmr39"36!!"!3!!"#!J)#!$NS0J!h6IH!-$VH!!"3)"!!%"!!%"!3!
+!!3!!!!!!!!!"!3%"!!%"!!%!!33!!!!!!!!!!!!!"`%"!!%!!!%!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!AepcG'&bG!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&!!!)4f9d5&488&-!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!$mr2cp"8&"-!!!%!!!!"!!!!!"!!!"B`!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"2cm
+r2`!!!!!!!!!#!!!!!J!#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!J"3!!%!!3!"!!%!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#G$6d4&*b!R4%&835F
+J*e"*3e3R!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!3!!!%!!!!+!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!%!!!#!!!
+!#`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"!!!!`!!!!`#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!3!!!3!!!!0!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!%!!!&!!!!$J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"!!!"J!!!!m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!3!!!F!!!!3!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!%!!!)!!!
+!%3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"!!!#3!!!")#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!3!!!S!!!!6!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!%!!!,!!!!&!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"!!!$!!!!"8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!3!!!d!!!!@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!%!!!1!!!
+!&`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"!!!$`!!!"J#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!3!!"!!!!!C!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!%!!!4!!!!'J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"!!!%J!!!"X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!3!!"-!!!!F!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!%!!!8!!!
+!(3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"!!!&3!!!"i#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!3!!"B!!!!I!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!%!!!A!!!!)!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"!!!'!!!!#%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!3!!"N!!!!L!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!%!!!D!!!
+!)`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"!!!'`!!!#3#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!3!!"`!!!!P!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!%!!!G!!!!*J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"!!!(J!!!#F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!3!!"m!!!!S!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!%!!!J!!!
+!+3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"!!!)3!!!#S#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!3!!#)!!!!V!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!%!!!M!!!!,!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!!)!!!!$!!!!"!!!!!8!!!!'!!!
+!"`!!!!J!!!!*!!!!#J!!!!X!!!!-!!!!$3!!!!i!!!!2!!!!%!!!!"%!!!!5!!!
+!%`!!!"3!!!!9!!!!&J!!!"F!!!!B!!!!'3!!!"S!!!!E!!!!(!!!!"d!!!!H!!!
+!(`!!!#!!!!!K!!!!)J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)`!!!%!%!!!!"!!
+!)`!!!GS!!3!F!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!"33!!!3%!!!$"!!
+!!J3!!!B%!!!,"!!!#J3!!!N%!!!)"!!!"`3!!!`%!!!5"!!!%33!!"!%!!!2"!!
+!$33!!!i%!!!6"!!!)J3!!#%%!!!J"!!!(`3!!#-%!!!""!!!&!3!!"8%!!!@"!!
+!&`3!!"J%!!!C"!!!'J3!!"X%!!!F"!!!(33!!"i!!J!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!,#2Z!!!!!!!!!"!!,#4r!!!J!!!!!!!!!!!!!#`MD!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J!!!3!!!!!&!!"rr`!!!!"
+rr`!!!!"rr`!!!!"rr`!!!!`!!3!#!!B!!!!&3!!!#!!"!!%k!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!2rrrrm!!!!$!!%!!6Sk!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrrrr`!!!!3
+!!3!"1MTTEQ0XG@4P1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$
+rrrrr3!!!!J!"!!%k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!2rrrrp!!!!$!!%!!6Sk1NG98dNkD@jME(9NC6S!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!rrrrrd!!!!3!!3!"1MSk4e9656TXD@)k!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$rrrrr3!!!"3!#!!%k6@&M6e-J8h9`F'p
+bG$S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!2rrrrp!!!!'!!)!!6T08d`
+k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrrrrd!!!!F
+!#J!!6@&M6e-J0MK,)%aTEQYPFJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!6h"PEP066#!f1'X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!%k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!!&0B@028b!f1%XJ6'PZDf9b!!!!!!!!!!!
+!!!!!!!!!!!!J39"36!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!3A"`E!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"J!!!!68e-3J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!6'P
+L)%PYF'pbG#!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69"-4J!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!6'PL)%PYF'pbG#!f1%X!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!69G$4!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!6d*+)!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69"A)%PYF'pbG#!f1%X!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!8%a[BJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!8P053`!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"J!!!!9%9B9#jLD!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3Q&
+XE'p[EL")C@a`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jM!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ3bp$+bXJ0MK,!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!9%9B9#jM+bX!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69F
+J3bp$+bXJ0MK,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jMB`!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ3bp$+bXJ0MK,!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!9%9B9#jMF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69F
+J3bp$+bXJ0MK,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jMF(!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ3bp$+bXJ0MK,!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!9%9B9#jPH(!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jRB`!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!4f&YC80[C'8J3fpZGQ9bG'9b!!!!!!!!!!!
+!!!!!!!"!!!!!9%9B9#jS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69F
+J3bp$+bXJ0MK,!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!!9%9B9#jX!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!4QaPH#"3FQ9`FQpMCA0cEh)!!!!!!!!!!!!
+!!!!!!!#!!!!!9%9B9#j`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69F
+J8'&cBf&X)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#j`BA-!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ8'&cBf&X)$Bi5`!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!9%9B9#j`BfJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69F
+J3bp$+bXJ0MK,!!!!!!!!!!!!!!!!!!!!!!!!!!#!!!!!9%9B9#j`BfJV+`!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69FJ3bp$+bXJ0MK,!!!!!!!!!!!!!!!!!!!
+!!!!!!!#!!!!!9%9B9#j`F(8!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!69F
+J8'&cBf&X)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!#!!!!!9%9B9#jb!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8Q9k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!9%9B9#jcC@F!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!9%9B9#jj!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3QPcEfiJ8(*PF(*[Bf9cFfpb!!!!!!!!!!!
+!!!!!!!#!!!!!C'pMG3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!FR0bB`!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"J!!!!FfKXBJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8%9
+')%PYF'pbG#!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Fh4eBJ!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!8%9')%PYF'pbG#!f1%X!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!#jNEf-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"3!!!!!!!!!#jbFh*M!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"J!!!!!!8"!3!"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"J!!!!!"!!!!!!8!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!3!
+!E@&TEJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!)!3!"!!!!!3%"!!!"!3%!!!!!!!%"!!!"!3!"!!!
+""!!!!!!!!!!!!!!)!3!"!3!"!3!!!!%!!!N!!!a2F'9Z8e0-+$BiDbN!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!r2cm
+r39"36!!!!J"B`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$mr2cm!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+0!!%!!!!!!"9I69G&8NY6AdG98dPIF(*PCQPi,QJ!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!"!!!!!!!!!!!!!!8"!3%!!!%"!!%!!!!!"!!!!!!!!!!!!!!!!!!!!!!"!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"IAh0dBA*d!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!3!!#8ePFQGP)%peG!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$mr2cp"8&"
+-!!%"!!!%)#!J)!15Jf!$G0pi!`1Yi!!&!J%!!3%!!3%"!!!"!!!!!!!!!!%"!3%
+!!3%!!3!""!!!!!!!!!!!!!!(!3%!!3!!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"IAh0dBA*
+d!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!8!!!G2F'9Z8e0-!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!2cmr2d&38%`!!!3!!!!%!!!!!%!!!&M!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%r2cmr!!!!!!!!!!)!!!!
+#!!)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!&!!!3!
+"!!%!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!8*d024%8R)#G%394"*b!R8%P$9#F!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"3!!!3!!!ES#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!8!!!)!!!'l!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!$!!!"[!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!"3!!"!!!!Ed#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!8!!!8!!!'q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!
+'!!!"[`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"3!!"`!!!F!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!8!!!J!!!("!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!*!!!"`J)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!"3!!#J!!!F-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!8!!!X!!!(%!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!
+-!!!"a3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"3!!$3!!!FB#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!8!!!i!!!((!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!2!!!"b!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!"3!!%!!!!FN#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!8!!"%!!!(+!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!
+5!!!"b`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"3!!%`!!!F`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!8!!"3!!!(E!J%!!!!!!!%!!3-
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!9!!!"h!)"!!!!!!!"!!%$!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!"3!!&J!!!Gd#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!8!!"F!!!(5!J%!!!!!!!%!!3-!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!
+B!!!"f3)"!!!!!!!"!!%$!!!!!!!!!!!!!!!!!3!!!!!!!!!!"3!!'3!!!G3#!3!
+!!!!!!3!"!`!!!!!!!!!!!!!!!!%!!!!!!!!!!!8!!"S!!!(9!J%!!!!!!!%!!3-
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!E!!!"eJ)"!!!!!!!"!!%$!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!"3!!(!!!!G-#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!8!!"d!!!(A!J%!!!!!!!%!!3-!!!!!!!!!!!!!!!!"!!!!!!!!!!!&!!!
+H!!!"f!)"!!!!!!!"!!%$!!!!!!!!!!!!!!!!!3!!!!!!!!!!"3!!(`!!!Im%!3!
+!!!!!!!!"!`!!!!!!!!!!!!!!!)%!!!!!!!!!!!8!!#!!!!(I!J%!!!!!!!%!!3-
+!!!!!!!!!!!!!!!#"!!!!!!!!!!!!!!!!!!!!!3!!!!)!!!!$!!!!"!!!!!8!!!!
+'!!!!"`!!!!J!!!!*!!!!#J!!!!X!!!!-!!!!$3!!!!i!!!!2!!!!%!!!!"%!!!!
+5!!!!&J!!!"X!!!!B!!!!'3!!!"S!!!!F!!!!(3!!!"F!!!!6!!!!&!!!!"8!!!!
+H!!!!(`!!!#!!!!!J"3!!!!8!!#!!!!(D!!%!(!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!8!!!%&!!!#"3!!!`8!!!3&!!!&"3!!"J8!!!F&!!!)"3!!#38!!!S&!!!
+,"3!!$!8!!!d&!!!1"3!!$`8!!"!&!!!4"3!!%J8!!#!&!!!I"3!!%`8!!"3&!!!
+9"3!!&J8!!"d&!!!H"3!!(!8!!"J&!!!A"3!!'38!!"S&!!!E!!)!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!#`MlJ!!!!!!!!!3!#`NI`!!)!!!!!!!!!!!!
+!!X)fJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!%!!!!!"3!
+!Irm!!!!!Irm!!!!!Irm!!!!!Irm!!!!-!!%!!J!'!!!!"8!!!!J!!3!"1J!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!$rrrrr!!!!!`!
+"!!%k1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!2r
+rrrm!!!!%!!%!!6SkD@jME(9NC6S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!rrrrrd!!!!)!!3!"1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!$rrrrr3!!!!`!"!!%k1MT(990*1QPZBfaeC'8k!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2rrrrp!!!!%!!%!!6Sk1NG98dNkE'PL1J!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!rrrrrd!!!!8!!J!"1NeKBdp
+6)&0eF("[FR3k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!$rrrrr3!!!"J!
+#!!%k690-1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!2r
+rrrp!!!!(!!S!!%eKBdp6)&"33b"-D@jVCA)!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!%aTBP066#"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!"1J!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J!"6@&M6e-J8&"$)%aTEQYPFJ!
+!!!!!!!!!!!!!!!!!!!!!(N&38%`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!%&`F'`!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!B!!!!%e06%)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%aTBL"*EA"[FR3J8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%e36%B!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%aTBL"*EA"[FR3J8&"$!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!%eA3d3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!&*68N-!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!B!!!!&4&@&3ZBQJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%*KE'a[EfiJ5'9XF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZB`!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZBbXV!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZBf-
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZBh!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZBh"
+`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZCAK`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZCf-
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%GKE@9$Ef4P)%0[ERCPFR4PFJ!
+!!!!!!!!!!!!!!!!!3!!!!&4&@&3ZD!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!!&4&@&3ZE!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%CXCAJJ8(*PF(*[Bf9cFfpb!!!
+!!!!!!!!!!!!!!!!!J!!!!&4&@&3ZF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%eA)&"KFf0KE#"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZF'&
+c!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)&"KFf0KE#"38%-!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZF'0S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!&4&@&3ZF'0
+S+bX!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%eA)%-[3bXV)&"33`!!!!!!!!!
+!!!!!!!!!!!!!!!!!J!!!!&4&@&3ZF("e!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!%eA)&"KFf0KE#"38%-!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!&4&@&3ZFJ!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&*PHJ!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZF`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&"33d&cE3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&4&@&3ZH3!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%*TFfpZ)&"bCA"bEf0PFh0[FJ!
+!!!!!!!!!!!!!!!!!J!!!!&K$6dB!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&K$6dC')%PYF'pbG#"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!'4[Bh8!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!B!!!!(*cFQ-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!(0SE')!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&"&4L"*EA"[FR3J8&"$!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!(0dG@)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!&"&4L"*EA"[FR3J8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!ZC'p
+M!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!8!!!!!!&!3%!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!!!!3!
+!!!!&!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!3%!!'eKD@i!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!%"!3!!!!%"!3!!!3%"!!!!!!!"!3!
+!!3%!!3!!!33!!!!!!!!!!!!!#!%!!3%!!3%!!!!"!!!*!!-B6'PL8e0-,MBi5b"
+'B5JiD9mdC#NZ6'PL!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!2cmr2cmr2cm!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!r2cmr!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!$3!"!!!!!!!9AdeA49*,8ep(990*Ah"bC@CTH#jS!!!!!!!!!!!!!!!
+!!3!!!3!!!!!!!3!!!!!!!!!!!!!&!3%"!!!"!3!"!!!!!!3!!!!!!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!AepcG'&bG!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!%!!!P0CA*RC5"2GA3!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+r2cmr39"36!!"!3!!"#!J)#!$NS0J!h6IH!-$VH!!"3)"!!%"!!%"!3!!!3!!!!!
+!!!!"!3%"!!%"!!%!!33!!!!!!!!!!!!!"`%"!!%!!!%!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!AepcG'&bG!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&!!-16'PL8e0-,P"33bj-D@)!!!!
+!!!!!!!!!!!!!!!!!!$mr2cmr2cmr!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"2cmr2`!!!!!
+!!!!#!!!!!J!#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!J"3!!%!!3!"!!%!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#G$6d4&*b!R4%&835FJ*e"*3e3
+R!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!B!!!%
+!!!!+!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!'!!!#!!!!#`)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"J!!!`!!!!`#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!!3!!!!0!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!'!!!&!!!!$J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!"J!!"J!!!!m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!!F
+!!!!3!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!'!!!)!!!!%3)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"J!!#3!!!")#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!!S!!!!6!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!'!!!,!!!!&!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!"J!!$!!!!"8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!!d
+!!!!@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!'!!!1!!!!&`)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"J!!$`!!!"J#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!"!!!!!C!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!'!!!4!!!!'J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!"J!!%J!!!"X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!"-
+!!!!F!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!'!!!8!!!!(3)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"J!!&3!!!"i#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!"B!!!!I!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!'!!!A!!!!)!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!"J!!'!!!!#%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!"N
+!!!!L!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!'!!!D!!!!)`)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"J!!'`!!!#3#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!"`!!!!P!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!'!!!G!!!!*J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!"J!!(J!!!#F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!"m
+!!!!S!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!'!!!J!!!!+3)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"J!!)3!!!#S#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!B!!#)!!!!V!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!'!!!M!!!!,!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!!)!!!!$!!!!"!!!!!8!!!!'!!!!"`!!!!J
+!!!!*!!!!#J!!!!X!!!!-!!!!$3!!!!i!!!!2!!!!%!!!!"%!!!!5!!!!%`!!!"3
+!!!!9!!!!&J!!!"F!!!!B!!!!'3!!!"S!!!!E!!!!(!!!!"d!!!!H!!!!(`!!!#!
+!!!!K!!!!)J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)`!!!%!'!!!!"J!!)`B!!!8
+'!!!%"J!!!`B!!!)'!!!'"J!!#`B!!!S'!!!*"J!!#!B!!!F'!!!-"J!!%JB!!"%
+'!!!3"J!!$`B!!!d'!!!1"J!!%`B!!#)'!!!K"J!!)!B!!"m'!!!M"J!!!3B!!"3
+'!!!9"J!!&JB!!"F'!!!B"J!!'3B!!"S'!!!E"J!!(!B!!"d'!!!H!!!"U!!"!#J
+!!!!J!j(*N!!r2`!!!!!!!!!!!!!$NFQ3!!!#!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!X)qi!!!!!!!!!%!!X*(m!!#!!!!!!!!!!!!!!,#0S!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!!!"!!!!!!8!!(rr!!!!!(rr!!!
+!!(rr!!!!!(rr!!!!$!!"!!)!"J!!!!9!!!!)!!%!!6S!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrrrr`!!!!-!!3!"1MS!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!$rrrrr!!!!"!!"!!%
+k1QPZBfaeC'8k!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2rrrrp
+!!!!#!!%!!6S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!rrrrrd!!!!-!!3!"1MSk4e9656TTEQ0XG@4P1J!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!$rrrrr3!!!"!!"!!%k1MT(990*1QaTBMS!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!2rrrrp!!!!&!!)!!6T0B@028b"6GA"`Eh*d1J!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrrrrd!!!!B!!J!"1Ne66$S!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!!$rrrrr3!!!"`!+!!"
+0B@028b"38%-J6'PZDf9b!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+-D@*$FRP`G'mJ8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!%!!6S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!)!!8eKBdp6)&"33b"-D@jVCA)!!!!!!!!!!!!!!!!
+!!!!!!"j"8&"-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!""F("X!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!'!!!!"068a#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"-D@)J5@e
+`Eh*d)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"08%a'!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"-D@)J5@e`Eh*d)&"33`!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"09d0%!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"58e*$!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!'!!!!"849K8,Q*S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"#B@aXEfp
+Z)%KPE(!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q-!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b"38%-!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"849K8,Q-V+`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-
+V+b"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q0M!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b"38%-!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"849K8,Q0`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-
+V+b"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q0`F!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b"38%-!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"849K8,Q9iF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,QGM!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"(B@eP3fpNC5"$EfjfCA*dCA)!!!!!!!!!!!!!!!!
+!!%!!!!"849K8,QJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-
+V+b"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!"849K8,Q`!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"'E'9i)&"bCA"bEf0PFh0[FJ!!!!!!!!!!!!!!!!!
+!!)!!!!"849K8,R!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"3BA0
+MB@`J8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,R"KF`!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"09b"3BA0MB@`J8&"$!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"849K8,R"MD!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-
+V+b"38%-!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!"849K8,R"MD#XV!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b"38%-!!!!!!!!!!!!!!!!!!!!!!!!
+!!)!!!!"849K8,R"`G3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"3BA0
+MB@`J8&"$!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!"849K8,R)!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"5CAS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"849K8,R-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"38%0"Ffd
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,RN!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"#DA0[EL"3FQ9`FQpMCA0cEh)!!!!!!!!!!!!!!!!
+!!)!!!!"B3dp'!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"B3dp'4L"
+*EA"[FR3J8&"$!!!!!!!!!!!!!!!!!!!!!!!!!!"NEf0e!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!'!!!!"bFh*M!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"cD'aL!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"348BJ5@e`Eh*d)&"33`!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!"cG(9L!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"348BJ5@e
+`Eh*d)&"33`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!,Q4[B`!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!&!!!!!!"3%"!!%!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!!!%!!!!!"3!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%"!!"YB@P
+Z!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!J"!!%!!!!"!3%"!3!"!3!!!!!!!3%!!!%"!!%!!!%!!3!
+!!!!!!!!!!!J"!!%"!!%"!!!!!3!!#3!!&deKBdp6)&4[EfaLEhJJ4%9#98FJ0MK
+,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$mr2cp"8&"
+-!!!"J&M!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2cmr2`!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!'!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!d!!3!
+!!!!!&9p09d955e0I4e9659p`FQ9QDAJZD!!!!!!!!!!!!!!!!!%!!!%!!!!!!!%
+!!!!!!!!!!!!!"3%"!3!!!3%!!3!!!!!%!!!!!!!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&pIFh4KFR3!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!3!"!!!*6@9bCf8J6h9d!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2cmr2d&38%`!!3%
+!!!3J)#!J!j+$B!0dhhJ$!khJ!!8#!3!"!3!"!3%!!!%!!!!!!!!!!3%"!3!"!3!
+"!!%%!!!!!!!!!!!!!!F"!3!"!!!"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&pIFh4KFR3!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!"3!$%8aTBN0bHA"dEbj38%-Z6'PL!!!!!!!!!!!!!!!
+!!!!r2cmr2cmr2`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!6mr2cm!!!!!!!!!!J!!!!)!!J!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!8!!"!!%!!3!
+"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!"3R3dp%45FJ*d4"9%%R)#G35808*`!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(!!!"!!!!,3)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!!J!!!#i#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!!-!!!![!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!%!!!!-!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!"3!!!$%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!!B!!!!
+b!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!(!!!!-`)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!#!!!!$3#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!!N!!!!e!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!+!!!!0J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!#`!!!$F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!!`!!!!
+i!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!0!!!!13)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!$J!!!$S#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!!m!!!!l!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!3!!!!2!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!%3!!!$d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!")!!!!
+q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!6!!!!2`)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!&!!!!%!#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!"8!!!""!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!@!!!!3J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!&`!!!%-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!"J!!!"
+%!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!C!!!!43)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!'J!!!%B#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!"X!!!"(!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!F!!!!5!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!(3!!!%N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!"i!!!"
++!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!I!!!!5`)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!)!!!!%`#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!#%!!!"0!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!L!!!!6J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!)`!!!%m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!#3!!!"
+3!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!P!!!!83)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!*J!!!&)#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!#F!!!"6!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!S!!!!9!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!+3!!!&8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!#S!!!"
+@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!V!!!!9`)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!,!!!!&J#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!#d!!!"C!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!Z!!!!@J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!,`!!!&X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!$!!!!"
+F!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!a!!!!A3)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!-J!!!&i#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!$-!!!"I!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!d!!!!B!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!03!!!'%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!$B!!!"
+L!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!h!!!!B`)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!1!!!!'3#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!$N!!!"P!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!!k!!!!CJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!1`!!!'F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!$`!!!"
+S!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!!p!!!!D3)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!2J!!!'S#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!$m!!!"V!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!"!!!!!E!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!33!!!'d#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!%)!!!"
+Z!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"$!!!!E`)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!4!!!!(!#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!%8!!!"a!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!"'!!!!FJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!4`!!!(-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!%J!!!"
+d!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"*!!!!G3)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!5J!!!(B#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!%X!!!"h!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!"-!!!!H!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!63!!!(N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!%i!!!"
+k!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"2!!!!H`)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!8!!!!(`#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!&%!!!"p!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!"5!!!!IJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!8`!!!(m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!&3!!!#
+!!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"9!!!!J3)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!9J!!!))#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!&F!!!#$!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!"B!!!!K!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!@3!!!)8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!&S!!!#
+'!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"E!!!!K`)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!A!!!!)J#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!&d!!!#*!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!"H!!!!LJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!
+!"`!!A`!!!)X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!'!!!!#
+-!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"K!!!!M3)"!!!!!!!
+"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!BJ!!!)i#!3!!!!!!!3!"!3!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!F!!'-!!!#2!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!
+"!!!!!!!!!!!(!!"N!!!!N!!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!F!!'8!!!#4!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"Q!!!
+!NJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!C`!!!*-#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!'J!!!#8!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!(!!"T!!!!P3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"`!!DJ!!!*B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!F!!'X!!!#A!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"X!!!
+!Q!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!E3!!!*N#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!'i!!!#D!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!(!!"[!!!!Q`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"`!!F!!!!*`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!F!!(%!!!#G!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"b!!!
+!RJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!F`!!!*m#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!(3!!!#J!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!(!!"e!!!!S3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"`!!GJ!!!+)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!F!!(F!!!#M!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"i!!!
+!T!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!H3!!!+8#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!(S!!!#Q!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!(!!"l!!!!T`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"`!!I!!!!+J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!F!!(d!!!#T!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!"q!!!
+!UJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!I`!!!+X#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!)!!!!#X!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!(!!#"!!!!V3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"`!!JJ!!!+i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!F!!)-!!!#[!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#%!!!
+!X!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!K3!!!,%#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!)B!!!#b!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!(!!#(!!!!X`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"`!!L!!!!,3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!F!!)N!!!#e!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#+!!!
+!YJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!L`!!!,F#!3!!!!!
+!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!)`!!!#i!J%!!!!!!!%!!3%!!!!
+!!!!!!!!!!!!"!!!!!!!!!!!(!!#0!!!!Z3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!
+!!3!!!!!!!!!!"`!!MJ!!!,S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!
+!!!F!!)m!!!#l!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#3!!!
+!!,`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!*%!!!#p!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#5!!!![J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!N`!!!,m#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!*3!!!$!!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!#9!!!!`3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!PJ!
+!!-)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!*F!!!$$!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#B!!!!a!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!Q3!!!-8#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!*S!!!$'!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!#E!!!!a`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!R!!
+!!-J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!*d!!!$*!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#H!!!!bJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!R`!!!-X#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!+!!!!$-!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!#K!!!!c3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!SJ!
+!!-i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!+-!!!$2!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#N!!!!d!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!T3!!!0%#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!+B!!!$5!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!#R!!!!d`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!U!!
+!!03#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!+N!!!$9!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#U!!!!eJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!U`!!!0F#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!+`!!!$B!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!#Y!!!!f3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!VJ!
+!!0S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!+m!!!$E!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#`!!!!h!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!X3!!!0d#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!,)!!!$H!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!#c!!!!h`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!Y!!
+!!1!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!,8!!!$K!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#f!!!!iJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!Y`!!!1-#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!,J!!!$N!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!#j!!!!j3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!ZJ!
+!!1B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!,X!!!$R!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!#m!!!!k!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!![3!!!1N#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!,i!!!$U!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!#r!!!!k`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!`!!
+!!1`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!-%!!!$Y!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$#!!!!lJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!``!!!1m#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!-3!!!$`!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$&!!!!m3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!aJ!
+!!2)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!-F!!!$c!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$)!!!!p!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!b3!!!28#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!-S!!!$f!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$,!!!!p`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!c!!
+!!2J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!-d!!!$j!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$1!!!!qJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!c`!!!2X#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!0!!!!$m!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$4!!!!r3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!dJ!
+!!2i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!0-!!!$r!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$8!!!"!!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!e3!!!3%#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!0B!!!%#!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$A!!!"!`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!f!!
+!!33#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!0N!!!%&!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$D!!!""J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!f`!!!3F#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!0`!!!%)!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$G!!!"#3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!hJ!
+!!3S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!0m!!!%,!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$J!!!"$!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!i3!!!3d#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!1)!!!%1!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$M!!!"$`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!j!!
+!!4!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!18!!!%4!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$Q!!!"%J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!j`!!!4-#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!1J!!!%8!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$T!!!"&3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!kJ!
+!!4B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!1X!!!%A!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$X!!!"'!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!l3!!!4N#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!1i!!!%D!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$[!!!"'`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!m!!
+!!4`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!2%!!!%G!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$b!!!"(J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!m`!!!4m#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!23!!!%J!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$e!!!")3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!pJ!
+!!5)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!2F!!!%M!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$i!!!"*!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!q3!!!58#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!2S!!!%Q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!$l!!!"*`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!!r!!
+!!5J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!2d!!!%T!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!$q!!!"+J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!!r`!!!5X#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!3!!!!%X!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%"!!!",3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"!J!
+!!5i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!3-!!!%[!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%%!!!"-!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!""3!!!6%#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!3B!!!%b!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%(!!!"-`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"#!!
+!!63#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!3N!!!%e!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%+!!!"0J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"#`!!!6F#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!3`!!!%i!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%0!!!"13)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"$J!
+!!6S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!3m!!!%l!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%3!!!"2!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"%3!!!6d#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!4)!!!%q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%6!!!"2`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"&!!
+!!8!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!48!!!&"!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%@!!!"3J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"&`!!!8-#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!4J!!!&%!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%C!!!"43)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"'J!
+!!8B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!4X!!!&(!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%F!!!"5!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"(3!!!8N#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!4i!!!&+!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%I!!!"5`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!")!!
+!!8`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!5%!!!&0!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%L!!!"6J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!")`!!!8m#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!53!!!&3!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%P!!!"83)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"*J!
+!!9)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!5F!!!&6!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%S!!!"9!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"+3!!!98#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!5S!!!&@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%V!!!"9`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!",!!
+!!9J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!5d!!!&C!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%Z!!!"@J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!",`!!!9X#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!6!!!!&F!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%a!!!"A3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"-J!
+!!9i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!6-!!!&I!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%d!!!"B!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"03!!!@%#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!6B!!!&L!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%h!!!"B`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"1!!
+!!@3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!6N!!!&P!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!%k!!!"CJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"1`!!!@F#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!6`!!!&S!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!%p!!!"D3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"2J!
+!!@S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!6m!!!&V!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&!!!!"E!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"33!!!@d#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!8)!!!&Z!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!&$!!!"E`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"4!!
+!!A!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!88!!!&a!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&'!!!"FJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"4`!!!A-#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!8J!!!&d!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!&*!!!"G3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"5J!
+!!AB#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!8X!!!&h!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&-!!!"H!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"63!!!AN#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!8i!!!&k!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!&2!!!"H`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"8!!
+!!A`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!9%!!!&p!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&5!!!"IJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"8`!!!B!#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!93!!!'"!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!&9!!!"JJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"9J!
+!!B-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!9F!!!'%!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&B!!!"K3)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"@3!!!BB#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!9S!!!'(!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!&E!!!"L!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"A!!
+!!BN#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!9d!!!'+!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&H!!!"L`)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!"`!"A`!!!B`#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!F!!@!!!!'0!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!(!!&K!!!"MJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"BJ!
+!!Bm#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!@-!!!'3!!)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"C!!!!C%#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!@8!!!'5!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!(!!&Q!!!"N`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!"`!"C`!!!C3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!@J
+!!!'9!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&T!!!"PJ)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"DJ!!!CF#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!@X!!!'B!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!(!!&X!!!"Q3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!"`!"E3!!!CS#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!@i
+!!!'E!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&[!!!"R!)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!"`!"F!!!!Cd#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!A%!!!'H!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!(!!&b!!!"R`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!"`!"F`!!!D3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!F!!A3
+!!!'Q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!(!!&e!!!"T`)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!!!!)
+!!!!$!!!!"!!!!!8!!!!'!!!!"`!!!!J!!!!*!!!!#J!!!!X!!!!-!!!!$3!!!!i
+!!!!2!!!!%!!!!"%!!!!5!!!!%`!!!"3!!!!9!!!!&J!!!"F!!!!B!!!!'3!!!"S
+!!!!E!!!!(!!!!"d!!!!H!!!!(`!!!#!!!!!K!!!!)J!!!#-!!!!N!!!!*3!!!#B
+!!!!R!!!!+!!!!#N!!!!U!!!!+`!!!#`!!!!Y!!!!,J!!!#m!!!!`!!!!-3!!!$)
+!!!!c!!!!0!!!!$8!!!!f!!!!0`!!!$J!!!!j!!!!1J!!!$X!!!!m!!!!23!!!$i
+!!!!r!!!!3!!!!%%!!!"#!!!!3`!!!%3!!!"&!!!!4J!!!%F!!!")!!!!53!!!%S
+!!!",!!!!6!!!!%d!!!"1!!!!6`!!!&!!!!"4!!!!8J!!!&-!!!"8!!!!93!!!&B
+!!!"A!!!!@!!!!&N!!!"D!!!!@`!!!&`!!!"G!!!!AJ!!!&m!!!"J!!!!B3!!!')
+!!!"M!!!!C!!!!'8!!!"Q!!!!C`!!!'J!!!"T!!!!DJ!!!'X!!!"X!!!!E3!!!'i
+!!!"[!!!!F!!!!(%!!!"b!!!!F`!!!(3!!!"e!!!!GJ!!!(F!!!"i!!!!H3!!!(S
+!!!"l!!!!I!!!!(d!!!"q!!!!I`!!!)!!!!#"!!!!JJ!!!)-!!!#%!!!!K3!!!)B
+!!!#(!!!!L!!!!)N!!!#+!!!!L`!!!)`!!!#0!!!!MJ!!!)m!!!#3!!!!!*%!!!#
+5!!!!N`!!!*3!!!#9!!!!PJ!!!*F!!!#B!!!!Q3!!!*S!!!#E!!!!R!!!!*d!!!#
+H!!!!R`!!!+!!!!#K!!!!SJ!!!+-!!!#N!!!!T3!!!+B!!!#R!!!!U!!!!+N!!!#
+U!!!!U`!!!+`!!!#Y!!!!VJ!!!+m!!!#`!!!!X3!!!,)!!!#c!!!!Y!!!!,8!!!#
+f!!!!Y`!!!,J!!!#j!!!!ZJ!!!,X!!!#m!!!![3!!!,i!!!#r!!!!`!!!!-%!!!$
+#!!!!``!!!-3!!!$&!!!!aJ!!!-F!!!$)!!!!b3!!!-S!!!$,!!!!c!!!!-d!!!$
+1!!!!c`!!!0!!!!$4!!!!dJ!!!0-!!!$8!!!!e3!!!0B!!!$A!!!!f!!!!0N!!!$
+D!!!!f`!!!0`!!!$G!!!!hJ!!!0m!!!$J!!!!i3!!!1)!!!$M!!!!j!!!!18!!!$
+Q!!!!j`!!!1J!!!$T!!!!kJ!!!1X!!!$X!!!!l3!!!1i!!!$[!!!!m!!!!2%!!!$
+b!!!!m`!!!23!!!$e!!!!pJ!!!2F!!!$i!!!!q3!!!2S!!!$l!!!!r!!!!2d!!!$
+q!!!!r`!!!3!!!!%"!!!"!J!!!3-!!!%%!!!""3!!!3B!!!%(!!!"#!!!!3N!!!%
++!!!"#`!!!3`!!!%0!!!"$J!!!3m!!!%3!!!"%3!!!4)!!!%6!!!"&!!!!48!!!%
+@!!!"&`!!!4J!!!%C!!!"'J!!!4X!!!%F!!!"(3!!!4i!!!%I!!!")!!!!5%!!!%
+L!!!")`!!!53!!!%P!!!"*J!!!5F!!!%S!!!"+3!!!5S!!!%V!!!",!!!!5d!!!%
+Z!!!",`!!!6!!!!%a!!!"-J!!!6-!!!%d!!!"03!!!6B!!!%h!!!"1!!!!6N!!!%
+k!!!"1`!!!6`!!!%p!!!"2J!!!6m!!!&!!!!"33!!!8)!!!&$!!!"4!!!!88!!!&
+'!!!"4`!!!8J!!!&*!!!"5J!!!8X!!!&-!!!"63!!!8i!!!&2!!!"8!!!!9%!!!&
+5!!!"8`!!!93!!!&9!!!"9J!!!9F!!!&B!!!"@3!!!9S!!!&E!!!"A!!!!9d!!!&
+H!!!"A`!!!@!!!!&K!!!"BJ!!!@-!!!&N!!!"C3!!!@B!!!&R!!!"D!!!!@N!!!&
+U!!!"D`!!!@`!!!&Y!!!"EJ!!!@m!!!&`!!!"F3!!!A)!!!&c!!!"G!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"G3!!!B!(!!!
+!"`!"G3F!!!%(!!!#"`!!!`F!!!3(!!!&"`!!"JF!!!F(!!!)"`!!#3F!!!S(!!!
+,"`!!$!F!!!d(!!!1"`!!$`F!!"!(!!!4"`!!%JF!!"-(!!!8"`!!&3F!!"B(!!!
+A"`!!'!F!!"N(!!!D"`!!'`F!!"`(!!!G"`!!(JF!!"m(!!!J"`!!)3F!!#)(!!!
+M"`!!*!F!!#8(!!!Q"`!!*`F!!#J(!!!T"`!!+JF!!#X(!!!X"`!!,3F!!#i(!!!
+["`!!-!F!!$%(!!!b"`!!-`F!!$3(!!!e"`!!0JF!!$F(!!!i"`!!13F!!$S(!!!
+l"`!!2!F!!$d(!!!q"`!!2`F!!%!(!!"""`!!3JF!!%-(!!"%"`!!43F!!%B(!!"
+("`!!5!F!!%N(!!"+"`!!5`F!!%`(!!"0"`!!6JF!!%m(!!"3"`!!83F!!&)(!!"
+6"`!!9!F!!&8(!!"@"`!!9`F!!&J(!!"C"`!!@JF!!&X(!!"F"`!"G!F!!&d(!!"
+H"`!!A`F!!'!(!!"K"`!!BJF!!'-(!!"N"`!!C3F!!'B(!!"R"`!!D!F!!'N(!!"
+U"`!!D`F!!'`(!!"Y"`!!EJF!!'m(!!"`"`!!F3F!!()(!!"c"`!!G!F!!(8(!!"
+f"`!!G`F!!(J(!!"j"`!!HJF!!(X(!!"m"`!!I3F!!(i(!!"r"`!!J!F!!)%(!!#
+#"`!!J`F!!)3(!!#&"`!!KJF!!)F(!!#)"`!!L3F!!)S(!!#,"`!!M!F!!)d(!!#
+1"`!!M`F!!*!!"`!!N3F!!*)(!!#6"`!!P!F!!*8(!!#@"`!!P`F!!*J(!!#C"`!
+!QJF!!*X(!!#F"`!!R3F!!*i(!!#I"`!!S!F!!+%(!!#L"`!!S`F!!+3(!!#P"`!
+!TJF!!+F(!!#S"`!!U3F!!+S(!!#V"`!!V!F!!+d(!!#Z"`!!V`F!!,!(!!#a"`!
+!XJF!!,-(!!#d"`!!Y3F!!,B(!!#h"`!!Z!F!!,N(!!#k"`!!Z`F!!,`(!!#p"`!
+![JF!!,m(!!$!"`!!`3F!!-)(!!$$"`!!a!F!!-8(!!$'"`!!a`F!!-J(!!$*"`!
+!bJF!!-X(!!$-"`!!c3F!!-i(!!$2"`!!d!F!!0%(!!$5"`!!d`F!!03(!!$9"`!
+!eJF!!0F(!!$B"`!!f3F!!0S(!!$E"`!!h!F!!0d(!!$H"`!!h`F!!1!(!!$K"`!
+!iJF!!1-(!!$N"`!!j3F!!1B(!!$R"`!!k!F!!1N(!!$U"`!!k`F!!1`(!!$Y"`!
+!lJF!!1m(!!$`"`!!m3F!!2)(!!$c"`!!p!F!!28(!!$f"`!!p`F!!2J(!!$j"`!
+!qJF!!2X(!!$m"`!!r3F!!2i(!!$r"`!"!!F!!3%(!!%#"`!"!`F!!33(!!%&"`!
+""JF!!3F(!!%)"`!"#3F!!A8(!!%+"`!"#`F!!3`(!!%0"`!"$JF!!3m(!!%3"`!
+"%3F!!4)(!!%6"`!"&!F!!48(!!%@"`!"&`F!!4J(!!%C"`!"'JF!!4X(!!%F"`!
+"(3F!!4i(!!%I"`!")!F!!5%(!!%L"`!")`F!!53(!!%P"`!"*JF!!5F(!!%S"`!
+"+3F!!5S(!!%V"`!",!F!!5d(!!%Z"`!",`F!!6!(!!%a"`!"-JF!!6-(!!%d"`!
+"03F!!6B(!!%h"`!"1!F!!6N(!!%k"`!"1`F!!6`(!!%p"`!"2JF!!6m(!!&!"`!
+"33F!!8)(!!&$"`!"4!F!!88(!!&'"`!"4`F!!8J(!!&*"`!"5JF!!8X(!!&-"`!
+"63F!!8i(!!&2"`!"8!F!!9%(!!&5"`!"8`F!!93(!!&9"`!"9JF!!9F(!!&B"`!
+"@3F!!9S(!!&E"`!"A!F!!9d(!!&H"`!"A`F!!@!(!!&K"`!"BJF!!@-(!!&N"`!
+"C3F!!@B(!!&R"`!"D!F!!@N(!!&U"`!"D`F!!@`(!!&Y"`!"EJF!!@m(!!&`"`!
+"F3F!!A)(!!&c!!!"U!!"!#J!!!!J!j(*N!!r2`!!!!!!!!!!!!!$NFQ3!!!#!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!X)qi!!!!!!!!!%!!X*(m!!#!!!
+!!!!!!!!!!!,#0S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!!!
+"!!!!!!8!!(rr!!!!!(rr!!!!!(rr!!!!!(rr!!!!$!!"!!)!"J!!!!9!!!!)!!%
+!!6S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrr
+rr`!!!!-!!3!"1MS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!%!!!$rrrrr!!!!"!!"!!%k1QPZBfaeC'8k!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!2rrrrp!!!!#!!%!!6S!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!rrrrrd!!!!-!!3!"1MSk4e9656TTEQ0XG@4
+P1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$rrrrr3!!!"!!"!!%k1MT(990
+*1QaTBMS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2rrrrp!!!!&!!)
+!!6T0B@028b"6GA"`Eh*d1J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!rrr
+rrd!!!!B!!J!"1Ne66$S!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!%!!!$rrrrr3!!!"`!+!!"0B@028b!f1%XJ6'PZDf9b!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!"-D@*$FRP`G'mJ0MK,!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!%!!6S!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!!8eKBdp6)$Bi5b"
+-D@jVCA)!!!!!!!!!!!!!!!!!!!!!!#""8&"-!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"
+"F("X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"068a#!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"-D@)J5@e`Eh*d)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+08%a'!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"-D@)J5@e`Eh*d)$B
+i5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09d0%!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"
+23NSJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"08&FJ5@e`Eh*d)$B
+i5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"36'pL!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"
+58e*$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"849K8,Q*S!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"#B@aXEfpZ)%KPE(!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,Q-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q-V+`!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,Q0M!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q0`!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,Q0`F!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,Q9iF!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,QGM!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"(B@eP3fpNC5"$Efj
+fCA*dCA)!!!!!!!!!!!!!!!!!!%!!!!"849K8,QJ!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!"!!!!"
+849K8,Q`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"'E'9i)&"bCA"bEf0
+PFh0[FJ!!!!!!!!!!!!!!!!!!!)!!!!"849K8,R!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"3BA0MB@`J0MK,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,R"KF`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"3BA0MB@`J0MK
+,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,R"MD!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!"
+849K8,R"MD#XV!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"09b"$,d-V+b!f1%X
+!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!"849K8,R"`G3!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"09b"3BA0MB@`J0MK,!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!"
+849K8,R)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"5CAS!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"849K8,R0PC`!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+849K8,RN!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"#DA0[EL"3FQ9`FQp
+MCA0cEh)!!!!!!!!!!!!!!!!!!)!!!!"NEf0e!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"
+bFh*M!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!"cD'aL!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!"348BJ5@e`Eh*d)$Bi5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+cG(9L!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"348BJ5@e`Eh*d)$B
+i5`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!,Q4[B`!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&!!!!!
+!!!!!,R*cFQ-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!!!"3%"!!%!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+'!!!!!!%!!!!!"3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!%"!!"YB@PZ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J"!!%!!!!"!3%!!!%"!3!
+!!!!!!3%!!!%"!!%!!!%%!!!!!!!!!!!!!!J"!!%"!!%"!!!!!3!!#3!$'daTBN0
+bHA"dEbif1'XJ4Q%S0'PI1'3T,NaTBJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!$mr2cmr2cmr!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!2cmr2`!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!d!!3!!!!!!&9p09d955e0I4e9659p`FQ9QDAJZD!!!!!!
+!!!!!!!!!!!%!!!!!!!!!!!%!!!!!!!!!!!!!"3%"!3!!!3%!!3!!!!!%!!!!!!!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&p
+IFh4KFR3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!3!"!!!*6@9bCf8J6h9
+d!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!2cmr2d&38%`!!3%!!!3J)#!J!j+$B!0dhhJ$!khJ!!8#!3!"!3!"!3%
+!!!%!!!!!!!!!!3%"!3!"!3!"!!%%!!!!!!!!!!!!!!F"!3!"!!!"!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!&pIFh4KFR3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"3!!"dp`C@j68d`!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!r2cmr39"36!!!"!!!!!3!!!!!3!!!@-!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!6m
+r2cm!!!!!!!!!!J!!!!)!!J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!)!8!!"!!%!!3!"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"3R3dp%45FJ*d4"9%%
+R)#G35808*`!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!)!!!"!!!!,3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!!J!
+!!#i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!!-!!!![!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!%!!!!-!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!"3!!!$%#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!!B!!!!b!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!(!!!!-`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!#!!
+!!$3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!!N!!!!e!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!+!!!!0J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!#`!!!$F#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!!`!!!!i!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!0!!!!13)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!$J!
+!!$S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!!m!!!!l!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!3!!!!2!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!%3!!!$d#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!")!!!!q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!6!!!!2`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!&!!
+!!%!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!"8!!!""!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!@!!!!3J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!&`!!!%-#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!"J!!!"%!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!C!!!!43)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!'J!
+!!%B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!"X!!!"(!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!F!!!!5!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!(3!!!%N#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!"i!!!"+!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!I!!!!5`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!)!!
+!!%`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!#%!!!"0!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!L!!!!6J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!)`!!!%m#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!#3!!!"3!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!P!!!!83)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!*J!
+!!&)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!#F!!!"6!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!S!!!!9!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!+3!!!&8#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!#S!!!"@!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!V!!!!9`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!,!!
+!!&J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!#d!!!"C!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!Z!!!!@J)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!,`!!!&X#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!$!!!!"F!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!a!!!!A3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!-J!
+!!&i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!$-!!!"I!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!d!!!!B!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!03!!!'%#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!$B!!!"L!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!h!!!!B`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!1!!
+!!'3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!$N!!!"P!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!!k!!!!CJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!1`!!!'F#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!$`!!!"S!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!!p!!!!D3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!2J!
+!!'S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!$m!!!"V!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"!!!!!E!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!33!!!'d#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!%)!!!"Z!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!"$!!!!E`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!4!!
+!!(!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!%8!!!"a!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"'!!!!FJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!4`!!!(-#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!%J!!!"d!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!"*!!!!G3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!5J!
+!!(B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!%X!!!"h!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"-!!!!H!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!63!!!(N#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!%i!!!"k!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!"2!!!!H`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!8!!
+!!(`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!&%!!!"p!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"5!!!!IJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!8`!!!(m#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!&3!!!#!!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!"9!!!!J3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!9J!
+!!))#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!&F!!!#$!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"B!!!!K!)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!@3!!!)8#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!&S!!!#'!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!"E!!!!K`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!A!!
+!!)J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!&d!!!#*!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"H!!!!LJ)"!!!!!!!"!!%"!!!
+!!!!!!!!!!!!!!3!!!!!!!!!!#!!!A`!!!)X#!3!!!!!!!3!"!3!!!!!!!!!!!!!
+!!!%!!!!!!!!!!!J!!'!!!!#-!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!
+!!!!)!!"K!!!!M3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!BJ!
+!!)i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!'-!!!#2!J%!!!!
+!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"N!!!!N!!#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!'8!!!#4!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!)!!"Q!!!!NJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!#!!!C`!!!*-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!'J
+!!!#8!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"T!!!!P3)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!DJ!!!*B#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!'X!!!#A!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!)!!"X!!!!Q!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!#!!!E3!!!*N#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!'i
+!!!#D!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"[!!!!Q`)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!F!!!!*`#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!(%!!!#G!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!)!!"b!!!!RJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!#!!!F`!!!*m#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!(3
+!!!#J!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"e!!!!S3)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!GJ!!!+)#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!(F!!!#M!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!)!!"i!!!!T!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!#!!!H3!!!+8#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!(S
+!!!#Q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!"l!!!!T`)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!I!!!!+J#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!(d!!!#T!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!)!!"q!!!!UJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!#!!!I`!!!+X#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!)!
+!!!#X!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#"!!!!V3)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!JJ!!!+i#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!)-!!!#[!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!)!!#%!!!!X!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!#!!!K3!!!,%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!)B
+!!!#b!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#(!!!!X`)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!L!!!!,3#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!)N!!!#e!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!)!!#+!!!!YJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!#!!!L`!!!,F#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!)`
+!!!#i!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#0!!!!Z3)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!MJ!!!,S#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!)m!!!#l!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!)!!#3!!!!!,`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!*%!!!#p!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#
+5!!!![J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!N`!!!,m#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!*3!!!$!!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#9!!!!`3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!PJ!!!-)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!*F!!!$$!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#
+B!!!!a!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!Q3!!!-8#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!*S!!!$'!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#E!!!!a`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!R!!!!-J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!*d!!!$*!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#
+H!!!!bJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!R`!!!-X#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!+!!!!$-!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#K!!!!c3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!SJ!!!-i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!+-!!!$2!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#
+N!!!!d!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!T3!!!0%#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!+B!!!$5!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#R!!!!d`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!U!!!!03#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!+N!!!$9!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#
+U!!!!eJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!U`!!!0F#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!+`!!!$B!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#Y!!!!f3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!VJ!!!0S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!+m!!!$E!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#
+`!!!!h!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!X3!!!0d#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!,)!!!$H!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#c!!!!h`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!Y!!!!1!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!,8!!!$K!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#
+f!!!!iJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!Y`!!!1-#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!,J!!!$N!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#j!!!!j3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!ZJ!!!1B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!,X!!!$R!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#
+m!!!!k!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!![3!!!1N#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!,i!!!$U!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!#r!!!!k`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!`!!!!1`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!-%!!!$Y!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+#!!!!lJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!``!!!1m#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!-3!!!$`!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$&!!!!m3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!aJ!!!2)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!-F!!!$c!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+)!!!!p!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!b3!!!28#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!-S!!!$f!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$,!!!!p`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!c!!!!2J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!-d!!!$j!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+1!!!!qJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!c`!!!2X#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!0!!!!$m!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$4!!!!r3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!dJ!!!2i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!0-!!!$r!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+8!!!"!!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!e3!!!3%#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!0B!!!%#!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$A!!!"!`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!f!!!!33#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!0N!!!%&!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+D!!!""J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!f`!!!3F#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!0`!!!%)!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$G!!!"#3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!hJ!!!3S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!0m!!!%,!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+J!!!"$!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!i3!!!3d#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!1)!!!%1!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$M!!!"$`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!j!!!!4!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!18!!!%4!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+Q!!!"%J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!j`!!!4-#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!1J!!!%8!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$T!!!"&3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!kJ!!!4B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!1X!!!%A!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+X!!!"'!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!l3!!!4N#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!1i!!!%D!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$[!!!"'`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!m!!!!4`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!2%!!!%G!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+b!!!"(J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!m`!!!4m#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!23!!!%J!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$e!!!")3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!pJ!!!5)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!2F!!!%M!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+i!!!"*!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!q3!!!58#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!2S!!!%Q!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$l!!!"*`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!!r!!!!5J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!2d!!!%T!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!$
+q!!!"+J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!!r`!!!5X#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!3!!!!%X!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%"!!!",3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"!J!!!5i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!3-!!!%[!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+%!!!"-!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!""3!!!6%#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!3B!!!%b!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%(!!!"-`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"#!!!!63#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!3N!!!%e!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
++!!!"0J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"#`!!!6F#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!3`!!!%i!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%0!!!"13)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"$J!!!6S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!3m!!!%l!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+3!!!"2!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"%3!!!6d#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!4)!!!%q!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%6!!!"2`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"&!!!!8!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!48!!!&"!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+@!!!"3J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"&`!!!8-#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!4J!!!&%!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%C!!!"43)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"'J!!!8B#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!4X!!!&(!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+F!!!"5!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"(3!!!8N#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!4i!!!&+!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%I!!!"5`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!")!!!!8`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!5%!!!&0!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+L!!!"6J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!")`!!!8m#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!53!!!&3!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%P!!!"83)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"*J!!!9)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!5F!!!&6!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+S!!!"9!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"+3!!!98#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!5S!!!&@!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%V!!!"9`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!",!!!!9J#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!5d!!!&C!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+Z!!!"@J)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!",`!!!9X#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!6!!!!&F!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%a!!!"A3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"-J!!!9i#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!6-!!!&I!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+d!!!"B!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"03!!!@%#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!6B!!!&L!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%h!!!"B`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"1!!!!@3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!6N!!!&P!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%
+k!!!"CJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"1`!!!@F#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!6`!!!&S!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!%p!!!"D3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"2J!!!@S#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!6m!!!&V!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&
+!!!!"E!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"33!!!@d#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!8)!!!&Z!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&$!!!"E`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"4!!!!A!#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!88!!!&a!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&
+'!!!"FJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"4`!!!A-#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!8J!!!&d!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&*!!!"G3)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"5J!!!AB#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!8X!!!&h!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&
+-!!!"H!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"63!!!AN#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!8i!!!&k!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&2!!!"H`)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"8!!!!A`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!9%!!!&p!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&
+5!!!"IJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"8`!!!B!#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!93!!!'"!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&9!!!"JJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"9J!!!B-#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!9F!!!'%!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&
+B!!!"K3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"@3!!!BB#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!9S!!!'(!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&E!!!"L!)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"A!!!!BN#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!9d!!!'+!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&
+H!!!"L`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"A`!!!B`#!3!
+!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!@!!!!'0!J%!!!!!!!%!!3%
+!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&K!!!"MJ)"!!!!!!!"!!%"!!!!!!!!!!!
+!!!!!!3!!!!!!!!!!#!!"BJ!!!Bm#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!
+!!!!!!!J!!@-!!!'3!!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!
+"C!!!!C%#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!@8!!!'5!J%
+!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&Q!!!"N`)"!!!!!!!"!!%
+"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"C`!!!C3#!3!!!!!!!3!"!3!!!!!!!!!
+!!!!!!!%!!!!!!!!!!!J!!@J!!!'9!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!
+!!!!!!!!)!!&T!!!"PJ)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!
+"DJ!!!CF#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!@X!!!'B!J%
+!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&X!!!"Q3)"!!!!!!!"!!%
+"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"E3!!!CS#!3!!!!!!!3!"!3!!!!!!!!!
+!!!!!!!%!!!!!!!!!!!J!!@i!!!'E!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!
+!!!!!!!!)!!&[!!!"R!)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!
+"F!!!!Cd#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!J!!A%!!!'H!J%
+!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!)!!&b!!!"R`)"!!!!!!!"!!%
+"!!!!!!!!!!!!!!!!!3!!!!!!!!!!#!!"F`!!!D3#!3!!!!!!!3!"!3!!!!!!!!!
+!!!!!!!%!!!!!!!!!!!J!!A3!!!'Q!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!
+!!!!!!!!)!!&e!!!"T`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!3!!!!)!!!!$!!!!"!!!!!8!!!!'!!!!"`!!!!J!!!!*!!!
+!#J!!!!X!!!!-!!!!$3!!!!i!!!!2!!!!%!!!!"%!!!!5!!!!%`!!!"3!!!!9!!!
+!&J!!!"F!!!!B!!!!'3!!!"S!!!!E!!!!(!!!!"d!!!!H!!!!(`!!!#!!!!!K!!!
+!)J!!!#-!!!!N!!!!*3!!!#B!!!!R!!!!+!!!!#N!!!!U!!!!+`!!!#`!!!!Y!!!
+!,J!!!#m!!!!`!!!!-3!!!$)!!!!c!!!!0!!!!$8!!!!f!!!!0`!!!$J!!!!j!!!
+!1J!!!$X!!!!m!!!!23!!!$i!!!!r!!!!3!!!!%%!!!"#!!!!3`!!!%3!!!"&!!!
+!4J!!!%F!!!")!!!!53!!!%S!!!",!!!!6!!!!%d!!!"1!!!!6`!!!&!!!!"4!!!
+!8J!!!&-!!!"8!!!!93!!!&B!!!"A!!!!@!!!!&N!!!"D!!!!@`!!!&`!!!"G!!!
+!AJ!!!&m!!!"J!!!!B3!!!')!!!"M!!!!C!!!!'8!!!"Q!!!!C`!!!'J!!!"T!!!
+!DJ!!!'X!!!"X!!!!E3!!!'i!!!"[!!!!F!!!!(%!!!"b!!!!F`!!!(3!!!"e!!!
+!GJ!!!(F!!!"i!!!!H3!!!(S!!!"l!!!!I!!!!(d!!!"q!!!!I`!!!)!!!!#"!!!
+!JJ!!!)-!!!#%!!!!K3!!!)B!!!#(!!!!L!!!!)N!!!#+!!!!L`!!!)`!!!#0!!!
+!MJ!!!)m!!!#3!!!!!*%!!!#5!!!!N`!!!*3!!!#9!!!!PJ!!!*F!!!#B!!!!Q3!
+!!*S!!!#E!!!!R!!!!*d!!!#H!!!!R`!!!+!!!!#K!!!!SJ!!!+-!!!#N!!!!T3!
+!!+B!!!#R!!!!U!!!!+N!!!#U!!!!U`!!!+`!!!#Y!!!!VJ!!!+m!!!#`!!!!X3!
+!!,)!!!#c!!!!Y!!!!,8!!!#f!!!!Y`!!!,J!!!#j!!!!ZJ!!!,X!!!#m!!!![3!
+!!,i!!!#r!!!!`!!!!-%!!!$#!!!!``!!!-3!!!$&!!!!aJ!!!-F!!!$)!!!!b3!
+!!-S!!!$,!!!!c!!!!-d!!!$1!!!!c`!!!0!!!!$4!!!!dJ!!!0-!!!$8!!!!e3!
+!!0B!!!$A!!!!f!!!!0N!!!$D!!!!f`!!!0`!!!$G!!!!hJ!!!0m!!!$J!!!!i3!
+!!1)!!!$M!!!!j!!!!18!!!$Q!!!!j`!!!1J!!!$T!!!!kJ!!!1X!!!$X!!!!l3!
+!!1i!!!$[!!!!m!!!!2%!!!$b!!!!m`!!!23!!!$e!!!!pJ!!!2F!!!$i!!!!q3!
+!!2S!!!$l!!!!r!!!!2d!!!$q!!!!r`!!!3!!!!%"!!!"!J!!!3-!!!%%!!!""3!
+!!3B!!!%(!!!"#!!!!3N!!!%+!!!"#`!!!3`!!!%0!!!"$J!!!3m!!!%3!!!"%3!
+!!4)!!!%6!!!"&!!!!48!!!%@!!!"&`!!!4J!!!%C!!!"'J!!!4X!!!%F!!!"(3!
+!!4i!!!%I!!!")!!!!5%!!!%L!!!")`!!!53!!!%P!!!"*J!!!5F!!!%S!!!"+3!
+!!5S!!!%V!!!",!!!!5d!!!%Z!!!",`!!!6!!!!%a!!!"-J!!!6-!!!%d!!!"03!
+!!6B!!!%h!!!"1!!!!6N!!!%k!!!"1`!!!6`!!!%p!!!"2J!!!6m!!!&!!!!"33!
+!!8)!!!&$!!!"4!!!!88!!!&'!!!"4`!!!8J!!!&*!!!"5J!!!8X!!!&-!!!"63!
+!!8i!!!&2!!!"8!!!!9%!!!&5!!!"8`!!!93!!!&9!!!"9J!!!9F!!!&B!!!"@3!
+!!9S!!!&E!!!"A!!!!9d!!!&H!!!"A`!!!@!!!!&K!!!"BJ!!!@-!!!&N!!!"C3!
+!!@B!!!&R!!!"D!!!!@N!!!&U!!!"D`!!!@`!!!&Y!!!"EJ!!!@m!!!&`!!!"F3!
+!!A)!!!&c!!!"G!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!"G3!!!B!)!!!!#!!"G3!!!GS!!3!F!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!#!!!!3J!!!))!!!$#!!!"!J!!!8)!!!'#!!!"`J!!!J)!!!*#!!!#JJ
+!!!X)!!!-#!!!$3J!!!i)!!!2#!!!%!J!!"%)!!!5#!!!%`J!!"3)!!!9#!!!&JJ
+!!"F)!!!B#!!!'3J!!"S)!!!E#!!!(!J!!"d)!!!H#!!!(`J!!#!)!!!K#!!!)JJ
+!!#-)!!!N#!!!*3J!!#B)!!!R#!!!+!J!!#N)!!!U#!!!+`J!!#`)!!!Y#!!!,JJ
+!!#m)!!!`#!!!-3J!!$))!!!c#!!!0!J!!$8)!!!f#!!!0`J!!$J)!!!j#!!!1JJ
+!!$X)!!!m#!!!23J!!$i)!!!r#!!!3!J!!%%)!!"##!!!3`J!!%3)!!"&#!!!4JJ
+!!%F)!!")#!!!53J!!%S)!!",#!!!6!J!!%d)!!"1#!!!6`J!!&!)!!"4#!!!8JJ
+!!&-)!!"8#!!!93J!!&B)!!"A#!!!@!J!!&N)!!"D#!!!@`J!!&`)!!&d#!!!A3J
+!!&i)!!"I#!!!B!J!!'%)!!"L#!!!B`J!!'3)!!"P#!!!CJJ!!'F)!!"S#!!!D3J
+!!'S)!!"V#!!!E!J!!'d)!!"Z#!!!E`J!!(!)!!"a#!!!FJJ!!(-)!!"d#!!!G3J
+!!(B)!!"h#!!!H!J!!(N)!!"k#!!!H`J!!(`)!!"p#!!!IJJ!!(m)!!#!#!!!J3J
+!!)))!!#$#!!!K!J!!)8)!!#'#!!!K`J!!)J)!!#*#!!!LJJ!!)X)!!#-#!!!M3J
+!!)i)!!#2#!!!N!!)!!#4#!!!NJJ!!*-)!!#8#!!!P3J!!*B)!!#A#!!!Q!J!!*N
+)!!#D#!!!Q`J!!*`)!!#G#!!!RJJ!!*m)!!#J#!!!S3J!!+))!!#M#!!!T!J!!+8
+)!!#Q#!!!T`J!!+J)!!#T#!!!UJJ!!+X)!!#X#!!!V3J!!+i)!!#[#!!!X!J!!,%
+)!!#b#!!!X`J!!,3)!!#e#!!!YJJ!!,F)!!#i#!!!Z3J!!,S)!!#l#!!![!J!!,d
+)!!#q#!!![`J!!-!)!!$"#!!!`JJ!!--)!!$%#!!!a3J!!-B)!!$(#!!!b!J!!-N
+)!!$+#!!!b`J!!-`)!!$0#!!!cJJ!!-m)!!$3#!!!d3J!!0))!!$6#!!!e!J!!08
+)!!$@#!!!e`J!!0J)!!$C#!!!fJJ!!0X)!!$F#!!!h3J!!0i)!!$I#!!!i!J!!1%
+)!!$L#!!!i`J!!13)!!$P#!!!jJJ!!1F)!!$S#!!!k3J!!1S)!!$V#!!!l!J!!1d
+)!!$Z#!!!l`J!!2!)!!$a#!!!mJJ!!2-)!!$d#!!!p3J!!2B)!!$h#!!!q!J!!2N
+)!!$k#!!!q`J!!2`)!!$p#!!!rJJ!!2m)!!%!#!!"!3J!!3))!!%$#!!""!J!!38
+)!!%'#!!""`J!!3J)!!%*#!!"G3J!!3S)!!%,#!!"$!J!!3d)!!%1#!!"$`J!!4!
+)!!%4#!!"%JJ!!4-)!!%8#!!"&3J!!4B)!!%A#!!"'!J!!4N)!!%D#!!"'`J!!4`
+)!!%G#!!"(JJ!!4m)!!%J#!!")3J!!5))!!%M#!!"*!J!!58)!!%Q#!!"*`J!!5J
+)!!%T#!!"+JJ!!5X)!!%X#!!",3J!!5i)!!%[#!!"-!J!!6%)!!%b#!!"-`J!!63
+)!!%e#!!"0JJ!!6F)!!%i#!!"13J!!6S)!!%l#!!"2!J!!6d)!!%q#!!"2`J!!8!
+)!!&"#!!"3JJ!!8-)!!&%#!!"43J!!8B)!!&(#!!"5!J!!8N)!!&+#!!"5`J!!8`
+)!!&0#!!"6JJ!!8m)!!&3#!!"83J!!9))!!&6#!!"9!J!!98)!!&@#!!"9`J!!9J
+)!!&C#!!"@JJ!!9X)!!&F#!!"A3J!!9i)!!&I#!!"B!J!!@%)!!&L#!!"B`J!!@3
+)!!&P#!!"CJJ!!@F)!!&S#!!"D3J!!@S)!!&V#!!"E!J!!@d)!!&Z#!!"E`J!!A!
+)!!&a#!!"FJJ!!A-#!!!"!!!!!3)"!!!!!!!"!!%$!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!J!!!J!!!!)#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!3!!!!!!!!!!!)!!!-
+!!!!$!J%!!!!!!!%!!3-!!!!!!!!!!!!!!!!%!!!!!!!!!!!#!!!%!!!!"!)"!!!
+!!!!"!!%$!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J!!"3!!!!8#!3!!!!!!!3!"!`!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!!B!!!!'!J%!!!!!!!%!!3-!!!!!!!!!!!!
+!!!!&!!!!!!!!!!!#!!!(!!!!"`)"!!!!!!!"!!%$!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!J!!#!!!!!J#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!8!!!!!!!!!!!)!!!N
+!!!!*!J%!!!!!!!%!!3-!!!!!!!!!!!!!!!!&!!!!!!!!!!!#!!!+!!!"I`)"!!!
+!!!!"!!%$!!!!!!!!!!!!!!!!!3!!!!!!!!!!!J!!#`!!!DN#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!!`!!!'U!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!#!!!0!!!"U`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!J!!$J!!!D`#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!!m
+!!!'Y!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!#!!!3!!!"VJ)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!J!!%3!!!Dm#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!")!!!'`!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!#!!!6!!!"X3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!J!!&!!!!E)#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!"8
+!!!'c!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!#!!!@!!!"Y!)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!J!!&`!!!E8#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!"J!!!'f!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!#!!!C!!!"Y`)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!J!!'J!!!EJ#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!"X
+!!!'j!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!#!!!F!!!"ZJ)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!J!!(3!!!EX#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!"i!!!'m!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!#!!!I!!!"[3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!J!!)!!!!Ei#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!#%
+!!!'r!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!#!!!L!!!"`!)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!J!!)`!!!F%#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!#3!!!(#!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!#!!!P!!!"``)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!J!!*J!!!F3#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!#F
+!!!(&!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!#!!!S!!!"aJ)"!!!
+!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!!!!!!!J!!+3!!!FF#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!#S!!!()!J%!!!!!!!%!!3%!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!#!!!V!!!"b3)"!!!!!!!"!!%"!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!J!!,!!!!FS#!3!!!!!!!3!"!3!!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!#d
+!!!(,!J%!!!!!!!%!!3%!!!!!!!!!!!!!!!!"!!!!!!!!!!!#!!!Z!!!"T3)"!!!
+!!!!"!!%$!!!!!!!!!!!!!!!!!3!!!!!!!!!!!J!!,`!!!F`#!3!!!!!!!3!"!3!
+!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!$!!!!(0!J%!!!!!!!%!!3-!!!!!!!!!!!!
+!!!!"!!!!!!!!!!!#!!!a!!!"cJ)"!!!!!!!"!!%$!!!!!!!!!!!!!!!!!3!!!!!
+!!!!!!J!!-J!!!Fm#!3!!!!!!!3!"!`!!!!!!!!!!!!!!!!%!!!!!!!!!!!)!!$-
+!!!(p"!%!!!!!!!!!!3-!!!!!!!!!!!!!!!#"!!!!!!!!!!!#!!!d!!!"rJ3"!!!
+!!!!!!!%$!!!!!!!!!!!!!!!!J3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'!!!!J)!!J!!!!!#!`!&!!!
+!!!)%!!`!!!!!!J8!#J!!!!!#"J!#!!!!!!)(!!8!!!!!!JJ!!J!!!!!##3!'!!!
+!!!)+!!d!!!!!!JX!"3!!!!!#$!!&!!!!!!)0!!%!!!!!!Ji!!3!!!!!#$`!(!!!
+!!!)3!!J!!!!!!K%!"3!!!!!#%J!#!!!!!!)6!!)!!!!!!K3!#!!!!!!#&3!"!!!
+!!!)@!!%!!!!!!KF!#!!!!!!#'!!*!!!!!!)C!!3!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!"jJF!!!%!!!!!!!!!!!!!!!!!!!!!Y0m2&2rrr[B
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(R#!!!!3!!!!!!!!!!!!!!!!!!!!#
+dh`m8rrr13J!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!J!!!!"i!!!!!(L!!!
+!!H%!!!!"j!!!!!(P!!!!!H-!!!!"jJ!!!!(R!!%!!!!b8Np29!!!!!!!!!!!!!!
+!!!C(8P93!!!!!!!!!!%18Qpj*h-J4f9d5&488&-!!!!%4NP-43%!!D*'58a&!3!
+"SdC*6%8"!!'K4NP-43%!!D"(8P93!!!!!!!!!!)66h"PEP066#""F("XD@0KG'P
+[EJ!!!#0'58a&!J!!(%C*6%8#!!!U4NP-43)!!!e'58a&!J!!)%C*6%8#!!!54NP
+-43)!!"0'58a&!J!!&NC*6%8#!!!B4NP-43)!!"G'58a&!J!!$NC*6%8#!!!H4NP
+-43)!!"&'58a&!J!!%%C*6%8#!!!K4NP-43)!!"4'58a&!J!!&8C*6%8#!!!X4NP
+-43)!!"T'58a&!J!!'8C*6%8#!!!S4NP-43)!!#G'58a&!J!!*%C*6%8#!!!Y4NP
+-43)!!!Y'58a&!J!!*NC*6%8#!!!T4NP-43)!!!a'58a&!J!!+dC*6%8#!!!L4NP
+-43)!!!p'58a&!J!!'dC*6%8#!!!G4NP-43)!!"p'58a&!J!!*8C*6%8#!!!M4e*
+98!!!!!!!!!!$%8p`C@j68d`J6'PLFQ&bD@9c!!!!"%G599!!!!!!!!!!"!038%-
+!!!!#4NP-43)!!$0'58a&!J!!0%G599!!!!!!!!!!"3-f1'X!!!!#4NP-438!!#"
+'58a&"3!!(dG599!!!!!!!!!!"JCMFRP`G'm!!!!S4NP-43%!!Aa'58a&!3!"INC
+*6%8"!!'N4NP-43%!!Cp'58a&!3!"I8C*6%8"!!&l4e*98!!!!!!!!!!("'&cEM%
+!!!"A4NP-43%!!$j'58a&!3!!-8C*6%8"!!"&4NP-43%!!$P'58a&!3!!3dC*6%8
+"!!!m4NP-43%!!$p'58a&!3!!3%C*6%8"!!"%4NP-43%!!%&'58a&!3!!0dC*6%8
+"!!!e4NP-43%!!$Y'58a&!3!!-NC*6%8"!!!i4NP-43%!!%K'58a&!3!!4NC*6%8
+"!!"#4NP-43%!!$C'58a&!3!!4dC*6%8"!!')4NP-43%!!("'58a&!3!!I%C*6%8
+"!!"i4NP-43%!!(T'58a&!3!!H8C*6%8"!!"a4NP-43%!!(C'58a&!3!!FNC*6%8
+"!!"p4NP-43%!!B&'58a&!3!!FdC*6%8"!!"e4NP-43%!!(Y'58a&!3!!A8C*6%8
+"!!"04NP-43%!!&P'58a&!3!!6NC*6%8"!!"D4NP-43%!!%p'58a&!3!!@dC*6%8
+"!!"34NP-43%!!&a'58a&!3!!5dC*6%8"!!"A4NP-43%!!%a'58a&!3!!@%C*6%8
+"!!"Z4NP-43%!!'p'58a&!3!"LNC*6%8"!!"X4NP-43%!!'e'58a&!3!"L8C*6%8
+"!!',4NP-43%!!'9'58a&!3!!D8C*6%8"!!"S4NP-43%!!'G'58a&!3!!BdC*6%8
+"!!"N4NP-43%!!'&'58a&!3!!DNC*6%8"!!"L4NP-43%!!'C'58a&!3!!8dC*6%8
+"!!"84NP-43%!!&9'58a&!3!!9NC*6%8"!!"*4NP-43%!!%T'58a&!3!!ANC*6%8
+"!!"54NP-43%!!$T'58a&!3!!GdC*6%8"!!!c4NP-43%!!(4'58a&!3!!,dC*6%8
+"!!!Z4NP-43%!!#e'58a&!3!!28C*6%8"!!!d4NP-43%!!Ba'58a&!3!!88C*6%8
+"!!!`4NP-43%!!&p'58a&!3!!B%C*6%8"!!"V4e*98!!!!!!!!!!)!Q*Q!!!!"8C
+*6%8"!!##4NP-43%!!(p'58a&!3!!J%C*6%8"!!"q4NP-43%!!)&(8P93!!!!!!!
+!!!N$BQP[!!!!$NC*6%8"!!#%4NP-43%!!Be'58a&!3!!JdC*6%8"!!'14NP-43%
+!!C&'58a&!3!"MdC*6%8"!!'3!%C*6%8"!!#&4NP-43%!!C*'58a&!3!"J%C*6%8
+"!!'(4NP-43%!!C9'58a&!3!"NdC*6%8"!!'84e*98!!!!!!!!!!+!Q*Z!!!!&%C
+*6%8"!!#'4NP-43%!!)P'58a&!3!!LdC*6%8"!!#14NP-43%!!DC'58a&!3!!N8C
+*6%8"!!#64NP-43%!!*4'58a&!3!!PNC*6%8"!!#B4NP-43%!!)K'58a&!3!!M8C
+*6%8"!!#54NP-43%!!)T'58a&!3!!PdC*6%8"!!#(4NP-43%!!*9'58a&!3!!MdC
+*6%8"!!#3!%C*6%8"!!#-4e*98!!!!!!!!!!,"Q*eCQCPFJ!!!!*'58a&!3!!Q8C
+*6%8"!!#D4e*98!!!!!!!!!!-"'0KFh3!!!!&4NP-43%!!*p'58a&!3!!R%C*6%8
+"!!#G4NP-43%!!*Y'58a&!3!!RNG599!!!!!!!!!!$34MEfe`!!!!!dC*6%8"!!#
+J4NP-43%!!+&'58a&!3!!SNG599!!!!!!!!!!$J4MEfjQ!!!!!NC*6%8"!!#M4NP
+-43%!!+4(8P93!!!!!!!!!!m$C'9c!!!!'NC*6%8"!!#P4NP-43%!!+C'58a&!3!
+!U%C*6%8"!!#T4NP-43%!!+Y'58a&!3!!V%C*6%8"!!#Z4NP-43%!!CC'58a&!3!
+!VdC*6%8"!!#b4NP-43%!!,0'58a&!3!!Y%C*6%8"!!#e4NP-43%!!,C'58a&!3!
+!Z%C*6%8"!!#j4NP-43%!!,T'58a&!3!!UNC*6%8"!!#`4NP-43%!!,G'58a&!3!
+![8C*6%8"!!#l4NP-43%!!+G'58a&!3!!X8C*6%8"!!#m4NP-43%!!+e(8P93!!!
+!!!!!!"!#C'J!!!!&4NP-43%!!-"'58a&!3!!`8C*6%8"!!$#4NP-43%!!,j'58a
+&!3!![dG599!!!!!!!!!!%30NFf%!!!!)4NP-43%!!-9'58a&!3!!aNC*6%8"!!$
+(4NP-43%!!-0'58a&!3!!b8C*6%8"!!$)4NP-43%!!-4'58a&!3!"JNG599!!!!!
+!!!!!%J0PFR)!!!!$4NP-43%!!-T'58a&!3!!bdC*6%8"!!$-4e*98!!!!!!!!!!
+6!f9fF!!!!$p'58a&!3!!ddC*6%8"!!$54NP-43%!!04'58a&!3!!eNC*6%8"!!$
+V4NP-43%!!0e'58a&!3!!j%C*6%8"!!$c4NP-43%!!1a'58a&!3!!hNC*6%8"!!$
+P4NP-43%!!24'58a&!3!!k%C*6%8"!!$D4NP-43%!!2G'58a&!3!"!NC*6%8"!!$
+K4NP-43%!!2"'58a&!3!!q%C*6%8"!!$Y4NP-43%!!0p'58a&!3!!jNC*6%8"!!$
+e4NP-43%!!1P'58a&!3!!fdC*6%8"!!$L4NP-43%!!2&'58a&!3!!kNC*6%8"!!$
+F4NP-43%!!10'58a&!3!!mNC*6%8"!!$Z4NP-43%!!1"'58a&!3!!jdC*6%8"!!$
+f4NP-43%!!2j'58a&!3!!qdC*6%8"!!$m4NP-43%!!3"'58a&!3!"!8C*6%8"!!$
+j4NP-43%!!2T'58a&!3!!r8C*6%8"!!$r4NP-43%!!3C'58a&!3!""dC*6%8"!!%
+)4NP-43%!!3P'58a&!3!""8C*6%8"!!%%4NP-43%!!30'58a&!3!!cdC*6%8"!!$
+04NP-43%!!-j'58a&!3!!e8C*6%8"!!$[4NP-43%!!0&'58a&!3!!edC*6%8"!!$
+34NP-43%!!0P'58a&!3!!f%C*6%8"!!'A4NP-43%!!CK(8P93!!!!!!!!!"3%D'e
+KB`!!!!&'58a&!3!"#NG599!!!!!!!!!!&34TC'9K!!!!"8C*6%8"!!%,4NP-43%
+!!3a'58a&!3!"$NC*6%8"!!%04NP-43%!!3p(8P93!!!!!!!!!"B&E'KKFfJ!!!!
+#4NP-43%!!4"'58a&!3!"%8G599!!!!!!!!!!&`0YC$)!!!!#4NP-43%!!4*'58a
+&!3!"%dG599!!!!!!!!!!'!0YC$8!!!!#4NP-43%!!44'58a&!3!"&8G599!!!!!
+!!!!!'34YC'-b!!!!!NC*6%8"!!%@4NP-43%!!4G(8P93!!!!!!!!!"S(Ef*UC@0
+dF`!!!!4'58a&!3!"'dC*6%8"!!%B4NP-43%!!4T'58a&!3!"'8G599!!!!!!!!!
+!'`0`C@d!!!!'4NP-43%!!5&'58a&!3!")%C*6%8"!!%H4NP-43%!!4p'58a&!3!
+"(%C*6%8"!!%G4e*98!!!!!!!!!!F"R"VBh-a-J!!!""'58a&!3!")NC*6%8"!!%
+M4NP-43%!!54'58a&!3!"*8C*6%8"!!%Q4NP-43%!!5G'58a&!3!"+%C*6%8"!!%
+T4NP-43%!!5T'58a&!3!"+dC*6%8"!!%X4NP-43%!!5e'58a&!3!",NC*6%8"!!%
+[4NP-43%!!CP'58a&!3!"-%G599!!!!!!!!!!(39`Df0c0`!!!!C'58a&!3!"-NC
+*6%8"!!%c4NP-43%!!6&'58a&!3!"R%C*6%8"!!'D4NP-43%!!CY(8P93!!!!!!!
+!!"i%FQ&ZC!!!!!4'58a&!3!"0%C*6%8"!!%e4NP-43%!!6C'58a&!3!"TdG599!
+!!!!!!!!!(`0bBc)!!!!&4NP-43%!!6T'58a&!3!"1dC*6%8"!!%j4NP-43%!!6G
+'58a&!3!"1%G599!!!!!!!!!!)!0bBc3!!!!#4NP-43%!!6e'58a&!3!"2%G599!
+!!!!!!!!!)30bBc8!!!!&4NP-43%!!8*'58a&!3!"3%C*6%8"!!&"4NP-43%!!6j
+'58a&!3!"2dG599!!!!!!!!!!)JCbDA"PE@3!!!!#4NP-43%!!80'58a&!3!"4%G
+599!!!!!!!!!!)`0bFf%!!!!-4NP-43%!!89'58a&!3!"4dC*6%8"!!&)4NP-43%
+!!8e'58a&!3!"6%C*6%8"!!&'4NP-43%!!8Y'58a&!3!"6NC*6%8"!!&*4NP-43%
+!!8T'58a&!3!"R8C*6%8"!!'H4e*98!!!!!!!!!!N!h0SB3!!!!4'58a&!3!"88C
+*6%8"!!&24NP-43%!!9*'58a&!3!"8%G599!!!!!!!!!!*39cG'&MD`!!!!&'58a
+&!3!"8dG599!!!!!!!!!!*JCdH(4IC')!!!!"4NP-43%!!94(8P93!!!!!!!!!#F
+%H$8`13!!!"9'58a&!3!"A%C*6%8"!!&E4NP-43%!!@&'58a&!3!"@NC*6%8"!!&
+J4NP-43%!!@*'58a&!3!"JdC*6%8"!!&Q4NP-43%!!@0'58a&!3!"@%C*6%8"!!&
+G4NP-43%!!9G'58a&!3!"C8C*6%8"!!&H4NP-43%!!9P'58a&!3!"AdC*6%8"!!&
+R4NP-43%!!@4'58a&!3!"K%C*6%8"!!&94NP-43%!!9C(8P93!!!!!!!!!#J'H$8
+`1ABc!!!!&8C*6%8"!!&V4NP-43%!!@a'58a&!3!"E8C*6%8"!!&a4NP-43%!!A0
+'58a&!3!"G8C*6%8"!!&h4NP-43%!!AT'58a&!3!"D%C*6%8"!!&b4NP-43%!!@T
+'58a&!3!"H%C*6%8"!!&T4NP-43%!!AC'58a&!3!"G%C*6%8"!!&`4NP-43%!!AP
+'58a&!3!"ENC*6%8"!!&[4NP-43%!!B9'58a&!3!"KNG599!!!!!!!!!!+30cFf`
+!!!!M4NP-43%!!"0'58a&!3!!&8C*6%8"!!!34NP-43%!!"*'58a&!3!!%8C*6%8
+"!!!84NP-43%!!"T'58a&!3!!(%C*6%8"!!!A4NP-43%!!"P'58a&!3!!'%C*6%8
+"!!!E4NP-43%!!"C'58a&!3!!$8C*6%8"!!!24NP-43%!!!Y'58a&!3!!$%C*6%8
+"!!!14NP-43%!!#Y'58a&!3!!,%C*6%8"!!!S4NP-43%!!#T'58a&!3!!+8C*6%8
+"!!!M4NP-43%!!#*'58a&!3!!(dC*6%8"!!!P4NP-43%!!#"'58a&!3!!*NC*6%8
+"!!!N4NP-43%!!"j'58a&!3!!*dC*6%8"!!!G4NP-43%!!!T'58a&!3!!)8G599!
+!!!!!!!!!+Jj(990*)%aTBR*KFQPPF`!!!!0'58a&!J!!,dG599!!!!!!!!!!+`0
+38%-!!!!$4NP-43)!!$"'58a&!J!!-8C*6%8#!!!b4e*98!!!!!!!!!!X!cBiD`!
+!!!0'58a&"3!!&%C*6%8&!!!94NP-438!!"C(8P93!!!!!!!!!#d138j655"-D@*
+bBA*TCA-!!!!#4e*98!!!!!!!!!!Z!e"33`!!!!*'58a&!3!!!8C*6%8"!!&r4e*
+98!!!!!!!!!![!cBiD`!!!!*'58a&!`!"S%C*6%8$!!'K4e*98!!!!!!!!!!`$8e
+KBb"-D@*bBA*TCA-!!!!#4e*98!!!!!!!!!!a!e"33`!!!!P'58a&!3!!"%C*6%8
+"!!!#4NP-43%!!!0'58a&!3!!#8C*6%8"!!!)4NP-43%!!!G'58a&!3!!"NC*6%8
+"!!!&4NP-43%!!D9(8P93!!!!!!!!!$)$0MKV!!!!"NC*6%8$!!'D4NP-43-!!D*
+'58a&!`!"R%C*6%8$!!'G4NP-43-!!Cp'58a&!`!"Q`!!!!!!!!!!!!!!Y,T3!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!#"J%#!!!c"`%#!!!d!!!!!J3""3!!)!J""3!!(`!!!HF
+!!!)!!!!6e`!!&!!!!!(R!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!$*!!!!i!!!&0i
+!!"J!!!!!b3!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!!!!H!"!!!"!!!!!!!!!!!
+!"!!"!!!"k,6I$a6rrqXL!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"i3)!!!%
+!!!!!!!!!!!!%!!%!!!(dY0m2*3!!DlF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!(L!`!!!3!!!!!!!!!!!!3!!3!!!I@dh`m8!!!`R3!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!H-%!!!"!!!!!!!!!!!!"!!"!!!"ql6I$a6rrjeI!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!"j!8!!!%!!!!!!!!!!!!%!!%!!!(mY0m2*IrrcT!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"j3B!!!%!!!!!!!!!!!!%!!%!!!(
+pY0m2&2rrVV8!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Q"`!!!3!!!!!!!!!
+!!!3!!3!!!Ikdh`m8rrrqpJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!HF)!!!
+"!!!!!!!!!!!!"!!"!!!"rl6I$a6rrmj#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!"+!!!'!"YFh4b!!!!!!!!!!!!!!!!!!!C+!!!#S"YFh4X!!!!!!!!!!!!!!!
+!!!!MU!!!!i"YFh4Z!!!!!!!!!!!!!!!!!!!R+!!!'!"YFh4b!!!$k!!!!!!!!!!
+!!!!r+!!!'B"YFh4X!!!$k!!!!!!!!!!!!!%0dJ!!#)"YFh4Z!!!$k!!!!!!!!!!
+!!!"E+!!!"4"`FQ9Q!!jqcJ!!!!%!!!!!!!"J1!!!!!K`FQ9Q!!i,hJ!!!!)!!!!
+!!!"J3!!!!"T`FQ9Q!!i*C!!!!!-!!!!!!!"J@J!!$+"`FQ9Q!!j"B3!!!!3!!!!
+!!!"XqJ!!"K4`FQ9Q!!kHI3!!!!8!!!!!!!"c$J!!#*C`FQ9Q!!j,f`!!!!B!!!!
+!!!"lT!!!!3G`FQ9Q!!ihQJ!!!!F!!!!!!!"mU`!!!b"`FQ9Q!!iT1`!!!!J!!!!
+!!!"rb`!!!"4`FQ9Q!!jZi!!!!!N!!!!!!!"rh`!!!!T`FQ9Q!!jf-!!!!!S!!!!
+!!!"rk3!!!!a`FQ9Q!!k$&3!!!!X!!!!!!!"rp3!!!!j`FQ9Q!!l6V!!!!!`!!!!
+!!!#!!`!!!3C`FQ9Q!!l9e3!!!!d!!!!!!!#"#3!!!$j`FQ9Q!!k(*3!!!!i!!!!
+!!!#"4`!!!!j`FQ9Q!!j"33!!!!m!!!!!!!#"93!!!GT`FQ9Q!!jMQ`!!!"!!!!!
+!!!#$,`!!!'*`FQ9Q!!iIT3!!!"%!!!!!!!#$N3!!!"4`FQ9Q!!i)0`!!!")!!!!
+!!!#$T3!!!!T`FQ9Q!!k[Z3!!!"-!!!!!!!#$V`!!!!a`FQ9Q!!kCE!!!!"3!!!!
+!!!#$Z`!!!-T`FQ9Q!!jHY`!!!"8!!!!!!!#%K3!!!4K`FQ9Q!!kSh!!!!"B!!!!
+!!!#&R3!!!+K`FQ9Q!!j(T3!!!"F!!!!!!!#'43!!!#j`FQ9Q!!i#aJ!!!"J!!!!
+!!!#'F`!!!Ja`FQ9Q!!lpS`!!!"N!!!!!!!#)I`!!4J"YG("X!!!!!3!!!!!!!!!
+!!!$1I`!!"`"YG("c!!!!!3!!!!!!!!!!!!$9I`!!!""YG("T!!!!!3!!!!!!!!!
+!!!$9M`!!"TaYG'a[!!!!!3!!!!!!!!!!!!$F+`!!!#"YG(0X!!!!!3!!!!!!!!!
+!!!$F5`!!"4"`FQ9Q!!klZ`!!!"S!!!!!!!$K@`!!!!K`FQ9Q!!lq$`!!!"X!!!!
+!!!$KB`!!!"T`FQ9Q!!lTR!!!!"`!!!!!!!$KI3!!%0"`FQ9Q!!jkK!!!!"d!!!!
+!!!$b63!!"K4`FQ9Q!!lQ%3!!!"i!!!!!!!$iB3!!#*C`FQ9Q!!l4QJ!!!"m!!!!
+!!!%!p`!!!3G`FQ9Q!!l9lJ!!!#!!!!!!!!%"rJ!!!b"`FQ9Q!!i2K!!!!#%!!!!
+!!!%&(J!!!"4`FQ9Q!!kki3!!!#)!!!!!!!%&-J!!!!T`FQ9Q!!lUEJ!!!#-!!!!
+!!!%&2!!!!!a`FQ9Q!!l+`J!!!#3!!!!!!!%&5!!!!!j`FQ9Q!!j@3J!!!#8!!!!
+!!!%&9J!!!3C`FQ9Q!!kR#`!!!#B!!!!!!!%'A!!!!$j`FQ9Q!!i993!!!#F!!!!
+!!!%'QJ!!!!j`FQ9Q!!km6J!!!#J!!!!!!!%'U!!!!GT`FQ9Q!!kq6J!!!#N!!!!
+!!!%)JJ!!!'*`FQ9Q!!lXDJ!!!#S!!!!!!!%)j!!!!"4`FQ9Q!!lEH!!!!#X!!!!
+!!!%)q!!!!!T`FQ9Q!!i6c`!!!#`!!!!!!!%*!J!!!!a`FQ9Q!!iSA!!!!#d!!!!
+!!!%*$J!!!-T`FQ9Q!!i15!!!!#i!!!!!!!%*f!!!!4K`FQ9Q!!i#2!!!!#m!!!!
+!!!%+m!!!!+K`FQ9Q!!l,'3!!!$!!!!!!!!%,Q!!!!#j`FQ9Q!!l[K3!!!$%!!!!
+!!!%,aJ!!!Ja`FQ9Q!!kqX!!!!$)!!!!!!!0#I!!!#J"YG("X!!!!!J!!!!!!!!!
+!!!"BU!!!!3"YG("c!!!!!J!!!!!!!!!!!!"CU!!!!""YG("T!!!!!J!!!!!!!!!
+!!!%BiJ!!!0"YG'a[!!!!!J!!!!!!!!!!!!%CXJ!!!#"YG(0X!!!!!J!!!!!!!!!
+!!!%CdJ!!"4"`FQ9Q!!lk53!!!$-!!!!!!!%HiJ!!!!K`FQ9Q!!ibfJ!!!$3!!!!
+!!!%HkJ!!!"T`FQ9Q!!j($3!!!$8!!!!!!!%I"!!!$+"`FQ9Q!!ipM3!!!$B!!!!
+!!!%VT!!!"K4`FQ9Q!!kR*3!!!$F!!!!!!!%aZ!!!#5C`FQ9Q!!lqqJ!!!$J!!!!
+!!!%khJ!!!3G`FQ9Q!!j"k!!!!$N!!!!!!!%lj3!!!b"`FQ9Q!!jU8`!!!$S!!!!
+!!!%r"3!!!"4`FQ9Q!!m!0!!!!$X!!!!!!!%r'3!!!!T`FQ9Q!!kBq3!!!$`!!!!
+!!!%r)`!!!!a`FQ9Q!!ia@3!!!$d!!!!!!!%r,`!!!!j`FQ9Q!!kDRJ!!!$i!!!!
+!!!%r23!!!3C`FQ9Q!!i"i`!!!$m!!!!!!!&!3`!!!$j`FQ9Q!!ja`3!!!%!!!!!
+!!!&!J3!!!!j`FQ9Q!!lI4!!!!%%!!!!!!!&!M`!!!GT`FQ9Q!!j[I`!!!%)!!!!
+!!!&#D3!!!'*`FQ9Q!!iXV!!!!%-!!!!!!!&#b`!!!"4`FQ9Q!!i&T`!!!%3!!!!
+!!!&#h`!!!!T`FQ9Q!!lfMJ!!!%8!!!!!!!&#k3!!!!a`FQ9Q!!km-!!!!%B!!!!
+!!!&#p3!!!-T`FQ9Q!!k+c3!!!%F!!!!!!!&$[`!!!4K`FQ9Q!!jBk`!!!%J!!!!
+!!!&%e`!!!+K`FQ9Q!!i30J!!!%N!!!!!!!&&I`!!!#j`FQ9Q!!kMJ3!!!%S!!!!
+!!!&&V3!!!Ja`FQ9Q!!jc,3!!!%X!!!!!!!&(Z3!!4J"YG("X!!!!!`!!!!!!!!!
+!!!'0Z3!!"`"YG("c!!!!!`!!!!!!!!!!!!'8Z3!!!""YG("T!!!!!`!!!!!!!!!
+!!!'8b3!!!#"YG(0X!!!!!`!!!!!!!!!!!!'8k3!!"T!!EA4XE`!!!!-!!!!!!!!
+!!!!"QhN!!!83F(*PCJ!1L,S!!!"-!!!!!!!"S)N!!!!)F(*PCJ!1iN8!!!"0!!!
+!!!!"S*%!!!!DF(*PCJ!1d&S!!!"1!!!!!!!"S+X!!"$3F(*PCJ!1Rh-!!!"2!!!
+!!!!"XAX!!!B8F(*PCJ!1P(-!!!"3!!!!!!!"Yim!!!NQF(*PCJ!1LkB!!!"4!!!
+!!!!"`,8!!!%(F(*PCJ!1VAF!!!"5!!!!!!!"`E`!!!-JF(*PCJ!1ejm!!!"6!!!
+!!!!"a0`!!!!8F(*PCJ!1FbF!!!"8!!!!!!!"a2!!!!!+F(*PCJ!1@,m!!!"9!!!
+!!!!"a2S!!!!-F(*PCJ!1VG`!!!"@!!!!!!!"a3B!!!!1F(*PCJ!1@GJ!!!"A!!!
+!!!!"a43!!!%'F(*PCJ!1G1)!!!"B!!!!!!!"aKS!!!!qF(*PCJ!1CB`!!!"C!!!
+!!!!"aPJ!!!!1F(*PCJ!1*2X!!!"D!!!!!!!"aQB!!!(DF(*PCJ!19#X!!!"E!!!
+!!!!"b%!!!!"LF(*PCJ!1mb!!!!"F!!!!!!!"b+)!!!!8F(*PCJ!1m`8!!!"G!!!
+!!!!"b,B!!!!+F(*PCJ!1fHN!!!"H!!!!!!!"b-!!!!!-F(*PCJ!1$)-!!!"I!!!
+!!!!"b-`!!!$+F(*PCJ!1%CN!!!"J!!!!!!!"bCB!!!%BF(*PCJ!1Y5%!!!"K!!!
+!!!!"bUi!!!#SF(*PCJ!1$e8!!!"L!!!!!!!"beB!!!!ZF(*PCJ!1VXF!!!"M!!!
+!!!!"bi3!!!)-F(*PCJ!1YBi!!!"N!!!!!!!"cC!!!!!+!'edF'`!!!!%!!!!!!!
+!!!!!!GH3!!!!!3"YG("c!!!!"!!!!!!!!!!!!!(BN!!!!!!3EA4`D3!!!!3!!!!
+!!!!!!!!"f+!!!!!JEA4cE!!!!!3!!!!!!!!!!!!"f-!!!!#-EA4XE`!!!!3!!!!
+!!!!!!!!"f8`!!!83F(*PCJ!1C"3!!!"P!!!!!!!"hP`!!!!)F(*PCJ!1MEF!!!"
+Q!!!!!!!"hQ3!!!!DF(*PCJ!1SV`!!!"R!!!!!!!"hRi!!"$3F(*PCJ!1NlJ!!!"
+S!!!!!!!"ldi!!!B8F(*PCJ!1G1B!!!"T!!!!!!!"p@)!!!NQF(*PCJ!1lFS!!!"
+U!!!!!!!"rSJ!!!%(F(*PCJ!1ff%!!!"V!!!!!!!"rim!!!-JF(*PCJ!1r-N!!!"
+X!!!!!!!#!Um!!!!8F(*PCJ!1r(F!!!"Y!!!!!!!#!X-!!!!+F(*PCJ!1%0B!!!"
+Z!!!!!!!#!Xd!!!!-F(*PCJ!11!J!!!"[!!!!!!!#!YN!!!!1F(*PCJ!1Lh%!!!"
+`!!!!!!!#!ZF!!!%'F(*PCJ!1,BX!!!"a!!!!!!!#!qd!!!!qF(*PCJ!1KTd!!!"
+b!!!!!!!#"#X!!!!1F(*PCJ!1%am!!!"c!!!!!!!#"$N!!!(DF(*PCJ!1HE-!!!"
+d!!!!!!!#"K-!!!"LF(*PCJ!1idJ!!!"e!!!!!!!#"R8!!!!8F(*PCJ!1AA!!!!"
+f!!!!!!!#"SN!!!!+F(*PCJ!1j"8!!!"h!!!!!!!#"T-!!!!-F(*PCJ!1Qr-!!!"
+i!!!!!!!#"Tm!!!$+F(*PCJ!1a+%!!!"j!!!!!!!#"fN!!!%BF(*PCJ!1CMm!!!"
+k!!!!!!!##)%!!!#SF(*PCJ!1XB!!!!"l!!!!!!!##5N!!!!ZF(*PCJ!1mR8!!!"
+m!!!!!!!##9F!!!)-F(*PCJ!1Z,`!!!"p!!!!!!!##f-!!!8!EA4`E!!!!!8!!!!
+!!!!!!!!!@EJ!!!#!EA4`F`!!!!8!!!!!!!!!!!!!@MJ!!!!3EA4`D3!!!!8!!!!
+!!!!!!!!#%2-!!!!JEA4cE!!!!!8!!!!!!!!!!!!#%4-!!!#!EA4XE`!!!!8!!!!
+!!!!!!!!#%C-!!!83F(*PCJ!1a$B!!!"q!!!!!!!#&U-!!!!)F(*PCJ!1ppX!!!"
+r!!!!!!!#&UX!!!!DF(*PCJ!1YK%!!!#!!!!!!!!#&X8!!"$3F(*PCJ!1UKi!!!#
+"!!!!!!!#*j8!!!B8F(*PCJ!1!fJ!!!##!!!!!!!#,DN!!!L@F(*PCJ!1bY3!!!#
+$!!!!!!!#0Mm!!!%(F(*PCJ!1D*S!!!#%!!!!!!!#0dB!!!-JF(*PCJ!1Q1)!!!#
+&!!!!!!!#1QB!!!!8F(*PCJ!1DmN!!!#'!!!!!!!#1RS!!!!+F(*PCJ!1B[N!!!#
+(!!!!!!!#1S3!!!!-F(*PCJ!1Y%%!!!#)!!!!!!!#1T!!!!!!$R"bC@B!$Z2!!!!
+!L3!!!!!!!MUH!!!""R"bC@B!$K+Q!!!!LJ!!!!!!!MZN!!!!2R"bC@B!$Y45!!!
+!L`!!!!!!!M[L!!!!$R"bC@B!$ThJ!!!!M!!!!!!!!M[`!!!"fR"bC@B!$L2p!!!
+!M3!!!!!!!Mh+!!!!BR"bC@B!$UH%!!!!MJ!!!!!!!MiX!!!!&("bC@B!$U1Q!!!
+!M`!!!!!!!Mj!!!!!#R"bC@B!$Rrm!!!!N!!!!!!!!!)q5J!!!!a`FQ9Q!!iEh`!
+!!*%!!!!!!!)q9J!!!-T`FQ9Q!!j-XJ!!!*)!!!!!!!)r)!!!!4K`FQ9Q!!jGN3!
+!!*-!!!!!!!*!1!!!!+K`FQ9Q!!i5!3!!!*3!!!!!!!*!i!!!!#j`FQ9Q!!lG5`!
+!!*8!!!!!!!*"$J!!!Ja`FQ9Q!!jL+`!!!*B!!!!!!!*$'J!!#J"YG("X!!!!"J!
+!!!!!!!!!!!*0'J!!!3"YG("c!!!!"J!!!!!!!!!!!!*1'J!!!""YG("T!!!!"J!
+!!!!!!!!!!!*1+J!!!)aYG'a[!!!!"J!!!!!!!!!!!!*1YJ!!!#"YG(0X!!!!"J!
+!!!!!!!!!!!*1eJ!!"4"`FQ9Q!!ke'`!!!*F!!!!!!!*6jJ!!!!K`FQ9Q!!iPYJ!
+!!*J!!!!!!!*6lJ!!!"T`FQ9Q!!k$'`!!!*N!!!!!!!*8#!!!%0"`FQ9Q!!iDS3!
+!!*S!!!!!!!*Nf!!!"K4`FQ9Q!!k8"3!!!*X!!!!!!!*Ul!!!#*C`FQ9Q!!iKFJ!
+!!*`!!!!!!!*cJJ!!!3G`FQ9Q!!iTD3!!!*d!!!!!!!*dL3!!!b"`FQ9Q!!i1j`!
+!!*i!!!!!!!*hU3!!!"4`FQ9Q!!jL[3!!!*m!!!!!!!*h[3!!!!T`FQ9Q!!jXAJ!
+!!+!!!!!!!!*ha`!!!!a`FQ9Q!!jr'`!!!+%!!!!!!!*hd`!!!!j`FQ9Q!!k0TJ!
+!!+)!!!!!!!*hi3!!!3C`FQ9Q!!i0!3!!!+-!!!!!!!*ij`!!!$j`FQ9Q!!j!f3!
+!!+3!!!!!!!*j*3!!!!j`FQ9Q!!k[33!!!+8!!!!!!!*j-`!!!GT`FQ9Q!!iY93!
+!!+B!!!!!!!*l$3!!!'*`FQ9Q!!i`KJ!!!+F!!!!!!!*lE`!!!"4`FQ9Q!!jK6!!
+!!+J!!!!!!!*lJ`!!!!T`FQ9Q!!kKkJ!!!+N!!!!!!!*lM3!!!!a`FQ9Q!!k[X3!
+!!+S!!!!!!!*lQ3!!!-T`FQ9Q!!iUj!!!!+X!!!!!!!*mB`!!!4K`FQ9Q!!iAM3!
+!!+`!!!!!!!*pH`!!!+K`FQ9Q!!jMNJ!!!+d!!!!!!!*q)`!!!#j`FQ9Q!!lid!!
+!!+i!!!!!!!*q83!!!Ja`FQ9Q!!iiI!!!!+m!!!!!!!+!A3!!2!"YG("X!!!!"`!
+!!!!!!!!!!!+mA3!!"J"YG("c!!!!"`!!!!!!!!!!!!,#A3!!!""YG("T!!!!"`!
+!!!!!!!!!!!,#E3!!"G4YG'a[!!!!"`!!!!!!!!!!!!,)33!!!#"YG(0X!!!!"`!
+!!!!!!!!!!!,)B3!!"4"`FQ9Q!!i1N!!!!!#`!!!!!!!#cA%!!!!)F(*PCJ!1PMd
+!!!#a!!!!!!!#cAN!!!!DF(*PCJ!1G*S!!!#b!!!!!!!#cC-!!"$3F(*PCJ!1m28
+!!!#c!!!!!!!#hQ-!!!B8F(*PCJ!18k%!!!#d!!!!!!!#j(F!!!NQF(*PCJ!1&dF
+!!!#e!!!!!!!#lCd!!!%(F(*PCJ!1a"8!!!#f!!!!!!!#lU3!!!-JF(*PCJ!1h-`
+!!!#h!!!!!!!#mF3!!!!8F(*PCJ!1Gj-!!!#i!!!!!!!#mGJ!!!!+F(*PCJ!1c58
+!!!#j!!!!!!!#mH)!!!!-F(*PCJ!1Nd!!!!#k!!!!!!!#mHi!!!!1F(*PCJ!1Kq%
+!!!#l!!!!!!!#mI`!!!%'F(*PCJ!1ebJ!!!#m!!!!!!!#m`)!!!!qF(*PCJ!1C`N
+!!!#p!!!!!!!#md!!!!!1F(*PCJ!1qpm!!!#q!!!!!!!#mdi!!!(DF(*PCJ!1EaJ
+!!!#r!!!!!!!#p5J!!!"LF(*PCJ!1m4i!!!$!!!!!!!!#pBS!!!!8F(*PCJ!1#Td
+!!!$"!!!!!!!#pCi!!!!+F(*PCJ!1d"!!!!$#!!!!!!!#pDJ!!!!-F(*PCJ!1Mb-
+!!!$$!!!!!!!#pE3!!!$+F(*PCJ!1+43!!!$%!!!!!!!#pRi!!!%BF(*PCJ!1BQB
+!!!$&!!!!!!!#pjB!!!#SF(*PCJ!1JbF!!!$'!!!!!!!#q$i!!!!ZF(*PCJ!1jBJ
+!!!$(!!!!!!!#q'`!!!)-F(*PCJ!1EJ)!!!$)!!!!!!!#qRJ!!$`!EA4`E!!!!!J
+!!!!!!!!!!!!$0RJ!!!B!EA4`F`!!!!J!!!!!!!!!!!!$2(J!!!!3EA4`D3!!!!J
+!!!!!!!!!!!!$2)J!!!!JEA4cE!!!!!J!!!!!!!!!!!!$2+J!!!A8EA4XE`!!!!J
+!!!!!!!!!!!!$D9S!!"$%EA4RE!!!!qJ!!!!!!!!!!!!$8d!!!!!XE@pdD3!!!!!
+!!!!!!!!!!!!$8f`!!"1!8%acG!!19TJ!!!$*!!!!!!!"&P)!!!)XEA"cD3!!!qJ
+!!!!!!!!!!!!$D1S!!!!3EA0dF!!!!!)!!!!!!!!!!!!$D2S!!!!3EA0dF!!!!!8
+!!!!!!!!!!!!!@NJ!!!!SEA0dD3!!!qJ!!!!!!!!!!!!$D6)!!!!SEA0dD3!!!!!
+!!!!!!!!!!!!!@R!!!!!-E@&XE!!!!!!!!!!!!!!!!!!$6(`!!!$%E@&`E!!!!!!
+!!!!!!!!!!-eY!!!:
diff --git a/src/lib/libssl/src/MacOS/TODO b/src/lib/libssl/src/MacOS/TODO
new file mode 100644
index 0000000000..903eb133de
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/TODO
@@ -0,0 +1,18 @@
+-------------------------------------------------------------------
+Verify server certificate
+-------------------------------------------------------------------
+Currently omitted from the project:
+
+        crypto/tmdiff.c
+        crypto/bio/bss_conn.c
+        crypto/bio/b_sock.c
+        crypto/bio/bss_acpt.c
+        crypto/bio/bss_log.h
+
+-------------------------------------------------------------------
+Build libraries to link with...
+-------------------------------------------------------------------
+Port openssl application.
+-------------------------------------------------------------------
+BN optimizations (currently PPC version is compiled with BN_LLONG)
+-------------------------------------------------------------------
diff --git a/src/lib/libssl/src/MacOS/_MWERKS_GUSI_prefix.h b/src/lib/libssl/src/MacOS/_MWERKS_GUSI_prefix.h
new file mode 100644
index 0000000000..fe6b5387d6
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/_MWERKS_GUSI_prefix.h
@@ -0,0 +1,9 @@
+#include <MacHeaders.h>
+#define B_ENDIAN
+#ifdef __POWERPC__
+#pragma longlong on
+#endif
+#if 1
+#define MAC_OS_GUSI_SOURCE
+#endif
+#define MONOLITH
diff --git a/src/lib/libssl/src/MacOS/_MWERKS_prefix.h b/src/lib/libssl/src/MacOS/_MWERKS_prefix.h
new file mode 100644
index 0000000000..2189da753b
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/_MWERKS_prefix.h
@@ -0,0 +1,9 @@
+#include <MacHeaders.h>
+#define B_ENDIAN
+#ifdef __POWERPC__
+#pragma longlong on
+#endif
+#if 0
+#define MAC_OS_GUSI_SOURCE
+#endif
+#define MONOLITH
diff --git a/src/lib/libssl/src/MacOS/buildinf.h b/src/lib/libssl/src/MacOS/buildinf.h
new file mode 100644
index 0000000000..90875b6e2f
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/buildinf.h
@@ -0,0 +1,5 @@
+#ifndef MK1MF_BUILD
+#  define CFLAGS        "-DB_ENDIAN"
+#  define PLATFORM      "macos"
+#  define DATE          "Sun Feb 27 19:44:16 MET 2000"
+#endif
diff --git a/src/lib/libssl/src/MacOS/mklinks.as.hqx b/src/lib/libssl/src/MacOS/mklinks.as.hqx
new file mode 100644
index 0000000000..fe3e7d53da
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/mklinks.as.hqx
@@ -0,0 +1,820 @@
+(This file must be converted with BinHex 4.0)
+
+:#QeVE'PZDh-ZBA-!39"36'&`E(3J!!!!!!!!!*LiI6m!!!!!!3!!!*G#!!#@3J!
+!!AChFQPd!!!!K3)"!3m(Fh9`F'pbG!!!!)B#!3%$"(0eFQ8!!!#(!J-%"!3("3C
+cGfPdBfJ!!!#)!J%"#39cH@jMD!!!!)N#"J%$!`-&"3-'FhPcG'9Y!!!!LJ)&"3)
+%!J8("!-#!`4dB@*X!!!!L`))!3-$!`-$!`-$"(4PE'`!!!#-!J)"#38$G'KP!!!
+!M3))(J)@!Ki#!J))!K)#!`)B!Kd%G'KPE3!!!)i#!J%&#`4dD'9j!!!!M`)#!J)
+#$3TdD(*[G@GSEh9d!!!!N!!#!3%&"(4TCQB!!!#4!J%"!`4dD@eP!!!!NJ)"!JS
+#!h4T!!!!'N!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!H!!!!!!!#!!!!!!
+!!!!!!!!!!!!!rrrrr`!!!$3!!!!N!!!!!#"[!!5JAb"[!!5K++!M6R9$9'mJFR9
+Z)(4SDA-JFf0bDA"d)'&`F'aTBf&dD@pZ,#"jEh8JEA9cG#"QDA*cG#"TER0dB@a
+X)%&`F'aP8f0bDA"d,J!!!)C8D'Pc)(0MFQP`G#"MFQ9KG'9c)#iZ,fPZBfaeC'8
+[Eh"PER0cE#"KEQ3JCQPXE(-JDA3JGfPdD#"ZC@0PFh0KFRNJB@aTBA0PFbi0$8P
+d)'eTCfKd)(4KDf8JB5"hD'PXC5"dEb"MEfe`E'9dC5"cEb"`E'9KFf8JBQ8JF'&
+dD@9ZG$SY+3!!!#S!!J!!!!!!$3!+!"!!!!!-!!!!!!!!!!!!63!0!!S!%!%!!!`
+!!!!!!!!!!!!B!!!!+!!!!!!!!!!)!!!!)!#N2c`!!DR`!!!!l!!!!!&19[ri,`0
+f!#m$-$bKVDG'*KmY52ri,`-`2+LITdBQ(b!ZrrLa`'FJ,`-J2'0`ER4"l[rm)NL
+KV5+)*Kp+3'B)5Ulrr'F#GJ%3!bBZrr41ANje6PB!!#m-@Bm[2%j29%Nr2!#!U"m
+SAb!-CJK`!cm!UFKJ+#m-UC)J9#!)d+J!'#&!!"JJ9#!)d+J!(#&!!"a9Mbm8)&q
+JAMk!9%mSE[rm6Pj1G8j@!!![$%kkre4+!'FU@Bm[2'&`E(3[2(0MF(4`)DJU+&m
+J$'F5@Bm[$#mm!!!!!A!!U#UTp&K26VVrG#KZrra1ANje!!!!('&`E(3!!!!"4P*
+&4J!!!!!!J%P$6L-!!!!!!*B!!!!"!!!!!!G"8&"-!!!!!!!"!!!"!!!!!S!!!!4
+!!!"i)!!!K"!!!3))!!)#"!!%"!)!#!J"!"!8!)!J)J"!3%%!)2#!J"#*!%!)KJ!
+J")3!)!*!!"!")!!3!K!!%!3)!"!)"!!J%!)!3#!"!)"!!S%!J!5#!3!)4!)!#%J
+%!!KB#!!%C"!!!m)J!!!"3!!!!)!!!!%!!!!$J!!!"m!!!(rJ!!$rm!!"rrJ!!rr
+m!!IrrJ!2rrm!(rrrJ$rrrm"rrrrJrrrrm2rrrrMrrrrmrrrrrRrrrrmrrrrq(rr
+rr!rrrrJ(rrr`!rrri!(rrm!$rrq!"rrr!!rrrJ!2rr`!$rri!!IRm!!$`q!!!!(
+!!!!!J!!!!!)!!!!!!!!!!!m!!!!!!!!!!!!!!!!!!!$`m!!!!!!!!!!!!!!!!!!
+2!!m!!!!!!!!!!!!!!!rrm!!!m!!!!!!!!!!!!!$`c0m!!!m!!!!!!!!!!!!2!!c
+-m!!!m!!!!!!!!!!!m!$-cI!!!!m!!!!!!!!!$`!-c0m!!!!!m!!!!!!!!2!!c-h
+`!!!!!!m!!!!!!!m!$-cIh`!!!!!!m!!!!!$`!-c0rGh`!!!!!!m!!!!2!!c-hph
+-h`!!!!!!m!!!rrr-cIhF`-h`!!!!!!m!!2lFr0rGc!`-h`!!!!!!m!$pc-rph-$
+!`-h`!!!!!!m!r-`2cF`-$!!-r3!!!!!!m!m!`-c!`-!!$0m!!!!!$-m!m!`-$!`
+!!-cI!!!!!-c`!!m!`-$!!!`-h`!!!!c2!!!!m!`-!!$!c0m!!!$-m!!!!!m!`!!
+-$-hm!!!-c`!!!!!!m!!!`-cIc!!!c2!!!!!!!!m!$!c0r-`!$-m!!!!!!!$pm-$
+-hmc!!-c`!!!!!!!2hI`-cIc-!!c2!!!!!!!!rGc2c0r-`!$-m!!!!!!!!2h-cmh
+mc!!-c`!!!!!!!!$mc!rIr-!!c2!!!!!!!!!!$m$2m!r-$-m!!!!!!!!!!!$rr`!
+!r-c`!!!!!!!!!!!!!!!!!!r2!!!!!!!!!!!!!!!!!!!!m!!!!!!!!!!!!!"!!B!
+13"%J)4"##18%Q)+3!%&!)5!L%%3BL#83*L!G3!#!!B!2`"rJ2r"rq2rmrrlrrhr
+r2riIr"ri2r!ri"h!!)!!!!#!!!!!$r!!!!!!!2r`$`!!!!!2$!m!m!!!!2$!c`!
+2!!!2$!c`!!$`!2r`cpm!!!m!rGrpc2!!!2$p$p`-c`!!$`m!`-$0m!$2!2!-$-h
+`$2!!$`$-hm$2!!!2m-hm$2!!!2h2hm$2!!!!r-rm$2!!!!!2r`r2!!!!!!!!!2!
+!!!!!!!#D8f0bDA"d)%&`F'aTBf&dD@pZ$3e8D'Pc)(0MFQP`G#"MFQ9KG'9c)#i
+Z,fPZBfaeC'8[Eh"PER0cE#"KEQ3JCQPXE(-JDA3JGfPdD#"ZC@0PFh0KFRNJB@a
+TBA0PFbi0$8Pd)'eTCfKd)(4KDf8JB5"hD'PXC5"dEb"MEfe`E'9dC5"cEb"`E'9
+KFf8JBQ8JF'&dD@9ZG$SY+3!!!")!!J!!!!!!!!!!!!%!"J!'%iN!!!!+@1!!!b!
+!!!-J!!!!!"3!+`!(!Cm#@!!V!!F"f!*B!!!!!3!!M`C'BA0N98&6)$%Z-6!a,M%
+`$J!!!!32rrm!!3!#!!-"rrm!!!d!!3!"D`!!!!!!!!!%!J!%!!)!"3!'$3!&!!*
+X!!)!!!U`!!IrrJd!"`!#6`!!!!!+X!!)!!N0!!J!!@X!!!!%#Um!#J)!#J!#!!X
+!$!d!#`!#E!!#!!3!"2rprr`"rrd!!!(rr!!!!J!-!!)!$3!1$3!0!!*X!!%!"!!
+%rrX!$`(rq`!!$!!2!&N!8b"(CA3JF'&dD#"dEb"dD'Pc)%&`F'aP8f0bDA"d)'&
+`F'aPG$XJGA0P)'Pd)(4[)'C[FQdJG'KP)("KG'JJG'mJG'KP)'PZBfaeC'8JCQp
+XC'9b!!)!!!)!$J!#!"!!%3d!%!!#E!!"!!3!"2rk!")"rrS!!!`!%J!Q!#!JB@j
+N)(4SC5"[G'KPFL"bC@aPGQ&ZG#"QEfaNCA*c,J!#!!!#!"%!!J!6!"30!"-!!R-
+!!!!%!"%!&3!@$3!9!!*M!!!!"!!1!"F!'!d!&`!#E!!&!!3!$!!CrrN0!"N!!Qi
+!!!!%!!`!'J!E$3!D!!)d!!!!"3!-rrJ!(!Vrq!!%#Q0[BQS0!"`!!Q`!"3!'!!X
+!(Irh$3!G!!0*!!)!"J!,rrB!([re#[rf!"JZC@&bFfCQC(*KE'Pc!!!!!!!!)!"
+KCQ4b$3!H!!"Q!!!!"J!(![re!!!"rrF!!!d!'`!"E3!!!!3!"3!I$`!I!6J)ER9
+XE!!!!!!!!Gq!rrm!!!!A"NCTEQ4PFJ!!(`*[Me!!ASfm!Qq,i!"HA[!!I&M!!!!
+!!!!!'mi!!JN#!Qq-1!!!Kb%#Ei`J!!!!!%C14&*038e"3e-!!"%!B@aTF`!!!!!
+!fJ!#!!!-6@&MD@jdEh0S)%K%!!!!!!!!!!!!!!!!!!!!XSA5h%*%!!!!!!!A"NC
+TEQ4PFJ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!!!!!!!!!!!!!!!!!!!!3rLc#@a!4Nj%8Ne"3e2rrrrr!!!!!!!!!!!!!!!!!!!
+!!!!!!!e6HA0dC@dJ4QpXC'9b!!!"!!3!!!!A!!)!)8eKBfPZG'pcD#")4$T6HA0
+dC@dJ4QpXC'9b1NCTEQ4PFJ$rr`!!!Irj!!!0!"J!!@d!!!!-!!hrp!Vrp!!%#Q0
+dH(30!"B!!@m!!!!!!!$rm`[rm`!5-!!(G'KPF'&dD!!(G'KP8'&dD!)!&!!#!#!
+!)3d!)!!#E!!#!")!%[rbrr%"rr)!!!(rm3!!!J!K!!)!)J!M$3!L!!*b!!!!%J!
+A!#3!*3d!*!!#EJ!$!")!&3!Q!#F0!#B!!6%!!!!6!"Arm!Vrm!!%#R4iC'`0!#F
+!!6%!!!!5!"2rl`Vrl`!%#Q&cBh)0!#8!!@m!!!!!!!$rlJ[rlJ!F-!!-G'KPEfa
+NC'9XD@ec!!adD'92E'4%C@aTEA-#!#-!!J!S!#N0!#J!!R)!!!!B!"d!+J!V$3!
+U!!&Y!!!!'!!C!#`-!#`!"`!"1J!#!!!0!#X!!Qi!!`!!!!!!,3!Z$3!Y!!%a!!!
+!'J!Frqd+rqd!"!TdH'4X$3!Z!!%a!!!!'3!Drq`+rq`!"!TKFf0b!J!T!!)!,`!
+`$3![!!*X!!)!(J!Hrq[rkJ(rk`!!!IrU!!!#!$!!!J!a!$)0!$%!!R)!!!!H!#X
+!-`!d$3!c!!*X!!8!(J!T!$Ark3d!03!#EJ!!!"i!+3!f!$F0!$B!!cF"!!!I!#R
+rk!!i!$N+rqJ!"!TMDA4Y$3!i!!&Y!!!!)`!PrqF$rqF!!3d!13!"E3!!!#B!+2r
+Q!rrQrrd0!$F!!@m!!!!H!"rrj3[rj3!5-!!(G'KPF'&dD!!(G'KP8'&dD!(rk3!
+!$3!d!!&[!!!!!!!!rq3,rq3!)$!!$R4SCA"bEfTPBh4`BA4S!!jdD'93FQpUC@0
+d8'&dD!)!-J!#!$S!1`d!1J!#FJ!!!#`!1`!m!$d0!$`!!Q-!!!!X!$N!2J!r$3!
+q!!*X!!8!,!!h!%$ri`d!3!!#EJ!!!#`!0`""!%)0!%%!!cF"!!!Y!$IriJ"$!%3
++rq)!"!TMDA4Y$3"$!!&Y!!!!-3!crq%$rq%!!3d!4!!"E3!!!$3!0[rJ!rrJrri
+0!%)!!@m!!!!X!#hrh`[rh`!5-!!(G'KPF'&dD!!(G'KP8'&dD!(ri`!!$3!r!!&
+Y!!!!0`!irpi+rpi!"!T849K8$3!p!!&[!!!!!!!!rpd,rpd!&M!!#A4SC@ePF'&
+dD!!*G'KP6@93BA4S!J!l!!)!43"'$3"&!!*X!!)!2!!mrpcrf`(rh!!!!IrE!!!
+#!%B!!J"(!%J0!%F!!R)!!!!m!%8!53"+$3"*!!*M!!!!2!""!%X!6!d!5`!#BJ!
+!!$`!2`"0!%i0!%d!!@m!!!!m!$hrfJ[rfJ!J-!!1G'KPF(*[DQ9MG("KG'J!$R4
+SC9"bEfTPBh43BA4S$3"1!!&Y!!!!23!q!%m-!%m!$3!(D@jME(9NC3!#!!!0!%`
+!!@d!!!!r!%$rf3Vrf3!%#P4&@&30!%S!!@m!!!!!!!$rf![rf!!Q-!!4D@jME(9
+NC@C[E'4PFR"KG'J!%@PZBfaeC'9'EfaNCA*3BA4S!J")!!)!8!"4$3"3!!*b!!!
+!4J"9!&)!8`d!8J!#B`!!!%B!83"8!&80!&3!!Q)!!!"'!%m!9J"A$3"@!!*L!!!
+!4J",!&J!@3d!@!!"E`!!!%B!4rrA#rrA!#!`!!jdD'9`FQpUC@0dF'&dD!!1G'K
+P8(*[DQ9MG&"KG'J0!&N!!@d!!!"(!%S!@J`!@J!0!!GTEQ0XG@4P!!)!!!d!9`!
+"E3!!!%X!6J"E$!"E!!d!"fp`C@jcFf`!!J!!$3"9!!&Y!!!!6`"3rpB+rpB!"!T
+849K8$3"6!!&[!!!!!!!!rp8,rp8!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&
+dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S!J"4!!)!A!"G$3"F!!*b!!!!9J"
+K!&i!A`d!AJ!#B`!!!&B!A3"J!'%0!'!!!Q)!!!"@!&X!BJ"M$3"L!!&[!!!!9J"
+Arp3,rp3!)$!!$R4SCA"bEfTPBh4`BA4S!!jdD'93FQpUC@0d8'&dD!d!B`!"E3!
+!!&F!@J"N$!"N!!`!"Q0bHA"dE`!#!!!0!'%!!@d!!!"E!&crd`Vrd`!%#P4&@&3
+0!&m!!@m!!!!!!!$rdJ[rdJ!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4Qp
+XC'9b8'&dD!)!A3!#!'8!CJd!C3!#FJ!!!')!E3"R!'J0!'F!!Q-!!!"L!'N!D3"
+U$3"T!!*L!!!!BJ"R!'X!E!d!D`!"E`!!!')!Brr4#rr4!#!`!!jdD'9`FQpUC@0
+dF'&dD!!1G'KP8(*[DQ9MG&"KG'J0!'`!!@d!!!"M!'B!E3`!E3!*!!0cFf`!!J!
+!$3"U!!&Y!!!!C`"Srp!+rp!!"!T849K8$3"S!!&[!!!!!!!!rmm,rmm!(M!!$A0
+cE'C[E'4PFR"KG'J!$A0cE%C[E'4PFP"KG'J#!'B!!J"Z!'m0!'i!!R)!!!"Z!(8
+!F!"a$3"`!!*M!!!!EJ"a!()!F`d!FJ!"E`!!!'i!Err1#rr1!#!`!!jdD'9`FQp
+UC@0dF'&dD!!1G'KP8(*[DQ9MG&"KG'J0!(-!!@d!!!"[!($rc3Vrc3!%#P4&@&3
+0!(%!!@m!!!!!!!$rc![rc!!Q-!!4Eh"PER0cE'C[E'4PFR"KG'J!%@p`C@jcFfa
+'EfaNCA*3BA4S!J"[!!)!G!"e$3"d!!*X!!)!GJ"frm[rbJ(rb`!!!Ir+!!!#!(8
+!!J"f!(F0!(B!!R)!!!"f!(X!H!"j$3"i!!&[!!!!GJ"hrmN,rmN!($!!$(4SC@p
+XC'4PE'PYF`!-G'KP6faN4'9XD@ec$3"j!!*Z!!-!!!!!!(S!H`d!HJ!"-3!!!(J
+!H[r)#[r)!!3+G(KNE!d!H`!"-3!!!(F!H2r(#[r(!!3+BA0MFJ)!G`!#!(`!I3d
+!I!!#E!!#!(`!I2r'rm8"rmB!!!(ra3!!!J"p!!)!IJ"r$3"q!!*X!!%!I!"mrm3
+!J!(ra!!!$!#!!%!!1L"NC@aPG'8JEfaN)'PZBfaeC'8kEh"PER0cE#"QEfaNCA)
+JB@jN)(*PBh*PBA4P)'Pd)'0XC@&ZE(N!!J!!!J"r!!)!J3##$3#"!!*X!!)!I!"
+mrm2r`J(r``!!!Ir#!!!#!))!!J#$!)30!)-!!e%!!!"m!+8!K3#'!)F0!)8!!@X
+!!!"r!*`!L!)!L!!#!)N!LJd!L3!$53!#!(m!N[r"!)[r`!Vr`3!B,QeTFf0cE'0
+d+LSU+J!!!!!!!*!!!#SU+LS0!)X!!Qi!!!"r!)i!M!#0$3#-!!)d!!!!K`#1rlm
+!MJVr[`!%#Q0QEf`0!)i!!@d!!!#+!)d!M``!M`!0!!G[F'9ZFh0X!!)!!!d!M3!
+#0!!!!(m!Krqq!*!!#[qq!!3+BfC[E!d!N!!!!@m!!!#$!)Er[3[r[3!Q-!!4D@j
+ME(9NC@C[E'4PFR"KG'J!%@PZBfaeC'9'EfaNCA*3BA4S![r!!!!#!)S!!J#4rl`
+0!*%!!dN!!J#6!*crZ`#5rlS+rlX!'#jMEh*PC'9XEbSU+LS!!!!!!!#3!!!U+LS
+U$3#5!!%a!!!!N`#BrlN+rlN!"!TcC@aP![qk!!!#rl`!!!d!KJ!$8J!!!!!!!2q
+irlIrYJVrZ!!B,Q&cBh*PFR)J+LSU+J!!!!!!!*!!!#SU+LS"rlF!!!,rYJ!!$3#
+(!!*X!!%!T!#Nrl8!N`(rY3!!$!#6!"-!$5"TCfj[FQ8JCA*bEh)!!J!!!J#%!!)
+!P!#9$3#8!!*X!!)!TJ#Qrl6rX`(rY!!!!Iqc!!!#!*8!!J#@!*F0!*B!!dN!!J#
+Q!,lrX[qa!*J+rl)!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@aX!Iqa!!!'!*J
+!!rq`!*N!QJVrX!!%#QY[Bf`0!*N!!@d!!!#U!+hrV`VrV`!%#Q0QEf`'!*S!!rq
+Z!*[rV3VrVJ!%#QPZFfJ0!*X!!M3!!!#`!,MrV!#F#[qX!!3+BfC[E!d!R!!"E`!
+!!,3!YrqV#rqV!#B`!"&TEQ0XG@4PCQpXC'9bF'&dD!!4D@jME(9NC8C[E'4PFP"
+KG'J'rkd!!!)!P`!#!*d!RJd!R3!#FJ!!!,m!aJ#I!+!0!*m!!Q`"!!#r!-)!SIq
+U$3#K!!%a!!!![`$#rkN+rkN!"!TbFfad!IqU!!!0!+!!!@m!!!!!!!$rU![rU!!
+Z-!!9G'KPEQ9hCQpXC'9bFQ9QCA*PEQ0P!"9dD'91CAG'EfaNCA*5C@CPFQ9ZBf8
+#!*i!!J#L!+-0!+)!!dN!!J$(!-lrT`#NrkB+rkF!'#jYDA0MFfaMG#SU+LS!!!!
+!!!#3!!!U+LSU$3#N!!&[!!!!a`$+rk8,rk8!,M!!&A4SC@jPGfC[E'4PFR*PCQ9
+bC@jMC3!9G'KP6Q9h4QpXC'9b8Q9QCA*PEQ0P![qQ!!!#!+-!!J#P!+B0!+8!!R)
+!!!$2!0`!T`#S$3#R!!&Y!!!!c`$5!+N-!+N!$3!(Eh"PER0cE!!#!!!0!+J!!Qi
+!!!!!!!!!UJ#V$3#U!!%a!!!!e`$Erk3+rk3!"!T`EQ&Y$3#V!!%a!!!!dJ$Ark-
++rk-!"!TcC@aP!J#Q!!)!V!#Y$3#X!!*X!!)!h3$Grk,rS3(rSJ!!!IqK!!!#!+d
+!!J#Z!+m0!+i!!Q`!!3$G!0hrS!#`!IqJ!!!-!,!!(`!C)&0dBA*d)'eKDfPZCb"
+dD'8JB@aTBA0PF`!#!!!#!+m!!J#a!,)0!,%!!dN!!J$G!3ArRrqH!,-+rjm!'#j
+MEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@aX!IqH!!!'!,-!!rqG!,3!Y3VrR3!%#QY
+[Bf`0!,3!!@d!!!$K!16rR!VrR!!%#Q&XD@%'!,8!!rqE!,B!Y`VrQ`!%#QPZFfJ
+0!,B!!M3!!!$R!1rrQJ#i#[qD!!3+BfC[E!d!Z!!"E`!!!1X!l[qC#rqC!$3`!"K
+[F'9ZFh0XD@jME(9NC@C[E'4PFR"KG'J!''p`C@j68da*EQ0XG@4P4QpXC'9b8'&
+dD!B!Y`!$rjJ!ZIqA#[qB!!3+G'mJ)!d!Z3!#EJ!!!2)!r`#k!,X0!,S!!M3!!!$
+i!2rrPJ#m#[q@!!3+CQPXC3d![!!"E3!!!2X!rJ#p$!#p!"-!$@p`C@jcFfaMEfj
+Q,QJ!!J!!$3#l!!)d!!!!mJ$irj8![JVrP3!%#Q0QEf`0!,i!!@m!!!$f!2IrP![
+rP!!@-!!*G'KPE@9`BA4S!!PdD'90C9"KG'J'rjF!!!)!XJ!#!,m!`!d![`!#E!!
+#!3B""[q6rj)"rj-!!!(rNJ!!!J$!!!)!`3$#$3$"!!*b!!!""J%4!--!a!d!``!
+#BJ!!!3B"$3$&!-B0!-8!!@m!!!%'!3RrN3[rN3!N-!!3Bh*jF(4[CQpXC'9bF'&
+dD!!3Bh*jF(4[4QpXC'9b8'&dD!d!aJ!"E3!!!3N"$!$($!$(!!X!"6TKFfia!!)
+!!!d!a!!"E`!!!!!!!2q3!![rN!!!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!)!`J!
+#!-J!b3d!b!!$53!#!4)"22q2rii!bJVrM`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!
+!!'jeE'`"rii!!!B!bJ!$rid!b`$-#[q0!!3+DfpME!d!b`!"E3!!!4B"'Iq-#[q
+-!!3+B@aTB3B!c!!$riX!c3$1#[q,!!3+D@jcD!d!c3!#0!!!!4`"*2q+!-m+riS
+!"!TMCQpX$3$2!!&[!!!")!%MriN,riN!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9
+bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J$1!!2rL!$3riF+riJ!"!T
+dEb!J$3$3!!*Z!!!"*`%f!0%!dJd!d3!#0!!!!5m"0[q'!0-+riB!"!TQD@aP$3$
+6!!&Y!!!"-J%e!03-!03!$!!'BA0Z-5jS!!)!!!d!dJ!#0!!!!5F",rq&!08+ri8
+!"!TMCQpX$3$9!!&[!!!"+`%Zri3,ri3!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!E
+rK`!!!J$*!!)!eJ$A$3$@!!0*!!)"23&Rri2rJJ$B#[q$!"JZBfpbC@0bC@`U+LS
+U!!!!!!!!N!!!ER9XE!(rJJ!!"J$B!!2rJ3$C!0S+ri%!"!TVEf0X$3$C!!&Y!!!
+"33&%ri!+ri!!"!TKE'PK"J$D!!2rI`$E!0`+rhm!"!TTER0S$3$E!!)d!!!"4`&
+2rhi!h3VrIJ!%#Q0QEf`0!0d!!@m!!!&,!8lrI3[rI3!d-!!BEh"PER0cE'PZBfa
+eC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'!0`!!rpm!0l
+rH`VrI!!%#R4[)#!0!0i!!Qi!!!&5!@%!h`$J$3$I!!)d!!!"@J&KrhS!i3VrHJ!
+%#QCTE'80!1%!!@d!!!&G!@!!iJ`!iJ!3!!TKFfiaAfeKBbjS!!)!!!d!i!!#0!!
+!!9)"@[pj!1-+rhN!"!TMCQpX$3$M!!&[!!!"9J&CrhJ,rhJ!&$!!#(4PEA"`BA4
+S!!KdC@e`8'&dD!ErH`!!!J$A!!)!j!$P$3$N!!*X!!)"D!&SrhIrGJ(rG`!!!Ip
+f!!!#!18!!J$Q!1F0!1B!!R)!!!&S!A-!k!$T$3$S!!*L!!!"D!&[!1S!k`d!kJ!
+"E`!!!@J"Drpe#rpe!#3`!""MFRP`G'pQEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*
+3BA4S$3$V!!&Y!!!"D`&Z!1`-!1`!#J!%1Q*TE`!#!!!0!1N!!@m!!!!!!!$rG![
+rG!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S!J$R!!)!l3$Z$3$Y!!0*!!)"G!'Hrh2
+rFJ$[#[pc!"JZBfpbC@0bC@`U+LSU!!!!!!!!N!!!ER9XE!(rFJ!!"J$[!!2rF3$
+`!2%+rh%!"!TVEf0X$3$`!!&Y!!!"H!&lrh!+rh!!"!TKE'PK"J$a!!2rE`$b!2-
++rfm!"!TTER0S$3$b!!)d!!!"IJ''rfi!p!VrEJ!%#Q0QEf`0!23!!@m!!!'#!BA
+rE3[rE3!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9
+NC8C[E'4PFP"KG'J'!2-!!rpX!2ArD`VrE!!%#R4[)#!0!28!!Qi!!!'*!CJ!pJ$
+h$3$f!!)d!!!"N3'BrfS!q!VrDJ!%#QCTE'80!2J!!@d!!!'8!CF!q3`!q3!,!!9
+LD@mZD!!#!!!0!2F!!M3!!!'*!C(rD3$k#[pT!!3+BfC[E!d!qJ!"E`!!!Bd"N!$
+rD![rD!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S"[pV!!!#!1i!!J$l!2`0!2X!!Q`
+!!J'I!CrrCrpQ!IpR!!!"rfB!!!)!r!!#!2d!rJd!r3!#FJ!!!Cm"UJ$r!3!0!2m
+!!Q)!!!'I!DB"!3%#$3%"!!&[!!!"R`'Lrf8,rf8!*$!!%'0bHA"dEfC[E'4PFR"
+KG'J!%'0bHA"dEdC[E'4PFP"KG'J0!3)!!@d!!!'L!D8"!``"!`!*!!-kBQB!!J!
+!$3%!!!&[!!!!!!!!rf3,rf3!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!)!rJ!#!33
+""3d""!!$53!#!DX"eIpMrf)""JVrB`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'j
+eE'`"rf)!!!B""J!$rf%""`%)#[pK!!3+DfpME!d""`!"E3!!!Dm"X[pJ#[pJ!!3
++B@aTB3B"#!!$rem"#3%+#[pI!!3+D@jcD!d"#3!#0!!!!E8"[IpH!3X+rei!"!T
+MCQpX$3%,!!&[!!!"Z3'mred,red!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&
+dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J%+!!2rA!%-reX+re`!"!TdEb!
+J$3%-!!*Z!!!"`!(2!3d"$Jd"$3!#0!!!!FJ"crpD!3m+reS!"!TQD@aP$3%2!!&
+Y!!!"b`(1!4!-!4!!%!!+BQa[GfCTFfJZD!!#!!!0!3i!!M3!!!(!!FMr@3%4#[p
+C!!3+BfC[E!d"%3!"E`!!!F3"arpB#rpB!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J
+'reX!!!)""3!#!4)"%`d"%J!#E!!#!GB"e[pAreB"reF!!!(r9J!!!J%6!!)"&!%
+9$3%8!!*b!!!"eJ(K!4B"&`d"&J!#BJ!!!GB"h3%B!4N0!4J!!@m!!!(@!GRr93[
+r93!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD!d"'3!"E3!
+!!GN"h!%D$!%D!!N!!cTLEJ!#!!!0!4F!!@m!!!!!!!$r9![r9!!8-!!)G'9YF("
+KG'J!#(4PEA"3BA4S!J%9!!)"'`%F$3%E!!0*!!)"iJ)-re2r8J%G#[p6!"JZBfp
+bC@0bC@`U+LSU!!!!!!!!N!!!ER9XE!(r8J!!"J%G!!2r83%H!4m+re%!"!TVEf0
+X$3%H!!&Y!!!"jJ(Tre!+re!!"!TKE'PK"J%I!!2r6`%J!5%+rdm!"!TTER0S$3%
+J!!)d!!!"l!(drdi")JVr6J!%#Q0QEf`0!5)!!@m!!!(`!I2r63[r63!d-!!BEh"
+PER0cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J
+'!5%!!rp-!52r5`Vr6!!%#R4[)#!0!5-!!Qi!!!(h!JB"*!%P$3%N!!)d!!!"r`)
+'rdS"*JVr5J!%#QCTE'80!5B!!@d!!!)#!J8"*``"*`!+!!4LELjS!!)!!!d"*3!
+#0!!!!IF"rrp*!5J+rdN!"!TMCQpX$3%S!!&[!!!"q`(qrdJ,rdJ!&$!!#(4PEA"
+`BA4S!!KdC@e`8'&dD!Er5`!!!J%F!!)"+3%U$3%T!!*X!!)#$3)0rdIr4J(r4`!
+!!Ip'!!!#!5S!!J%V!5`0!5X!!R)!!!)0!KJ",3%Z$3%Y!!*L!!!#$3)8!5m"-!d
+",`!"E`!!!Jd#%2p&#rp&!#3`!""MFRP`G'pQEfaNCA*`BA4S!""MFRP`G'p'Efa
+NCA*3BA4S$3%`!!&Y!!!#%!)6!6%-!6%!$3!(1Q*eCQCPFJ!#!!!0!5i!!@m!!!!
+!!!$r4![r4!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S!J%X!!)"-J%c$3%b!!0*!!)
+#'3*$rd2r3J%d#[p$!"JZBfpbC@0bC@`U+LSU!!!!!!!!N!!!ER9XE!(r3J!!"J%
+d!!2r33%e!6B+rd%!"!TVEf0X$3%e!!&Y!!!#(3)Jrd!+rd!!"!TKE'PK"J%f!!2
+r2`%h!6J+rcm!"!TTER0S$3%h!!)d!!!#)`)Vrci"13Vr2J!%#Q0QEf`0!6N!!@m
+!!!)R!LVr23[r23!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0
+-5@jME(9NC8C[E'4PFP"KG'J'!6J!!rmm!6Vr1`Vr2!!%#R4[)#!0!6S!!Qi!!!)
+Z!Md"1`%m$3%l!!)d!!!#0J)prcS"23Vr1J!%#QCTE'80!6d!!@d!!!)j!M`"2J`
+"2J!1!!KLG@CQCA)ZD!!#!!!0!6`!!M3!!!)Z!MEr13%r#[mj!!3+BfC[E!d"2`!
+"E`!!!M)#0Imi#rmi!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J'rcX!!!)"-`!#!8!
+"33d"3!!#E!!#!N3#42mhrcB"rcF!!!(r0J!!!J&"!!)"3J&$$3&#!!*b!!!#4!*
+2!83"43d"4!!#BJ!!!N3#5`&'!8F0!8B!!@m!!!*%!NIr03[r03!N-!!3Bh*jF(4
+[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD!d"4`!"E3!!!NF#5J&)$!&)!!X
+!"6TMBA0d!!)!!!d"43!"E`!!!!!!!2md#rmd!"3`!!KdC@e`F'&dD!!)G'9YF&"
+KG'J#!8-!!J&*!8S0!8N!!dN!!J*3!RVr-rmb!8X+rc-!'#jMEh*PBh*PE#SU+LS
+!!!!!!!#3!!"ZG@aX!Imb!!!'!8X!!rma!8`"63Vr-3!%#QY[Bf`0!8`!!@d!!!*
+8!PIr-!Vr-!!%#Q&XD@%'!8d!!rm[!8i"6`Vr,`!%#QPZFfJ0!8i!!M3!!!*D!Q,
+r,J&3#[mZ!!3+BfC[E!d"8!!"E`!!!Pi#BImY#rmY!$3`!"K[F'9ZFh0XD@jME(9
+NC@C[E'4PFR"KG'J!''p`C@j68da*EQ0XG@4P4QpXC'9b8'&dD!B"6`!$rb`"8Im
+V#[mX!!3+G'mJ)!d"83!#EJ!!!Q8#G!&5!9-0!9)!!M3!!!*Y!R6r+J&8#[mU!!3
++CQPXC3d"9!!"E3!!!R!#F`&9$!&9!!`!"Q0KFh3ZD!!#!!!0!9-!!M3!!!*P!Qh
+r+3&@#[mT!!3+BfC[E!d"9J!"E`!!!QN#E2mS#rmS!"3`!!KdC@e`F'&dD!!)G'9
+YF&"KG'J'rbX!!!)"5J!#!9F"@!d"9`!#E!!#!RX#HrmRrbB"rbF!!!(r*J!!!J&
+B!!)"@3&D$3&C!!*b!!!#H`+'!9X"A!d"@`!#BJ!!!RX#JJ&G!9i0!9d!!@m!!!*
+l!Rlr*3[r*3!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD!d
+"AJ!"E3!!!Ri#J3&I$!&I!!X!"6TMEfe`!!)!!!d"A!!"E`!!!!!!!2mN#rmN!"3
+`!!KdC@e`F'&dD!!)G'9YF&"KG'J#!9S!!J&J!@%0!@!!!dN!!J+(!V(r)rmL!@)
++rb-!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@aX!ImL!!!'!@)!!rmK!@-"C!V
+r)3!%#QY[Bf`0!@-!!@d!!!+,!Slr)!Vr)!!%#Q&XD@%'!@3!!rmI!@8"CJVr(`!
+%#QPZFfJ0!@8!!M3!!!+4!TRr(J&R#[mH!!3+BfC[E!d"C`!"E`!!!T8#Q2mG#rm
+G!$3`!"K[F'9ZFh0XD@jME(9NC@C[E'4PFR"KG'J!''p`C@j68da*EQ0XG@4P4Qp
+XC'9b8'&dD!B"CJ!$ra`"D2mE#[mF!!3+G'mJ)!d"D!!#EJ!!!T`#U`&T!@S0!@N
+!!M3!!!+N!U[r'J&V#[mD!!3+CQPXC3d"D`!"E3!!!UF#UJ&X$!&X!!`!"Q0[EA!
+ZD!!#!!!0!@S!!M3!!!+F!U6r'3&Y#[mC!!3+BfC[E!d"E3!"E`!!!U!#SrmB#rm
+B!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J'raX!!!)"B3!#!@i"E`d"EJ!#E!!#!V)
+#X[mAraB"raF!!!(r&J!!!J&[!!)"F!&a$3&`!!*b!!!#XJ+p!A)"F`d"FJ!#BJ!
+!!V)#Z3&d!A80!A3!!@m!!!+b!VAr&3[r&3!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!
+3Bh*jF(4[4QpXC'9b8'&dD!d"G3!"E3!!!V8#Z!&f$!&f!!X!"6TMEfjQ!!)!!!d
+"F`!"E`!!!!!!!2m8#rm8!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J#!A%!!J&h!AJ
+0!AF!!dN!!J+q!ZMr%rm5!AN+ra-!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@a
+X!Im5!!!'!AN!!rm4!AS"H`Vr%3!%#QY[Bf`0!AS!!@d!!!,#!XAr%!Vr%!!%#Q&
+XD@%'!AX!!rm2!A`"I3Vr$`!%#QPZFfJ0!A`!!M3!!!,)!Y$r$J&q#[m1!!3+BfC
+[E!d"IJ!"E`!!!X`#crm0#rm0!$3`!"K[F'9ZFh0XD@jME(9NC@C[E'4PFR"KG'J
+!''p`C@j68da*EQ0XG@4P4QpXC'9b8'&dD!B"I3!$r``"Irm,#[m-!!3+G'mJ)!d
+"I`!#EJ!!!Y-#iJ'!!B%0!B!!!M3!!!,E!Z,r#J'##[m+!!3+CQPXC3d"JJ!"E3!
+!!Yi#i3'$$!'$!!`!"Q0[EQBZD!!#!!!0!B%!!M3!!!,6!Y[r#3'%#[m*!!3+BfC
+[E!d"K!!"E`!!!YF#f[m)#rm)!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J'r`X!!!)
+"H!!#!B8"KJd"K3!#E!!#!ZN#kIm(r`B"r`F!!!(r"J!!!J''!!)"K`')$3'(!!*
+b!!!#k3,d!BN"LJd"L3!#BJ!!!ZN#m!',!B`0!BX!!@m!!!,T!Zcr"3[r"3!N-!!
+3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD!d"M!!"E3!!!Z`#l`'
+0$!'0!!S!"$TNCA-!!J!!$3'+!!&[!!!!!!!!r`3,r`3!&$!!#(4PEA"`BA4S!!K
+dC@e`8'&dD!)"L!!#!Bi"M`d"MJ!$53!#![8$(rm$r`)"N!!+r`-!'#jMEh*PBh*
+PE#SU+LS!!!!!!!#3!!"ZG@aX!Im#!!!'!C!!!!2r!3'4!C)+r`%!"!TVEf0X$3'
+4!!&Y!!!#q3,mr`!+r`!!"!TKE'PK"J'5!!2qr`'6!C3+r[m!"!TTER0S$3'6!!)
+d!!!#r`-(r[i"P3VqrJ!%#Q0QEf`0!C8!!@m!!!-$!`Eqr3[qr3!d-!!BEh"PER0
+cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'!C3
+!!rlm!CEqq`Vqr!!%#R4[)#!0!CB!!Qi!!!-+!aN"P`'B$3'A!!)d!!!$%J-Cr[S
+"Q3VqqJ!%#QCTE'80!CN!!@d!!!-9!aJ"QJ`"QJ!,!!9NCA-ZD!!#!!!0!CJ!!M3
+!!!-+!a,qq3'E#[lj!!3+BfC[E!d"Q`!"E`!!!`i$%Ili#rli!"3`!!KdC@e`F'&
+dD!!)G'9YF&"KG'J'r[X!!!)"M`!#!C`"R3d"R!!#E!!#!b!$)2lhr[B"r[F!!!(
+qpJ!!!J'G!!)"RJ'I$3'H!!*b!!!$)!-V!D!"S3d"S!!#BJ!!!b!$*`'L!D-0!D)
+!!@m!!!-J!b2qp3[qp3!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9
+b8'&dD!d"S`!"E3!!!b-$*J'N$!'N!!N!!cTND!!#!!!0!D%!!@m!!!!!!!$qp![
+qp!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S!J'I!!)"T3'Q$3'P!!0*!!)$,!0@r[2
+qmJ'R#[lc!"JZBfpbC@0bC@`U+LSU!!!!!!!!N!!!ER9XE!(qmJ!!"J'R!!2qm3'
+S!DN+r[%!"!TVEf0X$3'S!!&Y!!!$-!-cr[!+r[!!"!TKE'PK"J'T!!2ql`'U!DX
++rZm!"!TTER0S$3'U!!)d!!!$0J-qrZi"V!VqlJ!%#Q0QEf`0!D`!!@m!!!-k!ch
+ql3[ql3!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9
+NC8C[E'4PFP"KG'J'!DX!!rlX!Dhqk`Vql!!%#R4[)#!0!Dd!!Qi!!!0"!e!"VJ'
+[$3'Z!!)d!!!$5303rZS"X!VqkJ!%#QCTE'80!E!!!@d!!!0-!dm"X3`"X3!+!!4
+ND#jS!!)!!!d"V`!#0!!!!d%$5IlT!E)+rZN!"!TMCQpX$3'b!!&[!!!$430)rZJ
+,rZJ!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!Eqk`!!!J'Q!!)"X`'d$3'c!!*X!!)
+$9`0ArZIqjJ(qj`!!!IlQ!!!#!E3!!J'e!EB0!E8!!R)!!!0A!f)"Y`'i$3'h!!*
+L!!!$9`0H!EN"ZJd"Z3!"E`!!!eF$@[lP#rlP!#3`!""MFRP`G'pQEfaNCA*`BA4
+S!""MFRP`G'p'EfaNCA*3BA4S$3'k!!&Y!!!$@J0G!EX-!EX!#J!%1Q4cB3!#!!!
+0!EJ!!@m!!!!!!!$qj![qj!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S!J'f!!)"[!'
+p$3'm!!0*!!)$B`10rZ2qiJ'q#[lM!"JZBfpbC@0bC@`U+LSU!!!!!!!!N!!!ER9
+XE!(qiJ!!"J'q!!2qi3'r!F!+rZ%!"!TVEf0X$3'r!!&Y!!!$C`0UrZ!+rZ!!"!T
+KE'PK"J(!!!2qh`("!F)+rYm!"!TTER0S$3("!!)d!!!$E30erYi"``VqhJ!%#Q0
+QEf`0!F-!!@m!!!0a!h6qh3[qh3!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4
+S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'!F)!!rlF!F6qf`Vqh!!%#R4[)#!
+0!F3!!Qi!!!0i!iF"a3('$3(&!!)d!!!$J!1(rYS"a`VqfJ!%#QCTE'80!FF!!@d
+!!!1$!iB"b!`"b!!,!!9NFf%ZD!!#!!!0!FB!!M3!!!0i!i$qf3(*#[lC!!3+BfC
+[E!d"b3!"E`!!!h`$IrlB#rlB!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J'rYX!!!)
+"[3!#!FS"b`d"bJ!#E!!#!ii$M[lArYB"rYF!!!(qeJ!!!J(,!!)"c!(0$3(-!!*
+b!!!$MJ1C!Fi"c`d"cJ!#BJ!!!ii$P3(3!G%0!G!!!@m!!!11!j(qe3[qe3!N-!!
+3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD!d"d3!"E3!!!j%$P!(
+5$!(5!!S!"$TPFR)!!J!!$3(2!!&[!!!!!!!!rY3,rY3!&$!!#(4PEA"`BA4S!!K
+dC@e`8'&dD!)"c3!#!G-"e!d"d`!$53!#!jS$a2l6rY)"e3Vqd`!B,Q0[FQ9MFQ9
+X+LSU+J!!!!!!!*!!!'jeE'`"rY)!!!B"e3!$rY%"eJ(A#[l4!!3+DfpME!d"eJ!
+"E3!!!ji$SIl3#[l3!!3+B@aTB3B"e`!$rXm"f!(C#[l2!!3+D@jcD!d"f!!#0!!
+!!k3$V2l1!GS+rXi!"!TMCQpX$3(D!!&[!!!$U!1VrXd,rXd!0$!!''p`C@jcFfa
+TEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J(C!!2
+qc!(ErXX+rX`!"!TdEb!J$3(E!!*Z!!!$V`1q!G`"h3d"h!!#0!!!!lF$[[l+!Gi
++rXS!"!TQD@aP$3(H!!&Y!!!$ZJ1p!Gm-!Gm!#`!&CA*b,QJ!!J!!$3(G!!)d!!!
+$V`1hrXN"i!Vqb3!%#Q0QEf`0!H!!!@m!!!1c!lEqb![qb!!8-!!)G'9YF("KG'J
+!#(4PEA"3BA4S"[l,!!!#!G3!!J(K!H)0!H%!!Q`!!J2&!mAqarl'!Il(!!!"rXB
+!!!)"iJ!#!H-"j!d"i`!#FJ!!!m8$d!(P!HB0!H8!!Q)!!!2&!m`"j`(S$3(R!!&
+[!!!$a32)rX8,rX8!*$!!%'0bHA"dEfC[E'4PFR"KG'J!%'0bHA"dEdC[E'4PFP"
+KG'J0!HJ!!@d!!!2)!mX"k3`"k3!+!!3kCAC`!!)!!!d"jJ!"E`!!!!!!!2l%#rl
+%!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J#!H3!!J(U!HX0!HS!!dN!!J24!r[q`rl
+#!H`+rX-!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@aX!Il#!!!'!H`!!rl"!Hd
+"lJVq`3!%#QY[Bf`0!Hd!!@d!!!29!pMq`!Vq`!!%#Q&XD@%'!Hi!!rkr!Hm"m!V
+q[`!%#QPZFfJ0!Hm!!M3!!!2E!q2q[J(a#[kq!!3+BfC[E!d"m3!"E`!!!pm$i[k
+p#rkp!$3`!"K[F'9ZFh0XD@jME(9NC@C[E'4PFR"KG'J!''p`C@j68da*EQ0XG@4
+P4QpXC'9b8'&dD!B"m!!$rV`"m[kl#[km!!3+G'mJ)!d"mJ!#EJ!!!qB$p3(c!I3
+0!I-!!M3!!!2Z!rAqZJ(e#[kk!!3+CQPXC3d"p3!"E3!!!r%$p!(f$!(f!!X!"@9
+fF#jS!!)!!!d"p!!#0!!!!qB$l[kj!IF+rVN!"!TMCQpX$3(h!!&[!!!$kJ2YrVJ
+,rVJ!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!EqZ`!!!J(V!!)"q!(j$3(i!!*X!!)
+$r!2mrVIqYJ(qY`!!!Ikf!!!#!IN!!J(k!IX0!IS!!R)!!!2m"!F"r!(p$3(m!!*
+L!!!$r!3$!Ii"r`d"rJ!"E`!!!r`$rrke#rke!#3`!""MFRP`G'pQEfaNCA*`BA4
+S!""MFRP`G'p'EfaNCA*3BA4S$3(r!!&Y!!!$r`3#!J!-!J!!#`!&1QKYB@-!!J!
+!$3(p!!&[!!!!!!!!rV3,rV3!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!)"q`!#!J%
+#!Jd#!3!$53!#"!J%-[kcrV)#!`VqX`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'j
+eE'`"rV)!!!B#!`!$rV%#"!)&#[ka!!3+DfpME!d#"!!"E3!!"!`%$rk`#[k`!!3
++B@aTB3B#"3!$rUm#"J)(#[k[!!3+D@jcD!d#"J!#0!!!"")%'[kZ!JJ+rUi!"!T
+MCQpX$3))!!&[!!!%&J3CrUd,rUd!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&
+dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J)(!!2qV!)*rUX+rU`!"!TdEb!
+J$3)*!!*Z!!!%(33X!JS##`d##J!#0!!!"#8%,2kU!J`+rUS!"!TQD@aP$3)-!!&
+Y!!!%+!3V!Jd-!Jd!$!!'D'eKBbjS!!)!!!d##`!#0!!!""d%*IkT!Ji+rUN!"!T
+MCQpX$3)1!!&[!!!%)33NrUJ,rUJ!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!EqU`!
+!!J)#!!)#$`)3$3)2!!*X!!)%-`3crUIqTJ(qT`!!!IkQ!!!#!K!!!J)4!K)0!K%
+!!R)!!!3c"$i#%`)8$3)6!!*L!!!%-`3k!K8#&Jd#&3!"E`!!"$-%0[kP#rkP!#3
+`!""MFRP`G'pQEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S$3)@!!&Y!!!%0J3
+j!KF-!KF!#`!&1QPNC@%!!J!!$3)8!!&[!!!!!!!!rU3,rU3!&$!!#(4PEA"`BA4
+S!!KdC@e`8'&dD!)#%J!#!KJ#'3d#'!!$53!#"$m%DIkMrU)#'JVqS`!B,Q0[FQ9
+MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"rU)!!!B#'J!$rU%#'`)F#[kK!!3+DfpME!d
+#'`!"E3!!"%-%4[kJ#[kJ!!3+B@aTB3B#(!!$rTm#(3)H#[kI!!3+D@jcD!d#(3!
+#0!!!"%N%8IkH!Km+rTi!"!TMCQpX$3)I!!&[!!!%6343rTd,rTd!0$!!''p`C@j
+cFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J)
+H!!2qR!)JrTX+rT`!"!TdEb!J$3)J!!*Z!!!%9!4M!L%#)Jd#)3!#0!!!"&`%Brk
+D!L-+rTS!"!TQD@aP$3)M!!&Y!!!%A`4L!L3-!L3!$!!'D@4PB5jS!!)!!!d#)J!
+#0!!!"&3%A2kC!L8+rTN!"!TMCQpX$3)P!!&[!!!%@!4ErTJ,rTJ!&$!!#(4PEA"
+`BA4S!!KdC@e`8'&dD!EqQ`!!!J)C!!)#*J)R$3)Q!!*X!!)%DJ4UrTIqPJ(qP`!
+!!Ik@!!!#!LF!!J)S!LN0!LJ!!R)!!!4U"(8#+J)V$3)U!!*L!!!%DJ4a!L`#,3d
+#,!!"E`!!"'S%EIk9#rk9!#3`!""MFRP`G'pQEfaNCA*`BA4S!""MFRP`G'p'Efa
+NCA*3BA4S$3)Y!!&Y!!!%E34`!Li-!Li!$!!'1QaSBA0S!!)!!!d#+`!"E`!!!!!
+!!2k8#rk8!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J#!LN!!J)[!M!0!Lm!!dN!!J4
+f"+$qNrk5!M%+rT-!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@aX!Ik5!!!'!M%
+!!rk4!M)#-`VqN3!%#QY[Bf`0!M)!!@d!!!4k"(hqN!!+rT!!!!3+B@aTB3B#-`!
+$rSm#0!)e#[k2!!3+D@jcD!d#0!!#0!!!")!%L2k1!MB+rSi!"!TMCQpX$3)f!!&
+[!!!%K!5(rSd,rSd!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP0
+66%PZBfaeC'9'EfaNCA*3BA4S"J)e!!2qM!)hrSX+rS`!"!TdEb!J$3)h!!*Z!!!
+%L`5D!MJ#13d#1!!#0!!!"*-%Q[k+!MS+rSS!"!TQD@aP$3)k!!&Y!!!%PJ5C!MX
+-!MX!$3!(E'KKFfJZD!!#!!!0!MN!!M3!!!5,"*2qL3)m#[k*!!3+BfC[E!d#2!!
+"E`!!")m%N[k)#rk)!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J'rSX!!!)#-!!#!Md
+#2Jd#23!#E!!#"+%%SIk(rSB"rSF!!!(qKJ!!!J)q!!)#2`*!$3)r!!*b!!!%S35
+X!N%#3Jd#33!#BJ!!"+%%U!*$!N30!N-!!@m!!!5K"+6qK3[qK3!N-!!3Bh*jF(4
+[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD!d#4!!"E3!!"+3%T`*&$!*&!!S
+!"$TYC$)!!J!!$3*#!!&[!!!!!!!!rS3,rS3!&$!!#(4PEA"`BA4S!!KdC@e`8'&
+dD!)#3!!#!NB#4`d#4J!$53!#"+d%erk$rS)#5!VqJ`!B,Q0[FQ9MFQ9X+LSU+J!
+!!!!!!*!!!'jeE'`"rS)!!!B#5!!$rS%#53*+#[k"!!3+DfpME!d#53!"E3!!",%
+%Y2k!#[k!!!3+B@aTB3B#5J!$rRm#5`*-#[jr!!3+D@jcD!d#5`!#0!!!",F%[rj
+q!Nd+rRi!"!TMCQpX$3*0!!&[!!!%Z`5qrRd,rRd!0$!!''p`C@jcFfaTEQ0XG@4
+PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J*-!!2qI!*1rRX
++rR`!"!TdEb!J$3*1!!*Z!!!%`J64!Nm#8!d#6`!#0!!!"-S%dIjk!P%+rRS!"!T
+QD@aP$3*4!!&Y!!!%c363!P)-!P)!#`!&E@3b,QJ!!J!!$3*3!!)d!!!%`J6+rRN
+#8`VqH3!%#Q0QEf`0!P-!!@m!!!6'"-RqH![qH!!8-!!)G'9YF("KG'J!#(4PEA"
+3BA4S"[jl!!!#!NF!!J*8!P80!P3!!Q`!!J6B"0MqGrjf!Ijh!!!"rRB!!!)#93!
+#!PB#9`d#9J!#FJ!!"0J%i`*B!PN0!PJ!!Q)!!!6B"0m#@J*E$3*D!!&[!!!%f!6
+ErR8,rR8!*$!!%'0bHA"dEfC[E'4PFR"KG'J!%'0bHA"dEdC[E'4PFP"KG'J0!PX
+!!@d!!!6E"0i#A!`#A!!+!!3kE@3e!!)!!!d#@3!"E`!!!!!!!2jd#rjd!"3`!!K
+dC@e`F'&dD!!)G'9YF&"KG'J#!PF!!J*G!Pi0!Pd!!dN!!J6N"3lqFrjb!Pm+rR-
+!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@aX!Ijb!!!'!Pm!!rja!Q!#B3VqF3!
+%#QY[Bf`0!Q!!!@d!!!6S"1[qF!VqF!!%#Q&XD@%'!Q%!!rj[!Q)#B`VqE`!%#QP
+ZFfJ0!Q)!!M3!!!6Z"2EqEJ*N#[jZ!!3+BfC[E!d#C!!"E`!!"2)%pIjY#rjY!$3
+`!"K[F'9ZFh0XD@jME(9NC@C[E'4PFR"KG'J!''p`C@j68da*EQ0XG@4P4QpXC'9
+b8'&dD!B#B`!$rQ`#CIjV#[jX!!3+G'mJ)!d#C3!#EJ!!"2N&#!*Q!QF0!QB!!M3
+!!!8""3MqDJ*S#[jU!!3+CQPXC3d#D!!"E3!!"33&"`*T$!*T!!X!"@eN05jS!!)
+!!!d#C`!#0!!!"2N&!IjT!QS+rQN!"!TMCQpX$3*U!!&[!!!%r38!rQJ,rQJ!&$!
+!#(4PEA"`BA4S!!KdC@e`8'&dD!EqD`!!!J*H!!)#D`*X$3*V!!*X!!)&$`82rQI
+qCJ(qC`!!!IjQ!!!#!Q`!!J*Y!Qi0!Qd!!R)!!!82"4S#E`*`$3*[!!*L!!!&$`8
+@!R%#FJd#F3!"E`!!"3m&%[jP#rjP!#3`!""MFRP`G'pQEfaNCA*`BA4S!""MFRP
+`G'p'EfaNCA*3BA4S$3*b!!&Y!!!&%J89!R--!R-!#`!&1QeNBc)!!J!!$3*`!!&
+[!!!!!!!!rQ3,rQ3!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!)#EJ!#!R3#G3d#G!!
+$53!#"4X&4IjMrQ)#GJVqB`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"rQ)
+!!!B#GJ!$rQ%#G`*i#[jK!!3+DfpME!d#G`!"E3!!"4m&)[jJ#[jJ!!3+B@aTB3B
+#H!!$rPm#H3*k#[jI!!3+D@jcD!d#H3!#0!!!"58&,IjH!RX+rPi!"!TMCQpX$3*
+l!!&[!!!&+38XrPd,rPd!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"
+PEP066%PZBfaeC'9'EfaNCA*3BA4S"J*k!!2qA!*mrPX+rP`!"!TdEb!J$3*m!!*
+Z!!!&-!8r!Rd#IJd#I3!#0!!!"6J&2rjD!Rm+rPS!"!TQD@aP$3*r!!&Y!!!&1`8
+q!S!-!S!!$!!'E@4M-LjS!!)!!!d#IJ!#0!!!"6!&12jC!S%+rPN!"!TMCQpX$3+
+"!!&[!!!&0!8hrPJ,rPJ!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!Eq@`!!!J*e!!)
+#JJ+$$3+#!!*X!!)&4J9'rPIq9J(q9`!!!Ij@!!!#!S-!!J+%!S80!S3!!R)!!!9
+'"9%#KJ+($3+'!!*L!!!&4J90!SJ#L3d#L!!"E`!!"8B&5Ij9#rj9!#3`!""MFRP
+`G'pQEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S$3+*!!&Y!!!&539-!SS-!SS
+!$J!)1QpLDQ9MG(-!!J!!$3+(!!&[!!!!!!!!rP3,rP3!&$!!#(4PEA"`BA4S!!K
+dC@e`8'&dD!)#K3!#!SX#M!d#L`!$53!#"9)&I2j6rP)#M3Vq8`!B,Q0[FQ9MFQ9
+X+LSU+J!!!!!!!*!!!'jeE'`"rP)!!!B#M3!$rP%#MJ+2#[j4!!3+DfpME!d#MJ!
+"E3!!"9B&@Ij3#[j3!!3+B@aTB3B#M`!$rNm#N!!#N3Vq6`!%#QPZFfJ0!T!!!!)
+d!!!&A!9NrNi#NJVq6J!%#Q0QEf`0!T)!!@m!!!9J"@2q63[q63!d-!!BEh"PER0
+cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'!T%
+!!rj-!T2q5`Vq6!!%#R4[)#!0!T-!!Qi!!!9R"AB#P!+9$3+8!!)d!!!&E`9frNS
+#PJVq5J!%#QCTE'80!TB!!@d!!!9b"A8#P``#P`!2!!P[BQTPBh4c,QJ!!J!!$3+
+9!!)d!!!&C`9[rNN#Q!Vq53!%#Q0QEf`0!TJ!!@m!!!9V"@lq5![q5!!8-!!)G'9
+YF("KG'J!#(4PEA"3BA4S"[j,!!!#!S`!!J+C!TS0!TN!!Q`!!J9p"Ahq4rj'!Ij
+(!!!"rNB!!!)#QJ!#!TX#R!d#Q`!#FJ!!"Ad&L!+G!Ti0!Td!!Q)!!!9p"B3#R`+
+J$3+I!!&[!!!&I3@!rN8,rN8!*$!!%'0bHA"dEfC[E'4PFR"KG'J!%'0bHA"dEdC
+[E'4PFP"KG'J0!U!!!@d!!!@!"B-#S3`#S3!+!!3kF'9Y!!)!!!d#RJ!"E`!!!!!
+!!2j%#rj%!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J#!T`!!J+L!U-0!U)!!dN!!J@
+*"E2q3rj#!U3+rN-!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@aX!Ij#!!!'!U3
+!!rj"!U8#TJVq33!%#QY[Bf`0!U8!!@d!!!@0"C!!rN!+rN!!"!TKE'PK"J+Q!!2
+q2`+R!UJ+rMm!"!TTER0S$3+R!!)d!!!&N`@ErMi#U3Vq2J!%#Q0QEf`0!UN!!@m
+!!!@A"CVq23[q23!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0
+-5@jME(9NC8C[E'4PFP"KG'J'!UJ!!rim!UVq1`Vq2!!%#R4[)#!0!US!!Qi!!!@
+H"Dd#U`+X$3+V!!)d!!!&TJ@YrMS#V3Vq1J!%#QCTE'80!Ud!!@d!!!@T"D`#VJ`
+#VJ!,!!9`C@dZD!!#!!!0!U`!!M3!!!@H"DEq13+[#[ij!!3+BfC[E!d#V`!"E`!
+!"D)&TIii#rii!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J'rMX!!!)#S`!#!V!#X3d
+#X!!$53!#"E3&h[ihrMB#XJVq0`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`
+"rMB!!!B#XJ!$rM8#X`+d#[ie!!3+DfpME!d#X`!"E3!!"EJ&Zrid#[id!!3+B@a
+TB3B#Y!!$rM-#Y3+f#[ic!!3+D@jcD!d#Y3!#0!!!"Ei&a[ib!VF+rM)!"!TMCQp
+X$3+h!!&[!!!&`JA&rM%,rM%!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!
+BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J+f!!2q-!+irLm+rM!!"!TdEb!J$3+
+i!!*Z!!!&b3AB!VN#ZJd#Z3!#0!!!"G%&f2iZ!VX+rLi!"!TQD@aP$3+l!!&Y!!!
+&e!AA!V`-!V`!$!!'F'9Y-LjS!!)!!!d#ZJ!#0!!!"FN&dIiY!Vd+rLd!"!TMCQp
+X$3+p!!&[!!!&c3A3rL`,rL`!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!Eq,`!!!J+
+a!!)#[J+r$3+q!!*X!!)&h`AIrL[q+J(q+`!!!IiU!!!#!Vm!!J,!!X%0!X!!!R)
+!!!AI"HS#`J,$$3,#!!*L!!!&h`AQ!X3#a3d#a!!"E`!!"Gm&i[iT#riT!#3`!""
+MFRP`G'pQEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S$3,&!!&Y!!!&iJAP!XB
+-!XB!$3!(1R"VBh-a-J!#!!!0!X-!!@m!!!!!!!$q+![q+!!8-!!)G'9YF("KG'J
+!#(4PEA"3BA4S!J,"!!)#a`,)$3,(!!0*!!)&k`B9rLIq*J,*#[iR!"JZBfpbC@0
+bC@`U+LSU!!!!!!!!N!!!ER9XE!(q*J!!"J,*!!2q*3,+!XX+rL8!"!TVEf0X$3,
++!!&Y!!!&l`AbrL3+rL3!"!TKE'PK"J,,!!2q)`,-!Xd+rL-!"!TTER0S$3,-!!)
+d!!!&p3AprL)#cJVq)J!%#Q0QEf`0!Xi!!@m!!!Aj"Icq)3[q)3!d-!!BEh"PER0
+cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'!Xd
+!!riJ!Xrq(`Vq)!!%#R4[)#!0!Xm!!Qi!!!B!"Jm#d!,4$3,3!!)d!!!'#!B2rKi
+#dJVq(J!%#QCTE'80!Y)!!@d!!!B,"Ji#d``#d`!1!!K`Df0c-6)ZD!!#!!!0!Y%
+!!M3!!!B!"JMq(3,8#[iG!!3+BfC[E!d#e!!"E`!!"J3'"riF#riF!"3`!!KdC@e
+`F'&dD!!)G'9YF&"KG'J'rKm!!!)#b!!#!Y8#eJd#e3!#E!!#"KB'&[iErKS"rKX
+!!!(q'J!!!J,@!!)#e`,B$3,A!!*b!!!'&JBK!YN#fJd#f3!#BJ!!"KB'(3,E!Y`
+0!YX!!@m!!!B@"KRq'3[q'3!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4Qp
+XC'9b8'&dD!d#h!!"E3!!"KN'(!,G$!,G!!`!"MT`Df0c0`!#!!!0!YS!!@m!!!!
+!!!$q'![q'!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S!J,B!!)#hJ,I$3,H!!0*!!)
+')JC-rKIq&J,J#[iA!"JZBfpbC@0bC@`U+LSU!!!!!!!!N!!!ER9XE!(q&J!!"J,
+J!!2q&3,K!Z)+rK8!"!TVEf0X$3,K!!&Y!!!'*JBTrK3+rK3!"!TKE'PK"J,L!!2
+q%`,M!Z3+rK-!"!TTER0S$3,M!!)d!!!',!BdrK)#j3Vq%J!%#Q0QEf`0!Z8!!@m
+!!!B`"M2q%3[q%3!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0
+-5@jME(9NC8C[E'4PFP"KG'J'!Z3!!ri3!ZEq$`Vq%!!%#R4[)#!0!ZB!!Qi!!!B
+h"NB#j`,S$3,R!!)d!!!'2`C'rJi#k3Vq$J!%#QCTE'80!ZN!!@d!!!C#"N8#kJ`
+#kJ!0!!G`Df0c0bjS!!)!!!d#k!!#0!!!"MF'2ri0!ZX+rJd!"!TMCQpX$3,V!!&
+[!!!'1`BqrJ`,rJ`!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!Eq$`!!!J,I!!)#l!,
+Y$3,X!!*X!!)'63C0rJ[q#J(q#`!!!Ii+!!!#!Zd!!J,Z!Zm0!Zi!!R)!!!C0"PJ
+#m!,a$3,`!!*L!!!'63C8![)#m`d#mJ!"E`!!"Nd'82i*#ri*!#3`!""MFRP`G'p
+QEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S$3,c!!&Y!!!'8!C6![3-![3!#`!
+&1R*KEQ3!!J!!$3,a!!&[!!!!!!!!rJJ,rJJ!&$!!#(4PEA"`BA4S!!KdC@e`8'&
+dD!)#l`!#![8#pJd#p3!$53!#"PN'Jri(rJB#p`Vq"`!B,Q0[FQ9MFQ9X+LSU+J!
+!!!!!!*!!!'jeE'`"rJB!!!B#p`!$rJ8#q!,j#[i&!!3+DfpME!d#q!!"E3!!"Pd
+'B2i%#[i%!!3+B@aTB3B#q3!$rJ-#qJ,l#[i$!!3+D@jcD!d#qJ!#0!!!"Q-'Dri
+#![`+rJ)!"!TMCQpX$3,m!!&[!!!'C`CUrJ%,rJ%!0$!!''p`C@jcFfaTEQ0XG@4
+PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J,l!!2q!!,prIm
++rJ!!"!TdEb!J$3,p!!*Z!!!'EJCp![i#r`d#rJ!#0!!!"RB'IIhq!`!+rIi!"!T
+QD@aP$3-!!!&Y!!!'H3Cm!`%-!`%!$!!'FQ&ZC#jS!!)!!!d#r`!#0!!!"Qi'G[h
+p!`)+rId!"!TMCQpX$3-#!!&[!!!'FJCerI`,rI`!&$!!#(4PEA"`BA4S!!KdC@e
+`8'&dD!Epr`!!!J,f!!)$!`-%$3-$!!*X!!)'K!D%rI[pqJ(pq`!!!Ihk!!!#!`3
+!!J-&!`B0!`8!!R)!!!D%"Sm$"`-)$3-(!!*L!!!'K!D,!`N$#Jd$#3!"E`!!"S3
+'Krhj#rhj!#3`!""MFRP`G'pQEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S$3-
++!!&Y!!!'K`D+!`X-!`X!#J!%1R*M-J!#!!!0!`J!!@m!!!!!!!$pq![pq!!8-!!
+)G'9YF("KG'J!#(4PEA"3BA4S!J-'!!)$$!-0$3--!!0*!!)'N!!'Z[hhrIB$$JV
+pp`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"rIB!!!B$$J!$rI8$$`-3#[h
+e!!3+DfpME!d$$`!"E3!!"T3'Prhd#[hd!!3+B@aTB3B$%!!$rI-$%3-5#[hc!!3
++D@jcD!d$%3!#0!!!"TS'S[hb!a-+rI)!"!TMCQpX$3-6!!&[!!!'RJDKrI%,rI%
+!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'Efa
+NCA*3BA4S"J-5!!2pm!-8rHm+rI!!"!TdEb!J$3-8!!*Z!!!'T3Dd!a8$&Jd$&3!
+#0!!!"Ud'Y2hZ!aF+rHi!"!TQD@aP$3-A!!&Y!!!'X!Dc!aJ-!aJ!#`!&FQ-b,QJ
+!!J!!$3-@!!)d!!!'T3DYrHd$'3Vpl3!%#Q0QEf`0!aN!!@m!!!DT"Ucpl![pl!!
+8-!!)G'9YF("KG'J!#(4PEA"3BA4S"[h[!!!#!`d!!J-D!aX0!aS!!Q`!!JDl"V[
+pkrhU!IhV!!!"rHS!!!)$'`!#!a`$(3d$(!!#FJ!!"VX'aJ-H!am0!ai!!Q)!!!D
+l"X)$)!-K$3-J!!&[!!!'Z`DqrHN,rHN!*$!!%'0bHA"dEfC[E'4PFR"KG'J!%'0
+bHA"dEdC[E'4PFP"KG'J0!b%!!@d!!!Dq"X%$)J`$)J!+!!3kFQ-d!!)!!!d$(`!
+"E`!!!!!!!2hS#rhS!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J#!ad!!J-M!b30!b-
+!!dN!!JE("[(pjrhQ!b8+rHF!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"ZG@aX!Ih
+Q!!!'!b8!!rhP!bB$*`Vpj3!%#QY[Bf`0!bB!!@d!!!E,"Xlpj!Vpj!!%#Q&XD@%
+'!bF!!rhM!bJ$+3Vpi`!%#QPZFfJ0!bJ!!M3!!!E4"YRpiJ-U#[hL!!3+BfC[E!d
+$+J!"E`!!"Y8'f2hK#rhK!$3`!"K[F'9ZFh0XD@jME(9NC@C[E'4PFR"KG'J!''p
+`C@j68da*EQ0XG@4P4QpXC'9b8'&dD!B$+3!$rH!$+rhI#[hJ!!3+G'mJ)!d$+`!
+#EJ!!"Y`'k`-X!bd0!b`!!M3!!!EN"Z[phJ-Z#[hH!!3+CQPXC3d$,J!"E3!!"ZF
+'kJ-[$!-[!!X!"A*M0#jS!!)!!!d$,3!#0!!!"Y`'j2hG!c!+rGd!"!TMCQpX$3-
+`!!&[!!!'i!EMrG`,rG`!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!Eph`!!!J-N!!)
+$-3-b$3-a!!*X!!)'mJEbrG[pfJ(pf`!!!IhD!!!#!c)!!J-c!c30!c-!!R)!!!E
+b"[d$03-f$3-e!!*L!!!'mJEj!cF$1!d$0`!"E`!!"[)'pIhC#rhC!#3`!""MFRP
+`G'pQEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S$3-i!!&Y!!!'p3Ei!cN-!cN
+!#J!%1R*M03!#!!!0!cB!!@m!!!!!!!$pf![pf!!8-!!)G'9YF("KG'J!#(4PEA"
+3BA4S!J-d!!)$1J-l$3-k!!0*!!)'rJFSrGIpeJ-m#[hA!"JZBfpbC@0bC@`U+LS
+U!!!!!!!!N!!!ER9XE!(peJ!!"J-m!!2pe3-p!ci+rG8!"!TVEf0X$3-p!!&Y!!!
+(!JF&rG3+rG3!"!TKE'PK"J-q!!2pd`-r!d!+rG-!"!TTER0S$3-r!!)d!!!(#!F
+3rG)$33VpdJ!%#Q0QEf`0!d%!!@m!!!F-"`rpd3[pd3!d-!!BEh"PER0cE'PZBfa
+eC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'!d!!!rh3!d,
+pc`Vpd!!%#R4[)#!0!d)!!Qi!!!F6"b)$3`0%$30$!!)d!!!('`FLrFi$43VpcJ!
+%#QCTE'80!d8!!@d!!!FH"b%$4J`$4J!,!!9bBc8ZD!!#!!!0!d3!!M3!!!F6"a[
+pc30(#[h0!!3+BfC[E!d$4`!"E`!!"aF('[h-#rh-!"3`!!KdC@e`F'&dD!!)G'9
+YF&"KG'J'rFm!!!)$1`!#!dJ$53d$5!!#E!!#"bN(+Ih,rFS"rFX!!!(pbJ!!!J0
+*!!)$5J0,$30+!!*b!!!(+3Fd!d`$63d$6!!#BJ!!"bN(-!01!dm0!di!!@m!!!F
+T"bcpb3[pb3!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD!d
+$6`!"E3!!"b`(,`03$!03!!d!"cTbDA"PE@3!!J!!$300!!&[!!!!!!!!rFJ,rFJ
+!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!)$5`!#!e%$8Jd$83!$53!#"c8(Arh(rFB
+$8`Vpa`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"rFB!!!B$8`!$rF8$9!0
+9#[h&!!3+DfpME!d$9!!"E3!!"cN(22h%#[h%!!3+B@aTB3B$93!$rF-$9J0A#[h
+$!!3+D@jcD!d$9J!#0!!!"cm(4rh#!eJ+rF)!"!TMCQpX$30B!!&[!!!(3`G'rF%
+,rF%!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9
+'EfaNCA*3BA4S"J0A!!2p`!0CrEm+rF!!"!TdEb!J$30C!!*Z!!!(5JGC!eS$@`d
+$@J!#0!!!"e)(@Ifq!e`+rEi!"!TQD@aP$30F!!&Y!!!(93GB!ed-!ed!$J!)FQP
+`C@eN,QJ!!J!!$30E!!)d!!!(5JG5rEd$AJVp[3!%#Q0QEf`0!ei!!@m!!!G1"e(
+p[![p[!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S"[fr!!!#!e)!!J0I!f!0!em!!Q`
+!!JGJ"f$pZrfk!Ifl!!!"rES!!!)$B!!#!f%$BJd$B3!#FJ!!"f!(D`0M!f30!f-
+!!Q)!!!GJ"fF$C30Q$30P!!&[!!!(B!GMrEN,rEN!*$!!%'0bHA"dEfC[E'4PFR"
+KG'J!%'0bHA"dEdC[E'4PFP"KG'J0!fB!!@d!!!GM"fB$C``$C`!+!!3kFR0K!!)
+!!!d$C!!"E`!!!!!!!2fi#rfi!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J#!f)!!J0
+S!fN0!fJ!!dN!!JGX"jEpYrff!fS+rEF!'#jMEh*PBh*PE#SU+LS!!!!!!!#3!!"
+ZG@aX!Iff!!!'!fS!!rfe!fX$E!VpY3!%#QY[Bf`0!fX!!@d!!!G`"h2pY!VpY!!
+%#Q&XD@%'!f`!!rfc!fd$EJVpX`!%#QPZFfJ0!fd!!M3!!!Gf"hlpXJ0[#[fb!!3
++BfC[E!d$E`!"E`!!"hS(IIfa#rfa!$3`!"K[F'9ZFh0XD@jME(9NC@C[E'4PFR"
+KG'J!''p`C@j68da*EQ0XG@4P4QpXC'9b8'&dD!B$EJ!$rE!$F2f[#[f`!!3+G'm
+J)!d$F!!#EJ!!"i%(N!!$F30b$30a!!)d!!!(L3H3!2fZ!h-+rDi!"!TQD@aP$30
+c!!&Y!!!(M!H2!h3-!h3!#`!&FR0K,QJ!!J!!$30b!!)d!!!(J3H*rDd$G3VpV3!
+%#Q0QEf`0!h8!!@m!!!H&"iMpV![pV!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S"[f
+[!!!#!fN!!J0f!hF0!hB!!Q`!!JHA"jIpUrfU!IfV!!!"rDS!!!)$G`!#!hJ$H3d
+$H!!#FJ!!"jF(SJ0k!hX0!hS!!Q)!!!HA"ji$I!0p$30m!!&[!!!(P`HDrDN,rDN
+!*$!!%'0bHA"dEfC[E'4PFR"KG'J!%'0bHA"dEdC[E'4PFP"KG'J0!hd!!@d!!!H
+D"jd$IJ`$IJ!-!!BkFh4KBfX!!J!!$30l!!&[!!!!!!!!rDJ,rDJ!&$!!#(4PEA"
+`BA4S!!KdC@e`8'&dD!)$H3!#!hm$J!d$I`!$53!#"k-(cIfRrDB$J3VpT`!B,Q0
+[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"rDB!!!B$J3!$rD8$JJ1$#[fP!!3+Dfp
+ME!d$JJ!"E3!!"kF(U[fN#[fN!!3+B@aTB3B$J`!$rD-$K!1&#[fM!!3+D@jcD!d
+$K!!#0!!!"kd(YIfL!iB+rD)!"!TMCQpX$31'!!&[!!!(X3HdrD%,rD%!0$!!''p
+`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4
+S"J1&!!2pS!1(rCm+rD!!"!TdEb!J$31(!!*Z!!!(Z!I(!iJ$L3d$L!!#0!!!"m!
+(arfH!iS+rCi!"!TQD@aP$31+!!&Y!!!(``I'!iX-!iX!$3!(Fh4KBfXZD!!#!!!
+0!iN!!M3!!!Hi"m$pR31-#[fG!!3+BfC[E!d$M!!"E`!!"l`([rfF#rfF!"3`!!K
+dC@e`F'&dD!!)G'9YF&"KG'J'rCm!!!)$J!!#!id$MJd$M3!$53!#"mi(q2fErCS
+$M`VpQ`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"rCS!!!B$M`!$rCN$N!!
+$N3VpQ3!%#QY[Bf`0!j!!!!&Y!!!(dJI9rCJ+rCJ!"!TKE'PK"J14!!2pP`15!j-
++rCF!"!TTER0S$315!!)d!!!(f!IJrCB$P!VpPJ!%#Q0QEf`0!j3!!@m!!!IF"pr
+pP3[pP3!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9
+NC8C[E'4PFP"KG'J'!j-!!rf8!jApN`VpP!!%#R4[)#!0!j8!!Qi!!!IM"r)$PJ1
+A$31@!!)d!!!(k`IbrC)$Q!VpNJ!%#QCTE'80!jJ!!@d!!!IZ"r%$Q3`$Q3!4!!Y
+cB@CPFh4KBfXZD!!#!!!0!jF!!M3!!!IM"q[pN31D#[f4!!3+BfC[E!d$QJ!"E`!
+!"qF(k[f3!![pN!!!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!EpN`!!!J11!!)$Q`1
+F$31E!!*X!!)(q3IjrBrpMJ(pM`!!!If1!!!#!j`!!J1G!ji0!jd!!R)!!!Ij#!3
+$R`1J$31I!!*L!!!(q3J!!k%$SJd$S3!"E`!!"rN(r2f0#rf0!#3`!""MFRP`G'p
+QEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S$31L!!&Y!!!(r!Ir!k--!k-!#J!
+%1R0SB3!#!!!0!k!!!@m!!!!!!!$pM![pM!!8-!!)G'9YF("KG'J!#(4PEA"3BA4
+S!J1H!!)$T!1P$31N!!0*!!))"3J[rB[pLJ1Q#[f,!"JZBfpbC@0bC@`U+LSU!!!
+!!!!!N!!!ER9XE!(pLJ!!"J1Q!!2pL31R!kJ+rBN!"!TVEf0X$31R!!&Y!!!)#3J
+-rBJ+rBJ!"!TKE'PK"J1S!!2pK`1T!kS+rBF!"!TTER0S$31T!!)d!!!)$`JArBB
+$U`VpKJ!%#Q0QEf`0!kX!!@m!!!J6#"EpK3[pK3!d-!!BEh"PER0cE'PZBfaeC'9
+QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'!kS!!rf%!kcpJ`V
+pK!!%#R4[)#!0!k`!!Qi!!!JD##N$V31Z$31Y!!)d!!!))JJTrB)$V`VpJJ!%#QC
+TE'80!km!!@d!!!JP##J$X!`$X!!,!!9cD'%ZD!!#!!!0!ki!!M3!!!JD##,pJ31
+a#[f"!!3+BfC[E!d$X3!"E`!!#"i))If!#rf!!"3`!!KdC@e`F'&dD!!)G'9YF&"
+KG'J'rB-!!!)$T3!#!l)$X`d$XJ!#E!!##$!)-2errAi"rAm!!!(pIJ!!!J1c!!)
+$Y!1e$31d!!*b!!!)-!Jl!lB$Y`d$YJ!#BJ!!#$!)0`1i!lN0!lJ!!@m!!!J`#$2
+pI3[pI3!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD!d$Z3!
+"E3!!#$-)0J1k$!1k!!d!"cTdH(4IC')!!J!!$31h!!&[!!!!!!!!rA`,rA`!&$!
+!#(4PEA"`BA4S!!KdC@e`8'&dD!)$Y3!#!lX$[!d$Z`!$53!##$`)C[elrAS$[3V
+pH`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"rAS!!!B$[3!$rAN$[J1r#[e
+j!!3+DfpME!d$[J!"E3!!#%!)3rei#[ei!!3+B@aTB3B$[`!$rAF$`!2"#[eh!!3
++D@jcD!d$`!!#0!!!#%B)6[ef!m)+rAB!"!TMCQpX$32#!!&[!!!)5JK0rA8,rA8
+!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'Efa
+NCA*3BA4S"J2"!!2pG!2$rA-+rA3!"!TdEb!J$32$!!*Z!!!)83KJ!m3$a3d$a!!
+#0!!!#&N)B2eb!mB+rA)!"!TQD@aP$32'!!&Y!!!)A!KI!mF-!mF!$J!)G(KdAf4
+L,QJ!!J!!$32&!!)d!!!)83KCrA%$b!VpF3!%#Q0QEf`0!mJ!!@m!!!K9#&MpF![
+pF!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S"[ec!!!#!l`!!J2*!mS0!mN!!Q`!!JK
+R#'IpEreZ!Ie[!!!"r@i!!!)$bJ!#!mX$c!d$b`!#FJ!!#'F)FJ20!mi0!md!!Q)
+!!!KR#'i$c`23$322!!&[!!!)C`KUr@d,r@d!*$!!%'0bHA"dEfC[E'4PFR"KG'J
+!%'0bHA"dEdC[E'4PFP"KG'J0!p!!!@d!!!KU#'d$d3`$d3!,!!8kH$8`13!#!!!
+0!mi!!@m!!!!!!!$pE![pE!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S!J2-!!)$dJ2
+6$325!!0*!!))F`LGr@[pDJ28#[eV!"JZBfpbC@0bC@`U+LSU!!!!!!!!N!!!ER9
+XE!(pDJ!!"J28!!2pD329!pB+r@N!"!TVEf0X$329!!&Y!!!)G`Kkr@J+r@J!"!T
+KE'PK"J2@!!2pC`2A!pJ+r@F!"!TTER0S$32A!!)d!!!)I3L&r@B$f3VpCJ!%#Q0
+QEf`0!pN!!@m!!!L"#)6pC3[pC3!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4
+S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'!pJ!!reN!pVpB`VpC!!%#R4[)#!
+0!pS!!Qi!!!L)#*F$f`2F$32E!!)d!!!)N!!)PreL!pd+r@)!"!TQD@aP$32G!!&
+Y!!!)N`L@!pi-!pi!$!!'H$8`15jS!!)!!!d$h!!#0!!!#)J)N!$pB32I#[eK!!3
++BfC[E!d$h`!"E`!!#)`)MreJ#reJ!"3`!!KdC@e`F'&dD!!)G'9YF&"KG'J'r@-
+!!!)$d`!#!q!$i3d$i!!$53!##*i)b2eIr9i$iJVpA`!B,Q0[FQ9MFQ9X+LSU+J!
+!!!!!!*!!!'jeE'`"r9i!!!B$iJ!$r9d$i`2N#[eG!!3+DfpME!d$i`!"E3!!#+)
+)TIeF#[eF!!3+B@aTB3B$j!!$r9X$j32Q#[eE!!3+D@jcD!d$j3!#0!!!#+J)X2e
+D!qF+r9S!"!TMCQpX$32R!!&[!!!)V!L[r9N,r9N!0$!!''p`C@jcFfaTEQ0XG@4
+PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J2Q!!2p@!2Sr9F
++r9J!"!TdEb!J$32S!!*Z!!!)X`M#!qN$kJd$k3!#0!!!#,X)`[e@!qX+r9B!"!T
+QD@aP$32V!!&Y!!!)[JM"!q`-!q`!%!!+H$8`19pfCRNZD!!#!!!0!qS!!M3!!!L
+c#,[p932Y#[e9!!3+BfC[E!d$l3!"E`!!#,F)Z[e8#re8!"3`!!KdC@e`F'&dD!!
+)G'9YF&"KG'J'r9F!!!)$i3!#!qi$l`d$lJ!#E!!##-N)bIe6r9)"r9-!!!(p8J!
+!!J2[!!)$m!2a$32`!!*b!!!)b3M8!r)$m`d$mJ!#BJ!!#-N)d!2d!r80!r3!!@m
+!!!M*#-cp83[p83!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&
+dD!d$p3!"E3!!#-`)c`2f$!2f!!d!"cTi06!jGM-!!J!!$32c!!&[!!!!!!!!r9!
+,r9!!&$!!#(4PEA"`BA4S!!KdC@e`8'&dD!)$m3!#!rF$q!d$p`!$53!##08)rre
+2r8i$q3Vp6`!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"r8i!!!B$q3!$r8d
+$qJ2l#[e0!!3+DfpME!d$qJ!"E3!!#0N)h2e-#[e-!!3+B@aTB3B$q`!$r8X$r!2
+p#[e,!!3+D@jcD!d$r!!#0!!!#0m)jre+!ri+r8S!"!TMCQpX$32q!!&[!!!)i`M
+Qr8N,r8N!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfa
+eC'9'EfaNCA*3BA4S"J2p!!2p5!2rr8F+r8J!"!TdEb!J$32r!!*Z!!!)kJMj"!!
+%!3d%!!!#0!!!#2))qIe'"!)+r8B!"!TQD@aP$33#!!&Y!!!)p3Mi"!--"!-!$J!
+)H$8`1ABc,QJ!!J!!$33"!!)d!!!)kJMbr88%"!Vp43!%#Q0QEf`0"!3!!@m!!!M
+Z#2(p4![p4!!8-!!)G'9YF("KG'J!#(4PEA"3BA4S"[e(!!!#!rJ!!J3&"!B0"!8
+!!Q`!!JN!#3$p3re#!Ie$!!!"r8)!!!)%"J!#"!F%#!d%"`!$53!##3!*+[e"r8!
+%#3Vp33!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"r8!!!!B%#3!$r6m%#J3
+,#[dr!!3+DfpME!d%#J!"E3!!#33*"rdq#[dq!!3+B@aTB3B%#`!$r6d%$!30#[d
+p!!3+D@jcD!d%$!!#0!!!#3S*%[dm"!i+r6`!"!TMCQpX$331!!&[!!!*$JN4r6X
+,r6X!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9
+'EfaNCA*3BA4S"J30!!2p1J32r6N+r6S!"!TdEb!J$332!!*Z!!!*&3NN""!%%3d
+%%!!#0!!!#4d**2di"")+r6J!"!TQD@aP$335!!&Y!!!*)!NM""--""-!#`!&Fh0
+X,QJ!!J!!$334!!)d!!!*&3NGr6F%&!Vp0`!%#Q0QEf`0""3!!@m!!!NC#4cp0J[
+p0J!H-!!0Fh0XCQpXC'9bF'&dD!!0Fh0X4QpXC'9b8'&dD!Ep13!!!J3)!!)%&33
+@$339!!0*!!)*+`P9r6Ap0!3A#[de!"JZBfpbC@0bC@`U+LSU!!!!!!!!N!!!ER9
+XE!(p0!!!"J3A!!2p-`3B""N+r6-!"!TVEf0X$33B!!&Y!!!*,`Nbr6)+r6)!"!T
+KE'PK"J3C!!2p-33D""X+r6%!"!TTER0S$33D!!)d!!!*03Npr6!%(!Vp-!!%#Q0
+QEf`0""`!!@m!!!Nj#6cp,`[p,`!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4
+S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'""X!!rdZ""hp,3Vp,J!%#R4[)#!
+0""d!!Qi!!!P!#8m%(J3I$33H!!)d!!!*5!P2r5`%)!Vp,!!%#QCTE'80"#!!!@d
+!!!P,#8i%)3`%)3!-!!CcFf`b,QJ!!J!!$33I!!)d!!!*3!P)r5X%)JVp+`!%#Q0
+QEf`0"#)!!@m!!!P%#8Ip+J[p+J!H-!!0Fh0XCQpXC'9bF'&dD!!0Fh0X4QpXC'9
+b8'&dD!Ep,3!!!J3@!!)%)`3N$33M!!0*!!)*9JQ!r5Rp+!3P#[dT!"JZBfpbC@0
+bC@`U+LSU!!!!!!!!N!!!ER9XE!(p+!!!"J3P!!2p*`3Q"#F+r5F!"!TVEf0X$33
+Q!!&Y!!!*@JPGr5B+r5B!"!TKE'PK"J3R!!2p*33S"#N+r58!"!TTER0S$33S!!)
+d!!!*B!PSr53%+JVp*!!%#Q0QEf`0"#S!!@m!!!PN#@Ip)`[p)`!d-!!BEh"PER0
+cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'"#N
+!!rdL"#[p)3Vp)J!%#R4[)#!0"#X!!Qi!!!PV#AS%,!3Y$33X!!)d!!!*F`Pkr5!
+%,JVp)!!%#QCTE'80"#i!!@d!!!Pf#AN%,``%,`!0!!GcFf`b-bjS!!)!!!d%,3!
+#0!!!#@X*FrdI"$!+r4m!"!TMCQpX$33`!!&[!!!*E`Pbr4i,r4i!(M!!$A0cE'C
+[E'4PFR"KG'J!$A0cE%C[E'4PFP"KG'J'r5%!!!)%*!!#"$%%-Jd%-3!$53!##B%
+*UrdGr4`%-`Vp(3!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"r4`!!!B%-`!
+$r4X%0!3e#[dE!!3+DfpME!d%0!!"E3!!#B8*L2dD#[dD!!3+B@aTB3B%03!$r4N
+%0J3h#[dC!!3+D@jcD!d%0J!#0!!!#BX*NrdB"$J+r4J!"!TMCQpX$33i!!&[!!!
+*M`Q5r4F,r4F!0$!!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%P
+ZBfaeC'9'EfaNCA*3BA4S"J3h!!2p&J3jr48+r4B!"!TdEb!J$33j!!*Z!!!*PJQ
+P"$S%1`d%1J!#0!!!#Ci*TId8"$`+r43!"!TQD@aP$33m!!&Y!!!*S3QN"$d-"$d
+!$!!'Fh0X-bjS!!)!!!d%1`!#0!!!#CB*R[d6"$i+r4-!"!TMCQpX$33q!!&[!!!
+*QJQGr4),r4)!(M!!$A0cE'C[E'4PFR"KG'J!$A0cE%C[E'4PFP"KG'J'r48!!!)
+%-J!#"$m%3!d%2`!$53!##D`*e[d4r4!%33Vp%3!B,Q0[FQ9MFQ9X+LSU+J!!!!!
+!!*!!!'jeE'`"r4!!!!B%33!$r3m%3J4$#[d2!!3+DfpME!d%3J!"E3!!#E!*Xrd
+1#[d1!!3+B@aTB3B%3`!$r3d%4!4&#[d0!!3+D@jcD!d%4!!#0!!!#EB*[[d-"%B
++r3`!"!TMCQpX$34'!!&[!!!*ZJQpr3X,r3X!0$!!''p`C@jcFfaTEQ0XG@4PCQp
+XC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*3BA4S"J4&!!2p#J4(r3N+r3S
+!"!TdEb!J$34(!!*Z!!!*`3R3"%J%53d%5!!#0!!!#FN*d2d)"%S+r3J!"!TQD@a
+P$34+!!&Y!!!*c!R2"%X-"%X!$!!'G'ac-5jS!!)!!!d%53!#0!!!#F%*bId("%`
++r3F!"!TMCQpX$34-!!&[!!!*a3R)r3B,r3B!(M!!$A0cE'C[E'4PFR"KG'J!$A0
+cE%C[E'4PFP"KG'J'r3N!!!)%3!!#"%d%6Jd%63!#E!!##GF*erd&r33"r38!!!(
+p"!!!!J41!!)%6`43$342!!0*!!)*e`S"r32p!J44#[d$!"JZBfpbC@0bC@`U+LS
+U!!!!!!!!N!!!ER9XE!(p!J!!"J44!!2p!345"&-+r3%!"!TVEf0X$345!!&Y!!!
+*f`RHr3!+r3!!"!TKE'PK"J46!!2mr`48"&8+r2m!"!TTER0S$348!!)d!!!*i3R
+Tr2i%9JVmrJ!%#Q0QEf`0"&B!!@m!!!RP#HMmr3[mr3!d-!!BEh"PER0cE'PZBfa
+eC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9NC8C[E'4PFP"KG'J'"&8!!rcm"&I
+mq`Vmr!!%#R4[)#!0"&F!!Qi!!!RX#IX%@!4C$34B!!)d!!!*p!Rlr2S%@JVmqJ!
+%#QCTE'80"&S!!@d!!!Rh#IS%@``%@`!1!!KMFRP`G'mZD!!#!!!0"&N!!M3!!!R
+X#I6mq34F#[cj!!3+BfC[E!d%A!!"E`!!#I!*mrci#rci!#3`!""MFRP`G'pQEfa
+NCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S"[cl!!!#"&!!!J4G"&i0"&d!!Q`!!JS
+##J,mprcf!Ich!!!"r2B!!!)%AJ!#"&m%B!d%A`!$53!##J)+,2cer23%B3Vmp3!
+B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"r23!!!B%B3!$r2-%BJ4M#[cc!!3
++DfpME!d%BJ!"E3!!#JB+#Icb#[cb!!3+B@aTB3B%B`!$r2%%C!4P#[ca!!3+D@j
+cD!d%C!!#0!!!#J`+&2c`"'B+r2!!"!TMCQpX$34Q!!&[!!!+%!S6r1m,r1m!0$!
+!''p`C@jcFfaTEQ0XG@4PCQpXC'9bF'&dD!!BEh"PEP066%PZBfaeC'9'EfaNCA*
+3BA4S"J4P!!2mlJ4Rr1d+r1i!"!TdEb!J$34R!!*Z!!!+&`SQ"'J%D3d%D!!#0!!
+!#Km+*[cX"'S+r1`!"!TQD@aP$34U!!&Y!!!+)JSP"'X-"'X!%!!+Eh"PER0cE(B
+ZD!!#!!!0"'N!!M3!!!SA#Krmk`4X#[cV!!3+BfC[E!d%E!!"E`!!#KX+([cU#rc
+U!#3`!""MFRP`G'pQEfaNCA*`BA4S!""MFRP`G'p'EfaNCA*3BA4S"[cY!!!#"'!
+!!J4Y"'i0"'d!!dN!!JSY#PImkIcS"'m+r1N!'#jMEh*PBh*PE#SU+LS!!!!!!!#
+3!!"ZG@aX!IcS!!!'"'m!!rcR"(!%F3Vmj`!%#QY[Bf`0"(!!!@d!!!Sa#M6mjJV
+mjJ!%#Q&XD@%'"(%!!rcP"()%F`Vmj3!%#QPZFfJ0"()!!M3!!!Sh#Mrmj!4d#[c
+N!!3+BfC[E!d%G!!"E`!!#MX+2[cM#rcM!$3`!"K[F'9ZFh0XD@jME(9NC@C[E'4
+PFR"KG'J!''p`C@j68da*EQ0XG@4P4QpXC'9b8'&dD!B%F`!$r1)%GIcK#[cL!!3
++G'mJ)!d%G3!#EJ!!#N)+834f"(F0"(B!!M3!!!T+#P(mi!4i#[cJ!!3+CQPXC3d
+%H!!"E3!!#Nd+8!4j$!4j!!i!#(4YC'PQCLjS!!)!!!d%G`!#0!!!#N)+5[cI"(S
++r0m!"!TMCQpX$34k!!&[!!!+4JT*r0i,r0i!*$!!%'0bHA"dEfC[E'4PFR"KG'J
+!%'0bHA"dEdC[E'4PFP"KG'J'r1%!!!)%EJ!#"(X%I!d%H`!#E!!##PJ+@2cGr0`
+"r0d!!!(mh!!!!J4m!!)%I34q$34p!!*X!!)+@!TBr0[mfJ(mf`!!!IcD!!!#"(i
+!!J4r")!0"(m!!dN!!JTB#S,mfIcB")%+r0N!'#jMEh*PBh*PE#SU+LS!!!!!!!#
+3!!"ZG@aX!IcB!!!'")%!!rcA"))%J`Vme`!%#QY[Bf`0"))!!@d!!!TF#PrmeJV
+meJ!%#Q&XD@%'")-!!rc9")3%K3Vme3!%#QPZFfJ0")3!!M3!!!TL#QVme!5'#[c
+8!!3+BfC[E!d%KJ!"E`!!#QB+DIc6#rc6!$3`!"K[F'9ZFh0XD@jME(9NC@C[E'4
+PFR"KG'J!''p`C@j68da*EQ0XG@4P4QpXC'9b8'&dD!B%K3!$r0)%Krc4#[c5!!3
++G'mJ)!d%K`!#EJ!!#Qd+I!5)")N0")J!!M3!!!Te#Rcmd!5+#[c3!!3+CQPXC3d
+%LJ!"E3!!#RJ+H`5,$!5,!!`!"Q9IEh-ZD!!#!!!0")N!!M3!!!TY#RAmc`5-#[c
+2!!3+BfC[E!d%M!!"E`!!#R%+G2c1#rc1!#B`!"&[F'9ZFh0XCQpXC'9bF'&dD!!
+4Eh"PER0cE%C[E'4PFP"KG'J'r0%!!!)%J!!#")d%MJd%M3!$53!##S-+VIc0r-`
+%M`Vmc3!B,Q0[FQ9MFQ9X+LSU+J!!!!!!!*!!!'jeE'`"r-`!!!B%M`!$r-X%N!!
+%N3Vmb`!%#QY[Bf`0"*!!!!&Y!!!+K`U+r-S+r-S!"!TKE'PK"J54!!2mb355"*-
++r-N!"!TTER0S$355!!)d!!!+M3U9r-J%P!Vmb!!%#Q0QEf`0"*3!!@m!!!U4#T6
+ma`[ma`!d-!!BEh"PER0cE'PZBfaeC'9QEfaNCA*`BA4S!"K[F'9Z8e0-5@jME(9
+NC8C[E'4PFP"KG'J'"*-!!rc'"*Ama3VmaJ!%#R4[)#!0"*8!!Qi!!!UB#UF%PJ5
+A$35@!!)d!!!+S!URr-3%Q!Vma!!%#QCTE'80"*J!!@d!!!UM#UB%Q3`%Q3!0!!G
+PAfpc-LjS!!)!!!d%P`!#0!!!#TJ+S2c$"*S+r--!"!TMCQpX$35D!!&[!!!+R!U
+Ir-),r-)!*M!!%@p`C@jcFfaQEfaNCA*`BA4S!"&[F'9ZFh0X4QpXC'9b8'&dD!E
+ma3!!!J51!!)%Qrc"$35E!!*X!!)+VJUZr-$m[`(m`!!!!Ibr!!!#r-%!!!d!#3!
+"E3!!!!!!!3!I!Irq!!!#!!B!!J5F"*d0"*`!!Q`!!J!!!!$m[[bp!Ibq!!!"r,d
+!!!)%R3!#"*i%R`d%RJ!#E!!##V%+b!5Jr,`0"+!!!dN!!JUa#XMmZ`5K"+)+r,X
+!'#jcHA0[C'a[Cf&cDh)!!!!!!!!!!&4&@&30"+%!!@d!!!Ua#V3%S``%S`!'!!!
+!!J!!"J5L!!2mZJ5N"+8+r,S!"!TLG'jc$35N!!&+!!!+Y`Um"+B#"+B!!J5Rr,N
+0"+F!!@d!!!Uh#VS%U!`%U!!+!!4%EfjP!!)!!!,mZ3!!"J5P!!2mZ!5Tr,F+r,J
+!"!TRDACe$35T!!&Y!!!+[`V#r,B$r,B!"3EmY`!!!Ibm!!!#"*m!!J5Ur,80"+S
+!!Q`!!J!!!!$mY2bc!Ibd!!!"r,-!!!,mY3!!$J!#!!!2%!!$!",mXJ5V"+`%V35
+Z"+m%X!5a",)%X`5d",8%YJ5hr,(mX2b[r+i"r,)!!"!%U`!3r+hmV2bVr+VmUIb
+Sr+ImT[bPr+6mSrbLr+(mS2bIr*i+r+d!'#jKCACdEf&`F'jeE'`!!)!!!!#3!!!
+U+LSU#rbX!")`!!GdD'9`BA4S!!GdD'93BA4S#rbV!"``!!adD'9[E'4NC@aTEA-
+!$(4SC8pXC%4PE'PYF`[mUJ!J-!!1G'KPF(*[DQ9MG("KG'J!$R4SC9"bEfTPBh4
+3BA4S#rbT!"B`!!PdD'9YCA"KG'J!#A4SC8eP8'&dD![mU!!Q-!!4D@jME(9NC@C
+[E'4PFR"KG'J!%@PZBfaeC'9'EfaNCA*3BA4S#rbR!$3`!"K[F'9ZFh0XD@jME(9
+NC@C[E'4PFR"KG'J!''p`C@j68da*EQ0XG@4P4QpXC'9b8'&dD![mTJ!N-!!3Bh*
+jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD![mT3!H-!!0Fh0XCQpXC'9
+bF'&dD!!0Fh0X4QpXC'9b8'&dD![mT!!Q-!!4Eh"PER0cE'C[E'4PFR"KG'J!%@p
+`C@jcFfa'EfaNCA*3BA4S#rbM!#i`!"9dD'9ZCAGQEfaNCA*bC@CPFQ9ZBf8!&A4
+SC8jPGdC[E'4PFP*PCQ9bC@jMC3[mSJ!8-!!)G'9YF("KG'J!#(4PEA"3BA4S!Ib
+K!!!"r+!!!!(mR`!!!IbH!!!1"+`!"a$mR35ir*cmQ`5j",VmQJVmR3!B,Q&PGR4
+[BA"`ER9XE!!!J!!!!*!!!#SU+LS0",J!!@X!!!!!#XJ%Z`)%Z`!#!!8%[!)%[!!
+#"*lmQ3,mQ3!!!IbF!!!#r*X!!"!%Z3!!%!5k!)B!(rbBr*ImP[b9r*6mNrb5!#c
+mNIb3!2b2r)lmMIb-!%rmL`"D!&[mLJ"Nr)N!EIb)r)ImKJ#2r)AmK2b$r),mJIb
+!r(rmI[apr(cmH`#Tr(VmHIair(F![Iaf!-ImG3$8!1)!l!$j!3-"%!%D!5F"-3%
+q!8J"93&I!@`"GJ'$!Bd"QJ'N!E%"Z`()!G)"h`(T!IB#!!)0!KF#*!)Z!MX#43*
+5!P`#D3*c!S!#LJ+A!U%#VJ+m!XB#d`,G!ZS#p!-"!`X$'!-L!bm$130'!e!$A30
+R!h3$IJ1,!jN$S`1`!lS$a`24!pi$l!2f"!-%%`3K"#m%234,"&X%D`4j")X%Q35
+Mr(3%U2acr(,mF3VmQ!!%#Q0[BQS+r*F!'#jPBA*cCQCNFQ&XDA-!!!!!!!!J!'&
+QC()+r*B!"!TMG(Kd#rb9!")`!!GdD'9`BA4S!!GdD'93BA4S#[b8!!3+BA0MFJV
+mN`!%#R4iC'`,r*)!($!!$(4SC@pXC'4PE'PYF`!-G'KP6faN4'9XD@ec#[b4!!3
++BfPdE32mN!$rr3[mM`!J-!!1G'KPF(*[DQ9MG("KG'J!$R4SC9"bEfTPBh43BA4
+S!rb1rri+r)d!"!T849K8#rb-!"B`!!PdD'9YCA"KG'J!#A4SC8eP8'&dD![mL`!
+Q-!!4D@jME(9NC@C[E'4PFR"KG'J!%@PZBfaeC'9'EfaNCA*3BA4S#rb+!$3`!"K
+[F'9ZFh0XD@jME(9NC@C[E'4PFR"KG'J!''p`C@j68da*EQ0XG@4P4QpXC'9b8'&
+dD![mL3!N-!!3Bh*jF(4[CQpXC'9bF'&dD!!3Bh*jF(4[4QpXC'9b8'&dD![mL!!
+H-!!0Fh0XCQpXC'9bF'&dD!!0Fh0X4QpXC'9b8'&dD![mK`!Q-!!4Eh"PER0cE'C
+[E'4PFR"KG'J!%@p`C@jcFfa'EfaNCA*3BA4S#[b'!!3+BfC[E!VmK3!B,QeTFf0
+cE'0d+LSU+J!!!!!!!*!!!#SU+LS+r)3!"!TcC@aP#[b$!"JZBfpbC@4PE'mU+LS
+U!!!!!!!!N!!!+LSU+J(mJJ!!![b"!!!+r)!!"!TVEf0X#[ar!!3+D@jcD!2mIJ!
+%#[ap!"JZBfpbC@0bC@`U+LSU!!!!!!!!N!!!ER9XE!VmI!!%#R*cE(3,r(X!,M!
+!&A4SC@jPGfC[E'4PFR*PCQ9bC@jMC3!9G'KP6Q9h4QpXC'9b8Q9QCA*PEQ0P#[a
+k!!3+F'jKE3VmH3!%#Q&XD@%+r(J!"!TdEb!J#[ah!!3+CQPXC32mGJ!'#rae!"3
+`!!KdC@e`F'&dD!!)G'9YF&"KG'J+r(3!"!TLG'jc#[ac!!3+CfPfG32mFJ!&#[a
+a!"JZFhPcEf4XEfGKFfYb!!!!!!!!!!"849K8%IbD#XRJ%JUYi1%TDJ`!!LrM*N9
+4e%r&jLa&edrSaHBX4Nr%@qPF@eTVA&VU-NAE6m4Ek9aE@QYF@Z`bl5C&hNr,lbA
+Y*N9J!""2bf%!%59K!")Pl5C&B!!66mYK!"3Pl5C&B!!96mYK!"BPl5C&B!!A6m[
+Y*N9J!"K2amAQ,%C2&!!L+Q%!'9m!%#pK!"PK!"S[DJ`!'dmUB3!F,'S-!"eA!!K
+B!"i!(fK2+Q%!)'%!'@%!)5TK!"PI!"![B3!L$!!M6em!*%9J!#92A`!PDJ`!'dp
+K!#BUB3!F,'%!*ba'6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"R1,f%!+Q%!+bp
+K!#`-!#02A`!9B3!Y*89J!#j2+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!,Lp
+K!#TK!#m[B3!X$!!M6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"PI!#i[B3!UB3!
+`,f%!,!`!)dpI!"9K!$%P4@!!,NmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!
+Z,f%!+Q%!-LpK!#`-!#02A`!9B3!c*89J!#j2+Q%!)'%!+'%!)5TK!"PI!"-[B3!
+T+Q%!'9m!,LpK!#TK!$3[B3!X$!!M6em!&@%!059&B!!Z6bTK!#"K!#KK!#%UB3!
+CA`!6,f%!+5TK!"PI!#i[B3!UB3!f,f%!,!`!)dpI!"9K!$FP4@!!,NmUB3!JB3!
+SB3!K+Q%!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%!1#pK!#`-!#02A`!9B3!j*89J!#j
+2+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!,LpK!#TK!$S[B3!X$!!M6em!&@%
+!1b9&B!!Z6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"PI!#i[B3!UB3!m,f%!,!`
+!)dpI!"9K!$dP4@!!,NmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%
+!2LpK!#`-!#02A`!9B3!r*89J!#j2+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m
+!,LpK!#TK!%![B3!X$!!M6em!&@%!359&B!!Z6bTK!#"K!#KK!#%UB3!CA`!6,f%
+!+5TK!"PI!#i[B3!UB3"#,f%!,!`!)dpI!"9K!%-P4@!!,NmUB3!JB3!SB3!K+Q%
+!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%!4#pK!#`-!#02A`!9B3"&*89J!#j2+Q%!)'%
+!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!,LpK!#TK!%B[B3!X$!!M6em!&@%!4b9&B!!
+Z6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"PI!#i[B3!UB3"),f%!,!`!)dpI!"9
+K!%NP4@!!,NmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%!5LpK!#`
+-!#02A`!9B3",*89J!#j2+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!,LpK!#T
+K!%`[B3!X$!!M6em!&@%!659&B!!Z6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"P
+I!#i[B3!UB3"1,f%!,!`!)dpI!"9K!%mP4@!!,NmUB3!JB3!SB3!K+Q%!'9m!%bp
+K!#NUB3!CA`!Z,f%!+Q%!8#pK!#`-!#02A`!9B3"4*89J!#j2+Q%!)'%!+'%!)5T
+K!"PI!"-[B3!T+Q%!'9m!,LpK!#TK!&)[B3!X$!!M6em!&@%!8b9&B!!Z6bTK!#"
+K!#KK!#%UB3!CA`!6,f%!+5TK!"PI!#i[B3!UB3"8,f%!,!`!)dpI!"9K!&8P4@!
+!,NmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%!9LpK!#`-!#02A`!
+9B3"A*89J!#j2+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!,LpK!#TK!&J[B3!
+X$!!M6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"PI!#i[B3!UB3"C,f%!,!`!)dp
+I!"9K!&SP4@!!,NmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%!@bp
+K!#`-!#02A`!9B3"F*89J!#j2+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!,Lp
+K!#TK!&d[B3!X$!!M6em!&@%!AL9&B!!Z6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5T
+K!"PI!#i[B3!UB3"I,f%!,!`!)dpI!"9K!'!P4@!!,NmUB3!JB3!SB3!K+Q%!'9m
+!%bpK!#NUB3!CA`!Z,f%!+Q%!B5pK!#`-!#02A`!9B3"L*89J!#j2+Q%!)'%!+'%
+!)5TK!"PI!"-[B3!T+Q%!'9m!,LpK!#TK!'-[B3!X$!!M6em!&@%!C#9&B!!Z6bT
+K!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"PI!#i[B3!UB3"P,f%!,!`!)dpI!"9K!'B
+P4@!!,NmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%!CbpK!#`-!#0
+2A`!9B3"S*89J!#j2+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!,LpK!#TK!'N
+[B3!X$!!M6em!&@%!DL9&B!!Z6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"PI!#i
+[B3!UB3"V,f%!,!`!)dmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%
+!E#pK!#`-!#02A`!9B3"Y*89J!#j2+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m
+!,LpK!#TK!'i[B3!X$!!M6em!&@%!Eb9&B!!Z6bTK!#"K!#KK!#%UB3!CA`!6,f%
+!+5TK!"PI!#i[B3!UB3"`,f%!,!`!)dpI!"9K!(%P4@!!,NmUB3!JB3!SB3!K+Q%
+!'9m!%bpK!#NUB3!CA`!Z,f%!+Q%!FLpK!#`-!#02+Q%!)'%!+'%!)5TK!"PI!"-
+[B3!T+Q%!'9m!,LpK!#TK!(-[B3!X$!!M6em!&@%!G#9&B!!Z6bTK!#"K!#KK!#%
+UB3!CA`!6,f%!+5TK!"PI!#i[B3!UB3"e,f%!,!`!)dmUB3!JB3!SB3!K+Q%!'9m
+!%bpK!#NUB3!CA`!A,f%!+Q%!GLpK!#`-!#02+Q%!)'%!+'%!)5TK!"PI!"-[B3!
+T+Q%!'9m!&bpK!#TK!(F[B3!X$!!M6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"P
+I!"F[B3!UB3"i,f%!,!`!)dmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!A,f%
+!+Q%!H5pK!#`-!#02+Q%!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!&bpK!#TK!(S
+[B3!X$!!M6bTK!#"K!#KK!#%UB3!CA`!6,f%!+5TK!"PI!"8[B3!UB3"l,f%!,!`
+!)dmUB3!JB3!SB3!K+Q%!'9m!%bpK!#NUB3!CA`!9,f%!+Q%!I#pK!#`-!#02+Q%
+!)'%!+'%!)5TK!"PI!"-[B3!T+Q%!'9m!&5pK!#TK!(d[B3!X$!!M6bTK!#"K!#K
+K!#%UB3!CA`!6,f%!+5TK!"PI!"J[B3!UB3"q,f%!,!`!)dmUB3!JB3!SB3!K+Q%
+!'9m!%bpK!#NUB3!CA`!B,f%!+Q%!IbpK!#`-!#028&92B3#!B3#"B3##DhCK!)0
+K!)4K!#)-!)82$!5Y!&%!5deKBfPZG'pcD#")4$T%CA0VG'p`)%C[E'4PFMT*EQ0
+[E@PZCcT[F'9ZFh0X,90139!Y-6Nj16%b-6%k6@&M6e-kE@YXD@jVFbjKF`!#!!!
+1"+i!!J6mF!5p!ra`!!%1",d!!3!%[J`%[J!'!!!!!J!!$J5[!!)%r'm%[`2mE`!
+%$J5r!!3!"-!%`36#"---"-!!%J!-6@&MD@jdEh0S)%K%!!)!!!`%`3!8!!j%CA0
+VG'p`)%C[E'4PFJ!#!!!-"-)!$J!)5@jMEfeTEQF!!J!!$!6$!"X!&@p`C@jcFf`
+Y8dj"8#da16Nj-6)a-3!#!!!-",!!4J"!6@&MD@jdEh0S)%K%1N4PFfYdEh!J4Qp
+XC'9b1NPZBfpYD@jR1Qp`C@jcFf`Y8dj"8#da16Nj-6)a-6T0B@028`!#!!!-",%
+!5!"#6@&MD@jdEh0S)%K%1N4PFfYdEh!J4QpXC'9b1NPZBfpYD@jR1Qp`C@jcFf`
+Y8dj"8#da16Nj-6)a-6TTEQ0XG@4P!!)!!!`%XJ"3!%T0B@0TER4[FfJJ5%3k4'9
+cDh4[F#"'EfaNCA)k5@jMEfeTEQFkEh"PER0cE#e66N&3,6%j16Na-M%a1QPZBfa
+eC'8kEh"PER0cE!!#!!!-",-!4`""6@&MD@jdEh0S)%K%1N4PFfYdEh!J4QpXC'9
+b1NPZBfpYD@jR1Qp`C@jcFf`Y8dj"8#da16Nj-6)a-6TMFRP`G'm!!J!!$!5d!%3
+!2NeKBfPZG'pcD#")4$T%CA0VG'p`)%C[E'4PFMT*EQ0[E@PZCcT[F'9ZFh0X,90
+139!Y-6Nj16%b-6%kFh0X!!)!!!`%Y3"!!$T0B@0TER4[FfJJ5%3k4'9cDh4[F#"
+'EfaNCA)k5@jMEfeTEQFkEh"PER0cE#e66N&3,6%j16Na-M%a!!)!!!i%YJ!"&!6
+%$J6%!!-B"-AmEJ6'$J6&!!-B"-ImE36)$J6(!!-B"-RmE!6+$J6*!!-B!"rmD`6
+,#[aV!!3+BfC[E!`%b`!1!!K*EQ0[E@PZC`!#!!!+r'`!"!TMCQpX$!6+!"X!&@p
+`C@jcFf`Y8dj"8#da16Nj-6)a-3!#!!!+r'd!"!TMCQpX$!6)!!d!"fPZBfaeC'8
+!!J!!#[aZ!!3+BfC[E!`%aJ!9!!peER4TG'aPC#"QEfaNCA)!!J!!$!5h!%i!5%e
+KBfPZG'pcD#")4$T%CA0VG'p`)%C[E'4PFMT*EQ0[E@PZCcT[F'9ZFh0X,90139!
+Y-6Nj16%b-6%kBh*jF(4[1RJe-$Pf-`!#!!!"r,%!!!(mX!!!!Ib[!!!"r+i!!'&
+cBh)!!3!-qYlHV3!!!3!!!*G#!!#@3J!!!AB!!$-8-0J!!!!F!AB!$h0MFhS!!!#
+#6Np853!!!)jcBh"d!!!!QP4&@&3!!3#QFh4jE!!!!,j$6d4&!!%!bN*14%`!!!$
+LBA"XG!!!!1j'8N9'!!!!qNP$6L-!!!%'D@0X0!!!!4*TBh-M!!!"(QPMFc3!!!%
+UD'CNFJ!!!6C659T&!!!"3PG3Eh-!!!&1!!$rr`!!!!!!!!!!!)$rre!!!"i!!!!
+!!)$rr`!!"cJ#DH#m"'Mrr`!!!*S!!!!!%iRrr`!!"Pi!!!!!"'Mrr`!!!53!!!!
+!!!$rrb!!!9)!!!!!!!(rra3!!@i#DG`%!)$rr`!!!Pi#DH"X!!$rr`!!!Ri!!!!
+!!)$rr`!!!S-#DH"d!*Err`!!!Si!!!!!!*Err`!!!j)!!!!!!*Err`!!"CB#DH%
+i!*Err`!!"GS#DH%dkF$rr`!!"[`!!!!!rrrrr`!!"a)!!!!!!)$rr`!!"b!!!!!
+!*4S:
diff --git a/src/lib/libssl/src/MacOS/opensslconf.h b/src/lib/libssl/src/MacOS/opensslconf.h
new file mode 100644
index 0000000000..ad557cc06a
--- /dev/null
+++ b/src/lib/libssl/src/MacOS/opensslconf.h
@@ -0,0 +1,116 @@
+/* MacOS/opensslconf.h */
+
+#if !(defined(VMS) || defined(__VMS)) /* VMS uses logical names instead */
+#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
+#define OPENSSLDIR "/usr/local/ssl"
+#endif
+#endif
+
+#if defined(HEADER_IDEA_H) && !defined(IDEA_INT)
+#define IDEA_INT unsigned int
+#endif
+
+#if defined(HEADER_MD2_H) && !defined(MD2_INT)
+#define MD2_INT unsigned int
+#endif
+
+#if defined(HEADER_RC2_H) && !defined(RC2_INT)
+/* I need to put in a mod for the alpha - eay */
+#define RC2_INT unsigned int
+#endif
+
+#if defined(HEADER_RC4_H)
+#if !defined(RC4_INT)
+/* using int types make the structure larger but make the code faster
+ * on most boxes I have tested - up to %20 faster. */
+/*
+ * I don't know what does "most" mean, but declaring "int" is a must on:
+ * - Intel P6 because partial register stalls are very expensive;
+ * - elder Alpha because it lacks byte load/store instructions;
+ */
+#define RC4_INT unsigned char
+#endif
+#if !defined(RC4_CHUNK)
+/*
+ * This enables code handling data aligned at natural CPU word
+ * boundary. See crypto/rc4/rc4_enc.c for further details.
+ */
+#define RC4_CHUNK unsigned long
+#endif
+#endif
+
+#if defined(HEADER_DES_H) && !defined(DES_LONG)
+/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
+ * %20 speed up (longs are 8 bytes, int's are 4). */
+#ifndef DES_LONG
+#define DES_LONG unsigned long
+#endif
+#endif
+
+#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H)
+#define CONFIG_HEADER_BN_H
+#if __option(longlong)
+#  define BN_LLONG
+#else
+#  undef BN_LLONG
+#endif
+
+/* Should we define BN_DIV2W here? */
+
+/* Only one for the following should be defined */
+/* The prime number generation stuff may not work when
+ * EIGHT_BIT but I don't care since I've only used this mode
+ * for debuging the bignum libraries */
+#undef SIXTY_FOUR_BIT_LONG
+#undef SIXTY_FOUR_BIT
+#define THIRTY_TWO_BIT
+#undef SIXTEEN_BIT
+#undef EIGHT_BIT
+#endif
+
+#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
+#define CONFIG_HEADER_RC4_LOCL_H
+/* if this is defined data[i] is used instead of *data, this is a %20
+ * speedup on x86 */
+#undef RC4_INDEX
+#endif
+
+#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
+#define CONFIG_HEADER_BF_LOCL_H
+#define BF_PTR
+#endif /* HEADER_BF_LOCL_H */
+
+#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)
+#define CONFIG_HEADER_DES_LOCL_H
+/* the following is tweaked from a config script, that is why it is a
+ * protected undef/define */
+#ifndef DES_PTR
+#define DES_PTR
+#endif
+
+/* This helps C compiler generate the correct code for multiple functional
+ * units.  It reduces register dependancies at the expense of 2 more
+ * registers */
+#ifndef DES_RISC1
+#define DES_RISC1
+#endif
+
+#ifndef DES_RISC2
+#undef DES_RISC2
+#endif
+
+#if defined(DES_RISC1) && defined(DES_RISC2)
+YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
+#endif
+
+/* Unroll the inner loop, this sometimes helps, sometimes hinders.
+ * Very mucy CPU dependant */
+#ifndef DES_UNROLL
+#define DES_UNROLL
+#endif
+
+#endif /* HEADER_DES_LOCL_H */
+
+#ifndef __POWERPC__
+#define MD32_XARRAY
+#endif
diff --git a/src/lib/libssl/src/Makefile.org b/src/lib/libssl/src/Makefile.org
index 1dd3d81b6d..be6894426f 100644
--- a/src/lib/libssl/src/Makefile.org
+++ b/src/lib/libssl/src/Makefile.org
@@ -56,6 +56,8 @@ EX_LIBS=
 AR=ar r
 RANLIB= ranlib
 PERL= perl
+TAR= tar
+TARFLAGS= --norecurse
 
 # Set BN_ASM to bn_asm.o if you want to use the C version
 BN_ASM= bn_asm.o
@@ -156,6 +158,7 @@ SDIRS=  \
 MAKEFILE= Makefile.ssl
 MAKE=     make -f Makefile.ssl
 
+MANDIR=$(OPENSSLDIR)/man
 MAN1=1
 MAN3=3
 SHELL=/bin/sh
@@ -180,6 +183,7 @@ all: Makefile.ssl
         (cd $$i && echo "making all in $$i..." && \
         $(MAKE) CC='${CC}' PLATFORM='${PLATFORM}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' SDIRS='${SDIRS}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' all ) || exit 1; \
         done
+        -@# cd crypto; $(MAKE) CC='${CC}' PLATFORM='${PLATFORM}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' SDIRS='${SDIRS}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' testapps
         -@# cd perl; $(PERL) Makefile.PL; make
 
 sub_all:
@@ -215,7 +219,7 @@ libclean:
         rm -f *.a */lib */*/lib
 
 clean:
-        rm -f shlib/*.o *.o core a.out fluff *.map
+        rm -f shlib/*.o *.o core a.out fluff *.map rehash.time testlog make.log cctest cctest.c
         @for i in $(DIRS) ;\
         do \
         (cd $$i && echo "making clean in $$i..." && \
@@ -242,7 +246,7 @@ files:
         done;
 
 links:
-        @$(SHELL) $(TOP)/util/point.sh Makefile.ssl Makefile
+        @$(TOP)/util/point.sh Makefile.ssl Makefile
         @$(PERL) $(TOP)/util/mkdir-p.pl include/openssl
         @$(PERL) $(TOP)/util/mklink.pl include/openssl $(EXHEADER)
         @for i in $(DIRS); do \
@@ -258,8 +262,10 @@ dclean:
         $(MAKE) SDIRS='${SDIRS}' PERL='${PERL}' dclean ) || exit 1; \
         done;
 
-rehash:
+rehash: rehash.time
+rehash.time: certs
         @(OPENSSL="`pwd`/apps/openssl"; export OPENSSL; sh tools/c_rehash certs)
+        touch rehash.time
 
 test:   tests
 
@@ -268,6 +274,9 @@ tests: rehash
         $(MAKE) CC='${CC}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' SDIRS='${SDIRS}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' AR='${AR}' tests );
         @apps/openssl version -a
 
+report:
+        @$(PERL) util/selftest.pl
+
 depend:
         @for i in $(DIRS) ;\
         do \
@@ -298,14 +307,17 @@ util/libeay.num::
 util/ssleay.num::
         perl util/mkdef.pl ssl update
 
+crypto/objects/obj_dat.h: crypto/objects/objects.h crypto/objects/obj_dat.pl
+        perl crypto/objects/obj_dat.pl crypto/objects/objects.h crypto/objects/obj_dat.h
+
 TABLE: Configure
         (echo 'Output of `Configure TABLE'"':"; \
         perl Configure TABLE) > TABLE
 
-update: depend errors util/libeay.num util/ssleay.num TABLE
+update: depend errors util/libeay.num util/ssleay.num crypto/objects/obj_dat.h TABLE
 
 tar:
-        @tar --norecurse -cvf - \
+        @$(TAR) $(TARFLAGS) -cvf - \
                 `find * \! -path CVS/\* \! -path \*/CVS/\* \! -name CVS \! -name .cvsignore \! -name STATUS \! -name TABLE | sort` |\
         tardy --user_number=0  --user_name=openssl \
               --group_number=0 --group_name=openssl \
@@ -322,7 +334,7 @@ dist:
 dist_pem_h:
         (cd crypto/pem; $(MAKE) CC='${CC}' SDIRS='${SDIRS}' CFLAG='${CFLAG}' pem.h; $(MAKE) clean)
 
-install: all
+install: all install_docs
         @$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
                 $(INSTALL_PREFIX)$(INSTALLTOP)/lib \
                 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl \
@@ -338,7 +350,7 @@ install: all
         @for i in $(DIRS) ;\
         do \
         (cd $$i; echo "installing $$i..."; \
-        $(MAKE) CC='${CC}' CFLAG='${CFLAG}' INSTALL_PREFIX='${INSTALL_PREFIX}' INSTALLTOP='${INSTALLTOP}' OPENSSLDIR='${OPENSSLDIR}' EX_LIBS='${EX_LIBS}' SDIRS='${SDIRS}' install ); \
+        $(MAKE) CC='${CC}' CFLAG='${CFLAG}' INSTALL_PREFIX='${INSTALL_PREFIX}' INSTALLTOP='${INSTALLTOP}' OPENSSLDIR='${OPENSSLDIR}' EX_LIBS='${EX_LIBS}' SDIRS='${SDIRS}' RANLIB='${RANLIB}' install ); \
         done
         @for i in $(LIBS) ;\
         do \
@@ -348,4 +360,29 @@ install: all
                 chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i ); \
         done
 
+install_docs:
+        @$(PERL) $(TOP)/util/mkdir-p.pl \
+                $(INSTALL_PREFIX)$(MANDIR)/man1 \
+                $(INSTALL_PREFIX)$(MANDIR)/man3 \
+                $(INSTALL_PREFIX)$(MANDIR)/man5 \
+                $(INSTALL_PREFIX)$(MANDIR)/man7
+        @echo installing man 1 and man 5
+        @for i in doc/apps/*.pod; do \
+                (cd `dirname $$i`; \
+                fn=`basename $$i .pod`; \
+                sec=`[ "$$fn" = "config" ] && echo 5 || echo 1`; \
+                $(PERL) ../../util/pod2man.pl --section=$$sec --center=OpenSSL \
+                         --release=$(VERSION) `basename $$i` \
+                        >  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/`basename $$i .pod`.$$sec); \
+        done
+        @echo installing man 3 and man 7
+        @for i in doc/crypto/*.pod doc/ssl/*.pod; do \
+                (cd `dirname $$i`; \
+                fn=`basename $$i .pod`; \
+                sec=`[ "$$fn" = "des_modes" ] && echo 7 || echo 3`; \
+                $(PERL) ../../util/pod2man.pl --section=$$sec --center=OpenSSL \
+                        --release=$(VERSION) `basename $$i` \
+                        >  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/`basename $$i .pod`.$$sec); \
+        done
+
 # DO NOT DELETE THIS LINE -- make depend depends on it.
diff --git a/src/lib/libssl/src/NEWS b/src/lib/libssl/src/NEWS
index c152b7155d..a2084af8e6 100644
--- a/src/lib/libssl/src/NEWS
+++ b/src/lib/libssl/src/NEWS
@@ -5,6 +5,42 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
+  Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5:
+
+      o S/MIME support in new 'smime' command
+      o Documentation for the OpenSSL command line application
+      o Automation of 'req' application
+      o Fixes to make s_client, s_server work under Windows
+      o Support for multiple fieldnames in SPKACs
+      o New SPKAC command line utilty and associated library functions
+      o Options to allow passwords to be obtained from various sources
+      o New public key PEM format and options to handle it
+      o Many other fixes and enhancements to command line utilities
+      o Usable certificate chain verification
+      o Certificate purpose checking
+      o Certificate trust settings
+      o Support of authority information access extension
+      o Extensions in certificate requests
+      o Simplified X509 name and attribute routines
+      o Initial (incomplete) support for international character sets
+      o New DH_METHOD, DSA_METHOD and enhanced RSA_METHOD
+      o Read only memory BIOs and simplified creation function
+      o TLS/SSL protocol bugfixes: Accept TLS 'client hello' in SSL 3.0
+        record; allow fragmentation and interleaving of handshake and other
+        data
+      o TLS/SSL code now "tolerates" MS SGC
+      o Work around for Netscape client certificate hang bug
+      o RSA_NULL option that removes RSA patent code but keeps other
+        RSA functionality
+      o Memory leak detection now allows applications to add extra information
+        via a per-thread stack
+      o PRNG robustness improved
+      o EGD support
+      o BIGNUM library bug fixes
+      o Faster DSA parameter generation
+      o Enhanced support for Alpha Linux
+      o Experimental MacOS support
+
   Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4:
 
       o Transparent support for PKCS#8 format private keys: these are used
diff --git a/src/lib/libssl/src/README b/src/lib/libssl/src/README
index d7682e8a2f..7ef77c83c6 100644
--- a/src/lib/libssl/src/README
+++ b/src/lib/libssl/src/README
@@ -1,7 +1,7 @@
 
- OpenSSL 0.9.4  09 Aug 1999
+ OpenSSL 0.9.5  28 Feb 2000
 
- Copyright (c) 1998-1999 The OpenSSL Project
+ Copyright (c) 1998-2000 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
  All rights reserved.
 
@@ -80,40 +80,14 @@
         A Configuration loader that uses a format similar to MS .ini files.
 
  openssl: 
-     A command line tool which provides the following functions:
-
-     enc     - a general encryption program that can encrypt/decrypt using
-               one of 17 different cipher/mode combinations.  The
-               input/output can also be converted to/from base64
-               ascii encoding.
-     dgst    - a generate message digesting program that will generate
-               message digests for any of md2, md5, sha (sha-0 or sha-1)
-               or mdc2.
-     asn1parse - parse and display the structure of an asn1 encoded
-               binary file.
-     rsa     - Manipulate RSA private keys.
-     dsa     - Manipulate DSA private keys.
-     dh      - Manipulate Diffie-Hellman parameter files.
-     dsaparam- Manipulate and generate DSA parameter files.
-     crl     - Manipulate certificate revocation lists.
-     crt2pkcs7- Generate a pkcs7 object containing a crl and a certificate.
-     x509    - Manipulate x509 certificates, self-sign certificates.
-     req     - Manipulate PKCS#10 certificate requests and also
-               generate certificate requests.
-     genrsa  - Generates an arbitrary sized RSA private key.
-     gendsa  - Generates DSA parameters.
-     gendh   - Generates a set of Diffie-Hellman parameters, the prime
-               will be a strong prime.
-     ca      - Create certificates from PKCS#10 certificate requests.
-               This program also maintains a database of certificates
-               issued.
-     verify  - Check x509 certificate signatures.
-     speed   - Benchmark OpenSSL's ciphers.
-     s_server- A test SSL server.
-     s_client- A test SSL client.
-     s_time  - Benchmark SSL performance of SSL server programs.
-     errstr  - Convert from OpenSSL hex error codes to a readable form.
-     nseq    - Netscape certificate sequence utility
+     A command line tool that can be used for:
+        Creation of RSA, DH and DSA key parameters
+        Creation of X.509 certificates, CSRs and CRLs 
+        Calculation of Message Digests
+        Encryption and Decryption with Ciphers
+        SSL/TLS Client and Server Tests
+        Handling of S/MIME signed or encrypted mail
+
         
  PATENTS
  -------
@@ -157,43 +131,40 @@
  If you have any problems with OpenSSL then please take the following steps
  first:
 
+    - Download the current snapshot from ftp://ftp.openssl.org/snapshot/
+      to see if the problem has already been addressed
     - Remove ASM versions of libraries
     - Remove compiler optimisation flags 
-    - Add compiler debug flags (if using gcc then remove -fomit-frame-pointer
-      before you try to debug things)
 
  If you wish to report a bug then please include the following information in
  any bug report:
 
-    OpenSSL Details
-    - Version, most of these details can be got from the
-      'openssl version -a' command.
-    Operating System Details
-    - On Unix systems: Output of './config -t'
-    - OS Name, Version
-    - Hardware platform
-    Compiler Details
-    - Name
-    - Version
-    Application Details 
-    - Name 
-    - Version 
-    Problem Description
-    - include steps that will reproduce the problem (if known)
-    Stack Traceback (if the application dumps core)
+    - On Unix systems:
+        Self-test report generated by 'make report'
+    - On other systems:
+        OpenSSL version: output of 'openssl version -a'
+        OS Name, Version, Hardware platform
+        Compiler Details (name, version)
+    - Application Details (name, version)
+    - Problem Description (steps that will reproduce the problem, if known)
+    - Stack Traceback (if the application dumps core)
 
  Report the bug to the OpenSSL project at:
 
     openssl-bugs@openssl.org
 
+ Note that mail to openssl-bugs@openssl.org is forwarded to a public
+ mailing list. Confidential mail may be sent to openssl-security@openssl.org
+ (PGP key available from the key servers).
+
  HOW TO CONTRIBUTE TO OpenSSL
  ----------------------------
 
  Development is coordinated on the openssl-dev mailing list (see
  http://www.openssl.org for information on subscribing). If you
- would like to submit a patch, send it to openssl-dev@openssl.org.
- Please be sure to include a textual explanation of what your patch
- does.
+ would like to submit a patch, send it to openssl-dev@openssl.org with
+ the string "[PATCH]" in the subject. Please be sure to include a
+ textual explanation of what your patch does.
 
  The preferred format for changes is "diff -u" output. You might
  generate it like this:
diff --git a/src/lib/libssl/src/VMS/install.com b/src/lib/libssl/src/VMS/install.com
index d941392c23..1664d769e2 100644
--- a/src/lib/libssl/src/VMS/install.com
+++ b/src/lib/libssl/src/VMS/install.com
@@ -37,6 +37,7 @@ $
 $       EXHEADER := vms_idhacks.h
 $
 $       COPY 'EXHEADER' WRK_SSLINCLUDE: /LOG
+$       SET FILE/PROT=WORLD:RE WRK_SSLINCLUDE:'EXHEADER'
 $
 $       OPEN/WRITE SF WRK_SSLROOT:[VMS]OPENSSL_STARTUP.COM
 $       WRITE SYS$OUTPUT "%OPEN-I-CREATED,  ",F$SEARCH("WRK_SSLROOT:[VMS]OPENSSL_STARTUP.COM")," created."
@@ -65,7 +66,9 @@ $	WRITE SF "	   @SSLROOT:[VMS]OPENSSL_SYSTARTUP.COM"
 $       WRITE SF "$"
 $       WRITE SF "$     EXIT"
 $       CLOSE SF
+$       SET FILE/PROT=WORLD:RE WRK_SSLROOT:[VMS]OPENSSL_STARTUP.COM
 $
 $       COPY OPENSSL_UTILS.COM WRK_SSLROOT:[VMS]/LOG
+$       SET FILE/PROT=WORLD:RE WRK_SSLROOT:[VMS]OPENSSL_UTILS.COM
 $
 $       EXIT
diff --git a/src/lib/libssl/src/VMS/test-includes.com b/src/lib/libssl/src/VMS/test-includes.com
new file mode 100644
index 0000000000..c1d7ccd0ee
--- /dev/null
+++ b/src/lib/libssl/src/VMS/test-includes.com
@@ -0,0 +1,28 @@
+$! Quick script to check how well including individual header files works
+$! on VMS, even when the VMS macro isn't defined.
+$
+$       sav_def = f$env("DEFAULT")
+$       here = f$parse("A.;0",f$ENV("PROCEDURE")) - "A.;0"
+$       set default 'here'
+$       set default [-.include.openssl]
+$       define openssl 'f$env("DEFAULT")'
+$       set default [--]
+$
+$ loop:
+$       f = f$search("openssl:*.h")
+$       if f .eqs. "" then goto loop_end
+$       write sys$output "Checking ",f
+$       open/write foo foo.c
+$       write foo "#undef VMS"
+$       write foo "#include <stdio.h>"
+$       write foo "#include <openssl/",f$parse(f,,,"NAME"),".h>"
+$       write foo "main()"
+$       write foo "{printf(""foo\n"");}"
+$       close foo
+$       cc/STANDARD=ANSI89/NOLIST/PREFIX=ALL foo.c
+$       delete foo.c;
+$       goto loop
+$ loop_end:
+$       set default 'save_def'
+$       exit
+
diff --git a/src/lib/libssl/src/VMS/vms_idhacks.h b/src/lib/libssl/src/VMS/vms_idhacks.h
index 8cf9e9c61f..c2010c91e4 100644
--- a/src/lib/libssl/src/VMS/vms_idhacks.h
+++ b/src/lib/libssl/src/VMS/vms_idhacks.h
@@ -57,55 +57,124 @@
 
 #ifdef VMS
 
+/* Hack a long name in crypto/asn1/a_mbstr.c */
+#define ASN1_STRING_set_default_mask_asc ASN1_STRING_set_def_mask_asc
 /* Hack the names created with DECLARE_STACK_OF(PKCS7_SIGNER_INFO) */
-#define sk_PKCS7_SIGNER_INFO_new        sk_PKCS7_SIGINF_new
-#define sk_PKCS7_SIGNER_INFO_new_null   sk_PKCS7_SIGINF_new_null
-#define sk_PKCS7_SIGNER_INFO_free       sk_PKCS7_SIGINF_free
-#define sk_PKCS7_SIGNER_INFO_num        sk_PKCS7_SIGINF_num
-#define sk_PKCS7_SIGNER_INFO_value      sk_PKCS7_SIGINF_value
-#define sk_PKCS7_SIGNER_INFO_set        sk_PKCS7_SIGINF_set
-#define sk_PKCS7_SIGNER_INFO_zero       sk_PKCS7_SIGINF_zero
-#define sk_PKCS7_SIGNER_INFO_push       sk_PKCS7_SIGINF_push
-#define sk_PKCS7_SIGNER_INFO_unshift    sk_PKCS7_SIGINF_unshift
-#define sk_PKCS7_SIGNER_INFO_find       sk_PKCS7_SIGINF_find
-#define sk_PKCS7_SIGNER_INFO_delete     sk_PKCS7_SIGINF_delete
-#define sk_PKCS7_SIGNER_INFO_delete_ptr sk_PKCS7_SIGINF_delete_ptr
-#define sk_PKCS7_SIGNER_INFO_insert     sk_PKCS7_SIGINF_insert
+#define sk_PKCS7_SIGNER_INFO_new                sk_PKCS7_SIGINF_new
+#define sk_PKCS7_SIGNER_INFO_new_null           sk_PKCS7_SIGINF_new_null
+#define sk_PKCS7_SIGNER_INFO_free               sk_PKCS7_SIGINF_free
+#define sk_PKCS7_SIGNER_INFO_num                sk_PKCS7_SIGINF_num
+#define sk_PKCS7_SIGNER_INFO_value              sk_PKCS7_SIGINF_value
+#define sk_PKCS7_SIGNER_INFO_set                sk_PKCS7_SIGINF_set
+#define sk_PKCS7_SIGNER_INFO_zero               sk_PKCS7_SIGINF_zero
+#define sk_PKCS7_SIGNER_INFO_push               sk_PKCS7_SIGINF_push
+#define sk_PKCS7_SIGNER_INFO_unshift            sk_PKCS7_SIGINF_unshift
+#define sk_PKCS7_SIGNER_INFO_find               sk_PKCS7_SIGINF_find
+#define sk_PKCS7_SIGNER_INFO_delete             sk_PKCS7_SIGINF_delete
+#define sk_PKCS7_SIGNER_INFO_delete_ptr         sk_PKCS7_SIGINF_delete_ptr
+#define sk_PKCS7_SIGNER_INFO_insert             sk_PKCS7_SIGINF_insert
 #define sk_PKCS7_SIGNER_INFO_set_cmp_func       sk_PKCS7_SIGINF_set_cmp_func
-#define sk_PKCS7_SIGNER_INFO_dup        sk_PKCS7_SIGINF_dup
-#define sk_PKCS7_SIGNER_INFO_pop_free   sk_PKCS7_SIGINF_pop_free
-#define sk_PKCS7_SIGNER_INFO_shift      sk_PKCS7_SIGINF_shift
-#define sk_PKCS7_SIGNER_INFO_pop        sk_PKCS7_SIGINF_pop
-#define sk_PKCS7_SIGNER_INFO_sort       sk_PKCS7_SIGINF_sort
+#define sk_PKCS7_SIGNER_INFO_dup                sk_PKCS7_SIGINF_dup
+#define sk_PKCS7_SIGNER_INFO_pop_free           sk_PKCS7_SIGINF_pop_free
+#define sk_PKCS7_SIGNER_INFO_shift              sk_PKCS7_SIGINF_shift
+#define sk_PKCS7_SIGNER_INFO_pop                sk_PKCS7_SIGINF_pop
+#define sk_PKCS7_SIGNER_INFO_sort               sk_PKCS7_SIGINF_sort
 
 /* Hack the names created with DECLARE_STACK_OF(PKCS7_RECIP_INFO) */
-#define sk_PKCS7_RECIP_INFO_new         sk_PKCS7_RECINF_new
-#define sk_PKCS7_RECIP_INFO_new_null    sk_PKCS7_RECINF_new_null
-#define sk_PKCS7_RECIP_INFO_free        sk_PKCS7_RECINF_free
-#define sk_PKCS7_RECIP_INFO_num         sk_PKCS7_RECINF_num
-#define sk_PKCS7_RECIP_INFO_value       sk_PKCS7_RECINF_value
-#define sk_PKCS7_RECIP_INFO_set         sk_PKCS7_RECINF_set
-#define sk_PKCS7_RECIP_INFO_zero        sk_PKCS7_RECINF_zero
-#define sk_PKCS7_RECIP_INFO_push        sk_PKCS7_RECINF_push
-#define sk_PKCS7_RECIP_INFO_unshift     sk_PKCS7_RECINF_unshift
-#define sk_PKCS7_RECIP_INFO_find        sk_PKCS7_RECINF_find
-#define sk_PKCS7_RECIP_INFO_delete      sk_PKCS7_RECINF_delete
-#define sk_PKCS7_RECIP_INFO_delete_ptr  sk_PKCS7_RECINF_delete_ptr
-#define sk_PKCS7_RECIP_INFO_insert      sk_PKCS7_RECINF_insert
+#define sk_PKCS7_RECIP_INFO_new                 sk_PKCS7_RECINF_new
+#define sk_PKCS7_RECIP_INFO_new_null            sk_PKCS7_RECINF_new_null
+#define sk_PKCS7_RECIP_INFO_free                sk_PKCS7_RECINF_free
+#define sk_PKCS7_RECIP_INFO_num                 sk_PKCS7_RECINF_num
+#define sk_PKCS7_RECIP_INFO_value               sk_PKCS7_RECINF_value
+#define sk_PKCS7_RECIP_INFO_set                 sk_PKCS7_RECINF_set
+#define sk_PKCS7_RECIP_INFO_zero                sk_PKCS7_RECINF_zero
+#define sk_PKCS7_RECIP_INFO_push                sk_PKCS7_RECINF_push
+#define sk_PKCS7_RECIP_INFO_unshift             sk_PKCS7_RECINF_unshift
+#define sk_PKCS7_RECIP_INFO_find                sk_PKCS7_RECINF_find
+#define sk_PKCS7_RECIP_INFO_delete              sk_PKCS7_RECINF_delete
+#define sk_PKCS7_RECIP_INFO_delete_ptr          sk_PKCS7_RECINF_delete_ptr
+#define sk_PKCS7_RECIP_INFO_insert              sk_PKCS7_RECINF_insert
 #define sk_PKCS7_RECIP_INFO_set_cmp_func        sk_PKCS7_RECINF_set_cmp_func
-#define sk_PKCS7_RECIP_INFO_dup         sk_PKCS7_RECINF_dup
-#define sk_PKCS7_RECIP_INFO_pop_free    sk_PKCS7_RECINF_pop_free
-#define sk_PKCS7_RECIP_INFO_shift       sk_PKCS7_RECINF_shift
-#define sk_PKCS7_RECIP_INFO_pop         sk_PKCS7_RECINF_pop
-#define sk_PKCS7_RECIP_INFO_sort        sk_PKCS7_RECINF_sort
+#define sk_PKCS7_RECIP_INFO_dup                 sk_PKCS7_RECINF_dup
+#define sk_PKCS7_RECIP_INFO_pop_free            sk_PKCS7_RECINF_pop_free
+#define sk_PKCS7_RECIP_INFO_shift               sk_PKCS7_RECINF_shift
+#define sk_PKCS7_RECIP_INFO_pop                 sk_PKCS7_RECINF_pop
+#define sk_PKCS7_RECIP_INFO_sort                sk_PKCS7_RECINF_sort
+
+/* Hack the names created with DECLARE_STACK_OF(ASN1_STRING_TABLE) */
+#define sk_ASN1_STRING_TABLE_new                sk_ASN1_STRTAB_new
+#define sk_ASN1_STRING_TABLE_new_null           sk_ASN1_STRTAB_new_null
+#define sk_ASN1_STRING_TABLE_free               sk_ASN1_STRTAB_free
+#define sk_ASN1_STRING_TABLE_num                sk_ASN1_STRTAB_num
+#define sk_ASN1_STRING_TABLE_value              sk_ASN1_STRTAB_value
+#define sk_ASN1_STRING_TABLE_set                sk_ASN1_STRTAB_set
+#define sk_ASN1_STRING_TABLE_zero               sk_ASN1_STRTAB_zero
+#define sk_ASN1_STRING_TABLE_push               sk_ASN1_STRTAB_push
+#define sk_ASN1_STRING_TABLE_unshift            sk_ASN1_STRTAB_unshift
+#define sk_ASN1_STRING_TABLE_find               sk_ASN1_STRTAB_find
+#define sk_ASN1_STRING_TABLE_delete             sk_ASN1_STRTAB_delete
+#define sk_ASN1_STRING_TABLE_delete_ptr         sk_ASN1_STRTAB_delete_ptr
+#define sk_ASN1_STRING_TABLE_insert             sk_ASN1_STRTAB_insert
+#define sk_ASN1_STRING_TABLE_set_cmp_func       sk_ASN1_STRTAB_set_cmp_func
+#define sk_ASN1_STRING_TABLE_dup                sk_ASN1_STRTAB_dup
+#define sk_ASN1_STRING_TABLE_pop_free           sk_ASN1_STRTAB_pop_free
+#define sk_ASN1_STRING_TABLE_shift              sk_ASN1_STRTAB_shift
+#define sk_ASN1_STRING_TABLE_pop                sk_ASN1_STRTAB_pop
+#define sk_ASN1_STRING_TABLE_sort               sk_ASN1_STRTAB_sort
+
+/* Hack the names created with DECLARE_STACK_OF(ACCESS_DESCRIPTION) */
+#define sk_ACCESS_DESCRIPTION_new               sk_ACC_DESC_new
+#define sk_ACCESS_DESCRIPTION_new_null          sk_ACC_DESC_new_null
+#define sk_ACCESS_DESCRIPTION_free              sk_ACC_DESC_free
+#define sk_ACCESS_DESCRIPTION_num               sk_ACC_DESC_num
+#define sk_ACCESS_DESCRIPTION_value             sk_ACC_DESC_value
+#define sk_ACCESS_DESCRIPTION_set               sk_ACC_DESC_set
+#define sk_ACCESS_DESCRIPTION_zero              sk_ACC_DESC_zero
+#define sk_ACCESS_DESCRIPTION_push              sk_ACC_DESC_push
+#define sk_ACCESS_DESCRIPTION_unshift           sk_ACC_DESC_unshift
+#define sk_ACCESS_DESCRIPTION_find              sk_ACC_DESC_find
+#define sk_ACCESS_DESCRIPTION_delete            sk_ACC_DESC_delete
+#define sk_ACCESS_DESCRIPTION_delete_ptr        sk_ACC_DESC_delete_ptr
+#define sk_ACCESS_DESCRIPTION_insert            sk_ACC_DESC_insert
+#define sk_ACCESS_DESCRIPTION_set_cmp_func      sk_ACC_DESC_set_cmp_func
+#define sk_ACCESS_DESCRIPTION_dup               sk_ACC_DESC_dup
+#define sk_ACCESS_DESCRIPTION_pop_free          sk_ACC_DESC_pop_free
+#define sk_ACCESS_DESCRIPTION_shift             sk_ACC_DESC_shift
+#define sk_ACCESS_DESCRIPTION_pop               sk_ACC_DESC_pop
+#define sk_ACCESS_DESCRIPTION_sort              sk_ACC_DESC_sort
+
+/* Hack the names created with DECLARE_STACK_OF(CRYPTO_EX_DATA_FUNCS) */
+#define sk_CRYPTO_EX_DATA_FUNCS_new             sk_CRYPT_EX_DATFNS_new
+#define sk_CRYPTO_EX_DATA_FUNCS_new_null        sk_CRYPT_EX_DATFNS_new_null
+#define sk_CRYPTO_EX_DATA_FUNCS_free            sk_CRYPT_EX_DATFNS_free
+#define sk_CRYPTO_EX_DATA_FUNCS_num             sk_CRYPT_EX_DATFNS_num
+#define sk_CRYPTO_EX_DATA_FUNCS_value           sk_CRYPT_EX_DATFNS_value
+#define sk_CRYPTO_EX_DATA_FUNCS_set             sk_CRYPT_EX_DATFNS_set
+#define sk_CRYPTO_EX_DATA_FUNCS_zero            sk_CRYPT_EX_DATFNS_zero
+#define sk_CRYPTO_EX_DATA_FUNCS_push            sk_CRYPT_EX_DATFNS_push
+#define sk_CRYPTO_EX_DATA_FUNCS_unshift         sk_CRYPT_EX_DATFNS_unshift
+#define sk_CRYPTO_EX_DATA_FUNCS_find            sk_CRYPT_EX_DATFNS_find
+#define sk_CRYPTO_EX_DATA_FUNCS_delete          sk_CRYPT_EX_DATFNS_delete
+#define sk_CRYPTO_EX_DATA_FUNCS_delete_ptr      sk_CRYPT_EX_DATFNS_delete_ptr
+#define sk_CRYPTO_EX_DATA_FUNCS_insert          sk_CRYPT_EX_DATFNS_insert
+#define sk_CRYPTO_EX_DATA_FUNCS_set_cmp_func    sk_CRYPT_EX_DATFNS_set_cmp_func
+#define sk_CRYPTO_EX_DATA_FUNCS_dup             sk_CRYPT_EX_DATFNS_dup
+#define sk_CRYPTO_EX_DATA_FUNCS_pop_free        sk_CRYPT_EX_DATFNS_pop_free
+#define sk_CRYPTO_EX_DATA_FUNCS_shift           sk_CRYPT_EX_DATFNS_shift
+#define sk_CRYPTO_EX_DATA_FUNCS_pop             sk_CRYPT_EX_DATFNS_pop
+#define sk_CRYPTO_EX_DATA_FUNCS_sort            sk_CRYPT_EX_DATFNS_sort
 
 /* Hack the names created with DECLARE_ASN1_SET_OF(PKCS7_SIGNER_INFO) */
-#define i2d_ASN1_SET_OF_PKCS7_SIGNER_INFO i2d_ASN1_SET_OF_PKCS7_SIGINF
-#define d2i_ASN1_SET_OF_PKCS7_SIGNER_INFO d2i_ASN1_SET_OF_PKCS7_SIGINF
+#define i2d_ASN1_SET_OF_PKCS7_SIGNER_INFO       i2d_ASN1_SET_OF_PKCS7_SIGINF
+#define d2i_ASN1_SET_OF_PKCS7_SIGNER_INFO       d2i_ASN1_SET_OF_PKCS7_SIGINF
 
 /* Hack the names created with DECLARE_ASN1_SET_OF(PKCS7_RECIP_INFO) */
-#define i2d_ASN1_SET_OF_PKCS7_RECIP_INFO i2d_ASN1_SET_OF_PKCS7_RECGINF
-#define d2i_ASN1_SET_OF_PKCS7_RECIP_INFO d2i_ASN1_SET_OF_PKCS7_RECGINF
+#define i2d_ASN1_SET_OF_PKCS7_RECIP_INFO        i2d_ASN1_SET_OF_PKCS7_RECGINF
+#define d2i_ASN1_SET_OF_PKCS7_RECIP_INFO        d2i_ASN1_SET_OF_PKCS7_RECGINF
+
+/* Hack the names created with DECLARE_ASN1_SET_OF(ACCESS_DESCRIPTION) */
+#define i2d_ASN1_SET_OF_ACCESS_DESCRIPTION      i2d_ASN1_SET_OF_ACC_DESC
+#define d2i_ASN1_SET_OF_ACCESS_DESCRIPTION      d2i_ASN1_SET_OF_ACC_DESC
 
 /* Hack the names created with DECLARE_PEM_rw(NETSCAPE_CERT_SEQUENCE) */
 #define PEM_read_NETSCAPE_CERT_SEQUENCE         PEM_read_NS_CERT_SEQUENCE
@@ -119,7 +188,10 @@
 #define PEM_write_PKCS8_PRIV_KEY_INFO           PEM_write_P8_PRIV_KEY_INFO
 #define PEM_read_bio_PKCS8_PRIV_KEY_INFO        PEM_read_bio_P8_PRIV_KEY_INFO
 #define PEM_write_bio_PKCS8_PRIV_KEY_INFO       PEM_write_bio_P8_PRIV_KEY_INFO
-#define PEM_write_cb_bio_PKCS8_PRIV_KEY_INFO    PEM_write_cb_bio_P8_PRIV_KEY_INFO
+#define PEM_write_cb_bio_PKCS8_PRIV_KEY_INFO    PEM_wrt_cb_bio_P8_PRIV_KEY_INFO
+
+/* Hack other PEM names */
+#define PEM_write_bio_PKCS8PrivateKey_nid       PEM_write_bio_PKCS8PrivKey_nid
 
 #endif /* defined VMS */
 
diff --git a/src/lib/libssl/src/apps/CA.com b/src/lib/libssl/src/apps/CA.com
index f324788eca..02682e424a 100644
--- a/src/lib/libssl/src/apps/CA.com
+++ b/src/lib/libssl/src/apps/CA.com
@@ -35,6 +35,7 @@ $ REQ    = openssl + " req " + SSLEAY_CONFIG
 $ CA     = openssl + " ca " + SSLEAY_CONFIG
 $ VERIFY = openssl + " verify"
 $ X509   = openssl + " x509"
+$ PKCS12 = openssl + " pkcs12"
 $ echo   = "write sys$Output"
 $!
 $ s = F$PARSE(F$ENVIRONMENT("DEFAULT"),"[]") - "].;"
@@ -96,10 +97,18 @@ $     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.certs]
 $     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.crl]
 $     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.newcerts]
 $     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.private]
+$
 $     OPEN   /WRITE ser_file 'CATOP']serial. 
 $     WRITE ser_file "01"
 $     CLOSE ser_file
 $     APPEND/NEW NL: 'CATOP']index.txt
+$
+$     ! The following is to make sure access() doesn't get confused.  It
+$     ! really needs one file in the directory to give correct answers...
+$     COPY NLA0: 'CATOP'.certs].;
+$     COPY NLA0: 'CATOP'.crl].;
+$     COPY NLA0: 'CATOP'.newcerts].;
+$     COPY NLA0: 'CATOP'.private].;
 $   ENDIF
 $!
 $   IF F$SEARCH(CATOP+".private"+CAKEY) .EQS. ""
@@ -121,6 +130,17 @@ $   ENDIF
 $   GOTO opt_loop_continue
 $ ENDIF
 $!
+$ IF (prog_opt .EQS. "-pkcs12")
+$ THEN
+$   i = i + 1
+$   cname = P'i'
+$   IF cname .EQS. "" THEN cname = "My certificate"
+$   PKCS12 -in newcert.pem -inkey newreq.pem -certfile 'CATOP''CACERT -
+           -out newcert.p12 -export -name "''cname'"
+$   RET=$STATUS
+$   exit RET
+$ ENDIF
+$!
 $ IF (prog_opt .EQS. "-xsign")
 $ THEN
 $!
diff --git a/src/lib/libssl/src/apps/CA.pl b/src/lib/libssl/src/apps/CA.pl
index 7c023ae71f..beebee7ffe 100644
--- a/src/lib/libssl/src/apps/CA.pl
+++ b/src/lib/libssl/src/apps/CA.pl
@@ -1,4 +1,4 @@
-#!/usr/local/bin/perl
+#!/sw/bin/perl
 #
 # CA - wrapper around ca to make it easier to use ... basically ca requires
 #      some setup stuff to be done before you can use it and this makes
@@ -41,6 +41,7 @@ $REQ="openssl req $SSLEAY_CONFIG";
 $CA="openssl ca $SSLEAY_CONFIG";
 $VERIFY="openssl verify";
 $X509="openssl x509";
+$PKCS12="openssl pkcs12";
 
 $CATOP="./demoCA";
 $CAKEY="cakey.pem";
@@ -65,7 +66,7 @@ foreach (@ARGV) {
             $RET=$?;
             print "Request (and private key) is in newreq.pem\n";
         } elsif (/^-newca$/) {
-                # if explictly asked for or it doesn't exist then setup the
+                # if explicitly asked for or it doesn't exist then setup the
                 # directory structure that Eric likes to manage things 
             $NEW="1";
             if ( "$NEW" || ! -f "${CATOP}/serial" ) {
@@ -99,6 +100,14 @@ foreach (@ARGV) {
                     $RET=$?;
                 }
             }
+        } elsif (/^-pkcs12$/) {
+            my $cname = $ARGV[1];
+            $cname = "My Certificate" unless defined $cname;
+            system ("$PKCS12 -in newcert.pem -inkey newreq.pem " .
+                        "-certfile ${CATOP}/$CACERT -out newcert.p12 " .
+                        "-export -name \"$cname\"");
+            $RET=$?;
+            exit $RET;
         } elsif (/^-xsign$/) {
             system ("$CA -policy policy_anything -infiles newreq.pem");
             $RET=$?;
diff --git a/src/lib/libssl/src/apps/CA.pl.in b/src/lib/libssl/src/apps/CA.pl.in
new file mode 100644
index 0000000000..4eef57e6e3
--- /dev/null
+++ b/src/lib/libssl/src/apps/CA.pl.in
@@ -0,0 +1,162 @@
+#!/usr/local/bin/perl
+#
+# CA - wrapper around ca to make it easier to use ... basically ca requires
+#      some setup stuff to be done before you can use it and this makes
+#      things easier between now and when Eric is convinced to fix it :-)
+#
+# CA -newca ... will setup the right stuff
+# CA -newreq ... will generate a certificate request 
+# CA -sign ... will sign the generated request and output 
+#
+# At the end of that grab newreq.pem and newcert.pem (one has the key 
+# and the other the certificate) and cat them together and that is what
+# you want/need ... I'll make even this a little cleaner later.
+#
+#
+# 12-Jan-96 tjh    Added more things ... including CA -signcert which
+#                  converts a certificate to a request and then signs it.
+# 10-Jan-96 eay    Fixed a few more bugs and added the SSLEAY_CONFIG
+#                  environment variable so this can be driven from
+#                  a script.
+# 25-Jul-96 eay    Cleaned up filenames some more.
+# 11-Jun-96 eay    Fixed a few filename missmatches.
+# 03-May-96 eay    Modified to use 'ssleay cmd' instead of 'cmd'.
+# 18-Apr-96 tjh    Original hacking
+#
+# Tim Hudson
+# tjh@cryptsoft.com
+#
+
+# 27-Apr-98 snh    Translation into perl, fix existing CA bug.
+#
+#
+# Steve Henson
+# shenson@bigfoot.com
+
+# default openssl.cnf file has setup as per the following
+# demoCA ... where everything is stored
+
+$DAYS="-days 365";
+$REQ="openssl req $SSLEAY_CONFIG";
+$CA="openssl ca $SSLEAY_CONFIG";
+$VERIFY="openssl verify";
+$X509="openssl x509";
+$PKCS12="openssl pkcs12";
+
+$CATOP="./demoCA";
+$CAKEY="cakey.pem";
+$CACERT="cacert.pem";
+
+$DIRMODE = 0777;
+
+$RET = 0;
+
+foreach (@ARGV) {
+        if ( /^(-\?|-h|-help)$/ ) {
+            print STDERR "usage: CA -newcert|-newreq|-newca|-sign|-verify\n";
+            exit 0;
+        } elsif (/^-newcert$/) {
+            # create a certificate
+            system ("$REQ -new -x509 -keyout newreq.pem -out newreq.pem $DAYS");
+            $RET=$?;
+            print "Certificate (and private key) is in newreq.pem\n"
+        } elsif (/^-newreq$/) {
+            # create a certificate request
+            system ("$REQ -new -keyout newreq.pem -out newreq.pem $DAYS");
+            $RET=$?;
+            print "Request (and private key) is in newreq.pem\n";
+        } elsif (/^-newca$/) {
+                # if explicitly asked for or it doesn't exist then setup the
+                # directory structure that Eric likes to manage things 
+            $NEW="1";
+            if ( "$NEW" || ! -f "${CATOP}/serial" ) {
+                # create the directory hierarchy
+                mkdir $CATOP, $DIRMODE;
+                mkdir "${CATOP}/certs", $DIRMODE;
+                mkdir "${CATOP}/crl", $DIRMODE ;
+                mkdir "${CATOP}/newcerts", $DIRMODE;
+                mkdir "${CATOP}/private", $DIRMODE;
+                open OUT, ">${CATOP}/serial";
+                print OUT "01\n";
+                close OUT;
+                open OUT, ">${CATOP}/index.txt";
+                close OUT;
+            }
+            if ( ! -f "${CATOP}/private/$CAKEY" ) {
+                print "CA certificate filename (or enter to create)\n";
+                $FILE = <STDIN>;
+
+                chop $FILE;
+
+                # ask user for existing CA certificate
+                if ($FILE) {
+                    cp_pem($FILE,"${CATOP}/private/$CAKEY", "PRIVATE");
+                    cp_pem($FILE,"${CATOP}/$CACERT", "CERTIFICATE");
+                    $RET=$?;
+                } else {
+                    print "Making CA certificate ...\n";
+                    system ("$REQ -new -x509 -keyout " .
+                        "${CATOP}/private/$CAKEY -out ${CATOP}/$CACERT $DAYS");
+                    $RET=$?;
+                }
+            }
+        } elsif (/^-pkcs12$/) {
+            my $cname = $ARGV[1];
+            $cname = "My Certificate" unless defined $cname;
+            system ("$PKCS12 -in newcert.pem -inkey newreq.pem " .
+                        "-certfile ${CATOP}/$CACERT -out newcert.p12 " .
+                        "-export -name \"$cname\"");
+            $RET=$?;
+            exit $RET;
+        } elsif (/^-xsign$/) {
+            system ("$CA -policy policy_anything -infiles newreq.pem");
+            $RET=$?;
+        } elsif (/^(-sign|-signreq)$/) {
+            system ("$CA -policy policy_anything -out newcert.pem " .
+                                                        "-infiles newreq.pem");
+            $RET=$?;
+            print "Signed certificate is in newcert.pem\n";
+        } elsif (/^-signcert$/) {
+            system ("$X509 -x509toreq -in newreq.pem -signkey newreq.pem " .
+                                                                "-out tmp.pem");
+            system ("$CA -policy policy_anything -out newcert.pem " .
+                                                        "-infiles tmp.pem");
+            $RET = $?;
+            print "Signed certificate is in newcert.pem\n";
+        } elsif (/^-verify$/) {
+            if (shift) {
+                foreach $j (@ARGV) {
+                    system ("$VERIFY -CAfile $CATOP/$CACERT $j");
+                    $RET=$? if ($? != 0);
+                }
+                exit $RET;
+            } else {
+                    system ("$VERIFY -CAfile $CATOP/$CACERT newcert.pem");
+                    $RET=$?;
+                    exit 0;
+            }
+        } else {
+            print STDERR "Unknown arg $_\n";
+            print STDERR "usage: CA -newcert|-newreq|-newca|-sign|-verify\n";
+            exit 1;
+        }
+}
+
+exit $RET;
+
+sub cp_pem {
+my ($infile, $outfile, $bound) = @_;
+open IN, $infile;
+open OUT, ">$outfile";
+my $flag = 0;
+while (<IN>) {
+        $flag = 1 if (/^-----BEGIN.*$bound/) ;
+        print OUT $_ if ($flag);
+        if (/^-----END.*$bound/) {
+                close IN;
+                close OUT;
+                return;
+        }
+}
+}
+
diff --git a/src/lib/libssl/src/apps/CA.sh b/src/lib/libssl/src/apps/CA.sh
index 728f5bf4d8..d9f3069fb2 100644
--- a/src/lib/libssl/src/apps/CA.sh
+++ b/src/lib/libssl/src/apps/CA.sh
@@ -60,7 +60,7 @@ case $i in
     echo "Request (and private key) is in newreq.pem"
     ;;
 -newca)     
-    # if explictly asked for or it doesn't exist then setup the directory
+    # if explicitly asked for or it doesn't exist then setup the directory
     # structure that Eric likes to manage things 
     NEW="1"
     if [ "$NEW" -o ! -f ${CATOP}/serial ]; then
diff --git a/src/lib/libssl/src/apps/Makefile.ssl b/src/lib/libssl/src/apps/Makefile.ssl
index 8e382701b1..f97154ba03 100644
--- a/src/lib/libssl/src/apps/Makefile.ssl
+++ b/src/lib/libssl/src/apps/Makefile.ssl
@@ -13,6 +13,7 @@ OPENSSLDIR=	/usr/local/ssl
 MAKE=           make -f Makefile.ssl
 MAKEDEPEND=     $(TOP)/util/domd $(TOP)
 MAKEFILE=       Makefile.ssl
+PERL=/usr/local/bin/perl
 RM=             rm -f
 
 PEX_LIBS=
@@ -33,11 +34,11 @@ SCRIPTS=CA.sh CA.pl der_chop
 
 EXE= $(PROGRAM)
 
-E_EXE=  verify asn1pars req dgst dh enc gendh errstr ca crl \
-        rsa dsa dsaparam \
+E_EXE=  verify asn1pars req dgst dh dhparam enc passwd gendh errstr \
+        ca crl rsa dsa dsaparam \
         x509 genrsa gendsa s_server s_client speed \
         s_time version pkcs7 crl2pkcs7 sess_id ciphers nseq pkcs12 \
-        pkcs8
+        pkcs8 spkac smime
 
 PROGS= $(PROGRAM).c
 
@@ -45,22 +46,24 @@ A_OBJ=apps.o
 A_SRC=apps.c
 S_OBJ=  s_cb.o s_socket.o
 S_SRC=  s_cb.c s_socket.c
+RAND_OBJ=app_rand.o
+RAND_SRC=app_rand.c
 
-E_OBJ=  verify.o asn1pars.o req.o dgst.o dh.o enc.o gendh.o errstr.o ca.o \
-        pkcs7.o crl2p7.o crl.o \
+E_OBJ=  verify.o asn1pars.o req.o dgst.o dh.o dhparam.o enc.o passwd.o gendh.o errstr.o \
+        ca.o pkcs7.o crl2p7.o crl.o \
         rsa.o dsa.o dsaparam.o \
         x509.o genrsa.o gendsa.o s_server.o s_client.o speed.o \
-        s_time.o $(A_OBJ) $(S_OBJ) version.o sess_id.o \
-        ciphers.o nseq.o pkcs12.o pkcs8.o
+        s_time.o $(A_OBJ) $(S_OBJ) $(RAND_OBJ) version.o sess_id.o \
+        ciphers.o nseq.o pkcs12.o pkcs8.o spkac.o smime.o
 
 #       pem_mail.o
 
-E_SRC=  verify.c asn1pars.c req.c dgst.c dh.c enc.c gendh.c errstr.c ca.c \
+E_SRC=  verify.c asn1pars.c req.c dgst.c dh.c enc.c passwd.c gendh.c errstr.c ca.c \
         pkcs7.c crl2p7.c crl.c \
         rsa.c dsa.c dsaparam.c \
         x509.c genrsa.c gendsa.c s_server.c s_client.c speed.c \
-        s_time.c $(A_SRC) $(S_SRC) version.c sess_id.c \
-        ciphers.c nseq.c pkcs12.c pkcs8.c
+        s_time.c $(A_SRC) $(S_SRC) $(RAND_SRC) version.c sess_id.c \
+        ciphers.c nseq.c pkcs12.c pkcs8.c spkac.c smime.c
 
 #       pem_mail.c
 
@@ -81,7 +84,7 @@ all:	exe
 exe:    $(EXE)
 
 req: sreq.o $(A_OBJ) $(DLIBCRYPTO)
-        $(CC) -o req $(CFLAG) sreq.o $(A_OBJ) $(PEX_LIBS) $(LIBCRYPTO) $(EX_LIBS)
+        $(CC) -o req $(CFLAG) sreq.o $(A_OBJ) $(RAND_OBJ) $(PEX_LIBS) $(LIBCRYPTO) $(EX_LIBS)
 
 sreq.o: req.c 
         $(CC) -c $(INCLUDES) $(CFLAG) -o sreq.o req.c
@@ -138,16 +141,44 @@ $(PROGRAM): progs.h $(E_OBJ) $(PROGRAM).o $(DLIBCRYPTO) $(DLIBSSL)
         $(CC) -o $(PROGRAM) $(CFLAGS) $(PROGRAM).o $(E_OBJ) $(PEX_LIBS) $(LIBSSL) $(LIBCRYPTO) $(EX_LIBS)
         @(cd ..; OPENSSL="`pwd`/apps/openssl"; export OPENSSL; sh tools/c_rehash certs)
 
-progs.h:
-        $(PERL) ./progs.pl $(E_EXE) >progs.h
+progs.h: progs.pl
+        $(PERL) progs.pl $(E_EXE) >progs.h
         $(RM) $(PROGRAM).o
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
-apps.o: ../include/openssl/bio.h ../include/openssl/buffer.h
-apps.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
-apps.o: ../include/openssl/e_os2.h ../include/openssl/opensslconf.h
-apps.o: ../include/openssl/opensslv.h ../include/openssl/stack.h apps.h progs.h
+app_rand.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+app_rand.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
+app_rand.o: ../include/openssl/buffer.h ../include/openssl/cast.h
+app_rand.o: ../include/openssl/crypto.h ../include/openssl/des.h
+app_rand.o: ../include/openssl/dh.h ../include/openssl/dsa.h
+app_rand.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+app_rand.o: ../include/openssl/evp.h ../include/openssl/idea.h
+app_rand.o: ../include/openssl/md2.h ../include/openssl/md5.h
+app_rand.o: ../include/openssl/mdc2.h ../include/openssl/objects.h
+app_rand.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+app_rand.o: ../include/openssl/pkcs7.h ../include/openssl/rand.h
+app_rand.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+app_rand.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+app_rand.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+app_rand.o: ../include/openssl/sha.h ../include/openssl/stack.h
+app_rand.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
+apps.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+apps.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
+apps.o: ../include/openssl/buffer.h ../include/openssl/cast.h
+apps.o: ../include/openssl/crypto.h ../include/openssl/des.h
+apps.o: ../include/openssl/dh.h ../include/openssl/dsa.h
+apps.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+apps.o: ../include/openssl/evp.h ../include/openssl/idea.h
+apps.o: ../include/openssl/md2.h ../include/openssl/md5.h
+apps.o: ../include/openssl/mdc2.h ../include/openssl/objects.h
+apps.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+apps.o: ../include/openssl/pkcs7.h ../include/openssl/rc2.h
+apps.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
+apps.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
+apps.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+apps.o: ../include/openssl/stack.h ../include/openssl/x509.h
+apps.o: ../include/openssl/x509_vfy.h apps.h
 asn1pars.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 asn1pars.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 asn1pars.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -165,7 +196,6 @@ asn1pars.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 asn1pars.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 asn1pars.o: ../include/openssl/sha.h ../include/openssl/stack.h
 asn1pars.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-asn1pars.o: progs.h
 ca.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 ca.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 ca.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -184,7 +214,7 @@ ca.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
 ca.o: ../include/openssl/safestack.h ../include/openssl/sha.h
 ca.o: ../include/openssl/stack.h ../include/openssl/txt_db.h
 ca.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
-ca.o: ../include/openssl/x509v3.h apps.h progs.h
+ca.o: ../include/openssl/x509v3.h apps.h
 ciphers.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 ciphers.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 ciphers.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -205,7 +235,6 @@ ciphers.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
 ciphers.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
 ciphers.o: ../include/openssl/stack.h ../include/openssl/tls1.h
 ciphers.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-ciphers.o: progs.h
 crl.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 crl.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 crl.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -224,7 +253,7 @@ crl.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 crl.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 crl.o: ../include/openssl/sha.h ../include/openssl/stack.h
 crl.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
-crl.o: ../include/openssl/x509v3.h apps.h progs.h
+crl.o: ../include/openssl/x509v3.h apps.h
 crl2p7.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 crl2p7.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 crl2p7.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -242,7 +271,6 @@ crl2p7.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 crl2p7.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 crl2p7.o: ../include/openssl/sha.h ../include/openssl/stack.h
 crl2p7.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-crl2p7.o: progs.h
 dgst.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 dgst.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 dgst.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -259,7 +287,7 @@ dgst.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
 dgst.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 dgst.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 dgst.o: ../include/openssl/sha.h ../include/openssl/stack.h
-dgst.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h progs.h
+dgst.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 dh.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 dh.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 dh.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -276,7 +304,7 @@ dh.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
 dh.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 dh.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 dh.o: ../include/openssl/sha.h ../include/openssl/stack.h
-dh.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h progs.h
+dh.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 dsa.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 dsa.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 dsa.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -293,7 +321,7 @@ dsa.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
 dsa.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 dsa.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 dsa.o: ../include/openssl/sha.h ../include/openssl/stack.h
-dsa.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h progs.h
+dsa.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 dsaparam.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 dsaparam.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 dsaparam.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -306,12 +334,11 @@ dsaparam.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
 dsaparam.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
 dsaparam.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
 dsaparam.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
-dsaparam.o: ../include/openssl/rand.h ../include/openssl/rc2.h
-dsaparam.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
-dsaparam.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
-dsaparam.o: ../include/openssl/safestack.h ../include/openssl/sha.h
-dsaparam.o: ../include/openssl/stack.h ../include/openssl/x509.h
-dsaparam.o: ../include/openssl/x509_vfy.h apps.h progs.h
+dsaparam.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+dsaparam.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+dsaparam.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+dsaparam.o: ../include/openssl/sha.h ../include/openssl/stack.h
+dsaparam.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 enc.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 enc.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 enc.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -324,11 +351,12 @@ enc.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
 enc.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
 enc.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
 enc.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
-enc.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
-enc.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
-enc.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
-enc.o: ../include/openssl/sha.h ../include/openssl/stack.h
-enc.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h progs.h
+enc.o: ../include/openssl/rand.h ../include/openssl/rc2.h
+enc.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
+enc.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
+enc.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+enc.o: ../include/openssl/stack.h ../include/openssl/x509.h
+enc.o: ../include/openssl/x509_vfy.h apps.h
 errstr.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 errstr.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 errstr.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -349,7 +377,6 @@ errstr.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
 errstr.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
 errstr.o: ../include/openssl/stack.h ../include/openssl/tls1.h
 errstr.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-errstr.o: progs.h
 gendh.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 gendh.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 gendh.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -367,7 +394,7 @@ gendh.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
 gendh.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
 gendh.o: ../include/openssl/safestack.h ../include/openssl/sha.h
 gendh.o: ../include/openssl/stack.h ../include/openssl/x509.h
-gendh.o: ../include/openssl/x509_vfy.h apps.h progs.h
+gendh.o: ../include/openssl/x509_vfy.h apps.h
 gendsa.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 gendsa.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 gendsa.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -380,12 +407,11 @@ gendsa.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
 gendsa.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
 gendsa.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
 gendsa.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
-gendsa.o: ../include/openssl/rand.h ../include/openssl/rc2.h
-gendsa.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
-gendsa.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
-gendsa.o: ../include/openssl/safestack.h ../include/openssl/sha.h
-gendsa.o: ../include/openssl/stack.h ../include/openssl/x509.h
-gendsa.o: ../include/openssl/x509_vfy.h apps.h progs.h
+gendsa.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+gendsa.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+gendsa.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+gendsa.o: ../include/openssl/sha.h ../include/openssl/stack.h
+gendsa.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 genrsa.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 genrsa.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 genrsa.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -398,12 +424,11 @@ genrsa.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
 genrsa.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
 genrsa.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
 genrsa.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
-genrsa.o: ../include/openssl/rand.h ../include/openssl/rc2.h
-genrsa.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
-genrsa.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
-genrsa.o: ../include/openssl/safestack.h ../include/openssl/sha.h
-genrsa.o: ../include/openssl/stack.h ../include/openssl/x509.h
-genrsa.o: ../include/openssl/x509_vfy.h apps.h progs.h
+genrsa.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+genrsa.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+genrsa.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+genrsa.o: ../include/openssl/sha.h ../include/openssl/stack.h
+genrsa.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 nseq.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 nseq.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 nseq.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -420,7 +445,7 @@ nseq.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
 nseq.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 nseq.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 nseq.o: ../include/openssl/sha.h ../include/openssl/stack.h
-nseq.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h progs.h
+nseq.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 openssl.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 openssl.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 openssl.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -442,6 +467,23 @@ openssl.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
 openssl.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
 openssl.o: ../include/openssl/tls1.h ../include/openssl/x509.h
 openssl.o: ../include/openssl/x509_vfy.h apps.h progs.h s_apps.h
+passwd.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+passwd.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
+passwd.o: ../include/openssl/buffer.h ../include/openssl/cast.h
+passwd.o: ../include/openssl/crypto.h ../include/openssl/des.h
+passwd.o: ../include/openssl/dh.h ../include/openssl/dsa.h
+passwd.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+passwd.o: ../include/openssl/err.h ../include/openssl/evp.h
+passwd.o: ../include/openssl/idea.h ../include/openssl/md2.h
+passwd.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
+passwd.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+passwd.o: ../include/openssl/opensslv.h ../include/openssl/pkcs7.h
+passwd.o: ../include/openssl/rand.h ../include/openssl/rc2.h
+passwd.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
+passwd.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
+passwd.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+passwd.o: ../include/openssl/stack.h ../include/openssl/x509.h
+passwd.o: ../include/openssl/x509_vfy.h apps.h
 pkcs12.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 pkcs12.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 pkcs12.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -459,7 +501,7 @@ pkcs12.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
 pkcs12.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
 pkcs12.o: ../include/openssl/safestack.h ../include/openssl/sha.h
 pkcs12.o: ../include/openssl/stack.h ../include/openssl/x509.h
-pkcs12.o: ../include/openssl/x509_vfy.h apps.h progs.h
+pkcs12.o: ../include/openssl/x509_vfy.h apps.h
 pkcs7.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 pkcs7.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 pkcs7.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -476,7 +518,7 @@ pkcs7.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
 pkcs7.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 pkcs7.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 pkcs7.o: ../include/openssl/sha.h ../include/openssl/stack.h
-pkcs7.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h progs.h
+pkcs7.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 pkcs8.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 pkcs8.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 pkcs8.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -494,7 +536,7 @@ pkcs8.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
 pkcs8.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
 pkcs8.o: ../include/openssl/safestack.h ../include/openssl/sha.h
 pkcs8.o: ../include/openssl/stack.h ../include/openssl/x509.h
-pkcs8.o: ../include/openssl/x509_vfy.h apps.h progs.h
+pkcs8.o: ../include/openssl/x509_vfy.h apps.h
 req.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 req.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 req.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -508,12 +550,12 @@ req.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
 req.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
 req.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
 req.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
-req.o: ../include/openssl/rand.h ../include/openssl/rc2.h
-req.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
-req.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
-req.o: ../include/openssl/safestack.h ../include/openssl/sha.h
-req.o: ../include/openssl/stack.h ../include/openssl/x509.h
-req.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h progs.h
+req.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+req.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+req.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+req.o: ../include/openssl/sha.h ../include/openssl/stack.h
+req.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+req.o: ../include/openssl/x509v3.h apps.h
 rsa.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 rsa.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 rsa.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -530,7 +572,7 @@ rsa.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
 rsa.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 rsa.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 rsa.o: ../include/openssl/sha.h ../include/openssl/stack.h
-rsa.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h progs.h
+rsa.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 s_cb.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 s_cb.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 s_cb.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -550,8 +592,7 @@ s_cb.o: ../include/openssl/safestack.h ../include/openssl/sha.h
 s_cb.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
 s_cb.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
 s_cb.o: ../include/openssl/stack.h ../include/openssl/tls1.h
-s_cb.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h progs.h
-s_cb.o: s_apps.h
+s_cb.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h s_apps.h
 s_client.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 s_client.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 s_client.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -572,7 +613,7 @@ s_client.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
 s_client.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
 s_client.o: ../include/openssl/stack.h ../include/openssl/tls1.h
 s_client.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-s_client.o: progs.h s_apps.h
+s_client.o: s_apps.h
 s_server.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 s_server.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 s_server.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -593,7 +634,7 @@ s_server.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
 s_server.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
 s_server.o: ../include/openssl/stack.h ../include/openssl/tls1.h
 s_server.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-s_server.o: progs.h s_apps.h
+s_server.o: s_apps.h
 s_socket.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 s_socket.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 s_socket.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -613,7 +654,7 @@ s_socket.o: ../include/openssl/sha.h ../include/openssl/ssl.h
 s_socket.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
 s_socket.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
 s_socket.o: ../include/openssl/tls1.h ../include/openssl/x509.h
-s_socket.o: ../include/openssl/x509_vfy.h apps.h progs.h s_apps.h
+s_socket.o: ../include/openssl/x509_vfy.h apps.h s_apps.h
 s_time.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 s_time.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 s_time.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -634,7 +675,7 @@ s_time.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
 s_time.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
 s_time.o: ../include/openssl/stack.h ../include/openssl/tls1.h
 s_time.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-s_time.o: progs.h s_apps.h
+s_time.o: s_apps.h
 sess_id.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 sess_id.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 sess_id.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -655,7 +696,23 @@ sess_id.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
 sess_id.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
 sess_id.o: ../include/openssl/stack.h ../include/openssl/tls1.h
 sess_id.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-sess_id.o: progs.h
+smime.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+smime.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
+smime.o: ../include/openssl/buffer.h ../include/openssl/cast.h
+smime.o: ../include/openssl/crypto.h ../include/openssl/des.h
+smime.o: ../include/openssl/dh.h ../include/openssl/dsa.h
+smime.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+smime.o: ../include/openssl/err.h ../include/openssl/evp.h
+smime.o: ../include/openssl/idea.h ../include/openssl/md2.h
+smime.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
+smime.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+smime.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
+smime.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
+smime.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+smime.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+smime.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+smime.o: ../include/openssl/sha.h ../include/openssl/stack.h
+smime.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 speed.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 speed.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 speed.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -673,15 +730,33 @@ speed.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 speed.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 speed.o: ../include/openssl/sha.h ../include/openssl/stack.h
 speed.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h ./testdsa.h
-speed.o: ./testrsa.h apps.h progs.h
+speed.o: ./testrsa.h apps.h
+spkac.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+spkac.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
+spkac.o: ../include/openssl/buffer.h ../include/openssl/cast.h
+spkac.o: ../include/openssl/crypto.h ../include/openssl/des.h
+spkac.o: ../include/openssl/dh.h ../include/openssl/dsa.h
+spkac.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+spkac.o: ../include/openssl/err.h ../include/openssl/evp.h
+spkac.o: ../include/openssl/idea.h ../include/openssl/md2.h
+spkac.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
+spkac.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+spkac.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
+spkac.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
+spkac.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+spkac.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+spkac.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+spkac.o: ../include/openssl/sha.h ../include/openssl/stack.h
+spkac.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
 verify.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 verify.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 verify.o: ../include/openssl/buffer.h ../include/openssl/cast.h
-verify.o: ../include/openssl/crypto.h ../include/openssl/des.h
-verify.o: ../include/openssl/dh.h ../include/openssl/dsa.h
-verify.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
-verify.o: ../include/openssl/err.h ../include/openssl/evp.h
-verify.o: ../include/openssl/idea.h ../include/openssl/md2.h
+verify.o: ../include/openssl/conf.h ../include/openssl/crypto.h
+verify.o: ../include/openssl/des.h ../include/openssl/dh.h
+verify.o: ../include/openssl/dsa.h ../include/openssl/e_os.h
+verify.o: ../include/openssl/e_os2.h ../include/openssl/err.h
+verify.o: ../include/openssl/evp.h ../include/openssl/idea.h
+verify.o: ../include/openssl/lhash.h ../include/openssl/md2.h
 verify.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
 verify.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
 verify.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
@@ -690,8 +765,8 @@ verify.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
 verify.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 verify.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 verify.o: ../include/openssl/sha.h ../include/openssl/stack.h
-verify.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-verify.o: progs.h
+verify.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+verify.o: ../include/openssl/x509v3.h apps.h
 version.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 version.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 version.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -702,10 +777,12 @@ version.o: ../include/openssl/evp.h ../include/openssl/idea.h
 version.o: ../include/openssl/md2.h ../include/openssl/md5.h
 version.o: ../include/openssl/mdc2.h ../include/openssl/objects.h
 version.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-version.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
-version.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
-version.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
-version.o: ../include/openssl/sha.h ../include/openssl/stack.h apps.h progs.h
+version.o: ../include/openssl/pkcs7.h ../include/openssl/rc2.h
+version.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
+version.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
+version.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+version.o: ../include/openssl/stack.h ../include/openssl/x509.h
+version.o: ../include/openssl/x509_vfy.h apps.h
 x509.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 x509.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 x509.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -724,4 +801,4 @@ x509.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
 x509.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
 x509.o: ../include/openssl/sha.h ../include/openssl/stack.h
 x509.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
-x509.o: ../include/openssl/x509v3.h apps.h progs.h
+x509.o: ../include/openssl/x509v3.h apps.h
diff --git a/src/lib/libssl/src/apps/app_rand.c b/src/lib/libssl/src/apps/app_rand.c
new file mode 100644
index 0000000000..f7f133831d
--- /dev/null
+++ b/src/lib/libssl/src/apps/app_rand.c
@@ -0,0 +1,211 @@
+/* apps/app_rand.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "apps.h"
+#include <openssl/bio.h>
+#include <openssl/rand.h>
+
+
+static int seeded = 0;
+static int egdsocket = 0;
+
+int app_RAND_load_file(const char *file, BIO *bio_e, int dont_warn)
+        {
+        int consider_randfile = (file == NULL);
+        char buffer[200];
+        
+#ifdef WINDOWS
+        BIO_printf(bio_e,"Loading 'screen' into random state -");
+        BIO_flush(bio_e);
+        RAND_screen();
+        BIO_printf(bio_e," done\n");
+#endif
+
+        if (file == NULL)
+                file = RAND_file_name(buffer, sizeof buffer);
+        else if (RAND_egd(file) > 0)
+                {
+                /* we try if the given filename is an EGD socket.
+                   if it is, we don't write anything back to the file. */
+                egdsocket = 1;
+                return 1;
+                }
+        if (file == NULL || !RAND_load_file(file, -1))
+                {
+                if (RAND_status() == 0 && !dont_warn)
+                        {
+                        BIO_printf(bio_e,"unable to load 'random state'\n");
+                        BIO_printf(bio_e,"This means that the random number generator has not been seeded\n");
+                        BIO_printf(bio_e,"with much random data.\n");
+                        if (consider_randfile) /* explanation does not apply when a file is explicitly named */
+                                {
+                                BIO_printf(bio_e,"Consider setting the RANDFILE environment variable to point at a file that\n");
+                                BIO_printf(bio_e,"'random' data can be kept in (the file will be overwritten).\n");
+                                }
+                        }
+                return 0;
+                }
+        seeded = 1;
+        return 1;
+        }
+
+long app_RAND_load_files(char *name)
+        {
+        char *p,*n;
+        int last;
+        long tot=0;
+    int egd;
+        
+        for (;;)
+                {
+                last=0;
+                for (p=name; ((*p != '\0') && (*p != LIST_SEPARATOR_CHAR)); p++);
+                if (*p == '\0') last=1;
+                *p='\0';
+                n=name;
+                name=p+1;
+                if (*n == '\0') break;
+
+        egd=RAND_egd(n);
+                if (egd > 0) tot+=egd;
+                tot+=RAND_load_file(n,1024L*1024L);
+                if (last) break;
+                }
+        if (tot > 512)
+                app_RAND_allow_write_file();
+        return(tot);
+        }
+
+int app_RAND_write_file(const char *file, BIO *bio_e)
+        {
+        char buffer[200];
+        
+        if (egdsocket || !seeded)
+                /* If we did not manage to read the seed file,
+                 * we should not write a low-entropy seed file back --
+                 * it would suppress a crucial warning the next time
+                 * we want to use it. */
+                return 0;
+
+        if (file == NULL)
+                file = RAND_file_name(buffer, sizeof buffer);
+        if (file == NULL || !RAND_write_file(file))
+                {
+                BIO_printf(bio_e,"unable to write 'random state'\n");
+                return 0;
+                }
+        return 1;
+        }
+
+void app_RAND_allow_write_file(void)
+        {
+        seeded = 1;
+        }
diff --git a/src/lib/libssl/src/apps/apps.c b/src/lib/libssl/src/apps/apps.c
index 8fb5e8aaa7..a87d23bf33 100644
--- a/src/lib/libssl/src/apps/apps.c
+++ b/src/lib/libssl/src/apps/apps.c
@@ -324,3 +324,93 @@ int app_init(long mesgwin)
         return(1);
         }
 #endif
+
+
+int dump_cert_text (BIO *out, X509 *x)
+{
+        char buf[256];
+        X509_NAME_oneline(X509_get_subject_name(x),buf,256);
+        BIO_puts(out,"subject=");
+        BIO_puts(out,buf);
+
+        X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
+        BIO_puts(out,"\nissuer= ");
+        BIO_puts(out,buf);
+        BIO_puts(out,"\n");
+        return 0;
+}
+
+static char *app_get_pass(BIO *err, char *arg, int keepbio);
+
+int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2)
+{
+        int same;
+        if(!arg2 || !arg1 || strcmp(arg1, arg2)) same = 0;
+        else same = 1;
+        if(arg1) {
+                *pass1 = app_get_pass(err, arg1, same);
+                if(!*pass1) return 0;
+        } else if(pass1) *pass1 = NULL;
+        if(arg2) {
+                *pass2 = app_get_pass(err, arg2, same ? 2 : 0);
+                if(!*pass2) return 0;
+        } else if(pass2) *pass2 = NULL;
+        return 1;
+}
+
+static char *app_get_pass(BIO *err, char *arg, int keepbio)
+{
+        char *tmp, tpass[APP_PASS_LEN];
+        static BIO *pwdbio = NULL;
+        int i;
+        if(!strncmp(arg, "pass:", 5)) return BUF_strdup(arg + 5);
+        if(!strncmp(arg, "env:", 4)) {
+                tmp = getenv(arg + 4);
+                if(!tmp) {
+                        BIO_printf(err, "Can't read environment variable %s\n", arg + 4);
+                        return NULL;
+                }
+                return BUF_strdup(tmp);
+        }
+        if(!keepbio || !pwdbio) {
+                if(!strncmp(arg, "file:", 5)) {
+                        pwdbio = BIO_new_file(arg + 5, "r");
+                        if(!pwdbio) {
+                                BIO_printf(err, "Can't open file %s\n", arg + 5);
+                                return NULL;
+                        }
+                } else if(!strncmp(arg, "fd:", 3)) {
+                        BIO *btmp;
+                        i = atoi(arg + 3);
+                        if(i >= 0) pwdbio = BIO_new_fd(i, BIO_NOCLOSE);
+                        if((i < 0) || !pwdbio) {
+                                BIO_printf(err, "Can't access file descriptor %s\n", arg + 3);
+                                return NULL;
+                        }
+                        /* Can't do BIO_gets on an fd BIO so add a buffering BIO */
+                        btmp = BIO_new(BIO_f_buffer());
+                        pwdbio = BIO_push(btmp, pwdbio);
+                } else if(!strcmp(arg, "stdin")) {
+                        pwdbio = BIO_new_fp(stdin, BIO_NOCLOSE);
+                        if(!pwdbio) {
+                                BIO_printf(err, "Can't open BIO for stdin\n");
+                                return NULL;
+                        }
+                } else {
+                        BIO_printf(err, "Invalid password argument \"%s\"\n", arg);
+                        return NULL;
+                }
+        }
+        i = BIO_gets(pwdbio, tpass, APP_PASS_LEN);
+        if(keepbio != 1) {
+                BIO_free_all(pwdbio);
+                pwdbio = NULL;
+        }
+        if(i <= 0) {
+                BIO_printf(err, "Error reading password from BIO\n");
+                return NULL;
+        }
+        tmp = strchr(tpass, '\n');
+        if(tmp) *tmp = 0;
+        return BUF_strdup(tpass);
+}
diff --git a/src/lib/libssl/src/apps/apps.h b/src/lib/libssl/src/apps/apps.h
index 063f9c65be..2dcdb88c43 100644
--- a/src/lib/libssl/src/apps/apps.h
+++ b/src/lib/libssl/src/apps/apps.h
@@ -64,7 +64,17 @@
 #include <openssl/buffer.h>
 #include <openssl/bio.h>
 #include <openssl/crypto.h>
-#include "progs.h"
+#include <openssl/x509.h>
+
+int app_RAND_load_file(const char *file, BIO *bio_e, int dont_warn);
+int app_RAND_write_file(const char *file, BIO *bio_e);
+/* When `file' is NULL, use defaults.
+ * `bio_e' is for error messages. */
+void app_RAND_allow_write_file(void);
+long app_RAND_load_files(char *file); /* `file' is a list of files to read,
+                                       * separated by LIST_SEPARATOR_CHAR
+                                       * (see e_os.h).  The string is
+                                       * destroyed! */
 
 #ifdef NO_STDIO
 BIO_METHOD *BIO_s_file();
@@ -103,7 +113,7 @@ extern BIO *bio_err;
 #define do_pipe_sig()
 #endif
 
-#if defined(MONOLITH) && !defined(SSLEAY)
+#if defined(MONOLITH) && !defined(OPENSSL_C)
 #  define apps_startup()        do_pipe_sig()
 #else
 #  if defined(MSDOS) || defined(WIN16) || defined(WIN32)
@@ -132,10 +142,16 @@ int args_from_file(char *file, int *argc, char **argv[]);
 int str2fmt(char *s);
 void program_name(char *in,char *out,int size);
 int chopup_args(ARGS *arg,char *buf, int *argc, char **argv[]);
+#ifdef HEADER_X509_H
+int dump_cert_text(BIO *out, X509 *x);
+#endif
+int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2);
 #define FORMAT_UNDEF    0
 #define FORMAT_ASN1     1
 #define FORMAT_TEXT     2
 #define FORMAT_PEM      3
 #define FORMAT_NETSCAPE 4
 
+#define APP_PASS_LEN    1024
+
 #endif
diff --git a/src/lib/libssl/src/apps/asn1pars.c b/src/lib/libssl/src/apps/asn1pars.c
index 1b272b2977..f104ebc1f0 100644
--- a/src/lib/libssl/src/apps/asn1pars.c
+++ b/src/lib/libssl/src/apps/asn1pars.c
@@ -74,19 +74,21 @@
  * -i           - indent the details by depth
  * -offset      - where in the file to start
  * -length      - how many bytes to use
- * -oid file    - extra oid decription file
+ * -oid file    - extra oid description file
  */
 
 #undef PROG
 #define PROG    asn1parse_main
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int i,badops=0,offset=0,ret=1,j;
         unsigned int length=0;
         long num,tmplen;
         BIO *in=NULL,*out=NULL,*b64=NULL, *derout = NULL;
-        int informat,indent=0;
+        int informat,indent=0, noout = 0;
         char *infile=NULL,*str=NULL,*prog,*oidfile=NULL, *derfile=NULL;
         unsigned char *tmpbuf;
         BUF_MEM *buf=NULL;
@@ -130,6 +132,7 @@ int MAIN(int argc, char **argv)
                         {
                         indent=1;
                         }
+                else if (strcmp(*argv,"-noout") == 0) noout = 1;
                 else if (strcmp(*argv,"-oid") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -168,8 +171,10 @@ bad:
                 BIO_printf(bio_err,"where options are\n");
                 BIO_printf(bio_err," -inform arg   input format - one of DER TXT PEM\n");
                 BIO_printf(bio_err," -in arg       input file\n");
+                BIO_printf(bio_err," -out arg      output file\n");
+                BIO_printf(bio_err," -noout arg    don't produce any output\n");
                 BIO_printf(bio_err," -offset arg   offset into file\n");
-                BIO_printf(bio_err," -length arg   lenth of section in file\n");
+                BIO_printf(bio_err," -length arg   length of section in file\n");
                 BIO_printf(bio_err," -i            indent entries\n");
                 BIO_printf(bio_err," -oid file     file of extra oid definitions\n");
                 BIO_printf(bio_err," -strparse offset\n");
@@ -287,7 +292,8 @@ bad:
                         goto end;
                 }
         }
-        if (!ASN1_parse(out,(unsigned char *)&(str[offset]),length,indent))
+        if (!noout &&
+            !ASN1_parse(out,(unsigned char *)&(str[offset]),length,indent))
                 {
                 ERR_print_errors(bio_err);
                 goto end;
diff --git a/src/lib/libssl/src/apps/ca.c b/src/lib/libssl/src/apps/ca.c
index 9ed100dd3c..e22beda097 100644
--- a/src/lib/libssl/src/apps/ca.c
+++ b/src/lib/libssl/src/apps/ca.c
@@ -147,6 +147,8 @@ static char *ca_usage[]={
 " -gencrl         - Generate a new CRL\n",
 " -crldays days   - Days is when the next CRL is due\n",
 " -crlhours hours - Hours is when the next CRL is due\n",
+" -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
+" -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
 " -days arg       - number of days to certify the certificate for\n",
 " -md arg         - md to use, one of md2, md5, sha or sha1\n",
 " -policy arg     - The CA 'policy' to support\n",
@@ -163,6 +165,8 @@ static char *ca_usage[]={
 " -batch          - Don't ask questions\n",
 " -msie_hack      - msie modifications to handle all those universal strings\n",
 " -revoke file    - Revoke a certificate (given in file)\n",
+" -extensions ..  - Extension section (override value in config file)\n",
+" -crlexts ..     - CRL extension section (override value in config file)\n",
 NULL
 };
 
@@ -174,7 +178,6 @@ extern int EF_ALIGNMENT;
 
 static int add_oid_section(LHASH *conf);
 static void lookup_fail(char *name,char *tag);
-static int MS_CALLBACK key_callback(char *buf,int len,int verify,void *u);
 static unsigned long index_serial_hash(char **a);
 static int index_serial_cmp(char **a, char **b);
 static unsigned long index_name_hash(char **a);
@@ -197,22 +200,24 @@ static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                          char *enddate, int days, char *ext_sect,LHASH *conf,
                                 int verbose);
 static int fix_data(int nid, int *type);
-static void write_new_certificate(BIO *bp, X509 *x, int output_der);
+static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
         STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,
         char *startdate, char *enddate, int days, int batch, int verbose,
         X509_REQ *req, char *ext_sect, LHASH *conf);
 static int do_revoke(X509 *x509, TXT_DB *db);
 static int check_time_format(char *str);
-static LHASH *conf;
-static char *key=NULL;
+static LHASH *conf=NULL;
 static char *section=NULL;
 
 static int preserve=0;
 static int msie_hack=0;
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
+        char *key=NULL;
         int total=0;
         int total_done=0;
         int badops=0;
@@ -244,6 +249,7 @@ int MAIN(int argc, char **argv)
         char *enddate=NULL;
         int days=0;
         int batch=0;
+        int notext=0;
         X509 *x509=NULL;
         X509 *x=NULL;
         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
@@ -262,6 +268,7 @@ int MAIN(int argc, char **argv)
 #undef BSIZE
 #define BSIZE 256
         MS_STATIC char buf[3][BSIZE];
+        char *randfile=NULL;
 
 #ifdef EFENCE
 EF_PROTECT_FREE=1;
@@ -271,9 +278,12 @@ EF_ALIGNMENT=0;
 
         apps_startup();
 
-        X509V3_add_standard_extensions();
+        conf = NULL;
+        key = NULL;
+        section = NULL;
 
         preserve=0;
+        msie_hack=0;
         if (bio_err == NULL)
                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
@@ -350,6 +360,8 @@ EF_ALIGNMENT=0;
                         if (--argc < 1) goto bad;
                         outdir= *(++argv);
                         }
+                else if (strcmp(*argv,"-notext") == 0)
+                        notext=1;
                 else if (strcmp(*argv,"-batch") == 0)
                         batch=1;
                 else if (strcmp(*argv,"-preserveDN") == 0)
@@ -393,6 +405,16 @@ EF_ALIGNMENT=0;
                         infile= *(++argv);
                         dorevoke=1;
                         }
+                else if (strcmp(*argv,"-extensions") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        extensions= *(++argv);
+                        }
+                else if (strcmp(*argv,"-crlexts") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        crl_ext= *(++argv);
+                        }
                 else
                         {
 bad:
@@ -476,12 +498,16 @@ bad:
                                 BIO_free(oid_bio);
                                 }
                         }
-                }
-                if(!add_oid_section(conf)) {
+                if(!add_oid_section(conf)) 
+                        {
                         ERR_print_errors(bio_err);
                         goto err;
+                        }
                 }
 
+        randfile = CONF_get_string(conf, BASE_SECTION, "RANDFILE");
+        app_RAND_load_file(randfile, bio_err, 0);
+        
         in=BIO_new(BIO_s_file());
         out=BIO_new(BIO_s_file());
         Sout=BIO_new(BIO_s_file());
@@ -493,7 +519,7 @@ bad:
                 }
 
         /*****************************************************************/
-        /* we definitly need an public key, so lets get it */
+        /* we definitely need an public key, so lets get it */
 
         if ((keyfile == NULL) && ((keyfile=CONF_get_string(conf,
                 section,ENV_PRIVATE_KEY)) == NULL))
@@ -507,13 +533,8 @@ bad:
                 BIO_printf(bio_err,"trying to load CA private key\n");
                 goto err;
                 }
-        if (key == NULL)
-                pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL);
-        else
-                {
-                pkey=PEM_read_bio_PrivateKey(in,NULL,key_callback,NULL);
-                memset(key,0,strlen(key));
-                }
+                pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,key);
+                if(key) memset(key,0,strlen(key));
         if (pkey == NULL)
                 {
                 BIO_printf(bio_err,"unable to load CA private key\n");
@@ -566,14 +587,19 @@ bad:
                         BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
                         goto err;
                         }
-#ifdef VMS
-                /* For technical reasons, VMS misbehaves with X_OK */
-                if (access(outdir,R_OK|W_OK) != 0)
-#else
+#ifndef VMS /* outdir is a directory spec, but access() for VMS demands a
+               filename.  In any case, stat(), below, will catch the problem
+               if outdir is not a directory spec, and the fopen() or open()
+               will catch an error if there is no write access.
+
+               Presumably, this problem could also be solved by using the DEC
+               C routines to convert the directory syntax to Unixly, and give
+               that to access().  However, time's too short to do that just
+               now.
+            */
                 if (access(outdir,R_OK|W_OK|X_OK) != 0)
-#endif
                         {
-                        BIO_printf(bio_err,"I am unable to acces the %s directory\n",outdir);
+                        BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
                         perror(outdir);
                         goto err;
                         }
@@ -584,12 +610,15 @@ bad:
                         perror(outdir);
                         goto err;
                         }
+#ifdef S_IFDIR
                 if (!(sb.st_mode & S_IFDIR))
                         {
                         BIO_printf(bio_err,"%s need to be a directory\n",outdir);
                         perror(outdir);
                         goto err;
                         }
+#endif
+#endif
                 }
 
         /*****************************************************************/
@@ -655,7 +684,7 @@ bad:
                 TXT_DB_write(out,db);
                 BIO_printf(bio_err,"%d entries loaded from the database\n",
                         db->data->num);
-                BIO_printf(bio_err,"generating indexs\n");
+                BIO_printf(bio_err,"generating index\n");
                 }
         
         if (!TXT_DB_create_index(db,DB_serial,NULL,index_serial_hash,
@@ -720,8 +749,8 @@ bad:
                         lookup_fail(section,ENV_SERIAL);
                         goto err;
                         }
-
-                extensions=CONF_get_string(conf,section,ENV_EXTENSIONS);
+                if(!extensions)
+                        extensions=CONF_get_string(conf,section,ENV_EXTENSIONS);
                 if(extensions) {
                         /* Check syntax of file */
                         X509V3_CTX ctx;
@@ -966,8 +995,8 @@ bad:
                                 perror(buf[2]);
                                 goto err;
                                 }
-                        write_new_certificate(Cout,x, 0);
-                        write_new_certificate(Sout,x, output_der);
+                        write_new_certificate(Cout,x, 0, notext);
+                        write_new_certificate(Sout,x, output_der, notext);
                         }
 
                 if (sk_num(cert_sk))
@@ -987,14 +1016,14 @@ bad:
                         out=NULL;
                         if (rename(serialfile,buf[2]) < 0)
                                 {
-                                BIO_printf(bio_err,"unabel to rename %s to %s\n",
+                                BIO_printf(bio_err,"unable to rename %s to %s\n",
                                         serialfile,buf[2]);
                                 perror("reason");
                                 goto err;
                                 }
                         if (rename(buf[0],serialfile) < 0)
                                 {
-                                BIO_printf(bio_err,"unabel to rename %s to %s\n",
+                                BIO_printf(bio_err,"unable to rename %s to %s\n",
                                         buf[0],serialfile);
                                 perror("reason");
                                 rename(buf[2],serialfile);
@@ -1011,14 +1040,14 @@ bad:
 
                         if (rename(dbfile,buf[2]) < 0)
                                 {
-                                BIO_printf(bio_err,"unabel to rename %s to %s\n",
+                                BIO_printf(bio_err,"unable to rename %s to %s\n",
                                         dbfile,buf[2]);
                                 perror("reason");
                                 goto err;
                                 }
                         if (rename(buf[1],dbfile) < 0)
                                 {
-                                BIO_printf(bio_err,"unabel to rename %s to %s\n",
+                                BIO_printf(bio_err,"unable to rename %s to %s\n",
                                         buf[1],dbfile);
                                 perror("reason");
                                 rename(buf[2],dbfile);
@@ -1031,7 +1060,7 @@ bad:
         /*****************************************************************/
         if (gencrl)
                 {
-                crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);
+                if(!crl_ext) crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);
                 if(crl_ext) {
                         /* Check syntax of file */
                         X509V3_CTX ctx;
@@ -1143,13 +1172,6 @@ bad:
         /*****************************************************************/
         if (dorevoke)
                 {
-                in=BIO_new(BIO_s_file());
-                out=BIO_new(BIO_s_file());
-                if ((in == NULL) || (out == NULL))
-                        {
-                        ERR_print_errors(bio_err);
-                        goto err;
-                        }
                 if (infile == NULL) 
                         {
                         BIO_printf(bio_err,"no input files\n");
@@ -1157,19 +1179,22 @@ bad:
                         }
                 else
                         {
+                        X509 *revcert;
                         if (BIO_read_filename(in,infile) <= 0)
                                 {
                                 perror(infile);
                                 BIO_printf(bio_err,"error trying to load '%s' certificate\n",infile);
                                 goto err;
                                 }
-                        x509=PEM_read_bio_X509(in,NULL,NULL,NULL);
-                        if (x509 == NULL)
+                        revcert=PEM_read_bio_X509(in,NULL,NULL,NULL);
+                        if (revcert == NULL)
                                 {
                                 BIO_printf(bio_err,"unable to load '%s' certificate\n",infile);
                                 goto err;
                                 }
-                        j=do_revoke(x509,db);
+                        j=do_revoke(revcert,db);
+                        if (j <= 0) goto err;
+                        X509_free(revcert);
 
                         strncpy(buf[0],dbfile,BSIZE-4);
                         strcat(buf[0],".new");
@@ -1181,10 +1206,6 @@ bad:
                                 }
                         j=TXT_DB_write(out,db);
                         if (j <= 0) goto err;
-                        BIO_free(in);
-                        BIO_free(out);
-                        in=NULL;
-                        out=NULL;
                         strncpy(buf[1],dbfile,BSIZE-4);
                         strcat(buf[1],".old");
                         if (rename(dbfile,buf[1]) < 0)
@@ -1215,13 +1236,13 @@ err:
         sk_pop_free(cert_sk,X509_free);
 
         if (ret) ERR_print_errors(bio_err);
+        app_RAND_write_file(randfile, bio_err);
         BN_free(serial);
         TXT_DB_free(db);
         EVP_PKEY_free(pkey);
         X509_free(x509);
         X509_CRL_free(crl);
         CONF_free(conf);
-        X509V3_EXT_cleanup();
         OBJ_cleanup();
         EXIT(ret);
         }
@@ -1231,17 +1252,6 @@ static void lookup_fail(char *name, char *tag)
         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
         }
 
-static int MS_CALLBACK key_callback(char *buf, int len, int verify, void *u)
-        {
-        int i;
-
-        if (key == NULL) return(0);
-        i=strlen(key);
-        i=(i > len)?len:i;
-        memcpy(buf,key,i);
-        return(i);
-        }
-
 static unsigned long index_serial_hash(char **a)
         {
         char *n;
@@ -1664,8 +1674,7 @@ again2:
 
                         if (push != NULL)
                                 {
-                                if (!X509_NAME_add_entry(subject,push,
-                                        X509_NAME_entry_count(subject),0))
+                                if (!X509_NAME_add_entry(subject,push, -1, 0))
                                         {
                                         if (push != NULL)
                                                 X509_NAME_ENTRY_free(push);
@@ -1685,7 +1694,7 @@ again2:
                 }
 
         if (verbose)
-                BIO_printf(bio_err,"The subject name apears to be ok, checking data base for clashes\n");
+                BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
 
         row[DB_name]=X509_NAME_oneline(subject,NULL,0);
         row[DB_serial]=BN_bn2hex(serial);
@@ -1742,7 +1751,7 @@ again2:
                 goto err;
                 }
 
-        /* We are now totaly happy, lets make and sign the certificate */
+        /* We are now totally happy, lets make and sign the certificate */
         if (verbose)
                 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
 
@@ -1789,7 +1798,7 @@ again2:
                 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
 
                 /* Free the current entries if any, there should not
-                 * be any I belive */
+                 * be any I believe */
                 if (ci->extensions != NULL)
                         sk_X509_EXTENSION_pop_free(ci->extensions,
                                                    X509_EXTENSION_free);
@@ -1883,6 +1892,8 @@ err:
                 X509_NAME_free(CAname);
         if (subject != NULL)
                 X509_NAME_free(subject);
+        if (tmptm != NULL)
+                ASN1_UTCTIME_free(tmptm);
         if (ok <= 0)
                 {
                 if (ret != NULL) X509_free(ret);
@@ -1893,17 +1904,16 @@ err:
         return(ok);
         }
 
-static void write_new_certificate(BIO *bp, X509 *x, int output_der)
+static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
         {
-        char *f;
-        char buf[256];
 
         if (output_der)
                 {
                 (void)i2d_X509_bio(bp,x);
                 return;
                 }
-
+#if 0
+        /* ??? Not needed since X509_print prints all this stuff anyway */
         f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
         BIO_printf(bp,"issuer :%s\n",f);
 
@@ -1913,10 +1923,9 @@ static void write_new_certificate(BIO *bp, X509 *x, int output_der)
         BIO_puts(bp,"serial :");
         i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
         BIO_puts(bp,"\n\n");
-        X509_print(bp,x);
-        BIO_puts(bp,"\n");
+#endif
+        if(!notext)X509_print(bp,x);
         PEM_write_bio_X509(bp,x);
-        BIO_puts(bp,"\n");
         }
 
 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
@@ -1929,7 +1938,6 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
         X509_REQ *req=NULL;
         CONF_VALUE *cv=NULL;
         NETSCAPE_SPKI *spki = NULL;
-        unsigned char *spki_der = NULL,*p;
         X509_REQ_INFO *ri;
         char *type,*buf;
         EVP_PKEY *pktmp=NULL;
@@ -1986,31 +1994,22 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
 
                 cv=sk_CONF_VALUE_value(sk,i);
                 type=cv->name;
-                buf=cv->value;
+                /* Skip past any leading X. X: X, etc to allow for
+                 * multiple instances
+                 */
+                for(buf = cv->name; *buf ; buf++)
+                        if ((*buf == ':') || (*buf == ',') || (*buf == '.')) {
+                                        buf++;
+                                        if(*buf) type = buf;
+                                        break;
+                }
 
+                buf=cv->value;
                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
                         {
                         if (strcmp(type, "SPKAC") == 0)
                                 {
-                                spki_der=(unsigned char *)Malloc(
-                                        strlen(cv->value)+1);
-                                if (spki_der == NULL)
-                                        {
-                                        BIO_printf(bio_err,"Malloc failure\n");
-                                        goto err;
-                                        }
-                                j = EVP_DecodeBlock(spki_der, (unsigned char *)cv->value,
-                                        strlen(cv->value));
-                                if (j <= 0)
-                                        {
-                                        BIO_printf(bio_err, "Can't b64 decode SPKAC structure\n");
-                                        goto err;
-                                        }
-
-                                p=spki_der;
-                                spki = d2i_NETSCAPE_SPKI(&spki, &p, j);
-                                Free(spki_der);
-                                spki_der = NULL;
+                                spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
                                 if (spki == NULL)
                                         {
                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
@@ -2034,8 +2033,7 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
                         strlen(buf))) == NULL)
                         goto err;
 
-                if (!X509_NAME_add_entry(n,ne,X509_NAME_entry_count(n),0))
-                        goto err;
+                if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
                 }
         if (spki == NULL)
                 {
@@ -2050,7 +2048,7 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
 
         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
 
-        if ((pktmp=X509_PUBKEY_get(spki->spkac->pubkey)) == NULL)
+        if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
                 {
                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
                 goto err;
@@ -2071,7 +2069,6 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
 err:
         if (req != NULL) X509_REQ_free(req);
         if (parms != NULL) CONF_free(parms);
-        if (spki_der != NULL) Free(spki_der);
         if (spki != NULL) NETSCAPE_SPKI_free(spki);
         if (ne != NULL) X509_NAME_ENTRY_free(ne);
 
@@ -2127,20 +2124,26 @@ static int add_oid_section(LHASH *hconf)
 
 static int do_revoke(X509 *x509, TXT_DB *db)
 {
-        ASN1_UTCTIME *tm=NULL;
+        ASN1_UTCTIME *tm=NULL, *revtm=NULL;
         char *row[DB_NUMBER],**rrow,**irow;
+        BIGNUM *bn = NULL;
         int ok=-1,i;
 
         for (i=0; i<DB_NUMBER; i++)
                 row[i]=NULL;
-        row[DB_name]=X509_NAME_oneline(x509->cert_info->subject,NULL,0);
-        row[DB_serial]=BN_bn2hex(ASN1_INTEGER_to_BN(x509->cert_info->serialNumber,NULL));
+        row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
+        bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
+        row[DB_serial]=BN_bn2hex(bn);
+        BN_free(bn);
         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
                 {
                 BIO_printf(bio_err,"Malloc failure\n");
                 goto err;
                 }
-        rrow=TXT_DB_get_by_index(db,DB_name,row);
+        /* We have to lookup by serial number because name lookup
+         * skips revoked certs
+         */
+        rrow=TXT_DB_get_by_index(db,DB_serial,row);
         if (rrow == NULL)
                 {
                 BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);
@@ -2191,16 +2194,15 @@ static int do_revoke(X509 *x509, TXT_DB *db)
                         }
 
                 /* Revoke Certificate */
-                do_revoke(x509,db);
+                ok = do_revoke(x509,db);
 
-                ok=1;
                 goto err;
 
                 }
-        else if (index_serial_cmp(row,rrow))
+        else if (index_name_cmp(row,rrow))
                 {
-                BIO_printf(bio_err,"ERROR:no same serial number %s\n",
-                           row[DB_serial]);
+                BIO_printf(bio_err,"ERROR:name does not match %s\n",
+                           row[DB_name]);
                 goto err;
                 }
         else if (rrow[DB_type][0]=='R')
@@ -2212,12 +2214,14 @@ static int do_revoke(X509 *x509, TXT_DB *db)
         else
                 {
                 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
-                tm=X509_gmtime_adj(tm,0);
+                revtm = ASN1_UTCTIME_new();
+                revtm=X509_gmtime_adj(revtm,0);
                 rrow[DB_type][0]='R';
                 rrow[DB_type][1]='\0';
-                rrow[DB_rev_date]=(char *)Malloc(tm->length+1);
-                memcpy(rrow[DB_rev_date],tm->data,tm->length);
-                rrow[DB_rev_date][tm->length]='\0';
+                rrow[DB_rev_date]=(char *)Malloc(revtm->length+1);
+                memcpy(rrow[DB_rev_date],revtm->data,revtm->length);
+                rrow[DB_rev_date][revtm->length]='\0';
+                ASN1_UTCTIME_free(revtm);
                 }
         ok=1;
 err:
@@ -2226,7 +2230,6 @@ err:
                 if (row[i] != NULL) 
                         Free(row[i]);
                 }
-        ASN1_UTCTIME_free(tm);
         return(ok);
 }
 
diff --git a/src/lib/libssl/src/apps/ciphers.c b/src/lib/libssl/src/apps/ciphers.c
index 08e47be4f7..f8e9e7be2e 100644
--- a/src/lib/libssl/src/apps/ciphers.c
+++ b/src/lib/libssl/src/apps/ciphers.c
@@ -66,10 +66,6 @@
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 
-#if defined(NO_RSA) && !defined(NO_SSL2)
-#define NO_SSL2
-#endif
-
 #undef PROG
 #define PROG    ciphers_main
 
@@ -81,6 +77,8 @@ static char *ciphers_usage[]={
 NULL
 };
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int ret=1,i;
@@ -145,12 +143,16 @@ int MAIN(int argc, char **argv)
                 goto end;
                 }
 
-        SSLeay_add_ssl_algorithms();
+        OpenSSL_add_ssl_algorithms();
 
         ctx=SSL_CTX_new(meth);
         if (ctx == NULL) goto err;
-        if (ciphers != NULL)
-                SSL_CTX_set_cipher_list(ctx,ciphers);
+        if (ciphers != NULL) {
+                if(!SSL_CTX_set_cipher_list(ctx,ciphers)) {
+                        BIO_printf(bio_err, "Error in cipher list\n");
+                        goto err;
+                }
+        }
         ssl=SSL_new(ctx);
         if (ssl == NULL) goto err;
 
diff --git a/src/lib/libssl/src/apps/crl.c b/src/lib/libssl/src/apps/crl.c
index f7bdf76676..338f46d97c 100644
--- a/src/lib/libssl/src/apps/crl.c
+++ b/src/lib/libssl/src/apps/crl.c
@@ -75,7 +75,7 @@
 static char *crl_usage[]={
 "usage: crl args\n",
 "\n",
-" -inform arg     - input format - default PEM (one of DER, TXT or PEM)\n",
+" -inform arg     - input format - default PEM (DER or PEM)\n",
 " -outform arg    - output format - default PEM\n",
 " -text           - print out a text format version\n",
 " -in arg         - input file - default stdin\n",
@@ -85,21 +85,32 @@ static char *crl_usage[]={
 " -lastupdate     - lastUpdate field\n",
 " -nextupdate     - nextUpdate field\n",
 " -noout          - no CRL output\n",
+" -CAfile  name   - verify CRL using certificates in file \"name\"\n",
+" -CApath  dir    - verify CRL using certificates in \"dir\"\n",
 NULL
 };
 
 static X509_CRL *load_crl(char *file, int format);
 static BIO *bio_out=NULL;
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         X509_CRL *x=NULL;
+        char *CAfile = NULL, *CApath = NULL;
         int ret=1,i,num,badops=0;
         BIO *out=NULL;
         int informat,outformat;
         char *infile=NULL,*outfile=NULL;
         int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0;
         char **pp,buf[256];
+        X509_STORE *store = NULL;
+        X509_STORE_CTX ctx;
+        X509_LOOKUP *lookup = NULL;
+        X509_OBJECT xobj;
+        EVP_PKEY *pkey;
+        int do_ver = 0;
 
         apps_startup();
 
@@ -146,6 +157,20 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         outfile= *(++argv);
                         }
+                else if (strcmp(*argv,"-CApath") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        CApath = *(++argv);
+                        do_ver = 1;
+                        }
+                else if (strcmp(*argv,"-CAfile") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        CAfile = *(++argv);
+                        do_ver = 1;
+                        }
+                else if (strcmp(*argv,"-verify") == 0)
+                        do_ver = 1;
                 else if (strcmp(*argv,"-text") == 0)
                         text = 1;
                 else if (strcmp(*argv,"-hash") == 0)
@@ -177,36 +202,74 @@ bad:
                 }
 
         ERR_load_crypto_strings();
-        X509V3_add_standard_extensions();
         x=load_crl(infile,informat);
         if (x == NULL) { goto end; }
 
+        if(do_ver) {
+                store = X509_STORE_new();
+                lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
+                if (lookup == NULL) goto end;
+                if (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))
+                        X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
+                        
+                lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
+                if (lookup == NULL) goto end;
+                if (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM))
+                        X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
+                ERR_clear_error();
+
+                X509_STORE_CTX_init(&ctx, store, NULL, NULL);
+
+                i = X509_STORE_get_by_subject(&ctx, X509_LU_X509, 
+                                        X509_CRL_get_issuer(x), &xobj);
+                if(i <= 0) {
+                        BIO_printf(bio_err,
+                                "Error getting CRL issuer certificate\n");
+                        goto end;
+                }
+                pkey = X509_get_pubkey(xobj.data.x509);
+                X509_OBJECT_free_contents(&xobj);
+                if(!pkey) {
+                        BIO_printf(bio_err,
+                                "Error getting CRL issuer public key\n");
+                        goto end;
+                }
+                i = X509_CRL_verify(x, pkey);
+                EVP_PKEY_free(pkey);
+                if(i < 0) goto end;
+                if(i == 0) BIO_printf(bio_err, "verify failure\n");
+                else BIO_printf(bio_err, "verify OK\n");
+        }
+
         if (num)
                 {
                 for (i=1; i<=num; i++)
                         {
                         if (issuer == i)
                                 {
-                                X509_NAME_oneline(x->crl->issuer,buf,256);
+                                X509_NAME_oneline(X509_CRL_get_issuer(x),
+                                                                buf,256);
                                 BIO_printf(bio_out,"issuer= %s\n",buf);
                                 }
 
                         if (hash == i)
                                 {
                                 BIO_printf(bio_out,"%08lx\n",
-                                        X509_NAME_hash(x->crl->issuer));
+                                        X509_NAME_hash(X509_CRL_get_issuer(x)));
                                 }
                         if (lastupdate == i)
                                 {
                                 BIO_printf(bio_out,"lastUpdate=");
-                                ASN1_TIME_print(bio_out,x->crl->lastUpdate);
+                                ASN1_TIME_print(bio_out,
+                                                X509_CRL_get_lastUpdate(x));
                                 BIO_printf(bio_out,"\n");
                                 }
                         if (nextupdate == i)
                                 {
                                 BIO_printf(bio_out,"nextUpdate=");
-                                if (x->crl->nextUpdate != NULL)
-                                        ASN1_TIME_print(bio_out,x->crl->nextUpdate);
+                                if (X509_CRL_get_nextUpdate(x)) 
+                                        ASN1_TIME_print(bio_out,
+                                                X509_CRL_get_nextUpdate(x));
                                 else
                                         BIO_printf(bio_out,"NONE");
                                 BIO_printf(bio_out,"\n");
@@ -250,8 +313,12 @@ bad:
 end:
         BIO_free(out);
         BIO_free(bio_out);
+        bio_out=NULL;
         X509_CRL_free(x);
-        X509V3_EXT_cleanup();
+        if(store) {
+                X509_STORE_CTX_cleanup(&ctx);
+                X509_STORE_free(store);
+        }
         EXIT(ret);
         }
 
diff --git a/src/lib/libssl/src/apps/crl2p7.c b/src/lib/libssl/src/apps/crl2p7.c
index 8634e3a1ec..4056591676 100644
--- a/src/lib/libssl/src/apps/crl2p7.c
+++ b/src/lib/libssl/src/apps/crl2p7.c
@@ -76,12 +76,14 @@ static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
 #undef PROG
 #define PROG    crl2pkcs7_main
 
-/* -inform arg  - input format - default PEM (one of DER, TXT or PEM)
+/* -inform arg  - input format - default PEM (DER or PEM)
  * -outform arg - output format - default PEM
  * -in arg      - input file - default stdin
  * -out arg     - output file - default stdout
  */
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int i,badops=0;
@@ -157,8 +159,8 @@ int MAIN(int argc, char **argv)
 bad:
                 BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
                 BIO_printf(bio_err,"where options are\n");
-                BIO_printf(bio_err," -inform arg    input format - one of DER TXT PEM\n");
-                BIO_printf(bio_err," -outform arg   output format - one of DER TXT PEM\n");
+                BIO_printf(bio_err," -inform arg    input format - DER or PEM\n");
+                BIO_printf(bio_err," -outform arg   output format - DER or PEM\n");
                 BIO_printf(bio_err," -in arg        input file\n");
                 BIO_printf(bio_err," -out arg       output file\n");
                 BIO_printf(bio_err," -certfile arg  certificates file of chain to a trusted CA\n");
diff --git a/src/lib/libssl/src/apps/dgst.c b/src/lib/libssl/src/apps/dgst.c
index 5f0506ed8c..1b56d6ef44 100644
--- a/src/lib/libssl/src/apps/dgst.c
+++ b/src/lib/libssl/src/apps/dgst.c
@@ -74,6 +74,9 @@
 #define PROG    dgst_main
 
 void do_fp(unsigned char *buf,BIO *f,int sep);
+
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         unsigned char *buf=NULL;
diff --git a/src/lib/libssl/src/apps/dh.c b/src/lib/libssl/src/apps/dh.c
index 9efdcd78a3..b3c20e2b5c 100644
--- a/src/lib/libssl/src/apps/dh.c
+++ b/src/lib/libssl/src/apps/dh.c
@@ -72,7 +72,7 @@
 #undef PROG
 #define PROG    dh_main
 
-/* -inform arg  - input format - default PEM (one of DER, TXT or PEM)
+/* -inform arg  - input format - default PEM (DER or PEM)
  * -outform arg - output format - default PEM
  * -in arg      - input file - default stdin
  * -out arg     - output file - default stdout
@@ -82,6 +82,8 @@
  * -C
  */
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         DH *dh=NULL;
@@ -149,8 +151,8 @@ int MAIN(int argc, char **argv)
 bad:
                 BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
                 BIO_printf(bio_err,"where options are\n");
-                BIO_printf(bio_err," -inform arg   input format - one of DER TXT PEM\n");
-                BIO_printf(bio_err," -outform arg  output format - one of DER TXT PEM\n");
+                BIO_printf(bio_err," -inform arg   input format - one of DER PEM\n");
+                BIO_printf(bio_err," -outform arg  output format - one of DER PEM\n");
                 BIO_printf(bio_err," -in arg       input file\n");
                 BIO_printf(bio_err," -out arg      output file\n");
                 BIO_printf(bio_err," -check        check the DH parameters\n");
@@ -219,7 +221,7 @@ bad:
                 BN_print(stdout,dh->g);
                 printf("\n");
                 if (dh->length != 0)
-                        printf("recomented private length=%ld\n",dh->length);
+                        printf("recommended private length=%ld\n",dh->length);
 #endif
                 }
         
@@ -282,6 +284,7 @@ bad:
                 printf("\tif ((dh->p == NULL) || (dh->g == NULL))\n");
                 printf("\t\treturn(NULL);\n");
                 printf("\treturn(dh);\n\t}\n");
+                Free(data);
                 }
 
 
@@ -297,7 +300,7 @@ bad:
                         }
                 if (!i)
                         {
-                        BIO_printf(bio_err,"unable to write DH paramaters\n");
+                        BIO_printf(bio_err,"unable to write DH parameters\n");
                         ERR_print_errors(bio_err);
                         goto end;
                         }
diff --git a/src/lib/libssl/src/apps/dhparam.c b/src/lib/libssl/src/apps/dhparam.c
new file mode 100644
index 0000000000..293a400d0c
--- /dev/null
+++ b/src/lib/libssl/src/apps/dhparam.c
@@ -0,0 +1,368 @@
+/* apps/dhparam.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#ifndef NO_DH
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <string.h>
+#include "apps.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/bn.h>
+#include <openssl/dh.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+
+#undef PROG
+#define PROG    dhparam_main
+
+#define DEFBITS 512
+
+/* -inform arg  - input format - default PEM (DER or PEM)
+ * -outform arg - output format - default PEM
+ * -in arg      - input file - default stdin
+ * -out arg     - output file - default stdout
+ * -check       - check the parameters are ok
+ * -noout
+ * -text
+ * -C
+ */
+
+static void MS_CALLBACK dh_cb(int p, int n, void *arg);
+
+int MAIN(int, char **);
+
+int MAIN(int argc, char **argv)
+        {
+        DH *dh=NULL;
+        int i,badops=0,text=0;
+        BIO *in=NULL,*out=NULL;
+        int informat,outformat,check=0,noout=0,C=0,ret=1;
+        char *infile,*outfile,*prog;
+        char *inrand=NULL;
+        int num = 0, g = 0;
+
+        apps_startup();
+
+        if (bio_err == NULL)
+                if ((bio_err=BIO_new(BIO_s_file())) != NULL)
+                        BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
+
+        infile=NULL;
+        outfile=NULL;
+        informat=FORMAT_PEM;
+        outformat=FORMAT_PEM;
+
+        prog=argv[0];
+        argc--;
+        argv++;
+        while (argc >= 1)
+                {
+                if      (strcmp(*argv,"-inform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        informat=str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-outform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        outformat=str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-in") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        infile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-out") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        outfile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-check") == 0)
+                        check=1;
+                else if (strcmp(*argv,"-text") == 0)
+                        text=1;
+                else if (strcmp(*argv,"-C") == 0)
+                        C=1;
+                else if (strcmp(*argv,"-noout") == 0)
+                        noout=1;
+                else if (strcmp(*argv,"-2") == 0)
+                        g=2;
+                else if (strcmp(*argv,"-5") == 0)
+                        g=5;
+                else if (strcmp(*argv,"-rand") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        inrand= *(++argv);
+                        }
+                else if (((sscanf(*argv,"%d",&num) == 0) || (num <= 0)))
+                        goto bad;
+                argv++;
+                argc--;
+                }
+
+        if (badops)
+                {
+bad:
+                BIO_printf(bio_err,"%s [options] [numbits]\n",prog);
+                BIO_printf(bio_err,"where options are\n");
+                BIO_printf(bio_err," -inform arg   input format - one of DER PEM\n");
+                BIO_printf(bio_err," -outform arg  output format - one of DER PEM\n");
+                BIO_printf(bio_err," -in arg       input file\n");
+                BIO_printf(bio_err," -out arg      output file\n");
+                BIO_printf(bio_err," -check        check the DH parameters\n");
+                BIO_printf(bio_err," -text         print a text form of the DH parameters\n");
+                BIO_printf(bio_err," -C            Output C code\n");
+                BIO_printf(bio_err," -2            generate parameters using  2 as the generator value\n");
+                BIO_printf(bio_err," -5            generate parameters using  5 as the generator value\n");
+                BIO_printf(bio_err," numbits       number of bits in to generate (default 512)\n");
+                BIO_printf(bio_err," -rand file:file:...\n");
+                BIO_printf(bio_err,"               - load the file (or the files in the directory) into\n");
+                BIO_printf(bio_err,"               the random number generator\n");
+                BIO_printf(bio_err," -noout        no output\n");
+                goto end;
+                }
+
+        ERR_load_crypto_strings();
+
+        if(g && !num) num = DEFBITS;
+        else if(num && !g) g = 2;
+
+        if(num) {
+
+                if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL)
+                        {
+                        BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
+                        }
+                if (inrand != NULL)
+                        BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                                app_RAND_load_files(inrand));
+
+                BIO_printf(bio_err,"Generating DH parameters, %d bit long strong prime, generator of %d\n",num,g);
+                BIO_printf(bio_err,"This is going to take a long time\n");
+                dh=DH_generate_parameters(num,g,dh_cb,bio_err);
+                        
+                if (dh == NULL) goto end;
+
+                app_RAND_write_file(NULL, bio_err);
+        } else {
+
+                in=BIO_new(BIO_s_file());
+                if (in == NULL)
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                if (infile == NULL)
+                        BIO_set_fp(in,stdin,BIO_NOCLOSE);
+                else
+                        {
+                        if (BIO_read_filename(in,infile) <= 0)
+                                {
+                                perror(infile);
+                                goto end;
+                                }
+                        }
+
+                if      (informat == FORMAT_ASN1)
+                        dh=d2i_DHparams_bio(in,NULL);
+                else if (informat == FORMAT_PEM)
+                        dh=PEM_read_bio_DHparams(in,NULL,NULL,NULL);
+                else
+                        {
+                        BIO_printf(bio_err,"bad input format specified\n");
+                        goto end;
+                        }
+                if (dh == NULL)
+                        {
+                        BIO_printf(bio_err,"unable to load DH parameters\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+
+        }
+
+        out=BIO_new(BIO_s_file());
+        if (out == NULL)
+                {
+                ERR_print_errors(bio_err);
+                goto end;
+                }
+        if (outfile == NULL)
+                BIO_set_fp(out,stdout,BIO_NOCLOSE);
+        else
+                {
+                if (BIO_write_filename(out,outfile) <= 0)
+                        {
+                        perror(outfile);
+                        goto end;
+                        }
+                }
+
+        
+
+        if (text)
+                {
+                DHparams_print(out,dh);
+                }
+        
+        if (check)
+                {
+                if (!DH_check(dh,&i))
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                if (i & DH_CHECK_P_NOT_PRIME)
+                        printf("p value is not prime\n");
+                if (i & DH_CHECK_P_NOT_STRONG_PRIME)
+                        printf("p value is not a strong prime\n");
+                if (i & DH_UNABLE_TO_CHECK_GENERATOR)
+                        printf("unable to check the generator value\n");
+                if (i & DH_NOT_SUITABLE_GENERATOR)
+                        printf("the g value is not a generator\n");
+                if (i == 0)
+                        printf("DH parameters appear to be ok.\n");
+                }
+        if (C)
+                {
+                unsigned char *data;
+                int len,l,bits;
+
+                len=BN_num_bytes(dh->p);
+                bits=BN_num_bits(dh->p);
+                data=(unsigned char *)Malloc(len);
+                if (data == NULL)
+                        {
+                        perror("Malloc");
+                        goto end;
+                        }
+                l=BN_bn2bin(dh->p,data);
+                printf("static unsigned char dh%d_p[]={",bits);
+                for (i=0; i<l; i++)
+                        {
+                        if ((i%12) == 0) printf("\n\t");
+                        printf("0x%02X,",data[i]);
+                        }
+                printf("\n\t};\n");
+
+                l=BN_bn2bin(dh->g,data);
+                printf("static unsigned char dh%d_g[]={",bits);
+                for (i=0; i<l; i++)
+                        {
+                        if ((i%12) == 0) printf("\n\t");
+                        printf("0x%02X,",data[i]);
+                        }
+                printf("\n\t};\n\n");
+
+                printf("DH *get_dh%d()\n\t{\n",bits);
+                printf("\tDH *dh;\n\n");
+                printf("\tif ((dh=DH_new()) == NULL) return(NULL);\n");
+                printf("\tdh->p=BN_bin2bn(dh%d_p,sizeof(dh%d_p),NULL);\n",
+                        bits,bits);
+                printf("\tdh->g=BN_bin2bn(dh%d_g,sizeof(dh%d_g),NULL);\n",
+                        bits,bits);
+                printf("\tif ((dh->p == NULL) || (dh->g == NULL))\n");
+                printf("\t\treturn(NULL);\n");
+                printf("\treturn(dh);\n\t}\n");
+                Free(data);
+                }
+
+
+        if (!noout)
+                {
+                if      (outformat == FORMAT_ASN1)
+                        i=i2d_DHparams_bio(out,dh);
+                else if (outformat == FORMAT_PEM)
+                        i=PEM_write_bio_DHparams(out,dh);
+                else    {
+                        BIO_printf(bio_err,"bad output format specified for outfile\n");
+                        goto end;
+                        }
+                if (!i)
+                        {
+                        BIO_printf(bio_err,"unable to write DH parameters\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                }
+        ret=0;
+end:
+        if (in != NULL) BIO_free(in);
+        if (out != NULL) BIO_free(out);
+        if (dh != NULL) DH_free(dh);
+        EXIT(ret);
+        }
+
+static void MS_CALLBACK dh_cb(int p, int n, void *arg)
+        {
+        char c='*';
+
+        if (p == 0) c='.';
+        if (p == 1) c='+';
+        if (p == 2) c='*';
+        if (p == 3) c='\n';
+        BIO_write((BIO *)arg,&c,1);
+        (void)BIO_flush((BIO *)arg);
+#ifdef LINT
+        p=n;
+#endif
+        }
+
+#endif
diff --git a/src/lib/libssl/src/apps/dsa.c b/src/lib/libssl/src/apps/dsa.c
index fedecf2739..4977671b8a 100644
--- a/src/lib/libssl/src/apps/dsa.c
+++ b/src/lib/libssl/src/apps/dsa.c
@@ -83,6 +83,8 @@
  * -modulus     - print the DSA public key
  */
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int ret=1;
@@ -91,7 +93,10 @@ int MAIN(int argc, char **argv)
         const EVP_CIPHER *enc=NULL;
         BIO *in=NULL,*out=NULL;
         int informat,outformat,text=0,noout=0;
+        int pubin = 0, pubout = 0;
         char *infile,*outfile,*prog;
+        char *passargin = NULL, *passargout = NULL;
+        char *passin = NULL, *passout = NULL;
         int modulus=0;
 
         apps_startup();
@@ -130,12 +135,26 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         outfile= *(++argv);
                         }
+                else if (strcmp(*argv,"-passin") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargin= *(++argv);
+                        }
+                else if (strcmp(*argv,"-passout") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargout= *(++argv);
+                        }
                 else if (strcmp(*argv,"-noout") == 0)
                         noout=1;
                 else if (strcmp(*argv,"-text") == 0)
                         text=1;
                 else if (strcmp(*argv,"-modulus") == 0)
                         modulus=1;
+                else if (strcmp(*argv,"-pubin") == 0)
+                        pubin=1;
+                else if (strcmp(*argv,"-pubout") == 0)
+                        pubout=1;
                 else if ((enc=EVP_get_cipherbyname(&(argv[0][1]))) == NULL)
                         {
                         BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -151,23 +170,30 @@ int MAIN(int argc, char **argv)
 bad:
                 BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
                 BIO_printf(bio_err,"where options are\n");
-                BIO_printf(bio_err," -inform arg   input format - one of DER NET PEM\n");
-                BIO_printf(bio_err," -outform arg  output format - one of DER NET PEM\n");
-                BIO_printf(bio_err," -in arg       input file\n");
-                BIO_printf(bio_err," -out arg      output file\n");
-                BIO_printf(bio_err," -des          encrypt PEM output with cbc des\n");
-                BIO_printf(bio_err," -des3         encrypt PEM output with ede cbc des using 168 bit key\n");
+                BIO_printf(bio_err," -inform arg     input format - DER or PEM\n");
+                BIO_printf(bio_err," -outform arg    output format - DER or PEM\n");
+                BIO_printf(bio_err," -in arg         input file\n");
+                BIO_printf(bio_err," -passin arg     input file pass phrase source\n");
+                BIO_printf(bio_err," -out arg        output file\n");
+                BIO_printf(bio_err," -passout arg    output file pass phrase source\n");
+                BIO_printf(bio_err," -des            encrypt PEM output with cbc des\n");
+                BIO_printf(bio_err," -des3           encrypt PEM output with ede cbc des using 168 bit key\n");
 #ifndef NO_IDEA
-                BIO_printf(bio_err," -idea         encrypt PEM output with cbc idea\n");
+                BIO_printf(bio_err," -idea           encrypt PEM output with cbc idea\n");
 #endif
-                BIO_printf(bio_err," -text         print the key in text\n");
-                BIO_printf(bio_err," -noout        don't print key out\n");
-                BIO_printf(bio_err," -modulus      print the DSA public value\n");
+                BIO_printf(bio_err," -text           print the key in text\n");
+                BIO_printf(bio_err," -noout          don't print key out\n");
+                BIO_printf(bio_err," -modulus        print the DSA public value\n");
                 goto end;
                 }
 
         ERR_load_crypto_strings();
 
+        if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
+                BIO_printf(bio_err, "Error getting passwords\n");
+                goto end;
+        }
+
         in=BIO_new(BIO_s_file());
         out=BIO_new(BIO_s_file());
         if ((in == NULL) || (out == NULL))
@@ -187,19 +213,21 @@ bad:
                         }
                 }
 
-        BIO_printf(bio_err,"read DSA private key\n");
-        if      (informat == FORMAT_ASN1)
-                dsa=d2i_DSAPrivateKey_bio(in,NULL);
-        else if (informat == FORMAT_PEM)
-                dsa=PEM_read_bio_DSAPrivateKey(in,NULL,NULL,NULL);
-        else
+        BIO_printf(bio_err,"read DSA key\n");
+        if      (informat == FORMAT_ASN1) {
+                if(pubin) dsa=d2i_DSA_PUBKEY_bio(in,NULL);
+                else dsa=d2i_DSAPrivateKey_bio(in,NULL);
+        } else if (informat == FORMAT_PEM) {
+                if(pubin) dsa=PEM_read_bio_DSA_PUBKEY(in,NULL, NULL, NULL);
+                else dsa=PEM_read_bio_DSAPrivateKey(in,NULL,NULL,passin);
+        } else
                 {
                 BIO_printf(bio_err,"bad input format specified for key\n");
                 goto end;
                 }
         if (dsa == NULL)
                 {
-                BIO_printf(bio_err,"unable to load Private Key\n");
+                BIO_printf(bio_err,"unable to load Key\n");
                 ERR_print_errors(bio_err);
                 goto end;
                 }
@@ -231,12 +259,16 @@ bad:
                 }
 
         if (noout) goto end;
-        BIO_printf(bio_err,"writing DSA private key\n");
-        if      (outformat == FORMAT_ASN1)
-                i=i2d_DSAPrivateKey_bio(out,dsa);
-        else if (outformat == FORMAT_PEM)
-                i=PEM_write_bio_DSAPrivateKey(out,dsa,enc,NULL,0,NULL,NULL);
-        else    {
+        BIO_printf(bio_err,"writing DSA key\n");
+        if      (outformat == FORMAT_ASN1) {
+                if(pubin || pubout) i=i2d_DSA_PUBKEY_bio(out,dsa);
+                else i=i2d_DSAPrivateKey_bio(out,dsa);
+        } else if (outformat == FORMAT_PEM) {
+                if(pubin || pubout)
+                        i=PEM_write_bio_DSA_PUBKEY(out,dsa);
+                else i=PEM_write_bio_DSAPrivateKey(out,dsa,enc,
+                                                        NULL,0,NULL, passout);
+        } else {
                 BIO_printf(bio_err,"bad output format specified for outfile\n");
                 goto end;
                 }
@@ -248,9 +280,11 @@ bad:
         else
                 ret=0;
 end:
-        if (in != NULL) BIO_free(in);
-        if (out != NULL) BIO_free(out);
-        if (dsa != NULL) DSA_free(dsa);
+        if(in != NULL) BIO_free(in);
+        if(out != NULL) BIO_free(out);
+        if(dsa != NULL) DSA_free(dsa);
+        if(passin) Free(passin);
+        if(passout) Free(passout);
         EXIT(ret);
         }
 #endif
diff --git a/src/lib/libssl/src/apps/dsaparam.c b/src/lib/libssl/src/apps/dsaparam.c
index fb8d471108..4d4e1ad2b5 100644
--- a/src/lib/libssl/src/apps/dsaparam.c
+++ b/src/lib/libssl/src/apps/dsaparam.c
@@ -57,6 +57,7 @@
  */
 
 #ifndef NO_DSA
+#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>
@@ -65,7 +66,6 @@
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/bn.h>
-#include <openssl/rand.h>
 #include <openssl/dsa.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
@@ -73,7 +73,7 @@
 #undef PROG
 #define PROG    dsaparam_main
 
-/* -inform arg  - input format - default PEM (one of DER, TXT or PEM)
+/* -inform arg  - input format - default PEM (DER or PEM)
  * -outform arg - output format - default PEM
  * -in arg      - input file - default stdin
  * -out arg     - output file - default stdout
@@ -84,7 +84,10 @@
  * -genkey
  */
 
-static void MS_CALLBACK dsa_cb(int p, int n, char *arg);
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg);
+
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         DSA *dsa=NULL;
@@ -93,7 +96,7 @@ int MAIN(int argc, char **argv)
         int informat,outformat,noout=0,C=0,ret=1;
         char *infile,*outfile,*prog,*inrand=NULL;
         int numbits= -1,num,genkey=0;
-        char buffer[200],*randfile=NULL;
+        int need_rand=0;
 
         apps_startup();
 
@@ -136,11 +139,15 @@ int MAIN(int argc, char **argv)
                 else if (strcmp(*argv,"-C") == 0)
                         C=1;
                 else if (strcmp(*argv,"-genkey") == 0)
+                        {
                         genkey=1;
+                        need_rand=1;
+                        }
                 else if (strcmp(*argv,"-rand") == 0)
                         {
                         if (--argc < 1) goto bad;
                         inrand= *(++argv);
+                        need_rand=1;
                         }
                 else if (strcmp(*argv,"-noout") == 0)
                         noout=1;
@@ -148,6 +155,7 @@ int MAIN(int argc, char **argv)
                         {
                         /* generate a key */
                         numbits=num;
+                        need_rand=1;
                         }
                 else
                         {
@@ -164,11 +172,11 @@ int MAIN(int argc, char **argv)
 bad:
                 BIO_printf(bio_err,"%s [options] [bits] <infile >outfile\n",prog);
                 BIO_printf(bio_err,"where options are\n");
-                BIO_printf(bio_err," -inform arg   input format - one of DER TXT PEM\n");
-                BIO_printf(bio_err," -outform arg  output format - one of DER TXT PEM\n");
+                BIO_printf(bio_err," -inform arg   input format - DER or PEM\n");
+                BIO_printf(bio_err," -outform arg  output format - DER or PEM\n");
                 BIO_printf(bio_err," -in arg       input file\n");
                 BIO_printf(bio_err," -out arg      output file\n");
-                BIO_printf(bio_err," -text         check the DSA parameters\n");
+                BIO_printf(bio_err," -text         print the key in text\n");
                 BIO_printf(bio_err," -C            Output C code\n");
                 BIO_printf(bio_err," -noout        no output\n");
                 BIO_printf(bio_err," -rand         files to use for random number input\n");
@@ -207,15 +215,20 @@ bad:
                         }
                 }
 
-        if (numbits > 0)
+        if (need_rand)
                 {
-                randfile=RAND_file_name(buffer,200);
-                RAND_load_file(randfile,1024L*1024L);
+                app_RAND_load_file(NULL, bio_err, (inrand != NULL));
+                if (inrand != NULL)
+                        BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                                app_RAND_load_files(inrand));
+                }
 
+        if (numbits > 0)
+                {
+                assert(need_rand);
                 BIO_printf(bio_err,"Generating DSA parameters, %d bit long prime\n",num);
                 BIO_printf(bio_err,"This could take some time\n");
-                dsa=DSA_generate_parameters(num,NULL,0,NULL,NULL,
-                        dsa_cb,(char *)bio_err);
+                dsa=DSA_generate_parameters(num,NULL,0,NULL,NULL, dsa_cb,bio_err);
                 }
         else if (informat == FORMAT_ASN1)
                 dsa=d2i_DSAparams_bio(in,NULL);
@@ -307,7 +320,7 @@ bad:
                         }
                 if (!i)
                         {
-                        BIO_printf(bio_err,"unable to write DSA paramaters\n");
+                        BIO_printf(bio_err,"unable to write DSA parameters\n");
                         ERR_print_errors(bio_err);
                         goto end;
                         }
@@ -316,6 +329,7 @@ bad:
                 {
                 DSA *dsakey;
 
+                assert(need_rand);
                 if ((dsakey=DSAparams_dup(dsa)) == NULL) goto end;
                 if (!DSA_generate_key(dsakey)) goto end;
                 if      (outformat == FORMAT_ASN1)
@@ -328,6 +342,8 @@ bad:
                         }
                 DSA_free(dsakey);
                 }
+        if (need_rand)
+                app_RAND_write_file(NULL, bio_err);
         ret=0;
 end:
         if (in != NULL) BIO_free(in);
@@ -336,7 +352,7 @@ end:
         EXIT(ret);
         }
 
-static void MS_CALLBACK dsa_cb(int p, int n, char *arg)
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
         {
         char c='*';
 
@@ -344,8 +360,8 @@ static void MS_CALLBACK dsa_cb(int p, int n, char *arg)
         if (p == 1) c='+';
         if (p == 2) c='*';
         if (p == 3) c='\n';
-        BIO_write((BIO *)arg,&c,1);
-        (void)BIO_flush((BIO *)arg);
+        BIO_write(arg,&c,1);
+        (void)BIO_flush(arg);
 #ifdef LINT
         p=n;
 #endif
diff --git a/src/lib/libssl/src/apps/enc.c b/src/lib/libssl/src/apps/enc.c
index bce936a2fc..6531c58c54 100644
--- a/src/lib/libssl/src/apps/enc.c
+++ b/src/lib/libssl/src/apps/enc.c
@@ -65,6 +65,7 @@
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/rand.h>
 #ifndef NO_MD5
 #include <openssl/md5.h>
 #endif
@@ -79,17 +80,22 @@ int set_hex(char *in,unsigned char *out,int size);
 #define BSIZE   (8*1024)
 #define PROG    enc_main
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
+        static const char magic[]="Salted__";
+        char mbuf[8];   /* should be 1 smaller than magic */
         char *strbuf=NULL;
         unsigned char *buff=NULL,*bufsize=NULL;
         int bsize=BSIZE,verbose=0;
         int ret=1,inl;
         unsigned char key[24],iv[MD5_DIGEST_LENGTH];
-        char *str=NULL;
-        char *hkey=NULL,*hiv=NULL;
+        unsigned char salt[PKCS5_SALT_LEN];
+        char *str=NULL, *passarg = NULL, *pass = NULL;
+        char *hkey=NULL,*hiv=NULL,*hsalt = NULL;
         int enc=1,printkey=0,i,base64=0;
-        int debug=0,olb64=0;
+        int debug=0,olb64=0,nosalt=0;
         const EVP_CIPHER *cipher=NULL,*c;
         char *inf=NULL,*outf=NULL;
         BIO *in=NULL,*out=NULL,*b64=NULL,*benc=NULL,*rbio=NULL,*wbio=NULL;
@@ -130,14 +136,22 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         outf= *(++argv);
                         }
+                else if (strcmp(*argv,"-pass") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passarg= *(++argv);
+                        }
                 else if (strcmp(*argv,"-d") == 0)
                         enc=0;
                 else if (strcmp(*argv,"-p") == 0)
                         printkey=1;
                 else if (strcmp(*argv,"-v") == 0)
                         verbose=1;
-                else if ((strcmp(*argv,"-debug") == 0) ||
-                         (strcmp(*argv,"-d") == 0))
+                else if (strcmp(*argv,"-salt") == 0)
+                        nosalt=0;
+                else if (strcmp(*argv,"-nosalt") == 0)
+                        nosalt=1;
+                else if (strcmp(*argv,"-debug") == 0)
                         debug=1;
                 else if (strcmp(*argv,"-P") == 0)
                         printkey=2;
@@ -194,6 +208,11 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         hkey= *(++argv);
                         }
+                else if (strcmp(*argv,"-S") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        hsalt= *(++argv);
+                        }
                 else if (strcmp(*argv,"-iv") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -212,7 +231,8 @@ int MAIN(int argc, char **argv)
 bad:
                         BIO_printf(bio_err,"options are\n");
                         BIO_printf(bio_err,"%-14s input file\n","-in <file>");
-                        BIO_printf(bio_err,"%-14s output fileencrypt\n","-out <file>");
+                        BIO_printf(bio_err,"%-14s output file\n","-out <file>");
+                        BIO_printf(bio_err,"%-14s pass phrase source\n","-pass <arg>");
                         BIO_printf(bio_err,"%-14s encrypt\n","-e");
                         BIO_printf(bio_err,"%-14s decrypt\n","-d");
                         BIO_printf(bio_err,"%-14s base64 encode/decode, depending on encryption flag\n","-a/-base64");
@@ -233,7 +253,7 @@ bad:
                         BIO_printf(bio_err,"rc2     :128 bit key RC2 encryption\n");
 #endif
 #ifndef NO_BF
-                        BIO_printf(bio_err,"bf      :128 bit key BlowFish encryption\n");
+                        BIO_printf(bio_err,"bf      :128 bit key Blowfish encryption\n");
 #endif
 #ifndef NO_RC4
                         BIO_printf(bio_err," -%-5s :128 bit key RC4 encryption\n",
@@ -357,6 +377,14 @@ bad:
                         }
                 }
 
+        if(!str && passarg) {
+                if(!app_passwd(bio_err, passarg, NULL, &pass, NULL)) {
+                        BIO_printf(bio_err, "Error getting password\n");
+                        goto end;
+                }
+                str = pass;
+        }
+
         if ((str == NULL) && (cipher != NULL) && (hkey == NULL))
                 {
                 for (;;)
@@ -386,11 +414,83 @@ bad:
                         }
                 }
 
+
+        if (outf == NULL)
+                BIO_set_fp(out,stdout,BIO_NOCLOSE);
+        else
+                {
+                if (BIO_write_filename(out,outf) <= 0)
+                        {
+                        perror(outf);
+                        goto end;
+                        }
+                }
+
+        rbio=in;
+        wbio=out;
+
+        if (base64)
+                {
+                if ((b64=BIO_new(BIO_f_base64())) == NULL)
+                        goto end;
+                if (debug)
+                        {
+                        BIO_set_callback(b64,BIO_debug_callback);
+                        BIO_set_callback_arg(b64,bio_err);
+                        }
+                if (olb64)
+                        BIO_set_flags(b64,BIO_FLAGS_BASE64_NO_NL);
+                if (enc)
+                        wbio=BIO_push(b64,wbio);
+                else
+                        rbio=BIO_push(b64,rbio);
+                }
+
         if (cipher != NULL)
                 {
                 if (str != NULL)
                         {
-                        EVP_BytesToKey(cipher,EVP_md5(),NULL,
+                        /* Salt handling: if encrypting generate a salt and
+                         * write to output BIO. If decrypting read salt from
+                         * input BIO.
+                         */
+                        unsigned char *sptr;
+                        if(nosalt) sptr = NULL;
+                        else {
+                                if(enc) {
+                                        if(hsalt) {
+                                                if(!set_hex(hsalt,salt,PKCS5_SALT_LEN)) {
+                                                        BIO_printf(bio_err,
+                                                                "invalid hex salt value\n");
+                                                        goto end;
+                                                }
+                                        } else if (RAND_pseudo_bytes(salt, PKCS5_SALT_LEN) < 0)
+                                                goto end;
+                                        /* If -P option then don't bother writing */
+                                        if((printkey != 2)
+                                           && (BIO_write(wbio,magic,
+                                                         sizeof magic-1) != sizeof magic-1
+                                               || BIO_write(wbio,
+                                                            (char *)salt,
+                                                            PKCS5_SALT_LEN) != PKCS5_SALT_LEN)) {
+                                                BIO_printf(bio_err,"error writing output file\n");
+                                                goto end;
+                                        }
+                                } else if(BIO_read(rbio,mbuf,sizeof mbuf) != sizeof mbuf
+                                          || BIO_read(rbio,
+                                                      (unsigned char *)salt,
+                                    PKCS5_SALT_LEN) != PKCS5_SALT_LEN) {
+                                        BIO_printf(bio_err,"error reading input file\n");
+                                        goto end;
+                                } else if(memcmp(mbuf,magic,sizeof magic-1)) {
+                                    BIO_printf(bio_err,"bad magic number\n");
+                                    goto end;
+                                }
+
+                                sptr = salt;
+                        }
+
+                        EVP_BytesToKey(cipher,EVP_md5(),sptr,
                                 (unsigned char *)str,
                                 strlen(str),1,key,iv);
                         /* zero the complete buffer or the string
@@ -424,6 +524,13 @@ bad:
 
                 if (printkey)
                         {
+                        if (!nosalt)
+                                {
+                                printf("salt=");
+                                for (i=0; i<PKCS5_SALT_LEN; i++)
+                                        printf("%02X",salt[i]);
+                                printf("\n");
+                                }
                         if (cipher->key_len > 0)
                                 {
                                 printf("key=");
@@ -446,38 +553,6 @@ bad:
                         }
                 }
 
-
-        if (outf == NULL)
-                BIO_set_fp(out,stdout,BIO_NOCLOSE);
-        else
-                {
-                if (BIO_write_filename(out,outf) <= 0)
-                        {
-                        perror(outf);
-                        goto end;
-                        }
-                }
-
-        rbio=in;
-        wbio=out;
-
-        if (base64)
-                {
-                if ((b64=BIO_new(BIO_f_base64())) == NULL)
-                        goto end;
-                if (debug)
-                        {
-                        BIO_set_callback(b64,BIO_debug_callback);
-                        BIO_set_callback_arg(b64,bio_err);
-                        }
-                if (olb64)
-                        BIO_set_flags(b64,BIO_FLAGS_BASE64_NO_NL);
-                if (enc)
-                        wbio=BIO_push(b64,wbio);
-                else
-                        rbio=BIO_push(b64,rbio);
-                }
-
         /* Only encrypt/decrypt as we write the file */
         if (benc != NULL)
                 wbio=BIO_push(benc,wbio);
@@ -505,12 +580,14 @@ bad:
                 BIO_printf(bio_err,"bytes written:%8ld\n",BIO_number_written(out));
                 }
 end:
+        ERR_print_errors(bio_err);
         if (strbuf != NULL) Free(strbuf);
         if (buff != NULL) Free(buff);
         if (in != NULL) BIO_free(in);
         if (out != NULL) BIO_free(out);
         if (benc != NULL) BIO_free(benc);
         if (b64 != NULL) BIO_free(b64);
+        if(pass) Free(pass);
         EXIT(ret);
         }
 
diff --git a/src/lib/libssl/src/apps/errstr.c b/src/lib/libssl/src/apps/errstr.c
index c86b5d940b..4650379589 100644
--- a/src/lib/libssl/src/apps/errstr.c
+++ b/src/lib/libssl/src/apps/errstr.c
@@ -68,6 +68,8 @@
 #undef PROG
 #define PROG    errstr_main
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int i,ret=0;
diff --git a/src/lib/libssl/src/apps/gendh.c b/src/lib/libssl/src/apps/gendh.c
index 3d50948580..1f6be96599 100644
--- a/src/lib/libssl/src/apps/gendh.c
+++ b/src/lib/libssl/src/apps/gendh.c
@@ -75,15 +75,16 @@
 #define PROG gendh_main
 
 static void MS_CALLBACK dh_cb(int p, int n, void *arg);
-static long dh_load_rand(char *names);
+
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
-        char buffer[200];
         DH *dh=NULL;
         int ret=1,num=DEFBITS;
         int g=2;
         char *outfile=NULL;
-        char *inrand=NULL,*randfile;
+        char *inrand=NULL;
         BIO *out=NULL;
 
         apps_startup();
@@ -150,17 +151,13 @@ bad:
                         }
                 }
 
-        randfile=RAND_file_name(buffer,200);
-        if ((randfile == NULL)|| !RAND_load_file(randfile,1024L*1024L))
-                BIO_printf(bio_err,"unable to load 'random state'\n");
-
-        if (inrand == NULL)
-                BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
-        else
+        if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL)
                 {
-                BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
-                        dh_load_rand(inrand));
+                BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
                 }
+        if (inrand != NULL)
+                BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                        app_RAND_load_files(inrand));
 
         BIO_printf(bio_err,"Generating DH parameters, %d bit long strong prime, generator of %d\n",num,g);
         BIO_printf(bio_err,"This is going to take a long time\n");
@@ -168,10 +165,7 @@ bad:
                 
         if (dh == NULL) goto end;
 
-        if (randfile == NULL)
-                BIO_printf(bio_err,"unable to write 'random state'\n");
-        else
-                RAND_write_file(randfile);
+        app_RAND_write_file(NULL, bio_err);
 
         if (!PEM_write_bio_DHparams(out,dh))
                 goto end;
@@ -198,26 +192,4 @@ static void MS_CALLBACK dh_cb(int p, int n, void *arg)
         p=n;
 #endif
         }
-
-static long dh_load_rand(char *name)
-        {
-        char *p,*n;
-        int last;
-        long tot=0;
-
-        for (;;)
-                {
-                last=0;
-                for (p=name; ((*p != '\0') && (*p != LIST_SEPARATOR_CHAR)); p++);
-                if (*p == '\0') last=1;
-                *p='\0';
-                n=name;
-                name=p+1;
-                if (*n == '\0') break;
-
-                tot+=RAND_load_file(n,1);
-                if (last) break;
-                }
-        return(tot);
-        }
 #endif
diff --git a/src/lib/libssl/src/apps/gendsa.c b/src/lib/libssl/src/apps/gendsa.c
index 5f00b89bb0..d69a93da45 100644
--- a/src/lib/libssl/src/apps/gendsa.c
+++ b/src/lib/libssl/src/apps/gendsa.c
@@ -63,7 +63,6 @@
 #include <sys/stat.h>
 #include "apps.h"
 #include <openssl/bio.h>
-#include <openssl/rand.h>
 #include <openssl/err.h>
 #include <openssl/bn.h>
 #include <openssl/dsa.h>
@@ -74,14 +73,15 @@
 #undef PROG
 #define PROG gendsa_main
 
-static long dsa_load_rand(char *names);
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
-        char buffer[200];
         DSA *dsa=NULL;
         int ret=1;
         char *outfile=NULL;
-        char *inrand=NULL,*randfile,*dsaparams=NULL;
+        char *inrand=NULL,*dsaparams=NULL;
+        char *passargout = NULL, *passout = NULL;
         BIO *out=NULL,*in=NULL;
         EVP_CIPHER *enc=NULL;
 
@@ -101,6 +101,11 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         outfile= *(++argv);
                         }
+                else if (strcmp(*argv,"-passout") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargout= *(++argv);
+                        }
                 else if (strcmp(*argv,"-rand") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -148,6 +153,12 @@ bad:
                 goto end;
                 }
 
+        if(!app_passwd(bio_err, NULL, passargout, NULL, &passout)) {
+                BIO_printf(bio_err, "Error getting password\n");
+                goto end;
+        }
+
+
         in=BIO_new(BIO_s_file());
         if (!(BIO_read_filename(in,dsaparams)))
                 {
@@ -161,6 +172,7 @@ bad:
                 goto end;
                 }
         BIO_free(in);
+        in = NULL;
                 
         out=BIO_new(BIO_s_file());
         if (out == NULL) goto end;
@@ -176,57 +188,30 @@ bad:
                         }
                 }
 
-        randfile=RAND_file_name(buffer,200);
-        if ((randfile == NULL)|| !RAND_load_file(randfile,1024L*1024L))
-                BIO_printf(bio_err,"unable to load 'random state'\n");
-
-        if (inrand == NULL)
-                BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
-        else
+        if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL)
                 {
-                BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
-                        dsa_load_rand(inrand));
+                BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
                 }
+        if (inrand != NULL)
+                BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                        app_RAND_load_files(inrand));
 
         BIO_printf(bio_err,"Generating DSA key, %d bits\n",
                                                         BN_num_bits(dsa->p));
         if (!DSA_generate_key(dsa)) goto end;
 
-        if (randfile == NULL)
-                BIO_printf(bio_err,"unable to write 'random state'\n");
-        else
-                RAND_write_file(randfile);
+        app_RAND_write_file(NULL, bio_err);
 
-        if (!PEM_write_bio_DSAPrivateKey(out,dsa,enc,NULL,0,NULL,NULL))
+        if (!PEM_write_bio_DSAPrivateKey(out,dsa,enc,NULL,0,NULL, passout))
                 goto end;
         ret=0;
 end:
         if (ret != 0)
                 ERR_print_errors(bio_err);
+        if (in != NULL) BIO_free(in);
         if (out != NULL) BIO_free(out);
         if (dsa != NULL) DSA_free(dsa);
+        if(passout) Free(passout);
         EXIT(ret);
         }
-
-static long dsa_load_rand(char *name)
-        {
-        char *p,*n;
-        int last;
-        long tot=0;
-
-        for (;;)
-                {
-                last=0;
-                for (p=name; ((*p != '\0') && (*p != LIST_SEPARATOR_CHAR)); p++);
-                if (*p == '\0') last=1;
-                *p='\0';
-                n=name;
-                name=p+1;
-                if (*n == '\0') break;
-
-                tot+=RAND_load_file(n,1);
-                if (last) break;
-                }
-        return(tot);
-        }
 #endif
diff --git a/src/lib/libssl/src/apps/genrsa.c b/src/lib/libssl/src/apps/genrsa.c
index 67382065fb..dc63ff02bd 100644
--- a/src/lib/libssl/src/apps/genrsa.c
+++ b/src/lib/libssl/src/apps/genrsa.c
@@ -63,7 +63,6 @@
 #include <sys/stat.h>
 #include "apps.h"
 #include <openssl/bio.h>
-#include <openssl/rand.h>
 #include <openssl/err.h>
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
@@ -76,18 +75,20 @@
 #define PROG genrsa_main
 
 static void MS_CALLBACK genrsa_cb(int p, int n, void *arg);
-static long gr_load_rand(char *names);
+
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int ret=1;
-        char buffer[200];
         RSA *rsa=NULL;
         int i,num=DEFBITS;
-        long rnum=0,l;
+        long l;
         EVP_CIPHER *enc=NULL;
         unsigned long f4=RSA_F4;
         char *outfile=NULL;
-        char *inrand=NULL,*randfile;
+        char *passargout = NULL, *passout = NULL;
+        char *inrand=NULL;
         BIO *out=NULL;
 
         apps_startup();
@@ -97,7 +98,7 @@ int MAIN(int argc, char **argv)
                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
         if ((out=BIO_new(BIO_s_file())) == NULL)
                 {
-                BIO_printf(bio_err,"unable to creat BIO for output\n");
+                BIO_printf(bio_err,"unable to create BIO for output\n");
                 goto err;
                 }
 
@@ -130,6 +131,11 @@ int MAIN(int argc, char **argv)
                 else if (strcmp(*argv,"-idea") == 0)
                         enc=EVP_idea_cbc();
 #endif
+                else if (strcmp(*argv,"-passout") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargout= *(++argv);
+                        }
                 else
                         break;
                 argv++;
@@ -139,21 +145,28 @@ int MAIN(int argc, char **argv)
                 {
 bad:
                 BIO_printf(bio_err,"usage: genrsa [args] [numbits]\n");
-                BIO_printf(bio_err," -des      - encrypt the generated key with DES in cbc mode\n");
-                BIO_printf(bio_err," -des3     - encrypt the generated key with DES in ede cbc mode (168 bit key)\n");
+                BIO_printf(bio_err," -des            encrypt the generated key with DES in cbc mode\n");
+                BIO_printf(bio_err," -des3           encrypt the generated key with DES in ede cbc mode (168 bit key)\n");
 #ifndef NO_IDEA
-                BIO_printf(bio_err," -idea     - encrypt the generated key with IDEA in cbc mode\n");
+                BIO_printf(bio_err," -idea           encrypt the generated key with IDEA in cbc mode\n");
 #endif
-                BIO_printf(bio_err," -out file - output the key to 'file\n");
-                BIO_printf(bio_err," -f4       - use F4 (0x10001) for the E value\n");
-                BIO_printf(bio_err," -3        - use 3 for the E value\n");
+                BIO_printf(bio_err," -out file       output the key to 'file\n");
+                BIO_printf(bio_err," -passout arg    output file pass phrase source\n");
+                BIO_printf(bio_err," -f4             use F4 (0x10001) for the E value\n");
+                BIO_printf(bio_err," -3              use 3 for the E value\n");
                 BIO_printf(bio_err," -rand file:file:...\n");
-                BIO_printf(bio_err,"           - load the file (or the files in the directory) into\n");
-                BIO_printf(bio_err,"             the random number generator\n");
+                BIO_printf(bio_err,"                 load the file (or the files in the directory) into\n");
+                BIO_printf(bio_err,"                 the random number generator\n");
                 goto err;
                 }
                 
         ERR_load_crypto_strings();
+
+        if(!app_passwd(bio_err, NULL, passargout, NULL, &passout)) {
+                BIO_printf(bio_err, "Error getting password\n");
+                goto err;
+        }
+
         if (outfile == NULL)
                 BIO_set_fp(out,stdout,BIO_NOCLOSE);
         else
@@ -165,45 +178,23 @@ bad:
                         }
                 }
 
-#ifdef WINDOWS
-        BIO_printf(bio_err,"Loading 'screen' into random state -");
-        BIO_flush(bio_err);
-        RAND_screen();
-        BIO_printf(bio_err," done\n");
-#endif
-        randfile=RAND_file_name(buffer,200);
-        if ((randfile == NULL) ||
-                 !(rnum=(long)RAND_load_file(randfile,1024L*1024L)))
+        if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL)
                 {
-                BIO_printf(bio_err,"unable to load 'random state'\n");
+                BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
                 }
-
-        if (inrand == NULL)
-                {
-                if (rnum == 0)
-                        {
-                        BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
-                        }
-                }
-        else
-                {
-                rnum+=gr_load_rand(inrand);
-                }
-        if (rnum != 0)
-                BIO_printf(bio_err,"%ld semi-random bytes loaded\n",rnum);
+        if (inrand != NULL)
+                BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                        app_RAND_load_files(inrand));
 
         BIO_printf(bio_err,"Generating RSA private key, %d bit long modulus\n",
                 num);
         rsa=RSA_generate_key(num,f4,genrsa_cb,bio_err);
                 
-        if (randfile == NULL)
-                BIO_printf(bio_err,"unable to write 'random state'\n");
-        else
-                RAND_write_file(randfile);
+        app_RAND_write_file(NULL, bio_err);
 
         if (rsa == NULL) goto err;
         
-        /* We need to do the folloing for when the base number size is <
+        /* We need to do the following for when the base number size is <
          * long, esp windows 3.1 :-(. */
         l=0L;
         for (i=0; i<rsa->e->top; i++)
@@ -215,13 +206,14 @@ bad:
                 l+=rsa->e->d[i];
                 }
         BIO_printf(bio_err,"e is %ld (0x%lX)\n",l,l);
-        if (!PEM_write_bio_RSAPrivateKey(out,rsa,enc,NULL,0,NULL,NULL))
+        if (!PEM_write_bio_RSAPrivateKey(out,rsa,enc,NULL,0,NULL, passout))
                 goto err;
 
         ret=0;
 err:
         if (rsa != NULL) RSA_free(rsa);
         if (out != NULL) BIO_free(out);
+        if(passout) Free(passout);
         if (ret != 0)
                 ERR_print_errors(bio_err);
         EXIT(ret);
@@ -241,26 +233,10 @@ static void MS_CALLBACK genrsa_cb(int p, int n, void *arg)
         p=n;
 #endif
         }
+#else /* !NO_RSA */
 
-static long gr_load_rand(char *name)
-        {
-        char *p,*n;
-        int last;
-        long tot=0;
-
-        for (;;)
-                {
-                last=0;
-                for (p=name; ((*p != '\0') && (*p != LIST_SEPARATOR_CHAR)); p++);
-                if (*p == '\0') last=1;
-                *p='\0';
-                n=name;
-                name=p+1;
-                if (*n == '\0') break;
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
 
-                tot+=RAND_load_file(n,1024L*1024L);
-                if (last) break;
-                }
-        return(tot);
-        }
 #endif
diff --git a/src/lib/libssl/src/apps/makeapps.com b/src/lib/libssl/src/apps/makeapps.com
index 8a15a130ed..5ef6a8904e 100644
--- a/src/lib/libssl/src/apps/makeapps.com
+++ b/src/lib/libssl/src/apps/makeapps.com
@@ -79,7 +79,7 @@ $!
 $! Define what programs should be compiled
 $!
 $ PROGRAMS := OPENSSL
-$!$ PROGRAMS := VERIFY,ASN1PARS,REQ,DGST,DH,ENC,GENDH,ERRSTR,CA,CRL,-
+$!$ PROGRAMS := VERIFY,ASN1PARS,REQ,DGST,DH,ENC,PASSWD,GENDH,ERRSTR,CA,CRL,-
 $!            RSA,DSA,DSAPARAM,-
 $!            X509,GENRSA,GENDSA,S_SERVER,S_CLIENT,SPEED,-
 $!            S_TIME,VERSION,PKCS7,CRL2P7,SESS_ID,CIPHERS,NSEQ,
@@ -152,20 +152,18 @@ $ GOSUB CHECK_OPT_FILE
 $!
 $! Define The Application Files.
 $!
-$ LIB_FILES = "VERIFY;ASN1PARS;REQ;DGST;DH;ENC;GENDH;"+-
-              "ERRSTR;CA;"+-
-              "PKCS7;CRL2P7;CRL;"+-
+$ LIB_FILES = "VERIFY;ASN1PARS;REQ;DGST;DH;DHPARAM;ENC;PASSWD;GENDH;ERRSTR;"+-
+              "CA;PKCS7;CRL2P7;CRL;"+-
               "RSA;DSA;DSAPARAM;"+-
               "X509;GENRSA;GENDSA;S_SERVER;S_CLIENT;SPEED;"+-
-              "S_TIME;APPS;S_CB;S_SOCKET;VERSION;SESS_ID;"+-
-              "CIPHERS;NSEQ;PKCS12;PKCS8"
-$ APP_FILES := OPENSSL,'OBJ_DIR'VERIFY.OBJ,ASN1PARS.OBJ,REQ.OBJ,DGST.OBJ,DH.OBJ,ENC.OBJ,GENDH.OBJ,-
-               ERRSTR.OBJ,CA.OBJ,-
-               PKCS7.OBJ,CRL2P7.OBJ,CRL.OBJ,-
+              "S_TIME;APPS;S_CB;S_SOCKET;APP_RAND;VERSION;SESS_ID;"+-
+              "CIPHERS;NSEQ;PKCS12;PKCS8;SPKAC;SMIME"
+$ APP_FILES := OPENSSL,'OBJ_DIR'VERIFY.OBJ,ASN1PARS.OBJ,REQ.OBJ,DGST.OBJ,DH.OBJ,DHPARAM.OBJ,ENC.OBJ,PASSWD.OBJ,GENDH.OBJ,ERRSTR.OBJ,-
+               CA.OBJ,PKCS7.OBJ,CRL2P7.OBJ,CRL.OBJ,-
                RSA.OBJ,DSA.OBJ,DSAPARAM.OBJ,-
                X509.OBJ,GENRSA.OBJ,GENDSA.OBJ,S_SERVER.OBJ,S_CLIENT.OBJ,SPEED.OBJ,-
-               S_TIME.OBJ,APPS.OBJ,S_CB.OBJ,S_SOCKET.OBJ,VERSION.OBJ,SESS_ID.OBJ,-
-               CIPHERS.OBJ,NSEQ.OBJ,PKCS12.OBJ,PKCS8.OBJ
+               S_TIME.OBJ,APPS.OBJ,S_CB.OBJ,S_SOCKET.OBJ,APP_RAND.OBJ,VERSION.OBJ,SESS_ID.OBJ,-
+               CIPHERS.OBJ,NSEQ.OBJ,PKCS12.OBJ,PKCS8.OBJ,SPKAC.OBJ,SMIME.OBJ
 $ TCPIP_PROGRAMS = ",,"
 $ IF COMPILER .EQS. "VAXC" THEN -
      TCPIP_PROGRAMS = ",OPENSSL,"
@@ -808,12 +806,36 @@ $!
 $! Set Up Initial CC Definitions, Possibly With User Ones
 $!
 $ CCDEFS = "VMS=1,MONOLITH"
+$ IF F$TRNLNM("OPENSSL_NO_ASM") THEN CCDEFS = CCDEFS + ",NO_ASM"
+$ IF F$TRNLNM("OPENSSL_NO_RSA") THEN CCDEFS = CCDEFS + ",NO_RSA"
+$ IF F$TRNLNM("OPENSSL_NO_DSA") THEN CCDEFS = CCDEFS + ",NO_DSA"
+$ IF F$TRNLNM("OPENSSL_NO_DH") THEN CCDEFS = CCDEFS + ",NO_DH"
+$ IF F$TRNLNM("OPENSSL_NO_MD2") THEN CCDEFS = CCDEFS + ",NO_MD2"
+$ IF F$TRNLNM("OPENSSL_NO_MD5") THEN CCDEFS = CCDEFS + ",NO_MD5"
+$ IF F$TRNLNM("OPENSSL_NO_RIPEMD") THEN CCDEFS = CCDEFS + ",NO_RIPEMD"
+$ IF F$TRNLNM("OPENSSL_NO_SHA") THEN CCDEFS = CCDEFS + ",NO_SHA"
+$ IF F$TRNLNM("OPENSSL_NO_SHA0") THEN CCDEFS = CCDEFS + ",NO_SHA0"
+$ IF F$TRNLNM("OPENSSL_NO_SHA1") THEN CCDEFS = CCDEFS + ",NO_SHA1"
+$ IF F$TRNLNM("OPENSSL_NO_DES")
+$ THEN
+$   CCDEFS = CCDEFS + ",NO_DES,NO_MDC2"
+$ ELSE
+$   IF F$TRNLNM("OPENSSL_NO_MDC2") THEN CCDEFS = CCDEFS + ",NO_MDC2"
+$ ENDIF
+$ IF F$TRNLNM("OPENSSL_NO_RC2") THEN CCDEFS = CCDEFS + ",NO_RC2"
+$ IF F$TRNLNM("OPENSSL_NO_RC4") THEN CCDEFS = CCDEFS + ",NO_RC4"
+$ IF F$TRNLNM("OPENSSL_NO_RC5") THEN CCDEFS = CCDEFS + ",NO_RC5"
+$ IF F$TRNLNM("OPENSSL_NO_IDEA") THEN CCDEFS = CCDEFS + ",NO_IDEA"
+$ IF F$TRNLNM("OPENSSL_NO_BF") THEN CCDEFS = CCDEFS + ",NO_BF"
+$ IF F$TRNLNM("OPENSSL_NO_CAST") THEN CCDEFS = CCDEFS + ",NO_CAST"
+$ IF F$TRNLNM("OPENSSL_NO_HMAC") THEN CCDEFS = CCDEFS + ",NO_HMAC"
+$ IF F$TRNLNM("OPENSSL_NO_SSL2") THEN CCDEFS = CCDEFS + ",NO_SSL2"
 $ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS
 $ CCEXTRAFLAGS = ""
 $ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS
-$ CCDISABLEWARNINGS = ""
+$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"
 $ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -
-        CCDISABLEWARNINGS = USER_CCDISABLEWARNINGS
+        CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS
 $!
 $!  Check To See If The User Entered A Valid Paramter.
 $!
diff --git a/src/lib/libssl/src/apps/nseq.c b/src/lib/libssl/src/apps/nseq.c
index d9d01659e7..cc88d50ceb 100644
--- a/src/lib/libssl/src/apps/nseq.c
+++ b/src/lib/libssl/src/apps/nseq.c
@@ -65,7 +65,7 @@
 #undef PROG
 #define PROG nseq_main
 
-static int dump_cert_text(BIO *out, X509 *x);
+int MAIN(int, char **);
 
 int MAIN(int argc, char **argv)
 {
@@ -158,17 +158,3 @@ end:
         EXIT(ret);
 }
 
-static int dump_cert_text(BIO *out, X509 *x)
-{
-        char buf[256];
-        X509_NAME_oneline(X509_get_subject_name(x),buf,256);
-        BIO_puts(out,"subject=");
-        BIO_puts(out,buf);
-
-        X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
-        BIO_puts(out,"\nissuer= ");
-        BIO_puts(out,buf);
-        BIO_puts(out,"\n");
-        return 0;
-}
-
diff --git a/src/lib/libssl/src/apps/openssl-vms.cnf b/src/lib/libssl/src/apps/openssl-vms.cnf
index 13d10f21ed..d4498713fa 100644
--- a/src/lib/libssl/src/apps/openssl-vms.cnf
+++ b/src/lib/libssl/src/apps/openssl-vms.cnf
@@ -86,6 +86,19 @@ distinguished_name	= req_distinguished_name
 attributes              = req_attributes
 x509_extensions = v3_ca # The extentions to add to the self signed cert
 
+# This sets the permitted types in a DirectoryString. There are several
+# options. 
+# default: PrintableString, T61String, BMPString.
+# pkix   : PrintableString, BMPString.
+# utf8only: only UTF8Strings.
+# nobmp : PrintableString, T61String (no BMPStrings).
+# MASK:XXXX a literal mask value.
+# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
+# so use this option with caution!
+dirstring_type = nobmp
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
 [ req_distinguished_name ]
 countryName                     = Country Name (2 letter code)
 countryName_default             = AU
@@ -170,7 +183,15 @@ authorityKeyIdentifier=keyid,issuer:always
 #nsCaPolicyUrl
 #nsSslServerName
 
-[ v3_ca]
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
 
 # Extensions for a typical CA
 
@@ -200,10 +221,11 @@ basicConstraints = CA:true
 # Copy issuer details
 # issuerAltName=issuer:copy
 
-# RAW DER hex encoding of an extension: beware experts only!
-# 1.2.3.5=RAW:02:03
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
 # You can even override a supported extension:
-# basicConstraints= critical, RAW:30:03:01:01:FF
+# basicConstraints= critical, DER:30:03:01:01:FF
 
 [ crl_ext ]
 
diff --git a/src/lib/libssl/src/apps/openssl.c b/src/lib/libssl/src/apps/openssl.c
index 9a337fb316..748c6ce71a 100644
--- a/src/lib/libssl/src/apps/openssl.c
+++ b/src/lib/libssl/src/apps/openssl.c
@@ -70,10 +70,10 @@
 #include <openssl/x509.h>
 #include <openssl/pem.h>
 #include <openssl/ssl.h>
-#define SSLEAY  /* turn off a few special case MONOLITH macros */
 #define USE_SOCKETS /* needed for the _O_BINARY defs in the MS world */
-#define SSLEAY_SRC
+#define OPENSSL_C /* tells apps.h to use complete apps_startup() */
 #include "apps.h"
+#include "progs.h"
 #include "s_apps.h"
 #include <openssl/err.h>
 
@@ -120,9 +120,6 @@ int main(int Argc, char *Argv[])
         arg.data=NULL;
         arg.count=0;
 
-        /* SSLeay_add_ssl_algorithms(); is called in apps_startup() */
-        apps_startup();
-
 #if defined(DEBUG) && !defined(WINDOWS) && !defined(MSDOS)
 #ifdef SIGBUS
         signal(SIGBUS,sig_stop);
@@ -132,12 +129,14 @@ int main(int Argc, char *Argv[])
 #endif
 #endif
 
+        CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+
+        apps_startup();
+
         if (bio_err == NULL)
                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 
-        CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
-
         ERR_load_crypto_strings();
 
         /* Lets load up our environment a little */
@@ -165,7 +164,7 @@ int main(int Argc, char *Argv[])
         program_name(Argv[0],pname,PROG_NAME_SIZE);
 
         f.name=pname;
-        fp=(FUNCTION *)lh_retrieve(prog,(char *)&f);
+        fp=(FUNCTION *)lh_retrieve(prog,&f);
         if (fp != NULL)
                 {
                 Argv[0]=pname;
@@ -236,6 +235,12 @@ end:
         EVP_cleanup();
         ERR_free_strings();
 
+#ifdef LEVITTE_DEBUG
+        CRYPTO_push_info("Just to make sure I get a memory leak I can see :-)");
+        (void)Malloc(1024);
+        CRYPTO_pop_info();
+#endif
+
         CRYPTO_mem_leaks(bio_err);
         if (bio_err != NULL)
                 {
@@ -257,7 +262,7 @@ static int do_cmd(LHASH *prog, int argc, char *argv[])
         if ((argc <= 0) || (argv[0] == NULL))
                 { ret=0; goto end; }
         f.name=argv[0];
-        fp=(FUNCTION *)lh_retrieve(prog,(char *)&f);
+        fp=(FUNCTION *)lh_retrieve(prog,&f);
         if (fp != NULL)
                 {
                 ret=fp->func(argc,argv);
@@ -356,7 +361,7 @@ static LHASH *prog_init(void)
         if ((ret=lh_new(hash,cmp)) == NULL) return(NULL);
 
         for (f=functions; f->name != NULL; f++)
-                lh_insert(ret,(char *)f);
+                lh_insert(ret,f);
         return(ret);
         }
 
@@ -369,5 +374,3 @@ static unsigned long MS_CALLBACK hash(FUNCTION *a)
         {
         return(lh_strhash(a->name));
         }
-
-#undef SSLEAY
diff --git a/src/lib/libssl/src/apps/openssl.cnf b/src/lib/libssl/src/apps/openssl.cnf
index d70dd25622..dbe8cbefe0 100644
--- a/src/lib/libssl/src/apps/openssl.cnf
+++ b/src/lib/libssl/src/apps/openssl.cnf
@@ -3,8 +3,13 @@
 # This is mostly being used for generation of certificate requests.
 #
 
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME                    = .
 RANDFILE                = $ENV::HOME/.rnd
-oid_file                = $ENV::HOME/.oid
+
+# Extra OBJECT IDENTIFIER info:
+#oid_file               = $ENV::HOME/.oid
 oid_section             = new_oids
 
 # To use this configuration file with the "-extfile" option of the
@@ -86,6 +91,22 @@ distinguished_name	= req_distinguished_name
 attributes              = req_attributes
 x509_extensions = v3_ca # The extentions to add to the self signed cert
 
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options. 
+# default: PrintableString, T61String, BMPString.
+# pkix   : PrintableString, BMPString.
+# utf8only: only UTF8Strings.
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
+# so use this option with caution!
+string_mask = nombstr
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
 [ req_distinguished_name ]
 countryName                     = Country Name (2 letter code)
 countryName_default             = AU
@@ -170,8 +191,16 @@ authorityKeyIdentifier=keyid,issuer:always
 #nsCaPolicyUrl
 #nsSslServerName
 
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
 [ v3_ca ]
 
+
 # Extensions for a typical CA
 
 
@@ -200,10 +229,11 @@ basicConstraints = CA:true
 # Copy issuer details
 # issuerAltName=issuer:copy
 
-# RAW DER hex encoding of an extension: beware experts only!
-# 1.2.3.5=RAW:02:03
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
 # You can even override a supported extension:
-# basicConstraints= critical, RAW:30:03:01:01:FF
+# basicConstraints= critical, DER:30:03:01:01:FF
 
 [ crl_ext ]
 
diff --git a/src/lib/libssl/src/apps/passwd.c b/src/lib/libssl/src/apps/passwd.c
new file mode 100644
index 0000000000..c7e21d2081
--- /dev/null
+++ b/src/lib/libssl/src/apps/passwd.c
@@ -0,0 +1,475 @@
+/* apps/passwd.c */
+
+#if defined NO_MD5 || defined CHARSET_EBCDIC
+# define NO_APR1
+#endif
+
+#if !defined(NO_DES) || !defined(NO_APR1)
+
+#include <assert.h>
+#include <string.h>
+
+#include "apps.h"
+
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/rand.h>
+
+#ifndef NO_DES
+# include <openssl/des.h>
+#endif
+#ifndef NO_APR1
+# include <openssl/md5.h>
+#endif
+
+
+#undef PROG
+#define PROG passwd_main
+
+
+static unsigned const char cov_2char[64]={
+        /* from crypto/des/fcrypt.c */
+        0x2E,0x2F,0x30,0x31,0x32,0x33,0x34,0x35,
+        0x36,0x37,0x38,0x39,0x41,0x42,0x43,0x44,
+        0x45,0x46,0x47,0x48,0x49,0x4A,0x4B,0x4C,
+        0x4D,0x4E,0x4F,0x50,0x51,0x52,0x53,0x54,
+        0x55,0x56,0x57,0x58,0x59,0x5A,0x61,0x62,
+        0x63,0x64,0x65,0x66,0x67,0x68,0x69,0x6A,
+        0x6B,0x6C,0x6D,0x6E,0x6F,0x70,0x71,0x72,
+        0x73,0x74,0x75,0x76,0x77,0x78,0x79,0x7A
+};
+
+static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
+        char *passwd, BIO *out, int quiet, int table, int reverse,
+        size_t pw_maxlen, int usecrypt, int useapr1);
+
+/* -crypt        - standard Unix password algorithm (default, only choice)
+ * -apr1         - MD5-based password algorithm
+ * -salt string  - salt
+ * -in file      - read passwords from file
+ * -stdin        - read passwords from stdin
+ * -quiet        - no warnings
+ * -table        - format output as table
+ * -reverse      - switch table columns
+ */
+
+int MAIN(int, char **);
+
+int MAIN(int argc, char **argv)
+        {
+        int ret = 1;
+        char *infile = NULL;
+        int in_stdin = 0;
+        char *salt = NULL, *passwd = NULL, **passwds = NULL;
+        char *salt_malloc = NULL, *passwd_malloc = NULL;
+        int pw_source_defined = 0;
+        BIO *in = NULL, *out = NULL;
+        int i, badopt, opt_done;
+        int passed_salt = 0, quiet = 0, table = 0, reverse = 0;
+        int usecrypt = 0, useapr1 = 0;
+        size_t pw_maxlen = 0;
+
+        apps_startup();
+
+        if (bio_err == NULL)
+                if ((bio_err=BIO_new(BIO_s_file())) != NULL)
+                        BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
+        out = BIO_new(BIO_s_file());
+        if (out == NULL)
+                goto err;
+        BIO_set_fp(out, stdout, BIO_NOCLOSE | BIO_FP_TEXT);
+
+        badopt = 0, opt_done = 0;
+        i = 0;
+        while (!badopt && !opt_done && argv[++i] != NULL)
+                {
+                if (strcmp(argv[i], "-crypt") == 0)
+                        usecrypt = 1;
+                else if (strcmp(argv[i], "-apr1") == 0)
+                        useapr1 = 1;
+                else if (strcmp(argv[i], "-salt") == 0)
+                        {
+                        if ((argv[i+1] != NULL) && (salt == NULL))
+                                {
+                                passed_salt = 1;
+                                salt = argv[++i];
+                                }
+                        else
+                                badopt = 1;
+                        }
+                else if (strcmp(argv[i], "-in") == 0)
+                        {
+                        if ((argv[i+1] != NULL) && !pw_source_defined)
+                                {
+                                pw_source_defined = 1;
+                                infile = argv[++i];
+                                }
+                        else
+                                badopt = 1;
+                        }
+                else if (strcmp(argv[i], "-stdin") == 0)
+                        {
+                        if (!pw_source_defined)
+                                {
+                                pw_source_defined = 1;
+                                in_stdin = 1;
+                                }
+                        else
+                                badopt = 1;
+                        }
+                else if (strcmp(argv[i], "-quiet") == 0)
+                        quiet = 1;
+                else if (strcmp(argv[i], "-table") == 0)
+                        table = 1;
+                else if (strcmp(argv[i], "-reverse") == 0)
+                        reverse = 1;
+                else if (argv[i][0] == '-')
+                        badopt = 1;
+                else if (!pw_source_defined)
+                        /* non-option arguments, use as passwords */
+                        {
+                        pw_source_defined = 1;
+                        passwds = &argv[i];
+                        opt_done = 1;
+                        }
+                else
+                        badopt = 1;
+                }
+
+        if (!usecrypt && !useapr1) /* use default */
+                usecrypt = 1;
+        if (usecrypt + useapr1 > 1) /* conflict */
+                badopt = 1;
+
+        /* reject unsupported algorithms */
+#ifdef NO_DES
+        if (usecrypt) badopt = 1;
+#endif
+#ifdef NO_APR1
+        if (useapr1) badopt = 1;
+#endif
+
+        if (badopt) 
+                {
+                BIO_printf(bio_err, "Usage: passwd [options] [passwords]\n");
+                BIO_printf(bio_err, "where options are\n");
+#ifndef NO_DES
+                BIO_printf(bio_err, "-crypt             standard Unix password algorithm (default)\n");
+#endif
+#ifndef NO_APR1
+                BIO_printf(bio_err, "-apr1              MD5-based password algorithm\n");
+#endif
+                BIO_printf(bio_err, "-salt string       use provided salt\n");
+                BIO_printf(bio_err, "-in file           read passwords from file\n");
+                BIO_printf(bio_err, "-stdin             read passwords from stdin\n");
+                BIO_printf(bio_err, "-quiet             no warnings\n");
+                BIO_printf(bio_err, "-table             format output as table\n");
+                BIO_printf(bio_err, "-reverse           switch table columns\n");
+                
+                goto err;
+                }
+
+        if ((infile != NULL) || in_stdin)
+                {
+                in = BIO_new(BIO_s_file());
+                if (in == NULL)
+                        goto err;
+                if (infile != NULL)
+                        {
+                        assert(in_stdin == 0);
+                        if (BIO_read_filename(in, infile) <= 0)
+                                goto err;
+                        }
+                else
+                        {
+                        assert(in_stdin);
+                        BIO_set_fp(in, stdin, BIO_NOCLOSE);
+                        }
+                }
+        
+        if (usecrypt)
+                pw_maxlen = 8;
+        else if (useapr1)
+                pw_maxlen = 256; /* arbitrary limit, should be enough for most passwords */
+
+        if (passwds == NULL)
+                {
+                /* no passwords on the command line */
+                passwd = passwd_malloc = Malloc(pw_maxlen + 1);
+                if (passwd_malloc == NULL)
+                        goto err;
+                }
+
+        if ((in == NULL) && (passwds == NULL))
+                {
+                /* build a null-terminated list */
+                static char *passwds_static[2] = {NULL, NULL};
+                
+                passwds = passwds_static;
+                if (in == NULL)
+                        if (EVP_read_pw_string(passwd_malloc, pw_maxlen + 1, "Password: ", 0) != 0)
+                                goto err;
+                passwds[0] = passwd_malloc;
+                }
+
+        if (in == NULL)
+                {
+                assert(passwds != NULL);
+                assert(*passwds != NULL);
+                
+                do /* loop over list of passwords */
+                        {
+                        passwd = *passwds++;
+                        if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, out,
+                                quiet, table, reverse, pw_maxlen, usecrypt, useapr1))
+                                goto err;
+                        }
+                while (*passwds != NULL);
+                }
+        else
+                /* in != NULL */
+                {
+                int done;
+
+                assert (passwd != NULL);
+                do
+                        {
+                        int r = BIO_gets(in, passwd, pw_maxlen + 1);
+                        if (r > 0)
+                                {
+                                char *c = (strchr(passwd, '\n')) ;
+                                if (c != NULL)
+                                        *c = 0; /* truncate at newline */
+                                else
+                                        {
+                                        /* ignore rest of line */
+                                        char trash[BUFSIZ];
+                                        do
+                                                r = BIO_gets(in, trash, sizeof trash);
+                                        while ((r > 0) && (!strchr(trash, '\n')));
+                                        }
+                                
+                                if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, out,
+                                        quiet, table, reverse, pw_maxlen, usecrypt, useapr1))
+                                        goto err;
+                                }
+                        done = (r <= 0);
+                        }
+                while (!done);
+                }
+
+err:
+        ERR_print_errors(bio_err);
+        if (salt_malloc)
+                Free(salt_malloc);
+        if (passwd_malloc)
+                Free(passwd_malloc);
+        if (in)
+                BIO_free(in);
+        if (out)
+                BIO_free(out);
+        EXIT(ret);
+        }
+
+
+#ifndef NO_APR1
+/* MD5-based password algorithm compatible to the one found in Apache
+ * (should probably be available as a library function;
+ * then the static buffer would not be acceptable) */
+static char *apr1_crypt(const char *passwd, const char *salt)
+        {
+        static char out_buf[6 + 9 + 24 + 2]; /* "$apr1$..salt..$.......md5hash..........\0" */
+        unsigned char buf[MD5_DIGEST_LENGTH];
+        char *salt_out;
+        int n, i;
+        MD5_CTX md;
+        size_t passwd_len, salt_len;
+
+        passwd_len = strlen(passwd);
+        strcpy(out_buf, "$apr1$");
+        strncat(out_buf, salt, 8);
+        assert(strlen(out_buf) <= 6 + 8); /* "$apr1$..salt.." */
+        salt_out = out_buf + 6;
+        salt_len = strlen(salt_out);
+        assert(salt_len <= 8);
+        
+        MD5_Init(&md);
+        MD5_Update(&md, passwd, passwd_len);
+        MD5_Update(&md, "$apr1$", 6);
+        MD5_Update(&md, salt_out, salt_len);
+        
+         {
+                MD5_CTX md2;
+
+                MD5_Init(&md2);
+                MD5_Update(&md2, passwd, passwd_len);
+                MD5_Update(&md2, salt_out, salt_len);
+                MD5_Update(&md2, passwd, passwd_len);
+                MD5_Final(buf, &md2);
+         }
+        for (i = passwd_len; i > sizeof buf; i -= sizeof buf)
+                MD5_Update(&md, buf, sizeof buf);
+        MD5_Update(&md, buf, i);
+        
+        n = passwd_len;
+        while (n)
+                {
+                MD5_Update(&md, (n & 1) ? "\0" : passwd, 1);
+                n >>= 1;
+                }
+        MD5_Final(buf, &md);
+
+        for (i = 0; i < 1000; i++)
+                {
+                MD5_CTX md2;
+
+                MD5_Init(&md2);
+                MD5_Update(&md2, (i & 1) ? (unsigned char *) passwd : buf,
+                                 (i & 1) ? passwd_len : sizeof buf);
+                if (i % 3)
+                        MD5_Update(&md2, salt_out, salt_len);
+                if (i % 7)
+                        MD5_Update(&md2, passwd, passwd_len);
+                MD5_Update(&md2, (i & 1) ? buf : (unsigned char *) passwd,
+                                 (i & 1) ? sizeof buf : passwd_len);
+                MD5_Final(buf, &md2);
+                }
+        
+         {
+                /* transform buf into output string */
+        
+                unsigned char buf_perm[sizeof buf];
+                int dest, source;
+                char *output;
+
+                /* silly output permutation */
+                for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
+                        buf_perm[dest] = buf[source];
+                buf_perm[14] = buf[5];
+                buf_perm[15] = buf[11];
+#ifndef PEDANTIC /* Unfortunately, this generates a "no effect" warning */
+                assert(16 == sizeof buf_perm);
+#endif
+                
+                output = salt_out + salt_len;
+                assert(output == out_buf + strlen(out_buf));
+                
+                *output++ = '$';
+
+                for (i = 0; i < 15; i += 3)
+                        {
+                        *output++ = cov_2char[buf_perm[i+2] & 0x3f];
+                        *output++ = cov_2char[((buf_perm[i+1] & 0xf) << 2) |
+                                                  (buf_perm[i+2] >> 6)];
+                        *output++ = cov_2char[((buf_perm[i] & 3) << 4) |
+                                                  (buf_perm[i+1] >> 4)];
+                        *output++ = cov_2char[buf_perm[i] >> 2];
+                        }
+                assert(i == 15);
+                *output++ = cov_2char[buf_perm[i] & 0x3f];
+                *output++ = cov_2char[buf_perm[i] >> 6];
+                *output = 0;
+                assert(strlen(out_buf) < sizeof(out_buf));
+         }
+
+        return out_buf;
+        }
+#endif
+
+
+static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
+        char *passwd, BIO *out, int quiet, int table, int reverse,
+        size_t pw_maxlen, int usecrypt, int useapr1)
+        {
+        char *hash = NULL;
+
+        assert(salt_p != NULL);
+        assert(salt_malloc_p != NULL);
+
+        /* first make sure we have a salt */
+        if (!passed_salt)
+                {
+#ifndef NO_DES
+                if (usecrypt)
+                        {
+                        if (*salt_malloc_p == NULL)
+                                {
+                                *salt_p = *salt_malloc_p = Malloc(3);
+                                if (*salt_malloc_p == NULL)
+                                        goto err;
+                                }
+                        if (RAND_pseudo_bytes((unsigned char *)*salt_p, 2) < 0)
+                                goto err;
+                        (*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f]; /* 6 bits */
+                        (*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f]; /* 6 bits */
+                        (*salt_p)[2] = 0;
+#ifdef CHARSET_EBCDIC
+                        ascii2ebcdic(*salt_p, *salt_p, 2); /* des_crypt will convert
+                                                            * back to ASCII */
+#endif
+                        }
+#endif /* !NO_DES */
+
+#ifndef NO_APR1
+                if (useapr1)
+                        {
+                        int i;
+                        
+                        if (*salt_malloc_p == NULL)
+                                {
+                                *salt_p = *salt_malloc_p = Malloc(9);
+                                if (*salt_malloc_p == NULL)
+                                        goto err;
+                                }
+                        if (RAND_pseudo_bytes((unsigned char *)*salt_p, 8) < 0)
+                                goto err;
+                        
+                        for (i = 0; i < 8; i++)
+                                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */
+                        (*salt_p)[8] = 0;
+                        }
+#endif /* !NO_APR1 */
+                }
+        
+        assert(*salt_p != NULL);
+        
+        /* truncate password if necessary */
+        if ((strlen(passwd) > pw_maxlen))
+                {
+                if (!quiet)
+                        BIO_printf(bio_err, "Warning: truncating password to %u characters\n", pw_maxlen);
+                passwd[pw_maxlen] = 0;
+                }
+        assert(strlen(passwd) <= pw_maxlen);
+        
+        /* now compute password hash */
+#ifndef NO_DES
+        if (usecrypt)
+                hash = des_crypt(passwd, *salt_p);
+#endif
+#ifndef NO_APR1
+        if (useapr1)
+                hash = apr1_crypt(passwd, *salt_p);
+#endif
+        assert(hash != NULL);
+
+        if (table && !reverse)
+                BIO_printf(out, "%s\t%s\n", passwd, hash);
+        else if (table && reverse)
+                BIO_printf(out, "%s\t%s\n", hash, passwd);
+        else
+                BIO_printf(out, "%s\n", hash);
+        return 1;
+        
+err:
+        return 0;
+        }
+#else
+
+int MAIN(int argc, char **argv)
+        {
+        fputs("Program not available.\n", stderr)
+        EXIT(1);
+        }
+#endif
diff --git a/src/lib/libssl/src/apps/pkcs12.c b/src/lib/libssl/src/apps/pkcs12.c
index 5defddeb32..d535a71335 100644
--- a/src/lib/libssl/src/apps/pkcs12.c
+++ b/src/lib/libssl/src/apps/pkcs12.c
@@ -61,12 +61,12 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <openssl/des.h>
-#include <openssl/pem.h>
+#include "apps.h"
+#include <openssl/crypto.h>
 #include <openssl/err.h>
+#include <openssl/pem.h>
 #include <openssl/pkcs12.h>
 
-#include "apps.h"
 #define PROG pkcs12_main
 
 EVP_CIPHER *enc;
@@ -79,14 +79,16 @@ EVP_CIPHER *enc;
 #define CACERTS         0x10
 
 int get_cert_chain(X509 *cert, STACK_OF(X509) **chain);
-int dump_cert_text (BIO *out, X509 *x);
-int dump_certs_keys_p12(BIO *out, PKCS12 *p12, char *pass, int passlen, int options);
-int dump_certs_pkeys_bags(BIO *out, STACK *bags, char *pass, int passlen, int options);
-int dump_certs_pkeys_bag(BIO *out, PKCS12_SAFEBAG *bags, char *pass, int passlen, int options);
+int dump_certs_keys_p12(BIO *out, PKCS12 *p12, char *pass, int passlen, int options, char *pempass);
+int dump_certs_pkeys_bags(BIO *out, STACK *bags, char *pass, int passlen, int options, char *pempass);
+int dump_certs_pkeys_bag(BIO *out, PKCS12_SAFEBAG *bags, char *pass, int passlen, int options, char *pempass);
 int print_attribs(BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst, char *name);
 void hex_prin(BIO *out, unsigned char *buf, int len);
 int alg_print(BIO *x, X509_ALGOR *alg);
 int cert_load(BIO *in, STACK_OF(X509) *sk);
+
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
 {
     char *infile=NULL, *outfile=NULL, *keyname = NULL;  
@@ -101,15 +103,19 @@ int MAIN(int argc, char **argv)
     int chain = 0;
     int badarg = 0;
     int iter = PKCS12_DEFAULT_ITER;
-    int maciter = 1;
+    int maciter = PKCS12_DEFAULT_ITER;
     int twopass = 0;
     int keytype = 0;
     int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
+    int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
     int ret = 1;
     int macver = 1;
     int noprompt = 0;
     STACK *canames = NULL;
     char *cpass = NULL, *mpass = NULL;
+    char *passargin = NULL, *passargout = NULL, *passarg = NULL;
+    char *passin = NULL, *passout = NULL;
+    char *inrand = NULL;
 
     apps_startup();
 
@@ -143,8 +149,35 @@ int MAIN(int argc, char **argv)
                 else if (!strcmp (*args, "-noiter")) iter = 1;
                 else if (!strcmp (*args, "-maciter"))
                                          maciter = PKCS12_DEFAULT_ITER;
+                else if (!strcmp (*args, "-nomaciter"))
+                                         maciter = 1;
                 else if (!strcmp (*args, "-nodes")) enc=NULL;
-                else if (!strcmp (*args, "-inkey")) {
+                else if (!strcmp (*args, "-certpbe")) {
+                        if (args[1]) {
+                                args++;
+                                cert_pbe=OBJ_txt2nid(*args);
+                                if(cert_pbe == NID_undef) {
+                                        BIO_printf(bio_err,
+                                                 "Unknown PBE algorithm %s\n", *args);
+                                        badarg = 1;
+                                }
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-keypbe")) {
+                        if (args[1]) {
+                                args++;
+                                key_pbe=OBJ_txt2nid(*args);
+                                if(key_pbe == NID_undef) {
+                                        BIO_printf(bio_err,
+                                                 "Unknown PBE algorithm %s\n", *args);
+                                        badarg = 1;
+                                }
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-rand")) {
+                    if (args[1]) {
+                        args++; 
+                        inrand = *args;
+                    } else badarg = 1;
+                } else if (!strcmp (*args, "-inkey")) {
                     if (args[1]) {
                         args++; 
                         keyname = *args;
@@ -175,20 +208,20 @@ int MAIN(int argc, char **argv)
                         args++; 
                         outfile = *args;
                     } else badarg = 1;
-                } else if (!strcmp (*args, "-envpass")) {
+                } else if (!strcmp(*args,"-passin")) {
                     if (args[1]) {
                         args++; 
-                        if(!(cpass = getenv(*args))) {
-                                BIO_printf(bio_err,
-                                 "Can't read environment variable %s\n", *args);
-                                goto end;
-                        }
-                        noprompt = 1;
+                        passargin = *args;
+                    } else badarg = 1;
+                } else if (!strcmp(*args,"-passout")) {
+                    if (args[1]) {
+                        args++; 
+                        passargout = *args;
                     } else badarg = 1;
                 } else if (!strcmp (*args, "-password")) {
                     if (args[1]) {
                         args++; 
-                        cpass = *args;
+                        passarg = *args;
                         noprompt = 1;
                     } else badarg = 1;
                 } else badarg = 1;
@@ -225,21 +258,54 @@ int MAIN(int argc, char **argv)
         BIO_printf (bio_err, "-maciter      use MAC iteration\n");
         BIO_printf (bio_err, "-twopass      separate MAC, encryption passwords\n");
         BIO_printf (bio_err, "-descert      encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");
+        BIO_printf (bio_err, "-certpbe alg  specify certificate PBE algorithm (default RC2-40)\n");
+        BIO_printf (bio_err, "-keypbe alg   specify private key PBE algorithm (default 3DES)\n");
         BIO_printf (bio_err, "-keyex        set MS key exchange type\n");
         BIO_printf (bio_err, "-keysig       set MS key signature type\n");
-        BIO_printf (bio_err, "-password p   set import/export password (NOT RECOMMENDED)\n");
-        BIO_printf (bio_err, "-envpass p    set import/export password from environment\n");
+        BIO_printf (bio_err, "-password p   set import/export password source\n");
+        BIO_printf (bio_err, "-passin p     input file pass phrase source\n");
+        BIO_printf (bio_err, "-passout p    output file pass phrase source\n");
+        BIO_printf(bio_err,  "-rand file:file:...\n");
+        BIO_printf(bio_err,  "              load the file (or the files in the directory) into\n");
+        BIO_printf(bio_err,  "              the random number generator\n");
         goto end;
     }
 
-    if(cpass) mpass = cpass;
-    else {
+    if(passarg) {
+        if(export_cert) passargout = passarg;
+        else passargin = passarg;
+    }
+
+    if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
+        BIO_printf(bio_err, "Error getting passwords\n");
+        goto end;
+    }
+
+    if(!cpass) {
+        if(export_cert) cpass = passout;
+        else cpass = passin;
+    }
+
+    if(cpass) {
+        mpass = cpass;
+        noprompt = 1;
+    } else {
         cpass = pass;
         mpass = macpass;
     }
 
+    if(export_cert || inrand) {
+        app_RAND_load_file(NULL, bio_err, (inrand != NULL));
+        if (inrand != NULL)
+                BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                        app_RAND_load_files(inrand));
+    }
     ERR_load_crypto_strings();
 
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("read files");
+#endif
+
     if (!infile) in = BIO_new_fp(stdin, BIO_NOCLOSE);
     else in = BIO_new_file(infile, "rb");
     if (!in) {
@@ -265,6 +331,11 @@ int MAIN(int argc, char **argv)
         }
      }
 
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+    CRYPTO_push_info("write files");
+#endif
+
     if (!outfile) out = BIO_new_fp(stdout, BIO_NOCLOSE);
     else out = BIO_new_file(outfile, "wb");
     if (!out) {
@@ -274,27 +345,38 @@ int MAIN(int argc, char **argv)
         goto end;
     }
     if (twopass) {
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("read MAC password");
+#endif
         if(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert))
         {
             BIO_printf (bio_err, "Can't read Password\n");
             goto end;
         }
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+#endif
     }
 
-if (export_cert) {
+    if (export_cert) {
         EVP_PKEY *key;
         STACK *bags, *safes;
         PKCS12_SAFEBAG *bag;
         PKCS8_PRIV_KEY_INFO *p8;
         PKCS7 *authsafe;
-        X509 *cert = NULL, *ucert = NULL;
-        STACK_OF(X509) *certs;
+        X509 *ucert = NULL;
+        STACK_OF(X509) *certs=NULL;
         char *catmp;
         int i;
         unsigned char keyid[EVP_MAX_MD_SIZE];
         unsigned int keyidlen = 0;
-        key = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL, NULL);
+
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_push_info("process -export_cert");
+#endif
+        key = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL, passin);
         if (!inkey) (void) BIO_reset(in);
+        else BIO_free(inkey);
         if (!key) {
                 BIO_printf (bio_err, "Error loading private key\n");
                 ERR_print_errors(bio_err);
@@ -313,7 +395,7 @@ if (export_cert) {
         for(i = 0; i < sk_X509_num(certs); i++) {
                 ucert = sk_X509_value(certs, i);
                 if(X509_check_private_key(ucert, key)) {
-                        X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
+                        X509_digest(ucert, EVP_sha1(), keyid, &keyidlen);
                         break;
                 }
         }
@@ -354,6 +436,7 @@ if (export_cert) {
 
         /* We now have loads of certificates: include them all */
         for(i = 0; i < sk_X509_num(certs); i++) {
+                X509 *cert = NULL;
                 cert = sk_X509_value(certs, i);
                 bag = M_PKCS12_x5092certbag(cert);
                 /* If it matches private key set id */
@@ -364,7 +447,7 @@ if (export_cert) {
                                 PKCS12_add_friendlyname(bag, catmp, -1);
                 sk_push(bags, (char *)bag);
         }
-
+        sk_X509_pop_free(certs, X509_free);
         if (canames) sk_free(canames);
 
         if(!noprompt &&
@@ -390,8 +473,7 @@ if (export_cert) {
         p8 = EVP_PKEY2PKCS8 (key);
         EVP_PKEY_free(key);
         if(keytype) PKCS8_add_keyusage(p8, keytype);
-        bag = PKCS12_MAKE_SHKEYBAG(NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
-                        cpass, -1, NULL, 0, iter, p8);
+        bag = PKCS12_MAKE_SHKEYBAG(key_pbe, cpass, -1, NULL, 0, iter, p8);
         PKCS8_PRIV_KEY_INFO_free(p8);
         if (name) PKCS12_add_friendlyname (bag, name, -1);
         PKCS12_add_localkeyid (bag, keyid, keyidlen);
@@ -415,6 +497,10 @@ if (export_cert) {
         PKCS12_free(p12);
 
         ret = 0;
+
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+#endif
         goto end;
         
     }
@@ -424,50 +510,61 @@ if (export_cert) {
         goto end;
     }
 
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("read import password");
+#endif
     if(!noprompt && EVP_read_pw_string(pass, 50, "Enter Import Password:", 0)) {
         BIO_printf (bio_err, "Can't read Password\n");
         goto end;
     }
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+#endif
 
     if (!twopass) strcpy(macpass, pass);
 
     if (options & INFO) BIO_printf (bio_err, "MAC Iteration %ld\n", p12->mac->iter ? ASN1_INTEGER_get (p12->mac->iter) : 1);
     if(macver) {
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("verify MAC");
+#endif
         if (!PKCS12_verify_mac (p12, mpass, -1)) {
-            BIO_printf (bio_err, "Mac verify errror: invalid password?\n");
+            BIO_printf (bio_err, "Mac verify error: invalid password?\n");
             ERR_print_errors (bio_err);
             goto end;
         } else BIO_printf (bio_err, "MAC verified OK\n");
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+#endif
     }
 
-    if (!dump_certs_keys_p12 (out, p12, cpass, -1, options)) {
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("output keys and certificates");
+#endif
+    if (!dump_certs_keys_p12 (out, p12, cpass, -1, options, passout)) {
         BIO_printf(bio_err, "Error outputting keys and certificates\n");
         ERR_print_errors (bio_err);
         goto end;
     }
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+#endif
     PKCS12_free(p12);
     ret = 0;
     end:
+    if(export_cert || inrand) app_RAND_write_file(NULL, bio_err);
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_remove_all_info();
+#endif
+    BIO_free(in);
     BIO_free(out);
+    if(passin) Free(passin);
+    if(passout) Free(passout);
     EXIT(ret);
 }
 
-int dump_cert_text (BIO *out, X509 *x)
-{
-        char buf[256];
-        X509_NAME_oneline(X509_get_subject_name(x),buf,256);
-        BIO_puts(out,"subject=");
-        BIO_puts(out,buf);
-
-        X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
-        BIO_puts(out,"\nissuer= ");
-        BIO_puts(out,buf);
-        BIO_puts(out,"\n");
-        return 0;
-}
-
 int dump_certs_keys_p12 (BIO *out, PKCS12 *p12, char *pass,
-             int passlen, int options)
+             int passlen, int options, char *pempass)
 {
         STACK *asafes, *bags;
         int i, bagnid;
@@ -489,7 +586,7 @@ int dump_certs_keys_p12 (BIO *out, PKCS12 *p12, char *pass,
                 } else continue;
                 if (!bags) return 0;
                 if (!dump_certs_pkeys_bags (out, bags, pass, passlen, 
-                                                         options)) {
+                                                 options, pempass)) {
                         sk_pop_free (bags, PKCS12_SAFEBAG_free);
                         return 0;
                 }
@@ -500,19 +597,19 @@ int dump_certs_keys_p12 (BIO *out, PKCS12 *p12, char *pass,
 }
 
 int dump_certs_pkeys_bags (BIO *out, STACK *bags, char *pass,
-             int passlen, int options)
+             int passlen, int options, char *pempass)
 {
         int i;
         for (i = 0; i < sk_num (bags); i++) {
                 if (!dump_certs_pkeys_bag (out,
                          (PKCS12_SAFEBAG *)sk_value (bags, i), pass, passlen,
-                                                        options)) return 0;
+                                                options, pempass)) return 0;
         }
         return 1;
 }
 
 int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
-             int passlen, int options)
+             int passlen, int options, char *pempass)
 {
         EVP_PKEY *pkey;
         PKCS8_PRIV_KEY_INFO *p8;
@@ -527,7 +624,7 @@ int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
                 p8 = bag->value.keybag;
                 if (!(pkey = EVP_PKCS82PKEY (p8))) return 0;
                 print_attribs (out, p8->attributes, "Key Attributes");
-                PEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL, NULL);
+                PEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL, pempass);
                 EVP_PKEY_free(pkey);
         break;
 
@@ -543,7 +640,7 @@ int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
                 if (!(pkey = EVP_PKCS82PKEY (p8))) return 0;
                 print_attribs (out, p8->attributes, "Key Attributes");
                 PKCS8_PRIV_KEY_INFO_free(p8);
-                PEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL, NULL);
+                PEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL, pempass);
                 EVP_PKEY_free(pkey);
         break;
 
@@ -566,7 +663,7 @@ int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
                 if (options & INFO) BIO_printf (bio_err, "Safe Contents bag\n");
                 print_attribs (out, bag->attrib, "Bag Attributes");
                 return dump_certs_pkeys_bags (out, bag->value.safes, pass,
-                                                            passlen, options);
+                                                            passlen, options, pempass);
                                         
         default:
                 BIO_printf (bio_err, "Warning unsupported bag type: ");
@@ -588,7 +685,7 @@ int get_cert_chain (X509 *cert, STACK_OF(X509) **chain)
         X509_STORE_CTX store_ctx;
         STACK_OF(X509) *chn;
         int i;
-        X509 *x;
+
         store = X509_STORE_new ();
         X509_STORE_set_default_paths (store);
         X509_STORE_CTX_init(&store_ctx, store, cert, NULL);
@@ -596,11 +693,7 @@ int get_cert_chain (X509 *cert, STACK_OF(X509) **chain)
                 i = X509_STORE_CTX_get_error (&store_ctx);
                 goto err;
         }
-        chn =  sk_X509_dup(X509_STORE_CTX_get_chain (&store_ctx));
-        for (i = 0; i < sk_X509_num(chn); i++) {
-                x = sk_X509_value(chn, i);
-                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
-        }
+        chn =  X509_STORE_CTX_get1_chain(&store_ctx);
         i = 0;
         *chain = chn;
 err:
diff --git a/src/lib/libssl/src/apps/pkcs7.c b/src/lib/libssl/src/apps/pkcs7.c
index 0e1427cc31..f471cc77fd 100644
--- a/src/lib/libssl/src/apps/pkcs7.c
+++ b/src/lib/libssl/src/apps/pkcs7.c
@@ -71,27 +71,23 @@
 #undef PROG
 #define PROG    pkcs7_main
 
-/* -inform arg  - input format - default PEM (one of DER, TXT or PEM)
+/* -inform arg  - input format - default PEM (DER or PEM)
  * -outform arg - output format - default PEM
  * -in arg      - input file - default stdin
  * -out arg     - output file - default stdout
- * -des         - encrypt output if PEM format with DES in cbc mode
- * -des3        - encrypt output if PEM format
- * -idea        - encrypt output if PEM format
  * -print_certs
  */
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         PKCS7 *p7=NULL;
         int i,badops=0;
-#if !defined(NO_DES) || !defined(NO_IDEA)
-        EVP_CIPHER *enc=NULL;
-#endif
         BIO *in=NULL,*out=NULL;
         int informat,outformat;
-        char *infile,*outfile,*prog,buf[256];
-        int print_certs=0;
+        char *infile,*outfile,*prog;
+        int print_certs=0,text=0,noout=0;
         int ret=0;
 
         apps_startup();
@@ -130,18 +126,12 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         outfile= *(++argv);
                         }
+                else if (strcmp(*argv,"-noout") == 0)
+                        noout=1;
+                else if (strcmp(*argv,"-text") == 0)
+                        text=1;
                 else if (strcmp(*argv,"-print_certs") == 0)
                         print_certs=1;
-#ifndef NO_DES
-                else if (strcmp(*argv,"-des") == 0)
-                        enc=EVP_des_cbc();
-                else if (strcmp(*argv,"-des3") == 0)
-                        enc=EVP_des_ede3_cbc();
-#endif
-#ifndef NO_IDEA
-                else if (strcmp(*argv,"-idea") == 0)
-                        enc=EVP_idea_cbc();
-#endif
                 else
                         {
                         BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -157,16 +147,13 @@ int MAIN(int argc, char **argv)
 bad:
                 BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
                 BIO_printf(bio_err,"where options are\n");
-                BIO_printf(bio_err," -inform arg   input format - one of DER TXT PEM\n");
-                BIO_printf(bio_err," -outform arg  output format - one of DER TXT PEM\n");
+                BIO_printf(bio_err," -inform arg   input format - DER or PEM\n");
+                BIO_printf(bio_err," -outform arg  output format - DER or PEM\n");
                 BIO_printf(bio_err," -in arg       input file\n");
                 BIO_printf(bio_err," -out arg      output file\n");
                 BIO_printf(bio_err," -print_certs  print any certs or crl in the input\n");
-                BIO_printf(bio_err," -des          encrypt PEM output with cbc des\n");
-                BIO_printf(bio_err," -des3         encrypt PEM output with ede cbc des using 168 bit key\n");
-#ifndef NO_IDEA
-                BIO_printf(bio_err," -idea         encrypt PEM output with cbc idea\n");
-#endif
+                BIO_printf(bio_err," -text         print full details of certificates\n");
+                BIO_printf(bio_err," -noout        don't output encoded data\n");
                 EXIT(1);
                 }
 
@@ -246,19 +233,10 @@ bad:
                         for (i=0; i<sk_X509_num(certs); i++)
                                 {
                                 x=sk_X509_value(certs,i);
+                                if(text) X509_print(out, x);
+                                else dump_cert_text(out, x);
 
-                                X509_NAME_oneline(X509_get_subject_name(x),
-                                        buf,256);
-                                BIO_puts(out,"subject=");
-                                BIO_puts(out,buf);
-
-                                X509_NAME_oneline(X509_get_issuer_name(x),
-                                        buf,256);
-                                BIO_puts(out,"\nissuer= ");
-                                BIO_puts(out,buf);
-                                BIO_puts(out,"\n");
-
-                                PEM_write_bio_X509(out,x);
+                                if(!noout) PEM_write_bio_X509(out,x);
                                 BIO_puts(out,"\n");
                                 }
                         }
@@ -270,17 +248,9 @@ bad:
                                 {
                                 crl=sk_X509_CRL_value(crls,i);
 
-                                X509_NAME_oneline(crl->crl->issuer,buf,256);
-                                BIO_puts(out,"issuer= ");
-                                BIO_puts(out,buf);
+                                X509_CRL_print(out, crl);
 
-                                BIO_puts(out,"\nlast update=");
-                                ASN1_TIME_print(out,crl->crl->lastUpdate);
-                                BIO_puts(out,"\nnext update=");
-                                ASN1_TIME_print(out,crl->crl->nextUpdate);
-                                BIO_puts(out,"\n");
-
-                                PEM_write_bio_X509_CRL(out,crl);
+                                if(!noout)PEM_write_bio_X509_CRL(out,crl);
                                 BIO_puts(out,"\n");
                                 }
                         }
@@ -289,21 +259,23 @@ bad:
                 goto end;
                 }
 
-        if      (outformat == FORMAT_ASN1)
-                i=i2d_PKCS7_bio(out,p7);
-        else if (outformat == FORMAT_PEM)
-                i=PEM_write_bio_PKCS7(out,p7);
-        else    {
-                BIO_printf(bio_err,"bad output format specified for outfile\n");
-                goto end;
-                }
+        if(!noout) {
+                if      (outformat == FORMAT_ASN1)
+                        i=i2d_PKCS7_bio(out,p7);
+                else if (outformat == FORMAT_PEM)
+                        i=PEM_write_bio_PKCS7(out,p7);
+                else    {
+                        BIO_printf(bio_err,"bad output format specified for outfile\n");
+                        goto end;
+                        }
 
-        if (!i)
-                {
-                BIO_printf(bio_err,"unable to write pkcs7 object\n");
-                ERR_print_errors(bio_err);
-                goto end;
-                }
+                if (!i)
+                        {
+                        BIO_printf(bio_err,"unable to write pkcs7 object\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+        }
         ret=0;
 end:
         if (p7 != NULL) PKCS7_free(p7);
diff --git a/src/lib/libssl/src/apps/pkcs8.c b/src/lib/libssl/src/apps/pkcs8.c
index a05388300a..3e59b74124 100644
--- a/src/lib/libssl/src/apps/pkcs8.c
+++ b/src/lib/libssl/src/apps/pkcs8.c
@@ -57,6 +57,7 @@
  */
 #include <stdio.h>
 #include <string.h>
+#include "apps.h"
 #include <openssl/pem.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
@@ -65,10 +66,12 @@
 #include "apps.h"
 #define PROG pkcs8_main
 
+int MAIN(int, char **);
 
 int MAIN(int argc, char **argv)
 {
         char **args, *infile = NULL, *outfile = NULL;
+        char *passargin = NULL, *passargout = NULL;
         BIO *in = NULL, *out = NULL;
         int topk8 = 0;
         int pbe_nid = -1;
@@ -80,13 +83,13 @@ int MAIN(int argc, char **argv)
         X509_SIG *p8;
         PKCS8_PRIV_KEY_INFO *p8inf;
         EVP_PKEY *pkey;
-        char pass[50];
+        char pass[50], *passin = NULL, *passout = NULL, *p8pass = NULL;
         int badarg = 0;
         if (bio_err == NULL) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);
         informat=FORMAT_PEM;
         outformat=FORMAT_PEM;
         ERR_load_crypto_strings();
-        SSLeay_add_all_algorithms();
+        OpenSSL_add_all_algorithms();
         args = argv + 1;
         while (!badarg && *args && *args[0] == '-') {
                 if (!strcmp(*args,"-v2")) {
@@ -99,6 +102,16 @@ int MAIN(int argc, char **argv)
                                         badarg = 1;
                                 }
                         } else badarg = 1;
+                } else if (!strcmp(*args,"-v1")) {
+                        if (args[1]) {
+                                args++;
+                                pbe_nid=OBJ_txt2nid(*args);
+                                if(pbe_nid == NID_undef) {
+                                        BIO_printf(bio_err,
+                                                 "Unknown PBE algorithm %s\n", *args);
+                                        badarg = 1;
+                                }
+                        } else badarg = 1;
                 } else if (!strcmp(*args,"-inform")) {
                         if (args[1]) {
                                 args++;
@@ -113,6 +126,18 @@ int MAIN(int argc, char **argv)
                 else if (!strcmp (*args, "-noiter")) iter = 1;
                 else if (!strcmp (*args, "-nocrypt")) nocrypt = 1;
                 else if (!strcmp (*args, "-nooct")) p8_broken = PKCS8_NO_OCTET;
+                else if (!strcmp (*args, "-nsdb")) p8_broken = PKCS8_NS_DB;
+                else if (!strcmp (*args, "-embed")) p8_broken = PKCS8_EMBEDDED_PARAM;
+                else if (!strcmp(*args,"-passin"))
+                        {
+                        if (!args[1]) goto bad;
+                        passargin= *(++args);
+                        }
+                else if (!strcmp(*args,"-passout"))
+                        {
+                        if (!args[1]) goto bad;
+                        passargout= *(++args);
+                        }
                 else if (!strcmp (*args, "-in")) {
                         if (args[1]) {
                                 args++;
@@ -128,25 +153,36 @@ int MAIN(int argc, char **argv)
         }
 
         if (badarg) {
-                BIO_printf (bio_err, "Usage pkcs8 [options]\n");
-                BIO_printf (bio_err, "where options are\n");
-                BIO_printf (bio_err, "-in file   input file\n");
-                BIO_printf (bio_err, "-inform X  input format (DER or PEM)\n");
-                BIO_printf (bio_err, "-outform X output format (DER or PEM)\n");
-                BIO_printf (bio_err, "-out file  output file\n");
-                BIO_printf (bio_err, "-topk8     output PKCS8 file\n");
-                BIO_printf (bio_err, "-nooct     use (broken) no octet form\n");
-                BIO_printf (bio_err, "-noiter    use 1 as iteration count\n");
-                BIO_printf (bio_err, "-nocrypt   use or expect unencrypted private key\n");
-                BIO_printf (bio_err, "-v2 alg    use PKCS#5 v2.0 and cipher \"alg\"\n");
+                bad:
+                BIO_printf(bio_err, "Usage pkcs8 [options]\n");
+                BIO_printf(bio_err, "where options are\n");
+                BIO_printf(bio_err, "-in file        input file\n");
+                BIO_printf(bio_err, "-inform X       input format (DER or PEM)\n");
+                BIO_printf(bio_err, "-passin arg     input file pass phrase source\n");
+                BIO_printf(bio_err, "-outform X      output format (DER or PEM)\n");
+                BIO_printf(bio_err, "-out file       output file\n");
+                BIO_printf(bio_err, "-passout arg    output file pass phrase source\n");
+                BIO_printf(bio_err, "-topk8          output PKCS8 file\n");
+                BIO_printf(bio_err, "-nooct          use (nonstandard) no octet format\n");
+                BIO_printf(bio_err, "-embed          use (nonstandard) embedded DSA parameters format\n");
+                BIO_printf(bio_err, "-nsdb           use (nonstandard) DSA Netscape DB format\n");
+                BIO_printf(bio_err, "-noiter         use 1 as iteration count\n");
+                BIO_printf(bio_err, "-nocrypt        use or expect unencrypted private key\n");
+                BIO_printf(bio_err, "-v2 alg         use PKCS#5 v2.0 and cipher \"alg\"\n");
+                BIO_printf(bio_err, "-v1 obj         use PKCS#5 v1.5 and cipher \"alg\"\n");
+                return (1);
+        }
+
+        if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
+                BIO_printf(bio_err, "Error getting passwords\n");
                 return (1);
         }
 
         if ((pbe_nid == -1) && !cipher) pbe_nid = NID_pbeWithMD5AndDES_CBC;
 
         if (infile) {
-                if (!(in = BIO_new_file (infile, "rb"))) {
-                        BIO_printf (bio_err,
+                if (!(in = BIO_new_file(infile, "rb"))) {
+                        BIO_printf(bio_err,
                                  "Can't open input file %s\n", infile);
                         return (1);
                 }
@@ -154,25 +190,32 @@ int MAIN(int argc, char **argv)
 
         if (outfile) {
                 if (!(out = BIO_new_file (outfile, "wb"))) {
-                        BIO_printf (bio_err,
+                        BIO_printf(bio_err,
                                  "Can't open output file %s\n", outfile);
                         return (1);
                 }
         } else out = BIO_new_fp (stdout, BIO_NOCLOSE);
 
         if (topk8) {
-                if (!(pkey = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL))) {
-                        BIO_printf (bio_err, "Error reading key\n", outfile);
+                if(informat == FORMAT_PEM)
+                        pkey = PEM_read_bio_PrivateKey(in, NULL, NULL, passin);
+                else if(informat == FORMAT_ASN1)
+                        pkey = d2i_PrivateKey_bio(in, NULL);
+                else {
+                        BIO_printf(bio_err, "Bad format specified for key\n");
+                        return (1);
+                }
+                if (!pkey) {
+                        BIO_printf(bio_err, "Error reading key\n", outfile);
                         ERR_print_errors(bio_err);
                         return (1);
                 }
                 BIO_free(in);
-                if (!(p8inf = EVP_PKEY2PKCS8(pkey))) {
-                        BIO_printf (bio_err, "Error converting key\n", outfile);
+                if (!(p8inf = EVP_PKEY2PKCS8_broken(pkey, p8_broken))) {
+                        BIO_printf(bio_err, "Error converting key\n", outfile);
                         ERR_print_errors(bio_err);
                         return (1);
                 }
-                PKCS8_set_broken(p8inf, p8_broken);
                 if(nocrypt) {
                         if(outformat == FORMAT_PEM) 
                                 PEM_write_bio_PKCS8_PRIV_KEY_INFO(out, p8inf);
@@ -183,17 +226,23 @@ int MAIN(int argc, char **argv)
                                 return (1);
                         }
                 } else {
-                        EVP_read_pw_string(pass, 50, "Enter Encryption Password:", 1);
+                        if(passout) p8pass = passout;
+                        else {
+                                p8pass = pass;
+                                EVP_read_pw_string(pass, 50, "Enter Encryption Password:", 1);
+                        }
+                        app_RAND_load_file(NULL, bio_err, 0);
                         if (!(p8 = PKCS8_encrypt(pbe_nid, cipher,
-                                        pass, strlen(pass),
+                                        p8pass, strlen(p8pass),
                                         NULL, 0, iter, p8inf))) {
-                                BIO_printf (bio_err, "Error encrypting key\n",
+                                BIO_printf(bio_err, "Error encrypting key\n",
                                                                  outfile);
                                 ERR_print_errors(bio_err);
                                 return (1);
                         }
+                        app_RAND_write_file(NULL, bio_err);
                         if(outformat == FORMAT_PEM) 
-                                PEM_write_bio_PKCS8 (out, p8);
+                                PEM_write_bio_PKCS8(out, p8);
                         else if(outformat == FORMAT_ASN1)
                                 i2d_PKCS8_bio(out, p8);
                         else {
@@ -205,6 +254,8 @@ int MAIN(int argc, char **argv)
                 PKCS8_PRIV_KEY_INFO_free (p8inf);
                 EVP_PKEY_free(pkey);
                 BIO_free(out);
+                if(passin) Free(passin);
+                if(passout) Free(passout);
                 return (0);
         }
 
@@ -232,8 +283,12 @@ int MAIN(int argc, char **argv)
                         ERR_print_errors(bio_err);
                         return (1);
                 }
-                EVP_read_pw_string(pass, 50, "Enter Password:", 0);
-                p8inf = M_PKCS8_decrypt(p8, pass, strlen(pass));
+                if(passin) p8pass = passin;
+                else {
+                        p8pass = pass;
+                        EVP_read_pw_string(pass, 50, "Enter Password:", 0);
+                }
+                p8inf = M_PKCS8_decrypt(p8, p8pass, strlen(p8pass));
                 X509_SIG_free(p8);
         }
 
@@ -253,7 +308,15 @@ int MAIN(int argc, char **argv)
                 BIO_printf(bio_err, "Warning: broken key encoding: ");
                 switch (p8inf->broken) {
                         case PKCS8_NO_OCTET:
-                        BIO_printf(bio_err, "No Octet String\n");
+                        BIO_printf(bio_err, "No Octet String in PrivateKey\n");
+                        break;
+
+                        case PKCS8_EMBEDDED_PARAM:
+                        BIO_printf(bio_err, "DSA parameters included in PrivateKey\n");
+                        break;
+
+                        case PKCS8_NS_DB:
+                        BIO_printf(bio_err, "DSA public key include in PrivateKey\n");
                         break;
 
                         default:
@@ -263,12 +326,20 @@ int MAIN(int argc, char **argv)
         }
         
         PKCS8_PRIV_KEY_INFO_free(p8inf);
-
-        PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, NULL);
+        if(outformat == FORMAT_PEM) 
+                PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, passout);
+        else if(outformat == FORMAT_ASN1)
+                i2d_PrivateKey_bio(out, pkey);
+        else {
+                BIO_printf(bio_err, "Bad format specified for key\n");
+                        return (1);
+        }
 
         EVP_PKEY_free(pkey);
         BIO_free(out);
         BIO_free(in);
+        if(passin) Free(passin);
+        if(passout) Free(passout);
 
         return (0);
 }
diff --git a/src/lib/libssl/src/apps/progs.h b/src/lib/libssl/src/apps/progs.h
index df067182bc..ffb21bd64f 100644
--- a/src/lib/libssl/src/apps/progs.h
+++ b/src/lib/libssl/src/apps/progs.h
@@ -1,11 +1,14 @@
-/* This file was generated by progs.pl. */
+/* apps/progs.h */
+/* automatically generated by progs.pl for openssl.c */
 
 extern int verify_main(int argc,char *argv[]);
 extern int asn1parse_main(int argc,char *argv[]);
 extern int req_main(int argc,char *argv[]);
 extern int dgst_main(int argc,char *argv[]);
 extern int dh_main(int argc,char *argv[]);
+extern int dhparam_main(int argc,char *argv[]);
 extern int enc_main(int argc,char *argv[]);
+extern int passwd_main(int argc,char *argv[]);
 extern int gendh_main(int argc,char *argv[]);
 extern int errstr_main(int argc,char *argv[]);
 extern int ca_main(int argc,char *argv[]);
@@ -28,8 +31,8 @@ extern int ciphers_main(int argc,char *argv[]);
 extern int nseq_main(int argc,char *argv[]);
 extern int pkcs12_main(int argc,char *argv[]);
 extern int pkcs8_main(int argc,char *argv[]);
-
-#ifdef SSLEAY_SRC  /* Defined only in openssl.c. */
+extern int spkac_main(int argc,char *argv[]);
+extern int smime_main(int argc,char *argv[]);
 
 #define FUNC_TYPE_GENERAL       1
 #define FUNC_TYPE_MD            2
@@ -49,7 +52,11 @@ FUNCTION functions[] = {
 #ifndef NO_DH
         {FUNC_TYPE_GENERAL,"dh",dh_main},
 #endif
+#ifndef NO_DH
+        {FUNC_TYPE_GENERAL,"dhparam",dhparam_main},
+#endif
         {FUNC_TYPE_GENERAL,"enc",enc_main},
+        {FUNC_TYPE_GENERAL,"passwd",passwd_main},
 #ifndef NO_DH
         {FUNC_TYPE_GENERAL,"gendh",gendh_main},
 #endif
@@ -72,14 +79,14 @@ FUNCTION functions[] = {
 #ifndef NO_DSA
         {FUNC_TYPE_GENERAL,"gendsa",gendsa_main},
 #endif
-#if !defined(NO_SOCK) && !(defined(NO_SSL2) && defined(O_SSL3))
+#if !defined(NO_SOCK) && !(defined(NO_SSL2) && defined(NO_SSL3))
         {FUNC_TYPE_GENERAL,"s_server",s_server_main},
 #endif
-#if !defined(NO_SOCK) && !(defined(NO_SSL2) && defined(O_SSL3))
+#if !defined(NO_SOCK) && !(defined(NO_SSL2) && defined(NO_SSL3))
         {FUNC_TYPE_GENERAL,"s_client",s_client_main},
 #endif
         {FUNC_TYPE_GENERAL,"speed",speed_main},
-#if !defined(NO_SOCK) && !(defined(NO_SSL2) && defined(O_SSL3))
+#if !defined(NO_SOCK) && !(defined(NO_SSL2) && defined(NO_SSL3))
         {FUNC_TYPE_GENERAL,"s_time",s_time_main},
 #endif
         {FUNC_TYPE_GENERAL,"version",version_main},
@@ -94,6 +101,8 @@ FUNCTION functions[] = {
         {FUNC_TYPE_GENERAL,"pkcs12",pkcs12_main},
 #endif
         {FUNC_TYPE_GENERAL,"pkcs8",pkcs8_main},
+        {FUNC_TYPE_GENERAL,"spkac",spkac_main},
+        {FUNC_TYPE_GENERAL,"smime",smime_main},
         {FUNC_TYPE_MD,"md2",dgst_main},
         {FUNC_TYPE_MD,"md5",dgst_main},
         {FUNC_TYPE_MD,"sha",dgst_main},
@@ -116,6 +125,9 @@ FUNCTION functions[] = {
 #ifndef NO_RC4
         {FUNC_TYPE_CIPHER,"rc4",enc_main},
 #endif
+#ifndef NO_RC4
+        {FUNC_TYPE_CIPHER,"rc4-40",enc_main},
+#endif
 #ifndef NO_RC2
         {FUNC_TYPE_CIPHER,"rc2",enc_main},
 #endif
@@ -188,6 +200,12 @@ FUNCTION functions[] = {
 #ifndef NO_RC2
         {FUNC_TYPE_CIPHER,"rc2-ofb",enc_main},
 #endif
+#ifndef NO_RC2
+        {FUNC_TYPE_CIPHER,"rc2-64-cbc",enc_main},
+#endif
+#ifndef NO_RC2
+        {FUNC_TYPE_CIPHER,"rc2-40-cbc",enc_main},
+#endif
 #ifndef NO_BF
         {FUNC_TYPE_CIPHER,"bf-cbc",enc_main},
 #endif
@@ -229,5 +247,3 @@ FUNCTION functions[] = {
 #endif
         {0,NULL,NULL}
         };
-#endif
-
diff --git a/src/lib/libssl/src/apps/progs.pl b/src/lib/libssl/src/apps/progs.pl
index 7a69fc7b18..9842d2ace7 100644
--- a/src/lib/libssl/src/apps/progs.pl
+++ b/src/lib/libssl/src/apps/progs.pl
@@ -1,6 +1,7 @@
 #!/usr/local/bin/perl
 
-print "/* This file was generated by progs.pl. */\n\n";
+print "/* apps/progs.h */\n";
+print "/* automatically generated by progs.pl for openssl.c */\n\n";
 
 grep(s/^asn1pars$/asn1parse/,@ARGV);
 
@@ -9,8 +10,6 @@ foreach (@ARGV)
 
 print <<'EOF';
 
-#ifdef SSLEAY_SRC  /* Defined only in openssl.c. */
-
 #define FUNC_TYPE_GENERAL       1
 #define FUNC_TYPE_MD            2
 #define FUNC_TYPE_CIPHER        3
@@ -29,13 +28,15 @@ foreach (@ARGV)
         push(@files,$_);
         $str="\t{FUNC_TYPE_GENERAL,\"$_\",${_}_main},\n";
         if (($_ =~ /^s_/) || ($_ =~ /^ciphers$/))
-                { print "#if !defined(NO_SOCK) && !(defined(NO_SSL2) && defined(O_SSL3))\n${str}#endif\n"; } 
+                { print "#if !defined(NO_SOCK) && !(defined(NO_SSL2) && defined(NO_SSL3))\n${str}#endif\n"; } 
         elsif ( ($_ =~ /^rsa$/) || ($_ =~ /^genrsa$/) ) 
                 { print "#ifndef NO_RSA\n${str}#endif\n";  }
         elsif ( ($_ =~ /^dsa$/) || ($_ =~ /^gendsa$/) || ($_ =~ /^dsaparam$/))
                 { print "#ifndef NO_DSA\n${str}#endif\n"; }
-        elsif ( ($_ =~ /^dh$/) || ($_ =~ /^gendh$/))
+        elsif ( ($_ =~ /^dh$/) || ($_ =~ /^gendh$/) || ($_ =~ /^dhparam$/))
                 { print "#ifndef NO_DH\n${str}#endif\n"; }
+        elsif ( ($_ =~ /^pkcs12$/))
+                { print "#if !defined(NO_DES) && !defined(NO_SHA1)\n${str}#endif\n"; }
         else
                 { print $str; }
         }
@@ -48,13 +49,14 @@ foreach ("md2","md5","sha","sha1","mdc2","rmd160")
 
 foreach (
         "base64",
-        "des", "des3", "desx", "idea", "rc4", "rc2","bf","cast","rc5",
+        "des", "des3", "desx", "idea", "rc4", "rc4-40",
+        "rc2", "bf", "cast", "rc5",
         "des-ecb", "des-ede",    "des-ede3",
         "des-cbc", "des-ede-cbc","des-ede3-cbc",
         "des-cfb", "des-ede-cfb","des-ede3-cfb",
         "des-ofb", "des-ede-ofb","des-ede3-ofb",
         "idea-cbc","idea-ecb",   "idea-cfb", "idea-ofb",
-        "rc2-cbc", "rc2-ecb",    "rc2-cfb",  "rc2-ofb",
+        "rc2-cbc", "rc2-ecb", "rc2-cfb","rc2-ofb", "rc2-64-cbc", "rc2-40-cbc",
         "bf-cbc",  "bf-ecb",     "bf-cfb",   "bf-ofb",
         "cast5-cbc","cast5-ecb", "cast5-cfb","cast5-ofb",
         "cast-cbc", "rc5-cbc",   "rc5-ecb",  "rc5-cfb",  "rc5-ofb")
@@ -73,5 +75,3 @@ foreach (
         }
 
 print "\t{0,NULL,NULL}\n\t};\n";
-print "#endif\n\n";
-
diff --git a/src/lib/libssl/src/apps/req.c b/src/lib/libssl/src/apps/req.c
index 463ac156ea..97bb0d0ed8 100644
--- a/src/lib/libssl/src/apps/req.c
+++ b/src/lib/libssl/src/apps/req.c
@@ -66,7 +66,6 @@
 #include "apps.h"
 #include <openssl/bio.h>
 #include <openssl/evp.h>
-#include <openssl/rand.h>
 #include <openssl/conf.h>
 #include <openssl/err.h>
 #include <openssl/asn1.h>
@@ -79,9 +78,12 @@
 
 #define BITS            "default_bits"
 #define KEYFILE         "default_keyfile"
+#define PROMPT          "prompt"
 #define DISTINGUISHED_NAME      "distinguished_name"
 #define ATTRIBUTES      "attributes"
 #define V3_EXTENSIONS   "x509_extensions"
+#define REQ_EXTENSIONS  "req_extensions"
+#define STRING_MASK     "string_mask"
 
 #define DEFAULT_KEY_LENGTH      512
 #define MIN_KEY_LENGTH          384
@@ -89,7 +91,7 @@
 #undef PROG
 #define PROG    req_main
 
-/* -inform arg  - input format - default PEM (one of DER, TXT or PEM)
+/* -inform arg  - input format - default PEM (DER or PEM)
  * -outform arg - output format - default PEM
  * -in arg      - input file - default stdin
  * -out arg     - output file - default stdout
@@ -108,13 +110,20 @@
  */
 
 static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,int attribs);
-static int add_attribute_object(STACK_OF(X509_ATTRIBUTE) *n, char *text,
+static int prompt_info(X509_REQ *req,
+                STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
+                STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs);
+static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
+                                STACK_OF(CONF_VALUE) *attr, int attribs);
+static int add_attribute_object(X509_REQ *req, char *text,
                                 char *def, char *value, int nid, int min,
                                 int max);
 static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
         int nid,int min,int max);
+#ifndef NO_RSA
 static void MS_CALLBACK req_cb(int p,int n,void *arg);
-static int req_fix_data(int nid,int *type,int len,int min,int max);
+#endif
+static int req_check_len(int len,int min,int max);
 static int check_end(char *str, char *end);
 static int add_oid_section(LHASH *conf);
 #ifndef MONOLITH
@@ -127,6 +136,8 @@ static LHASH *req_conf=NULL;
 #define TYPE_DSA        2
 #define TYPE_DH         3
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
 #ifndef NO_DSA
@@ -139,17 +150,21 @@ int MAIN(int argc, char **argv)
         int i,badops=0,newreq=0,newkey= -1,pkey_type=0;
         BIO *in=NULL,*out=NULL;
         int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM;
-        int nodes=0,kludge=0;
+        int nodes=0,kludge=0,newhdr=0;
         char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL;
         char *extensions = NULL;
+        char *req_exts = NULL;
         EVP_CIPHER *cipher=NULL;
         int modulus=0;
+        char *passargin = NULL, *passargout = NULL;
+        char *passin = NULL, *passout = NULL;
         char *p;
         const EVP_MD *md_alg=NULL,*digest=EVP_md5();
 #ifndef MONOLITH
         MS_STATIC char config_name[256];
 #endif
 
+        req_conf = NULL;
 #ifndef NO_DES
         cipher=EVP_des_ede3_cbc();
 #endif
@@ -214,6 +229,16 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         keyout= *(++argv);
                         }
+                else if (strcmp(*argv,"-passin") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargin= *(++argv);
+                        }
+                else if (strcmp(*argv,"-passout") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargout= *(++argv);
+                        }
                 else if (strcmp(*argv,"-newkey") == 0)
                         {
                         int is_numeric;
@@ -281,6 +306,8 @@ int MAIN(int argc, char **argv)
 
                         newreq=1;
                         }
+                else if (strcmp(*argv,"-newhdr") == 0)
+                        newhdr=1;
                 else if (strcmp(*argv,"-modulus") == 0)
                         modulus=1;
                 else if (strcmp(*argv,"-verify") == 0)
@@ -308,8 +335,17 @@ int MAIN(int argc, char **argv)
                         /* ok */
                         digest=md_alg;
                         }
+                else if (strcmp(*argv,"-extensions") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        extensions = *(++argv);
+                        }
+                else if (strcmp(*argv,"-reqexts") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        req_exts = *(++argv);
+                        }
                 else
-
                         {
                         BIO_printf(bio_err,"unknown option %s\n",*argv);
                         badops=1;
@@ -324,8 +360,8 @@ int MAIN(int argc, char **argv)
 bad:
                 BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
                 BIO_printf(bio_err,"where options  are\n");
-                BIO_printf(bio_err," -inform arg    input format - one of DER TXT PEM\n");
-                BIO_printf(bio_err," -outform arg   output format - one of DER TXT PEM\n");
+                BIO_printf(bio_err," -inform arg    input format - DER or PEM\n");
+                BIO_printf(bio_err," -outform arg   output format - DER or PEM\n");
                 BIO_printf(bio_err," -in arg        input file\n");
                 BIO_printf(bio_err," -out arg       output file\n");
                 BIO_printf(bio_err," -text          text form of request\n");
@@ -344,16 +380,21 @@ bad:
                 BIO_printf(bio_err," -new           new request.\n");
                 BIO_printf(bio_err," -x509          output a x509 structure instead of a cert. req.\n");
                 BIO_printf(bio_err," -days          number of days a x509 generated by -x509 is valid for.\n");
+                BIO_printf(bio_err," -newhdr        output \"NEW\" in the header lines\n");
                 BIO_printf(bio_err," -asn1-kludge   Output the 'request' in a format that is wrong but some CA's\n");
                 BIO_printf(bio_err,"                have been reported as requiring\n");
-                BIO_printf(bio_err,"                [ It is now always turned on but can be turned off with -no-asn1-kludge ]\n");
+                BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n");
+                BIO_printf(bio_err," -reqexts ..    specify request extension section (override value in config file)\n");
                 goto end;
                 }
 
         ERR_load_crypto_strings();
-        X509V3_add_standard_extensions();
+        if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
+                BIO_printf(bio_err, "Error getting passwords\n");
+                goto end;
+        }
 
-#ifndef MONOLITH
+#ifndef MONOLITH /* else this has happened in openssl.c (global `config') */
         /* Lets load up our environment a little */
         p=getenv("OPENSSL_CONF");
         if (p == NULL)
@@ -367,7 +408,7 @@ bad:
                 strcat(config_name,OPENSSL_CONF);
                 p=config_name;
                 }
-        default_config_file=p;
+        default_config_file=p;
         config=CONF_load(config,p,NULL);
 #endif
 
@@ -425,7 +466,8 @@ bad:
                         digest=md_alg;
                 }
 
-        extensions = CONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
+        if(!extensions)
+                extensions = CONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
         if(extensions) {
                 /* Check syntax of file */
                 X509V3_CTX ctx;
@@ -438,6 +480,34 @@ bad:
                 }
         }
 
+        if(!passin)
+                passin = CONF_get_string(req_conf, SECTION, "input_password");
+
+        if(!passout)
+                passout = CONF_get_string(req_conf, SECTION, "output_password");
+
+        p = CONF_get_string(req_conf, SECTION, STRING_MASK);
+
+        if(p && !ASN1_STRING_set_default_mask_asc(p)) {
+                BIO_printf(bio_err, "Invalid global string mask setting %s\n", p);
+                goto end;
+        }
+
+        if(!req_exts)
+                req_exts = CONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
+        if(req_exts) {
+                /* Check syntax of file */
+                X509V3_CTX ctx;
+                X509V3_set_ctx_test(&ctx);
+                X509V3_set_conf_lhash(&ctx, req_conf);
+                if(!X509V3_EXT_add_conf(req_conf, &ctx, req_exts, NULL)) {
+                        BIO_printf(bio_err,
+                         "Error Loading request extension section %s\n",
+                                                                req_exts);
+                        goto end;
+                }
+        }
+
         in=BIO_new(BIO_s_file());
         out=BIO_new(BIO_s_file());
         if ((in == NULL) || (out == NULL))
@@ -451,11 +521,12 @@ bad:
                         goto end;
                         }
 
-/*              if (keyform == FORMAT_ASN1)
-                        rsa=d2i_RSAPrivateKey_bio(in,NULL);
-                else */
-                if (keyform == FORMAT_PEM)
-                        pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL);
+                if (keyform == FORMAT_ASN1)
+                        pkey=d2i_PrivateKey_bio(in,NULL);
+                else if (keyform == FORMAT_PEM)
+                        {
+                        pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,passin);
+                        }
                 else
                         {
                         BIO_printf(bio_err,"bad input format specified for X509 request\n");
@@ -471,25 +542,9 @@ bad:
 
         if (newreq && (pkey == NULL))
                 {
-                char *randfile;
-                char buffer[200];
-
-                if ((randfile=CONF_get_string(req_conf,SECTION,"RANDFILE")) == NULL)
-                        randfile=RAND_file_name(buffer,200);
-#ifdef WINDOWS
-                BIO_printf(bio_err,"Loading 'screen' into random state -");
-                BIO_flush(bio_err);
-                RAND_screen();
-                BIO_printf(bio_err," done\n");
-#endif
-                if ((randfile == NULL) || !RAND_load_file(randfile,1024L*1024L))
-                        {
-                        BIO_printf(bio_err,"unable to load 'random state'\n");
-                        BIO_printf(bio_err,"What this means is that the random number generator has not been seeded\n");
-                        BIO_printf(bio_err,"with much random data.\n");
-                        BIO_printf(bio_err,"Consider setting the RANDFILE environment variable to point at a file that\n");
-                        BIO_printf(bio_err,"'random' data can be kept in.\n");
-                        }
+                char *randfile = CONF_get_string(req_conf,SECTION,"RANDFILE");
+                app_RAND_load_file(randfile, bio_err, 0);
+        
                 if (newkey <= 0)
                         {
                         newkey=(int)CONF_get_number(req_conf,SECTION,BITS);
@@ -527,8 +582,7 @@ bad:
                         }
 #endif
 
-                if ((randfile == NULL) || (RAND_write_file(randfile) == 0))
-                        BIO_printf(bio_err,"unable to write 'random state'\n");
+                app_RAND_write_file(randfile, bio_err);
 
                 if (pkey == NULL) goto end;
 
@@ -560,7 +614,7 @@ bad:
                 i=0;
 loop:
                 if (!PEM_write_bio_PrivateKey(out,pkey,cipher,
-                        NULL,0,NULL,NULL))
+                        NULL,0,NULL,passout))
                         {
                         if ((ERR_GET_REASON(ERR_peek_error()) ==
                                 PEM_R_PROBLEMS_GETTING_PASSWORD) && (i < 3))
@@ -677,6 +731,22 @@ loop:
                         }
                 else
                         {
+                        X509V3_CTX ext_ctx;
+
+                        /* Set up V3 context struct */
+
+                        X509V3_set_ctx(&ext_ctx, NULL, NULL, req, NULL, 0);
+                        X509V3_set_conf_lhash(&ext_ctx, req_conf);
+
+                        /* Add extensions */
+                        if(req_exts && !X509V3_EXT_REQ_add_conf(req_conf, 
+                                        &ext_ctx, req_exts, req))
+                            {
+                            BIO_printf(bio_err,
+                                       "Error Loading extension section %s\n",
+                                       req_exts);
+                            goto end;
+                            }
                         if (!(i=X509_REQ_sign(req,pkey,digest)))
                                 goto end;
                         }
@@ -767,9 +837,10 @@ loop:
                 {
                 if      (outformat == FORMAT_ASN1)
                         i=i2d_X509_REQ_bio(out,req);
-                else if (outformat == FORMAT_PEM)
-                        i=PEM_write_bio_X509_REQ(out,req);
-                else    {
+                else if (outformat == FORMAT_PEM) {
+                        if(newhdr) i=PEM_write_bio_X509_REQ_NEW(out,req);
+                        else i=PEM_write_bio_X509_REQ(out,req);
+                } else {
                         BIO_printf(bio_err,"bad output format specified for outfile\n");
                         goto end;
                         }
@@ -807,7 +878,8 @@ end:
         EVP_PKEY_free(pkey);
         X509_REQ_free(req);
         X509_free(x509ss);
-        X509V3_EXT_cleanup();
+        if(passin) Free(passin);
+        if(passout) Free(passout);
         OBJ_cleanup();
 #ifndef NO_DSA
         if (dsa_params != NULL) DSA_free(dsa_params);
@@ -818,43 +890,67 @@ end:
 static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, int attribs)
         {
         int ret=0,i;
-        char *p,*q;
-        X509_REQ_INFO *ri;
-        char buf[100];
-        int nid,min,max;
-        char *type,*def,*tmp,*value,*tmp_attr;
-        STACK_OF(CONF_VALUE) *sk, *attr=NULL;
-        CONF_VALUE *v;
-        
-        tmp=CONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME);
-        if (tmp == NULL)
+        char no_prompt = 0;
+        STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL;
+        char *tmp, *dn_sect,*attr_sect;
+
+        tmp=CONF_get_string(req_conf,SECTION,PROMPT);
+        if((tmp != NULL) && !strcmp(tmp, "no")) no_prompt = 1;
+
+        dn_sect=CONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME);
+        if (dn_sect == NULL)
                 {
                 BIO_printf(bio_err,"unable to find '%s' in config\n",
                         DISTINGUISHED_NAME);
                 goto err;
                 }
-        sk=CONF_get_section(req_conf,tmp);
-        if (sk == NULL)
+        dn_sk=CONF_get_section(req_conf,dn_sect);
+        if (dn_sk == NULL)
                 {
-                BIO_printf(bio_err,"unable to get '%s' section\n",tmp);
+                BIO_printf(bio_err,"unable to get '%s' section\n",dn_sect);
                 goto err;
                 }
 
-        tmp_attr=CONF_get_string(req_conf,SECTION,ATTRIBUTES);
-        if (tmp_attr == NULL)
-                attr=NULL;
+        attr_sect=CONF_get_string(req_conf,SECTION,ATTRIBUTES);
+        if (attr_sect == NULL)
+                attr_sk=NULL;
         else
                 {
-                attr=CONF_get_section(req_conf,tmp_attr);
-                if (attr == NULL)
+                attr_sk=CONF_get_section(req_conf,attr_sect);
+                if (attr_sk == NULL)
                         {
-                        BIO_printf(bio_err,"unable to get '%s' section\n",tmp_attr);
+                        BIO_printf(bio_err,"unable to get '%s' section\n",attr_sect);
                         goto err;
                         }
                 }
 
-        ri=req->req_info;
+        /* setup version number */
+        if (!X509_REQ_set_version(req,0L)) goto err; /* version 1 */
+
+        if(no_prompt) i = auto_info(req, dn_sk, attr_sk, attribs);
+        else i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs);
+        if(!i) goto err;
+
+        X509_REQ_set_pubkey(req,pkey);
 
+        ret=1;
+err:
+        return(ret);
+        }
+
+
+static int prompt_info(X509_REQ *req,
+                STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
+                STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs)
+        {
+        int i;
+        char *p,*q;
+        char buf[100];
+        int nid,min,max;
+        char *type,*def,*value;
+        CONF_VALUE *v;
+        X509_NAME *subj;
+        subj = X509_REQ_get_subject_name(req);
         BIO_printf(bio_err,"You are about to be asked to enter information that will be incorporated\n");
         BIO_printf(bio_err,"into your certificate request.\n");
         BIO_printf(bio_err,"What you are about to enter is what is called a Distinguished Name or a DN.\n");
@@ -863,18 +959,16 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, int attribs)
         BIO_printf(bio_err,"If you enter '.', the field will be left blank.\n");
         BIO_printf(bio_err,"-----\n");
 
-        /* setup version number */
-        if (!ASN1_INTEGER_set(ri->version,0L)) goto err; /* version 1 */
 
-        if (sk_CONF_VALUE_num(sk))
+        if (sk_CONF_VALUE_num(dn_sk))
                 {
                 i= -1;
 start:          for (;;)
                         {
                         i++;
-                        if (sk_CONF_VALUE_num(sk) <= i) break;
+                        if (sk_CONF_VALUE_num(dn_sk) <= i) break;
 
-                        v=sk_CONF_VALUE_value(sk,i);
+                        v=sk_CONF_VALUE_value(dn_sk,i);
                         p=q=NULL;
                         type=v->name;
                         if(!check_end(type,"_min") || !check_end(type,"_max") ||
@@ -893,32 +987,32 @@ start:		for (;;)
                         /* If OBJ not recognised ignore it */
                         if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start;
                         sprintf(buf,"%s_default",v->name);
-                        if ((def=CONF_get_string(req_conf,tmp,buf)) == NULL)
+                        if ((def=CONF_get_string(req_conf,dn_sect,buf)) == NULL)
                                 def="";
                                 
                         sprintf(buf,"%s_value",v->name);
-                        if ((value=CONF_get_string(req_conf,tmp,buf)) == NULL)
+                        if ((value=CONF_get_string(req_conf,dn_sect,buf)) == NULL)
                                 value=NULL;
 
                         sprintf(buf,"%s_min",v->name);
-                        min=(int)CONF_get_number(req_conf,tmp,buf);
+                        min=(int)CONF_get_number(req_conf,dn_sect,buf);
 
                         sprintf(buf,"%s_max",v->name);
-                        max=(int)CONF_get_number(req_conf,tmp,buf);
+                        max=(int)CONF_get_number(req_conf,dn_sect,buf);
 
-                        if (!add_DN_object(ri->subject,v->value,def,value,nid,
+                        if (!add_DN_object(subj,v->value,def,value,nid,
                                 min,max))
-                                goto err;
+                                return 0;
                         }
-                if (sk_X509_NAME_ENTRY_num(ri->subject->entries) == 0)
+                if (X509_NAME_entry_count(subj) == 0)
                         {
                         BIO_printf(bio_err,"error, no objects specified in config file\n");
-                        goto err;
+                        return 0;
                         }
 
                 if (attribs)
                         {
-                        if ((attr != NULL) && (sk_CONF_VALUE_num(attr) > 0))
+                        if ((attr_sk != NULL) && (sk_CONF_VALUE_num(attr_sk) > 0))
                                 {
                                 BIO_printf(bio_err,"\nPlease enter the following 'extra' attributes\n");
                                 BIO_printf(bio_err,"to be sent with your certificate request\n");
@@ -928,57 +1022,101 @@ start:		for (;;)
 start2:                 for (;;)
                                 {
                                 i++;
-                                if ((attr == NULL) ||
-                                            (sk_CONF_VALUE_num(attr) <= i))
+                                if ((attr_sk == NULL) ||
+                                            (sk_CONF_VALUE_num(attr_sk) <= i))
                                         break;
 
-                                v=sk_CONF_VALUE_value(attr,i);
+                                v=sk_CONF_VALUE_value(attr_sk,i);
                                 type=v->name;
                                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
                                         goto start2;
 
                                 sprintf(buf,"%s_default",type);
-                                if ((def=CONF_get_string(req_conf,tmp_attr,buf))
+                                if ((def=CONF_get_string(req_conf,attr_sect,buf))
                                         == NULL)
                                         def="";
                                 
                                 sprintf(buf,"%s_value",type);
-                                if ((value=CONF_get_string(req_conf,tmp_attr,buf))
+                                if ((value=CONF_get_string(req_conf,attr_sect,buf))
                                         == NULL)
                                         value=NULL;
 
                                 sprintf(buf,"%s_min",type);
-                                min=(int)CONF_get_number(req_conf,tmp_attr,buf);
+                                min=(int)CONF_get_number(req_conf,attr_sect,buf);
 
                                 sprintf(buf,"%s_max",type);
-                                max=(int)CONF_get_number(req_conf,tmp_attr,buf);
+                                max=(int)CONF_get_number(req_conf,attr_sect,buf);
 
-                                if (!add_attribute_object(ri->attributes,
+                                if (!add_attribute_object(req,
                                         v->value,def,value,nid,min,max))
-                                        goto err;
+                                        return 0;
                                 }
                         }
                 }
         else
                 {
                 BIO_printf(bio_err,"No template, please set one up.\n");
-                goto err;
+                return 0;
                 }
 
-        X509_REQ_set_pubkey(req,pkey);
+        return 1;
 
-        ret=1;
-err:
-        return(ret);
         }
 
+static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
+                        STACK_OF(CONF_VALUE) *attr_sk, int attribs)
+        {
+        int i;
+        char *p,*q;
+        char *type;
+        CONF_VALUE *v;
+        X509_NAME *subj;
+
+        subj = X509_REQ_get_subject_name(req);
+
+        for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++)
+                {
+                v=sk_CONF_VALUE_value(dn_sk,i);
+                p=q=NULL;
+                type=v->name;
+                /* Skip past any leading X. X: X, etc to allow for
+                 * multiple instances 
+                 */
+                for(p = v->name; *p ; p++) 
+                        if ((*p == ':') || (*p == ',') || (*p == '.')) {
+                                p++;
+                                if(*p) type = p;
+                                break;
+                        }
+                if (!X509_NAME_add_entry_by_txt(subj,type, MBSTRING_ASC,
+                                (unsigned char *) v->value,-1,-1,0)) return 0;
+
+                }
+
+                if (!X509_NAME_entry_count(subj))
+                        {
+                        BIO_printf(bio_err,"error, no objects specified in config file\n");
+                        return 0;
+                        }
+                if (attribs)
+                        {
+                        for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++)
+                                {
+                                v=sk_CONF_VALUE_value(attr_sk,i);
+                                if(!X509_REQ_add1_attr_by_txt(req, v->name, MBSTRING_ASC,
+                                        (unsigned char *)v->value, -1)) return 0;
+                                }
+                        }
+        return 1;
+        }
+
+
 static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
              int nid, int min, int max)
         {
-        int i,j,ret=0;
-        X509_NAME_ENTRY *ne=NULL;
+        int i,ret=0;
         MS_STATIC char buf[1024];
-
+start:
         BIO_printf(bio_err,"%s [%s]:",text,def);
         (void)BIO_flush(bio_err);
         if (value != NULL)
@@ -1011,33 +1149,23 @@ static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
                 }
         buf[--i]='\0';
 
-        j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
-        if (req_fix_data(nid,&j,i,min,max) == 0)
-                goto err;
 #ifdef CHARSET_EBCDIC
         ebcdic2ascii(buf, buf, i);
 #endif
-        if ((ne=X509_NAME_ENTRY_create_by_NID(NULL,nid,j,(unsigned char *)buf,
-                strlen(buf)))
-                == NULL) goto err;
-        if (!X509_NAME_add_entry(n,ne,X509_NAME_entry_count(n),0))
-                goto err;
-
+        if(!req_check_len(i, min, max)) goto start;
+        if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC,
+                                (unsigned char *) buf, -1,-1,0)) goto err;
         ret=1;
 err:
-        if (ne != NULL) X509_NAME_ENTRY_free(ne);
         return(ret);
         }
 
-static int add_attribute_object(STACK_OF(X509_ATTRIBUTE) *n, char *text,
+static int add_attribute_object(X509_REQ *req, char *text,
                                 char *def, char *value, int nid, int min,
                                 int max)
         {
-        int i,z;
-        X509_ATTRIBUTE *xa=NULL;
+        int i;
         static char buf[1024];
-        ASN1_BIT_STRING *bs=NULL;
-        ASN1_TYPE *at=NULL;
 
 start:
         BIO_printf(bio_err,"%s [%s]:",text,def);
@@ -1071,50 +1199,21 @@ start:
                 return(0);
                 }
         buf[--i]='\0';
+        if(!req_check_len(i, min, max)) goto start;
 
-        /* add object plus value */
-        if ((xa=X509_ATTRIBUTE_new()) == NULL)
-                goto err;
-        if ((xa->value.set=sk_ASN1_TYPE_new_null()) == NULL)
+        if(!X509_REQ_add1_attr_by_NID(req, nid, MBSTRING_ASC,
+                                        (unsigned char *)buf, -1)) {
+                BIO_printf(bio_err, "Error adding attribute\n");
+                ERR_print_errors(bio_err);
                 goto err;
-        xa->set=1;
-
-        if (xa->object != NULL) ASN1_OBJECT_free(xa->object);
-        xa->object=OBJ_nid2obj(nid);
-
-        if ((bs=ASN1_BIT_STRING_new()) == NULL) goto err;
-
-        bs->type=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
-
-        z=req_fix_data(nid,&bs->type,i,min,max);
-        if (z == 0)
-                {
-                if (value == NULL)
-                        goto start;
-                else    goto err;
-                }
-
-        if (!ASN1_STRING_set(bs,(unsigned char *)buf,i+1))
-                { BIO_printf(bio_err,"Malloc failure\n"); goto err; }
-
-        if ((at=ASN1_TYPE_new()) == NULL)
-                { BIO_printf(bio_err,"Malloc failure\n"); goto err; }
-
-        ASN1_TYPE_set(at,bs->type,(char *)bs);
-        sk_ASN1_TYPE_push(xa->value.set,at);
-        bs=NULL;
-        at=NULL;
-        /* only one item per attribute */
+        }
 
-        if (!sk_X509_ATTRIBUTE_push(n,xa)) goto err;
         return(1);
 err:
-        if (xa != NULL) X509_ATTRIBUTE_free(xa);
-        if (at != NULL) ASN1_TYPE_free(at);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
         return(0);
         }
 
+#ifndef NO_RSA
 static void MS_CALLBACK req_cb(int p, int n, void *arg)
         {
         char c='*';
@@ -1129,26 +1228,10 @@ static void MS_CALLBACK req_cb(int p, int n, void *arg)
         p=n;
 #endif
         }
+#endif
 
-static int req_fix_data(int nid, int *type, int len, int min, int max)
+static int req_check_len(int len, int min, int max)
         {
-        if (nid == NID_pkcs9_emailAddress)
-                *type=V_ASN1_IA5STRING;
-        if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
-                *type=V_ASN1_T61STRING;
-        if ((nid == NID_pkcs9_challengePassword) &&
-                (*type == V_ASN1_IA5STRING))
-                *type=V_ASN1_T61STRING;
-
-        if ((nid == NID_pkcs9_unstructuredName) &&
-                (*type == V_ASN1_T61STRING))
-                {
-                BIO_printf(bio_err,"invalid characters in string, please re-enter the string\n");
-                return(0);
-                }
-        if (nid == NID_pkcs9_unstructuredName)
-                *type=V_ASN1_IA5STRING;
-
         if (len < min)
                 {
                 BIO_printf(bio_err,"string is too short, it needs to be at least %d bytes long\n",min);
diff --git a/src/lib/libssl/src/apps/rsa.c b/src/lib/libssl/src/apps/rsa.c
index 9b723ee406..53d234ca35 100644
--- a/src/lib/libssl/src/apps/rsa.c
+++ b/src/lib/libssl/src/apps/rsa.c
@@ -82,8 +82,12 @@
  * -text        - print a text version
  * -modulus     - print the RSA key modulus
  * -check       - verify key consistency
+ * -pubin       - Expect a public key in input file.
+ * -pubout      - Output a public key.
  */
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int ret=1;
@@ -92,7 +96,10 @@ int MAIN(int argc, char **argv)
         const EVP_CIPHER *enc=NULL;
         BIO *in=NULL,*out=NULL;
         int informat,outformat,text=0,check=0,noout=0;
+        int pubin = 0, pubout = 0;
         char *infile,*outfile,*prog;
+        char *passargin = NULL, *passargout = NULL;
+        char *passin = NULL, *passout = NULL;
         int modulus=0;
 
         apps_startup();
@@ -131,6 +138,20 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         outfile= *(++argv);
                         }
+                else if (strcmp(*argv,"-passin") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargin= *(++argv);
+                        }
+                else if (strcmp(*argv,"-passout") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargout= *(++argv);
+                        }
+                else if (strcmp(*argv,"-pubin") == 0)
+                        pubin=1;
+                else if (strcmp(*argv,"-pubout") == 0)
+                        pubout=1;
                 else if (strcmp(*argv,"-noout") == 0)
                         noout=1;
                 else if (strcmp(*argv,"-text") == 0)
@@ -154,24 +175,39 @@ int MAIN(int argc, char **argv)
 bad:
                 BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
                 BIO_printf(bio_err,"where options are\n");
-                BIO_printf(bio_err," -inform arg   input format - one of DER NET PEM\n");
-                BIO_printf(bio_err," -outform arg  output format - one of DER NET PEM\n");
-                BIO_printf(bio_err," -in arg       input file\n");
-                BIO_printf(bio_err," -out arg      output file\n");
-                BIO_printf(bio_err," -des          encrypt PEM output with cbc des\n");
-                BIO_printf(bio_err," -des3         encrypt PEM output with ede cbc des using 168 bit key\n");
+                BIO_printf(bio_err," -inform arg     input format - one of DER NET PEM\n");
+                BIO_printf(bio_err," -outform arg    output format - one of DER NET PEM\n");
+                BIO_printf(bio_err," -in arg         input file\n");
+                BIO_printf(bio_err," -passin arg     input file pass phrase source\n");
+                BIO_printf(bio_err," -in arg         input file\n");
+                BIO_printf(bio_err," -out arg        output file\n");
+                BIO_printf(bio_err," -passout arg    output file pass phrase source\n");
+                BIO_printf(bio_err," -des            encrypt PEM output with cbc des\n");
+                BIO_printf(bio_err," -des3           encrypt PEM output with ede cbc des using 168 bit key\n");
 #ifndef NO_IDEA
-                BIO_printf(bio_err," -idea         encrypt PEM output with cbc idea\n");
+                BIO_printf(bio_err," -idea           encrypt PEM output with cbc idea\n");
 #endif
-                BIO_printf(bio_err," -text         print the key in text\n");
-                BIO_printf(bio_err," -noout        don't print key out\n");
-                BIO_printf(bio_err," -modulus      print the RSA key modulus\n");
-                BIO_printf(bio_err," -check        verify key consistency\n");
+                BIO_printf(bio_err," -text           print the key in text\n");
+                BIO_printf(bio_err," -noout          don't print key out\n");
+                BIO_printf(bio_err," -modulus        print the RSA key modulus\n");
+                BIO_printf(bio_err," -check          verify key consistency\n");
+                BIO_printf(bio_err," -pubin          expect a public key in input file\n");
+                BIO_printf(bio_err," -pubout         output a public key\n");
                 goto end;
                 }
 
         ERR_load_crypto_strings();
 
+        if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
+                BIO_printf(bio_err, "Error getting passwords\n");
+                goto end;
+        }
+
+        if(check && pubin) {
+                BIO_printf(bio_err, "Only private keys can be checked\n");
+                goto end;
+        }
+
         in=BIO_new(BIO_s_file());
         out=BIO_new(BIO_s_file());
         if ((in == NULL) || (out == NULL))
@@ -191,9 +227,11 @@ bad:
                         }
                 }
 
-        BIO_printf(bio_err,"read RSA private key\n");
-        if      (informat == FORMAT_ASN1)
-                rsa=d2i_RSAPrivateKey_bio(in,NULL);
+        BIO_printf(bio_err,"read RSA key\n");
+        if      (informat == FORMAT_ASN1) {
+                if (pubin) rsa=d2i_RSA_PUBKEY_bio(in,NULL);
+                else rsa=d2i_RSAPrivateKey_bio(in,NULL);
+        }
 #ifndef NO_RC4
         else if (informat == FORMAT_NETSCAPE)
                 {
@@ -217,12 +255,14 @@ bad:
                                 }
                         }
                 p=(unsigned char *)buf->data;
-                rsa=(RSA *)d2i_Netscape_RSA(NULL,&p,(long)size,NULL);
+                rsa=d2i_Netscape_RSA(NULL,&p,(long)size,NULL);
                 BUF_MEM_free(buf);
                 }
 #endif
-        else if (informat == FORMAT_PEM)
-                rsa=PEM_read_bio_RSAPrivateKey(in,NULL,NULL,NULL);
+        else if (informat == FORMAT_PEM) {
+                if(pubin) rsa=PEM_read_bio_RSA_PUBKEY(in,NULL,NULL,NULL);
+                else rsa=PEM_read_bio_RSAPrivateKey(in,NULL, NULL,passin);
+        }
         else
                 {
                 BIO_printf(bio_err,"bad input format specified for key\n");
@@ -230,7 +270,7 @@ bad:
                 }
         if (rsa == NULL)
                 {
-                BIO_printf(bio_err,"unable to load Private Key\n");
+                BIO_printf(bio_err,"unable to load key\n");
                 ERR_print_errors(bio_err);
                 goto end;
                 }
@@ -256,9 +296,9 @@ bad:
 
         if (modulus)
                 {
-                fprintf(stdout,"Modulus=");
+                BIO_printf(out,"Modulus=");
                 BN_print(out,rsa->n);
-                fprintf(stdout,"\n");
+                BIO_printf(out,"\n");
                 }
 
         if (check)
@@ -288,10 +328,16 @@ bad:
                         }
                 }
                 
-        if (noout) goto end;
-        BIO_printf(bio_err,"writing RSA private key\n");
-        if      (outformat == FORMAT_ASN1)
-                i=i2d_RSAPrivateKey_bio(out,rsa);
+        if (noout)
+                {
+                ret = 0;
+                goto end;
+                }
+        BIO_printf(bio_err,"writing RSA key\n");
+        if      (outformat == FORMAT_ASN1) {
+                if(pubout || pubin) i=i2d_RSA_PUBKEY_bio(out,rsa);
+                else i=i2d_RSAPrivateKey_bio(out,rsa);
+        }
 #ifndef NO_RC4
         else if (outformat == FORMAT_NETSCAPE)
                 {
@@ -311,23 +357,34 @@ bad:
                 Free(pp);
                 }
 #endif
-        else if (outformat == FORMAT_PEM)
-                i=PEM_write_bio_RSAPrivateKey(out,rsa,enc,NULL,0,NULL,NULL);
-        else    {
+        else if (outformat == FORMAT_PEM) {
+                if(pubout || pubin)
+                    i=PEM_write_bio_RSA_PUBKEY(out,rsa);
+                else i=PEM_write_bio_RSAPrivateKey(out,rsa,
+                                                enc,NULL,0,NULL,passout);
+        } else  {
                 BIO_printf(bio_err,"bad output format specified for outfile\n");
                 goto end;
                 }
         if (!i)
                 {
-                BIO_printf(bio_err,"unable to write private key\n");
+                BIO_printf(bio_err,"unable to write key\n");
                 ERR_print_errors(bio_err);
                 }
         else
                 ret=0;
 end:
-        if (in != NULL) BIO_free(in);
-        if (out != NULL) BIO_free(out);
-        if (rsa != NULL) RSA_free(rsa);
+        if(in != NULL) BIO_free(in);
+        if(out != NULL) BIO_free(out);
+        if(rsa != NULL) RSA_free(rsa);
+        if(passin) Free(passin);
+        if(passout) Free(passout);
         EXIT(ret);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/apps/s_client.c b/src/lib/libssl/src/apps/s_client.c
index b06104130e..c4c3b0e94a 100644
--- a/src/lib/libssl/src/apps/s_client.c
+++ b/src/lib/libssl/src/apps/s_client.c
@@ -56,9 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
-#ifdef APPS_CRLF
-# include <assert.h>
-#endif
+#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -83,15 +81,16 @@ typedef unsigned int u_int;
 #include <openssl/pem.h>
 #include "s_apps.h"
 
+#ifdef WINDOWS
+#include <conio.h>
+#endif
+
+
 #if (defined(VMS) && __VMS_VER < 70000000)
 /* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
 #undef FIONBIO
 #endif
 
-#if defined(NO_RSA) && !defined(NO_SSL2)
-#define NO_SSL2
-#endif
-
 #undef PROG
 #define PROG    s_client_main
 
@@ -142,20 +141,20 @@ static void sc_usage(void)
 #ifdef FIONBIO
         BIO_printf(bio_err," -nbio         - Run with non-blocking IO\n");
 #endif
-#ifdef APPS_CRLF /* won't be #ifdef'd in next release */
         BIO_printf(bio_err," -crlf         - convert LF from terminal into CRLF\n");
-#endif
         BIO_printf(bio_err," -quiet        - no s_client output\n");
         BIO_printf(bio_err," -ssl2         - just use SSLv2\n");
         BIO_printf(bio_err," -ssl3         - just use SSLv3\n");
         BIO_printf(bio_err," -tls1         - just use TLSv1\n");
         BIO_printf(bio_err," -no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n");
         BIO_printf(bio_err," -bugs         - Switch on all SSL implementation bug workarounds\n");
-        BIO_printf(bio_err," -cipher       - prefered cipher to use, use the 'openssl ciphers'\n");
+        BIO_printf(bio_err," -cipher       - preferred cipher to use, use the 'openssl ciphers'\n");
         BIO_printf(bio_err,"                 command to see what is available\n");
 
         }
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int off=0;
@@ -171,15 +170,16 @@ int MAIN(int argc, char **argv)
         char *cert_file=NULL,*key_file=NULL;
         char *CApath=NULL,*CAfile=NULL,*cipher=NULL;
         int reconnect=0,badop=0,verify=SSL_VERIFY_NONE,bugs=0;
-#ifdef APPS_CRLF
         int crlf=0;
-#endif
         int write_tty,read_tty,write_ssl,read_ssl,tty_on,ssl_pending;
         SSL_CTX *ctx=NULL;
         int ret=1,in_init=1,i,nbio_test=0;
+        int prexit = 0;
         SSL_METHOD *meth=NULL;
         BIO *sbio;
-        /*static struct timeval timeout={10,0};*/
+#ifdef WINDOWS
+        struct timeval tv;
+#endif
 
 #if !defined(NO_SSL2) && !defined(NO_SSL3)
         meth=SSLv23_client_method();
@@ -244,10 +244,10 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         cert_file= *(++argv);
                         }
-#ifdef APPS_CRLF
+                else if (strcmp(*argv,"-prexit") == 0)
+                        prexit=1;
                 else if (strcmp(*argv,"-crlf") == 0)
                         crlf=1;
-#endif
                 else if (strcmp(*argv,"-quiet") == 0)
                         c_quiet=1;
                 else if (strcmp(*argv,"-pause") == 0)
@@ -324,6 +324,8 @@ bad:
                 goto end;
                 }
 
+        app_RAND_load_file(NULL, bio_err, 0);
+
         if (bio_c_out == NULL)
                 {
                 if (c_quiet)
@@ -337,7 +339,8 @@ bad:
                         }
                 }
 
-        SSLeay_add_ssl_algorithms();
+        OpenSSL_add_ssl_algorithms();
+        SSL_load_error_strings();
         ctx=SSL_CTX_new(meth);
         if (ctx == NULL)
                 {
@@ -352,7 +355,11 @@ bad:
 
         if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
         if (cipher != NULL)
-                SSL_CTX_set_cipher_list(ctx,cipher);
+                if(!SSL_CTX_set_cipher_list(ctx,cipher)) {
+                BIO_printf(bio_err,"error setting cipher list\n");
+                ERR_print_errors(bio_err);
+                goto end;
+        }
 #if 0
         else
                 SSL_CTX_set_cipher_list(ctx,getenv("SSL_CIPHER"));
@@ -365,14 +372,13 @@ bad:
         if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) ||
                 (!SSL_CTX_set_default_verify_paths(ctx)))
                 {
-                /* BIO_printf(bio_err,"error seting default verify locations\n"); */
+                /* BIO_printf(bio_err,"error setting default verify locations\n"); */
                 ERR_print_errors(bio_err);
                 /* goto end; */
                 }
 
-        SSL_load_error_strings();
 
-        con=(SSL *)SSL_new(ctx);
+        con=SSL_new(ctx);
 /*      SSL_set_cipher_list(con,"RC4-MD5"); */
 
 re_start:
@@ -473,12 +479,18 @@ re_start:
                                 if (read_tty)  FD_SET(fileno(stdin),&readfds);
                                 if (write_tty) FD_SET(fileno(stdout),&writefds);
                                 }
-#endif
                         if (read_ssl)
                                 FD_SET(SSL_get_fd(con),&readfds);
                         if (write_ssl)
                                 FD_SET(SSL_get_fd(con),&writefds);
-
+#else
+                        if(!tty_on || !write_tty) {
+                                if (read_ssl)
+                                        FD_SET(SSL_get_fd(con),&readfds);
+                                if (write_ssl)
+                                        FD_SET(SSL_get_fd(con),&writefds);
+                        }
+#endif
 /*                      printf("mode tty(%d %d%d) ssl(%d%d)\n",
                                 tty_on,read_tty,write_tty,read_ssl,write_ssl);*/
 
@@ -488,8 +500,29 @@ re_start:
                          * will choke the compiler: if you do have a cast then
                          * you can either go for (int *) or (void *).
                          */
+#ifdef WINDOWS
+                        /* Under Windows we make the assumption that we can
+                         * always write to the tty: therefore if we need to
+                         * write to the tty we just fall through. Otherwise
+                         * we timeout the select every second and see if there
+                         * are any keypresses. Note: this is a hack, in a proper
+                         * Windows application we wouldn't do this.
+                         */
+                        i=0;
+                        if(!write_tty) {
+                                if(read_tty) {
+                                        tv.tv_sec = 1;
+                                        tv.tv_usec = 0;
+                                        i=select(width,(void *)&readfds,(void *)&writefds,
+                                                 NULL,&tv);
+                                        if(!i && (!_kbhit() || !read_tty) ) continue;
+                                } else  i=select(width,(void *)&readfds,(void *)&writefds,
+                                         NULL,NULL);
+                        }
+#else
                         i=select(width,(void *)&readfds,(void *)&writefds,
                                  NULL,NULL);
+#endif
                         if ( i < 0)
                                 {
                                 BIO_printf(bio_err,"bad select %d\n",
@@ -566,8 +599,12 @@ re_start:
                                 goto shut;
                                 }
                         }
-#ifndef WINDOWS
+#ifdef WINDOWS
+                /* Assume Windows can always write */
+                else if (!ssl_pending && write_tty)
+#else
                 else if (!ssl_pending && FD_ISSET(fileno(stdout),&writefds))
+#endif
                         {
 #ifdef CHARSET_EBCDIC
                         ascii2ebcdic(&(sbuf[sbuf_off]),&(sbuf[sbuf_off]),sbuf_len);
@@ -589,7 +626,6 @@ re_start:
                                 write_tty=0;
                                 }
                         }
-#endif
                 else if (ssl_pending || FD_ISSET(SSL_get_fd(con),&readfds))
                         {
 #ifdef RENEG
@@ -644,10 +680,12 @@ printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
                                 }
                         }
 
-#ifndef WINDOWS
+#ifdef WINDOWS
+                else if (_kbhit())
+#else
                 else if (FD_ISSET(fileno(stdin),&readfds))
+#endif
                         {
-#ifdef APPS_CRLF
                         if (crlf)
                                 {
                                 int j, lf_num;
@@ -671,7 +709,6 @@ printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
                                 assert(lf_num == 0);
                                 }
                         else
-#endif
                                 i=read(fileno(stdin),cbuf,BUFSIZZ);
 
                         if ((!c_quiet) && ((i <= 0) || (cbuf[0] == 'Q')))
@@ -698,13 +735,13 @@ printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
                         write_ssl=1;
                         read_tty=0;
                         }
-#endif
                 }
 shut:
         SSL_shutdown(con);
         SHUTDOWN(SSL_get_fd(con));
         ret=0;
 end:
+        if(prexit) print_stuff(bio_c_out,con,1);
         if (con != NULL) SSL_free(con);
         if (con2 != NULL) SSL_free(con2);
         if (ctx != NULL) SSL_CTX_free(ctx);
diff --git a/src/lib/libssl/src/apps/s_server.c b/src/lib/libssl/src/apps/s_server.c
index 9a81418cda..af19b89227 100644
--- a/src/lib/libssl/src/apps/s_server.c
+++ b/src/lib/libssl/src/apps/s_server.c
@@ -56,9 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
-#ifdef APPS_CRLF
-# include <assert.h>
-#endif
+#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -87,15 +85,15 @@ typedef unsigned int u_int;
 #include <openssl/ssl.h>
 #include "s_apps.h"
 
+#ifdef WINDOWS
+#include <conio.h>
+#endif
+
 #if (defined(VMS) && __VMS_VER < 70000000)
 /* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
 #undef FIONBIO
 #endif
 
-#if defined(NO_RSA) && !defined(NO_SSL2)
-#define NO_SSL2
-#endif
-
 #ifndef NO_RSA
 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength);
 #endif
@@ -106,10 +104,12 @@ static void sv_usage(void);
 static int init_ssl_connection(SSL *s);
 static void print_stats(BIO *bp,SSL_CTX *ctx);
 #ifndef NO_DH
-static DH *load_dh_param(void );
+static DH *load_dh_param(char *dhfile);
 static DH *get_dh512(void);
 #endif
-/* static void s_server_init(void);*/
+#ifdef MONOLITH
+static void s_server_init(void);
+#endif
 
 #ifndef S_ISDIR
 # if defined(_S_IFMT) && defined(_S_IFDIR)
@@ -149,15 +149,13 @@ static DH *get_dh512(void)
 
 #undef BUFSIZZ
 #define BUFSIZZ 16*1024
-static int bufsize=32;
+static int bufsize=BUFSIZZ;
 static int accept_socket= -1;
 
 #define TEST_CERT       "server.pem"
 #undef PROG
 #define PROG            s_server_main
 
-#define DH_PARAM        "server.pem"
-
 extern int verify_depth;
 
 static char *cipher=NULL;
@@ -169,9 +167,7 @@ static char *s_dcert_file=NULL,*s_dkey_file=NULL;
 static int s_nbio=0;
 #endif
 static int s_nbio_test=0;
-#ifdef APPS_CRLF /* won't be #ifdef'd in next release */
 int s_crlf=0;
-#endif
 static SSL_CTX *ctx=NULL;
 static int www=0;
 
@@ -179,9 +175,12 @@ static BIO *bio_s_out=NULL;
 static int s_debug=0;
 static int s_quiet=0;
 
-#if 0
+static int hack=0;
+
+#ifdef MONOLITH
 static void s_server_init(void)
         {
+        accept_socket=-1;
         cipher=NULL;
         s_server_verify=SSL_VERIFY_NONE;
         s_dcert_file=NULL;
@@ -198,6 +197,7 @@ static void s_server_init(void)
         bio_s_out=NULL;
         s_debug=0;
         s_quiet=0;
+        hack=0;
         }
 #endif
 
@@ -211,17 +211,17 @@ static void sv_usage(void)
         BIO_printf(bio_err," -Verify arg   - turn on peer certificate verification, must have a cert.\n");
         BIO_printf(bio_err," -cert arg     - certificate file to use, PEM format assumed\n");
         BIO_printf(bio_err,"                 (default is %s)\n",TEST_CERT);
-        BIO_printf(bio_err," -key arg      - RSA file to use, PEM format assumed, in cert file if\n");
+        BIO_printf(bio_err," -key arg      - Private Key file to use, PEM format assumed, in cert file if\n");
         BIO_printf(bio_err,"                 not specified (default is %s)\n",TEST_CERT);
         BIO_printf(bio_err," -dcert arg    - second certificate file to use (usually for DSA)\n");
         BIO_printf(bio_err," -dkey arg     - second private key file to use (usually for DSA)\n");
+        BIO_printf(bio_err," -dhparam arg  - DH parameter file to use, in cert file if not specified\n");
+        BIO_printf(bio_err,"                 or a default set of parameters is used\n");
 #ifdef FIONBIO
         BIO_printf(bio_err," -nbio         - Run with non-blocking IO\n");
 #endif
         BIO_printf(bio_err," -nbio_test    - test with the non-blocking test bio\n");
-#ifdef APPS_CRLF
         BIO_printf(bio_err," -crlf         - convert LF from terminal into CRLF\n");
-#endif
         BIO_printf(bio_err," -debug        - Print more output\n");
         BIO_printf(bio_err," -state        - Print the SSL states\n");
         BIO_printf(bio_err," -CApath arg   - PEM format directory of CA's\n");
@@ -239,14 +239,13 @@ static void sv_usage(void)
 #ifndef NO_DH
         BIO_printf(bio_err," -no_dhe       - Disable ephemeral DH\n");
 #endif
-        BIO_printf(bio_err," -bugs         - Turn on SSL bug compatability\n");
+        BIO_printf(bio_err," -bugs         - Turn on SSL bug compatibility\n");
         BIO_printf(bio_err," -www          - Respond to a 'GET /' with a status page\n");
         BIO_printf(bio_err," -WWW          - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>\n");
         }
 
 static int local_argc=0;
 static char **local_argv;
-static int hack=0;
 
 #ifdef CHARSET_EBCDIC
 static int ebcdic_new(BIO *bi);
@@ -337,7 +336,7 @@ static int ebcdic_write(BIO *b, char *in, int inl)
                 num = num + num;  /* double the size */
                 if (num < inl)
                         num = inl;
-                Free((char*)wbuf);
+                Free(wbuf);
                 wbuf=(EBCDIC_OUTBUFF *)Malloc(sizeof(EBCDIC_OUTBUFF) + num);
 
                 wbuf->alloced = num;
@@ -398,11 +397,14 @@ static int ebcdic_puts(BIO *bp, char *str)
 }
 #endif
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char *argv[])
         {
         short port=PORT;
         char *CApath=NULL,*CAfile=NULL;
         char *context = NULL;
+        char *dhfile = NULL;
         int badop=0,bugs=0;
         int ret=1;
         int off=0;
@@ -425,8 +427,9 @@ int MAIN(int argc, char *argv[])
         local_argv=argv;
 
         apps_startup();
-        s_quiet=0;
-        s_debug=0;
+#ifdef MONOLITH
+        s_server_init();
+#endif
 
         if (bio_err == NULL)
                 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
@@ -479,6 +482,11 @@ int MAIN(int argc, char *argv[])
                         if (--argc < 1) goto bad;
                         s_key_file= *(++argv);
                         }
+                else if (strcmp(*argv,"-dhparam") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        dhfile = *(++argv);
+                        }
                 else if (strcmp(*argv,"-dcert") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -525,10 +533,8 @@ int MAIN(int argc, char *argv[])
                         { hack=1; }
                 else if (strcmp(*argv,"-state") == 0)
                         { state=1; }
-#ifdef APPS_CRLF
                 else if (strcmp(*argv,"-crlf") == 0)
                         { s_crlf=1; }
-#endif
                 else if (strcmp(*argv,"-quiet") == 0)
                         { s_quiet=1; }
                 else if (strcmp(*argv,"-bugs") == 0)
@@ -575,6 +581,8 @@ bad:
                 goto end;
                 }
 
+        app_RAND_load_file(NULL, bio_err, 0);
+
         if (bio_s_out == NULL)
                 {
                 if (s_quiet && !s_debug)
@@ -599,7 +607,7 @@ bad:
                 }
 
         SSL_load_error_strings();
-        SSLeay_add_ssl_algorithms();
+        OpenSSL_add_ssl_algorithms();
 
         ctx=SSL_CTX_new(meth);
         if (ctx == NULL)
@@ -641,8 +649,7 @@ bad:
 #ifndef NO_DH
         if (!no_dhe)
                 {
-                /* EAY EAY EAY evil hack */
-                dh=load_dh_param();
+                dh=load_dh_param(dhfile ? dhfile : s_cert_file);
                 if (dh != NULL)
                         {
                         BIO_printf(bio_s_out,"Setting temp DH parameters\n");
@@ -692,12 +699,17 @@ bad:
 #endif
 
         if (cipher != NULL)
-                SSL_CTX_set_cipher_list(ctx,cipher);
+                if(!SSL_CTX_set_cipher_list(ctx,cipher)) {
+                BIO_printf(bio_err,"error setting cipher list\n");
+                ERR_print_errors(bio_err);
+                goto end;
+        }
         SSL_CTX_set_verify(ctx,s_server_verify,verify_callback);
         SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context,
                 sizeof s_server_session_id_context);
 
-        SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
+        if (CAfile != NULL)
+            SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
 
         BIO_printf(bio_s_out,"ACCEPT\n");
         if (www)
@@ -750,6 +762,9 @@ static int sv_body(char *hostname, int s, unsigned char *context)
         unsigned long l;
         SSL *con=NULL;
         BIO *sbio;
+#ifdef WINDOWS
+        struct timeval tv;
+#endif
 
         if ((buf=Malloc(bufsize)) == NULL)
                 {
@@ -769,7 +784,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
 #endif
 
         if (con == NULL) {
-                con=(SSL *)SSL_new(ctx);
+                con=SSL_new(ctx);
                 if(context)
                       SSL_set_session_id_context(con, context,
                                                  strlen((char *)context));
@@ -798,22 +813,48 @@ static int sv_body(char *hostname, int s, unsigned char *context)
         width=s+1;
         for (;;)
                 {
-                FD_ZERO(&readfds);
+                int read_from_terminal;
+                int read_from_sslcon;
+
+                read_from_terminal = 0;
+                read_from_sslcon = SSL_pending(con);
+
+                if (!read_from_sslcon)
+                        {
+                        FD_ZERO(&readfds);
 #ifndef WINDOWS
-                FD_SET(fileno(stdin),&readfds);
+                        FD_SET(fileno(stdin),&readfds);
 #endif
-                FD_SET(s,&readfds);
-                /* Note: under VMS with SOCKETSHR the second parameter is
-                 * currently of type (int *) whereas under other systems
-                 * it is (void *) if you don't have a cast it will choke
-                 * the compiler: if you do have a cast then you can either
-                 * go for (int *) or (void *).
-                 */
-                i=select(width,(void *)&readfds,NULL,NULL,NULL);
-                if (i <= 0) continue;
-                if (FD_ISSET(fileno(stdin),&readfds))
+                        FD_SET(s,&readfds);
+                        /* Note: under VMS with SOCKETSHR the second parameter is
+                         * currently of type (int *) whereas under other systems
+                         * it is (void *) if you don't have a cast it will choke
+                         * the compiler: if you do have a cast then you can either
+                         * go for (int *) or (void *).
+                         */
+#ifdef WINDOWS
+                        /* Under Windows we can't select on stdin: only
+                         * on sockets. As a workaround we timeout the select every
+                         * second and check for any keypress. In a proper Windows
+                         * application we wouldn't do this because it is inefficient.
+                         */
+                        tv.tv_sec = 1;
+                        tv.tv_usec = 0;
+                        i=select(width,(void *)&readfds,NULL,NULL,&tv);
+                        if((i < 0) || (!i && !_kbhit() ) )continue;
+                        if(_kbhit())
+                                read_from_terminal = 1;
+#else
+                        i=select(width,(void *)&readfds,NULL,NULL,NULL);
+                        if (i <= 0) continue;
+                        if (FD_ISSET(fileno(stdin),&readfds))
+                                read_from_terminal = 1;
+#endif
+                        if (FD_ISSET(s,&readfds))
+                                read_from_sslcon = 1;
+                        }
+                if (read_from_terminal)
                         {
-#ifdef APPS_CRLF
                         if (s_crlf)
                                 {
                                 int j, lf_num;
@@ -837,7 +878,6 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                 assert(lf_num == 0);
                                 }
                         else
-#endif
                                 i=read(fileno(stdin),buf,bufsize);
                         if (!s_quiet)
                                 {
@@ -926,7 +966,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                 if (i <= 0) break;
                                 }
                         }
-                if (FD_ISSET(s,&readfds))
+                if (read_from_sslcon)
                         {
                         if (!SSL_is_init_finished(con))
                                 {
@@ -1059,12 +1099,12 @@ static int init_ssl_connection(SSL *con)
         }
 
 #ifndef NO_DH
-static DH *load_dh_param(void)
+static DH *load_dh_param(char *dhfile)
         {
         DH *ret=NULL;
         BIO *bio;
 
-        if ((bio=BIO_new_file(DH_PARAM,"r")) == NULL)
+        if ((bio=BIO_new_file(dhfile,"r")) == NULL)
                 goto err;
         ret=PEM_read_bio_DHparams(bio,NULL,NULL,NULL);
 err:
@@ -1126,7 +1166,7 @@ static int www_body(char *hostname, int s, unsigned char *context)
         /* lets make the output buffer a reasonable size */
         if (!BIO_set_write_buffer_size(io,bufsize)) goto err;
 
-        if ((con=(SSL *)SSL_new(ctx)) == NULL) goto err;
+        if ((con=SSL_new(ctx)) == NULL) goto err;
         if(context) SSL_set_session_id_context(con, context,
                                                strlen((char *)context));
 
@@ -1424,7 +1464,7 @@ end:
         /* make sure we re-use sessions */
         SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
 #else
-        /* This kills performace */
+        /* This kills performance */
 /*      SSL_shutdown(con); A shutdown gets sent in the
  *      BIO_free_all(io) procession */
 #endif
diff --git a/src/lib/libssl/src/apps/s_time.c b/src/lib/libssl/src/apps/s_time.c
index a529e2a119..39fd3b8b4d 100644
--- a/src/lib/libssl/src/apps/s_time.c
+++ b/src/lib/libssl/src/apps/s_time.c
@@ -67,10 +67,6 @@
 #include <stdlib.h>
 #include <string.h>
 
-#if defined(NO_RSA) && !defined(NO_SSL2)
-#define NO_SSL2
-#endif
-
 #ifdef NO_STDIO
 #define APPS_WIN16
 #endif
@@ -220,7 +216,7 @@ static void s_time_usage(void)
                 file if not specified by this option\n\
 -CApath arg   - PEM format directory of CA's\n\
 -CAfile arg   - PEM format file of CA's\n\
--cipher       - prefered cipher to use, play with 'openssl ciphers'\n\n";
+-cipher       - preferred cipher to use, play with 'openssl ciphers'\n\n";
 
         printf( "usage: s_time <args>\n\n" );
 
@@ -229,7 +225,7 @@ static void s_time_usage(void)
         printf("-nbio         - Run with non-blocking IO\n");
         printf("-ssl2         - Just use SSLv2\n");
         printf("-ssl3         - Just use SSLv3\n");
-        printf("-bugs         - Turn on SSL bug compatability\n");
+        printf("-bugs         - Turn on SSL bug compatibility\n");
         printf("-new          - Just time new connections\n");
         printf("-reuse        - Just time connection reuse\n");
         printf("-www page     - Retrieve 'page' from the site\n");
@@ -248,15 +244,6 @@ static int parseArgs(int argc, char **argv)
 
     verify_depth=0;
     verify_error=X509_V_OK;
-#ifdef FIONBIO
-    t_nbio=0;
-#endif
-
-        apps_startup();
-        s_time_init();
-
-        if (bio_err == NULL)
-                bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
 
     argc--;
     argv++;
@@ -401,6 +388,8 @@ static double tm_Time_F(int s)
  * MAIN - main processing area for client
  *                      real name depends on MONOLITH
  */
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         double totalTime = 0.0;
@@ -411,6 +400,12 @@ int MAIN(int argc, char **argv)
         MS_STATIC char buf[1024*8];
         int ver;
 
+        apps_startup();
+        s_time_init();
+
+        if (bio_err == NULL)
+                bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
+
 #if !defined(NO_SSL2) && !defined(NO_SSL3)
         s_time_meth=SSLv23_client_method();
 #elif !defined(NO_SSL3)
@@ -423,7 +418,7 @@ int MAIN(int argc, char **argv)
         if( parseArgs( argc, argv ) < 0 )
                 goto end;
 
-        SSLeay_add_ssl_algorithms();
+        OpenSSL_add_ssl_algorithms();
         if ((tm_ctx=SSL_CTX_new(s_time_meth)) == NULL) return(1);
 
         SSL_CTX_set_quiet_shutdown(tm_ctx,1);
@@ -438,7 +433,7 @@ int MAIN(int argc, char **argv)
         if ((!SSL_CTX_load_verify_locations(tm_ctx,CAfile,CApath)) ||
                 (!SSL_CTX_set_default_verify_paths(tm_ctx)))
                 {
-                /* BIO_printf(bio_err,"error seting default verify locations\n"); */
+                /* BIO_printf(bio_err,"error setting default verify locations\n"); */
                 ERR_print_errors(bio_err);
                 /* goto end; */
                 }
@@ -639,7 +634,7 @@ static SSL *doConnection(SSL *scon)
         BIO_set_conn_hostname(conn,host);
 
         if (scon == NULL)
-                serverCon=(SSL *)SSL_new(tm_ctx);
+                serverCon=SSL_new(tm_ctx);
         else
                 {
                 serverCon=scon;
diff --git a/src/lib/libssl/src/apps/sess_id.c b/src/lib/libssl/src/apps/sess_id.c
index 8ac118d4a1..71d5aa0b7c 100644
--- a/src/lib/libssl/src/apps/sess_id.c
+++ b/src/lib/libssl/src/apps/sess_id.c
@@ -72,7 +72,7 @@
 static char *sess_id_usage[]={
 "usage: sess_id args\n",
 "\n",
-" -inform arg     - input format - default PEM (one of DER, TXT or PEM)\n",
+" -inform arg     - input format - default PEM (DER or PEM)\n",
 " -outform arg    - output format - default PEM\n",
 " -in arg         - input file - default stdin\n",
 " -out arg        - output file - default stdout\n",
@@ -84,6 +84,9 @@ NULL
 };
 
 static SSL_SESSION *load_sess_id(char *file, int format);
+
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         SSL_SESSION *x=NULL;
diff --git a/src/lib/libssl/src/apps/smime.c b/src/lib/libssl/src/apps/smime.c
new file mode 100644
index 0000000000..77633cfb60
--- /dev/null
+++ b/src/lib/libssl/src/apps/smime.c
@@ -0,0 +1,646 @@
+/* smime.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* S/MIME utility function */
+
+#include <stdio.h>
+#include <string.h>
+#include "apps.h"
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#include <openssl/err.h>
+
+#undef PROG
+#define PROG smime_main
+static X509 *load_cert(char *file);
+static EVP_PKEY *load_key(char *file, char *pass);
+static STACK_OF(X509) *load_certs(char *file);
+static X509_STORE *setup_verify(char *CAfile, char *CApath);
+static int save_certs(char *signerfile, STACK_OF(X509) *signers);
+
+#define SMIME_OP        0x10
+#define SMIME_ENCRYPT   (1 | SMIME_OP)
+#define SMIME_DECRYPT   2
+#define SMIME_SIGN      (3 | SMIME_OP)
+#define SMIME_VERIFY    4
+#define SMIME_PK7OUT    5
+
+int MAIN(int, char **);
+
+int MAIN(int argc, char **argv)
+{
+        int operation = 0;
+        int ret = 0;
+        char **args;
+        char *inmode = "r", *outmode = "w";
+        char *infile = NULL, *outfile = NULL;
+        char *signerfile = NULL, *recipfile = NULL;
+        char *certfile = NULL, *keyfile = NULL;
+        EVP_CIPHER *cipher = NULL;
+        PKCS7 *p7 = NULL;
+        X509_STORE *store = NULL;
+        X509 *cert = NULL, *recip = NULL, *signer = NULL;
+        EVP_PKEY *key = NULL;
+        STACK_OF(X509) *encerts = NULL, *other = NULL;
+        BIO *in = NULL, *out = NULL, *indata = NULL;
+        int badarg = 0;
+        int flags = PKCS7_DETACHED;
+        char *to = NULL, *from = NULL, *subject = NULL;
+        char *CAfile = NULL, *CApath = NULL;
+        char *passargin = NULL, *passin = NULL;
+        char *inrand = NULL;
+        int need_rand = 0;
+        args = argv + 1;
+
+        ret = 1;
+
+        while (!badarg && *args && *args[0] == '-') {
+                if (!strcmp (*args, "-encrypt")) operation = SMIME_ENCRYPT;
+                else if (!strcmp (*args, "-decrypt")) operation = SMIME_DECRYPT;
+                else if (!strcmp (*args, "-sign")) operation = SMIME_SIGN;
+                else if (!strcmp (*args, "-verify")) operation = SMIME_VERIFY;
+                else if (!strcmp (*args, "-pk7out")) operation = SMIME_PK7OUT;
+#ifndef NO_DES
+                else if (!strcmp (*args, "-des3")) 
+                                cipher = EVP_des_ede3_cbc();
+                else if (!strcmp (*args, "-des")) 
+                                cipher = EVP_des_cbc();
+#endif
+#ifndef NO_RC2
+                else if (!strcmp (*args, "-rc2-40")) 
+                                cipher = EVP_rc2_40_cbc();
+                else if (!strcmp (*args, "-rc2-128")) 
+                                cipher = EVP_rc2_cbc();
+                else if (!strcmp (*args, "-rc2-64")) 
+                                cipher = EVP_rc2_64_cbc();
+#endif
+                else if (!strcmp (*args, "-text")) 
+                                flags |= PKCS7_TEXT;
+                else if (!strcmp (*args, "-nointern")) 
+                                flags |= PKCS7_NOINTERN;
+                else if (!strcmp (*args, "-noverify")) 
+                                flags |= PKCS7_NOVERIFY;
+                else if (!strcmp (*args, "-nochain")) 
+                                flags |= PKCS7_NOCHAIN;
+                else if (!strcmp (*args, "-nocerts")) 
+                                flags |= PKCS7_NOCERTS;
+                else if (!strcmp (*args, "-noattr")) 
+                                flags |= PKCS7_NOATTR;
+                else if (!strcmp (*args, "-nodetach")) 
+                                flags &= ~PKCS7_DETACHED;
+                else if (!strcmp (*args, "-binary"))
+                                flags |= PKCS7_BINARY;
+                else if (!strcmp (*args, "-nosigs"))
+                                flags |= PKCS7_NOSIGS;
+                else if (!strcmp(*args,"-rand")) {
+                        if (args[1]) {
+                                args++;
+                                inrand = *args;
+                        } else badarg = 1;
+                        need_rand = 1;
+                } else if (!strcmp(*args,"-passin")) {
+                        if (args[1]) {
+                                args++;
+                                passargin = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-to")) {
+                        if (args[1]) {
+                                args++;
+                                to = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-from")) {
+                        if (args[1]) {
+                                args++;
+                                from = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-subject")) {
+                        if (args[1]) {
+                                args++;
+                                subject = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-signer")) {
+                        if (args[1]) {
+                                args++;
+                                signerfile = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-recip")) {
+                        if (args[1]) {
+                                args++;
+                                recipfile = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-inkey")) {
+                        if (args[1]) {
+                                args++;
+                                keyfile = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-certfile")) {
+                        if (args[1]) {
+                                args++;
+                                certfile = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-CAfile")) {
+                        if (args[1]) {
+                                args++;
+                                CAfile = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-CApath")) {
+                        if (args[1]) {
+                                args++;
+                                CApath = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-in")) {
+                        if (args[1]) {
+                                args++;
+                                infile = *args;
+                        } else badarg = 1;
+                } else if (!strcmp (*args, "-out")) {
+                        if (args[1]) {
+                                args++;
+                                outfile = *args;
+                        } else badarg = 1;
+                } else badarg = 1;
+                args++;
+        }
+
+        if(operation == SMIME_SIGN) {
+                if(!signerfile) {
+                        BIO_printf(bio_err, "No signer certificate specified\n");
+                        badarg = 1;
+                }
+                need_rand = 1;
+        } else if(operation == SMIME_DECRYPT) {
+                if(!recipfile) {
+                        BIO_printf(bio_err, "No recipient certificate and key specified\n");
+                        badarg = 1;
+                }
+        } else if(operation == SMIME_ENCRYPT) {
+                if(!*args) {
+                        BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
+                        badarg = 1;
+                }
+                need_rand = 1;
+        } else if(!operation) badarg = 1;
+
+        if (badarg) {
+                BIO_printf (bio_err, "Usage smime [options] cert.pem ...\n");
+                BIO_printf (bio_err, "where options are\n");
+                BIO_printf (bio_err, "-encrypt       encrypt message\n");
+                BIO_printf (bio_err, "-decrypt       decrypt encrypted message\n");
+                BIO_printf (bio_err, "-sign          sign message\n");
+                BIO_printf (bio_err, "-verify        verify signed message\n");
+                BIO_printf (bio_err, "-pk7out        output PKCS#7 structure\n");
+#ifndef NO_DES
+                BIO_printf (bio_err, "-des3          encrypt with triple DES\n");
+                BIO_printf (bio_err, "-des           encrypt with DES\n");
+#endif
+#ifndef NO_RC2
+                BIO_printf (bio_err, "-rc2-40        encrypt with RC2-40 (default)\n");
+                BIO_printf (bio_err, "-rc2-64        encrypt with RC2-64\n");
+                BIO_printf (bio_err, "-rc2-128       encrypt with RC2-128\n");
+#endif
+                BIO_printf (bio_err, "-nointern      don't search certificates in message for signer\n");
+                BIO_printf (bio_err, "-nosigs        don't verify message signature\n");
+                BIO_printf (bio_err, "-noverify      don't verify signers certificate\n");
+                BIO_printf (bio_err, "-nocerts       don't include signers certificate when signing\n");
+                BIO_printf (bio_err, "-nodetach      use opaque signing\n");
+                BIO_printf (bio_err, "-noattr        don't include any signed attributes\n");
+                BIO_printf (bio_err, "-binary        don't translate message to text\n");
+                BIO_printf (bio_err, "-certfile file other certificates file\n");
+                BIO_printf (bio_err, "-signer file   signer certificate file\n");
+                BIO_printf (bio_err, "-recip  file   recipient certificate file for decryption\n");
+                BIO_printf (bio_err, "-in file       input file\n");
+                BIO_printf (bio_err, "-inkey file    input private key (if not signer or recipient)\n");
+                BIO_printf (bio_err, "-out file      output file\n");
+                BIO_printf (bio_err, "-to addr       to address\n");
+                BIO_printf (bio_err, "-from ad       from address\n");
+                BIO_printf (bio_err, "-subject s     subject\n");
+                BIO_printf (bio_err, "-text          include or delete text MIME headers\n");
+                BIO_printf (bio_err, "-CApath dir    trusted certificates directory\n");
+                BIO_printf (bio_err, "-CAfile file   trusted certificates file\n");
+                BIO_printf(bio_err,  "-rand file:file:...\n");
+                BIO_printf(bio_err,  "               load the file (or the files in the directory) into\n");
+                BIO_printf(bio_err,  "               the random number generator\n");
+                BIO_printf (bio_err, "cert.pem       recipient certificate(s) for encryption\n");
+                goto end;
+        }
+
+        if(!app_passwd(bio_err, passargin, NULL, &passin, NULL)) {
+                BIO_printf(bio_err, "Error getting password\n");
+                goto end;
+        }
+
+        if (need_rand) {
+                app_RAND_load_file(NULL, bio_err, (inrand != NULL));
+                if (inrand != NULL)
+                        BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                                app_RAND_load_files(inrand));
+        }
+
+        ret = 2;
+
+        if(operation != SMIME_SIGN) flags &= ~PKCS7_DETACHED;
+
+        if(flags & PKCS7_BINARY) {
+                if(operation & SMIME_OP) inmode = "rb";
+                else outmode = "rb";
+        }
+
+        if(operation == SMIME_ENCRYPT) {
+                if (!cipher) {
+#ifndef NO_RC2                  
+                        cipher = EVP_rc2_40_cbc();
+#else
+                        BIO_printf(bio_err, "No cipher selected\n");
+                        goto end;
+#endif
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("load encryption certificates");
+#endif          
+                encerts = sk_X509_new_null();
+                while (*args) {
+                        if(!(cert = load_cert(*args))) {
+                                BIO_printf(bio_err, "Can't read recipient certificate file %s\n", *args);
+                                goto end;
+                        }
+                        sk_X509_push(encerts, cert);
+                        cert = NULL;
+                        args++;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        }
+
+        if(signerfile && (operation == SMIME_SIGN)) {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("load signer certificate");
+#endif          
+                if(!(signer = load_cert(signerfile))) {
+                        BIO_printf(bio_err, "Can't read signer certificate file %s\n", signerfile);
+                        goto end;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        }
+
+        if(certfile) {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("load other certfiles");
+#endif          
+                if(!(other = load_certs(certfile))) {
+                        BIO_printf(bio_err, "Can't read certificate file %s\n", certfile);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        }
+
+        if(recipfile && (operation == SMIME_DECRYPT)) {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("load recipient certificate");
+#endif          
+                if(!(recip = load_cert(recipfile))) {
+                        BIO_printf(bio_err, "Can't read recipient certificate file %s\n", recipfile);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        }
+
+        if(operation == SMIME_DECRYPT) {
+                if(!keyfile) keyfile = recipfile;
+        } else if(operation == SMIME_SIGN) {
+                if(!keyfile) keyfile = signerfile;
+        } else keyfile = NULL;
+
+        if(keyfile) {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("load keyfile");
+#endif          
+                if(!(key = load_key(keyfile, passin))) {
+                        BIO_printf(bio_err, "Can't read recipient certificate file %s\n", keyfile);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        }
+
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_push_info("open input files");
+#endif          
+        if (infile) {
+                if (!(in = BIO_new_file(infile, inmode))) {
+                        BIO_printf (bio_err,
+                                 "Can't open input file %s\n", infile);
+                        goto end;
+                }
+        } else in = BIO_new_fp(stdin, BIO_NOCLOSE);
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+#endif          
+
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_push_info("open output files");
+#endif          
+        if (outfile) {
+                if (!(out = BIO_new_file(outfile, outmode))) {
+                        BIO_printf (bio_err,
+                                 "Can't open output file %s\n", outfile);
+                        goto end;
+                }
+        } else out = BIO_new_fp(stdout, BIO_NOCLOSE);
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+#endif          
+
+        if(operation == SMIME_VERIFY) {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("setup_verify");
+#endif          
+                if(!(store = setup_verify(CAfile, CApath))) goto end;
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        }
+
+        ret = 3;
+
+        if(operation == SMIME_ENCRYPT) {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("PKCS7_encrypt");
+#endif          
+                p7 = PKCS7_encrypt(encerts, in, cipher, flags);
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        } else if(operation == SMIME_SIGN) {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("PKCS7_sign");
+#endif          
+                p7 = PKCS7_sign(signer, key, other, in, flags);
+                BIO_reset(in);
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        } else {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("SMIME_read_PKCS7");
+#endif          
+                if(!(p7 = SMIME_read_PKCS7(in, &indata))) {
+                        BIO_printf(bio_err, "Error reading S/MIME message\n");
+                        goto end;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        }
+
+        if(!p7) {
+                BIO_printf(bio_err, "Error creating PKCS#7 structure\n");
+                goto end;
+        }
+
+        ret = 4;
+        if(operation == SMIME_DECRYPT) {
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("PKCS7_decrypt");
+#endif          
+                if(!PKCS7_decrypt(p7, key, recip, out, flags)) {
+                        BIO_printf(bio_err, "Error decrypting PKCS#7 structure\n");
+                        goto end;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+        } else if(operation == SMIME_VERIFY) {
+                STACK_OF(X509) *signers;
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_push_info("PKCS7_verify");
+#endif          
+                if(PKCS7_verify(p7, other, store, indata, out, flags)) {
+                        BIO_printf(bio_err, "Verification Successful\n");
+                } else {
+                        BIO_printf(bio_err, "Verification Failure\n");
+                        goto end;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+                CRYPTO_push_info("PKCS7_get0_signers");
+#endif          
+                signers = PKCS7_get0_signers(p7, other, flags);
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+                CRYPTO_push_info("save_certs");
+#endif          
+                if(!save_certs(signerfile, signers)) {
+                        BIO_printf(bio_err, "Error writing signers to %s\n",
+                                                                signerfile);
+                        ret = 5;
+                        goto end;
+                }
+#ifdef CRYPTO_MDEBUG
+                CRYPTO_pop_info();
+#endif          
+                sk_X509_free(signers);
+        } else if(operation == SMIME_PK7OUT) {
+                PEM_write_bio_PKCS7(out, p7);
+        } else {
+                if(to) BIO_printf(out, "To: %s\n", to);
+                if(from) BIO_printf(out, "From: %s\n", from);
+                if(subject) BIO_printf(out, "Subject: %s\n", subject);
+                SMIME_write_PKCS7(out, p7, in, flags);
+        }
+        ret = 0;
+end:
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_remove_all_info();
+#endif
+        if (need_rand)
+                app_RAND_write_file(NULL, bio_err);
+        if(ret) ERR_print_errors(bio_err);
+        sk_X509_pop_free(encerts, X509_free);
+        sk_X509_pop_free(other, X509_free);
+        X509_STORE_free(store);
+        X509_free(cert);
+        X509_free(recip);
+        X509_free(signer);
+        EVP_PKEY_free(key);
+        PKCS7_free(p7);
+        BIO_free(in);
+        BIO_free(indata);
+        BIO_free(out);
+        if(passin) Free(passin);
+        return (ret);
+}
+
+static X509 *load_cert(char *file)
+{
+        BIO *in;
+        X509 *cert;
+        if(!(in = BIO_new_file(file, "r"))) return NULL;
+        cert = PEM_read_bio_X509(in, NULL, NULL,NULL);
+        BIO_free(in);
+        return cert;
+}
+
+static EVP_PKEY *load_key(char *file, char *pass)
+{
+        BIO *in;
+        EVP_PKEY *key;
+        if(!(in = BIO_new_file(file, "r"))) return NULL;
+        key = PEM_read_bio_PrivateKey(in, NULL,NULL,pass);
+        BIO_free(in);
+        return key;
+}
+
+static STACK_OF(X509) *load_certs(char *file)
+{
+        BIO *in;
+        int i;
+        STACK_OF(X509) *othercerts;
+        STACK_OF(X509_INFO) *allcerts;
+        X509_INFO *xi;
+        if(!(in = BIO_new_file(file, "r"))) return NULL;
+        othercerts = sk_X509_new(NULL);
+        if(!othercerts) return NULL;
+        allcerts = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
+        for(i = 0; i < sk_X509_INFO_num(allcerts); i++) {
+                xi = sk_X509_INFO_value (allcerts, i);
+                if (xi->x509) {
+                        sk_X509_push(othercerts, xi->x509);
+                        xi->x509 = NULL;
+                }
+        }
+        sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
+        BIO_free(in);
+        return othercerts;
+}
+
+static X509_STORE *setup_verify(char *CAfile, char *CApath)
+{
+        X509_STORE *store;
+        X509_LOOKUP *lookup;
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_push_info("X509_STORE_new");
+#endif  
+        if(!(store = X509_STORE_new())) goto end;
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+        CRYPTO_push_info("X509_STORE_add_lookup(...file)");
+#endif  
+        lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
+        if (lookup == NULL) goto end;
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+        CRYPTO_push_info("X509_LOOKUP_load_file");
+#endif  
+        if (CAfile) {
+                if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) {
+                        BIO_printf(bio_err, "Error loading file %s\n", CAfile);
+                        goto end;
+                }
+        } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
+                
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+        CRYPTO_push_info("X509_STORE_add_lookup(...hash_dir)");
+#endif  
+        lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
+        if (lookup == NULL) goto end;
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+        CRYPTO_push_info("X509_LOOKUP_add_dir");
+#endif  
+        if (CApath) {
+                if(!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) {
+                        BIO_printf(bio_err, "Error loading directory %s\n", CApath);
+                        goto end;
+                }
+        } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+#endif  
+
+        ERR_clear_error();
+        return store;
+        end:
+        X509_STORE_free(store);
+        return NULL;
+}
+
+static int save_certs(char *signerfile, STACK_OF(X509) *signers)
+{
+        int i;
+        BIO *tmp;
+        if(!signerfile) return 1;
+        tmp = BIO_new_file(signerfile, "w");
+        if(!tmp) return 0;
+        for(i = 0; i < sk_X509_num(signers); i++)
+                PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
+        BIO_free(tmp);
+        return 1;
+}
+        
diff --git a/src/lib/libssl/src/apps/speed.c b/src/lib/libssl/src/apps/speed.c
index 3cfb4dbea2..b3130def8b 100644
--- a/src/lib/libssl/src/apps/speed.c
+++ b/src/lib/libssl/src/apps/speed.c
@@ -238,16 +238,19 @@ static double Time_F(int s)
 #endif
         }
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         unsigned char *buf=NULL,*buf2=NULL;
-        int ret=1;
+        int mret=1;
 #define ALGOR_NUM       14
 #define SIZE_NUM        5
 #define RSA_NUM         4
 #define DSA_NUM         3
         long count,rsa_count;
-        int i,j,k,rsa_num,rsa_num2;
+        int i,j,k;
+        unsigned rsa_num,rsa_num2;
 #ifndef NO_MD2
         unsigned char md2[MD2_DIGEST_LENGTH];
 #endif
@@ -344,6 +347,7 @@ int MAIN(int argc, char **argv)
         int pr_header=0;
 
         apps_startup();
+        memset(results, 0, sizeof(results));
 #ifndef NO_DSA
         memset(dsa_key,0,sizeof(dsa_key));
 #endif
@@ -421,7 +425,7 @@ int MAIN(int argc, char **argv)
                         if (strcmp(*argv,"rc4") == 0) doit[D_RC4]=1;
                 else 
 #endif
-#ifndef NO_DEF
+#ifndef NO_DES
                         if (strcmp(*argv,"des-cbc") == 0) doit[D_CBC_DES]=1;
                 else    if (strcmp(*argv,"des-ede3") == 0) doit[D_EDE3_DES]=1;
                 else
@@ -435,12 +439,14 @@ int MAIN(int argc, char **argv)
                         }
                 else
 #endif
+#ifndef RSA_NULL
                         if (strcmp(*argv,"openssl") == 0) 
                         {
                         RSA_set_default_method(RSA_PKCS1_SSLeay());
                         j--;
                         }
                 else
+#endif
 #endif /* !NO_RSA */
                      if (strcmp(*argv,"dsa512") == 0) dsa_doit[R_DSA_512]=2;
                 else if (strcmp(*argv,"dsa1024") == 0) dsa_doit[R_DSA_1024]=2;
@@ -586,9 +592,9 @@ int MAIN(int argc, char **argv)
 #endif
 
 #ifndef NO_DES
-        des_set_key(&key,sch);
-        des_set_key(&key2,sch2);
-        des_set_key(&key3,sch3);
+        des_set_key_unchecked(&key,sch);
+        des_set_key_unchecked(&key2,sch2);
+        des_set_key_unchecked(&key3,sch3);
 #endif
 #ifndef NO_IDEA
         idea_set_encrypt_key(key16,&idea_ks);
@@ -612,6 +618,7 @@ int MAIN(int argc, char **argv)
         memset(rsa_c,0,sizeof(rsa_c));
 #endif
 #ifndef SIGALRM
+#ifndef NO_DES
         BIO_printf(bio_err,"First we calculate the approximate speed ...\n");
         count=10;
         do      {
@@ -703,10 +710,14 @@ int MAIN(int argc, char **argv)
 #define COND(d) (count < (d))
 #define COUNT(d) (d)
 #else
+/* not worth fixing */
+# error "You cannot disable DES on systems without SIGALRM."
+#endif /* NO_DES */
+#else
 #define COND(c) (run)
 #define COUNT(d) (count)
         signal(SIGALRM,sig_done);
-#endif
+#endif /* SIGALRM */
 
 #ifndef NO_MD2
         if (doit[D_MD2])
@@ -956,22 +967,22 @@ int MAIN(int argc, char **argv)
                 }
 #endif
 
-        RAND_bytes(buf,30);
+        RAND_pseudo_bytes(buf,36);
 #ifndef NO_RSA
         for (j=0; j<RSA_NUM; j++)
                 {
+                int ret;
                 if (!rsa_doit[j]) continue;
-                rsa_num=RSA_private_encrypt(30,buf,buf2,rsa_key[j],
-                        RSA_PKCS1_PADDING);
+                ret=RSA_sign(NID_md5_sha1, buf,36, buf2, &rsa_num, rsa_key[j]);
                 pkey_print_message("private","rsa",rsa_c[j][0],rsa_bits[j],
                         RSA_SECONDS);
 /*              RSA_blinding_on(rsa_key[j],NULL); */
                 Time_F(START);
                 for (count=0,run=1; COND(rsa_c[j][0]); count++)
                         {
-                        rsa_num=RSA_private_encrypt(30,buf,buf2,rsa_key[j],
-                                RSA_PKCS1_PADDING);
-                        if (rsa_num <= 0)
+                        ret=RSA_sign(NID_md5_sha1, buf,36, buf2, &rsa_num,
+                                                                 rsa_key[j]);
+                        if (ret <= 0)
                                 {
                                 BIO_printf(bio_err,"RSA private encrypt failure\n");
                                 ERR_print_errors(bio_err);
@@ -986,18 +997,17 @@ int MAIN(int argc, char **argv)
                 rsa_count=count;
 
 #if 1
-                rsa_num2=RSA_public_decrypt(rsa_num,buf2,buf,rsa_key[j],
-                        RSA_PKCS1_PADDING);
+                ret=RSA_verify(NID_md5_sha1, buf,36, buf2, rsa_num, rsa_key[j]);
                 pkey_print_message("public","rsa",rsa_c[j][1],rsa_bits[j],
                         RSA_SECONDS);
                 Time_F(START);
                 for (count=0,run=1; COND(rsa_c[j][1]); count++)
                         {
-                        rsa_num2=RSA_public_decrypt(rsa_num,buf2,buf,rsa_key[j],
-                                RSA_PKCS1_PADDING);
-                        if (rsa_num2 <= 0)
+                        ret=RSA_verify(NID_md5_sha1, buf,36, buf2, rsa_num,
+                                                                rsa_key[j]);
+                        if (ret <= 0)
                                 {
-                                BIO_printf(bio_err,"RSA public encrypt failure\n");
+                                BIO_printf(bio_err,"RSA verify failure\n");
                                 ERR_print_errors(bio_err);
                                 count=1;
                                 break;
@@ -1018,7 +1028,7 @@ int MAIN(int argc, char **argv)
                 }
 #endif
 
-        RAND_bytes(buf,20);
+        RAND_pseudo_bytes(buf,20);
 #ifndef NO_DSA
         for (j=0; j<DSA_NUM; j++)
                 {
@@ -1036,7 +1046,7 @@ int MAIN(int argc, char **argv)
                         {
                         rsa_num=DSA_sign(EVP_PKEY_DSA,buf,20,buf2,
                                 &kk,dsa_key[j]);
-                        if (rsa_num <= 0)
+                        if (rsa_num == 0)
                                 {
                                 BIO_printf(bio_err,"DSA sign failure\n");
                                 ERR_print_errors(bio_err);
@@ -1059,7 +1069,7 @@ int MAIN(int argc, char **argv)
                         {
                         rsa_num2=DSA_verify(EVP_PKEY_DSA,buf,20,buf2,
                                 kk,dsa_key[j]);
-                        if (rsa_num2 <= 0)
+                        if (rsa_num2 == 0)
                                 {
                                 BIO_printf(bio_err,"DSA verify failure\n");
                                 ERR_print_errors(bio_err);
@@ -1155,7 +1165,7 @@ int MAIN(int argc, char **argv)
                 fprintf(stdout,"\n");
                 }
 #endif
-        ret=0;
+        mret=0;
 end:
         if (buf != NULL) Free(buf);
         if (buf2 != NULL) Free(buf2);
@@ -1169,7 +1179,7 @@ end:
                 if (dsa_key[i] != NULL)
                         DSA_free(dsa_key[i]);
 #endif
-        EXIT(ret);
+        EXIT(mret);
         }
 
 static void print_message(char *s, long num, int length)
diff --git a/src/lib/libssl/src/apps/spkac.c b/src/lib/libssl/src/apps/spkac.c
new file mode 100644
index 0000000000..b35354a8d7
--- /dev/null
+++ b/src/lib/libssl/src/apps/spkac.c
@@ -0,0 +1,274 @@
+/* apps/spkac.c */
+
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999. Based on an original idea by Massimiliano Pala
+ * (madwolf@openca.org).
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include "apps.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+
+#undef PROG
+#define PROG    spkac_main
+
+/* -in arg      - input file - default stdin
+ * -out arg     - output file - default stdout
+ */
+
+int MAIN(int, char **);
+
+int MAIN(int argc, char **argv)
+        {
+        int i,badops=0, ret = 1;
+        BIO *in = NULL,*out = NULL, *key = NULL;
+        int verify=0,noout=0,pubkey=0;
+        char *infile = NULL,*outfile = NULL,*prog;
+        char *passargin = NULL, *passin = NULL;
+        char *spkac = "SPKAC", *spksect = "default", *spkstr = NULL;
+        char *challenge = NULL, *keyfile = NULL;
+        LHASH *conf = NULL;
+        NETSCAPE_SPKI *spki = NULL;
+        EVP_PKEY *pkey = NULL;
+
+        apps_startup();
+
+        if (!bio_err) bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
+
+        prog=argv[0];
+        argc--;
+        argv++;
+        while (argc >= 1)
+                {
+                if (strcmp(*argv,"-in") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        infile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-out") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        outfile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-passin") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargin= *(++argv);
+                        }
+                else if (strcmp(*argv,"-key") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        keyfile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-challenge") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        challenge= *(++argv);
+                        }
+                else if (strcmp(*argv,"-spkac") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        spkac= *(++argv);
+                        }
+                else if (strcmp(*argv,"-spksect") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        spksect= *(++argv);
+                        }
+                else if (strcmp(*argv,"-noout") == 0)
+                        noout=1;
+                else if (strcmp(*argv,"-pubkey") == 0)
+                        pubkey=1;
+                else if (strcmp(*argv,"-verify") == 0)
+                        verify=1;
+                else badops = 1;
+                argc--;
+                argv++;
+                }
+
+        if (badops)
+                {
+bad:
+                BIO_printf(bio_err,"%s [options]\n",prog);
+                BIO_printf(bio_err,"where options are\n");
+                BIO_printf(bio_err," -in arg        input file\n");
+                BIO_printf(bio_err," -out arg       output file\n");
+                BIO_printf(bio_err," -key arg       create SPKAC using private key\n");
+                BIO_printf(bio_err," -passin arg    input file pass phrase source\n");
+                BIO_printf(bio_err," -challenge arg challenge string\n");
+                BIO_printf(bio_err," -spkac arg     alternative SPKAC name\n");
+                BIO_printf(bio_err," -noout         don't print SPKAC\n");
+                BIO_printf(bio_err," -pubkey        output public key\n");
+                BIO_printf(bio_err," -verify        verify SPKAC signature\n");
+                goto end;
+                }
+
+        ERR_load_crypto_strings();
+        if(!app_passwd(bio_err, passargin, NULL, &passin, NULL)) {
+                BIO_printf(bio_err, "Error getting password\n");
+                goto end;
+        }
+
+        if(keyfile) {
+                if(strcmp(keyfile, "-")) key = BIO_new_file(keyfile, "r");
+                else key = BIO_new_fp(stdin, BIO_NOCLOSE);
+                if(!key) {
+                        BIO_printf(bio_err, "Error opening key file\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+                pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, passin);
+                if(!pkey) {
+                        BIO_printf(bio_err, "Error reading private key\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+                spki = NETSCAPE_SPKI_new();
+                if(challenge) ASN1_STRING_set(spki->spkac->challenge,
+                                                 challenge, strlen(challenge));
+                NETSCAPE_SPKI_set_pubkey(spki, pkey);
+                NETSCAPE_SPKI_sign(spki, pkey, EVP_md5());
+                spkstr = NETSCAPE_SPKI_b64_encode(spki);
+
+                if (outfile) out = BIO_new_file(outfile, "w");
+                else out = BIO_new_fp(stdout, BIO_NOCLOSE);
+
+                if(!out) {
+                        BIO_printf(bio_err, "Error opening output file\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+                BIO_printf(out, "SPKAC=%s\n", spkstr);
+                Free(spkstr);
+                ret = 0;
+                goto end;
+        }
+
+        
+
+        if (infile) in = BIO_new_file(infile, "r");
+        else in = BIO_new_fp(stdin, BIO_NOCLOSE);
+
+        if(!in) {
+                BIO_printf(bio_err, "Error opening input file\n");
+                ERR_print_errors(bio_err);
+                goto end;
+        }
+
+        conf = CONF_load_bio(NULL, in, NULL);
+
+        if(!conf) {
+                BIO_printf(bio_err, "Error parsing config file\n");
+                ERR_print_errors(bio_err);
+                goto end;
+        }
+
+        spkstr = CONF_get_string(conf, spksect, spkac);
+                
+        if(!spkstr) {
+                BIO_printf(bio_err, "Can't find SPKAC called \"%s\"\n", spkac);
+                ERR_print_errors(bio_err);
+                goto end;
+        }
+
+        spki = NETSCAPE_SPKI_b64_decode(spkstr, -1);
+        
+        if(!spki) {
+                BIO_printf(bio_err, "Error loading SPKAC\n");
+                ERR_print_errors(bio_err);
+                goto end;
+        }
+
+        if (outfile) out = BIO_new_file(outfile, "w");
+        else out = BIO_new_fp(stdout, BIO_NOCLOSE);
+
+        if(!out) {
+                BIO_printf(bio_err, "Error opening output file\n");
+                ERR_print_errors(bio_err);
+                goto end;
+        }
+
+        if(!noout) NETSCAPE_SPKI_print(out, spki);
+        pkey = NETSCAPE_SPKI_get_pubkey(spki);
+        if(verify) {
+                i = NETSCAPE_SPKI_verify(spki, pkey);
+                if(i) BIO_printf(bio_err, "Signature OK\n");
+                else {
+                        BIO_printf(bio_err, "Signature Failure\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+        }
+        if(pubkey) PEM_write_bio_PUBKEY(out, pkey);
+
+        ret = 0;
+
+end:
+        CONF_free(conf);
+        NETSCAPE_SPKI_free(spki);
+        BIO_free(in);
+        BIO_free(out);
+        BIO_free(key);
+        EVP_PKEY_free(pkey);
+        if(passin) Free(passin);
+        EXIT(ret);
+        }
diff --git a/src/lib/libssl/src/apps/verify.c b/src/lib/libssl/src/apps/verify.c
index 093fe09f2c..267ee4ecd7 100644
--- a/src/lib/libssl/src/apps/verify.c
+++ b/src/lib/libssl/src/apps/verify.c
@@ -63,19 +63,26 @@
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 #include <openssl/pem.h>
 
 #undef PROG
 #define PROG    verify_main
 
 static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx);
-static int check(X509_STORE *ctx,char *file);
+static int check(X509_STORE *ctx,char *file, STACK_OF(X509)*other, int purpose);
+static STACK_OF(X509) *load_untrusted(char *file);
 static int v_verbose=0;
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int i,ret=1;
+        int purpose = -1;
         char *CApath=NULL,*CAfile=NULL;
+        char *untfile = NULL;
+        STACK_OF(X509) *untrusted = NULL;
         X509_STORE *cert_ctx=NULL;
         X509_LOOKUP *lookup=NULL;
 
@@ -107,6 +114,24 @@ int MAIN(int argc, char **argv)
                                 if (argc-- < 1) goto end;
                                 CAfile= *(++argv);
                                 }
+                        else if (strcmp(*argv,"-purpose") == 0)
+                                {
+                                X509_PURPOSE *xptmp;
+                                if (argc-- < 1) goto end;
+                                i = X509_PURPOSE_get_by_sname(*(++argv));
+                                if(i < 0)
+                                        {
+                                        BIO_printf(bio_err, "unrecognized purpose\n");
+                                        goto end;
+                                        }
+                                xptmp = X509_PURPOSE_get0(i);
+                                purpose = X509_PURPOSE_get_id(xptmp);
+                                }
+                        else if (strcmp(*argv,"-untrusted") == 0)
+                                {
+                                if (argc-- < 1) goto end;
+                                untfile= *(++argv);
+                                }
                         else if (strcmp(*argv,"-help") == 0)
                                 goto end;
                         else if (strcmp(*argv,"-verbose") == 0)
@@ -124,34 +149,63 @@ int MAIN(int argc, char **argv)
 
         lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_file());
         if (lookup == NULL) abort();
-        if (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))
-                X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
+        if (CAfile) {
+                i=X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM);
+                if(!i) {
+                        BIO_printf(bio_err, "Error loading file %s\n", CAfile);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+        } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
                 
         lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_hash_dir());
         if (lookup == NULL) abort();
-        if (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM))
-                X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
-
+        if (CApath) {
+                i=X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM);
+                if(!i) {
+                        BIO_printf(bio_err, "Error loading directory %s\n", CApath);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+        } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
 
         ERR_clear_error();
-        if (argc < 1) check(cert_ctx,NULL);
+
+        if(untfile) {
+                if(!(untrusted = load_untrusted(untfile))) {
+                        BIO_printf(bio_err, "Error loading untrusted file %s\n", untfile);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                }
+        }
+
+        if (argc < 1) check(cert_ctx, NULL, untrusted, purpose);
         else
                 for (i=0; i<argc; i++)
-                        check(cert_ctx,argv[i]);
+                        check(cert_ctx,argv[i], untrusted, purpose);
         ret=0;
 end:
-        if (ret == 1)
+        if (ret == 1) {
                 BIO_printf(bio_err,"usage: verify [-verbose] [-CApath path] [-CAfile file] cert1 cert2 ...\n");
+                BIO_printf(bio_err,"recognized usages:\n");
+                for(i = 0; i < X509_PURPOSE_get_count(); i++) {
+                        X509_PURPOSE *ptmp;
+                        ptmp = X509_PURPOSE_get0(i);
+                        BIO_printf(bio_err, "\t%-10s\t%s\n", X509_PURPOSE_get0_sname(ptmp),
+                                                                X509_PURPOSE_get0_name(ptmp));
+                }
+        }
         if (cert_ctx != NULL) X509_STORE_free(cert_ctx);
+        sk_X509_pop_free(untrusted, X509_free);
         EXIT(ret);
         }
 
-static int check(X509_STORE *ctx, char *file)
+static int check(X509_STORE *ctx, char *file, STACK_OF(X509) *uchain, int purpose)
         {
         X509 *x=NULL;
         BIO *in=NULL;
         int i=0,ret=0;
-        X509_STORE_CTX csc;
+        X509_STORE_CTX *csc;
 
         in=BIO_new(BIO_s_file());
         if (in == NULL)
@@ -181,9 +235,16 @@ static int check(X509_STORE *ctx, char *file)
                 }
         fprintf(stdout,"%s: ",(file == NULL)?"stdin":file);
 
-        X509_STORE_CTX_init(&csc,ctx,x,NULL);
-        i=X509_verify_cert(&csc);
-        X509_STORE_CTX_cleanup(&csc);
+        csc = X509_STORE_CTX_new();
+        if (csc == NULL)
+                {
+                ERR_print_errors(bio_err);
+                goto end;
+                }
+        X509_STORE_CTX_init(csc,ctx,x,uchain);
+        if(purpose >= 0) X509_STORE_CTX_set_purpose(csc, purpose);
+        i=X509_verify_cert(csc);
+        X509_STORE_CTX_free(csc);
 
         ret=0;
 end:
@@ -200,27 +261,75 @@ end:
         return(ret);
         }
 
+static STACK_OF(X509) *load_untrusted(char *certfile)
+{
+        STACK_OF(X509_INFO) *sk=NULL;
+        STACK_OF(X509) *stack=NULL, *ret=NULL;
+        BIO *in=NULL;
+        X509_INFO *xi;
+
+        if(!(stack = sk_X509_new_null())) {
+                BIO_printf(bio_err,"memory allocation failure\n");
+                goto end;
+        }
+
+        if(!(in=BIO_new_file(certfile, "r"))) {
+                BIO_printf(bio_err,"error opening the file, %s\n",certfile);
+                goto end;
+        }
+
+        /* This loads from a file, a stack of x509/crl/pkey sets */
+        if(!(sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL))) {
+                BIO_printf(bio_err,"error reading the file, %s\n",certfile);
+                goto end;
+        }
+
+        /* scan over it and pull out the certs */
+        while (sk_X509_INFO_num(sk))
+                {
+                xi=sk_X509_INFO_shift(sk);
+                if (xi->x509 != NULL)
+                        {
+                        sk_X509_push(stack,xi->x509);
+                        xi->x509=NULL;
+                        }
+                X509_INFO_free(xi);
+                }
+        if(!sk_X509_num(stack)) {
+                BIO_printf(bio_err,"no certificates in file, %s\n",certfile);
+                sk_X509_free(stack);
+                goto end;
+        }
+        ret=stack;
+end:
+        BIO_free(in);
+        sk_X509_INFO_free(sk);
+        return(ret);
+        }
+
 static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx)
         {
         char buf[256];
 
         if (!ok)
                 {
-                /* since we are just checking the certificates, it is
-                 * ok if they are self signed. */
-                if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
-                        ok=1;
-                else
-                        {
-                        X509_NAME_oneline(
+                X509_NAME_oneline(
                                 X509_get_subject_name(ctx->current_cert),buf,256);
-                        printf("%s\n",buf);
-                        printf("error %d at %d depth lookup:%s\n",ctx->error,
-                                ctx->error_depth,
-                                X509_verify_cert_error_string(ctx->error));
-                        if (ctx->error == X509_V_ERR_CERT_HAS_EXPIRED)
-                                ok=1;
-                        }
+                printf("%s\n",buf);
+                printf("error %d at %d depth lookup:%s\n",ctx->error,
+                        ctx->error_depth,
+                        X509_verify_cert_error_string(ctx->error));
+                if (ctx->error == X509_V_ERR_CERT_HAS_EXPIRED) ok=1;
+                /* since we are just checking the certificates, it is
+                 * ok if they are self signed. But we should still warn
+                 * the user.
+                 */
+                if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ok=1;
+                /* Continue after extension errors too */
+                if (ctx->error == X509_V_ERR_INVALID_CA) ok=1;
+                if (ctx->error == X509_V_ERR_PATH_LENGTH_EXCEEDED) ok=1;
+                if (ctx->error == X509_V_ERR_INVALID_PURPOSE) ok=1;
+                if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ok=1;
                 }
         if (!v_verbose)
                 ERR_clear_error();
diff --git a/src/lib/libssl/src/apps/version.c b/src/lib/libssl/src/apps/version.c
index a567f34094..f5c9adc254 100644
--- a/src/lib/libssl/src/apps/version.c
+++ b/src/lib/libssl/src/apps/version.c
@@ -66,6 +66,8 @@
 #undef PROG
 #define PROG    version_main
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int i,ret=0;
diff --git a/src/lib/libssl/src/apps/x509.c b/src/lib/libssl/src/apps/x509.c
index 2e2d18bea4..d5c0d0404e 100644
--- a/src/lib/libssl/src/apps/x509.c
+++ b/src/lib/libssl/src/apps/x509.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -91,59 +92,78 @@ static char *x509_usage[]={
 " -CAkeyform arg  - CA key format - default PEM\n",
 " -in arg         - input file - default stdin\n",
 " -out arg        - output file - default stdout\n",
+" -passin arg     - private key password source\n",
 " -serial         - print serial number value\n",
 " -hash           - print hash value\n",
 " -subject        - print subject DN\n",
 " -issuer         - print issuer DN\n",
 " -startdate      - notBefore field\n",
 " -enddate        - notAfter field\n",
+" -purpose        - print out certificate purposes\n",
 " -dates          - both Before and After dates\n",
 " -modulus        - print the RSA key modulus\n",
+" -pubkey         - output the public key\n",
 " -fingerprint    - print the certificate fingerprint\n",
+" -alias          - output certificate alias\n",
 " -noout          - no certificate output\n",
-
+" -trustout       - output a \"trusted\" certificate\n",
+" -clrtrust       - clear all trusted purposes\n",
+" -clrreject      - clear all rejected purposes\n",
+" -addtrust arg   - trust certificate for a given purpose\n",
+" -addreject arg  - reject certificate for a given purpose\n",
+" -setalias arg   - set certificate alias\n",
 " -days arg       - How long till expiry of a signed certificate - def 30 days\n",
 " -signkey arg    - self sign cert with arg\n",
 " -x509toreq      - output a certification request object\n",
 " -req            - input is a certificate request, sign and output.\n",
 " -CA arg         - set the CA certificate, must be PEM format.\n",
 " -CAkey arg      - set the CA key, must be PEM format\n",
-"                   missing, it is asssumed to be in the CA file.\n",
+"                   missing, it is assumed to be in the CA file.\n",
 " -CAcreateserial - create serial number file if it does not exist\n",
 " -CAserial       - serial file\n",
 " -text           - print the certificate in text form\n",
 " -C              - print out C code forms\n",
-" -md2/-md5/-sha1/-mdc2 - digest to do an RSA sign with\n",
+" -md2/-md5/-sha1/-mdc2 - digest to use\n",
 " -extfile        - configuration file with X509V3 extensions to add\n",
+" -extensions     - section from config file with X509V3 extensions to add\n",
+" -crlext         - delete extensions before signing and input certificate\n",
 NULL
 };
 
 static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx);
-static EVP_PKEY *load_key(char *file, int format);
+static EVP_PKEY *load_key(char *file, int format, char *passin);
 static X509 *load_cert(char *file, int format);
-static int sign (X509 *x, EVP_PKEY *pkey,int days,const EVP_MD *digest,
+static int sign (X509 *x, EVP_PKEY *pkey,int days,int clrext, const EVP_MD *digest,
                                                 LHASH *conf, char *section);
 static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest,
                          X509 *x,X509 *xca,EVP_PKEY *pkey,char *serial,
-                         int create,int days, LHASH *conf, char *section);
+                         int create,int days, int clrext, LHASH *conf, char *section);
+static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
 static int reqfile=0;
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
         int ret=1;
         X509_REQ *req=NULL;
         X509 *x=NULL,*xca=NULL;
+        ASN1_OBJECT *objtmp;
         EVP_PKEY *Upkey=NULL,*CApkey=NULL;
         int i,num,badops=0;
         BIO *out=NULL;
         BIO *STDout=NULL;
+        STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;
         int informat,outformat,keyformat,CAformat,CAkeyformat;
         char *infile=NULL,*outfile=NULL,*keyfile=NULL,*CAfile=NULL;
         char *CAkeyfile=NULL,*CAserial=NULL;
+        char *alias=NULL;
         int text=0,serial=0,hash=0,subject=0,issuer=0,startdate=0,enddate=0;
         int noout=0,sign_flag=0,CA_flag=0,CA_createserial=0;
+        int trustout=0,clrtrust=0,clrreject=0,aliasout=0,clrext=0;
         int C=0;
-        int x509req=0,days=DEF_DAYS,modulus=0;
+        int x509req=0,days=DEF_DAYS,modulus=0,pubkey=0;
+        int pprint = 0;
         char **pp;
         X509_STORE *ctx=NULL;
         X509_REQ *rq=NULL;
@@ -151,7 +171,8 @@ int MAIN(int argc, char **argv)
         char buf[256];
         const EVP_MD *md_alg,*digest=EVP_md5();
         LHASH *extconf = NULL;
-        char *extsect = NULL, *extfile = NULL;
+        char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL;
+        int need_rand = 0;
 
         reqfile=0;
 
@@ -192,7 +213,10 @@ int MAIN(int argc, char **argv)
                         keyformat=str2fmt(*(++argv));
                         }
                 else if (strcmp(*argv,"-req") == 0)
+                        {
                         reqfile=1;
+                        need_rand = 1;
+                        }
                 else if (strcmp(*argv,"-CAform") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -213,11 +237,21 @@ int MAIN(int argc, char **argv)
                                 goto bad;
                                 }
                         }
+                else if (strcmp(*argv,"-passin") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargin= *(++argv);
+                        }
                 else if (strcmp(*argv,"-extfile") == 0)
                         {
                         if (--argc < 1) goto bad;
                         extfile= *(++argv);
                         }
+                else if (strcmp(*argv,"-extensions") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        extsect= *(++argv);
+                        }
                 else if (strcmp(*argv,"-in") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -233,12 +267,14 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         keyfile= *(++argv);
                         sign_flag= ++num;
+                        need_rand = 1;
                         }
                 else if (strcmp(*argv,"-CA") == 0)
                         {
                         if (--argc < 1) goto bad;
                         CAfile= *(++argv);
                         CA_flag= ++num;
+                        need_rand = 1;
                         }
                 else if (strcmp(*argv,"-CAkey") == 0)
                         {
@@ -250,12 +286,50 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         CAserial= *(++argv);
                         }
+                else if (strcmp(*argv,"-addtrust") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        if(!(objtmp = OBJ_txt2obj(*(++argv), 0))) {
+                                BIO_printf(bio_err,
+                                        "Invalid trust object value %s\n", *argv);
+                                goto bad;
+                        }
+                        if(!trust) trust = sk_ASN1_OBJECT_new_null();
+                        sk_ASN1_OBJECT_push(trust, objtmp);
+                        trustout = 1;
+                        }
+                else if (strcmp(*argv,"-addreject") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        if(!(objtmp = OBJ_txt2obj(*(++argv), 0))) {
+                                BIO_printf(bio_err,
+                                        "Invalid reject object value %s\n", *argv);
+                                goto bad;
+                        }
+                        if(!reject) reject = sk_ASN1_OBJECT_new_null();
+                        sk_ASN1_OBJECT_push(reject, objtmp);
+                        trustout = 1;
+                        }
+                else if (strcmp(*argv,"-setalias") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        alias= *(++argv);
+                        trustout = 1;
+                        }
+                else if (strcmp(*argv,"-setalias") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        alias= *(++argv);
+                        trustout = 1;
+                        }
                 else if (strcmp(*argv,"-C") == 0)
                         C= ++num;
                 else if (strcmp(*argv,"-serial") == 0)
                         serial= ++num;
                 else if (strcmp(*argv,"-modulus") == 0)
                         modulus= ++num;
+                else if (strcmp(*argv,"-pubkey") == 0)
+                        pubkey= ++num;
                 else if (strcmp(*argv,"-x509toreq") == 0)
                         x509req= ++num;
                 else if (strcmp(*argv,"-text") == 0)
@@ -273,15 +347,27 @@ int MAIN(int argc, char **argv)
                         startdate= ++num;
                         enddate= ++num;
                         }
+                else if (strcmp(*argv,"-purpose") == 0)
+                        pprint= ++num;
                 else if (strcmp(*argv,"-startdate") == 0)
                         startdate= ++num;
                 else if (strcmp(*argv,"-enddate") == 0)
                         enddate= ++num;
                 else if (strcmp(*argv,"-noout") == 0)
                         noout= ++num;
+                else if (strcmp(*argv,"-trustout") == 0)
+                        trustout= 1;
+                else if (strcmp(*argv,"-clrtrust") == 0)
+                        clrtrust= ++num;
+                else if (strcmp(*argv,"-clrreject") == 0)
+                        clrreject= ++num;
+                else if (strcmp(*argv,"-alias") == 0)
+                        aliasout= ++num;
                 else if (strcmp(*argv,"-CAcreateserial") == 0)
                         CA_createserial= ++num;
-                else if ((md_alg=EVP_get_digestbyname(&((*argv)[1]))) != NULL)
+                else if (strcmp(*argv,"-crlext") == 0)
+                        clrext = 1;
+                else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
                         {
                         /* ok */
                         digest=md_alg;
@@ -304,8 +390,15 @@ bad:
                 goto end;
                 }
 
+        if (need_rand)
+                app_RAND_load_file(NULL, bio_err, 0);
+
         ERR_load_crypto_strings();
-        X509V3_add_standard_extensions();
+
+        if(!app_passwd(bio_err, passargin, NULL, &passin, NULL)) {
+                BIO_printf(bio_err, "Error getting password\n");
+                goto end;
+        }
 
         if (!X509_STORE_set_default_paths(ctx))
                 {
@@ -335,7 +428,7 @@ bad:
                                                         ,errorline,extfile);
                         goto end;
                 }
-                if(!(extsect = CONF_get_string(extconf, "default",
+                if(!extsect && !(extsect = CONF_get_string(extconf, "default",
                                          "extensions"))) extsect = "default";
                 X509V3_set_ctx_test(&ctx2);
                 X509V3_set_conf_lhash(&ctx2, extconf);
@@ -425,15 +518,9 @@ bad:
                 X509_gmtime_adj(X509_get_notBefore(x),0);
                 X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days);
 
-#if 0
-                X509_PUBKEY_free(ci->key);
-                ci->key=req->req_info->pubkey;
-                req->req_info->pubkey=NULL;
-#else
                 pkey = X509_REQ_get_pubkey(req);
                 X509_set_pubkey(x,pkey);
                 EVP_PKEY_free(pkey);
-#endif
                 }
         else
                 x=load_cert(infile,informat);
@@ -468,6 +555,25 @@ bad:
                         }
                 }
 
+        if(alias) X509_alias_set1(x, (unsigned char *)alias, -1);
+
+        if(clrtrust) X509_trust_clear(x);
+        if(clrreject) X509_reject_clear(x);
+
+        if(trust) {
+                for(i = 0; i < sk_ASN1_OBJECT_num(trust); i++) {
+                        objtmp = sk_ASN1_OBJECT_value(trust, i);
+                        X509_add1_trust_object(x, objtmp);
+                }
+        }
+
+        if(reject) {
+                for(i = 0; i < sk_ASN1_OBJECT_num(reject); i++) {
+                        objtmp = sk_ASN1_OBJECT_value(reject, i);
+                        X509_add1_reject_object(x, objtmp);
+                }
+        }
+
         if (num)
                 {
                 for (i=1; i<=num; i++)
@@ -490,10 +596,28 @@ bad:
                                 i2a_ASN1_INTEGER(STDout,x->cert_info->serialNumber);
                                 BIO_printf(STDout,"\n");
                                 }
+                        else if (aliasout == i)
+                                {
+                                unsigned char *alstr;
+                                alstr = X509_alias_get0(x, NULL);
+                                if(alstr) BIO_printf(STDout,"%s\n", alstr);
+                                else BIO_puts(STDout,"<No Alias>\n");
+                                }
                         else if (hash == i)
                                 {
                                 BIO_printf(STDout,"%08lx\n",X509_subject_name_hash(x));
                                 }
+                        else if (pprint == i)
+                                {
+                                X509_PURPOSE *ptmp;
+                                int j;
+                                BIO_printf(STDout, "Certificate purposes:\n");
+                                for(j = 0; j < X509_PURPOSE_get_count(); j++)
+                                        {
+                                        ptmp = X509_PURPOSE_get0(j);
+                                        purpose_print(STDout, x, ptmp);
+                                        }
+                                }
                         else
                                 if (modulus == i)
                                 {
@@ -522,6 +646,21 @@ bad:
                                 EVP_PKEY_free(pkey);
                                 }
                         else
+                                if (pubkey == i)
+                                {
+                                EVP_PKEY *pkey;
+
+                                pkey=X509_get_pubkey(x);
+                                if (pkey == NULL)
+                                        {
+                                        BIO_printf(bio_err,"Error getting public key\n");
+                                        ERR_print_errors(bio_err);
+                                        goto end;
+                                        }
+                                PEM_write_bio_PUBKEY(STDout, pkey);
+                                EVP_PKEY_free(pkey);
+                                }
+                        else
                                 if (C == i)
                                 {
                                 unsigned char *d;
@@ -598,12 +737,13 @@ bad:
                                 unsigned int n;
                                 unsigned char md[EVP_MAX_MD_SIZE];
 
-                                if (!X509_digest(x,EVP_md5(),md,&n))
+                                if (!X509_digest(x,digest,md,&n))
                                         {
                                         BIO_printf(bio_err,"out of memory\n");
                                         goto end;
                                         }
-                                BIO_printf(STDout,"MD5 Fingerprint=");
+                                BIO_printf(STDout,"%s Fingerprint=",
+                                                OBJ_nid2sn(EVP_MD_type(digest)));
                                 for (j=0; j<(int)n; j++)
                                         {
                                         BIO_printf(STDout,"%02X%c",md[j],
@@ -618,7 +758,7 @@ bad:
                                 BIO_printf(bio_err,"Getting Private key\n");
                                 if (Upkey == NULL)
                                         {
-                                        Upkey=load_key(keyfile,keyformat);
+                                        Upkey=load_key(keyfile,keyformat, passin);
                                         if (Upkey == NULL) goto end;
                                         }
 #ifndef NO_DSA
@@ -626,7 +766,8 @@ bad:
                                         digest=EVP_dss1();
 #endif
 
-                                if (!sign(x,Upkey,days,digest,
+                                assert(need_rand);
+                                if (!sign(x,Upkey,days,clrext,digest,
                                                  extconf, extsect)) goto end;
                                 }
                         else if (CA_flag == i)
@@ -634,7 +775,7 @@ bad:
                                 BIO_printf(bio_err,"Getting CA Private Key\n");
                                 if (CAkeyfile != NULL)
                                         {
-                                        CApkey=load_key(CAkeyfile,CAkeyformat);
+                                        CApkey=load_key(CAkeyfile,CAkeyformat, passin);
                                         if (CApkey == NULL) goto end;
                                         }
 #ifndef NO_DSA
@@ -642,8 +783,9 @@ bad:
                                         digest=EVP_dss1();
 #endif
                                 
+                                assert(need_rand);
                                 if (!x509_certify(ctx,CAfile,digest,x,xca,
-                                        CApkey, CAserial,CA_createserial,days,
+                                        CApkey, CAserial,CA_createserial,days, clrext,
                                         extconf, extsect))
                                         goto end;
                                 }
@@ -659,13 +801,16 @@ bad:
                                         }
                                 else
                                         {
-                                        pk=load_key(keyfile,FORMAT_PEM);
+                                        pk=load_key(keyfile,FORMAT_PEM, passin);
                                         if (pk == NULL) goto end;
                                         }
 
                                 BIO_printf(bio_err,"Generating certificate request\n");
 
-                                rq=X509_to_X509_REQ(x,pk,EVP_md5());
+                                if (pk->type == EVP_PKEY_DSA)
+                                        digest=EVP_dss1();
+
+                                rq=X509_to_X509_REQ(x,pk,digest);
                                 EVP_PKEY_free(pk);
                                 if (rq == NULL)
                                         {
@@ -690,9 +835,10 @@ bad:
 
         if      (outformat == FORMAT_ASN1)
                 i=i2d_X509_bio(out,x);
-        else if (outformat == FORMAT_PEM)
-                i=PEM_write_bio_X509(out,x);
-        else if (outformat == FORMAT_NETSCAPE)
+        else if (outformat == FORMAT_PEM) {
+                if(trustout) i=PEM_write_bio_X509_AUX(out,x);
+                else i=PEM_write_bio_X509(out,x);
+        } else if (outformat == FORMAT_NETSCAPE)
                 {
                 ASN1_HEADER ah;
                 ASN1_OCTET_STRING os;
@@ -717,6 +863,8 @@ bad:
                 }
         ret=0;
 end:
+        if (need_rand)
+                app_RAND_write_file(NULL, bio_err);
         OBJ_cleanup();
         CONF_free(extconf);
         BIO_free(out);
@@ -728,13 +876,15 @@ end:
         EVP_PKEY_free(Upkey);
         EVP_PKEY_free(CApkey);
         X509_REQ_free(rq);
-        X509V3_EXT_cleanup();
+        sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);
+        sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);
+        if(passin) Free(passin);
         EXIT(ret);
         }
 
 static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
              X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
-             int days, LHASH *conf, char *section)
+             int days, int clrext, LHASH *conf, char *section)
         {
         int ret=0;
         BIO *io=NULL;
@@ -750,7 +900,7 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
         EVP_PKEY_free(upkey);
 
         X509_STORE_CTX_init(&xsc,ctx,x,NULL);
-        buf=(char *)Malloc(EVP_PKEY_size(pkey)*2+
+        buf=Malloc(EVP_PKEY_size(pkey)*2+
                 ((serialfile == NULL)
                         ?(strlen(CAfile)+strlen(POSTFIX)+1)
                         :(strlen(serialfile)))+1);
@@ -792,8 +942,8 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
                         }
                 else
                         {
-                        ASN1_INTEGER_set(bs,0);
-                        BN_zero(serial);
+                        ASN1_INTEGER_set(bs,1);
+                        BN_one(serial);
                         }
                 }
         else 
@@ -855,6 +1005,10 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
         if (X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days) == NULL)
                 goto end;
 
+        if(clrext) {
+                while(X509_get_ext_count(x) > 0) X509_delete_ext(x, 0);
+        }
+
         if(conf) {
                 X509V3_CTX ctx2;
                 X509_set_version(x,2); /* version 3 certificate */
@@ -909,7 +1063,7 @@ static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx)
                 }
         }
 
-static EVP_PKEY *load_key(char *file, int format)
+static EVP_PKEY *load_key(char *file, int format, char *passin)
         {
         BIO *key=NULL;
         EVP_PKEY *pkey=NULL;
@@ -930,25 +1084,13 @@ static EVP_PKEY *load_key(char *file, int format)
                 perror(file);
                 goto end;
                 }
-#ifndef NO_RSA
-        if      (format == FORMAT_ASN1)
+        if (format == FORMAT_ASN1)
                 {
-                RSA *rsa;
-
-                rsa=d2i_RSAPrivateKey_bio(key,NULL);
-                if (rsa != NULL)
-                        {
-                        if ((pkey=EVP_PKEY_new()) != NULL)
-                                EVP_PKEY_assign_RSA(pkey,rsa);
-                        else
-                                RSA_free(rsa);
-                        }
+                pkey=d2i_PrivateKey_bio(key, NULL);
                 }
-        else
-#endif
-                if (format == FORMAT_PEM)
+        else if (format == FORMAT_PEM)
                 {
-                pkey=PEM_read_bio_PrivateKey(key,NULL,NULL,NULL);
+                pkey=PEM_read_bio_PrivateKey(key,NULL,NULL,passin);
                 }
         else
                 {
@@ -1031,7 +1173,7 @@ static X509 *load_cert(char *file, int format)
                 ah->data=NULL;
                 }
         else if (format == FORMAT_PEM)
-                x=PEM_read_bio_X509(cert,NULL,NULL,NULL);
+                x=PEM_read_bio_X509_AUX(cert,NULL,NULL,NULL);
         else    {
                 BIO_printf(bio_err,"bad input format specified for input cert\n");
                 goto end;
@@ -1049,7 +1191,7 @@ end:
         }
 
 /* self sign */
-static int sign(X509 *x, EVP_PKEY *pkey, int days, const EVP_MD *digest, 
+static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest, 
                                                 LHASH *conf, char *section)
         {
 
@@ -1071,6 +1213,9 @@ static int sign(X509 *x, EVP_PKEY *pkey, int days, const EVP_MD *digest,
                 goto err;
 
         if (!X509_set_pubkey(x,pkey)) goto err;
+        if(clrext) {
+                while(X509_get_ext_count(x) > 0) X509_delete_ext(x, 0);
+        }
         if(conf) {
                 X509V3_CTX ctx;
                 X509_set_version(x,2); /* version 3 certificate */
@@ -1084,3 +1229,22 @@ err:
         ERR_print_errors(bio_err);
         return(0);
         }
+
+static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt)
+{
+        int id, i, idret;
+        char *pname;
+        id = X509_PURPOSE_get_id(pt);
+        pname = X509_PURPOSE_get0_name(pt);
+        for(i = 0; i < 2; i++) {
+                idret = X509_check_purpose(cert, id, i);
+                BIO_printf(bio, "%s%s : ", pname, i ? " CA" : ""); 
+                if(idret == 1) BIO_printf(bio, "Yes\n");
+                else if (idret == 0) BIO_printf(bio, "No\n");
+                else BIO_printf(bio, "Yes (WARNING code=%d)\n", idret);
+        }
+        return 1;
+}
+
+
+
diff --git a/src/lib/libssl/src/bugs/SSLv3 b/src/lib/libssl/src/bugs/SSLv3
index 2e22a65cdd..db53e1343a 100644
--- a/src/lib/libssl/src/bugs/SSLv3
+++ b/src/lib/libssl/src/bugs/SSLv3
@@ -39,3 +39,11 @@ SSL_shutdown() and still sharing the socket with its parent).
 
 Netscape, when using export ciphers, will accept a 1024 bit temporary
 RSA key.  It is supposed to only accept 512.
+
+If Netscape connects to a server which requests a client certificate
+it will frequently hang after the user has selected one and never
+complete the connection. Hitting "Stop" and reload fixes this and
+all subsequent connections work fine. This appears to be because 
+Netscape wont read any new records in when it is awaiting a server
+done message at this point. The fix is to send the certificate request
+and server done messages in one record.
diff --git a/src/lib/libssl/src/certs/ca-cert.pem b/src/lib/libssl/src/certs/ca-cert.pem
index 6dd974d70d..bcba68aefa 100644
--- a/src/lib/libssl/src/certs/ca-cert.pem
+++ b/src/lib/libssl/src/certs/ca-cert.pem
@@ -1,18 +1,20 @@
-issuer= /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test PCA (1024 bit)
-subject=/C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit)
 -----BEGIN CERTIFICATE-----
-MIICJjCCAY8CAQAwDQYJKoZIhvcNAQEEBQAwXDELMAkGA1UEBhMCQVUxEzARBgNV
-BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYD
-VQQDExNUZXN0IFBDQSAoMTAyNCBiaXQpMB4XDTk3MDYwOTEzNTc0M1oXDTAxMDYw
-OTEzNTc0M1owWzELMAkGA1UEBhMCQVUxEzARBgNVBAgTClF1ZWVuc2xhbmQxGjAY
-BgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRswGQYDVQQDExJUZXN0IENBICgxMDI0
-IGJpdCkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKO7o8t116VP6cgybTsZ
-DCZhr95nYlZuya3aCi1IKoztqwWnjbmDFIriOqGFPrZQ+moMETC9D59iRW/dFXSv
-1F65ka/XY2hLh9exCCo7XuUcDs53Qp3bI3AmMqHjgzE8oO3ajyJAzJkTTOUecQU2
-mw/gI4tMM0LqWMQS7luTy4+xAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAM7achv3v
-hLQJcv/65eGEpBXM40ZDVoFQFFJWaY5p883HTqLB1x4FdzsXHH0QKBTcKpWwqyu4
-YDm3fb8oDugw72bCzfyZK/zVZPR/hVlqI/fvU109Qoc+7oPvIXWky71HfcK6ZBCA
-q30KIqGM/uoM60INq97qjDmCJapagcNBGQs=
+MIIC5TCCAk6gAwIBAgIBATANBgkqhkiG9w0BAQQFADBcMQswCQYDVQQGEwJBVTET
+MBEGA1UECBMKUXVlZW5zbGFuZDEaMBgGA1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQx
+HDAaBgNVBAMTE1Rlc3QgUENBICgxMDI0IGJpdCkwHhcNOTkxMjAyMjEzODUxWhcN
+MDUwNzEwMjEzODUxWjBbMQswCQYDVQQGEwJBVTETMBEGA1UECBMKUXVlZW5zbGFu
+ZDEaMBgGA1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQxGzAZBgNVBAMTElRlc3QgQ0Eg
+KDEwMjQgYml0KTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAo7ujy3XXpU/p
+yDJtOxkMJmGv3mdiVm7JrdoKLUgqjO2rBaeNuYMUiuI6oYU+tlD6agwRML0Pn2JF
+b90VdK/UXrmRr9djaEuH17EIKjte5RwOzndCndsjcCYyoeODMTyg7dqPIkDMmRNM
+5R5xBTabD+Aji0wzQupYxBLuW5PLj7ECAwEAAaOBtzCBtDAdBgNVHQ4EFgQU1WWA
+U42mkhi3ecgey1dsJjU61+UwgYQGA1UdIwR9MHuAFE0RaEcrj18q1dw+G6nJbsTW
+R213oWCkXjBcMQswCQYDVQQGEwJBVTETMBEGA1UECBMKUXVlZW5zbGFuZDEaMBgG
+A1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQxHDAaBgNVBAMTE1Rlc3QgUENBICgxMDI0
+IGJpdCmCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQBb39BRphHL
+6aRAQyymsvBvPSCiG9+kR0R1L23aTpNbhXp2BebyFjbEQYZc2kWGiKKcHkNECA35
+3d4LoqUlVey8DFyafOIJd9hxdZfg+rxlHMxnL7uCJRmx9+xB411Jtsol9/wg1uCK
+sleGpgB4j8cG2SVCz7V2MNZNK+d5QCnR7A==
 -----END CERTIFICATE-----
 -----BEGIN RSA PRIVATE KEY-----
 MIICXQIBAAKBgQCju6PLddelT+nIMm07GQwmYa/eZ2JWbsmt2gotSCqM7asFp425
diff --git a/src/lib/libssl/src/certs/pca-cert.pem b/src/lib/libssl/src/certs/pca-cert.pem
index 140e9a6b43..9d754d460d 100644
--- a/src/lib/libssl/src/certs/pca-cert.pem
+++ b/src/lib/libssl/src/certs/pca-cert.pem
@@ -1,18 +1,20 @@
-issuer= /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test PCA (1024 bit)
-subject=/C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test PCA (1024 bit)
 -----BEGIN CERTIFICATE-----
-MIICJzCCAZACAQAwDQYJKoZIhvcNAQEEBQAwXDELMAkGA1UEBhMCQVUxEzARBgNV
-BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYD
-VQQDExNUZXN0IFBDQSAoMTAyNCBiaXQpMB4XDTk3MDYwOTEzNTczN1oXDTAxMDYw
-OTEzNTczN1owXDELMAkGA1UEBhMCQVUxEzARBgNVBAgTClF1ZWVuc2xhbmQxGjAY
+MIIC5jCCAk+gAwIBAgIBADANBgkqhkiG9w0BAQQFADBcMQswCQYDVQQGEwJBVTET
+MBEGA1UECBMKUXVlZW5zbGFuZDEaMBgGA1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQx
+HDAaBgNVBAMTE1Rlc3QgUENBICgxMDI0IGJpdCkwHhcNOTkxMjAyMjEzNTQ4WhcN
+MDUwNzExMjEzNTQ4WjBcMQswCQYDVQQGEwJBVTETMBEGA1UECBMKUXVlZW5zbGFu
+ZDEaMBgGA1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQxHDAaBgNVBAMTE1Rlc3QgUENB
+ICgxMDI0IGJpdCkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ2haT/f5Zwy
+V+MiuSDjSR62adBoSiBB7Usty44lXqsp9RICw+DCCxpsn/CfxPEDXLLd4olsWXc6
+JRcxGynbYmnzk+Z6aIPPJQhK3CTvaqGnWKZsA1m+WaUIUqJCuNTK4N+7hMAGaf6S
+S3e9HVgEQ4a34gXJ7VQFVIBNV1EnZRWHAgMBAAGjgbcwgbQwHQYDVR0OBBYEFE0R
+aEcrj18q1dw+G6nJbsTWR213MIGEBgNVHSMEfTB7gBRNEWhHK49fKtXcPhupyW7E
+1kdtd6FgpF4wXDELMAkGA1UEBhMCQVUxEzARBgNVBAgTClF1ZWVuc2xhbmQxGjAY
 BgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYDVQQDExNUZXN0IFBDQSAoMTAy
-NCBiaXQpMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdoWk/3+WcMlfjIrkg
-40ketmnQaEogQe1LLcuOJV6rKfUSAsPgwgsabJ/wn8TxA1yy3eKJbFl3OiUXMRsp
-22Jp85PmemiDzyUIStwk72qhp1imbANZvlmlCFKiQrjUyuDfu4TABmn+kkt3vR1Y
-BEOGt+IFye1UBVSATVdRJ2UVhwIDAQABMA0GCSqGSIb3DQEBBAUAA4GBABNA1u/S
-Cg/LJZWb7GliiKJsvuhxlE4E5JxQF2zMub/CSNbF97//tYSyj96sxeFQxZXbcjm9
-xt6mr/xNLA4szNQMJ4P+L7b5e/jC5DSqlwS+CUYJgaFs/SP+qJoCSu1bR3IM9XWO
-cRBpDmcBbYLkSyB92WURvsZ1LtjEcn+cdQVI
+NCBiaXQpggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAUa8B3pho
++Mvxeq9HsEzJxHIFQla05S5J/e/V+DQTYoKiRFchKPrDAdrzYSEvP3h4QJEtsNqQ
+JfOxg5M42uLFq7aPGWkF6ZZqZsYS+zA9IVT14g7gNA6Ne+5QtJqQtH9HA24st0T0
+Tga/lZ9M2ovImovaxSL/kRHbpCWcqWVxpOw=
 -----END CERTIFICATE-----
 -----BEGIN RSA PRIVATE KEY-----
 MIICXAIBAAKBgQCdoWk/3+WcMlfjIrkg40ketmnQaEogQe1LLcuOJV6rKfUSAsPg
diff --git a/src/lib/libssl/src/config b/src/lib/libssl/src/config
index 93e2317c3f..f57969bb44 100644
--- a/src/lib/libssl/src/config
+++ b/src/lib/libssl/src/config
@@ -27,6 +27,7 @@ RELEASE=`(uname -r) 2>/dev/null` || RELEASE="unknown"
 SYSTEM=`(uname -s) 2>/dev/null`  || SYSTEM="unknown"
 VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
 
+
 # Now test for ISC and SCO, since it is has a braindamaged uname.
 #
 # We need to work around FreeBSD 1.1.5.1 
@@ -50,6 +51,8 @@ if [ "x$XREL" != "x" ]; then
             4.2MP)
                 if [ "x$VERSION" = "x2.1.1" ]; then
                     echo "${MACHINE}-whatever-unixware211"; exit 0
+                elif [ "x$VERSION" = "x2.1.2" ]; then
+                    echo "${MACHINE}-whatever-unixware212"; exit 0
                 else
                     echo "${MACHINE}-whatever-unixware2"; exit 0
                 fi
@@ -57,6 +60,11 @@ if [ "x$XREL" != "x" ]; then
             4.2)
                 echo "whatever-whatever-unixware1"; exit 0
                 ;;
+            5)
+                if [ "`echo x$VERSION | sed -e 's/\..*//'`" = "x7" ]; then
+                    echo "${MACHINE}-sco-unixware7"; exit 0
+                fi
+                ;;
         esac
     fi
 fi
@@ -187,6 +195,10 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${MACHINE}" in
         echo "i860-intel-osf1"; exit 0
         ;;
 
+    Rhapsody:*)
+        echo "ppc-apple-rhapsody"; exit 0
+        ;;
+
     SunOS:5.*)
         echo "${MACHINE}-sun-solaris2"; exit 0
         ;;
@@ -311,7 +323,7 @@ else
 fi
 
 if [ "$SYSTEM" = "SunOS" ]; then
-  # assume output is "blah-blah C x.x"
+  # check for WorkShop C, expected output is "cc: blah-blah C x.x"
   CCVER=`(cc -V 2>&1) 2>/dev/null | \
         egrep -e '^cc: .* C [0-9]\.[0-9]' | \
         sed 's/.* C \([0-9]\)\.\([0-9]\).*/\1\2/'`
@@ -328,6 +340,19 @@ if [ "$SYSTEM" = "SunOS" ]; then
   fi
 fi
 
+if [ "${SYSTEM}-${MACHINE}" = "Linux-alpha" ]; then
+  # check for Compaq C, expected output is "blah-blah C Vx.x"
+  CCCVER=`(ccc -V 2>&1) 2>/dev/null | \
+        egrep -e '.* C V[0-9]\.[0-9]' | \
+        sed 's/.* C V\([0-9]\)\.\([0-9]\).*/\1\2/'`
+  CCCVER=${CCCVER:-0}
+  if [ $CCCVER -gt 60 ]; then
+    CC=ccc      # overrides gcc!!! well, ccc outperforms inoticeably
+                # only on hash routines and des, otherwise gcc (2.95)
+                # keeps along rather tight...
+  fi
+fi
+
 GCCVER=${GCCVER:-0}
 CCVER=${CCVER:-0}
 
@@ -340,9 +365,6 @@ echo Operating system: $GUESSOS
 # script above so we end up with values in vars but that would take
 # more time that I want to waste at the moment
 case "$GUESSOS" in
-  alpha-*-linux2) OUT="alpha-gcc" ;;
-  ppc-*-linux2) OUT="linux-ppc" ;;
-  mips-*-linux?) OUT="linux-mips" ;;
   mips2-sgi-irix)
         CPU=`(hinv -t cpu) 2>/dev/null | sed 's/^CPU:[^R]*R\([0-9]*\).*/\1/'`
         CPU=${CPU:-0}
@@ -369,6 +391,23 @@ case "$GUESSOS" in
         options="$options -mips4"
         OUT="irix-mips3-$CC"
         ;;
+  alpha-*-linux2)
+        ISA=`awk '/cpu model/{print$4}' /proc/cpuinfo`
+        case ${ISA:-generic} in
+        *[67])  OUT="linux-alpha+bwx-$CC" ;;
+        *)      OUT="linux-alpha-$CC" ;;
+        esac
+        if [ "$CC" = "gcc" ]; then
+            case ${ISA:-generic} in
+            EV5|EV45)           options="$options -mcpu=ev5";;
+            EV56|PCA56)         options="$options -mcpu=ev56";;
+            EV6|EV67|PCA57)     options="$options -mcpu=ev6";;
+            esac
+        fi
+        ;;
+  mips-*-linux?) OUT="linux-mips" ;;
+  ppc-*-linux2) OUT="linux-ppc" ;;
+  ppc-apple-rhapsody) OUT="rhapsody-ppc-cc" ;;
   sparc64-*-linux2)
         #Before we can uncomment following lines we have to wait at least
         #till 64-bit glibc for SPARC is operational:-(
@@ -413,17 +452,30 @@ case "$GUESSOS" in
   *-*-openbsd) OUT="OpenBSD" ;;
   *86*-*-bsdi4) OUT="bsdi-elf-gcc" ;;
   *-*-osf) OUT="alpha-cc" ;;
-  *-*-unixware*) OUT="unixware-2.0" ;;
+  *-*-unixware7) OUT="unixware-7" ;;
+  *-*-UnixWare7) OUT="unixware-7" ;;
+  *-*-Unixware7) OUT="unixware-7" ;;
+  *-*-unixware[1-2]*) OUT="unixware-2.0" ;;
+  *-*-UnixWare[1-2]*) OUT="unixware-2.0" ;;
+  *-*-Unixware[1-2]*) OUT="unixware-2.0" ;;
   BS2000-siemens-sysv4) OUT="BS2000-OSD" ;;
   RM*-siemens-sysv4) OUT="ReliantUNIX" ;;
   *-siemens-sysv4) OUT="SINIX" ;;
+  *-hpux1*)     OUT="hpux-parisc-$CC"
+                options="$options -D_REENTRANT" ;;
+  *-hpux)       OUT="hpux-parisc-$CC" ;;
   # these are all covered by the catchall below
-  # *-hpux*) OUT="hpux-$CC" ;;
   # *-aix) OUT="aix-$CC" ;;
   # *-dgux) OUT="dgux" ;;
   *) OUT=`echo $GUESSOS | awk -F- '{print $3}'`;;
 esac
 
+# See whether we can compile Atalla support
+if [ -f /usr/include/atasi.h ]
+then
+  options="$options -DATALLA"
+fi
+
 # gcc < 2.8 does not support -mcpu=ultrasparc
 if [ "$OUT" = solaris-sparcv9-gcc -a $GCCVER -lt 28 ]
 then
@@ -438,6 +490,17 @@ then
   sleep 5
   OUT=linux-sparcv8
 fi
+# To start with $OUT is never i86pc-sun-solaris2. Secondly why
+# ban *all* assembler implementation if it can't stand only one,
+# SHA-0 implementation.
+#if [ "$OUT" = "i86pc-sun-solaris2" ]
+#then
+#  ASM=`as -V /dev/null 2>&1`
+#  case "$ASM" in
+#    GNU*) ;;
+#    *) options="$options no-asm" ; echo "WARNING: You need the GNU assembler to use OpenSSL assembler code." ; echo "Sun as is not supported on Solaris x86." ;;
+#  esac
+#fi
 
 case "$GUESSOS" in
   i386-*) options="$options 386" ;;
@@ -484,14 +547,14 @@ fi
 # compiler for the platform ... in which case we add it on
 # the end ... otherwise we leave it off
 
-$PERL ./Configure 2>&1 | grep "$OUT-$CC" > /dev/null
+$PERL ./Configure LIST | grep "$OUT-$CC" > /dev/null
 if [ $? = "0" ]; then
   OUT="$OUT-$CC"
 fi
 
 OUT="$PREFIX$OUT"
 
-$PERL ./Configure 2>&1 | grep "$OUT" > /dev/null
+$PERL ./Configure LIST | grep "$OUT" > /dev/null
 if [ $? = "0" ]; then
   echo Configuring for $OUT
 
diff --git a/src/lib/libssl/src/crypto/Makefile b/src/lib/libssl/src/crypto/Makefile
index f4813d3aaa..c0b6e906a8 100644
--- a/src/lib/libssl/src/crypto/Makefile
+++ b/src/lib/libssl/src/crypto/Makefile
@@ -34,8 +34,8 @@ SDIRS=	md2 md5 sha mdc2 hmac ripemd \
 GENERAL=Makefile README crypto-lib.com install.com
 
 LIB= $(TOP)/libcrypto.a
-LIBSRC= cryptlib.c mem.c cversion.c ex_data.c tmdiff.c cpt_err.c
-LIBOBJ= cryptlib.o mem.o cversion.o ex_data.o tmdiff.o cpt_err.o
+LIBSRC= cryptlib.c mem.c mem_dbg.c cversion.c ex_data.c tmdiff.c cpt_err.c ebcdic.c
+LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o tmdiff.o cpt_err.o ebcdic.o
 
 SRC= $(LIBSRC)
 
@@ -57,6 +57,11 @@ buildinf.h: ../Makefile.ssl
         echo "  #define DATE \"`date`\""; \
         echo "#endif" ) >buildinf.h
 
+testapps:
+        if echo ${SDIRS} | fgrep ' des '; \
+        then cd des && $(MAKE) CC='$(CC)' INCLUDES='${INCLUDES}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' des; fi
+        cd pkcs7 && $(MAKE) CC='$(CC)' INCLUDES='${INCLUDES}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' testapps
+
 subdirs:
         @for i in $(SDIRS) ;\
         do \
@@ -122,7 +127,7 @@ lint:
         done;
 
 depend:
-        if [ ! -e buildinf.h ]; then touch buildinf.h; fi # fake buildinf.h if it does not exist
+        if [ ! -f buildinf.h ]; then touch buildinf.h; fi # fake buildinf.h if it does not exist
         $(MAKEDEPEND) $(INCLUDE) $(DEPFLAG) $(PROGS) $(LIBSRC)
         if [ ! -s buildinf.h ]; then rm buildinf.h; fi
         @for i in $(SDIRS) ;\
@@ -151,29 +156,40 @@ dclean:
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
 cpt_err.o: ../include/openssl/crypto.h ../include/openssl/err.h
-cpt_err.o: ../include/openssl/opensslv.h ../include/openssl/stack.h
+cpt_err.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+cpt_err.o: ../include/openssl/stack.h
 cryptlib.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 cryptlib.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 cryptlib.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 cryptlib.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-cryptlib.o: ../include/openssl/stack.h cryptlib.h
+cryptlib.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+cryptlib.o: cryptlib.h
 cversion.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 cversion.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 cversion.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 cversion.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-cversion.o: ../include/openssl/stack.h buildinf.h cryptlib.h
+cversion.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+cversion.o: buildinf.h cryptlib.h
 ex_data.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 ex_data.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 ex_data.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 ex_data.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
-ex_data.o: ../include/openssl/opensslv.h ../include/openssl/stack.h cryptlib.h
+ex_data.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+ex_data.o: ../include/openssl/stack.h cryptlib.h
 mem.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 mem.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 mem.o: ../include/openssl/e_os2.h ../include/openssl/err.h
-mem.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
-mem.o: ../include/openssl/opensslv.h ../include/openssl/stack.h cryptlib.h
+mem.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+mem.o: ../include/openssl/safestack.h ../include/openssl/stack.h cryptlib.h
+mem_dbg.o: ../include/openssl/bio.h ../include/openssl/buffer.h
+mem_dbg.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
+mem_dbg.o: ../include/openssl/e_os2.h ../include/openssl/err.h
+mem_dbg.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
+mem_dbg.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+mem_dbg.o: ../include/openssl/stack.h cryptlib.h
 tmdiff.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 tmdiff.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 tmdiff.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 tmdiff.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-tmdiff.o: ../include/openssl/stack.h ../include/openssl/tmdiff.h cryptlib.h
+tmdiff.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+tmdiff.o: ../include/openssl/tmdiff.h cryptlib.h
diff --git a/src/lib/libssl/src/crypto/Makefile.ssl b/src/lib/libssl/src/crypto/Makefile.ssl
index 2fcbf18545..cab75d9f80 100644
--- a/src/lib/libssl/src/crypto/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/Makefile.ssl
@@ -34,8 +34,8 @@ SDIRS=	md2 md5 sha mdc2 hmac ripemd \
 GENERAL=Makefile README crypto-lib.com install.com
 
 LIB= $(TOP)/libcrypto.a
-LIBSRC= cryptlib.c mem.c cversion.c ex_data.c tmdiff.c cpt_err.c
-LIBOBJ= cryptlib.o mem.o cversion.o ex_data.o tmdiff.o cpt_err.o
+LIBSRC= cryptlib.c mem.c mem_dbg.c cversion.c ex_data.c tmdiff.c cpt_err.c ebcdic.c
+LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o tmdiff.o cpt_err.o ebcdic.o
 
 SRC= $(LIBSRC)
 
@@ -57,6 +57,11 @@ buildinf.h: ../Makefile.ssl
         echo "  #define DATE \"`date`\""; \
         echo "#endif" ) >buildinf.h
 
+testapps:
+        if echo ${SDIRS} | fgrep ' des '; \
+        then cd des && $(MAKE) CC='$(CC)' INCLUDES='${INCLUDES}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' des; fi
+        cd pkcs7 && $(MAKE) CC='$(CC)' INCLUDES='${INCLUDES}' CFLAG='${CFLAG}' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' testapps
+
 subdirs:
         @for i in $(SDIRS) ;\
         do \
@@ -122,7 +127,7 @@ lint:
         done;
 
 depend:
-        if [ ! -e buildinf.h ]; then touch buildinf.h; fi # fake buildinf.h if it does not exist
+        if [ ! -f buildinf.h ]; then touch buildinf.h; fi # fake buildinf.h if it does not exist
         $(MAKEDEPEND) $(INCLUDE) $(DEPFLAG) $(PROGS) $(LIBSRC)
         if [ ! -s buildinf.h ]; then rm buildinf.h; fi
         @for i in $(SDIRS) ;\
@@ -151,29 +156,40 @@ dclean:
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
 cpt_err.o: ../include/openssl/crypto.h ../include/openssl/err.h
-cpt_err.o: ../include/openssl/opensslv.h ../include/openssl/stack.h
+cpt_err.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+cpt_err.o: ../include/openssl/stack.h
 cryptlib.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 cryptlib.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 cryptlib.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 cryptlib.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-cryptlib.o: ../include/openssl/stack.h cryptlib.h
+cryptlib.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+cryptlib.o: cryptlib.h
 cversion.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 cversion.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 cversion.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 cversion.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-cversion.o: ../include/openssl/stack.h buildinf.h cryptlib.h
+cversion.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+cversion.o: buildinf.h cryptlib.h
 ex_data.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 ex_data.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 ex_data.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 ex_data.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
-ex_data.o: ../include/openssl/opensslv.h ../include/openssl/stack.h cryptlib.h
+ex_data.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+ex_data.o: ../include/openssl/stack.h cryptlib.h
 mem.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 mem.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 mem.o: ../include/openssl/e_os2.h ../include/openssl/err.h
-mem.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
-mem.o: ../include/openssl/opensslv.h ../include/openssl/stack.h cryptlib.h
+mem.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+mem.o: ../include/openssl/safestack.h ../include/openssl/stack.h cryptlib.h
+mem_dbg.o: ../include/openssl/bio.h ../include/openssl/buffer.h
+mem_dbg.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
+mem_dbg.o: ../include/openssl/e_os2.h ../include/openssl/err.h
+mem_dbg.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
+mem_dbg.o: ../include/openssl/opensslv.h ../include/openssl/safestack.h
+mem_dbg.o: ../include/openssl/stack.h cryptlib.h
 tmdiff.o: ../include/openssl/bio.h ../include/openssl/buffer.h
 tmdiff.o: ../include/openssl/crypto.h ../include/openssl/e_os.h
 tmdiff.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 tmdiff.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-tmdiff.o: ../include/openssl/stack.h ../include/openssl/tmdiff.h cryptlib.h
+tmdiff.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+tmdiff.o: ../include/openssl/tmdiff.h cryptlib.h
diff --git a/src/lib/libssl/src/crypto/asn1/Makefile.ssl b/src/lib/libssl/src/crypto/asn1/Makefile.ssl
index 5d668411f6..a17a713a75 100644
--- a/src/lib/libssl/src/crypto/asn1/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/asn1/Makefile.ssl
@@ -23,34 +23,34 @@ APPS=
 
 LIB=$(TOP)/libcrypto.a
 LIBSRC= a_object.c a_bitstr.c a_utctm.c a_gentm.c a_time.c a_int.c a_octet.c \
-        a_print.c a_type.c a_set.c a_dup.c a_d2i_fp.c a_i2d_fp.c a_bmp.c \
-        a_enum.c a_vis.c a_utf8.c a_sign.c a_digest.c a_verify.c \
+        a_null.c a_print.c a_type.c a_set.c a_dup.c a_d2i_fp.c a_i2d_fp.c a_bmp.c \
+        a_enum.c a_vis.c a_utf8.c a_sign.c a_digest.c a_verify.c a_mbstr.c \
         x_algor.c x_val.c x_pubkey.c x_sig.c x_req.c x_attrib.c \
-        x_name.c x_cinf.c x_x509.c x_crl.c x_info.c x_spki.c nsseq.c \
+        x_name.c x_cinf.c x_x509.c x_x509a.c x_crl.c x_info.c x_spki.c nsseq.c \
         d2i_r_pr.c i2d_r_pr.c d2i_r_pu.c i2d_r_pu.c \
         d2i_s_pr.c i2d_s_pr.c d2i_s_pu.c i2d_s_pu.c \
         d2i_pu.c d2i_pr.c i2d_pu.c i2d_pr.c\
-        t_req.c t_x509.c t_crl.c t_pkey.c \
+        t_req.c t_x509.c t_x509a.c t_crl.c t_pkey.c t_spki.c t_bitst.c \
         p7_i_s.c p7_signi.c p7_signd.c p7_recip.c p7_enc_c.c p7_evp.c \
         p7_dgst.c p7_s_e.c p7_enc.c p7_lib.c \
         f_int.c f_string.c i2d_dhp.c i2d_dsap.c d2i_dhp.c d2i_dsap.c n_pkey.c \
         f_enum.c a_hdr.c x_pkey.c a_bool.c x_exten.c \
-        asn1_par.c asn1_lib.c asn1_err.c a_meth.c a_bytes.c \
+        asn1_par.c asn1_lib.c asn1_err.c a_meth.c a_bytes.c a_strnid.c \
         evp_asn1.c asn_pack.c p5_pbe.c p5_pbev2.c p8_pkey.c
 LIBOBJ= a_object.o a_bitstr.o a_utctm.o a_gentm.o a_time.o a_int.o a_octet.o \
-        a_print.o a_type.o a_set.o a_dup.o a_d2i_fp.o a_i2d_fp.o a_bmp.o \
-        a_enum.o a_vis.o a_utf8.o a_sign.o a_digest.o a_verify.o \
+        a_null.o a_print.o a_type.o a_set.o a_dup.o a_d2i_fp.o a_i2d_fp.o a_bmp.o \
+        a_enum.o a_vis.o a_utf8.o a_sign.o a_digest.o a_verify.o a_mbstr.o \
         x_algor.o x_val.o x_pubkey.o x_sig.o x_req.o x_attrib.o \
-        x_name.o x_cinf.o x_x509.o x_crl.o x_info.o x_spki.o nsseq.o \
+        x_name.o x_cinf.o x_x509.o x_x509a.o x_crl.o x_info.o x_spki.o nsseq.o \
         d2i_r_pr.o i2d_r_pr.o d2i_r_pu.o i2d_r_pu.o \
         d2i_s_pr.o i2d_s_pr.o d2i_s_pu.o i2d_s_pu.o \
         d2i_pu.o d2i_pr.o i2d_pu.o i2d_pr.o \
-        t_req.o t_x509.o t_crl.o t_pkey.o \
+        t_req.o t_x509.o t_x509a.o t_crl.o t_pkey.o t_spki.o t_bitst.o \
         p7_i_s.o p7_signi.o p7_signd.o p7_recip.o p7_enc_c.o p7_evp.o \
         p7_dgst.o p7_s_e.o p7_enc.o p7_lib.o \
         f_int.o f_string.o i2d_dhp.o i2d_dsap.o d2i_dhp.o d2i_dsap.o n_pkey.o \
         f_enum.o a_hdr.o x_pkey.o a_bool.o x_exten.o \
-        asn1_par.o asn1_lib.o asn1_err.o a_meth.o a_bytes.o \
+        asn1_par.o asn1_lib.o asn1_err.o a_meth.o a_bytes.o a_strnid.o \
         evp_asn1.o asn_pack.o p5_pbe.o p5_pbev2.o p8_pkey.o
 
 SRC= $(LIBSRC)
@@ -160,11 +160,13 @@ a_digest.o: ../../include/openssl/err.h ../../include/openssl/evp.h
 a_digest.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
 a_digest.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 a_digest.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-a_digest.o: ../../include/openssl/opensslv.h ../../include/openssl/rc2.h
-a_digest.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
-a_digest.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
-a_digest.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-a_digest.o: ../../include/openssl/stack.h ../cryptlib.h
+a_digest.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+a_digest.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+a_digest.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+a_digest.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+a_digest.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+a_digest.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+a_digest.o: ../cryptlib.h
 a_dup.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 a_dup.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 a_dup.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
@@ -207,6 +209,13 @@ a_int.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 a_int.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 a_int.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 a_int.o: ../cryptlib.h
+a_mbstr.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_mbstr.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_mbstr.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_mbstr.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_mbstr.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+a_mbstr.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+a_mbstr.o: ../cryptlib.h
 a_meth.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_meth.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_meth.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -214,6 +223,13 @@ a_meth.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 a_meth.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 a_meth.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 a_meth.o: ../cryptlib.h
+a_null.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_null.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_null.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_null.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_null.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+a_null.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+a_null.o: ../cryptlib.h
 a_object.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_object.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_object.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -259,6 +275,13 @@ a_sign.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 a_sign.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 a_sign.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 a_sign.o: ../cryptlib.h
+a_strnid.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_strnid.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_strnid.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_strnid.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_strnid.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+a_strnid.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+a_strnid.o: ../../include/openssl/stack.h ../cryptlib.h
 a_time.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_time.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_time.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -788,6 +811,24 @@ p8_pkey.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p8_pkey.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 p8_pkey.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
 p8_pkey.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+t_bitst.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+t_bitst.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+t_bitst.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+t_bitst.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+t_bitst.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_bitst.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_bitst.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_bitst.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_bitst.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+t_bitst.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+t_bitst.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+t_bitst.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+t_bitst.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+t_bitst.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+t_bitst.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+t_bitst.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+t_bitst.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+t_bitst.o: ../../include/openssl/x509v3.h ../cryptlib.h
 t_crl.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_crl.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_crl.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -812,15 +853,17 @@ t_pkey.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 t_pkey.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 t_pkey.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 t_pkey.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-t_pkey.o: ../../include/openssl/stack.h ../cryptlib.h
+t_pkey.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+t_pkey.o: ../cryptlib.h
 t_req.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_req.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_req.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-t_req.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-t_req.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-t_req.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-t_req.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-t_req.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+t_req.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+t_req.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_req.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_req.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_req.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_req.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 t_req.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 t_req.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 t_req.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -829,7 +872,24 @@ t_req.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 t_req.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 t_req.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 t_req.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-t_req.o: ../cryptlib.h
+t_req.o: ../../include/openssl/x509v3.h ../cryptlib.h
+t_spki.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+t_spki.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+t_spki.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+t_spki.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+t_spki.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_spki.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_spki.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_spki.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_spki.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+t_spki.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+t_spki.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+t_spki.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+t_spki.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+t_spki.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+t_spki.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+t_spki.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+t_spki.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 t_x509.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_x509.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_x509.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -848,6 +908,23 @@ t_x509.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 t_x509.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 t_x509.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 t_x509.o: ../../include/openssl/x509v3.h ../cryptlib.h
+t_x509a.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+t_x509a.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+t_x509a.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+t_x509a.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+t_x509a.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_x509a.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_x509a.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_x509a.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_x509a.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+t_x509a.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+t_x509a.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+t_x509a.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+t_x509a.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+t_x509a.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+t_x509a.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+t_x509a.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+t_x509a.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 x_algor.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 x_algor.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 x_algor.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
@@ -1088,3 +1165,20 @@ x_x509.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 x_x509.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 x_x509.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
 x_x509.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+x_x509a.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+x_x509a.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+x_x509a.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+x_x509a.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+x_x509a.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x_x509a.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x_x509a.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x_x509a.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x_x509a.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+x_x509a.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+x_x509a.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+x_x509a.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+x_x509a.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+x_x509a.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+x_x509a.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+x_x509a.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+x_x509a.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/asn1/a_bitstr.c b/src/lib/libssl/src/crypto/asn1/a_bitstr.c
index 38ea802be8..c77456b315 100644
--- a/src/lib/libssl/src/crypto/asn1/a_bitstr.c
+++ b/src/lib/libssl/src/crypto/asn1/a_bitstr.c
@@ -60,6 +60,15 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_BIT_STRING *ASN1_BIT_STRING_new(void)
+{ return M_ASN1_BIT_STRING_new(); }
+
+void ASN1_BIT_STRING_free(ASN1_BIT_STRING *x)
+{ M_ASN1_BIT_STRING_free(x); }
+
+int ASN1_BIT_STRING_set(ASN1_BIT_STRING *x, unsigned char *d, int len)
+{ return M_ASN1_BIT_STRING_set(x, d, len); }
+
 int i2d_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
         {
         int ret,j,r,bits,len;
@@ -121,7 +130,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
 
         if ((a == NULL) || ((*a) == NULL))
                 {
-                if ((ret=ASN1_BIT_STRING_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_BIT_STRING_new()) == NULL) return(NULL);
                 }
         else
                 ret=(*a);
@@ -164,7 +173,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
                 s=NULL;
 
         ret->length=(int)len;
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->data=s;
         ret->type=V_ASN1_BIT_STRING;
         if (a != NULL) (*a)=ret;
@@ -173,7 +182,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
 err:
         ASN1err(ASN1_F_D2I_ASN1_BIT_STRING,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_BIT_STRING_free(ret);
+                M_ASN1_BIT_STRING_free(ret);
         return(NULL);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_bmp.c b/src/lib/libssl/src/crypto/asn1/a_bmp.c
index 6075871984..d9ac5a0475 100644
--- a/src/lib/libssl/src/crypto/asn1/a_bmp.c
+++ b/src/lib/libssl/src/crypto/asn1/a_bmp.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_BMPSTRING *ASN1_BMPSTRING_new(void)
+{ return M_ASN1_BMPSTRING_new(); }
+
+void ASN1_BMPSTRING_free(ASN1_BMPSTRING *x)
+{ M_ASN1_BMPSTRING_free(x); }
+
 int i2d_ASN1_BMPSTRING(ASN1_BMPSTRING *a, unsigned char **pp)
         {
         return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
diff --git a/src/lib/libssl/src/crypto/asn1/a_bytes.c b/src/lib/libssl/src/crypto/asn1/a_bytes.c
index e452e03b88..8cde695804 100644
--- a/src/lib/libssl/src/crypto/asn1/a_bytes.c
+++ b/src/lib/libssl/src/crypto/asn1/a_bytes.c
@@ -71,7 +71,7 @@ B_ASN1_T61STRING,B_ASN1_VIDEOTEXSTRING,B_ASN1_IA5STRING,0,
 B_ASN1_UNIVERSALSTRING,B_ASN1_UNKNOWN,B_ASN1_BMPSTRING,B_ASN1_UNKNOWN,
         };
 
-static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c);
+static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c);
 /* type is a 'bitmap' of acceptable string types.
  */
 ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, unsigned char **pp,
@@ -124,7 +124,7 @@ ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, unsigned char **pp,
         else
                 s=NULL;
 
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->length=(int)len;
         ret->data=s;
         ret->type=tag;
@@ -205,7 +205,7 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                 c.tag=Ptag;
                 c.xclass=Pclass;
                 c.max=(length == 0)?0:(p+length);
-                if (!asn1_collate_primative(ret,&c)) 
+                if (!asn1_collate_primitive(ret,&c)) 
                         goto err; 
                 else
                         {
@@ -218,8 +218,8 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                         {
                         if ((ret->length < len) || (ret->data == NULL))
                                 {
-                                if (ret->data != NULL) Free((char *)ret->data);
-                                s=(unsigned char *)Malloc((int)len);
+                                if (ret->data != NULL) Free(ret->data);
+                                s=(unsigned char *)Malloc((int)len + 1);
                                 if (s == NULL)
                                         {
                                         i=ERR_R_MALLOC_FAILURE;
@@ -229,12 +229,13 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                         else
                                 s=ret->data;
                         memcpy(s,p,(int)len);
+                        s[len] = '\0';
                         p+=len;
                         }
                 else
                         {
                         s=NULL;
-                        if (ret->data != NULL) Free((char *)ret->data);
+                        if (ret->data != NULL) Free(ret->data);
                         }
 
                 ret->length=(int)len;
@@ -253,11 +254,11 @@ err:
         }
 
 
-/* We are about to parse 0..n d2i_ASN1_bytes objects, we are to collapes
- * them into the one struture that is then returned */
+/* We are about to parse 0..n d2i_ASN1_bytes objects, we are to collapse
+ * them into the one structure that is then returned */
 /* There have been a few bug fixes for this function from
  * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
-static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
+static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
         {
         ASN1_STRING *os=NULL;
         BUF_MEM b;
diff --git a/src/lib/libssl/src/crypto/asn1/a_digest.c b/src/lib/libssl/src/crypto/asn1/a_digest.c
index 8c45add557..3370aae998 100644
--- a/src/lib/libssl/src/crypto/asn1/a_digest.c
+++ b/src/lib/libssl/src/crypto/asn1/a_digest.c
@@ -58,16 +58,19 @@
 
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
 #include <openssl/evp.h>
 #include <openssl/buffer.h>
 #include <openssl/x509.h>
 
-int ASN1_digest(int (*i2d)(), EVP_MD *type, char *data, unsigned char *md,
-             unsigned int *len)
+int ASN1_digest(int (*i2d)(), const EVP_MD *type, char *data,
+                unsigned char *md, unsigned int *len)
         {
         EVP_MD_CTX ctx;
         int i;
diff --git a/src/lib/libssl/src/crypto/asn1/a_dup.c b/src/lib/libssl/src/crypto/asn1/a_dup.c
index c0a8709f3b..3202a816d0 100644
--- a/src/lib/libssl/src/crypto/asn1/a_dup.c
+++ b/src/lib/libssl/src/crypto/asn1/a_dup.c
@@ -78,6 +78,6 @@ char *ASN1_dup(int (*i2d)(), char *(*d2i)(), char *x)
         i=i2d(x,&p);
         p= b;
         ret=d2i(NULL,&p,i);
-        Free((char *)b);
+        Free(b);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/a_enum.c b/src/lib/libssl/src/crypto/asn1/a_enum.c
index 9239ecc439..ccf62e5a04 100644
--- a/src/lib/libssl/src/crypto/asn1/a_enum.c
+++ b/src/lib/libssl/src/crypto/asn1/a_enum.c
@@ -65,6 +65,12 @@
  * for comments on encoding see a_int.c
  */
 
+ASN1_ENUMERATED *ASN1_ENUMERATED_new(void)
+{ return M_ASN1_ENUMERATED_new(); }
+
+void ASN1_ENUMERATED_free(ASN1_ENUMERATED *x)
+{ M_ASN1_ENUMERATED_free(x); }
+
 int i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a, unsigned char **pp)
         {
         int pad=0,ret,r,i,t;
@@ -142,7 +148,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
 
         if ((a == NULL) || ((*a) == NULL))
                 {
-                if ((ret=ASN1_ENUMERATED_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_ENUMERATED_new()) == NULL) return(NULL);
                 ret->type=V_ASN1_ENUMERATED;
                 }
         else
@@ -171,7 +177,12 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
                 goto err;
                 }
         to=s;
-        if (*p & 0x80) /* a negative number */
+        if(!len) {
+                /* Strictly speaking this is an illegal ENUMERATED but we
+                 * tolerate it.
+                 */
+                ret->type=V_ASN1_ENUMERATED;
+        } else if (*p & 0x80) /* a negative number */
                 {
                 ret->type=V_ASN1_NEG_ENUMERATED;
                 if ((*p == 0xff) && (len != 1)) {
@@ -208,7 +219,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
                 p+=len;
         }
 
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->data=s;
         ret->length=(int)len;
         if (a != NULL) (*a)=ret;
@@ -217,7 +228,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
 err:
         ASN1err(ASN1_F_D2I_ASN1_ENUMERATED,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_ENUMERATED_free(ret);
+                M_ASN1_ENUMERATED_free(ret);
         return(NULL);
         }
 
@@ -231,7 +242,7 @@ int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v)
         if (a->length < (sizeof(long)+1))
                 {
                 if (a->data != NULL)
-                        Free((char *)a->data);
+                        Free(a->data);
                 if ((a->data=(unsigned char *)Malloc(sizeof(long)+1)) != NULL)
                         memset((char *)a->data,0,sizeof(long)+1);
                 }
@@ -295,7 +306,7 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
         int len,j;
 
         if (ai == NULL)
-                ret=ASN1_ENUMERATED_new();
+                ret=M_ASN1_ENUMERATED_new();
         else
                 ret=ai;
         if (ret == NULL)
@@ -311,7 +322,7 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
         ret->length=BN_bn2bin(bn,ret->data);
         return(ret);
 err:
-        if (ret != ai) ASN1_ENUMERATED_free(ret);
+        if (ret != ai) M_ASN1_ENUMERATED_free(ret);
         return(NULL);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_gentm.c b/src/lib/libssl/src/crypto/asn1/a_gentm.c
index 226474f057..84062170e8 100644
--- a/src/lib/libssl/src/crypto/asn1/a_gentm.c
+++ b/src/lib/libssl/src/crypto/asn1/a_gentm.c
@@ -63,6 +63,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_new(void)
+{ return M_ASN1_GENERALIZEDTIME_new(); }
+
+void ASN1_GENERALIZEDTIME_free(ASN1_GENERALIZEDTIME *x)
+{ M_ASN1_GENERALIZEDTIME_free(x); }
+
 int i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a, unsigned char **pp)
         {
 #ifdef CHARSET_EBCDIC
@@ -106,7 +112,7 @@ ASN1_GENERALIZEDTIME *d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a,
         return(ret);
 err:
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_GENERALIZEDTIME_free(ret);
+                M_ASN1_GENERALIZEDTIME_free(ret);
         return(NULL);
         }
 
@@ -193,7 +199,7 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
 #endif
 
         if (s == NULL)
-                s=ASN1_GENERALIZEDTIME_new();
+                s=M_ASN1_GENERALIZEDTIME_new();
         if (s == NULL)
                 return(NULL);
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_hdr.c b/src/lib/libssl/src/crypto/asn1/a_hdr.c
index 1171d36443..434610e8e1 100644
--- a/src/lib/libssl/src/crypto/asn1/a_hdr.c
+++ b/src/lib/libssl/src/crypto/asn1/a_hdr.c
@@ -102,7 +102,7 @@ ASN1_HEADER *ASN1_HEADER_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,ASN1_HEADER);
-        M_ASN1_New(ret->header,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->header,M_ASN1_OCTET_STRING_new);
         ret->meth=NULL;
         ret->data=NULL;
         return(ret);
@@ -112,8 +112,8 @@ ASN1_HEADER *ASN1_HEADER_new(void)
 void ASN1_HEADER_free(ASN1_HEADER *a)
         {
         if (a == NULL) return;
-        ASN1_OCTET_STRING_free(a->header);
+        M_ASN1_OCTET_STRING_free(a->header);
         if (a->meth != NULL)
                 a->meth->destroy(a->data);
-        Free((char *)a);
+        Free(a);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/a_i2d_fp.c b/src/lib/libssl/src/crypto/asn1/a_i2d_fp.c
index 6bd845443c..d9b8035e17 100644
--- a/src/lib/libssl/src/crypto/asn1/a_i2d_fp.c
+++ b/src/lib/libssl/src/crypto/asn1/a_i2d_fp.c
@@ -108,6 +108,6 @@ int ASN1_i2d_bio(int (*i2d)(), BIO *out, unsigned char *x)
                 j+=i;
                 n-=i;
                 }
-        Free((char *)b);
+        Free(b);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/a_int.c b/src/lib/libssl/src/crypto/asn1/a_int.c
index d05436378b..8b6794e8c1 100644
--- a/src/lib/libssl/src/crypto/asn1/a_int.c
+++ b/src/lib/libssl/src/crypto/asn1/a_int.c
@@ -60,6 +60,18 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_INTEGER *ASN1_INTEGER_new(void)
+{ return M_ASN1_INTEGER_new();}
+
+void ASN1_INTEGER_free(ASN1_INTEGER *x)
+{ M_ASN1_INTEGER_free(x);}
+
+ASN1_INTEGER *ASN1_INTEGER_dup(ASN1_INTEGER *x)
+{ return M_ASN1_INTEGER_dup(x);}
+
+int ASN1_INTEGER_cmp(ASN1_INTEGER *x, ASN1_INTEGER *y)
+{ return M_ASN1_INTEGER_cmp(x,y);}
+
 /* 
  * This converts an ASN1 INTEGER into its DER encoding.
  * The internal representation is an ASN1_STRING whose data is a big endian
@@ -160,7 +172,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
 
         if ((a == NULL) || ((*a) == NULL))
                 {
-                if ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);
                 ret->type=V_ASN1_INTEGER;
                 }
         else
@@ -190,7 +202,12 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                 goto err;
                 }
         to=s;
-        if (*p & 0x80) /* a negative number */
+        if(!len) {
+                /* Strictly speaking this is an illegal INTEGER but we
+                 * tolerate it.
+                 */
+                ret->type=V_ASN1_INTEGER;
+        } else if (*p & 0x80) /* a negative number */
                 {
                 ret->type=V_ASN1_NEG_INTEGER;
                 if ((*p == 0xff) && (len != 1)) {
@@ -231,7 +248,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                 memcpy(s,p,(int)len);
         }
 
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->data=s;
         ret->length=(int)len;
         if (a != NULL) (*a)=ret;
@@ -240,7 +257,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
 err:
         ASN1err(ASN1_F_D2I_ASN1_INTEGER,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_INTEGER_free(ret);
+                M_ASN1_INTEGER_free(ret);
         return(NULL);
         }
 
@@ -260,7 +277,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
 
         if ((a == NULL) || ((*a) == NULL))
                 {
-                if ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);
                 ret->type=V_ASN1_INTEGER;
                 }
         else
@@ -289,7 +306,8 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                 goto err;
                 }
         to=s;
-                ret->type=V_ASN1_INTEGER;
+        ret->type=V_ASN1_INTEGER;
+        if(len) {
                 if ((*p == 0) && (len != 1))
                         {
                         p++;
@@ -297,8 +315,9 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                         }
                 memcpy(s,p,(int)len);
                 p+=len;
+        }
 
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
         ret->data=s;
         ret->length=(int)len;
         if (a != NULL) (*a)=ret;
@@ -307,7 +326,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
 err:
         ASN1err(ASN1_F_D2I_ASN1_UINTEGER,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_INTEGER_free(ret);
+                M_ASN1_INTEGER_free(ret);
         return(NULL);
         }
 
@@ -321,7 +340,7 @@ int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
         if (a->length < (sizeof(long)+1))
                 {
                 if (a->data != NULL)
-                        Free((char *)a->data);
+                        Free(a->data);
                 if ((a->data=(unsigned char *)Malloc(sizeof(long)+1)) != NULL)
                         memset((char *)a->data,0,sizeof(long)+1);
                 }
@@ -385,7 +404,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
         int len,j;
 
         if (ai == NULL)
-                ret=ASN1_INTEGER_new();
+                ret=M_ASN1_INTEGER_new();
         else
                 ret=ai;
         if (ret == NULL)
@@ -401,7 +420,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
         ret->length=BN_bn2bin(bn,ret->data);
         return(ret);
 err:
-        if (ret != ai) ASN1_INTEGER_free(ret);
+        if (ret != ai) M_ASN1_INTEGER_free(ret);
         return(NULL);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_mbstr.c b/src/lib/libssl/src/crypto/asn1/a_mbstr.c
new file mode 100644
index 0000000000..7a710d5459
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/a_mbstr.c
@@ -0,0 +1,390 @@
+/* a_mbstr.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+
+static int traverse_string(const unsigned char *p, int len, int inform,
+                 int (*rfunc)(unsigned long value, void *in), void *arg);
+static int in_utf8(unsigned long value, void *arg);
+static int out_utf8(unsigned long value, void *arg);
+static int type_str(unsigned long value, void *arg);
+static int cpy_asc(unsigned long value, void *arg);
+static int cpy_bmp(unsigned long value, void *arg);
+static int cpy_univ(unsigned long value, void *arg);
+static int cpy_utf8(unsigned long value, void *arg);
+static int is_printable(unsigned long value);
+
+/* These functions take a string in UTF8, ASCII or multibyte form and
+ * a mask of permissible ASN1 string types. It then works out the minimal
+ * type (using the order Printable < IA5 < T61 < BMP < Universal < UTF8)
+ * and creates a string of the correct type with the supplied data.
+ * Yes this is horrible: it has to be :-(
+ * The 'ncopy' form checks minimum and maximum size limits too.
+ */
+
+int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask)
+{
+        return ASN1_mbstring_ncopy(out, in, len, inform, mask, 0, 0);
+}
+
+int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask, 
+                                        long minsize, long maxsize)
+{
+        int str_type;
+        int ret;
+        int outform, outlen;
+        ASN1_STRING *dest;
+        unsigned char *p;
+        int nchar;
+        char strbuf[32];
+        int (*cpyfunc)(unsigned long,void *) = NULL;
+        if(len == -1) len = strlen((const char *)in);
+        if(!mask) mask = DIRSTRING_TYPE;
+
+        /* First do a string check and work out the number of characters */
+        switch(inform) {
+
+                case MBSTRING_BMP:
+                if(len & 1) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                         ASN1_R_INVALID_BMPSTRING_LENGTH);
+                        return -1;
+                }
+                nchar = len >> 1;
+                break;
+
+                case MBSTRING_UNIV:
+                if(len & 3) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                         ASN1_R_INVALID_UNIVERSALSTRING_LENGTH);
+                        return -1;
+                }
+                nchar = len >> 2;
+                break;
+
+                case MBSTRING_UTF8:
+                nchar = 0;
+                /* This counts the characters and does utf8 syntax checking */
+                ret = traverse_string(in, len, MBSTRING_UTF8, in_utf8, &nchar);
+                if(ret < 0) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                                 ASN1_R_INVALID_UTF8STRING);
+                        return -1;
+                }
+                break;
+
+                case MBSTRING_ASC:
+                nchar = len;
+                break;
+
+                default:
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_UNKNOWN_FORMAT);
+                return -1;
+        }
+
+        if((minsize > 0) && (nchar < minsize)) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_SHORT);
+                sprintf(strbuf, "%ld", minsize);
+                ERR_add_error_data(2, "minsize=", strbuf);
+                return -1;
+        }
+
+        if((maxsize > 0) && (nchar > maxsize)) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_LONG);
+                sprintf(strbuf, "%ld", maxsize);
+                ERR_add_error_data(2, "maxsize=", strbuf);
+                return -1;
+        }
+
+        /* Now work out minimal type (if any) */
+        if(traverse_string(in, len, inform, type_str, &mask) < 0) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_ILLEGAL_CHARACTERS);
+                return -1;
+        }
+
+
+        /* Now work out output format and string type */
+        outform = MBSTRING_ASC;
+        if(mask & B_ASN1_PRINTABLESTRING) str_type = V_ASN1_PRINTABLESTRING;
+        else if(mask & B_ASN1_IA5STRING) str_type = V_ASN1_IA5STRING;
+        else if(mask & B_ASN1_T61STRING) str_type = V_ASN1_T61STRING;
+        else if(mask & B_ASN1_BMPSTRING) {
+                str_type = V_ASN1_BMPSTRING;
+                outform = MBSTRING_BMP;
+        } else if(mask & B_ASN1_UNIVERSALSTRING) {
+                str_type = V_ASN1_UNIVERSALSTRING;
+                outform = MBSTRING_UNIV;
+        } else {
+                str_type = V_ASN1_UTF8STRING;
+                outform = MBSTRING_UTF8;
+        }
+        if(!out) return str_type;
+        if(*out) {
+                dest = *out;
+                if(dest->data) {
+                        dest->length = 0;
+                        Free(dest->data);
+                        dest->data = NULL;
+                }
+                dest->type = str_type;
+        } else {
+                dest = ASN1_STRING_type_new(str_type);
+                if(!dest) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                                        ERR_R_MALLOC_FAILURE);
+                        return -1;
+                }
+                *out = dest;
+        }
+        /* If both the same type just copy across */
+        if(inform == outform) {
+                if(!ASN1_STRING_set(dest, in, len)) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,ERR_R_MALLOC_FAILURE);
+                        return -1;
+                }
+                return str_type;
+        } 
+
+        /* Work out how much space the destination will need */
+        switch(outform) {
+                case MBSTRING_ASC:
+                outlen = nchar;
+                cpyfunc = cpy_asc;
+                break;
+
+                case MBSTRING_BMP:
+                outlen = nchar << 1;
+                cpyfunc = cpy_bmp;
+                break;
+
+                case MBSTRING_UNIV:
+                outlen = nchar << 2;
+                cpyfunc = cpy_univ;
+                break;
+
+                case MBSTRING_UTF8:
+                outlen = 0;
+                traverse_string(in, len, inform, out_utf8, &outlen);
+                cpyfunc = cpy_utf8;
+                break;
+        }
+        if(!(p = Malloc(outlen + 1))) {
+                ASN1_STRING_free(dest);
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY,ERR_R_MALLOC_FAILURE);
+                return -1;
+        }
+        dest->length = outlen;
+        dest->data = p;
+        p[outlen] = 0;
+        traverse_string(in, len, inform, cpyfunc, &p);
+        return str_type;        
+}
+
+/* This function traverses a string and passes the value of each character
+ * to an optional function along with a void * argument.
+ */
+
+static int traverse_string(const unsigned char *p, int len, int inform,
+                 int (*rfunc)(unsigned long value, void *in), void *arg)
+{
+        unsigned long value;
+        int ret;
+        while(len) {
+                if(inform == MBSTRING_ASC) {
+                        value = *p++;
+                        len--;
+                } else if(inform == MBSTRING_BMP) {
+                        value = *p++ << 8;
+                        value |= *p++;
+                        len -= 2;
+                } else if(inform == MBSTRING_UNIV) {
+                        value = *p++ << 24;
+                        value |= *p++ << 16;
+                        value |= *p++ << 8;
+                        value |= *p++;
+                        len -= 4;
+                } else {
+                        ret = UTF8_getc(p, len, &value);
+                        if(ret < 0) return -1;
+                        len -= ret;
+                        p += ret;
+                }
+                if(rfunc) {
+                        ret = rfunc(value, arg);
+                        if(ret <= 0) return ret;
+                }
+        }
+        return 1;
+}
+
+/* Various utility functions for traverse_string */
+
+/* Just count number of characters */
+
+static int in_utf8(unsigned long value, void *arg)
+{
+        int *nchar;
+        nchar = arg;
+        (*nchar)++;
+        return 1;
+}
+
+/* Determine size of output as a UTF8 String */
+
+static int out_utf8(unsigned long value, void *arg)
+{
+        long *outlen;
+        outlen = arg;
+        *outlen += UTF8_putc(NULL, -1, value);
+        return 1;
+}
+
+/* Determine the "type" of a string: check each character against a
+ * supplied "mask".
+ */
+
+static int type_str(unsigned long value, void *arg)
+{
+        unsigned long types;
+        types = *((unsigned long *)arg);
+        if((types & B_ASN1_PRINTABLESTRING) && !is_printable(value))
+                                        types &= ~B_ASN1_PRINTABLESTRING;
+        if((types & B_ASN1_IA5STRING) && (value > 127))
+                                        types &= ~B_ASN1_IA5STRING;
+        if((types & B_ASN1_T61STRING) && (value > 0xff))
+                                        types &= ~B_ASN1_T61STRING;
+        if((types & B_ASN1_BMPSTRING) && (value > 0xffff))
+                                        types &= ~B_ASN1_BMPSTRING;
+        if(!types) return -1;
+        *((unsigned long *)arg) = types;
+        return 1;
+}
+
+/* Copy one byte per character ASCII like strings */
+
+static int cpy_asc(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q = (unsigned char) value;
+        (*p)++;
+        return 1;
+}
+
+/* Copy two byte per character BMPStrings */
+
+static int cpy_bmp(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q++ = (unsigned char) ((value >> 8) & 0xff);
+        *q = (unsigned char) (value & 0xff);
+        *p += 2;
+        return 1;
+}
+
+/* Copy four byte per character UniversalStrings */
+
+static int cpy_univ(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q++ = (unsigned char) ((value >> 24) & 0xff);
+        *q++ = (unsigned char) ((value >> 16) & 0xff);
+        *q++ = (unsigned char) ((value >> 8) & 0xff);
+        *q = (unsigned char) (value & 0xff);
+        *p += 4;
+        return 1;
+}
+
+/* Copy to a UTF8String */
+
+static int cpy_utf8(unsigned long value, void *arg)
+{
+        unsigned char **p;
+        int ret;
+        p = arg;
+        /* We already know there is enough room so pass 0xff as the length */
+        ret = UTF8_putc(*p, 0xff, value);
+        *p += ret;
+        return 1;
+}
+
+/* Return 1 if the character is permitted in a PrintableString */
+static int is_printable(unsigned long value)
+{
+        int ch;
+        if(value > 0x7f) return 0;
+        ch = (int) value;
+        /* Note: we can't use 'isalnum' because certain accented 
+         * characters may count as alphanumeric in some environments.
+         */
+        if((ch >= 'a') && (ch <= 'z')) return 1;
+        if((ch >= 'A') && (ch <= 'Z')) return 1;
+        if((ch >= '0') && (ch <= '9')) return 1;
+        if ((ch == ' ') || strchr("'()+,-./:=?", ch)) return 1;
+        return 0;
+}
diff --git a/src/lib/libssl/src/crypto/asn1/a_null.c b/src/lib/libssl/src/crypto/asn1/a_null.c
new file mode 100644
index 0000000000..119fd784be
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/a_null.c
@@ -0,0 +1,119 @@
+/* a_null.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+
+/* ASN1 functions for NULL type. For compatibility with other ASN1 code
+ * it returns a pointer to an "ASN1_NULL" structure. The new/free functions
+ * don't need to do any allocating because nothing is stored in a NULL.
+ */
+
+int i2d_ASN1_NULL(ASN1_NULL *a, unsigned char **pp)
+        {
+        if(!a) return 0;
+        if (pp) ASN1_put_object(pp,0,0,V_ASN1_NULL,V_ASN1_UNIVERSAL);
+        return 2;
+        }
+
+ASN1_NULL *d2i_ASN1_NULL(ASN1_NULL **a, unsigned char **pp, long length)
+        {
+        ASN1_NULL *ret = NULL;
+        unsigned char *p;
+        long len;
+        int inf,tag,xclass;
+        int i=0;
+
+        p= *pp;
+        inf=ASN1_get_object(&p,&len,&tag,&xclass,length);
+        if (inf & 0x80)
+                {
+                i=ASN1_R_BAD_OBJECT_HEADER;
+                goto err;
+                }
+
+        if (tag != V_ASN1_NULL)
+                {
+                i=ASN1_R_EXPECTING_A_NULL;
+                goto err;
+                }
+
+        if (len != 0)
+                {
+                i=ASN1_R_NULL_IS_WRONG_LENGTH;
+                goto err;
+                }
+        ret=(ASN1_NULL *)1;
+        if (a != NULL) (*a)=ret;
+        *pp=p;
+        return(ret);
+err:
+        ASN1err(ASN1_F_D2I_ASN1_NULL,i);
+        return(ret);
+        }
+
+ASN1_NULL *ASN1_NULL_new(void)
+{
+        return (ASN1_NULL *)1;
+}
+
+void ASN1_NULL_free(ASN1_NULL *a)
+{
+        return;
+}
diff --git a/src/lib/libssl/src/crypto/asn1/a_object.c b/src/lib/libssl/src/crypto/asn1/a_object.c
index b94b418ee8..09d56fb669 100644
--- a/src/lib/libssl/src/crypto/asn1/a_object.c
+++ b/src/lib/libssl/src/crypto/asn1/a_object.c
@@ -222,8 +222,8 @@ ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, unsigned char **pp,
                 }
         if ((ret->data == NULL) || (ret->length < len))
                 {
-                if (ret->data != NULL) Free((char *)ret->data);
-                ret->data=(unsigned char *)Malloc((int)len);
+                if (ret->data != NULL) Free(ret->data);
+                ret->data=(unsigned char *)Malloc(len ? (int)len : 1);
                 ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
                 if (ret->data == NULL)
                         { i=ERR_R_MALLOC_FAILURE; goto err; }
@@ -269,7 +269,7 @@ void ASN1_OBJECT_free(ASN1_OBJECT *a)
         if (a == NULL) return;
         if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS)
                 {
-#ifndef CONST_STRICT /* disable purely for compile-time strict const checking. Doing this on a "real" compile will cause mempory leaks */
+#ifndef CONST_STRICT /* disable purely for compile-time strict const checking. Doing this on a "real" compile will cause memory leaks */
                 if (a->sn != NULL) Free((void *)a->sn);
                 if (a->ln != NULL) Free((void *)a->ln);
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/a_octet.c b/src/lib/libssl/src/crypto/asn1/a_octet.c
index 7659a13bd3..2586f4327d 100644
--- a/src/lib/libssl/src/crypto/asn1/a_octet.c
+++ b/src/lib/libssl/src/crypto/asn1/a_octet.c
@@ -60,11 +60,23 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_OCTET_STRING *ASN1_OCTET_STRING_new(void)
+{ return M_ASN1_OCTET_STRING_new(); }
+
+void ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *x)
+{ M_ASN1_OCTET_STRING_free(x); }
+
+ASN1_OCTET_STRING *ASN1_OCTET_STRING_dup(ASN1_OCTET_STRING *x)
+{ return M_ASN1_OCTET_STRING_dup(x); }
+
+int ASN1_OCTET_STRING_cmp(ASN1_OCTET_STRING *a, ASN1_OCTET_STRING *b)
+{ return M_ASN1_OCTET_STRING_cmp(a, b); }
+
+int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)
+{ return M_ASN1_OCTET_STRING_set(x, d, len); }
+
 int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
-        {
-        return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
-                V_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL));
-        }
+{ return M_i2d_ASN1_OCTET_STRING(a, pp); }
 
 ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,
              unsigned char **pp, long length)
diff --git a/src/lib/libssl/src/crypto/asn1/a_print.c b/src/lib/libssl/src/crypto/asn1/a_print.c
index cdec7a1561..b7bd2bd18a 100644
--- a/src/lib/libssl/src/crypto/asn1/a_print.c
+++ b/src/lib/libssl/src/crypto/asn1/a_print.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_IA5STRING *ASN1_IA5STRING_new(void)
+{ return M_ASN1_IA5STRING_new();}
+
+void ASN1_IA5STRING_free(ASN1_IA5STRING *x)
+{ M_ASN1_IA5STRING_free(x);}
+
 int i2d_ASN1_IA5STRING(ASN1_IA5STRING *a, unsigned char **pp)
         { return(M_i2d_ASN1_IA5STRING(a,pp)); }
 
@@ -67,15 +73,30 @@ ASN1_IA5STRING *d2i_ASN1_IA5STRING(ASN1_IA5STRING **a, unsigned char **pp,
              long l)
         { return(M_d2i_ASN1_IA5STRING(a,pp,l)); }
 
+ASN1_T61STRING *ASN1_T61STRING_new(void)
+{ return M_ASN1_T61STRING_new();}
+
+void ASN1_T61STRING_free(ASN1_T61STRING *x)
+{ M_ASN1_T61STRING_free(x);}
+
 ASN1_T61STRING *d2i_ASN1_T61STRING(ASN1_T61STRING **a, unsigned char **pp,
              long l)
         { return(M_d2i_ASN1_T61STRING(a,pp,l)); }
 
+ASN1_PRINTABLESTRING *ASN1_PRINTABLESTRING_new(void)
+{ return M_ASN1_PRINTABLESTRING_new();}
+
+void ASN1_PRINTABLESTRING_free(ASN1_PRINTABLESTRING *x)
+{ M_ASN1_PRINTABLESTRING_free(x);}
+
 ASN1_PRINTABLESTRING *d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a,
              unsigned char **pp, long l)
         { return(M_d2i_ASN1_PRINTABLESTRING(a,pp,
              l)); }
 
+int i2d_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING *a, unsigned char **pp)
+        { return(M_i2d_ASN1_PRINTABLESTRING(a,pp)); }
+
 int i2d_ASN1_PRINTABLE(ASN1_STRING *a, unsigned char **pp)
         { return(M_i2d_ASN1_PRINTABLE(a,pp)); }
 
@@ -149,6 +170,11 @@ int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s)
         return(1);
         }
 
+ASN1_STRING *DIRECTORYSTRING_new(void)
+{ return M_DIRECTORYSTRING_new();}
+
+void DIRECTORYSTRING_free(ASN1_STRING *x)
+{ M_DIRECTORYSTRING_free(x);}
 
 int i2d_DIRECTORYSTRING(ASN1_STRING *a, unsigned char **pp)
         { return(M_i2d_DIRECTORYSTRING(a,pp)); }
@@ -157,6 +183,12 @@ ASN1_STRING *d2i_DIRECTORYSTRING(ASN1_STRING **a, unsigned char **pp,
              long l)
         { return(M_d2i_DIRECTORYSTRING(a,pp,l)); }
 
+ASN1_STRING *DISPLAYTEXT_new(void)
+{ return M_DISPLAYTEXT_new();}
+
+void DISPLAYTEXT_free(ASN1_STRING *x)
+{ M_DISPLAYTEXT_free(x);}
+
 int i2d_DISPLAYTEXT(ASN1_STRING *a, unsigned char **pp)
         { return(M_i2d_DISPLAYTEXT(a,pp)); }
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_sign.c b/src/lib/libssl/src/crypto/asn1/a_sign.c
index 57595692e5..cfb4bca4f1 100644
--- a/src/lib/libssl/src/crypto/asn1/a_sign.c
+++ b/src/lib/libssl/src/crypto/asn1/a_sign.c
@@ -58,10 +58,13 @@
 
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
 #include <openssl/bn.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
@@ -126,11 +129,11 @@ int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
                 ASN1err(ASN1_F_ASN1_SIGN,ERR_R_EVP_LIB);
                 goto err;
                 }
-        if (signature->data != NULL) Free((char *)signature->data);
+        if (signature->data != NULL) Free(signature->data);
         signature->data=buf_out;
         buf_out=NULL;
         signature->length=outl;
-        /* In the interests of compatability, I'll make sure that
+        /* In the interests of compatibility, I'll make sure that
          * the bit string has a 'not-used bits' value of 0
          */
         signature->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
@@ -138,8 +141,8 @@ int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
 err:
         memset(&ctx,0,sizeof(ctx));
         if (buf_in != NULL)
-                { memset((char *)buf_in,0,(unsigned int)inl); Free((char *)buf_in); }
+                { memset((char *)buf_in,0,(unsigned int)inl); Free(buf_in); }
         if (buf_out != NULL)
-                { memset((char *)buf_out,0,outll); Free((char *)buf_out); }
+                { memset((char *)buf_out,0,outll); Free(buf_out); }
         return(outl);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/a_strnid.c b/src/lib/libssl/src/crypto/asn1/a_strnid.c
new file mode 100644
index 0000000000..ab8417ffab
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/a_strnid.c
@@ -0,0 +1,247 @@
+/* a_strnid.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/objects.h>
+
+
+static STACK_OF(ASN1_STRING_TABLE) *stable = NULL;
+static void st_free(ASN1_STRING_TABLE *tbl);
+static int sk_table_cmp(ASN1_STRING_TABLE **a, ASN1_STRING_TABLE **b);
+static int table_cmp(ASN1_STRING_TABLE *a, ASN1_STRING_TABLE *b);
+
+
+/* This is the global mask for the mbstring functions: this is use to
+ * mask out certain types (such as BMPString and UTF8String) because
+ * certain software (e.g. Netscape) has problems with them.
+ */
+
+static unsigned long global_mask = 0xFFFFFFFFL;
+
+void ASN1_STRING_set_default_mask(unsigned long mask)
+{
+        global_mask = mask;
+}
+
+unsigned long ASN1_STRING_get_default_mask(void)
+{
+        return global_mask;
+}
+
+/* This function sets the default to various "flavours" of configuration.
+ * based on an ASCII string. Currently this is:
+ * MASK:XXXX : a numerical mask value.
+ * nobmp : Don't use BMPStrings (just Printable, T61).
+ * pkix : PKIX recommendation in RFC2459.
+ * utf8only : only use UTF8Strings (RFC2459 recommendation for 2004).
+ * default:   the default value, Printable, T61, BMP.
+ */
+
+int ASN1_STRING_set_default_mask_asc(char *p)
+{
+        unsigned long mask;
+        char *end;
+        if(!strncmp(p, "MASK:", 5)) {
+                if(!p[5]) return 0;
+                mask = strtoul(p + 5, &end, 0);
+                if(*end) return 0;
+        } else if(!strcmp(p, "nombstr"))
+                         mask = ~(B_ASN1_BMPSTRING|B_ASN1_UTF8STRING);
+        else if(!strcmp(p, "pkix"))
+                        mask = ~B_ASN1_T61STRING;
+        else if(!strcmp(p, "utf8only")) mask = B_ASN1_UTF8STRING;
+        else if(!strcmp(p, "default"))
+            mask = 0xFFFFFFFFL;
+        else return 0;
+        ASN1_STRING_set_default_mask(mask);
+        return 1;
+}
+
+/* The following function generates an ASN1_STRING based on limits in a table.
+ * Frequently the types and length of an ASN1_STRING are restricted by a 
+ * corresponding OID. For example certificates and certificate requests.
+ */
+
+ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, const unsigned char *in,
+                                        int inlen, int inform, int nid)
+{
+        ASN1_STRING_TABLE *tbl;
+        ASN1_STRING *str = NULL;
+        unsigned long mask;
+        int ret;
+        if(!out) out = &str;
+        tbl = ASN1_STRING_TABLE_get(nid);
+        if(tbl) {
+                mask = tbl->mask;
+                if(!(tbl->flags & STABLE_NO_MASK)) mask &= global_mask;
+                ret = ASN1_mbstring_ncopy(out, in, inlen, inform, tbl->mask,
+                                        tbl->minsize, tbl->maxsize);
+        } else ret = ASN1_mbstring_copy(out, in, inlen, inform, DIRSTRING_TYPE & global_mask);
+        if(ret <= 0) return NULL;
+        return *out;
+}
+
+/* Now the tables and helper functions for the string table:
+ */
+
+/* size limits: this stuff is taken straight from RFC2459 */
+
+#define ub_name                         32768
+#define ub_common_name                  64
+#define ub_locality_name                128
+#define ub_state_name                   128
+#define ub_organization_name            64
+#define ub_organization_unit_name       64
+#define ub_title                        64
+#define ub_email_address                128
+
+/* This table must be kept in NID order */
+
+static ASN1_STRING_TABLE tbl_standard[] = {
+{NID_commonName,                1, ub_common_name, DIRSTRING_TYPE, 0},
+{NID_countryName,               2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
+{NID_localityName,              1, ub_locality_name, DIRSTRING_TYPE, 0},
+{NID_stateOrProvinceName,       1, ub_state_name, DIRSTRING_TYPE, 0},
+{NID_organizationName,          1, ub_organization_name, DIRSTRING_TYPE, 0},
+{NID_organizationalUnitName,    1, ub_organization_unit_name, DIRSTRING_TYPE, 0},
+{NID_pkcs9_emailAddress,        1, ub_email_address, B_ASN1_IA5STRING, STABLE_NO_MASK},
+{NID_pkcs9_unstructuredName,    1, -1, PKCS9STRING_TYPE, 0},
+{NID_pkcs9_challengePassword,   1, -1, PKCS9STRING_TYPE, 0},
+{NID_pkcs9_unstructuredAddress, 1, -1, DIRSTRING_TYPE, 0},
+{NID_givenName,                 1, ub_name, DIRSTRING_TYPE, 0},
+{NID_surname,                   1, ub_name, DIRSTRING_TYPE, 0},
+{NID_initials,                  1, ub_name, DIRSTRING_TYPE, 0},
+{NID_name,                      1, ub_name, DIRSTRING_TYPE, 0},
+{NID_dnQualifier,               -1, -1, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK}
+};
+
+static int sk_table_cmp(ASN1_STRING_TABLE **a, ASN1_STRING_TABLE **b)
+{
+        return (*a)->nid - (*b)->nid;
+}
+
+static int table_cmp(ASN1_STRING_TABLE *a, ASN1_STRING_TABLE *b)
+{
+        return a->nid - b->nid;
+}
+
+ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid)
+{
+        int idx;
+        ASN1_STRING_TABLE *ttmp;
+        ASN1_STRING_TABLE fnd;
+        fnd.nid = nid;
+        ttmp = (ASN1_STRING_TABLE *) OBJ_bsearch((char *)&fnd,
+                                        (char *)tbl_standard, 
+                        sizeof(tbl_standard)/sizeof(ASN1_STRING_TABLE),
+                        sizeof(ASN1_STRING_TABLE), (int(*)())table_cmp);
+        if(ttmp) return ttmp;
+        if(!stable) return NULL;
+        idx = sk_ASN1_STRING_TABLE_find(stable, &fnd);
+        if(idx < 0) return NULL;
+        return sk_ASN1_STRING_TABLE_value(stable, idx);
+}
+        
+int ASN1_STRING_TABLE_add(int nid,
+                 long minsize, long maxsize, unsigned long mask,
+                                unsigned long flags)
+{
+        ASN1_STRING_TABLE *tmp;
+        char new_nid = 0;
+        flags &= ~STABLE_FLAGS_MALLOC;
+        if(!stable) stable = sk_ASN1_STRING_TABLE_new(sk_table_cmp);
+        if(!stable) {
+                ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        if(!(tmp = ASN1_STRING_TABLE_get(nid))) {
+                tmp = Malloc(sizeof(ASN1_STRING_TABLE));
+                if(!tmp) {
+                        ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD,
+                                                        ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                tmp->flags = flags | STABLE_FLAGS_MALLOC;
+                tmp->nid = nid;
+                new_nid = 1;
+        } else tmp->flags = (tmp->flags & STABLE_FLAGS_MALLOC) | flags;
+        if(minsize != -1) tmp->minsize = minsize;
+        if(maxsize != -1) tmp->maxsize = maxsize;
+        tmp->mask = mask;
+        if(new_nid) sk_ASN1_STRING_TABLE_push(stable, tmp);
+        return 1;
+}
+
+void ASN1_STRING_TABLE_cleanup(void)
+{
+        STACK_OF(ASN1_STRING_TABLE) *tmp;
+        tmp = stable;
+        if(!tmp) return;
+        stable = NULL;
+        sk_ASN1_STRING_TABLE_pop_free(tmp, st_free);
+}
+
+static void st_free(ASN1_STRING_TABLE *tbl)
+{
+        if(tbl->flags & STABLE_FLAGS_MALLOC) Free(tbl);
+}
+
+IMPLEMENT_STACK_OF(ASN1_STRING_TABLE)
diff --git a/src/lib/libssl/src/crypto/asn1/a_time.c b/src/lib/libssl/src/crypto/asn1/a_time.c
index c1690a5694..b193f1c71f 100644
--- a/src/lib/libssl/src/crypto/asn1/a_time.c
+++ b/src/lib/libssl/src/crypto/asn1/a_time.c
@@ -66,6 +66,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_TIME *ASN1_TIME_new(void)
+{ return M_ASN1_TIME_new(); }
+
+void ASN1_TIME_free(ASN1_TIME *x)
+{ M_ASN1_TIME_free(x); }
+
 int i2d_ASN1_TIME(ASN1_TIME *a, unsigned char **pp)
         {
 #ifdef CHARSET_EBCDIC
diff --git a/src/lib/libssl/src/crypto/asn1/a_type.c b/src/lib/libssl/src/crypto/asn1/a_type.c
index 3f2ecee5c2..161ef81197 100644
--- a/src/lib/libssl/src/crypto/asn1/a_type.c
+++ b/src/lib/libssl/src/crypto/asn1/a_type.c
@@ -282,7 +282,7 @@ void ASN1_TYPE_free(ASN1_TYPE *a)
         {
         if (a == NULL) return;
         ASN1_TYPE_component_free(a);
-        Free((char *)(char *)a);
+        Free(a);
         }
 
 int ASN1_TYPE_get(ASN1_TYPE *a)
diff --git a/src/lib/libssl/src/crypto/asn1/a_utctm.c b/src/lib/libssl/src/crypto/asn1/a_utctm.c
index 688199fdd2..07565974e3 100644
--- a/src/lib/libssl/src/crypto/asn1/a_utctm.c
+++ b/src/lib/libssl/src/crypto/asn1/a_utctm.c
@@ -66,6 +66,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_UTCTIME *ASN1_UTCTIME_new(void)
+{ return M_ASN1_UTCTIME_new(); }
+
+void ASN1_UTCTIME_free(ASN1_UTCTIME *x)
+{ M_ASN1_UTCTIME_free(x); }
+
 int i2d_ASN1_UTCTIME(ASN1_UTCTIME *a, unsigned char **pp)
         {
 #ifndef CHARSET_EBCDIC
@@ -109,7 +115,7 @@ ASN1_UTCTIME *d2i_ASN1_UTCTIME(ASN1_UTCTIME **a, unsigned char **pp,
         return(ret);
 err:
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_UTCTIME_free(ret);
+                M_ASN1_UTCTIME_free(ret);
         return(NULL);
         }
 
@@ -192,7 +198,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
 #endif
 
         if (s == NULL)
-                s=ASN1_UTCTIME_new();
+                s=M_ASN1_UTCTIME_new();
         if (s == NULL)
                 return(NULL);
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_utf8.c b/src/lib/libssl/src/crypto/asn1/a_utf8.c
index 4a8a92e9e4..b5125af224 100644
--- a/src/lib/libssl/src/crypto/asn1/a_utf8.c
+++ b/src/lib/libssl/src/crypto/asn1/a_utf8.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_UTF8STRING *ASN1_UTF8STRING_new(void)
+{ return M_ASN1_UTF8STRING_new();}
+
+void ASN1_UTF8STRING_free(ASN1_UTF8STRING *x)
+{ M_ASN1_UTF8STRING_free(x);}
+
 int i2d_ASN1_UTF8STRING(ASN1_UTF8STRING *a, unsigned char **pp)
         {
         return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
@@ -81,3 +87,152 @@ ASN1_UTF8STRING *d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a, unsigned char **pp,
         return(ret);
         }
 
+
+/* UTF8 utilities */
+
+/* This parses a UTF8 string one character at a time. It is passed a pointer
+ * to the string and the length of the string. It sets 'value' to the value of
+ * the current character. It returns the number of characters read or a
+ * negative error code:
+ * -1 = string too short
+ * -2 = illegal character
+ * -3 = subsequent characters not of the form 10xxxxxx
+ * -4 = character encoded incorrectly (not minimal length).
+ */
+
+int UTF8_getc(const unsigned char *str, int len, unsigned long *val)
+{
+        const unsigned char *p;
+        unsigned long value;
+        int ret;
+        if(len <= 0) return 0;
+        p = str;
+
+        /* Check syntax and work out the encoded value (if correct) */
+        if((*p & 0x80) == 0) {
+                value = *p++ & 0x7f;
+                ret = 1;
+        } else if((*p & 0xe0) == 0xc0) {
+                if(len < 2) return -1;
+                if((p[1] & 0xc0) != 0x80) return -3;
+                value = (*p++ & 0x1f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x80) return -4;
+                ret = 2;
+        } else if((*p & 0xf0) == 0xe0) {
+                if(len < 3) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0xf) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x800) return -4;
+                ret = 3;
+        } else if((*p & 0xf8) == 0xf0) {
+                if(len < 4) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x7) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x10000) return -4;
+                ret = 4;
+        } else if((*p & 0xfc) == 0xf8) {
+                if(len < 5) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) 
+                   || ((p[4] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x3) << 24;
+                value |= (*p++ & 0x3f) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x200000) return -4;
+                ret = 5;
+        } else if((*p & 0xfe) == 0xfc) {
+                if(len < 6) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) 
+                   || ((p[4] & 0xc0) != 0x80) 
+                   || ((p[5] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x1) << 30;
+                value |= (*p++ & 0x3f) << 24;
+                value |= (*p++ & 0x3f) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x4000000) return -4;
+                ret = 6;
+        } else return -2;
+        *val = value;
+        return ret;
+}
+
+/* This takes a character 'value' and writes the UTF8 encoded value in
+ * 'str' where 'str' is a buffer containing 'len' characters. Returns
+ * the number of characters written or -1 if 'len' is too small. 'str' can
+ * be set to NULL in which case it just returns the number of characters.
+ * It will need at most 6 characters.
+ */
+
+int UTF8_putc(unsigned char *str, int len, unsigned long value)
+{
+        if(!str) len = 6;       /* Maximum we will need */
+        else if(len <= 0) return -1;
+        if(value < 0x80) {
+                if(str) *str = (unsigned char)value;
+                return 1;
+        }
+        if(value < 0x800) {
+                if(len < 2) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 6) & 0x1f) | 0xc0);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 2;
+        }
+        if(value < 0x10000) {
+                if(len < 3) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 12) & 0xf) | 0xe0);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 3;
+        }
+        if(value < 0x200000) {
+                if(len < 4) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 18) & 0x7) | 0xf0);
+                        *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 4;
+        }
+        if(value < 0x4000000) {
+                if(len < 5) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 24) & 0x3) | 0xf8);
+                        *str++ = (unsigned char)(((value >> 18) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 5;
+        }
+        if(len < 6) return -1;
+        if(str) {
+                *str++ = (unsigned char)(((value >> 30) & 0x1) | 0xfc);
+                *str++ = (unsigned char)(((value >> 24) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 18) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                *str = (unsigned char)((value & 0x3f) | 0x80);
+        }
+        return 6;
+}
diff --git a/src/lib/libssl/src/crypto/asn1/a_verify.c b/src/lib/libssl/src/crypto/asn1/a_verify.c
index 6383d2c698..d4aede85c3 100644
--- a/src/lib/libssl/src/crypto/asn1/a_verify.c
+++ b/src/lib/libssl/src/crypto/asn1/a_verify.c
@@ -58,10 +58,13 @@
 
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
 #include <openssl/bn.h>
 #include <openssl/x509.h>
 #include <openssl/objects.h>
@@ -98,7 +101,7 @@ int ASN1_verify(int (*i2d)(), X509_ALGOR *a, ASN1_BIT_STRING *signature,
         EVP_VerifyUpdate(&ctx,(unsigned char *)buf_in,inl);
 
         memset(buf_in,0,(unsigned int)inl);
-        Free((char *)buf_in);
+        Free(buf_in);
 
         if (EVP_VerifyFinal(&ctx,(unsigned char *)signature->data,
                         (unsigned int)signature->length,pkey) <= 0)
diff --git a/src/lib/libssl/src/crypto/asn1/a_vis.c b/src/lib/libssl/src/crypto/asn1/a_vis.c
index 2072be780d..5cfc080bec 100644
--- a/src/lib/libssl/src/crypto/asn1/a_vis.c
+++ b/src/lib/libssl/src/crypto/asn1/a_vis.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_VISIBLESTRING *ASN1_VISIBLESTRING_new(void)
+{ return M_ASN1_VISIBLESTRING_new(); }
+
+void ASN1_VISIBLESTRING_free(ASN1_VISIBLESTRING *x)
+{ M_ASN1_VISIBLESTRING_free(x); }
+
 int i2d_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING *a, unsigned char **pp)
         {
         return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
diff --git a/src/lib/libssl/src/crypto/asn1/asn1.h b/src/lib/libssl/src/crypto/asn1/asn1.h
index 5c2d8999bc..99bd64a11e 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1.h
+++ b/src/lib/libssl/src/crypto/asn1/asn1.h
@@ -68,6 +68,10 @@ extern "C" {
 #include <openssl/stack.h>
 #include <openssl/safestack.h>
 
+#ifdef VMS
+#include <openssl/vms_idhacks.h>
+#endif
+
 #define V_ASN1_UNIVERSAL                0x00
 #define V_ASN1_APPLICATION              0x40
 #define V_ASN1_CONTEXT_SPECIFIC         0x80
@@ -77,7 +81,7 @@ extern "C" {
 #define V_ASN1_PRIMITIVE_TAG            0x1f
 #define V_ASN1_PRIMATIVE_TAG            0x1f
 
-#define V_ASN1_APP_CHOOSE               -2      /* let the recipent choose */
+#define V_ASN1_APP_CHOOSE               -2      /* let the recipient choose */
 
 #define V_ASN1_UNDEF                    -1
 #define V_ASN1_EOC                      0
@@ -129,6 +133,13 @@ extern "C" {
 #define B_ASN1_UNKNOWN          0x1000
 #define B_ASN1_UTF8STRING       0x2000
 
+/* For use with ASN1_mbstring_copy() */
+#define MBSTRING_FLAG           0x1000
+#define MBSTRING_ASC            (MBSTRING_FLAG|1)
+#define MBSTRING_BMP            (MBSTRING_FLAG|2)
+#define MBSTRING_UNIV           (MBSTRING_FLAG|3)
+#define MBSTRING_UTF8           (MBSTRING_FLAG|4)
+
 #define DECLARE_ASN1_SET_OF(type) \
 int i2d_ASN1_SET_OF_##type(STACK_OF(type) *a,unsigned char **pp, \
                            int (*func)(type *,unsigned char **), int ex_tag, \
@@ -165,7 +176,7 @@ typedef struct asn1_ctx_st
         int tag;        /* tag from last 'get object' */
         int xclass;     /* class from last 'get object' */
         long slen;      /* length of last 'get object' */
-        unsigned char *max; /* largest value of p alowed */
+        unsigned char *max; /* largest value of p allowed */
         unsigned char *q;/* temporary variable */
         unsigned char **pp;/* variable */
         int line;       /* used in error processing */
@@ -200,7 +211,34 @@ typedef struct asn1_string_st
         long flags;
         } ASN1_STRING;
 
-#ifndef DEBUG
+#define STABLE_FLAGS_MALLOC     0x01
+#define STABLE_NO_MASK          0x02
+#define DIRSTRING_TYPE  \
+ (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_BMPSTRING|B_ASN1_UTF8STRING)
+#define PKCS9STRING_TYPE (DIRSTRING_TYPE|B_ASN1_IA5STRING)
+
+typedef struct asn1_string_table_st {
+        int nid;
+        long minsize;
+        long maxsize;
+        unsigned long mask;
+        unsigned long flags;
+} ASN1_STRING_TABLE;
+
+DECLARE_STACK_OF(ASN1_STRING_TABLE)
+
+/* size limits: this stuff is taken straight from RFC2459 */
+
+#define ub_name                         32768
+#define ub_common_name                  64
+#define ub_locality_name                128
+#define ub_state_name                   128
+#define ub_organization_name            64
+#define ub_organization_unit_name       64
+#define ub_title                        64
+#define ub_email_address                128
+
+#ifdef NO_ASN1_TYPEDEFS
 #define ASN1_INTEGER            ASN1_STRING
 #define ASN1_ENUMERATED         ASN1_STRING
 #define ASN1_BIT_STRING         ASN1_STRING
@@ -234,6 +272,8 @@ typedef struct asn1_string_st ASN1_VISIBLESTRING;
 typedef struct asn1_string_st ASN1_UTF8STRING;
 #endif
 
+typedef int ASN1_NULL;
+
 typedef struct asn1_type_st
         {
         int type;
@@ -281,60 +321,58 @@ typedef struct asn1_header_st
         ASN1_METHOD *meth;
         } ASN1_HEADER;
 
-#define ASN1_STRING_length(x)   ((x)->length)
-#define ASN1_STRING_type(x)     ((x)->type)
-#define ASN1_STRING_data(x)     ((x)->data)
+/* This is used to contain a list of bit names */
+typedef struct BIT_STRING_BITNAME_st {
+        int bitnum;
+        const char *lname;
+        const char *sname;
+} BIT_STRING_BITNAME;
+
+
+#define M_ASN1_STRING_length(x) ((x)->length)
+#define M_ASN1_STRING_length_set(x, n)  ((x)->length = (n))
+#define M_ASN1_STRING_type(x)   ((x)->type)
+#define M_ASN1_STRING_data(x)   ((x)->data)
 
 /* Macros for string operations */
-#define ASN1_BIT_STRING_new()   (ASN1_BIT_STRING *)\
+#define M_ASN1_BIT_STRING_new() (ASN1_BIT_STRING *)\
                 ASN1_STRING_type_new(V_ASN1_BIT_STRING)
-#define ASN1_BIT_STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_BIT_STRING_dup(a) (ASN1_BIT_STRING *)\
+#define M_ASN1_BIT_STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_BIT_STRING_dup(a) (ASN1_BIT_STRING *)\
                 ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_BIT_STRING_cmp(a,b) ASN1_STRING_cmp(\
+#define M_ASN1_BIT_STRING_cmp(a,b) ASN1_STRING_cmp(\
                 (ASN1_STRING *)a,(ASN1_STRING *)b)
-#define ASN1_BIT_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
-/* i2d_ASN1_BIT_STRING() is a function */
-/* d2i_ASN1_BIT_STRING() is a function */
+#define M_ASN1_BIT_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
 
-#define ASN1_INTEGER_new()      (ASN1_INTEGER *)\
+#define M_ASN1_INTEGER_new()    (ASN1_INTEGER *)\
                 ASN1_STRING_type_new(V_ASN1_INTEGER)
-#define ASN1_INTEGER_free(a)            ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_INTEGER_dup(a) (ASN1_INTEGER *)ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_INTEGER_cmp(a,b)   ASN1_STRING_cmp(\
+#define M_ASN1_INTEGER_free(a)          ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_INTEGER_dup(a) (ASN1_INTEGER *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_INTEGER_cmp(a,b) ASN1_STRING_cmp(\
                 (ASN1_STRING *)a,(ASN1_STRING *)b)
-/* ASN1_INTEGER_set() is a function, also see BN_to_ASN1_INTEGER() */
-/* ASN1_INTEGER_get() is a function, also see ASN1_INTEGER_to_BN() */
-/* i2d_ASN1_INTEGER() is a function */
-/* d2i_ASN1_INTEGER() is a function */
 
-#define ASN1_ENUMERATED_new()   (ASN1_ENUMERATED *)\
+#define M_ASN1_ENUMERATED_new() (ASN1_ENUMERATED *)\
                 ASN1_STRING_type_new(V_ASN1_ENUMERATED)
-#define ASN1_ENUMERATED_free(a)         ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_ENUMERATED_dup(a) (ASN1_ENUMERATED *)ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_ENUMERATED_cmp(a,b)        ASN1_STRING_cmp(\
+#define M_ASN1_ENUMERATED_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_ENUMERATED_dup(a) (ASN1_ENUMERATED *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_ENUMERATED_cmp(a,b)      ASN1_STRING_cmp(\
                 (ASN1_STRING *)a,(ASN1_STRING *)b)
-/* ASN1_ENUMERATED_set() is a function, also see BN_to_ASN1_ENUMERATED() */
-/* ASN1_ENUMERATED_get() is a function, also see ASN1_ENUMERATED_to_BN() */
-/* i2d_ASN1_ENUMERATED() is a function */
-/* d2i_ASN1_ENUMERATED() is a function */
 
-#define ASN1_OCTET_STRING_new() (ASN1_OCTET_STRING *)\
+#define M_ASN1_OCTET_STRING_new()       (ASN1_OCTET_STRING *)\
                 ASN1_STRING_type_new(V_ASN1_OCTET_STRING)
-#define ASN1_OCTET_STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_OCTET_STRING_dup(a) (ASN1_OCTET_STRING *)\
+#define M_ASN1_OCTET_STRING_free(a)     ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_OCTET_STRING_dup(a) (ASN1_OCTET_STRING *)\
                 ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_OCTET_STRING_cmp(a,b) ASN1_STRING_cmp(\
+#define M_ASN1_OCTET_STRING_cmp(a,b) ASN1_STRING_cmp(\
                 (ASN1_STRING *)a,(ASN1_STRING *)b)
-#define ASN1_OCTET_STRING_set(a,b,c)    ASN1_STRING_set((ASN1_STRING *)a,b,c)
-#define ASN1_OCTET_STRING_print(a,b)    ASN1_STRING_print(a,(ASN1_STRING *)b)
+#define M_ASN1_OCTET_STRING_set(a,b,c)  ASN1_STRING_set((ASN1_STRING *)a,b,c)
+#define M_ASN1_OCTET_STRING_print(a,b)  ASN1_STRING_print(a,(ASN1_STRING *)b)
 #define M_i2d_ASN1_OCTET_STRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_OCTET_STRING,\
-                V_ASN1_OCTET_STRING)
-/* d2i_ASN1_OCTET_STRING() is a function */
+                V_ASN1_UNIVERSAL)
 
-#define ASN1_PRINTABLE_new()    ASN1_STRING_type_new(V_ASN1_T61STRING)
-#define ASN1_PRINTABLE_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_PRINTABLE_new()  ASN1_STRING_type_new(V_ASN1_T61STRING)
+#define M_ASN1_PRINTABLE_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_PRINTABLE(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                 pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_ASN1_PRINTABLE(a,pp,l) \
@@ -345,10 +383,11 @@ typedef struct asn1_header_st
                         B_ASN1_BIT_STRING| \
                         B_ASN1_UNIVERSALSTRING|\
                         B_ASN1_BMPSTRING|\
+                        B_ASN1_UTF8STRING|\
                         B_ASN1_UNKNOWN)
 
-#define DIRECTORYSTRING_new() ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
-#define DIRECTORYSTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_DIRECTORYSTRING_new() ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
+#define M_DIRECTORYSTRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_DIRECTORYSTRING(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                                                 pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_DIRECTORYSTRING(a,pp,l) \
@@ -359,8 +398,8 @@ typedef struct asn1_header_st
                         B_ASN1_UNIVERSALSTRING|\
                         B_ASN1_UTF8STRING)
 
-#define DISPLAYTEXT_new() ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
-#define DISPLAYTEXT_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_DISPLAYTEXT_new() ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
+#define M_DISPLAYTEXT_free(a) ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_DISPLAYTEXT(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                                                 pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_DISPLAYTEXT(a,pp,l) \
@@ -369,9 +408,9 @@ typedef struct asn1_header_st
                         B_ASN1_BMPSTRING|\
                         B_ASN1_UTF8STRING)
 
-#define ASN1_PRINTABLESTRING_new() (ASN1_PRINTABLESTRING *)\
+#define M_ASN1_PRINTABLESTRING_new() (ASN1_PRINTABLESTRING *)\
                 ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
-#define ASN1_PRINTABLESTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_PRINTABLESTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_PRINTABLESTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_PRINTABLESTRING,\
                 V_ASN1_UNIVERSAL)
@@ -379,9 +418,9 @@ typedef struct asn1_header_st
                 (ASN1_PRINTABLESTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_PRINTABLESTRING)
 
-#define ASN1_T61STRING_new()    (ASN1_T61STRING_STRING *)\
+#define M_ASN1_T61STRING_new()  (ASN1_T61STRING *)\
                 ASN1_STRING_type_new(V_ASN1_T61STRING)
-#define ASN1_T61STRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_T61STRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_T61STRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_T61STRING,\
                 V_ASN1_UNIVERSAL)
@@ -389,10 +428,10 @@ typedef struct asn1_header_st
                 (ASN1_T61STRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_T61STRING)
 
-#define ASN1_IA5STRING_new()    (ASN1_IA5STRING *)\
+#define M_ASN1_IA5STRING_new()  (ASN1_IA5STRING *)\
                 ASN1_STRING_type_new(V_ASN1_IA5STRING)
-#define ASN1_IA5STRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_IA5STRING_dup(a)   \
+#define M_ASN1_IA5STRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_IA5STRING_dup(a) \
                         (ASN1_IA5STRING *)ASN1_STRING_dup((ASN1_STRING *)a)
 #define M_i2d_ASN1_IA5STRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_IA5STRING,\
@@ -401,38 +440,25 @@ typedef struct asn1_header_st
                 (ASN1_IA5STRING *)d2i_ASN1_type_bytes((ASN1_STRING **)a,pp,l,\
                         B_ASN1_IA5STRING)
 
-#define ASN1_UTCTIME_new()      (ASN1_UTCTIME *)\
+#define M_ASN1_UTCTIME_new()    (ASN1_UTCTIME *)\
                 ASN1_STRING_type_new(V_ASN1_UTCTIME)
-#define ASN1_UTCTIME_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_UTCTIME_dup(a) (ASN1_UTCTIME *)ASN1_STRING_dup((ASN1_STRING *)a)
-/* i2d_ASN1_UTCTIME() is a function */
-/* d2i_ASN1_UTCTIME() is a function */
-/* ASN1_UTCTIME_set() is a function */
-/* ASN1_UTCTIME_check() is a function */
-
-#define ASN1_GENERALIZEDTIME_new()      (ASN1_GENERALIZEDTIME *)\
+#define M_ASN1_UTCTIME_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UTCTIME_dup(a) (ASN1_UTCTIME *)ASN1_STRING_dup((ASN1_STRING *)a)
+
+#define M_ASN1_GENERALIZEDTIME_new()    (ASN1_GENERALIZEDTIME *)\
                 ASN1_STRING_type_new(V_ASN1_GENERALIZEDTIME)
-#define ASN1_GENERALIZEDTIME_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_GENERALIZEDTIME_dup(a) (ASN1_GENERALIZEDTIME *)ASN1_STRING_dup(\
+#define M_ASN1_GENERALIZEDTIME_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_GENERALIZEDTIME_dup(a) (ASN1_GENERALIZEDTIME *)ASN1_STRING_dup(\
         (ASN1_STRING *)a)
-/* i2d_ASN1_GENERALIZEDTIME() is a function */
-/* d2i_ASN1_GENERALIZEDTIME() is a function */
-/* ASN1_GENERALIZEDTIME_set() is a function */
-/* ASN1_GENERALIZEDTIME_check() is a function */
 
-#define ASN1_TIME_new() (ASN1_TIME *)\
+#define M_ASN1_TIME_new()       (ASN1_TIME *)\
                 ASN1_STRING_type_new(V_ASN1_UTCTIME)
-#define ASN1_TIME_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_TIME_dup(a) (ASN1_TIME *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_TIME_free(a)     ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_TIME_dup(a) (ASN1_TIME *)ASN1_STRING_dup((ASN1_STRING *)a)
 
-/* i2d_ASN1_TIME() is a function */
-/* d2i_ASN1_TIME() is a function */
-/* ASN1_TIME_set() is a function */
-/* ASN1_TIME_check() is a function */
-
-#define ASN1_GENERALSTRING_new()        (ASN1_GENERALSTRING *)\
+#define M_ASN1_GENERALSTRING_new()      (ASN1_GENERALSTRING *)\
                 ASN1_STRING_type_new(V_ASN1_GENERALSTRING)
-#define ASN1_GENERALSTRING_free(a)      ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_GENERALSTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_GENERALSTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_GENERALSTRING,\
                         V_ASN1_UNIVERSAL)
@@ -440,9 +466,9 @@ typedef struct asn1_header_st
                 (ASN1_GENERALSTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_GENERALSTRING)
 
-#define ASN1_UNIVERSALSTRING_new()      (ASN1_UNIVERSALSTRING *)\
+#define M_ASN1_UNIVERSALSTRING_new()    (ASN1_UNIVERSALSTRING *)\
                 ASN1_STRING_type_new(V_ASN1_UNIVERSALSTRING)
-#define ASN1_UNIVERSALSTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UNIVERSALSTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_UNIVERSALSTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_UNIVERSALSTRING,\
                         V_ASN1_UNIVERSAL)
@@ -450,9 +476,9 @@ typedef struct asn1_header_st
                 (ASN1_UNIVERSALSTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_UNIVERSALSTRING)
 
-#define ASN1_BMPSTRING_new()    (ASN1_BMPSTRING *)\
+#define M_ASN1_BMPSTRING_new()  (ASN1_BMPSTRING *)\
                 ASN1_STRING_type_new(V_ASN1_BMPSTRING)
-#define ASN1_BMPSTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_BMPSTRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_BMPSTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_BMPSTRING,\
                         V_ASN1_UNIVERSAL)
@@ -460,9 +486,9 @@ typedef struct asn1_header_st
                 (ASN1_BMPSTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_BMPSTRING)
 
-#define ASN1_VISIBLESTRING_new()        (ASN1_VISIBLESTRING *)\
+#define M_ASN1_VISIBLESTRING_new()      (ASN1_VISIBLESTRING *)\
                 ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
-#define ASN1_VISIBLESTRING_free(a)      ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_VISIBLESTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_VISIBLESTRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_VISIBLESTRING,\
                         V_ASN1_UNIVERSAL)
@@ -470,9 +496,9 @@ typedef struct asn1_header_st
                 (ASN1_VISIBLESTRING *)d2i_ASN1_type_bytes\
                 ((ASN1_STRING **)a,pp,l,B_ASN1_VISIBLESTRING)
 
-#define ASN1_UTF8STRING_new()   (ASN1_UTF8STRING *)\
+#define M_ASN1_UTF8STRING_new() (ASN1_UTF8STRING *)\
                 ASN1_STRING_type_new(V_ASN1_UTF8STRING)
-#define ASN1_UTF8STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UTF8STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_UTF8STRING(a,pp) \
                 i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_UTF8STRING,\
                         V_ASN1_UNIVERSAL)
@@ -500,7 +526,7 @@ ASN1_OBJECT *	d2i_ASN1_OBJECT(ASN1_OBJECT **a,unsigned char **pp,
 DECLARE_STACK_OF(ASN1_OBJECT)
 DECLARE_ASN1_SET_OF(ASN1_OBJECT)
 
-ASN1_STRING *   ASN1_STRING_new(void );
+ASN1_STRING *   ASN1_STRING_new(void);
 void            ASN1_STRING_free(ASN1_STRING *a);
 ASN1_STRING *   ASN1_STRING_dup(ASN1_STRING *a);
 ASN1_STRING *   ASN1_STRING_type_new(int type );
@@ -508,23 +534,44 @@ int 		ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b);
   /* Since this is used to store all sorts of things, via macros, for now, make
      its data void * */
 int             ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
+int ASN1_STRING_length(ASN1_STRING *x);
+void ASN1_STRING_length_set(ASN1_STRING *x, int n);
+int ASN1_STRING_type(ASN1_STRING *x);
+unsigned char * ASN1_STRING_data(ASN1_STRING *x);
 
+ASN1_BIT_STRING *       ASN1_BIT_STRING_new(void);
+void            ASN1_BIT_STRING_free(ASN1_BIT_STRING *a);
 int             i2d_ASN1_BIT_STRING(ASN1_BIT_STRING *a,unsigned char **pp);
 ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,unsigned char **pp,
                         long length);
+int             ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d,
+                        int length );
 int             ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value);
 int             ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n);
 
+#ifdef HEADER_BIO_H
+int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
+                                BIT_STRING_BITNAME *tbl, int indent);
+#endif
+int ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl);
+int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
+                                BIT_STRING_BITNAME *tbl);
 
 int             i2d_ASN1_BOOLEAN(int a,unsigned char **pp);
 int             d2i_ASN1_BOOLEAN(int *a,unsigned char **pp,long length);
 
+ASN1_INTEGER *  ASN1_INTEGER_new(void);
+void            ASN1_INTEGER_free(ASN1_INTEGER *a);
 int             i2d_ASN1_INTEGER(ASN1_INTEGER *a,unsigned char **pp);
 ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a,unsigned char **pp,
                         long length);
 ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a,unsigned char **pp,
                         long length);
+ASN1_INTEGER *  ASN1_INTEGER_dup(ASN1_INTEGER *x);
+int ASN1_INTEGER_cmp(ASN1_INTEGER *x, ASN1_INTEGER *y);
 
+ASN1_ENUMERATED *       ASN1_ENUMERATED_new(void);
+void            ASN1_ENUMERATED_free(ASN1_ENUMERATED *a);
 int             i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a,unsigned char **pp);
 ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a,unsigned char **pp,
                         long length);
@@ -537,49 +584,88 @@ int ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *a);
 ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,time_t t);
 int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, char *str); 
 
+ASN1_OCTET_STRING *     ASN1_OCTET_STRING_new(void);
+void            ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *a);
 int             i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a,unsigned char **pp);
 ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,
                         unsigned char **pp,long length);
+ASN1_OCTET_STRING *     ASN1_OCTET_STRING_dup(ASN1_OCTET_STRING *a);
+int     ASN1_OCTET_STRING_cmp(ASN1_OCTET_STRING *a, ASN1_OCTET_STRING *b);
+int     ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, unsigned char *data, int len);
 
+ASN1_VISIBLESTRING *    ASN1_VISIBLESTRING_new(void);
+void            ASN1_VISIBLESTRING_free(ASN1_VISIBLESTRING *a);
 int     i2d_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING *a,unsigned char **pp);
 ASN1_VISIBLESTRING *d2i_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING **a,
                         unsigned char **pp,long length);
 
+ASN1_UTF8STRING *       ASN1_UTF8STRING_new(void);
+void            ASN1_UTF8STRING_free(ASN1_UTF8STRING *a);
 int             i2d_ASN1_UTF8STRING(ASN1_UTF8STRING *a,unsigned char **pp);
 ASN1_UTF8STRING *d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a,
                         unsigned char **pp,long length);
 
+ASN1_NULL *     ASN1_NULL_new(void);
+void            ASN1_NULL_free(ASN1_NULL *a);
+int             i2d_ASN1_NULL(ASN1_NULL *a,unsigned char **pp);
+ASN1_NULL *d2i_ASN1_NULL(ASN1_NULL **a, unsigned char **pp,long length);
+
+ASN1_BMPSTRING *        ASN1_BMPSTRING_new(void);
+void            ASN1_BMPSTRING_free(ASN1_BMPSTRING *a);
 int i2d_ASN1_BMPSTRING(ASN1_BMPSTRING *a, unsigned char **pp);
 ASN1_BMPSTRING *d2i_ASN1_BMPSTRING(ASN1_BMPSTRING **a, unsigned char **pp,
         long length);
 
+
+int UTF8_getc(const unsigned char *str, int len, unsigned long *val);
+int UTF8_putc(unsigned char *str, int len, unsigned long value);
+
 int i2d_ASN1_PRINTABLE(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_ASN1_PRINTABLE(ASN1_STRING **a,
         unsigned char **pp, long l);
+
+ASN1_PRINTABLESTRING *  ASN1_PRINTABLESTRING_new(void);
+void            ASN1_PRINTABLESTRING_free(ASN1_PRINTABLESTRING *a);
 ASN1_PRINTABLESTRING *d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a,
         unsigned char **pp, long l);
+int i2d_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING *a, unsigned char **pp);
 
+ASN1_STRING *   DIRECTORYSTRING_new(void);
+void            DIRECTORYSTRING_free(ASN1_STRING *a);
 int     i2d_DIRECTORYSTRING(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_DIRECTORYSTRING(ASN1_STRING **a, unsigned char **pp,
                                                                  long length);
 
+ASN1_STRING *   DISPLAYTEXT_new(void);
+void            DISPLAYTEXT_free(ASN1_STRING *a);
 int     i2d_DISPLAYTEXT(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_DISPLAYTEXT(ASN1_STRING **a, unsigned char **pp, long length);
 
+ASN1_T61STRING *        ASN1_T61STRING_new(void);
+void            ASN1_T61STRING_free(ASN1_IA5STRING *a);
 ASN1_T61STRING *d2i_ASN1_T61STRING(ASN1_T61STRING **a,
         unsigned char **pp, long l);
+
+ASN1_IA5STRING *        ASN1_IA5STRING_new(void);
+void            ASN1_IA5STRING_free(ASN1_IA5STRING *a);
 int i2d_ASN1_IA5STRING(ASN1_IA5STRING *a,unsigned char **pp);
 ASN1_IA5STRING *d2i_ASN1_IA5STRING(ASN1_IA5STRING **a,
         unsigned char **pp, long l);
 
+ASN1_UTCTIME *  ASN1_UTCTIME_new(void);
+void            ASN1_UTCTIME_free(ASN1_UTCTIME *a);
 int             i2d_ASN1_UTCTIME(ASN1_UTCTIME *a,unsigned char **pp);
 ASN1_UTCTIME *  d2i_ASN1_UTCTIME(ASN1_UTCTIME **a,unsigned char **pp,
                         long length);
 
+ASN1_GENERALIZEDTIME *  ASN1_GENERALIZEDTIME_new(void);
+void            ASN1_GENERALIZEDTIME_free(ASN1_GENERALIZEDTIME *a);
 int             i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a,unsigned char **pp);
 ASN1_GENERALIZEDTIME *  d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a,unsigned char **pp,
                         long length);
 
+ASN1_TIME *     ASN1_TIME_new(void);
+void            ASN1_TIME_free(ASN1_TIME *a);
 int             i2d_ASN1_TIME(ASN1_TIME *a,unsigned char **pp);
 ASN1_TIME *     d2i_ASN1_TIME(ASN1_TIME **a,unsigned char **pp, long length);
 ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s,time_t t);
@@ -654,6 +740,7 @@ int ASN1_TIME_print(BIO *fp,ASN1_TIME *a);
 int ASN1_STRING_print(BIO *bp,ASN1_STRING *v);
 int ASN1_parse(BIO *bp,unsigned char *pp,long len,int indent);
 #endif
+const char *ASN1_tag2str(int tag);
 
 /* Used to load and write netscape format cert/key */
 int i2d_ASN1_HEADER(ASN1_HEADER *a,unsigned char **pp);
@@ -687,6 +774,21 @@ unsigned char *ASN1_seq_pack(STACK *safes, int (*i2d)(), unsigned char **buf,
 void *ASN1_unpack_string(ASN1_STRING *oct, char *(*d2i)());
 ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 
+void ASN1_STRING_set_default_mask(unsigned long mask);
+int ASN1_STRING_set_default_mask_asc(char *p);
+unsigned long ASN1_STRING_get_default_mask(void);
+int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask);
+int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask, 
+                                        long minsize, long maxsize);
+
+ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, 
+                const unsigned char *in, int inlen, int inform, int nid);
+ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid);
+int ASN1_STRING_TABLE_add(int, long, long, unsigned long, unsigned long);
+void ASN1_STRING_TABLE_cleanup(void);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -699,6 +801,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_A2I_ASN1_ENUMERATED                       236
 #define ASN1_F_A2I_ASN1_INTEGER                          101
 #define ASN1_F_A2I_ASN1_STRING                           102
+#define ASN1_F_ACCESS_DESCRIPTION_NEW                    291
 #define ASN1_F_ASN1_COLLATE_PRIMITIVE                    103
 #define ASN1_F_ASN1_D2I_BIO                              104
 #define ASN1_F_ASN1_D2I_FP                               105
@@ -712,6 +815,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_ASN1_I2D_FP                               110
 #define ASN1_F_ASN1_INTEGER_SET                          111
 #define ASN1_F_ASN1_INTEGER_TO_BN                        112
+#define ASN1_F_ASN1_MBSTRING_COPY                        282
 #define ASN1_F_ASN1_OBJECT_NEW                           113
 #define ASN1_F_ASN1_PACK_STRING                          245
 #define ASN1_F_ASN1_PBE_SET                              253
@@ -719,6 +823,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_ASN1_SEQ_UNPACK                           247
 #define ASN1_F_ASN1_SIGN                                 114
 #define ASN1_F_ASN1_STRING_NEW                           115
+#define ASN1_F_ASN1_STRING_TABLE_ADD                     283
 #define ASN1_F_ASN1_STRING_TYPE_NEW                      116
 #define ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING             117
 #define ASN1_F_ASN1_TYPE_GET_OCTETSTRING                 118
@@ -730,6 +835,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_BASIC_CONSTRAINTS_NEW                     226
 #define ASN1_F_BN_TO_ASN1_ENUMERATED                     234
 #define ASN1_F_BN_TO_ASN1_INTEGER                        122
+#define ASN1_F_D2I_ACCESS_DESCRIPTION                    284
 #define ASN1_F_D2I_ASN1_BIT_STRING                       123
 #define ASN1_F_D2I_ASN1_BMPSTRING                        124
 #define ASN1_F_D2I_ASN1_BOOLEAN                          125
@@ -738,6 +844,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_ASN1_GENERALIZEDTIME                  223
 #define ASN1_F_D2I_ASN1_HEADER                           127
 #define ASN1_F_D2I_ASN1_INTEGER                          128
+#define ASN1_F_D2I_ASN1_NULL                             292
 #define ASN1_F_D2I_ASN1_OBJECT                           129
 #define ASN1_F_D2I_ASN1_OCTET_STRING                     130
 #define ASN1_F_D2I_ASN1_PRINT_TYPE                       131
@@ -765,6 +872,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_NETSCAPE_SPKAC                        143
 #define ASN1_F_D2I_NETSCAPE_SPKI                         144
 #define ASN1_F_D2I_NOTICEREF                             268
+#define ASN1_F_D2I_OTHERNAME                             287
 #define ASN1_F_D2I_PBE2PARAM                             262
 #define ASN1_F_D2I_PBEPARAM                              249
 #define ASN1_F_D2I_PBKDF2PARAM                           263
@@ -796,6 +904,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_X509                                  159
 #define ASN1_F_D2I_X509_ALGOR                            160
 #define ASN1_F_D2I_X509_ATTRIBUTE                        161
+#define ASN1_F_D2I_X509_CERT_AUX                         285
 #define ASN1_F_D2I_X509_CINF                             162
 #define ASN1_F_D2I_X509_CRL                              163
 #define ASN1_F_D2I_X509_CRL_INFO                         164
@@ -819,12 +928,14 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_I2D_DSAPARAMS                             178
 #define ASN1_F_I2D_DSAPRIVATEKEY                         179
 #define ASN1_F_I2D_DSAPUBLICKEY                          180
+#define ASN1_F_I2D_DSA_PUBKEY                            290
 #define ASN1_F_I2D_NETSCAPE_RSA                          181
 #define ASN1_F_I2D_PKCS7                                 182
 #define ASN1_F_I2D_PRIVATEKEY                            183
 #define ASN1_F_I2D_PUBLICKEY                             184
 #define ASN1_F_I2D_RSAPRIVATEKEY                         185
 #define ASN1_F_I2D_RSAPUBLICKEY                          186
+#define ASN1_F_I2D_RSA_PUBKEY                            289
 #define ASN1_F_I2D_X509_ATTRIBUTE                        187
 #define ASN1_F_I2T_ASN1_OBJECT                           188
 #define ASN1_F_NETSCAPE_CERT_SEQUENCE_NEW                229
@@ -832,6 +943,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_NETSCAPE_SPKAC_NEW                        190
 #define ASN1_F_NETSCAPE_SPKI_NEW                         191
 #define ASN1_F_NOTICEREF_NEW                             272
+#define ASN1_F_OTHERNAME_NEW                             288
 #define ASN1_F_PBE2PARAM_NEW                             264
 #define ASN1_F_PBEPARAM_NEW                              251
 #define ASN1_F_PBKDF2PARAM_NEW                           265
@@ -859,6 +971,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_USERNOTICE_NEW                            275
 #define ASN1_F_X509_ALGOR_NEW                            202
 #define ASN1_F_X509_ATTRIBUTE_NEW                        203
+#define ASN1_F_X509_CERT_AUX_NEW                         286
 #define ASN1_F_X509_CINF_NEW                             204
 #define ASN1_F_X509_CRL_INFO_NEW                         205
 #define ASN1_F_X509_CRL_NEW                              206
@@ -889,6 +1002,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_BN_LIB                                    107
 #define ASN1_R_BOOLEAN_IS_WRONG_LENGTH                   108
 #define ASN1_R_BUFFER_TOO_SMALL                          109
+#define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER           166
 #define ASN1_R_DATA_IS_WRONG                             110
 #define ASN1_R_DECODE_ERROR                              155
 #define ASN1_R_DECODING_ERROR                            111
@@ -902,24 +1016,31 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_EXPECTING_A_BIT_STRING                    116
 #define ASN1_R_EXPECTING_A_BOOLEAN                       117
 #define ASN1_R_EXPECTING_A_GENERALIZEDTIME               151
+#define ASN1_R_EXPECTING_A_NULL                          164
 #define ASN1_R_EXPECTING_A_TIME                          152
 #define ASN1_R_EXPECTING_A_UTCTIME                       118
 #define ASN1_R_FIRST_NUM_TOO_LARGE                       119
 #define ASN1_R_GENERALIZEDTIME_TOO_LONG                  153
 #define ASN1_R_HEADER_TOO_LONG                           120
+#define ASN1_R_ILLEGAL_CHARACTERS                        158
+#define ASN1_R_INVALID_BMPSTRING_LENGTH                  159
 #define ASN1_R_INVALID_DIGIT                             121
 #define ASN1_R_INVALID_SEPARATOR                         122
 #define ASN1_R_INVALID_TIME_FORMAT                       123
+#define ASN1_R_INVALID_UNIVERSALSTRING_LENGTH            160
+#define ASN1_R_INVALID_UTF8STRING                        161
 #define ASN1_R_IV_TOO_LARGE                              124
 #define ASN1_R_LENGTH_ERROR                              125
 #define ASN1_R_MISSING_SECOND_NUMBER                     126
 #define ASN1_R_NON_HEX_CHARACTERS                        127
 #define ASN1_R_NOT_ENOUGH_DATA                           128
+#define ASN1_R_NULL_IS_WRONG_LENGTH                      165
 #define ASN1_R_ODD_NUMBER_OF_CHARS                       129
 #define ASN1_R_PARSING                                   130
 #define ASN1_R_PRIVATE_KEY_HEADER_MISSING                131
 #define ASN1_R_SECOND_NUMBER_TOO_LARGE                   132
 #define ASN1_R_SHORT_LINE                                133
+#define ASN1_R_STRING_TOO_LONG                           163
 #define ASN1_R_STRING_TOO_SHORT                          134
 #define ASN1_R_TAG_VALUE_TOO_HIGH                        135
 #define ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 136
@@ -927,6 +1048,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_UNABLE_TO_DECODE_RSA_KEY                  138
 #define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY          139
 #define ASN1_R_UNKNOWN_ATTRIBUTE_TYPE                    140
+#define ASN1_R_UNKNOWN_FORMAT                            162
 #define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM          141
 #define ASN1_R_UNKNOWN_OBJECT_TYPE                       142
 #define ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE                   143
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_err.c b/src/lib/libssl/src/crypto/asn1/asn1_err.c
index 16755a0b05..b183814242 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_err.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_err.c
@@ -69,19 +69,21 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_A2I_ASN1_ENUMERATED,0),      "a2i_ASN1_ENUMERATED"},
 {ERR_PACK(0,ASN1_F_A2I_ASN1_INTEGER,0), "a2i_ASN1_INTEGER"},
 {ERR_PACK(0,ASN1_F_A2I_ASN1_STRING,0),  "a2i_ASN1_STRING"},
+{ERR_PACK(0,ASN1_F_ACCESS_DESCRIPTION_NEW,0),   "ACCESS_DESCRIPTION_new"},
 {ERR_PACK(0,ASN1_F_ASN1_COLLATE_PRIMITIVE,0),   "ASN1_COLLATE_PRIMITIVE"},
 {ERR_PACK(0,ASN1_F_ASN1_D2I_BIO,0),     "ASN1_d2i_bio"},
 {ERR_PACK(0,ASN1_F_ASN1_D2I_FP,0),      "ASN1_d2i_fp"},
 {ERR_PACK(0,ASN1_F_ASN1_DUP,0), "ASN1_dup"},
 {ERR_PACK(0,ASN1_F_ASN1_ENUMERATED_SET,0),      "ASN1_ENUMERATED_set"},
 {ERR_PACK(0,ASN1_F_ASN1_ENUMERATED_TO_BN,0),    "ASN1_ENUMERATED_to_BN"},
-{ERR_PACK(0,ASN1_F_ASN1_GENERALIZEDTIME_NEW,0), "ASN1_GENERALIZEDTIME_NEW"},
+{ERR_PACK(0,ASN1_F_ASN1_GENERALIZEDTIME_NEW,0), "ASN1_GENERALIZEDTIME_new"},
 {ERR_PACK(0,ASN1_F_ASN1_GET_OBJECT,0),  "ASN1_get_object"},
 {ERR_PACK(0,ASN1_F_ASN1_HEADER_NEW,0),  "ASN1_HEADER_new"},
 {ERR_PACK(0,ASN1_F_ASN1_I2D_BIO,0),     "ASN1_i2d_bio"},
 {ERR_PACK(0,ASN1_F_ASN1_I2D_FP,0),      "ASN1_i2d_fp"},
 {ERR_PACK(0,ASN1_F_ASN1_INTEGER_SET,0), "ASN1_INTEGER_set"},
 {ERR_PACK(0,ASN1_F_ASN1_INTEGER_TO_BN,0),       "ASN1_INTEGER_to_BN"},
+{ERR_PACK(0,ASN1_F_ASN1_MBSTRING_COPY,0),       "ASN1_mbstring_copy"},
 {ERR_PACK(0,ASN1_F_ASN1_OBJECT_NEW,0),  "ASN1_OBJECT_new"},
 {ERR_PACK(0,ASN1_F_ASN1_PACK_STRING,0), "ASN1_pack_string"},
 {ERR_PACK(0,ASN1_F_ASN1_PBE_SET,0),     "ASN1_PBE_SET"},
@@ -89,17 +91,19 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_ASN1_SEQ_UNPACK,0),  "ASN1_seq_unpack"},
 {ERR_PACK(0,ASN1_F_ASN1_SIGN,0),        "ASN1_sign"},
 {ERR_PACK(0,ASN1_F_ASN1_STRING_NEW,0),  "ASN1_STRING_new"},
+{ERR_PACK(0,ASN1_F_ASN1_STRING_TABLE_ADD,0),    "ASN1_STRING_TABLE_add"},
 {ERR_PACK(0,ASN1_F_ASN1_STRING_TYPE_NEW,0),     "ASN1_STRING_type_new"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING,0),    "ASN1_TYPE_get_int_octetstring"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_GET_OCTETSTRING,0),        "ASN1_TYPE_get_octetstring"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_NEW,0),    "ASN1_TYPE_new"},
 {ERR_PACK(0,ASN1_F_ASN1_UNPACK_STRING,0),       "ASN1_unpack_string"},
-{ERR_PACK(0,ASN1_F_ASN1_UTCTIME_NEW,0), "ASN1_UTCTIME_NEW"},
+{ERR_PACK(0,ASN1_F_ASN1_UTCTIME_NEW,0), "ASN1_UTCTIME_new"},
 {ERR_PACK(0,ASN1_F_ASN1_VERIFY,0),      "ASN1_verify"},
 {ERR_PACK(0,ASN1_F_AUTHORITY_KEYID_NEW,0),      "AUTHORITY_KEYID_new"},
 {ERR_PACK(0,ASN1_F_BASIC_CONSTRAINTS_NEW,0),    "BASIC_CONSTRAINTS_new"},
 {ERR_PACK(0,ASN1_F_BN_TO_ASN1_ENUMERATED,0),    "BN_to_ASN1_ENUMERATED"},
 {ERR_PACK(0,ASN1_F_BN_TO_ASN1_INTEGER,0),       "BN_to_ASN1_INTEGER"},
+{ERR_PACK(0,ASN1_F_D2I_ACCESS_DESCRIPTION,0),   "d2i_ACCESS_DESCRIPTION"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BIT_STRING,0),      "d2i_ASN1_BIT_STRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BMPSTRING,0),       "d2i_ASN1_BMPSTRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BOOLEAN,0), "d2i_ASN1_BOOLEAN"},
@@ -108,6 +112,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_ASN1_GENERALIZEDTIME,0), "d2i_ASN1_GENERALIZEDTIME"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_HEADER,0),  "d2i_ASN1_HEADER"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_INTEGER,0), "d2i_ASN1_INTEGER"},
+{ERR_PACK(0,ASN1_F_D2I_ASN1_NULL,0),    "d2i_ASN1_NULL"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_OBJECT,0),  "d2i_ASN1_OBJECT"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_OCTET_STRING,0),    "d2i_ASN1_OCTET_STRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_PRINT_TYPE,0),      "D2I_ASN1_PRINT_TYPE"},
@@ -135,6 +140,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_NETSCAPE_SPKAC,0),       "d2i_NETSCAPE_SPKAC"},
 {ERR_PACK(0,ASN1_F_D2I_NETSCAPE_SPKI,0),        "d2i_NETSCAPE_SPKI"},
 {ERR_PACK(0,ASN1_F_D2I_NOTICEREF,0),    "d2i_NOTICEREF"},
+{ERR_PACK(0,ASN1_F_D2I_OTHERNAME,0),    "d2i_OTHERNAME"},
 {ERR_PACK(0,ASN1_F_D2I_PBE2PARAM,0),    "d2i_PBE2PARAM"},
 {ERR_PACK(0,ASN1_F_D2I_PBEPARAM,0),     "d2i_PBEPARAM"},
 {ERR_PACK(0,ASN1_F_D2I_PBKDF2PARAM,0),  "d2i_PBKDF2PARAM"},
@@ -166,6 +172,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_X509,0), "d2i_X509"},
 {ERR_PACK(0,ASN1_F_D2I_X509_ALGOR,0),   "d2i_X509_ALGOR"},
 {ERR_PACK(0,ASN1_F_D2I_X509_ATTRIBUTE,0),       "d2i_X509_ATTRIBUTE"},
+{ERR_PACK(0,ASN1_F_D2I_X509_CERT_AUX,0),        "d2i_X509_CERT_AUX"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CINF,0),    "d2i_X509_CINF"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CRL,0),     "d2i_X509_CRL"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CRL_INFO,0),        "d2i_X509_CRL_INFO"},
@@ -189,12 +196,14 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_I2D_DSAPARAMS,0),    "i2d_DSAparams"},
 {ERR_PACK(0,ASN1_F_I2D_DSAPRIVATEKEY,0),        "i2d_DSAPrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_DSAPUBLICKEY,0), "i2d_DSAPublicKey"},
+{ERR_PACK(0,ASN1_F_I2D_DSA_PUBKEY,0),   "i2d_DSA_PUBKEY"},
 {ERR_PACK(0,ASN1_F_I2D_NETSCAPE_RSA,0), "i2d_Netscape_RSA"},
 {ERR_PACK(0,ASN1_F_I2D_PKCS7,0),        "i2d_PKCS7"},
 {ERR_PACK(0,ASN1_F_I2D_PRIVATEKEY,0),   "i2d_PrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_PUBLICKEY,0),    "i2d_PublicKey"},
 {ERR_PACK(0,ASN1_F_I2D_RSAPRIVATEKEY,0),        "i2d_RSAPrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_RSAPUBLICKEY,0), "i2d_RSAPublicKey"},
+{ERR_PACK(0,ASN1_F_I2D_RSA_PUBKEY,0),   "i2d_RSA_PUBKEY"},
 {ERR_PACK(0,ASN1_F_I2D_X509_ATTRIBUTE,0),       "i2d_X509_ATTRIBUTE"},
 {ERR_PACK(0,ASN1_F_I2T_ASN1_OBJECT,0),  "i2t_ASN1_OBJECT"},
 {ERR_PACK(0,ASN1_F_NETSCAPE_CERT_SEQUENCE_NEW,0),       "NETSCAPE_CERT_SEQUENCE_new"},
@@ -202,6 +211,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_NETSCAPE_SPKAC_NEW,0),       "NETSCAPE_SPKAC_new"},
 {ERR_PACK(0,ASN1_F_NETSCAPE_SPKI_NEW,0),        "NETSCAPE_SPKI_new"},
 {ERR_PACK(0,ASN1_F_NOTICEREF_NEW,0),    "NOTICEREF_new"},
+{ERR_PACK(0,ASN1_F_OTHERNAME_NEW,0),    "OTHERNAME_new"},
 {ERR_PACK(0,ASN1_F_PBE2PARAM_NEW,0),    "PBE2PARAM_new"},
 {ERR_PACK(0,ASN1_F_PBEPARAM_NEW,0),     "PBEPARAM_new"},
 {ERR_PACK(0,ASN1_F_PBKDF2PARAM_NEW,0),  "PBKDF2PARAM_new"},
@@ -229,6 +239,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_USERNOTICE_NEW,0),   "USERNOTICE_new"},
 {ERR_PACK(0,ASN1_F_X509_ALGOR_NEW,0),   "X509_ALGOR_new"},
 {ERR_PACK(0,ASN1_F_X509_ATTRIBUTE_NEW,0),       "X509_ATTRIBUTE_new"},
+{ERR_PACK(0,ASN1_F_X509_CERT_AUX_NEW,0),        "X509_CERT_AUX_new"},
 {ERR_PACK(0,ASN1_F_X509_CINF_NEW,0),    "X509_CINF_new"},
 {ERR_PACK(0,ASN1_F_X509_CRL_INFO_NEW,0),        "X509_CRL_INFO_new"},
 {ERR_PACK(0,ASN1_F_X509_CRL_NEW,0),     "X509_CRL_new"},
@@ -262,6 +273,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_BN_LIB                           ,"bn lib"},
 {ASN1_R_BOOLEAN_IS_WRONG_LENGTH          ,"boolean is wrong length"},
 {ASN1_R_BUFFER_TOO_SMALL                 ,"buffer too small"},
+{ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER  ,"cipher has no object identifier"},
 {ASN1_R_DATA_IS_WRONG                    ,"data is wrong"},
 {ASN1_R_DECODE_ERROR                     ,"decode error"},
 {ASN1_R_DECODING_ERROR                   ,"decoding error"},
@@ -275,24 +287,31 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_EXPECTING_A_BIT_STRING           ,"expecting a bit string"},
 {ASN1_R_EXPECTING_A_BOOLEAN              ,"expecting a boolean"},
 {ASN1_R_EXPECTING_A_GENERALIZEDTIME      ,"expecting a generalizedtime"},
+{ASN1_R_EXPECTING_A_NULL                 ,"expecting a null"},
 {ASN1_R_EXPECTING_A_TIME                 ,"expecting a time"},
 {ASN1_R_EXPECTING_A_UTCTIME              ,"expecting a utctime"},
 {ASN1_R_FIRST_NUM_TOO_LARGE              ,"first num too large"},
 {ASN1_R_GENERALIZEDTIME_TOO_LONG         ,"generalizedtime too long"},
 {ASN1_R_HEADER_TOO_LONG                  ,"header too long"},
+{ASN1_R_ILLEGAL_CHARACTERS               ,"illegal characters"},
+{ASN1_R_INVALID_BMPSTRING_LENGTH         ,"invalid bmpstring length"},
 {ASN1_R_INVALID_DIGIT                    ,"invalid digit"},
 {ASN1_R_INVALID_SEPARATOR                ,"invalid separator"},
 {ASN1_R_INVALID_TIME_FORMAT              ,"invalid time format"},
+{ASN1_R_INVALID_UNIVERSALSTRING_LENGTH   ,"invalid universalstring length"},
+{ASN1_R_INVALID_UTF8STRING               ,"invalid utf8string"},
 {ASN1_R_IV_TOO_LARGE                     ,"iv too large"},
 {ASN1_R_LENGTH_ERROR                     ,"length error"},
 {ASN1_R_MISSING_SECOND_NUMBER            ,"missing second number"},
 {ASN1_R_NON_HEX_CHARACTERS               ,"non hex characters"},
 {ASN1_R_NOT_ENOUGH_DATA                  ,"not enough data"},
+{ASN1_R_NULL_IS_WRONG_LENGTH             ,"null is wrong length"},
 {ASN1_R_ODD_NUMBER_OF_CHARS              ,"odd number of chars"},
 {ASN1_R_PARSING                          ,"parsing"},
 {ASN1_R_PRIVATE_KEY_HEADER_MISSING       ,"private key header missing"},
 {ASN1_R_SECOND_NUMBER_TOO_LARGE          ,"second number too large"},
 {ASN1_R_SHORT_LINE                       ,"short line"},
+{ASN1_R_STRING_TOO_LONG                  ,"string too long"},
 {ASN1_R_STRING_TOO_SHORT                 ,"string too short"},
 {ASN1_R_TAG_VALUE_TOO_HIGH               ,"tag value too high"},
 {ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD,"the asn1 object identifier is not known for this md"},
@@ -300,6 +319,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_UNABLE_TO_DECODE_RSA_KEY         ,"unable to decode rsa key"},
 {ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY ,"unable to decode rsa private key"},
 {ASN1_R_UNKNOWN_ATTRIBUTE_TYPE           ,"unknown attribute type"},
+{ASN1_R_UNKNOWN_FORMAT                   ,"unknown format"},
 {ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM ,"unknown message digest algorithm"},
 {ASN1_R_UNKNOWN_OBJECT_TYPE              ,"unknown object type"},
 {ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE          ,"unknown public key type"},
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_lib.c b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
index 95e54ed626..be8daa8688 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_lib.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
@@ -176,7 +176,7 @@ static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
         }
 
 /* class 0 is constructed
- * constructed == 2 for indefinitle length constructed */
+ * constructed == 2 for indefinite length constructed */
 void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
              int xclass)
         {
@@ -349,7 +349,7 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
         if (data != NULL)
                 {
                 memcpy(str->data,data,len);
-                /* an alowance for strings :-) */
+                /* an allowance for strings :-) */
                 str->data[len]='\0';
                 }
         return(1);
@@ -381,8 +381,8 @@ ASN1_STRING *ASN1_STRING_type_new(int type)
 void ASN1_STRING_free(ASN1_STRING *a)
         {
         if (a == NULL) return;
-        if (a->data != NULL) Free((char *)a->data);
-        Free((char *)a);
+        if (a->data != NULL) Free(a->data);
+        Free(a);
         }
 
 int ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b)
@@ -411,3 +411,14 @@ void asn1_add_error(unsigned char *address, int offset)
         ERR_add_error_data(4,"address=",buf1," offset=",buf2);
         }
 
+int ASN1_STRING_length(ASN1_STRING *x)
+{ return M_ASN1_STRING_length(x); }
+
+void ASN1_STRING_length_set(ASN1_STRING *x, int len)
+{ M_ASN1_STRING_length_set(x, len); return; }
+
+int ASN1_STRING_type(ASN1_STRING *x)
+{ return M_ASN1_STRING_type(x); }
+
+unsigned char * ASN1_STRING_data(ASN1_STRING *x)
+{ return M_ASN1_STRING_data(x); }
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_mac.h b/src/lib/libssl/src/crypto/asn1/asn1_mac.h
index 93f9c5193c..4f2a82d340 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_mac.h
+++ b/src/lib/libssl/src/crypto/asn1/asn1_mac.h
@@ -106,6 +106,20 @@ err:\
 #define M_ASN1_D2I_start_sequence() \
         if (!asn1_GetSequence(&c,&length)) \
                 { c.line=__LINE__; goto err; }
+/* Begin reading ASN1 without a surrounding sequence */
+#define M_ASN1_D2I_begin() \
+        c.slen = length;
+
+/* End reading ASN1 with no check on length */
+#define M_ASN1_D2I_Finish_nolen(a, func, e) \
+        *pp=c.p; \
+        if (a != NULL) (*a)=ret; \
+        return(ret); \
+err:\
+        ASN1_MAC_H_err((e),c.error,c.line); \
+        asn1_add_error(*pp,(int)(c.q- *pp)); \
+        if ((ret != NULL) && ((a == NULL) || (*a != ret))) func(ret); \
+        return(NULL)
 
 #define M_ASN1_D2I_end_sequence() \
         (((c.inf&1) == 0)?(c.slen <= 0): \
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_par.c b/src/lib/libssl/src/crypto/asn1/asn1_par.c
index 86886606ef..d1e9816bad 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_par.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_par.c
@@ -93,55 +93,8 @@ static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
                 sprintf(str,"cont [ %d ]",tag);
         else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
                 sprintf(str,"appl [ %d ]",tag);
-        else if ((tag == V_ASN1_EOC) /* && (xclass == V_ASN1_UNIVERSAL) */)
-                p="EOC";
-        else if (tag == V_ASN1_BOOLEAN)
-                p="BOOLEAN";
-        else if (tag == V_ASN1_INTEGER)
-                p="INTEGER";
-        else if (tag == V_ASN1_ENUMERATED)
-                p="ENUMERATED";
-        else if (tag == V_ASN1_BIT_STRING)
-                p="BIT STRING";
-        else if (tag == V_ASN1_OCTET_STRING)
-                p="OCTET STRING";
-        else if (tag == V_ASN1_NULL)
-                p="NULL";
-        else if (tag == V_ASN1_OBJECT)
-                p="OBJECT";
-        else if (tag == V_ASN1_SEQUENCE)
-                p="SEQUENCE";
-        else if (tag == V_ASN1_SET)
-                p="SET";
-        else if (tag == V_ASN1_PRINTABLESTRING)
-                p="PRINTABLESTRING";
-        else if (tag == V_ASN1_T61STRING)
-                p="T61STRING";
-        else if (tag == V_ASN1_IA5STRING)
-                p="IA5STRING";
-        else if (tag == V_ASN1_UTCTIME)
-                p="UTCTIME";
+        else p = ASN1_tag2str(tag);
 
-        /* extras */
-        else if (tag == V_ASN1_NUMERICSTRING)
-                p="NUMERICSTRING";
-        else if (tag == V_ASN1_VIDEOTEXSTRING)
-                p="VIDEOTEXSTRING";
-        else if (tag == V_ASN1_GENERALIZEDTIME)
-                p="GENERALIZEDTIME";
-        else if (tag == V_ASN1_GRAPHICSTRING)
-                p="GRAPHICSTRING";
-        else if (tag == V_ASN1_VISIBLESTRING)
-                p="VISIBLESTRING";
-        else if (tag == V_ASN1_GENERALSTRING)
-                p="GENERALSTRING";
-        else if (tag == V_ASN1_UNIVERSALSTRING)
-                p="UNIVERSALSTRING";
-        else if (tag == V_ASN1_BMPSTRING)
-                p="BMPSTRING";
-        else
-                p2="(unknown)";
-                
         if (p2 != NULL)
                 {
                 if (BIO_printf(bp,fmt2,tag,p2) <= 0) goto err;
@@ -320,7 +273,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                                         os->length) <= 0)
                                                         goto end;
                                                 }
-                                        ASN1_OCTET_STRING_free(os);
+                                        M_ASN1_OCTET_STRING_free(os);
                                         os=NULL;
                                         }
                                 }
@@ -354,7 +307,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                         if (BIO_write(bp,"BAD INTEGER",11) <= 0)
                                                 goto end;
                                         }
-                                ASN1_INTEGER_free(bs);
+                                M_ASN1_INTEGER_free(bs);
                                 }
                         else if (tag == V_ASN1_ENUMERATED)
                                 {
@@ -386,7 +339,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                         if (BIO_write(bp,"BAD ENUMERATED",11) <= 0)
                                                 goto end;
                                         }
-                                ASN1_ENUMERATED_free(bs);
+                                M_ASN1_ENUMERATED_free(bs);
                                 }
 
                         if (!nl) 
@@ -405,7 +358,28 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
         ret=1;
 end:
         if (o != NULL) ASN1_OBJECT_free(o);
-        if (os != NULL) ASN1_OCTET_STRING_free(os);
+        if (os != NULL) M_ASN1_OCTET_STRING_free(os);
         *pp=p;
         return(ret);
         }
+
+const char *ASN1_tag2str(int tag)
+{
+        const static char *tag2str[] = {
+         "EOC", "BOOLEAN", "INTEGER", "BIT STRING", "OCTET STRING", /* 0-4 */
+         "NULL", "OBJECT", "OBJECT DESCRIPTOR", "EXTERNAL", "REAL", /* 5-9 */
+         "ENUMERATED", "<ASN1 11>", "UTF8STRING", "<ASN1 13>",      /* 10-13 */
+        "<ASN1 14>", "<ASN1 15>", "SEQUENCE", "SET",                /* 15-17 */
+        "NUMERICSTRING", "PRINTABLESTRING", "T61STRING",            /* 18-20 */
+        "VIDEOTEXSTRING", "IA5STRING", "UTCTIME","GENERALIZEDTIME", /* 21-24 */
+        "GRAPHICSTRING", "VISIBLESTRING", "GENERALSTRING",          /* 25-27 */
+        "UNIVERSALSTRING", "<ASN1 29>", "BMPSTRING"                 /* 28-30 */
+        };
+
+        if((tag == V_ASN1_NEG_INTEGER) || (tag == V_ASN1_NEG_ENUMERATED))
+                                                        tag &= ~0x100;
+
+        if(tag < 0 || tag > 30) return "(unknown)";
+        return tag2str[tag];
+}
+
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_dhp.c b/src/lib/libssl/src/crypto/asn1/d2i_dhp.c
index a077211a4c..635ae829db 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_dhp.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_dhp.c
@@ -86,7 +86,7 @@ DH *d2i_DHparams(DH **a, unsigned char **pp, long length)
                 ret->length=(int)v;
                 }
 
-        ASN1_BIT_STRING_free(bs);
+        M_ASN1_BIT_STRING_free(bs);
 
         M_ASN1_D2I_Finish_2(a);
 
@@ -95,7 +95,7 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_DHPARAMS,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DH_free(ret);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
+        if (bs != NULL) M_ASN1_BIT_STRING_free(bs);
         return(NULL);
         }
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_dsap.c b/src/lib/libssl/src/crypto/asn1/d2i_dsap.c
index cdd7136f51..6d1c297133 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_dsap.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_dsap.c
@@ -83,7 +83,7 @@ DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
         M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
         if ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;
 
-        ASN1_BIT_STRING_free(bs);
+        M_ASN1_BIT_STRING_free(bs);
 
         M_ASN1_D2I_Finish_2(a);
 
@@ -92,7 +92,7 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_DSAPARAMS,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
+        if (bs != NULL) M_ASN1_BIT_STRING_free(bs);
         return(NULL);
         }
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_pr.c b/src/lib/libssl/src/crypto/asn1/d2i_pr.c
index f3d1aa6240..c92b8325d8 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_pr.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_pr.c
@@ -112,3 +112,26 @@ err:
         return(NULL);
         }
 
+/* This works like d2i_PrivateKey() except it automatically works out the type */
+
+EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, unsigned char **pp,
+             long length)
+{
+        STACK_OF(ASN1_TYPE) *inkey;
+        unsigned char *p;
+        int keytype;
+        p = *pp;
+        /* Dirty trick: read in the ASN1 data into a STACK_OF(ASN1_TYPE):
+         * by analyzing it we can determine the passed structure: this
+         * assumes the input is surrounded by an ASN1 SEQUENCE.
+         */
+        inkey = d2i_ASN1_SET_OF_ASN1_TYPE(NULL, &p, length, d2i_ASN1_TYPE, 
+                        ASN1_TYPE_free, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+        /* Since we only need to discern "traditional format" RSA and DSA
+         * keys we can just count the elements.
+         */
+        if(sk_ASN1_TYPE_num(inkey) == 6) keytype = EVP_PKEY_DSA;
+        else keytype = EVP_PKEY_RSA;
+        sk_ASN1_TYPE_pop_free(inkey, ASN1_TYPE_free);
+        return d2i_PrivateKey(keytype, a, pp, length);
+}
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_r_pr.c b/src/lib/libssl/src/crypto/asn1/d2i_r_pr.c
index 18f11b6f5e..6c8a45f821 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_r_pr.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_r_pr.c
@@ -107,7 +107,7 @@ RSA *d2i_RSAPrivateKey(RSA **a, unsigned char **pp, long length)
         if ((ret->iqmp=BN_bin2bn(bs->data,bs->length,ret->iqmp)) == NULL)
                 goto err_bn;
 
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
 
         M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -115,7 +115,14 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_RSAPRIVATEKEY,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) RSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
+
         return(NULL);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_r_pu.c b/src/lib/libssl/src/crypto/asn1/d2i_r_pu.c
index c4ae58b594..d1289f160e 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_r_pu.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_r_pu.c
@@ -81,7 +81,7 @@ RSA *d2i_RSAPublicKey(RSA **a, unsigned char **pp, long length)
         M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
         if ((ret->e=BN_bin2bn(bs->data,bs->length,ret->e)) == NULL) goto err_bn;
 
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
         bs=NULL;
 
         M_ASN1_D2I_Finish_2(a);
@@ -91,7 +91,13 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_RSAPUBLICKEY,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) RSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
         return(NULL);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_s_pr.c b/src/lib/libssl/src/crypto/asn1/d2i_s_pr.c
index 050e1cc5fb..dec2a2ebd3 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_s_pr.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_s_pr.c
@@ -91,7 +91,7 @@ DSA *d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length)
         if ((ret->priv_key=BN_bin2bn(bs->data,bs->length,ret->priv_key))
                 == NULL) goto err_bn;
 
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
 
         M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -99,7 +99,7 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_DSAPRIVATEKEY,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
         return(NULL);
         }
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_s_pu.c b/src/lib/libssl/src/crypto/asn1/d2i_s_pu.c
index 94ea1c313b..e0adaa0393 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_s_pu.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_s_pu.c
@@ -107,7 +107,7 @@ DSA *d2i_DSAPublicKey(DSA **a, unsigned char **pp, long length)
                 ret->write_params=1;
                 }
 
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
         bs=NULL;
         M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -115,7 +115,7 @@ err_bn:
 err:
         ASN1err(ASN1_F_D2I_DSAPUBLICKEY,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
         return(NULL);
         }
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/evp_asn1.c b/src/lib/libssl/src/crypto/asn1/evp_asn1.c
index 41ced49c19..3506005a71 100644
--- a/src/lib/libssl/src/crypto/asn1/evp_asn1.c
+++ b/src/lib/libssl/src/crypto/asn1/evp_asn1.c
@@ -65,8 +65,8 @@ int ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len)
         {
         ASN1_STRING *os;
 
-        if ((os=ASN1_OCTET_STRING_new()) == NULL) return(0);
-        if (!ASN1_OCTET_STRING_set(os,data,len)) return(0);
+        if ((os=M_ASN1_OCTET_STRING_new()) == NULL) return(0);
+        if (!M_ASN1_OCTET_STRING_set(os,data,len)) return(0);
         ASN1_TYPE_set(a,V_ASN1_OCTET_STRING,os);
         return(1);
         }
@@ -83,8 +83,8 @@ int ASN1_TYPE_get_octetstring(ASN1_TYPE *a, unsigned char *data,
                 ASN1err(ASN1_F_ASN1_TYPE_GET_OCTETSTRING,ASN1_R_DATA_IS_WRONG);
                 return(-1);
                 }
-        p=ASN1_STRING_data(a->value.octet_string);
-        ret=ASN1_STRING_length(a->value.octet_string);
+        p=M_ASN1_STRING_data(a->value.octet_string);
+        ret=M_ASN1_STRING_length(a->value.octet_string);
         if (ret < max_len)
                 num=ret;
         else
@@ -117,8 +117,8 @@ int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, unsigned char *data,
         /* Grow the 'string' */
         ASN1_STRING_set(osp,NULL,size);
 
-        ASN1_STRING_length(osp)=size;
-        p=ASN1_STRING_data(osp);
+        M_ASN1_STRING_length_set(osp, size);
+        p=M_ASN1_STRING_data(osp);
 
         ASN1_put_object(&p,1,n,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
           i2d_ASN1_INTEGER(&in,&p);
@@ -145,8 +145,8 @@ int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
                 {
                 goto err;
                 }
-        p=ASN1_STRING_data(a->value.sequence);
-        length=ASN1_STRING_length(a->value.sequence);
+        p=M_ASN1_STRING_data(a->value.sequence);
+        length=M_ASN1_STRING_length(a->value.sequence);
 
         c.pp= &p;
         c.p=p;
@@ -165,21 +165,21 @@ int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
         if (num != NULL)
                 *num=ASN1_INTEGER_get(ai);
 
-        ret=ASN1_STRING_length(os);
+        ret=M_ASN1_STRING_length(os);
         if (max_len > ret)
                 n=ret;
         else
                 n=max_len;
 
         if (data != NULL)
-                memcpy(data,ASN1_STRING_data(os),n);
+                memcpy(data,M_ASN1_STRING_data(os),n);
         if (0)
                 {
 err:
                 ASN1err(ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING,ASN1_R_DATA_IS_WRONG);
                 }
-        if (os != NULL) ASN1_OCTET_STRING_free(os);
-        if (ai != NULL) ASN1_INTEGER_free(ai);
+        if (os != NULL) M_ASN1_OCTET_STRING_free(os);
+        if (ai != NULL) M_ASN1_INTEGER_free(ai);
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/f_enum.c b/src/lib/libssl/src/crypto/asn1/f_enum.c
index 3bcceecdb8..3d0b1107cb 100644
--- a/src/lib/libssl/src/crypto/asn1/f_enum.c
+++ b/src/lib/libssl/src/crypto/asn1/f_enum.c
@@ -161,7 +161,7 @@ int a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size)
                         if (sp == NULL)
                                 {
                                 ASN1err(ASN1_F_A2I_ASN1_ENUMERATED,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                 goto err;
                                 }
                         s=sp;
diff --git a/src/lib/libssl/src/crypto/asn1/f_int.c b/src/lib/libssl/src/crypto/asn1/f_int.c
index 55560dd814..cd57331c3f 100644
--- a/src/lib/libssl/src/crypto/asn1/f_int.c
+++ b/src/lib/libssl/src/crypto/asn1/f_int.c
@@ -168,7 +168,7 @@ int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
                         if (sp == NULL)
                                 {
                                 ASN1err(ASN1_F_A2I_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                 goto err;
                                 }
                         s=sp;
diff --git a/src/lib/libssl/src/crypto/asn1/f_string.c b/src/lib/libssl/src/crypto/asn1/f_string.c
index 5d0cf5a46d..088313689a 100644
--- a/src/lib/libssl/src/crypto/asn1/f_string.c
+++ b/src/lib/libssl/src/crypto/asn1/f_string.c
@@ -166,7 +166,7 @@ int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size)
                         if (sp == NULL)
                                 {
                                 ASN1err(ASN1_F_A2I_ASN1_STRING,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                 goto err;
                                 }
                         s=sp;
diff --git a/src/lib/libssl/src/crypto/asn1/i2d_dhp.c b/src/lib/libssl/src/crypto/asn1/i2d_dhp.c
index fdda4ec41b..61eeb646f9 100644
--- a/src/lib/libssl/src/crypto/asn1/i2d_dhp.c
+++ b/src/lib/libssl/src/crypto/asn1/i2d_dhp.c
@@ -118,7 +118,7 @@ int i2d_DHparams(DH *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         ret=t;
 err:
         if (num[2] != NULL) BN_free(num[2]);
diff --git a/src/lib/libssl/src/crypto/asn1/i2d_dsap.c b/src/lib/libssl/src/crypto/asn1/i2d_dsap.c
index f36f0da4e2..4021123ba3 100644
--- a/src/lib/libssl/src/crypto/asn1/i2d_dsap.c
+++ b/src/lib/libssl/src/crypto/asn1/i2d_dsap.c
@@ -107,7 +107,7 @@ int i2d_DSAparams(DSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         ret=t;
 err:
         *pp=p;
diff --git a/src/lib/libssl/src/crypto/asn1/i2d_r_pr.c b/src/lib/libssl/src/crypto/asn1/i2d_r_pr.c
index 27e6844a7f..1250fa4b2d 100644
--- a/src/lib/libssl/src/crypto/asn1/i2d_r_pr.c
+++ b/src/lib/libssl/src/crypto/asn1/i2d_r_pr.c
@@ -119,9 +119,15 @@ int i2d_RSAPrivateKey(RSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         *pp=p;
         return(t);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
 
diff --git a/src/lib/libssl/src/crypto/asn1/i2d_r_pu.c b/src/lib/libssl/src/crypto/asn1/i2d_r_pu.c
index 6d01bfa8b5..582b92ee4c 100644
--- a/src/lib/libssl/src/crypto/asn1/i2d_r_pu.c
+++ b/src/lib/libssl/src/crypto/asn1/i2d_r_pu.c
@@ -105,8 +105,14 @@ int i2d_RSAPublicKey(RSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         *pp=p;
         return(t);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/i2d_s_pr.c b/src/lib/libssl/src/crypto/asn1/i2d_s_pr.c
index 5d3dcdf197..e399ceaeb9 100644
--- a/src/lib/libssl/src/crypto/asn1/i2d_s_pr.c
+++ b/src/lib/libssl/src/crypto/asn1/i2d_s_pr.c
@@ -116,7 +116,7 @@ int i2d_DSAPrivateKey(DSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         *pp=p;
         return(t);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/i2d_s_pu.c b/src/lib/libssl/src/crypto/asn1/i2d_s_pu.c
index 18f790f746..ca7f251b71 100644
--- a/src/lib/libssl/src/crypto/asn1/i2d_s_pu.c
+++ b/src/lib/libssl/src/crypto/asn1/i2d_s_pu.c
@@ -121,7 +121,7 @@ int i2d_DSAPublicKey(DSA *a, unsigned char **pp)
                 bs.length=BN_bn2bin(num[i],bs.data);
                 i2d_ASN1_INTEGER(&bs,&p);
                 }
-        Free((char *)bs.data);
+        Free(bs.data);
         *pp=p;
         if(all) return(t);
         else return(tot);
diff --git a/src/lib/libssl/src/crypto/asn1/n_pkey.c b/src/lib/libssl/src/crypto/asn1/n_pkey.c
index cdc0d8b7c4..d804986b73 100644
--- a/src/lib/libssl/src/crypto/asn1/n_pkey.c
+++ b/src/lib/libssl/src/crypto/asn1/n_pkey.c
@@ -139,7 +139,7 @@ int i2d_Netscape_RSA(RSA *a, unsigned char **pp, int (*cb)())
                 }
 
         if (pkey->private_key->data != NULL)
-                Free((char *)pkey->private_key->data);
+                Free(pkey->private_key->data);
         if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
                 {
                 ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);
@@ -205,10 +205,10 @@ RSA *d2i_Netscape_RSA(RSA **a, unsigned char **pp, long length, int (*cb)())
                 (char *)os->data,os->length) != 0))
                 {
                 ASN1err(ASN1_F_D2I_NETSCAPE_RSA,ASN1_R_PRIVATE_KEY_HEADER_MISSING);
-                ASN1_BIT_STRING_free(os);
+                M_ASN1_BIT_STRING_free(os);
                 goto err;
                 }
-        ASN1_BIT_STRING_free(os);
+        M_ASN1_BIT_STRING_free(os);
         c.q=c.p;
         if ((ret=d2i_Netscape_RSA_2(a,&c.p,c.slen,cb)) == NULL) goto err;
         c.slen-=(c.p-c.q);
@@ -279,7 +279,7 @@ RSA *d2i_Netscape_RSA_2(RSA **a, unsigned char **pp, long length,
         *pp=c.p;
 err:
         if (pkey != NULL) NETSCAPE_PKEY_free(pkey);
-        if (os != NULL) ASN1_BIT_STRING_free(os);
+        if (os != NULL) M_ASN1_BIT_STRING_free(os);
         if (alg != NULL) X509_ALGOR_free(alg);
         return(ret);
         }
@@ -321,9 +321,9 @@ static NETSCAPE_PKEY *NETSCAPE_PKEY_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,NETSCAPE_PKEY);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->private_key,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->private_key,M_ASN1_OCTET_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_NETSCAPE_PKEY_NEW);
         }
@@ -331,11 +331,18 @@ static NETSCAPE_PKEY *NETSCAPE_PKEY_new(void)
 static void NETSCAPE_PKEY_free(NETSCAPE_PKEY *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         X509_ALGOR_free(a->algor);
-        ASN1_OCTET_STRING_free(a->private_key);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->private_key);
+        Free(a);
         }
 
 #endif /* NO_RC4 */
+
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/p5_pbe.c b/src/lib/libssl/src/crypto/asn1/p5_pbe.c
index b831836e7b..64e90237cc 100644
--- a/src/lib/libssl/src/crypto/asn1/p5_pbe.c
+++ b/src/lib/libssl/src/crypto/asn1/p5_pbe.c
@@ -82,8 +82,8 @@ PBEPARAM *PBEPARAM_new(void)
         PBEPARAM *ret=NULL;
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PBEPARAM);
-        M_ASN1_New(ret->iter,ASN1_INTEGER_new);
-        M_ASN1_New(ret->salt,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->iter,M_ASN1_INTEGER_new);
+        M_ASN1_New(ret->salt,M_ASN1_OCTET_STRING_new);
         return (ret);
         M_ASN1_New_Error(ASN1_F_PBEPARAM_NEW);
 }
@@ -101,9 +101,9 @@ PBEPARAM *d2i_PBEPARAM(PBEPARAM **a, unsigned char **pp, long length)
 void PBEPARAM_free (PBEPARAM *a)
 {
         if(a==NULL) return;
-        ASN1_OCTET_STRING_free(a->salt);
-        ASN1_INTEGER_free (a->iter);
-        Free ((char *)a);
+        M_ASN1_OCTET_STRING_free(a->salt);
+        M_ASN1_INTEGER_free (a->iter);
+        Free (a);
 }
 
 /* Return an algorithm identifier for a PKCS#5 PBE algorithm */
@@ -129,7 +129,8 @@ X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
         }
         pbe->salt->length = saltlen;
         if (salt) memcpy (pbe->salt->data, salt, saltlen);
-        else RAND_bytes (pbe->salt->data, saltlen);
+        else if (RAND_bytes (pbe->salt->data, saltlen) <= 0)
+                return NULL;
 
         if (!(astype = ASN1_TYPE_new())) {
                 ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libssl/src/crypto/asn1/p5_pbev2.c b/src/lib/libssl/src/crypto/asn1/p5_pbev2.c
index 09f4bf6112..4ce06a94ab 100644
--- a/src/lib/libssl/src/crypto/asn1/p5_pbev2.c
+++ b/src/lib/libssl/src/crypto/asn1/p5_pbev2.c
@@ -104,7 +104,7 @@ void PBE2PARAM_free (PBE2PARAM *a)
         if(a==NULL) return;
         X509_ALGOR_free(a->keyfunc);
         X509_ALGOR_free(a->encryption);
-        Free ((char *)a);
+        Free (a);
 }
 
 int i2d_PBKDF2PARAM(PBKDF2PARAM *a, unsigned char **pp)
@@ -131,7 +131,7 @@ PBKDF2PARAM *PBKDF2PARAM_new(void)
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PBKDF2PARAM);
         M_ASN1_New(ret->salt, ASN1_TYPE_new);
-        M_ASN1_New(ret->iter, ASN1_INTEGER_new);
+        M_ASN1_New(ret->iter, M_ASN1_INTEGER_new);
         ret->keylength = NULL;
         ret->prf = NULL;
         return (ret);
@@ -155,10 +155,10 @@ void PBKDF2PARAM_free (PBKDF2PARAM *a)
 {
         if(a==NULL) return;
         ASN1_TYPE_free(a->salt);
-        ASN1_INTEGER_free(a->iter);
-        ASN1_INTEGER_free(a->keylength);
+        M_ASN1_INTEGER_free(a->iter);
+        M_ASN1_INTEGER_free(a->keylength);
         X509_ALGOR_free(a->prf);
-        Free ((char *)a);
+        Free (a);
 }
 
 /* Return an algorithm identifier for a PKCS#5 v2.0 PBE algorithm:
@@ -175,19 +175,26 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         PBKDF2PARAM *kdf = NULL;
         PBE2PARAM *pbe2 = NULL;
         ASN1_OCTET_STRING *osalt = NULL;
+        ASN1_OBJECT *obj;
+
+        alg_nid = EVP_CIPHER_type(cipher);
+        if(alg_nid == NID_undef) {
+                ASN1err(ASN1_F_PKCS5_PBE2_SET,
+                                ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
+                goto err;
+        }
+        obj = OBJ_nid2obj(alg_nid);
 
         if(!(pbe2 = PBE2PARAM_new())) goto merr;
 
         /* Setup the AlgorithmIdentifier for the encryption scheme */
         scheme = pbe2->encryption;
 
-        alg_nid = EVP_CIPHER_type(cipher);
-
-        scheme->algorithm = OBJ_nid2obj(alg_nid);
+        scheme->algorithm = obj;
         if(!(scheme->parameter = ASN1_TYPE_new())) goto merr;
 
         /* Create random IV */
-        RAND_bytes(iv, EVP_CIPHER_iv_length(cipher));
+        RAND_pseudo_bytes(iv, EVP_CIPHER_iv_length(cipher));
 
         /* Dummy cipherinit to just setup the IV */
         EVP_CipherInit(&ctx, cipher, NULL, iv, 0);
@@ -199,13 +206,13 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         EVP_CIPHER_CTX_cleanup(&ctx);
 
         if(!(kdf = PBKDF2PARAM_new())) goto merr;
-        if(!(osalt = ASN1_OCTET_STRING_new())) goto merr;
+        if(!(osalt = M_ASN1_OCTET_STRING_new())) goto merr;
 
         if (!saltlen) saltlen = PKCS5_SALT_LEN;
         if (!(osalt->data = Malloc (saltlen))) goto merr;
         osalt->length = saltlen;
         if (salt) memcpy (osalt->data, salt, saltlen);
-        else RAND_bytes (osalt->data, saltlen);
+        else if (RAND_bytes (osalt->data, saltlen) <= 0) goto merr;
 
         if(iter <= 0) iter = PKCS5_DEFAULT_ITER;
         if(!ASN1_INTEGER_set(kdf->iter, iter)) goto merr;
@@ -218,7 +225,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         /* If its RC2 then we'd better setup the key length */
 
         if(alg_nid == NID_rc2_cbc) {
-                if(!(kdf->keylength = ASN1_INTEGER_new())) goto merr;
+                if(!(kdf->keylength = M_ASN1_INTEGER_new())) goto merr;
                 if(!ASN1_INTEGER_set (kdf->keylength,
                                  EVP_CIPHER_key_length(cipher))) goto merr;
         }
@@ -264,7 +271,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         err:
         PBE2PARAM_free(pbe2);
         /* Note 'scheme' is freed as part of pbe2 */
-        ASN1_OCTET_STRING_free(osalt);
+        M_ASN1_OCTET_STRING_free(osalt);
         PBKDF2PARAM_free(kdf);
         X509_ALGOR_free(kalg);
         X509_ALGOR_free(ret);
diff --git a/src/lib/libssl/src/crypto/asn1/p7_dgst.c b/src/lib/libssl/src/crypto/asn1/p7_dgst.c
index 62783a2b8d..cba90e94a1 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_dgst.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_dgst.c
@@ -101,10 +101,10 @@ PKCS7_DIGEST *PKCS7_DIGEST_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_DIGEST);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->md,X509_ALGOR_new);
         M_ASN1_New(ret->contents,PKCS7_new);
-        M_ASN1_New(ret->digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->digest,M_ASN1_OCTET_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS7_DIGEST_NEW);
         }
@@ -112,10 +112,10 @@ PKCS7_DIGEST *PKCS7_DIGEST_new(void)
 void PKCS7_DIGEST_free(PKCS7_DIGEST *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         X509_ALGOR_free(a->md);
         PKCS7_free(a->contents);
-        ASN1_OCTET_STRING_free(a->digest);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->digest);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/p7_enc.c b/src/lib/libssl/src/crypto/asn1/p7_enc.c
index 4741126587..83b0e15faa 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_enc.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_enc.c
@@ -95,7 +95,7 @@ PKCS7_ENCRYPT *PKCS7_ENCRYPT_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_ENCRYPT);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS7_ENCRYPT_NEW);
@@ -104,8 +104,8 @@ PKCS7_ENCRYPT *PKCS7_ENCRYPT_new(void)
 void PKCS7_ENCRYPT_free(PKCS7_ENCRYPT *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS7_ENC_CONTENT_free(a->enc_data);
-        Free((char *)a);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/p7_enc_c.c b/src/lib/libssl/src/crypto/asn1/p7_enc_c.c
index a832737a38..582cc78b06 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_enc_c.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_enc_c.c
@@ -101,7 +101,8 @@ PKCS7_ENC_CONTENT *PKCS7_ENC_CONTENT_new(void)
 
         M_ASN1_New_Malloc(ret,PKCS7_ENC_CONTENT);
         /* M_ASN1_New(ret->content_type,ASN1_OBJECT_new); */
-        ret->content_type=OBJ_nid2obj(NID_pkcs7_encrypted);
+        /* We will almost always want this: so make it the default */
+        ret->content_type=OBJ_nid2obj(NID_pkcs7_data);
         M_ASN1_New(ret->algorithm,X509_ALGOR_new);
         ret->enc_data=NULL;
         return(ret);
@@ -113,7 +114,7 @@ void PKCS7_ENC_CONTENT_free(PKCS7_ENC_CONTENT *a)
         if (a == NULL) return;
         ASN1_OBJECT_free(a->content_type);
         X509_ALGOR_free(a->algorithm);
-        ASN1_OCTET_STRING_free(a->enc_data);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->enc_data);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/p7_evp.c b/src/lib/libssl/src/crypto/asn1/p7_evp.c
index b2b3d50dcd..4e734fdd28 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_evp.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_evp.c
@@ -101,7 +101,7 @@ PKCS7_ENVELOPE *PKCS7_ENVELOPE_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_ENVELOPE);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->recipientinfo,sk_PKCS7_RECIP_INFO_new_null);
         M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
         return(ret);
@@ -111,9 +111,9 @@ PKCS7_ENVELOPE *PKCS7_ENVELOPE_new(void)
 void PKCS7_ENVELOPE_free(PKCS7_ENVELOPE *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         sk_PKCS7_RECIP_INFO_pop_free(a->recipientinfo,PKCS7_RECIP_INFO_free);
         PKCS7_ENC_CONTENT_free(a->enc_data);
-        Free((char *)a);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/p7_i_s.c b/src/lib/libssl/src/crypto/asn1/p7_i_s.c
index 7d4b457e01..d21f7ddb84 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_i_s.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_i_s.c
@@ -96,7 +96,7 @@ PKCS7_ISSUER_AND_SERIAL *PKCS7_ISSUER_AND_SERIAL_new(void)
 
         M_ASN1_New_Malloc(ret,PKCS7_ISSUER_AND_SERIAL);
         M_ASN1_New(ret->issuer,X509_NAME_new);
-        M_ASN1_New(ret->serial,ASN1_INTEGER_new);
+        M_ASN1_New(ret->serial,M_ASN1_INTEGER_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS7_ISSUER_AND_SERIAL_NEW);
         }
@@ -105,7 +105,7 @@ void PKCS7_ISSUER_AND_SERIAL_free(PKCS7_ISSUER_AND_SERIAL *a)
         {
         if (a == NULL) return;
         X509_NAME_free(a->issuer);
-        ASN1_INTEGER_free(a->serial);
-        Free((char *)a);
+        M_ASN1_INTEGER_free(a->serial);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/p7_lib.c b/src/lib/libssl/src/crypto/asn1/p7_lib.c
index 846be17158..86db82cfa1 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_lib.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_lib.c
@@ -152,7 +152,7 @@ PKCS7 *d2i_PKCS7(PKCS7 **a, unsigned char **pp, long length)
                 {
                 if ((*a)->asn1 != NULL)
                         {
-                        Free((char *)(*a)->asn1);
+                        Free((*a)->asn1);
                         (*a)->asn1=NULL;
                         }
                 (*a)->length=0;
@@ -251,7 +251,7 @@ void PKCS7_free(PKCS7 *a)
                 {
                 ASN1_OBJECT_free(a->type);
                 }
-        Free((char *)(char *)a);
+        Free(a);
         }
 
 void PKCS7_content_free(PKCS7 *a)
@@ -259,7 +259,7 @@ void PKCS7_content_free(PKCS7 *a)
         if(a == NULL)
             return;
 
-        if (a->asn1 != NULL) Free((char *)a->asn1);
+        if (a->asn1 != NULL) Free(a->asn1);
 
         if (a->d.ptr != NULL)
                 {
@@ -268,7 +268,7 @@ void PKCS7_content_free(PKCS7 *a)
                 switch (OBJ_obj2nid(a->type))
                         {
                 case NID_pkcs7_data:
-                        ASN1_OCTET_STRING_free(a->d.data);
+                        M_ASN1_OCTET_STRING_free(a->d.data);
                         break;
                 case NID_pkcs7_signed:
                         PKCS7_SIGNED_free(a->d.sign);
diff --git a/src/lib/libssl/src/crypto/asn1/p7_recip.c b/src/lib/libssl/src/crypto/asn1/p7_recip.c
index 9fda4f20d4..b1abfa3b8f 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_recip.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_recip.c
@@ -101,10 +101,10 @@ PKCS7_RECIP_INFO *PKCS7_RECIP_INFO_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_RECIP_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->issuer_and_serial,PKCS7_ISSUER_AND_SERIAL_new);
         M_ASN1_New(ret->key_enc_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_key,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_key,M_ASN1_OCTET_STRING_new);
         ret->cert=NULL;
         return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS7_RECIP_INFO_NEW);
@@ -113,10 +113,10 @@ PKCS7_RECIP_INFO *PKCS7_RECIP_INFO_new(void)
 void PKCS7_RECIP_INFO_free(PKCS7_RECIP_INFO *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS7_ISSUER_AND_SERIAL_free(a->issuer_and_serial);
         X509_ALGOR_free(a->key_enc_algor);
-        ASN1_OCTET_STRING_free(a->enc_key);
+        M_ASN1_OCTET_STRING_free(a->enc_key);
         if (a->cert != NULL) X509_free(a->cert);
         Free(a);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/p7_s_e.c b/src/lib/libssl/src/crypto/asn1/p7_s_e.c
index 90946695c9..3d18fedf8e 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_s_e.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_s_e.c
@@ -119,7 +119,7 @@ PKCS7_SIGN_ENVELOPE *PKCS7_SIGN_ENVELOPE_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_SIGN_ENVELOPE);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->recipientinfo,sk_PKCS7_RECIP_INFO_new_null);
         M_ASN1_New(ret->md_algs,sk_X509_ALGOR_new_null);
         M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
@@ -133,7 +133,7 @@ PKCS7_SIGN_ENVELOPE *PKCS7_SIGN_ENVELOPE_new(void)
 void PKCS7_SIGN_ENVELOPE_free(PKCS7_SIGN_ENVELOPE *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         sk_PKCS7_RECIP_INFO_pop_free(a->recipientinfo,PKCS7_RECIP_INFO_free);
         sk_X509_ALGOR_pop_free(a->md_algs,X509_ALGOR_free);
         PKCS7_ENC_CONTENT_free(a->enc_data);
diff --git a/src/lib/libssl/src/crypto/asn1/p7_signd.c b/src/lib/libssl/src/crypto/asn1/p7_signd.c
index 74f0f522e1..f6f16a8715 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_signd.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_signd.c
@@ -112,7 +112,7 @@ PKCS7_SIGNED *PKCS7_SIGNED_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_SIGNED);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->md_algs,sk_X509_ALGOR_new_null);
         M_ASN1_New(ret->contents,PKCS7_new);
         ret->cert=NULL;
@@ -125,7 +125,7 @@ PKCS7_SIGNED *PKCS7_SIGNED_new(void)
 void PKCS7_SIGNED_free(PKCS7_SIGNED *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         sk_X509_ALGOR_pop_free(a->md_algs,X509_ALGOR_free);
         PKCS7_free(a->contents);
         sk_X509_pop_free(a->cert,X509_free);
diff --git a/src/lib/libssl/src/crypto/asn1/p7_signi.c b/src/lib/libssl/src/crypto/asn1/p7_signi.c
index 21132ef4dd..f74658ffe6 100644
--- a/src/lib/libssl/src/crypto/asn1/p7_signi.c
+++ b/src/lib/libssl/src/crypto/asn1/p7_signi.c
@@ -119,12 +119,12 @@ PKCS7_SIGNER_INFO *PKCS7_SIGNER_INFO_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,PKCS7_SIGNER_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->issuer_and_serial,PKCS7_ISSUER_AND_SERIAL_new);
         M_ASN1_New(ret->digest_alg,X509_ALGOR_new);
         ret->auth_attr=NULL;
         M_ASN1_New(ret->digest_enc_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_digest,M_ASN1_OCTET_STRING_new);
         ret->unauth_attr=NULL;
         ret->pkey=NULL;
         return(ret);
@@ -134,16 +134,16 @@ PKCS7_SIGNER_INFO *PKCS7_SIGNER_INFO_new(void)
 void PKCS7_SIGNER_INFO_free(PKCS7_SIGNER_INFO *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS7_ISSUER_AND_SERIAL_free(a->issuer_and_serial);
         X509_ALGOR_free(a->digest_alg);
         sk_X509_ATTRIBUTE_pop_free(a->auth_attr,X509_ATTRIBUTE_free);
         X509_ALGOR_free(a->digest_enc_alg);
-        ASN1_OCTET_STRING_free(a->enc_digest);
+        M_ASN1_OCTET_STRING_free(a->enc_digest);
         sk_X509_ATTRIBUTE_pop_free(a->unauth_attr,X509_ATTRIBUTE_free);
         if (a->pkey != NULL)
                 EVP_PKEY_free(a->pkey);
-        Free((char *)a);
+        Free(a);
         }
 
 IMPLEMENT_STACK_OF(PKCS7_SIGNER_INFO)
diff --git a/src/lib/libssl/src/crypto/asn1/p8_key.c b/src/lib/libssl/src/crypto/asn1/p8_key.c
new file mode 100644
index 0000000000..0b24374627
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/p8_key.c
@@ -0,0 +1,131 @@
+/* crypto/asn1/p8_key.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1_mac.h>
+#include <openssl/objects.h>
+
+int i2d_X509_KEY(X509 *a, unsigned char **pp)
+        {
+        M_ASN1_I2D_vars(a);
+
+        M_ASN1_I2D_len(a->cert_info,    i2d_X509_CINF);
+        M_ASN1_I2D_len(a->sig_alg,      i2d_X509_ALGOR);
+        M_ASN1_I2D_len(a->signature,    i2d_ASN1_BIT_STRING);
+
+        M_ASN1_I2D_seq_total();
+
+        M_ASN1_I2D_put(a->cert_info,    i2d_X509_CINF);
+        M_ASN1_I2D_put(a->sig_alg,      i2d_X509_ALGOR);
+        M_ASN1_I2D_put(a->signature,    i2d_ASN1_BIT_STRING);
+
+        M_ASN1_I2D_finish();
+        }
+
+X509 *d2i_X509_KEY(X509 **a, unsigned char **pp, long length)
+        {
+        M_ASN1_D2I_vars(a,X509 *,X509_new);
+
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+        M_ASN1_D2I_get(ret->cert_info,d2i_X509_CINF);
+        M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
+        M_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);
+        M_ASN1_D2I_Finish(a,X509_free,ASN1_F_D2I_X509);
+        }
+
+X509 *X509_KEY_new(void)
+        {
+        X509_KEY *ret=NULL;
+
+        M_ASN1_New_Malloc(ret,X509_KEY);
+        ret->references=1;
+        ret->type=NID
+        M_ASN1_New(ret->cert_info,X509_CINF_new);
+        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
+        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        return(ret);
+        M_ASN1_New_Error(ASN1_F_X509_NEW);
+        }
+
+void X509_KEY_free(X509 *a)
+        {
+        int i;
+
+        if (a == NULL) return;
+
+        i=CRYPTO_add_lock(&a->references,-1,CRYPTO_LOCK_X509_KEY);
+#ifdef REF_PRINT
+        REF_PRINT("X509_KEY",a);
+#endif
+        if (i > 0) return;
+#ifdef REF_CHECK
+        if (i < 0)
+                {
+                fprintf(stderr,"X509_KEY_free, bad reference count\n");
+                abort();
+                }
+#endif
+
+        X509_CINF_free(a->cert_info);
+        X509_ALGOR_free(a->sig_alg);
+        ASN1_BIT_STRING_free(a->signature);
+        Free(a);
+        }
+
diff --git a/src/lib/libssl/src/crypto/asn1/p8_pkey.c b/src/lib/libssl/src/crypto/asn1/p8_pkey.c
index aa9a4f6c96..59cfbe7f28 100644
--- a/src/lib/libssl/src/crypto/asn1/p8_pkey.c
+++ b/src/lib/libssl/src/crypto/asn1/p8_pkey.c
@@ -88,7 +88,7 @@ PKCS8_PRIV_KEY_INFO *PKCS8_PRIV_KEY_INFO_new(void)
         PKCS8_PRIV_KEY_INFO *ret=NULL;
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PKCS8_PRIV_KEY_INFO);
-        M_ASN1_New (ret->version, ASN1_INTEGER_new);
+        M_ASN1_New (ret->version, M_ASN1_INTEGER_new);
         M_ASN1_New (ret->pkeyalg, X509_ALGOR_new);
         M_ASN1_New (ret->pkey, ASN1_TYPE_new);
         ret->attributes = NULL;
@@ -109,15 +109,13 @@ PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO **a,
         M_ASN1_D2I_get_IMP_set_opt_type(X509_ATTRIBUTE, ret->attributes,
                                         d2i_X509_ATTRIBUTE,
                                         X509_ATTRIBUTE_free, 0);
-        if (ASN1_TYPE_get(ret->pkey) == V_ASN1_SEQUENCE) 
-                                                ret->broken = PKCS8_NO_OCTET;
         M_ASN1_D2I_Finish(a, PKCS8_PRIV_KEY_INFO_free, ASN1_F_D2I_PKCS8_PRIV_KEY_INFO);
 }
 
 void PKCS8_PRIV_KEY_INFO_free (PKCS8_PRIV_KEY_INFO *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free (a->version);
+        M_ASN1_INTEGER_free (a->version);
         X509_ALGOR_free(a->pkeyalg);
         /* Clear sensitive data */
         if (a->pkey->value.octet_string)
diff --git a/src/lib/libssl/src/crypto/asn1/pkcs8.c b/src/lib/libssl/src/crypto/asn1/pkcs8.c
index 29c4ea6a29..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/asn1/pkcs8.c
+++ b/src/lib/libssl/src/crypto/asn1/pkcs8.c
@@ -1,131 +0,0 @@
-/* crypto/asn1/pkcs8.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include <openssl/asn1_mac.h>
-#include <openssl/objects.h>
-
-int i2d_X509_KEY(X509 *a, unsigned char **pp)
-        {
-        M_ASN1_I2D_vars(a);
-
-        M_ASN1_I2D_len(a->cert_info,    i2d_X509_CINF);
-        M_ASN1_I2D_len(a->sig_alg,      i2d_X509_ALGOR);
-        M_ASN1_I2D_len(a->signature,    i2d_ASN1_BIT_STRING);
-
-        M_ASN1_I2D_seq_total();
-
-        M_ASN1_I2D_put(a->cert_info,    i2d_X509_CINF);
-        M_ASN1_I2D_put(a->sig_alg,      i2d_X509_ALGOR);
-        M_ASN1_I2D_put(a->signature,    i2d_ASN1_BIT_STRING);
-
-        M_ASN1_I2D_finish();
-        }
-
-X509 *d2i_X509_KEY(X509 **a, unsigned char **pp, long length)
-        {
-        M_ASN1_D2I_vars(a,X509 *,X509_new);
-
-        M_ASN1_D2I_Init();
-        M_ASN1_D2I_start_sequence();
-        M_ASN1_D2I_get(ret->cert_info,d2i_X509_CINF);
-        M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
-        M_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);
-        M_ASN1_D2I_Finish(a,X509_free,ASN1_F_D2I_X509);
-        }
-
-X509 *X509_KEY_new(void)
-        {
-        X509_KEY *ret=NULL;
-
-        M_ASN1_New_Malloc(ret,X509_KEY);
-        ret->references=1;
-        ret->type=NID
-        M_ASN1_New(ret->cert_info,X509_CINF_new);
-        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
-        return(ret);
-        M_ASN1_New_Error(ASN1_F_X509_NEW);
-        }
-
-void X509_KEY_free(X509 *a)
-        {
-        int i;
-
-        if (a == NULL) return;
-
-        i=CRYPTO_add_lock(&a->references,-1,CRYPTO_LOCK_X509_KEY);
-#ifdef REF_PRINT
-        REF_PRINT("X509_KEY",a);
-#endif
-        if (i > 0) return;
-#ifdef REF_CHECK
-        if (i < 0)
-                {
-                fprintf(stderr,"X509_KEY_free, bad reference count\n");
-                abort();
-                }
-#endif
-
-        X509_CINF_free(a->cert_info);
-        X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
-        }
-
diff --git a/src/lib/libssl/src/crypto/asn1/t_bitst.c b/src/lib/libssl/src/crypto/asn1/t_bitst.c
new file mode 100644
index 0000000000..8ee789f082
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/t_bitst.c
@@ -0,0 +1,99 @@
+/* t_bitst.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/conf.h>
+#include <openssl/x509v3.h>
+
+int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
+                                BIT_STRING_BITNAME *tbl, int indent)
+{
+        BIT_STRING_BITNAME *bnam;
+        char first = 1;
+        BIO_printf(out, "%*s", indent, "");
+        for(bnam = tbl; bnam->lname; bnam++) {
+                if(ASN1_BIT_STRING_get_bit(bs, bnam->bitnum)) {
+                        if(!first) BIO_puts(out, ", ");
+                        BIO_puts(out, bnam->lname);
+                        first = 0;
+                }
+        }
+        BIO_puts(out, "\n");
+        return 1;
+}
+
+int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
+                                BIT_STRING_BITNAME *tbl)
+{
+        int bitnum;
+        bitnum = ASN1_BIT_STRING_num_asc(name, tbl);
+        if(bitnum < 0) return 0;
+        if(bs) ASN1_BIT_STRING_set_bit(bs, bitnum, value);
+        return 1;
+}
+
+int ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl)
+{
+        BIT_STRING_BITNAME *bnam;
+        for(bnam = tbl; bnam->lname; bnam++) {
+                if(!strcmp(bnam->sname, name) ||
+                        !strcmp(bnam->lname, name) ) return bnam->bitnum;
+        }
+        return -1;
+}
diff --git a/src/lib/libssl/src/crypto/asn1/t_crl.c b/src/lib/libssl/src/crypto/asn1/t_crl.c
index c2e447ce6f..d78e4a8f88 100644
--- a/src/lib/libssl/src/crypto/asn1/t_crl.c
+++ b/src/lib/libssl/src/crypto/asn1/t_crl.c
@@ -160,7 +160,7 @@ static void ext_print(BIO *out, X509_EXTENSION *ex)
         BIO_printf(out, ": %s\n", j ? "critical":"","");
         if(!X509V3_EXT_print(out, ex, 0, 16)) {
                 BIO_printf(out, "%16s", "");
-                ASN1_OCTET_STRING_print(out,ex->value);
+                M_ASN1_OCTET_STRING_print(out,ex->value);
         }
         BIO_write(out,"\n",1);
 }
diff --git a/src/lib/libssl/src/crypto/asn1/t_pkey.c b/src/lib/libssl/src/crypto/asn1/t_pkey.c
index 0dc6e30c3d..e570ed1c47 100644
--- a/src/lib/libssl/src/crypto/asn1/t_pkey.c
+++ b/src/lib/libssl/src/crypto/asn1/t_pkey.c
@@ -133,7 +133,7 @@ int RSA_print(BIO *bp, RSA *x, int off)
         if (!print(bp,"coefficient:",x->iqmp,m,off)) goto err;
         ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         return(ret);
         }
 #endif /* NO_RSA */
@@ -204,7 +204,7 @@ int DSA_print(BIO *bp, DSA *x, int off)
         if ((x->g != NULL) && !print(bp,"G:   ",x->g,m,off)) goto err;
         ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         return(ret);
         }
 #endif /* !NO_DSA */
@@ -298,7 +298,7 @@ int DHparams_print(BIO *bp, DH *x)
         if (!print(bp,"generator:",x->g,m,4)) goto err;
         if (x->length != 0)
                 {
-                if (BIO_printf(bp,"    recomented-private-length: %d bits\n",
+                if (BIO_printf(bp,"    recommended-private-length: %d bits\n",
                         (int)x->length) <= 0) goto err;
                 }
         ret=1;
@@ -307,7 +307,7 @@ int DHparams_print(BIO *bp, DH *x)
 err:
                 DHerr(DH_F_DHPARAMS_PRINT,reason);
                 }
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         return(ret);
         }
 #endif
@@ -352,7 +352,7 @@ int DSAparams_print(BIO *bp, DSA *x)
         if (!print(bp,"g:",x->g,m,4)) goto err;
         ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         DSAerr(DSA_F_DSAPARAMS_PRINT,reason);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/t_req.c b/src/lib/libssl/src/crypto/asn1/t_req.c
index bdd749436a..81dd6355a8 100644
--- a/src/lib/libssl/src/crypto/asn1/t_req.c
+++ b/src/lib/libssl/src/crypto/asn1/t_req.c
@@ -62,6 +62,7 @@
 #include <openssl/bn.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 #ifndef NO_FP_API
 int X509_REQ_print_fp(FILE *fp, X509_REQ *x)
@@ -90,6 +91,7 @@ int X509_REQ_print(BIO *bp, X509_REQ *x)
         X509_REQ_INFO *ri;
         EVP_PKEY *pkey;
         STACK_OF(X509_ATTRIBUTE) *sk;
+        STACK_OF(X509_EXTENSION) *exts;
         char str[128];
 
         ri=x->req_info;
@@ -161,6 +163,8 @@ int X509_REQ_print(BIO *bp, X509_REQ *x)
                         int j,type=0,count=1,ii=0;
 
                         a=sk_X509_ATTRIBUTE_value(sk,i);
+                        if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
+                                                                continue;
                         sprintf(str,"%12s","");
                         if (BIO_puts(bp,str) <= 0) goto err;
                         if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
@@ -201,6 +205,29 @@ get_next:
                         }
                 }
 
+        exts = X509_REQ_get_extensions(x);
+        if(exts) {
+                BIO_printf(bp,"%8sRequested Extensions:\n","");
+                for (i=0; i<sk_X509_EXTENSION_num(exts); i++) {
+                        ASN1_OBJECT *obj;
+                        X509_EXTENSION *ex;
+                        int j;
+                        ex=sk_X509_EXTENSION_value(exts, i);
+                        if (BIO_printf(bp,"%12s","") <= 0) goto err;
+                        obj=X509_EXTENSION_get_object(ex);
+                        i2a_ASN1_OBJECT(bp,obj);
+                        j=X509_EXTENSION_get_critical(ex);
+                        if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
+                                goto err;
+                        if(!X509V3_EXT_print(bp, ex, 0, 16)) {
+                                BIO_printf(bp, "%16s", "");
+                                M_ASN1_OCTET_STRING_print(bp,ex->value);
+                        }
+                        if (BIO_write(bp,"\n",1) <= 0) goto err;
+                }
+                sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+        }
+
         i=OBJ_obj2nid(x->sig_alg->algorithm);
         sprintf(str,"%4sSignature Algorithm: %s","",
                 (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
diff --git a/src/lib/libssl/src/crypto/asn1/t_spki.c b/src/lib/libssl/src/crypto/asn1/t_spki.c
new file mode 100644
index 0000000000..d708434fca
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/t_spki.c
@@ -0,0 +1,116 @@
+/* t_spki.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/asn1_mac.h>
+
+/* Print out an SPKI */
+
+int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
+{
+        EVP_PKEY *pkey;
+        ASN1_IA5STRING *chal;
+        int i, n;
+        char *s;
+        BIO_printf(out, "Netscape SPKI:\n");
+        i=OBJ_obj2nid(spki->spkac->pubkey->algor->algorithm);
+        BIO_printf(out,"  Public Key Algorithm: %s\n",
+                                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
+        pkey = X509_PUBKEY_get(spki->spkac->pubkey);
+        if(!pkey) BIO_printf(out, "  Unable to load public key\n");
+        else {
+#ifndef NO_RSA
+                if (pkey->type == EVP_PKEY_RSA)
+                        {
+                        BIO_printf(out,"  RSA Public Key: (%d bit)\n",
+                                BN_num_bits(pkey->pkey.rsa->n));
+                        RSA_print(out,pkey->pkey.rsa,2);
+                        }
+                else 
+#endif
+#ifndef NO_DSA
+                if (pkey->type == EVP_PKEY_DSA)
+                {
+                BIO_printf(out,"  DSA Public Key:\n");
+                DSA_print(out,pkey->pkey.dsa,2);
+                }
+                else
+#endif
+                        BIO_printf(out,"  Unknown Public Key:\n");
+                EVP_PKEY_free(pkey);
+        }
+        chal = spki->spkac->challenge;
+        if(chal->length)
+                BIO_printf(out, "  Challenge String: %s\n", chal->data);
+        i=OBJ_obj2nid(spki->sig_algor->algorithm);
+        BIO_printf(out,"  Signature Algorithm: %s",
+                                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
+
+        n=spki->signature->length;
+        s=(char *)spki->signature->data;
+        for (i=0; i<n; i++)
+                {
+                if ((i%18) == 0) BIO_write(out,"\n      ",7);
+                BIO_printf(out,"%02x%s",(unsigned char)s[i],
+                                                ((i+1) == n)?"":":");
+                }
+        BIO_write(out,"\n",1);
+        return 1;
+}
diff --git a/src/lib/libssl/src/crypto/asn1/t_x509.c b/src/lib/libssl/src/crypto/asn1/t_x509.c
index 42f4d498cf..6ee1065ce9 100644
--- a/src/lib/libssl/src/crypto/asn1/t_x509.c
+++ b/src/lib/libssl/src/crypto/asn1/t_x509.c
@@ -188,11 +188,7 @@ int X509_print(BIO *bp, X509 *x)
                 BIO_printf(bp,"%8sX509v3 extensions:\n","");
                 for (i=0; i<n; i++)
                         {
-#if 0
-                        int data_type,pack_type;
-#endif
                         ASN1_OBJECT *obj;
-
                         ex=X509_get_ext(x,i);
                         if (BIO_printf(bp,"%12s","") <= 0) goto err;
                         obj=X509_EXTENSION_get_object(ex);
@@ -203,7 +199,7 @@ int X509_print(BIO *bp, X509 *x)
                         if(!X509V3_EXT_print(bp, ex, 0, 16))
                                 {
                                 BIO_printf(bp, "%16s", "");
-                                ASN1_OCTET_STRING_print(bp,ex->value);
+                                M_ASN1_OCTET_STRING_print(bp,ex->value);
                                 }
                         if (BIO_write(bp,"\n",1) <= 0) goto err;
                         }
@@ -223,10 +219,11 @@ int X509_print(BIO *bp, X509 *x)
                         ((i+1) == n)?"":":") <= 0) goto err;
                 }
         if (BIO_write(bp,"\n",1) != 1) goto err;
+        if (!X509_CERT_AUX_print(bp, x->aux, 0)) goto err;
         ret=1;
 err:
         if (str != NULL) ASN1_STRING_free(str);
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/t_x509a.c b/src/lib/libssl/src/crypto/asn1/t_x509a.c
new file mode 100644
index 0000000000..a18ebb586c
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/t_x509a.c
@@ -0,0 +1,102 @@
+/* t_x509a.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/asn1_mac.h>
+#include <openssl/x509.h>
+
+/* X509_CERT_AUX and string set routines
+ */
+
+int X509_CERT_AUX_print(BIO *out, X509_CERT_AUX *aux, int indent)
+{
+        char oidstr[80], first;
+        int i;
+        if(!aux) return 1;
+        if(aux->trust) {
+                first = 1;
+                BIO_printf(out, "%*sTrusted Uses:\n%*s",
+                                                indent, "", indent + 2, "");
+                for(i = 0; i < sk_ASN1_OBJECT_num(aux->trust); i++) {
+                        if(!first) BIO_puts(out, ", ");
+                        else first = 0;
+                        OBJ_obj2txt(oidstr, 80,
+                                sk_ASN1_OBJECT_value(aux->trust, i), 0);
+                        BIO_puts(out, oidstr);
+                }
+                BIO_puts(out, "\n");
+        } else BIO_printf(out, "%*sNo Trusted Uses.\n", indent, "");
+        if(aux->reject) {
+                first = 1;
+                BIO_printf(out, "%*sRejected Uses:\n%*s",
+                                                indent, "", indent + 2, "");
+                for(i = 0; i < sk_ASN1_OBJECT_num(aux->reject); i++) {
+                        if(!first) BIO_puts(out, ", ");
+                        else first = 0;
+                        OBJ_obj2txt(oidstr, 80,
+                                sk_ASN1_OBJECT_value(aux->reject, i), 0);
+                        BIO_puts(out, oidstr);
+                }
+                BIO_puts(out, "\n");
+        } else BIO_printf(out, "%*sNo Rejected Uses.\n", indent, "");
+        if(aux->alias) BIO_printf(out, "%*sAlias: %s\n", indent, "",
+                                                        aux->alias->data);
+        return 1;
+}
diff --git a/src/lib/libssl/src/crypto/asn1/x_algor.c b/src/lib/libssl/src/crypto/asn1/x_algor.c
index b2c20d139f..fe023842f8 100644
--- a/src/lib/libssl/src/crypto/asn1/x_algor.c
+++ b/src/lib/libssl/src/crypto/asn1/x_algor.c
@@ -111,7 +111,7 @@ void X509_ALGOR_free(X509_ALGOR *a)
         if (a == NULL) return;
         ASN1_OBJECT_free(a->algorithm);
         ASN1_TYPE_free(a->parameter);
-        Free((char *)a);
+        Free(a);
         }
 
 IMPLEMENT_STACK_OF(X509_ALGOR)
diff --git a/src/lib/libssl/src/crypto/asn1/x_attrib.c b/src/lib/libssl/src/crypto/asn1/x_attrib.c
index a1cbebf5a5..a874df79db 100644
--- a/src/lib/libssl/src/crypto/asn1/x_attrib.c
+++ b/src/lib/libssl/src/crypto/asn1/x_attrib.c
@@ -160,6 +160,6 @@ void X509_ATTRIBUTE_free(X509_ATTRIBUTE *a)
                 sk_ASN1_TYPE_pop_free(a->value.set,ASN1_TYPE_free);
         else
                 ASN1_TYPE_free(a->value.single);
-        Free((char *)a);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_cinf.c b/src/lib/libssl/src/crypto/asn1/x_cinf.c
index fe1b18a90f..b87c8fff17 100644
--- a/src/lib/libssl/src/crypto/asn1/x_cinf.c
+++ b/src/lib/libssl/src/crypto/asn1/x_cinf.c
@@ -115,7 +115,7 @@ X509_CINF *d2i_X509_CINF(X509_CINF **a, unsigned char **pp, long length)
                 {
                 if (ret->version != NULL)
                         {
-                        ASN1_INTEGER_free(ret->version);
+                        M_ASN1_INTEGER_free(ret->version);
                         ret->version=NULL;
                         }
                 }
@@ -129,12 +129,12 @@ X509_CINF *d2i_X509_CINF(X509_CINF **a, unsigned char **pp, long length)
                 {
                 if (ret->issuerUID != NULL)
                         {
-                        ASN1_BIT_STRING_free(ret->issuerUID);
+                        M_ASN1_BIT_STRING_free(ret->issuerUID);
                         ret->issuerUID=NULL;
                         }
                 if (ret->subjectUID != NULL)
                         {
-                        ASN1_BIT_STRING_free(ret->subjectUID);
+                        M_ASN1_BIT_STRING_free(ret->subjectUID);
                         ret->subjectUID=NULL;
                         }
                 M_ASN1_D2I_get_IMP_opt(ret->issuerUID,d2i_ASN1_BIT_STRING,  1,
@@ -170,7 +170,7 @@ X509_CINF *X509_CINF_new(void)
 
         M_ASN1_New_Malloc(ret,X509_CINF);
         ret->version=NULL;
-        M_ASN1_New(ret->serialNumber,ASN1_INTEGER_new);
+        M_ASN1_New(ret->serialNumber,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->signature,X509_ALGOR_new);
         M_ASN1_New(ret->issuer,X509_NAME_new);
         M_ASN1_New(ret->validity,X509_VAL_new);
@@ -186,15 +186,15 @@ X509_CINF *X509_CINF_new(void)
 void X509_CINF_free(X509_CINF *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
-        ASN1_INTEGER_free(a->serialNumber);
+        M_ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->serialNumber);
         X509_ALGOR_free(a->signature);
         X509_NAME_free(a->issuer);
         X509_VAL_free(a->validity);
         X509_NAME_free(a->subject);
         X509_PUBKEY_free(a->key);
-        ASN1_BIT_STRING_free(a->issuerUID);
-        ASN1_BIT_STRING_free(a->subjectUID);
+        M_ASN1_BIT_STRING_free(a->issuerUID);
+        M_ASN1_BIT_STRING_free(a->subjectUID);
         sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
         Free(a);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/x_crl.c b/src/lib/libssl/src/crypto/asn1/x_crl.c
index cd46bbebc2..12a42d04c7 100644
--- a/src/lib/libssl/src/crypto/asn1/x_crl.c
+++ b/src/lib/libssl/src/crypto/asn1/x_crl.c
@@ -130,9 +130,9 @@ int i2d_X509_CRL_INFO(X509_CRL_INFO *a, unsigned char **pp)
                 }
         M_ASN1_I2D_put(a->sig_alg,i2d_X509_ALGOR);
         M_ASN1_I2D_put(a->issuer,i2d_X509_NAME);
-        M_ASN1_I2D_put(a->lastUpdate,i2d_ASN1_UTCTIME);
+        M_ASN1_I2D_put(a->lastUpdate,i2d_ASN1_TIME);
         if (a->nextUpdate != NULL)
-                { M_ASN1_I2D_put(a->nextUpdate,i2d_ASN1_UTCTIME); }
+                { M_ASN1_I2D_put(a->nextUpdate,i2d_ASN1_TIME); }
         M_ASN1_I2D_put_SEQUENCE_opt_type(X509_REVOKED,a->revoked,
                                          i2d_X509_REVOKED);
         M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION,a->extensions,
@@ -157,20 +157,16 @@ X509_CRL_INFO *d2i_X509_CRL_INFO(X509_CRL_INFO **a, unsigned char **pp,
         
         if ((ver == 0) && (ret->version != NULL))
                 {
-                ASN1_INTEGER_free(ret->version);
+                M_ASN1_INTEGER_free(ret->version);
                 ret->version=NULL;
                 }
         M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
         M_ASN1_D2I_get(ret->issuer,d2i_X509_NAME);
         M_ASN1_D2I_get(ret->lastUpdate,d2i_ASN1_TIME);
         /* Manually handle the OPTIONAL ASN1_TIME stuff */
-        if(c.slen != 0
-           && ( (M_ASN1_next & ~V_ASN1_CONSTRUCTED) ==
-                    (V_ASN1_UNIVERSAL|V_ASN1_UTCTIME)
-                || (M_ASN1_next & ~V_ASN1_CONSTRUCTED) ==
-                    (V_ASN1_UNIVERSAL|V_ASN1_GENERALIZEDTIME) ) ) {
-                M_ASN1_D2I_get(ret->nextUpdate,d2i_ASN1_TIME);
-        }
+        /* First try UTCTime */
+        M_ASN1_D2I_get_opt(ret->nextUpdate,d2i_ASN1_UTCTIME, V_ASN1_UTCTIME);
+        /* If that doesn't work try GeneralizedTime */
         if(!ret->nextUpdate) 
                 M_ASN1_D2I_get_opt(ret->nextUpdate,d2i_ASN1_GENERALIZEDTIME,
                                                         V_ASN1_GENERALIZEDTIME);
@@ -190,20 +186,17 @@ X509_CRL_INFO *d2i_X509_CRL_INFO(X509_CRL_INFO **a, unsigned char **pp,
                         }
                 }
 
-        if (ver >= 1)
+        if (ret->extensions != NULL)
                 {
-                if (ret->extensions != NULL)
-                        {
-                        while (sk_X509_EXTENSION_num(ret->extensions))
-                                X509_EXTENSION_free(
-                                sk_X509_EXTENSION_pop(ret->extensions));
-                        }
-                        
-                M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION,ret->extensions,
-                                                d2i_X509_EXTENSION,
-                                                X509_EXTENSION_free,0,
-                                                V_ASN1_SEQUENCE);
+                while (sk_X509_EXTENSION_num(ret->extensions))
+                        X509_EXTENSION_free(
+                        sk_X509_EXTENSION_pop(ret->extensions));
                 }
+                
+        M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION,ret->extensions,
+                                        d2i_X509_EXTENSION,
+                                        X509_EXTENSION_free,0,
+                                        V_ASN1_SEQUENCE);
 
         M_ASN1_D2I_Finish(a,X509_CRL_INFO_free,ASN1_F_D2I_X509_CRL_INFO);
         }
@@ -245,8 +238,8 @@ X509_REVOKED *X509_REVOKED_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,X509_REVOKED);
-        M_ASN1_New(ret->serialNumber,ASN1_INTEGER_new);
-        M_ASN1_New(ret->revocationDate,ASN1_UTCTIME_new);
+        M_ASN1_New(ret->serialNumber,M_ASN1_INTEGER_new);
+        M_ASN1_New(ret->revocationDate,M_ASN1_UTCTIME_new);
         ret->extensions=NULL;
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_REVOKED_NEW);
@@ -261,7 +254,7 @@ X509_CRL_INFO *X509_CRL_INFO_new(void)
         ret->version=NULL;
         M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
         M_ASN1_New(ret->issuer,X509_NAME_new);
-        M_ASN1_New(ret->lastUpdate,ASN1_UTCTIME_new);
+        M_ASN1_New(ret->lastUpdate,M_ASN1_UTCTIME_new);
         ret->nextUpdate=NULL;
         M_ASN1_New(ret->revoked,sk_X509_REVOKED_new_null);
         M_ASN1_New(ret->extensions,sk_X509_EXTENSION_new_null);
@@ -279,7 +272,7 @@ X509_CRL *X509_CRL_new(void)
         ret->references=1;
         M_ASN1_New(ret->crl,X509_CRL_INFO_new);
         M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_CRL_NEW);
         }
@@ -287,8 +280,8 @@ X509_CRL *X509_CRL_new(void)
 void X509_REVOKED_free(X509_REVOKED *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->serialNumber);
-        ASN1_UTCTIME_free(a->revocationDate);
+        M_ASN1_INTEGER_free(a->serialNumber);
+        M_ASN1_UTCTIME_free(a->revocationDate);
         sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
         Free(a);
         }
@@ -296,12 +289,12 @@ void X509_REVOKED_free(X509_REVOKED *a)
 void X509_CRL_INFO_free(X509_CRL_INFO *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         X509_ALGOR_free(a->sig_alg);
         X509_NAME_free(a->issuer);
-        ASN1_UTCTIME_free(a->lastUpdate);
+        M_ASN1_UTCTIME_free(a->lastUpdate);
         if (a->nextUpdate)
-                ASN1_UTCTIME_free(a->nextUpdate);
+                M_ASN1_UTCTIME_free(a->nextUpdate);
         sk_X509_REVOKED_pop_free(a->revoked,X509_REVOKED_free);
         sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
         Free(a);
@@ -328,7 +321,7 @@ void X509_CRL_free(X509_CRL *a)
 
         X509_CRL_INFO_free(a->crl);
         X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
+        M_ASN1_BIT_STRING_free(a->signature);
         Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_exten.c b/src/lib/libssl/src/crypto/asn1/x_exten.c
index d5f9e1df9e..185cbd78a0 100644
--- a/src/lib/libssl/src/crypto/asn1/x_exten.c
+++ b/src/lib/libssl/src/crypto/asn1/x_exten.c
@@ -100,10 +100,6 @@ X509_EXTENSION *d2i_X509_EXTENSION(X509_EXTENSION **a, unsigned char **pp,
         M_ASN1_D2I_start_sequence();
         M_ASN1_D2I_get(ret->object,d2i_ASN1_OBJECT);
 
-        if ((ret->argp != NULL) && (ret->ex_free != NULL))
-                ret->ex_free(ret);
-        ret->argl=0;
-        ret->argp=NULL;
         ret->netscape_hack=0;
         if ((c.slen != 0) &&
                 (M_ASN1_next == (V_ASN1_UNIVERSAL|V_ASN1_BOOLEAN)))
@@ -126,12 +122,9 @@ X509_EXTENSION *X509_EXTENSION_new(void)
 
         M_ASN1_New_Malloc(ret,X509_EXTENSION);
         ret->object=OBJ_nid2obj(NID_undef);
-        M_ASN1_New(ret->value,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->value,M_ASN1_OCTET_STRING_new);
         ret->critical=0;
         ret->netscape_hack=0;
-        ret->argl=0L;
-        ret->argp=NULL;
-        ret->ex_free=NULL;
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_EXTENSION_NEW);
         }
@@ -139,10 +132,8 @@ X509_EXTENSION *X509_EXTENSION_new(void)
 void X509_EXTENSION_free(X509_EXTENSION *a)
         {
         if (a == NULL) return;
-        if ((a->argp != NULL) && (a->ex_free != NULL))
-                a->ex_free(a);
         ASN1_OBJECT_free(a->object);
-        ASN1_OCTET_STRING_free(a->value);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->value);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_info.c b/src/lib/libssl/src/crypto/asn1/x_info.c
index 99ce011f07..7fdc6f9dc8 100644
--- a/src/lib/libssl/src/crypto/asn1/x_info.c
+++ b/src/lib/libssl/src/crypto/asn1/x_info.c
@@ -106,7 +106,8 @@ void X509_INFO_free(X509_INFO *x)
         if (x->x509 != NULL) X509_free(x->x509);
         if (x->crl != NULL) X509_CRL_free(x->crl);
         if (x->x_pkey != NULL) X509_PKEY_free(x->x_pkey);
-        Free((char *)x);
+        if (x->enc_data != NULL) Free(x->enc_data);
+        Free(x);
         }
 
 IMPLEMENT_STACK_OF(X509_INFO)
diff --git a/src/lib/libssl/src/crypto/asn1/x_name.c b/src/lib/libssl/src/crypto/asn1/x_name.c
index b09fba33fb..64baf5719d 100644
--- a/src/lib/libssl/src/crypto/asn1/x_name.c
+++ b/src/lib/libssl/src/crypto/asn1/x_name.c
@@ -253,7 +253,7 @@ void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
         {
         if (a == NULL) return;
         ASN1_OBJECT_free(a->object);
-        ASN1_BIT_STRING_free(a->value);
+        M_ASN1_BIT_STRING_free(a->value);
         Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_pkey.c b/src/lib/libssl/src/crypto/asn1/x_pkey.c
index b0057eb212..fe58919dbb 100644
--- a/src/lib/libssl/src/crypto/asn1/x_pkey.c
+++ b/src/lib/libssl/src/crypto/asn1/x_pkey.c
@@ -112,7 +112,7 @@ X509_PKEY *X509_PKEY_new(void)
         M_ASN1_New_Malloc(ret,X509_PKEY);
         ret->version=0;
         M_ASN1_New(ret->enc_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_pkey,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_pkey,M_ASN1_OCTET_STRING_new);
         ret->dec_pkey=NULL;
         ret->key_length=0;
         ret->key_data=NULL;
@@ -144,8 +144,8 @@ void X509_PKEY_free(X509_PKEY *x)
 #endif
 
         if (x->enc_algor != NULL) X509_ALGOR_free(x->enc_algor);
-        if (x->enc_pkey != NULL) ASN1_OCTET_STRING_free(x->enc_pkey);
+        if (x->enc_pkey != NULL) M_ASN1_OCTET_STRING_free(x->enc_pkey);
         if (x->dec_pkey != NULL)EVP_PKEY_free(x->dec_pkey);
-        if ((x->key_data != NULL) && (x->key_free)) Free((char *)x->key_data);
-        Free((char *)(char *)x);
+        if ((x->key_data != NULL) && (x->key_free)) Free(x->key_data);
+        Free(x);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/x_pubkey.c b/src/lib/libssl/src/crypto/asn1/x_pubkey.c
index 4ac32c59dd..81e9815222 100644
--- a/src/lib/libssl/src/crypto/asn1/x_pubkey.c
+++ b/src/lib/libssl/src/crypto/asn1/x_pubkey.c
@@ -100,7 +100,7 @@ X509_PUBKEY *X509_PUBKEY_new(void)
 
         M_ASN1_New_Malloc(ret,X509_PUBKEY);
         M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->public_key,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->public_key,M_ASN1_BIT_STRING_new);
         ret->pkey=NULL;
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_PUBKEY_NEW);
@@ -110,9 +110,9 @@ void X509_PUBKEY_free(X509_PUBKEY *a)
         {
         if (a == NULL) return;
         X509_ALGOR_free(a->algor);
-        ASN1_BIT_STRING_free(a->public_key);
+        M_ASN1_BIT_STRING_free(a->public_key);
         if (a->pkey != NULL) EVP_PKEY_free(a->pkey);
-        Free((char *)a);
+        Free(a);
         }
 
 int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
@@ -176,7 +176,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
         if ((s=(unsigned char *)Malloc(i+1)) == NULL) goto err;
         p=s;
         i2d_PublicKey(pkey,&p);
-        if (!ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err;
+        if (!M_ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err;
         /* Set number of unused bits to zero */
         pk->public_key->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
         pk->public_key->flags|=ASN1_STRING_FLAG_BITS_LEFT;
@@ -252,3 +252,113 @@ err:
         return(NULL);
         }
 
+/* Now two pseudo ASN1 routines that take an EVP_PKEY structure
+ * and encode or decode as X509_PUBKEY
+ */
+
+EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, unsigned char **pp,
+             long length)
+{
+        X509_PUBKEY *xpk;
+        EVP_PKEY *pktmp;
+        xpk = d2i_X509_PUBKEY(NULL, pp, length);
+        if(!xpk) return NULL;
+        pktmp = X509_PUBKEY_get(xpk);
+        X509_PUBKEY_free(xpk);
+        if(!pktmp) return NULL;
+        if(a) {
+                EVP_PKEY_free(*a);
+                *a = pktmp;
+        }
+        return pktmp;
+}
+
+int i2d_PUBKEY(EVP_PKEY *a, unsigned char **pp)
+{
+        X509_PUBKEY *xpk=NULL;
+        int ret;
+        if(!a) return 0;
+        if(!X509_PUBKEY_set(&xpk, a)) return 0;
+        ret = i2d_X509_PUBKEY(xpk, pp);
+        X509_PUBKEY_free(xpk);
+        return ret;
+}
+
+/* The following are equivalents but which return RSA and DSA
+ * keys
+ */
+#ifndef NO_RSA
+RSA *d2i_RSA_PUBKEY(RSA **a, unsigned char **pp,
+             long length)
+{
+        EVP_PKEY *pkey;
+        RSA *key;
+        unsigned char *q;
+        q = *pp;
+        pkey = d2i_PUBKEY(NULL, &q, length);
+        if(!pkey) return NULL;
+        key = EVP_PKEY_get1_RSA(pkey);
+        EVP_PKEY_free(pkey);
+        if(!key) return NULL;
+        *pp = q;
+        if(a) {
+                RSA_free(*a);
+                *a = key;
+        }
+        return key;
+}
+
+int i2d_RSA_PUBKEY(RSA *a, unsigned char **pp)
+{
+        EVP_PKEY *pktmp;
+        int ret;
+        if(!a) return 0;
+        pktmp = EVP_PKEY_new();
+        if(!pktmp) {
+                ASN1err(ASN1_F_I2D_RSA_PUBKEY, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        EVP_PKEY_set1_RSA(pktmp, a);
+        ret = i2d_PUBKEY(pktmp, pp);
+        EVP_PKEY_free(pktmp);
+        return ret;
+}
+#endif
+
+#ifndef NO_DSA
+DSA *d2i_DSA_PUBKEY(DSA **a, unsigned char **pp,
+             long length)
+{
+        EVP_PKEY *pkey;
+        DSA *key;
+        unsigned char *q;
+        q = *pp;
+        pkey = d2i_PUBKEY(NULL, &q, length);
+        if(!pkey) return NULL;
+        key = EVP_PKEY_get1_DSA(pkey);
+        EVP_PKEY_free(pkey);
+        if(!key) return NULL;
+        *pp = q;
+        if(a) {
+                DSA_free(*a);
+                *a = key;
+        }
+        return key;
+}
+
+int i2d_DSA_PUBKEY(DSA *a, unsigned char **pp)
+{
+        EVP_PKEY *pktmp;
+        int ret;
+        if(!a) return 0;
+        pktmp = EVP_PKEY_new();
+        if(!pktmp) {
+                ASN1err(ASN1_F_I2D_DSA_PUBKEY, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        EVP_PKEY_set1_DSA(pktmp, a);
+        ret = i2d_PUBKEY(pktmp, pp);
+        EVP_PKEY_free(pktmp);
+        return ret;
+}
+#endif
diff --git a/src/lib/libssl/src/crypto/asn1/x_req.c b/src/lib/libssl/src/crypto/asn1/x_req.c
index 9b1d6abe64..0cd572ee73 100644
--- a/src/lib/libssl/src/crypto/asn1/x_req.c
+++ b/src/lib/libssl/src/crypto/asn1/x_req.c
@@ -73,7 +73,7 @@ int i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **pp)
          * allow some CA Software to accept the cert request.
          * It is not following the PKCS standards ...
          * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
          * NOTE: no OPTIONAL ... so it *must* be there
          */
         if (a->req_kludge) 
@@ -94,7 +94,7 @@ int i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **pp)
         /* this is a *nasty* hack reported to be required by some CA's.
          * It is not following the PKCS standards ...
          * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
          * NOTE: no OPTIONAL ... so it *must* be there
          */
         if (a->req_kludge)
@@ -126,7 +126,7 @@ X509_REQ_INFO *d2i_X509_REQ_INFO(X509_REQ_INFO **a, unsigned char **pp,
          * have been reported as requiring it.
          * It is not following the PKCS standards ...
          * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
          * NOTE: no OPTIONAL ... so it *must* be there
          */
         if (asn1_Finish(&c))
@@ -147,7 +147,7 @@ X509_REQ_INFO *X509_REQ_INFO_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,X509_REQ_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->subject,X509_NAME_new);
         M_ASN1_New(ret->pubkey,X509_PUBKEY_new);
         M_ASN1_New(ret->attributes,sk_X509_ATTRIBUTE_new_null);
@@ -159,11 +159,11 @@ X509_REQ_INFO *X509_REQ_INFO_new(void)
 void X509_REQ_INFO_free(X509_REQ_INFO *a)
         {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         X509_NAME_free(a->subject);
         X509_PUBKEY_free(a->pubkey);
         sk_X509_ATTRIBUTE_pop_free(a->attributes,X509_ATTRIBUTE_free);
-        Free((char *)a);
+        Free(a);
         }
 
 int i2d_X509_REQ(X509_REQ *a, unsigned char **pp)
@@ -203,7 +203,7 @@ X509_REQ *X509_REQ_new(void)
         ret->references=1;
         M_ASN1_New(ret->req_info,X509_REQ_INFO_new);
         M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_REQ_NEW);
         }
@@ -229,8 +229,8 @@ void X509_REQ_free(X509_REQ *a)
 
         X509_REQ_INFO_free(a->req_info);
         X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
+        M_ASN1_BIT_STRING_free(a->signature);
+        Free(a);
         }
 
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_sig.c b/src/lib/libssl/src/crypto/asn1/x_sig.c
index c2782d1b9c..3559bd5368 100644
--- a/src/lib/libssl/src/crypto/asn1/x_sig.c
+++ b/src/lib/libssl/src/crypto/asn1/x_sig.c
@@ -94,7 +94,7 @@ X509_SIG *X509_SIG_new(void)
 
         M_ASN1_New_Malloc(ret,X509_SIG);
         M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->digest,M_ASN1_OCTET_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_SIG_NEW);
         }
@@ -103,8 +103,8 @@ void X509_SIG_free(X509_SIG *a)
         {
         if (a == NULL) return;
         X509_ALGOR_free(a->algor);
-        ASN1_OCTET_STRING_free(a->digest);
-        Free((char *)a);
+        M_ASN1_OCTET_STRING_free(a->digest);
+        Free(a);
         }
 
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_spki.c b/src/lib/libssl/src/crypto/asn1/x_spki.c
index 43e0023839..8f5e7e6380 100644
--- a/src/lib/libssl/src/crypto/asn1/x_spki.c
+++ b/src/lib/libssl/src/crypto/asn1/x_spki.c
@@ -57,7 +57,7 @@
  */
 
  /* This module was send to me my Pat Richards <patr@x509.com> who
-  * wrote it.  It is under my Copyright with his permision
+  * wrote it.  It is under my Copyright with his permission
   */
 
 #include <stdio.h>
@@ -99,7 +99,7 @@ NETSCAPE_SPKAC *NETSCAPE_SPKAC_new(void)
 
         M_ASN1_New_Malloc(ret,NETSCAPE_SPKAC);
         M_ASN1_New(ret->pubkey,X509_PUBKEY_new);
-        M_ASN1_New(ret->challenge,ASN1_IA5STRING_new);
+        M_ASN1_New(ret->challenge,M_ASN1_IA5STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_NETSCAPE_SPKAC_NEW);
         }
@@ -108,8 +108,8 @@ void NETSCAPE_SPKAC_free(NETSCAPE_SPKAC *a)
         {
         if (a == NULL) return;
         X509_PUBKEY_free(a->pubkey);
-        ASN1_IA5STRING_free(a->challenge);
-        Free((char *)a);
+        M_ASN1_IA5STRING_free(a->challenge);
+        Free(a);
         }
 
 int i2d_NETSCAPE_SPKI(NETSCAPE_SPKI *a, unsigned char **pp)
@@ -150,7 +150,7 @@ NETSCAPE_SPKI *NETSCAPE_SPKI_new(void)
         M_ASN1_New_Malloc(ret,NETSCAPE_SPKI);
         M_ASN1_New(ret->spkac,NETSCAPE_SPKAC_new);
         M_ASN1_New(ret->sig_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_NETSCAPE_SPKI_NEW);
         }
@@ -160,7 +160,7 @@ void NETSCAPE_SPKI_free(NETSCAPE_SPKI *a)
         if (a == NULL) return;
         NETSCAPE_SPKAC_free(a->spkac);
         X509_ALGOR_free(a->sig_algor);
-        ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
+        M_ASN1_BIT_STRING_free(a->signature);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_val.c b/src/lib/libssl/src/crypto/asn1/x_val.c
index 84d6f7ca4d..1a2f49ffdf 100644
--- a/src/lib/libssl/src/crypto/asn1/x_val.c
+++ b/src/lib/libssl/src/crypto/asn1/x_val.c
@@ -93,8 +93,8 @@ X509_VAL *X509_VAL_new(void)
         ASN1_CTX c;
 
         M_ASN1_New_Malloc(ret,X509_VAL);
-        M_ASN1_New(ret->notBefore,ASN1_TIME_new);
-        M_ASN1_New(ret->notAfter,ASN1_TIME_new);
+        M_ASN1_New(ret->notBefore,M_ASN1_TIME_new);
+        M_ASN1_New(ret->notAfter,M_ASN1_TIME_new);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_VAL_NEW);
         }
@@ -102,8 +102,8 @@ X509_VAL *X509_VAL_new(void)
 void X509_VAL_free(X509_VAL *a)
         {
         if (a == NULL) return;
-        ASN1_TIME_free(a->notBefore);
-        ASN1_TIME_free(a->notAfter);
-        Free((char *)a);
+        M_ASN1_TIME_free(a->notBefore);
+        M_ASN1_TIME_free(a->notAfter);
+        Free(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_x509.c b/src/lib/libssl/src/crypto/asn1/x_x509.c
index 7abf6b2a6b..11e564ea30 100644
--- a/src/lib/libssl/src/crypto/asn1/x_x509.c
+++ b/src/lib/libssl/src/crypto/asn1/x_x509.c
@@ -62,6 +62,9 @@
 #include <openssl/asn1_mac.h>
 #include <openssl/x509.h>
 
+static int x509_meth_num = 0;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_meth = NULL;
+
 static ASN1_METHOD meth={
         (int (*)())  i2d_X509,
         (char *(*)())d2i_X509,
@@ -113,10 +116,13 @@ X509 *X509_new(void)
         M_ASN1_New_Malloc(ret,X509);
         ret->references=1;
         ret->valid=0;
+        ret->ex_flags = 0;
         ret->name=NULL;
+        ret->aux=NULL;
         M_ASN1_New(ret->cert_info,X509_CINF_new);
         M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
+        CRYPTO_new_ex_data(x509_meth, ret, &ret->ex_data);
         return(ret);
         M_ASN1_New_Error(ASN1_F_X509_NEW);
         }
@@ -140,12 +146,65 @@ void X509_free(X509 *a)
                 }
 #endif
 
-        /* CRYPTO_free_ex_data(bio_meth,(char *)a,&a->ex_data); */
+        CRYPTO_free_ex_data(x509_meth,a,&a->ex_data);
         X509_CINF_free(a->cert_info);
         X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
+        M_ASN1_BIT_STRING_free(a->signature);
+        X509_CERT_AUX_free(a->aux);
 
         if (a->name != NULL) Free(a->name);
-        Free((char *)a);
+        Free(a);
+        }
+
+int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        x509_meth_num++;
+        return(CRYPTO_get_ex_new_index(x509_meth_num-1,
+                &x509_meth,argl,argp,new_func,dup_func,free_func));
+        }
+
+int X509_set_ex_data(X509 *r, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
         }
 
+void *X509_get_ex_data(X509 *r, int idx)
+        {
+        return(CRYPTO_get_ex_data(&r->ex_data,idx));
+        }
+
+/* X509_AUX ASN1 routines. X509_AUX is the name given to
+ * a certificate with extra info tagged on the end. Since these
+ * functions set how a certificate is trusted they should only
+ * be used when the certificate comes from a reliable source
+ * such as local storage.
+ *
+ */
+
+X509 *d2i_X509_AUX(X509 **a, unsigned char **pp, long length)
+{
+        unsigned char *q;
+        X509 *ret;
+        /* Save start position */
+        q = *pp;
+        ret = d2i_X509(a, pp, length);
+        /* If certificate unreadable then forget it */
+        if(!ret) return NULL;
+        /* update length */
+        length -= *pp - q;
+        if(!length) return ret;
+        if(!d2i_X509_CERT_AUX(&ret->aux, pp, length)) goto err;
+        return ret;
+        err:
+        X509_free(ret);
+        return NULL;
+}
+
+int i2d_X509_AUX(X509 *a, unsigned char **pp)
+{
+        int length;
+        length = i2d_X509(a, pp);
+        if(a) length += i2d_X509_CERT_AUX(a->aux, pp);
+        return length;
+}
diff --git a/src/lib/libssl/src/crypto/asn1/x_x509a.c b/src/lib/libssl/src/crypto/asn1/x_x509a.c
new file mode 100644
index 0000000000..b9987ea968
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/x_x509a.c
@@ -0,0 +1,200 @@
+/* a_x509a.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/asn1_mac.h>
+#include <openssl/x509.h>
+
+/* X509_CERT_AUX routines. These are used to encode additional
+ * user modifiable data about a certificate. This data is
+ * appended to the X509 encoding when the *_X509_AUX routines
+ * are used. This means that the "traditional" X509 routines
+ * will simply ignore the extra data. 
+ */
+
+static X509_CERT_AUX *aux_get(X509 *x);
+
+X509_CERT_AUX *d2i_X509_CERT_AUX(X509_CERT_AUX **a, unsigned char **pp, long length)
+{
+        M_ASN1_D2I_vars(a, X509_CERT_AUX *, X509_CERT_AUX_new);
+        
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+
+        M_ASN1_D2I_get_seq_opt_type(ASN1_OBJECT, ret->trust,
+                                        d2i_ASN1_OBJECT, ASN1_OBJECT_free);
+        M_ASN1_D2I_get_IMP_set_opt_type(ASN1_OBJECT, ret->reject,
+                                        d2i_ASN1_OBJECT, ASN1_OBJECT_free, 0);
+        M_ASN1_D2I_get_opt(ret->alias, d2i_ASN1_UTF8STRING, V_ASN1_UTF8STRING);
+        M_ASN1_D2I_get_opt(ret->keyid, d2i_ASN1_OCTET_STRING, V_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_IMP_set_opt_type(X509_ALGOR, ret->other,
+                                        d2i_X509_ALGOR, X509_ALGOR_free, 1);
+
+        M_ASN1_D2I_Finish(a, X509_CERT_AUX_free, ASN1_F_D2I_X509_CERT_AUX);
+}
+
+X509_CERT_AUX *X509_CERT_AUX_new()
+{
+        X509_CERT_AUX *ret = NULL;
+        ASN1_CTX c;
+        M_ASN1_New_Malloc(ret, X509_CERT_AUX);
+        ret->trust = NULL;
+        ret->reject = NULL;
+        ret->alias = NULL;
+        ret->keyid = NULL;
+        ret->other = NULL;
+        return(ret);
+        M_ASN1_New_Error(ASN1_F_X509_CERT_AUX_NEW);
+}
+
+void X509_CERT_AUX_free(X509_CERT_AUX *a)
+{
+        if(a == NULL) return;
+        sk_ASN1_OBJECT_pop_free(a->trust, ASN1_OBJECT_free);
+        sk_ASN1_OBJECT_pop_free(a->reject, ASN1_OBJECT_free);
+        ASN1_UTF8STRING_free(a->alias);
+        ASN1_OCTET_STRING_free(a->keyid);
+        sk_X509_ALGOR_pop_free(a->other, X509_ALGOR_free);
+        Free(a);
+}
+
+int i2d_X509_CERT_AUX(X509_CERT_AUX *a, unsigned char **pp)
+{
+        M_ASN1_I2D_vars(a);
+
+        M_ASN1_I2D_len_SEQUENCE_opt_type(ASN1_OBJECT, a->trust, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_len_IMP_SEQUENCE_opt_type(ASN1_OBJECT, a->reject, i2d_ASN1_OBJECT, 0);
+
+        M_ASN1_I2D_len(a->alias, i2d_ASN1_UTF8STRING);
+        M_ASN1_I2D_len(a->keyid, i2d_ASN1_OCTET_STRING);
+        M_ASN1_I2D_len_IMP_SEQUENCE_opt_type(X509_ALGOR, a->other, i2d_X509_ALGOR, 1);
+
+        M_ASN1_I2D_seq_total();
+
+        M_ASN1_I2D_put_SEQUENCE_opt_type(ASN1_OBJECT, a->trust, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_put_IMP_SEQUENCE_opt_type(ASN1_OBJECT, a->reject, i2d_ASN1_OBJECT, 0);
+
+        M_ASN1_I2D_put(a->alias, i2d_ASN1_UTF8STRING);
+        M_ASN1_I2D_put(a->keyid, i2d_ASN1_OCTET_STRING);
+        M_ASN1_I2D_put_IMP_SEQUENCE_opt_type(X509_ALGOR, a->other, i2d_X509_ALGOR, 1);
+
+        M_ASN1_I2D_finish();
+}
+
+static X509_CERT_AUX *aux_get(X509 *x)
+{
+        if(!x) return NULL;
+        if(!x->aux && !(x->aux = X509_CERT_AUX_new())) return NULL;
+        return x->aux;
+}
+
+int X509_alias_set1(X509 *x, unsigned char *name, int len)
+{
+        X509_CERT_AUX *aux;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->alias && !(aux->alias = ASN1_UTF8STRING_new())) return 0;
+        return ASN1_STRING_set(aux->alias, name, len);
+}
+
+unsigned char *X509_alias_get0(X509 *x, int *len)
+{
+        if(!x->aux || !x->aux->alias) return NULL;
+        if(len) *len = x->aux->alias->length;
+        return x->aux->alias->data;
+}
+
+int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj)
+{
+        X509_CERT_AUX *aux;
+        ASN1_OBJECT *objtmp;
+        if(!(objtmp = OBJ_dup(obj))) return 0;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->trust
+                && !(aux->trust = sk_ASN1_OBJECT_new_null())) return 0;
+        return sk_ASN1_OBJECT_push(aux->trust, objtmp);
+}
+
+int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj)
+{
+        X509_CERT_AUX *aux;
+        ASN1_OBJECT *objtmp;
+        if(!(objtmp = OBJ_dup(obj))) return 0;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->reject
+                && !(aux->reject = sk_ASN1_OBJECT_new_null())) return 0;
+        return sk_ASN1_OBJECT_push(aux->reject, objtmp);
+}
+
+void X509_trust_clear(X509 *x)
+{
+        if(x->aux && x->aux->trust) {
+                sk_ASN1_OBJECT_pop_free(x->aux->trust, ASN1_OBJECT_free);
+                x->aux->trust = NULL;
+        }
+}
+
+void X509_reject_clear(X509 *x)
+{
+        if(x->aux && x->aux->reject) {
+                sk_ASN1_OBJECT_pop_free(x->aux->reject, ASN1_OBJECT_free);
+                x->aux->reject = NULL;
+        }
+}
+
diff --git a/src/lib/libssl/src/crypto/bf/bf_cbc.c b/src/lib/libssl/src/crypto/bf/bf_cbc.c
index 95d1cdcdf9..f949629dc6 100644
--- a/src/lib/libssl/src/crypto/bf/bf_cbc.c
+++ b/src/lib/libssl/src/crypto/bf/bf_cbc.c
@@ -59,8 +59,8 @@
 #include <openssl/blowfish.h>
 #include "bf_locl.h"
 
-void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
-             BF_KEY *ks, unsigned char *iv, int encrypt)
+void BF_cbc_encrypt(const unsigned char *in, unsigned char *out, long length,
+             const BF_KEY *schedule, unsigned char *ivec, int encrypt)
         {
         register BF_LONG tin0,tin1;
         register BF_LONG tout0,tout1,xor0,xor1;
@@ -69,9 +69,9 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
 
         if (encrypt)
                 {
-                n2l(iv,tout0);
-                n2l(iv,tout1);
-                iv-=8;
+                n2l(ivec,tout0);
+                n2l(ivec,tout1);
+                ivec-=8;
                 for (l-=8; l>=0; l-=8)
                         {
                         n2l(in,tin0);
@@ -80,7 +80,7 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         tin1^=tout1;
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_encrypt(tin,ks);
+                        BF_encrypt(tin,schedule);
                         tout0=tin[0];
                         tout1=tin[1];
                         l2n(tout0,out);
@@ -93,27 +93,27 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         tin1^=tout1;
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_encrypt(tin,ks);
+                        BF_encrypt(tin,schedule);
                         tout0=tin[0];
                         tout1=tin[1];
                         l2n(tout0,out);
                         l2n(tout1,out);
                         }
-                l2n(tout0,iv);
-                l2n(tout1,iv);
+                l2n(tout0,ivec);
+                l2n(tout1,ivec);
                 }
         else
                 {
-                n2l(iv,xor0);
-                n2l(iv,xor1);
-                iv-=8;
+                n2l(ivec,xor0);
+                n2l(ivec,xor1);
+                ivec-=8;
                 for (l-=8; l>=0; l-=8)
                         {
                         n2l(in,tin0);
                         n2l(in,tin1);
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_decrypt(tin,ks);
+                        BF_decrypt(tin,schedule);
                         tout0=tin[0]^xor0;
                         tout1=tin[1]^xor1;
                         l2n(tout0,out);
@@ -127,15 +127,15 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         n2l(in,tin1);
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_decrypt(tin,ks);
+                        BF_decrypt(tin,schedule);
                         tout0=tin[0]^xor0;
                         tout1=tin[1]^xor1;
                         l2nn(tout0,tout1,out,l+8);
                         xor0=tin0;
                         xor1=tin1;
                         }
-                l2n(xor0,iv);
-                l2n(xor1,iv);
+                l2n(xor0,ivec);
+                l2n(xor1,ivec);
                 }
         tin0=tin1=tout0=tout1=xor0=xor1=0;
         tin[0]=tin[1]=0;
diff --git a/src/lib/libssl/src/crypto/bf/bf_cfb64.c b/src/lib/libssl/src/crypto/bf/bf_cfb64.c
index 1fb8905f49..6451c8d407 100644
--- a/src/lib/libssl/src/crypto/bf/bf_cfb64.c
+++ b/src/lib/libssl/src/crypto/bf/bf_cfb64.c
@@ -64,8 +64,8 @@
  * 64bit block we have used is contained in *num;
  */
 
-void BF_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
-             BF_KEY *schedule, unsigned char *ivec, int *num, int encrypt)
+void BF_cfb64_encrypt(const unsigned char *in, unsigned char *out, long length,
+             const BF_KEY *schedule, unsigned char *ivec, int *num, int encrypt)
         {
         register BF_LONG v0,v1,t;
         register int n= *num;
diff --git a/src/lib/libssl/src/crypto/bf/bf_ecb.c b/src/lib/libssl/src/crypto/bf/bf_ecb.c
index 9f8a24cdff..341991636f 100644
--- a/src/lib/libssl/src/crypto/bf/bf_ecb.c
+++ b/src/lib/libssl/src/crypto/bf/bf_ecb.c
@@ -61,11 +61,11 @@
 #include <openssl/opensslv.h>
 
 /* Blowfish as implemented from 'Blowfish: Springer-Verlag paper'
- * (From LECTURE NOTES IN COIMPUTER SCIENCE 809, FAST SOFTWARE ENCRYPTION,
+ * (From LECTURE NOTES IN COMPUTER SCIENCE 809, FAST SOFTWARE ENCRYPTION,
  * CAMBRIDGE SECURITY WORKSHOP, CAMBRIDGE, U.K., DECEMBER 9-11, 1993)
  */
 
-const char *BF_version="BlowFish" OPENSSL_VERSION_PTEXT;
+const char *BF_version="Blowfish" OPENSSL_VERSION_PTEXT;
 
 const char *BF_options(void)
         {
@@ -78,17 +78,17 @@ const char *BF_options(void)
 #endif
         }
 
-void BF_ecb_encrypt(unsigned char *in, unsigned char *out, BF_KEY *ks,
-             int encrypt)
+void BF_ecb_encrypt(const unsigned char *in, unsigned char *out,
+             const BF_KEY *key, int encrypt)
         {
         BF_LONG l,d[2];
 
         n2l(in,l); d[0]=l;
         n2l(in,l); d[1]=l;
         if (encrypt)
-                BF_encrypt(d,ks);
+                BF_encrypt(d,key);
         else
-                BF_decrypt(d,ks);
+                BF_decrypt(d,key);
         l=d[0]; l2n(l,out);
         l=d[1]; l2n(l,out);
         l=d[0]=d[1]=0;
diff --git a/src/lib/libssl/src/crypto/bf/bf_enc.c b/src/lib/libssl/src/crypto/bf/bf_enc.c
index ee01834561..b380acf959 100644
--- a/src/lib/libssl/src/crypto/bf/bf_enc.c
+++ b/src/lib/libssl/src/crypto/bf/bf_enc.c
@@ -60,7 +60,7 @@
 #include "bf_locl.h"
 
 /* Blowfish as implemented from 'Blowfish: Springer-Verlag paper'
- * (From LECTURE NOTES IN COIMPUTER SCIENCE 809, FAST SOFTWARE ENCRYPTION,
+ * (From LECTURE NOTES IN COMPUTER SCIENCE 809, FAST SOFTWARE ENCRYPTION,
  * CAMBRIDGE SECURITY WORKSHOP, CAMBRIDGE, U.K., DECEMBER 9-11, 1993)
  */
 
@@ -69,10 +69,11 @@
 to modify the code.
 #endif
 
-void BF_encrypt(BF_LONG *data, BF_KEY *key)
+void BF_encrypt(BF_LONG *data, const BF_KEY *key)
         {
 #ifndef BF_PTR2
-        register BF_LONG l,r,*p,*s;
+        register BF_LONG l,r;
+    const register BF_LONG *p,*s;
 
         p=key->P;
         s= &(key->S[0]);
@@ -145,10 +146,11 @@ void BF_encrypt(BF_LONG *data, BF_KEY *key)
 
 #ifndef BF_DEFAULT_OPTIONS
 
-void BF_decrypt(BF_LONG *data, BF_KEY *key)
+void BF_decrypt(BF_LONG *data, const BF_KEY *key)
         {
 #ifndef BF_PTR2
-        register BF_LONG l,r,*p,*s;
+        register BF_LONG l,r;
+    const register BF_LONG *p,*s;
 
         p=key->P;
         s= &(key->S[0]);
@@ -219,8 +221,8 @@ void BF_decrypt(BF_LONG *data, BF_KEY *key)
 #endif
         }
 
-void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
-             BF_KEY *ks, unsigned char *iv, int encrypt)
+void BF_cbc_encrypt(const unsigned char *in, unsigned char *out, long length,
+             const BF_KEY *schedule, unsigned char *ivec, int encrypt)
         {
         register BF_LONG tin0,tin1;
         register BF_LONG tout0,tout1,xor0,xor1;
@@ -229,9 +231,9 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
 
         if (encrypt)
                 {
-                n2l(iv,tout0);
-                n2l(iv,tout1);
-                iv-=8;
+                n2l(ivec,tout0);
+                n2l(ivec,tout1);
+                ivec-=8;
                 for (l-=8; l>=0; l-=8)
                         {
                         n2l(in,tin0);
@@ -240,7 +242,7 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         tin1^=tout1;
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_encrypt(tin,ks);
+                        BF_encrypt(tin,schedule);
                         tout0=tin[0];
                         tout1=tin[1];
                         l2n(tout0,out);
@@ -253,27 +255,27 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         tin1^=tout1;
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_encrypt(tin,ks);
+                        BF_encrypt(tin,schedule);
                         tout0=tin[0];
                         tout1=tin[1];
                         l2n(tout0,out);
                         l2n(tout1,out);
                         }
-                l2n(tout0,iv);
-                l2n(tout1,iv);
+                l2n(tout0,ivec);
+                l2n(tout1,ivec);
                 }
         else
                 {
-                n2l(iv,xor0);
-                n2l(iv,xor1);
-                iv-=8;
+                n2l(ivec,xor0);
+                n2l(ivec,xor1);
+                ivec-=8;
                 for (l-=8; l>=0; l-=8)
                         {
                         n2l(in,tin0);
                         n2l(in,tin1);
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_decrypt(tin,ks);
+                        BF_decrypt(tin,schedule);
                         tout0=tin[0]^xor0;
                         tout1=tin[1]^xor1;
                         l2n(tout0,out);
@@ -287,15 +289,15 @@ void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
                         n2l(in,tin1);
                         tin[0]=tin0;
                         tin[1]=tin1;
-                        BF_decrypt(tin,ks);
+                        BF_decrypt(tin,schedule);
                         tout0=tin[0]^xor0;
                         tout1=tin[1]^xor1;
                         l2nn(tout0,tout1,out,l+8);
                         xor0=tin0;
                         xor1=tin1;
                         }
-                l2n(xor0,iv);
-                l2n(xor1,iv);
+                l2n(xor0,ivec);
+                l2n(xor1,ivec);
                 }
         tin0=tin1=tout0=tout1=xor0=xor1=0;
         tin[0]=tin[1]=0;
diff --git a/src/lib/libssl/src/crypto/bf/bf_locl.h b/src/lib/libssl/src/crypto/bf/bf_locl.h
index 05756b5d3b..cc7c3ec992 100644
--- a/src/lib/libssl/src/crypto/bf/bf_locl.h
+++ b/src/lib/libssl/src/crypto/bf/bf_locl.h
@@ -148,7 +148,7 @@
                          *((c)++)=(unsigned char)(((l)>> 8L)&0xff), \
                          *((c)++)=(unsigned char)(((l)     )&0xff))
 
-/* This is actually a big endian algorithm, the most significate byte
+/* This is actually a big endian algorithm, the most significant byte
  * is used to lookup array 0 */
 
 #if defined(BF_PTR2)
@@ -183,8 +183,8 @@
 
 /*
  * This is normally very good on RISC platforms where normally you
- * have to explicitely "multiplicate" array index by sizeof(BF_LONG)
- * in order to caclulate the effective address. This implementation
+ * have to explicitly "multiply" array index by sizeof(BF_LONG)
+ * in order to calculate the effective address. This implementation
  * excuses CPU from this extra work. Power[PC] uses should have most
  * fun as (R>>BF_i)&BF_M gets folded into a single instruction, namely
  * rlwinm. So let'em double-check if their compiler does it.
diff --git a/src/lib/libssl/src/crypto/bf/bf_ofb64.c b/src/lib/libssl/src/crypto/bf/bf_ofb64.c
index 8ceb8d9bda..f2a9ff6e41 100644
--- a/src/lib/libssl/src/crypto/bf/bf_ofb64.c
+++ b/src/lib/libssl/src/crypto/bf/bf_ofb64.c
@@ -63,8 +63,8 @@
  * used.  The extra state information to record how much of the
  * 64bit block we have used is contained in *num;
  */
-void BF_ofb64_encrypt(unsigned char *in, unsigned char *out, long length,
-             BF_KEY *schedule, unsigned char *ivec, int *num)
+void BF_ofb64_encrypt(const unsigned char *in, unsigned char *out, long length,
+             const BF_KEY *schedule, unsigned char *ivec, int *num)
         {
         register BF_LONG v0,v1,t;
         register int n= *num;
diff --git a/src/lib/libssl/src/crypto/bf/bf_opts.c b/src/lib/libssl/src/crypto/bf/bf_opts.c
index 5f330cc53c..bbe32b28c9 100644
--- a/src/lib/libssl/src/crypto/bf/bf_opts.c
+++ b/src/lib/libssl/src/crypto/bf/bf_opts.c
@@ -242,7 +242,7 @@ int main(int argc, char **argv)
                 }
 
 #ifndef TIMES
-        fprintf(stderr,"To get the most acurate results, try to run this\n");
+        fprintf(stderr,"To get the most accurate results, try to run this\n");
         fprintf(stderr,"program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libssl/src/crypto/bf/bf_pi.h b/src/lib/libssl/src/crypto/bf/bf_pi.h
index 417b935538..9949513c68 100644
--- a/src/lib/libssl/src/crypto/bf/bf_pi.h
+++ b/src/lib/libssl/src/crypto/bf/bf_pi.h
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
-static BF_KEY bf_init= {
+static const BF_KEY bf_init= {
         {
         0x243f6a88L, 0x85a308d3L, 0x13198a2eL, 0x03707344L,
         0xa4093822L, 0x299f31d0L, 0x082efa98L, 0xec4e6c89L,
diff --git a/src/lib/libssl/src/crypto/bf/bf_skey.c b/src/lib/libssl/src/crypto/bf/bf_skey.c
index eefa8e6f51..4d6a232fe0 100644
--- a/src/lib/libssl/src/crypto/bf/bf_skey.c
+++ b/src/lib/libssl/src/crypto/bf/bf_skey.c
@@ -62,11 +62,11 @@
 #include "bf_locl.h"
 #include "bf_pi.h"
 
-void BF_set_key(BF_KEY *key, int len, unsigned char *data)
+void BF_set_key(BF_KEY *key, int len, const unsigned char *data)
         {
         int i;
         BF_LONG *p,ri,in[2];
-        unsigned char *d,*end;
+        const unsigned char *d,*end;
 
 
         memcpy((char *)key,(char *)&bf_init,sizeof(BF_KEY));
diff --git a/src/lib/libssl/src/crypto/bf/bfspeed.c b/src/lib/libssl/src/crypto/bf/bfspeed.c
index 9b893e92cc..ecc9dff4e4 100644
--- a/src/lib/libssl/src/crypto/bf/bfspeed.c
+++ b/src/lib/libssl/src/crypto/bf/bfspeed.c
@@ -183,7 +183,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libssl/src/crypto/bf/bftest.c b/src/lib/libssl/src/crypto/bf/bftest.c
index 6ecd2609a9..5695250195 100644
--- a/src/lib/libssl/src/crypto/bf/bftest.c
+++ b/src/lib/libssl/src/crypto/bf/bftest.c
@@ -76,18 +76,18 @@ int main(int argc, char *argv[])
 #include <openssl/ebcdic.h>
 #endif
 
-char *bf_key[2]={
+static char *bf_key[2]={
         "abcdefghijklmnopqrstuvwxyz",
         "Who is John Galt?"
         };
 
 /* big endian */
-BF_LONG bf_plain[2][2]={
+static BF_LONG bf_plain[2][2]={
         {0x424c4f57L,0x46495348L},
         {0xfedcba98L,0x76543210L}
         };
 
-BF_LONG bf_cipher[2][2]={
+static BF_LONG bf_cipher[2][2]={
         {0x324ed0feL,0xf413a203L},
         {0xcc91732bL,0x8022f684L}
         };
@@ -228,16 +228,16 @@ static unsigned char ofb64_ok[]={
         0x63,0xC2,0xCF,0x80,0xDA};
 
 #define KEY_TEST_NUM    25
-unsigned char key_test[KEY_TEST_NUM]={
+static unsigned char key_test[KEY_TEST_NUM]={
         0xf0,0xe1,0xd2,0xc3,0xb4,0xa5,0x96,0x87,
         0x78,0x69,0x5a,0x4b,0x3c,0x2d,0x1e,0x0f,
         0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
         0x88};
 
-unsigned char key_data[8]=
+static unsigned char key_data[8]=
         {0xFE,0xDC,0xBA,0x98,0x76,0x54,0x32,0x10};
 
-unsigned char key_out[KEY_TEST_NUM][8]={
+static unsigned char key_out[KEY_TEST_NUM][8]={
         {0xF9,0xAD,0x59,0x7C,0x49,0xDB,0x00,0x5E},
         {0xE9,0x1D,0x21,0xC1,0xD9,0x61,0xA6,0xD6},
         {0xE9,0xC2,0xB7,0x0A,0x1B,0xC6,0x5C,0xF3},
diff --git a/src/lib/libssl/src/crypto/bf/blowfish.h b/src/lib/libssl/src/crypto/bf/blowfish.h
index 02f73b2f30..78acfd63b4 100644
--- a/src/lib/libssl/src/crypto/bf/blowfish.h
+++ b/src/lib/libssl/src/crypto/bf/blowfish.h
@@ -103,17 +103,19 @@ typedef struct bf_key_st
         } BF_KEY;
 
  
-void BF_set_key(BF_KEY *key, int len, unsigned char *data);
-void BF_ecb_encrypt(unsigned char *in,unsigned char *out,BF_KEY *key,
-        int enc);
-void BF_encrypt(BF_LONG *data,BF_KEY *key);
-void BF_decrypt(BF_LONG *data,BF_KEY *key);
-void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
-        BF_KEY *ks, unsigned char *iv, int enc);
-void BF_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
-        BF_KEY *schedule, unsigned char *ivec, int *num, int enc);
-void BF_ofb64_encrypt(unsigned char *in, unsigned char *out, long length,
-        BF_KEY *schedule, unsigned char *ivec, int *num);
+void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
+
+void BF_encrypt(BF_LONG *data,const BF_KEY *key);
+void BF_decrypt(BF_LONG *data,const BF_KEY *key);
+
+void BF_ecb_encrypt(const unsigned char *in, unsigned char *out,
+        const BF_KEY *key, int enc);
+void BF_cbc_encrypt(const unsigned char *in, unsigned char *out, long length,
+        const BF_KEY *schedule, unsigned char *ivec, int enc);
+void BF_cfb64_encrypt(const unsigned char *in, unsigned char *out, long length,
+        const BF_KEY *schedule, unsigned char *ivec, int *num, int enc);
+void BF_ofb64_encrypt(const unsigned char *in, unsigned char *out, long length,
+        const BF_KEY *schedule, unsigned char *ivec, int *num);
 const char *BF_options(void);
 
 #ifdef  __cplusplus
diff --git a/src/lib/libssl/src/crypto/bio/Makefile.ssl b/src/lib/libssl/src/crypto/bio/Makefile.ssl
index d9c381d263..2e7480ead9 100644
--- a/src/lib/libssl/src/crypto/bio/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/bio/Makefile.ssl
@@ -90,17 +90,20 @@ b_dump.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 b_dump.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 b_dump.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 b_dump.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-b_dump.o: ../../include/openssl/stack.h ../cryptlib.h
+b_dump.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+b_dump.o: ../cryptlib.h
 b_print.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 b_print.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 b_print.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 b_print.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-b_print.o: ../../include/openssl/stack.h ../cryptlib.h
+b_print.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+b_print.o: ../cryptlib.h
 b_sock.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 b_sock.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 b_sock.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 b_sock.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-b_sock.o: ../../include/openssl/stack.h ../cryptlib.h
+b_sock.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+b_sock.o: ../cryptlib.h
 bf_buff.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 bf_buff.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 bf_buff.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -151,60 +154,65 @@ bio_cb.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bio_cb.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bio_cb.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bio_cb.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bio_cb.o: ../../include/openssl/stack.h ../cryptlib.h
+bio_cb.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bio_cb.o: ../cryptlib.h
 bio_err.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
 bio_err.o: ../../include/openssl/err.h ../../include/openssl/opensslv.h
-bio_err.o: ../../include/openssl/stack.h
+bio_err.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bio_lib.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bio_lib.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bio_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bio_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bio_lib.o: ../../include/openssl/stack.h ../cryptlib.h
+bio_lib.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bio_lib.o: ../cryptlib.h
 bss_acpt.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_acpt.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_acpt.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_acpt.o: ../../include/openssl/opensslconf.h
-bss_acpt.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_acpt.o: ../cryptlib.h
+bss_acpt.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_acpt.o: ../../include/openssl/stack.h ../cryptlib.h
 bss_bio.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
 bss_bio.o: ../../include/openssl/err.h ../../include/openssl/opensslv.h
-bss_bio.o: ../../include/openssl/stack.h
+bss_bio.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bss_conn.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_conn.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_conn.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_conn.o: ../../include/openssl/opensslconf.h
-bss_conn.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_conn.o: ../cryptlib.h
+bss_conn.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_conn.o: ../../include/openssl/stack.h ../cryptlib.h
 bss_fd.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_fd.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_fd.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_fd.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bss_fd.o: ../../include/openssl/stack.h ../cryptlib.h bss_sock.c
+bss_fd.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bss_fd.o: ../cryptlib.h bss_sock.c
 bss_file.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_file.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_file.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_file.o: ../../include/openssl/opensslconf.h
-bss_file.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_file.o: ../cryptlib.h
+bss_file.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_file.o: ../../include/openssl/stack.h ../cryptlib.h
 bss_log.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_log.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_log.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_log.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bss_log.o: ../../include/openssl/stack.h ../cryptlib.h
+bss_log.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bss_log.o: ../cryptlib.h
 bss_mem.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_mem.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_mem.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_mem.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-bss_mem.o: ../../include/openssl/stack.h ../cryptlib.h
+bss_mem.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bss_mem.o: ../cryptlib.h
 bss_null.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_null.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_null.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_null.o: ../../include/openssl/opensslconf.h
-bss_null.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_null.o: ../cryptlib.h
+bss_null.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_null.o: ../../include/openssl/stack.h ../cryptlib.h
 bss_sock.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 bss_sock.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 bss_sock.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 bss_sock.o: ../../include/openssl/opensslconf.h
-bss_sock.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bss_sock.o: ../cryptlib.h
+bss_sock.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bss_sock.o: ../../include/openssl/stack.h ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/bio/b_dump.c b/src/lib/libssl/src/crypto/bio/b_dump.c
index a7cd828978..f5aeb237f5 100644
--- a/src/lib/libssl/src/crypto/bio/b_dump.c
+++ b/src/lib/libssl/src/crypto/bio/b_dump.c
@@ -92,7 +92,7 @@ int BIO_dump(BIO *bio, const char *s, int len)
       if (((i*DUMP_WIDTH)+j)>=len) {
         strcat(buf,"   ");
       } else {
-        ch=((unsigned char)*((char *)(s)+i*DUMP_WIDTH+j)) & 0xff;
+        ch=((unsigned char)*(s+i*DUMP_WIDTH+j)) & 0xff;
         sprintf(tmp,"%02x%c",ch,j==7?'-':' ');
         strcat(buf,tmp);
       }
@@ -101,7 +101,7 @@ int BIO_dump(BIO *bio, const char *s, int len)
     for(j=0;j<DUMP_WIDTH;j++) {
       if (((i*DUMP_WIDTH)+j)>=len)
         break;
-      ch=((unsigned char)*((char *)(s)+i*DUMP_WIDTH+j)) & 0xff;
+      ch=((unsigned char)*(s+i*DUMP_WIDTH+j)) & 0xff;
 #ifndef CHARSET_EBCDIC
       sprintf(tmp,"%c",((ch>=' ')&&(ch<='~'))?ch:'.');
 #else
diff --git a/src/lib/libssl/src/crypto/bio/b_print.c b/src/lib/libssl/src/crypto/bio/b_print.c
index f448004298..2a5e8b58c9 100644
--- a/src/lib/libssl/src/crypto/bio/b_print.c
+++ b/src/lib/libssl/src/crypto/bio/b_print.c
@@ -62,26 +62,649 @@
 
 #include <stdio.h>
 #include <stdarg.h>
+#include <string.h>
+#include <ctype.h>
 #include "cryptlib.h"
+#ifndef NO_SYS_TYPES_H
+#include <sys/types.h>
+#endif
 #include <openssl/bio.h>
 
+#ifdef BN_LLONG
+# ifndef HAVE_LONG_LONG
+#  define HAVE_LONG_LONG
+# endif
+#endif
+
+static void dopr (char *buffer, size_t maxlen, size_t *retlen,
+        const char *format, va_list args);
+
 int BIO_printf (BIO *bio, ...)
         {
         va_list args;
         char *format;
         int ret;
+        size_t retlen;
         MS_STATIC char hugebuf[1024*2]; /* 10k in one chunk is the limit */
 
         va_start(args, bio);
         format=va_arg(args, char *);
 
         hugebuf[0]='\0';
-
-        vsprintf(hugebuf,format,args);
-
-        ret=BIO_write(bio,hugebuf,strlen(hugebuf));
+        dopr(hugebuf, sizeof(hugebuf), &retlen, format, args);
+        ret=BIO_write(bio, hugebuf, (int)retlen);
 
         va_end(args);
         return(ret);
         }
 
+/*
+ * Copyright Patrick Powell 1995
+ * This code is based on code written by Patrick Powell <papowell@astart.com>
+ * It may be used for any purpose as long as this notice remains intact
+ * on all source code distributions.
+ */
+
+/*
+ * This code contains numerious changes and enhancements which were
+ * made by lots of contributors over the last years to Patrick Powell's
+ * original code:
+ *
+ * o Patrick Powell <papowell@astart.com>      (1995)
+ * o Brandon Long <blong@fiction.net>          (1996, for Mutt)
+ * o Thomas Roessler <roessler@guug.de>        (1998, for Mutt)
+ * o Michael Elkins <me@cs.hmc.edu>            (1998, for Mutt)
+ * o Andrew Tridgell <tridge@samba.org>        (1998, for Samba)
+ * o Luke Mewburn <lukem@netbsd.org>           (1999, for LukemFTP)
+ * o Ralf S. Engelschall <rse@engelschall.com> (1999, for Pth)
+ */
+
+#if HAVE_LONG_DOUBLE
+#define LDOUBLE long double
+#else
+#define LDOUBLE double
+#endif
+
+#if HAVE_LONG_LONG
+#define LLONG long long
+#else
+#define LLONG long
+#endif
+
+static void fmtstr     (char *, size_t *, size_t, char *, int, int, int);
+static void fmtint     (char *, size_t *, size_t, LLONG, int, int, int, int);
+static void fmtfp      (char *, size_t *, size_t, LDOUBLE, int, int, int);
+static void dopr_outch (char *, size_t *, size_t, int);
+
+/* format read states */
+#define DP_S_DEFAULT    0
+#define DP_S_FLAGS      1
+#define DP_S_MIN        2
+#define DP_S_DOT        3
+#define DP_S_MAX        4
+#define DP_S_MOD        5
+#define DP_S_CONV       6
+#define DP_S_DONE       7
+
+/* format flags - Bits */
+#define DP_F_MINUS      (1 << 0)
+#define DP_F_PLUS       (1 << 1)
+#define DP_F_SPACE      (1 << 2)
+#define DP_F_NUM        (1 << 3)
+#define DP_F_ZERO       (1 << 4)
+#define DP_F_UP         (1 << 5)
+#define DP_F_UNSIGNED   (1 << 6)
+
+/* conversion flags */
+#define DP_C_SHORT      1
+#define DP_C_LONG       2
+#define DP_C_LDOUBLE    3
+#define DP_C_LLONG      4
+
+/* some handy macros */
+#define char_to_int(p) (p - '0')
+#define MAX(p,q) ((p >= q) ? p : q)
+
+static void
+dopr(
+    char *buffer,
+    size_t maxlen,
+    size_t *retlen,
+    const char *format,
+    va_list args)
+{
+    char ch;
+    LLONG value;
+    LDOUBLE fvalue;
+    char *strvalue;
+    int min;
+    int max;
+    int state;
+    int flags;
+    int cflags;
+    size_t currlen;
+
+    state = DP_S_DEFAULT;
+    flags = currlen = cflags = min = 0;
+    max = -1;
+    ch = *format++;
+
+    while (state != DP_S_DONE) {
+        if ((ch == '\0') || (currlen >= maxlen))
+            state = DP_S_DONE;
+
+        switch (state) {
+        case DP_S_DEFAULT:
+            if (ch == '%')
+                state = DP_S_FLAGS;
+            else
+                dopr_outch(buffer, &currlen, maxlen, ch);
+            ch = *format++;
+            break;
+        case DP_S_FLAGS:
+            switch (ch) {
+            case '-':
+                flags |= DP_F_MINUS;
+                ch = *format++;
+                break;
+            case '+':
+                flags |= DP_F_PLUS;
+                ch = *format++;
+                break;
+            case ' ':
+                flags |= DP_F_SPACE;
+                ch = *format++;
+                break;
+            case '#':
+                flags |= DP_F_NUM;
+                ch = *format++;
+                break;
+            case '0':
+                flags |= DP_F_ZERO;
+                ch = *format++;
+                break;
+            default:
+                state = DP_S_MIN;
+                break;
+            }
+            break;
+        case DP_S_MIN:
+            if (isdigit((unsigned char)ch)) {
+                min = 10 * min + char_to_int(ch);
+                ch = *format++;
+            } else if (ch == '*') {
+                min = va_arg(args, int);
+                ch = *format++;
+                state = DP_S_DOT;
+            } else
+                state = DP_S_DOT;
+            break;
+        case DP_S_DOT:
+            if (ch == '.') {
+                state = DP_S_MAX;
+                ch = *format++;
+            } else
+                state = DP_S_MOD;
+            break;
+        case DP_S_MAX:
+            if (isdigit((unsigned char)ch)) {
+                if (max < 0)
+                    max = 0;
+                max = 10 * max + char_to_int(ch);
+                ch = *format++;
+            } else if (ch == '*') {
+                max = va_arg(args, int);
+                ch = *format++;
+                state = DP_S_MOD;
+            } else
+                state = DP_S_MOD;
+            break;
+        case DP_S_MOD:
+            switch (ch) {
+            case 'h':
+                cflags = DP_C_SHORT;
+                ch = *format++;
+                break;
+            case 'l':
+                if (*format == 'l') {
+                    cflags = DP_C_LLONG;
+                    format++;
+                } else
+                    cflags = DP_C_LONG;
+                ch = *format++;
+                break;
+            case 'q':
+                cflags = DP_C_LLONG;
+                ch = *format++;
+                break;
+            case 'L':
+                cflags = DP_C_LDOUBLE;
+                ch = *format++;
+                break;
+            default:
+                break;
+            }
+            state = DP_S_CONV;
+            break;
+        case DP_S_CONV:
+            switch (ch) {
+            case 'd':
+            case 'i':
+                switch (cflags) {
+                case DP_C_SHORT:
+                    value = (short int)va_arg(args, int);
+                    break;
+                case DP_C_LONG:
+                    value = va_arg(args, long int);
+                    break;
+                case DP_C_LLONG:
+                    value = va_arg(args, LLONG);
+                    break;
+                default:
+                    value = va_arg(args, int);
+                    break;
+                }
+                fmtint(buffer, &currlen, maxlen, value, 10, min, max, flags);
+                break;
+            case 'X':
+                flags |= DP_F_UP;
+                /* FALLTHROUGH */
+            case 'x':
+            case 'o':
+            case 'u':
+                flags |= DP_F_UNSIGNED;
+                switch (cflags) {
+                case DP_C_SHORT:
+                    value = (unsigned short int)va_arg(args, unsigned int);
+                    break;
+                case DP_C_LONG:
+                    value = (LLONG) va_arg(args,
+                        unsigned long int);
+                    break;
+                case DP_C_LLONG:
+                    value = va_arg(args, unsigned LLONG);
+                    break;
+                default:
+                    value = (LLONG) va_arg(args,
+                        unsigned int);
+                    break;
+                }
+                fmtint(buffer, &currlen, maxlen, value,
+                       ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),
+                       min, max, flags);
+                break;
+            case 'f':
+                if (cflags == DP_C_LDOUBLE)
+                    fvalue = va_arg(args, LDOUBLE);
+                else
+                    fvalue = va_arg(args, double);
+                fmtfp(buffer, &currlen, maxlen, fvalue, min, max, flags);
+                break;
+            case 'E':
+                flags |= DP_F_UP;
+            case 'e':
+                if (cflags == DP_C_LDOUBLE)
+                    fvalue = va_arg(args, LDOUBLE);
+                else
+                    fvalue = va_arg(args, double);
+                break;
+            case 'G':
+                flags |= DP_F_UP;
+            case 'g':
+                if (cflags == DP_C_LDOUBLE)
+                    fvalue = va_arg(args, LDOUBLE);
+                else
+                    fvalue = va_arg(args, double);
+                break;
+            case 'c':
+                dopr_outch(buffer, &currlen, maxlen,
+                    va_arg(args, int));
+                break;
+            case 's':
+                strvalue = va_arg(args, char *);
+                if (max < 0)
+                    max = maxlen;
+                fmtstr(buffer, &currlen, maxlen, strvalue,
+                    flags, min, max);
+                break;
+            case 'p':
+                value = (long)va_arg(args, void *);
+                fmtint(buffer, &currlen, maxlen,
+                    value, 16, min, max, flags);
+                break;
+            case 'n': /* XXX */
+                if (cflags == DP_C_SHORT) {
+                    short int *num;
+                    num = va_arg(args, short int *);
+                    *num = currlen;
+                } else if (cflags == DP_C_LONG) { /* XXX */
+                    long int *num;
+                    num = va_arg(args, long int *);
+                    *num = (long int) currlen;
+                } else if (cflags == DP_C_LLONG) { /* XXX */
+                    LLONG *num;
+                    num = va_arg(args, LLONG *);
+                    *num = (LLONG) currlen;
+                } else {
+                    int    *num;
+                    num = va_arg(args, int *);
+                    *num = currlen;
+                }
+                break;
+            case '%':
+                dopr_outch(buffer, &currlen, maxlen, ch);
+                break;
+            case 'w':
+                /* not supported yet, treat as next char */
+                ch = *format++;
+                break;
+            default:
+                /* unknown, skip */
+                break;
+            }
+            ch = *format++;
+            state = DP_S_DEFAULT;
+            flags = cflags = min = 0;
+            max = -1;
+            break;
+        case DP_S_DONE:
+            break;
+        default:
+            break;
+        }
+    }
+    if (currlen >= maxlen - 1)
+        currlen = maxlen - 1;
+    buffer[currlen] = '\0';
+    *retlen = currlen;
+    return;
+}
+
+static void
+fmtstr(
+    char *buffer,
+    size_t *currlen,
+    size_t maxlen,
+    char *value,
+    int flags,
+    int min,
+    int max)
+{
+    int padlen, strln;
+    int cnt = 0;
+
+    if (value == 0)
+        value = "<NULL>";
+    for (strln = 0; value[strln]; ++strln)
+        ;
+    padlen = min - strln;
+    if (padlen < 0)
+        padlen = 0;
+    if (flags & DP_F_MINUS)
+        padlen = -padlen;
+
+    while ((padlen > 0) && (cnt < max)) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        --padlen;
+        ++cnt;
+    }
+    while (*value && (cnt < max)) {
+        dopr_outch(buffer, currlen, maxlen, *value++);
+        ++cnt;
+    }
+    while ((padlen < 0) && (cnt < max)) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        ++padlen;
+        ++cnt;
+    }
+}
+
+static void
+fmtint(
+    char *buffer,
+    size_t *currlen,
+    size_t maxlen,
+    LLONG value,
+    int base,
+    int min,
+    int max,
+    int flags)
+{
+    int signvalue = 0;
+    unsigned LLONG uvalue;
+    char convert[20];
+    int place = 0;
+    int spadlen = 0;
+    int zpadlen = 0;
+    int caps = 0;
+
+    if (max < 0)
+        max = 0;
+    uvalue = value;
+    if (!(flags & DP_F_UNSIGNED)) {
+        if (value < 0) {
+            signvalue = '-';
+            uvalue = -value;
+        } else if (flags & DP_F_PLUS)
+            signvalue = '+';
+        else if (flags & DP_F_SPACE)
+            signvalue = ' ';
+    }
+    if (flags & DP_F_UP)
+        caps = 1;
+    do {
+        convert[place++] =
+            (caps ? "0123456789ABCDEF" : "0123456789abcdef")
+            [uvalue % (unsigned) base];
+        uvalue = (uvalue / (unsigned) base);
+    } while (uvalue && (place < 20));
+    if (place == 20)
+        place--;
+    convert[place] = 0;
+
+    zpadlen = max - place;
+    spadlen = min - MAX(max, place) - (signvalue ? 1 : 0);
+    if (zpadlen < 0)
+        zpadlen = 0;
+    if (spadlen < 0)
+        spadlen = 0;
+    if (flags & DP_F_ZERO) {
+        zpadlen = MAX(zpadlen, spadlen);
+        spadlen = 0;
+    }
+    if (flags & DP_F_MINUS)
+        spadlen = -spadlen;
+
+    /* spaces */
+    while (spadlen > 0) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        --spadlen;
+    }
+
+    /* sign */
+    if (signvalue)
+        dopr_outch(buffer, currlen, maxlen, signvalue);
+
+    /* zeros */
+    if (zpadlen > 0) {
+        while (zpadlen > 0) {
+            dopr_outch(buffer, currlen, maxlen, '0');
+            --zpadlen;
+        }
+    }
+    /* digits */
+    while (place > 0)
+        dopr_outch(buffer, currlen, maxlen, convert[--place]);
+
+    /* left justified spaces */
+    while (spadlen < 0) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        ++spadlen;
+    }
+    return;
+}
+
+static LDOUBLE
+abs_val(LDOUBLE value)
+{
+    LDOUBLE result = value;
+    if (value < 0)
+        result = -value;
+    return result;
+}
+
+static LDOUBLE
+pow10(int exp)
+{
+    LDOUBLE result = 1;
+    while (exp) {
+        result *= 10;
+        exp--;
+    }
+    return result;
+}
+
+static long
+round(LDOUBLE value)
+{
+    long intpart;
+    intpart = (long) value;
+    value = value - intpart;
+    if (value >= 0.5)
+        intpart++;
+    return intpart;
+}
+
+static void
+fmtfp(
+    char *buffer,
+    size_t *currlen,
+    size_t maxlen,
+    LDOUBLE fvalue,
+    int min,
+    int max,
+    int flags)
+{
+    int signvalue = 0;
+    LDOUBLE ufvalue;
+    char iconvert[20];
+    char fconvert[20];
+    int iplace = 0;
+    int fplace = 0;
+    int padlen = 0;
+    int zpadlen = 0;
+    int caps = 0;
+    long intpart;
+    long fracpart;
+
+    if (max < 0)
+        max = 6;
+    ufvalue = abs_val(fvalue);
+    if (fvalue < 0)
+        signvalue = '-';
+    else if (flags & DP_F_PLUS)
+        signvalue = '+';
+    else if (flags & DP_F_SPACE)
+        signvalue = ' ';
+
+    intpart = (long)ufvalue;
+
+    /* sorry, we only support 9 digits past the decimal because of our
+       conversion method */
+    if (max > 9)
+        max = 9;
+
+    /* we "cheat" by converting the fractional part to integer by
+       multiplying by a factor of 10 */
+    fracpart = round((pow10(max)) * (ufvalue - intpart));
+
+    if (fracpart >= pow10(max)) {
+        intpart++;
+        fracpart -= (long)pow10(max);
+    }
+
+    /* convert integer part */
+    do {
+        iconvert[iplace++] =
+            (caps ? "0123456789ABCDEF"
+              : "0123456789abcdef")[intpart % 10];
+        intpart = (intpart / 10);
+    } while (intpart && (iplace < 20));
+    if (iplace == 20)
+        iplace--;
+    iconvert[iplace] = 0;
+
+    /* convert fractional part */
+    do {
+        fconvert[fplace++] =
+            (caps ? "0123456789ABCDEF"
+              : "0123456789abcdef")[fracpart % 10];
+        fracpart = (fracpart / 10);
+    } while (fracpart && (fplace < 20));
+    if (fplace == 20)
+        fplace--;
+    fconvert[fplace] = 0;
+
+    /* -1 for decimal point, another -1 if we are printing a sign */
+    padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0);
+    zpadlen = max - fplace;
+    if (zpadlen < 0)
+        zpadlen = 0;
+    if (padlen < 0)
+        padlen = 0;
+    if (flags & DP_F_MINUS)
+        padlen = -padlen;
+
+    if ((flags & DP_F_ZERO) && (padlen > 0)) {
+        if (signvalue) {
+            dopr_outch(buffer, currlen, maxlen, signvalue);
+            --padlen;
+            signvalue = 0;
+        }
+        while (padlen > 0) {
+            dopr_outch(buffer, currlen, maxlen, '0');
+            --padlen;
+        }
+    }
+    while (padlen > 0) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        --padlen;
+    }
+    if (signvalue)
+        dopr_outch(buffer, currlen, maxlen, signvalue);
+
+    while (iplace > 0)
+        dopr_outch(buffer, currlen, maxlen, iconvert[--iplace]);
+
+    /*
+     * Decimal point. This should probably use locale to find the correct
+     * char to print out.
+     */
+    if (max > 0) {
+        dopr_outch(buffer, currlen, maxlen, '.');
+
+        while (fplace > 0)
+            dopr_outch(buffer, currlen, maxlen, fconvert[--fplace]);
+    }
+    while (zpadlen > 0) {
+        dopr_outch(buffer, currlen, maxlen, '0');
+        --zpadlen;
+    }
+
+    while (padlen < 0) {
+        dopr_outch(buffer, currlen, maxlen, ' ');
+        ++padlen;
+    }
+}
+
+static void
+dopr_outch(
+    char *buffer,
+    size_t *currlen,
+    size_t maxlen,
+    int c)
+{
+    if (*currlen < maxlen)
+        buffer[(*currlen)++] = (char)c;
+    return;
+}
diff --git a/src/lib/libssl/src/crypto/bio/b_sock.c b/src/lib/libssl/src/crypto/bio/b_sock.c
index d29b29ff8b..6409f98f57 100644
--- a/src/lib/libssl/src/crypto/bio/b_sock.c
+++ b/src/lib/libssl/src/crypto/bio/b_sock.c
@@ -163,7 +163,14 @@ int BIO_get_port(const char *str, unsigned short *port_ptr)
         else
                 {
                 CRYPTO_w_lock(CRYPTO_LOCK_GETSERVBYNAME);
-                s=getservbyname(str,"tcp");
+                /* Note: under VMS with SOCKETSHR, it seems like the first
+                 * parameter is 'char *', instead of 'const char *'
+                 */
+                s=getservbyname(
+#ifndef CONST_STRICT
+                    (char *)
+#endif
+                    str,"tcp");
                 if(s != NULL)
                         *port_ptr=ntohs((unsigned short)s->s_port);
                 CRYPTO_w_unlock(CRYPTO_LOCK_GETSERVBYNAME);
@@ -282,12 +289,12 @@ static struct hostent *ghbn_dup(struct hostent *a)
 
         j=strlen(a->h_name)+1;
         if ((ret->h_name=Malloc(j)) == NULL) goto err;
-        memcpy((char *)ret->h_name,a->h_name,j+1);
+        memcpy((char *)ret->h_name,a->h_name,j);
         for (i=0; a->h_aliases[i] != NULL; i++)
                 {
                 j=strlen(a->h_aliases[i])+1;
                 if ((ret->h_aliases[i]=Malloc(j)) == NULL) goto err;
-                memcpy(ret->h_aliases[i],a->h_aliases[i],j+1);
+                memcpy(ret->h_aliases[i],a->h_aliases[i],j);
                 }
         ret->h_length=a->h_length;
         ret->h_addrtype=a->h_addrtype;
@@ -327,7 +334,7 @@ static void ghbn_free(struct hostent *a)
                         Free(a->h_addr_list[i]);
                 Free(a->h_addr_list);
                 }
-        if (a->h_name != NULL) Free((char *)a->h_name);
+        if (a->h_name != NULL) Free(a->h_name);
         Free(a);
         }
 
@@ -368,7 +375,14 @@ struct hostent *BIO_gethostbyname(const char *name)
         if (i == GHBN_NUM) /* no hit*/
                 {
                 BIO_ghbn_miss++;
-                ret=gethostbyname(name);
+                /* Note: under VMS with SOCKETSHR, it seems like the first
+                 * parameter is 'char *', instead of 'const char *'
+                 */
+                ret=gethostbyname(
+#ifndef CONST_STRICT
+                    (char *)
+#endif
+                    name);
 
                 if (ret == NULL)
                         goto end;
diff --git a/src/lib/libssl/src/crypto/bio/bf_buff.c b/src/lib/libssl/src/crypto/bio/bf_buff.c
index acd8148138..ff0c9070ae 100644
--- a/src/lib/libssl/src/crypto/bio/bf_buff.c
+++ b/src/lib/libssl/src/crypto/bio/bf_buff.c
@@ -69,6 +69,7 @@ static int buffer_gets(BIO *h,char *str,int size);
 static long buffer_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int buffer_new(BIO *h);
 static int buffer_free(BIO *data);
+static long buffer_callback_ctrl(BIO *h,int cmd, void (*fp)());
 #define DEFAULT_BUFFER_SIZE     1024
 
 static BIO_METHOD methods_buffer=
@@ -82,6 +83,7 @@ static BIO_METHOD methods_buffer=
         buffer_ctrl,
         buffer_new,
         buffer_free,
+        buffer_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_buffer(void)
@@ -284,6 +286,7 @@ static long buffer_ctrl(BIO *b, int cmd, long num, char *ptr)
                 ctx->ibuf_len=0;
                 ctx->obuf_off=0;
                 ctx->obuf_len=0;
+                if (b->next_bio == NULL) return(0);
                 ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
                 break;
         case BIO_CTRL_INFO:
@@ -300,12 +303,18 @@ static long buffer_ctrl(BIO *b, int cmd, long num, char *ptr)
         case BIO_CTRL_WPENDING:
                 ret=(long)ctx->obuf_len;
                 if (ret == 0)
+                        {
+                        if (b->next_bio == NULL) return(0);
                         ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
+                        }
                 break;
         case BIO_CTRL_PENDING:
                 ret=(long)ctx->ibuf_len;
                 if (ret == 0)
+                        {
+                        if (b->next_bio == NULL) return(0);
                         ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
+                        }
                 break;
         case BIO_C_SET_BUFF_READ_DATA:
                 if (num > ctx->ibuf_size)
@@ -374,12 +383,14 @@ static long buffer_ctrl(BIO *b, int cmd, long num, char *ptr)
                         }
                 break;
         case BIO_C_DO_STATE_MACHINE:
+                if (b->next_bio == NULL) return(0);
                 BIO_clear_retry_flags(b);
                 ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
                 BIO_copy_next_retry(b);
                 break;
 
         case BIO_CTRL_FLUSH:
+                if (b->next_bio == NULL) return(0);
                 if (ctx->obuf_len <= 0)
                         {
                         ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
@@ -418,6 +429,7 @@ fprintf(stderr,"FLUSH [%3d] %3d -> %3d\n",ctx->obuf_off,ctx->obuf_len-ctx->obuf_
                         ret=0;
                 break;
         default:
+                if (b->next_bio == NULL) return(0);
                 ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
                 break;
                 }
@@ -427,6 +439,20 @@ malloc_error:
         return(0);
         }
 
+static long buffer_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int buffer_gets(BIO *b, char *buf, int size)
         {
         BIO_F_BUFFER_CTX *ctx;
diff --git a/src/lib/libssl/src/crypto/bio/bf_nbio.c b/src/lib/libssl/src/crypto/bio/bf_nbio.c
index cbec2bae29..5e574b7231 100644
--- a/src/lib/libssl/src/crypto/bio/bf_nbio.c
+++ b/src/lib/libssl/src/crypto/bio/bf_nbio.c
@@ -73,6 +73,7 @@ static int nbiof_gets(BIO *h,char *str,int size);
 static long nbiof_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int nbiof_new(BIO *h);
 static int nbiof_free(BIO *data);
+static long nbiof_callback_ctrl(BIO *h,int cmd,void (*fp)());
 typedef struct nbio_test_st
         {
         /* only set if we sent a 'should retry' error */
@@ -91,6 +92,7 @@ static BIO_METHOD methods_nbiof=
         nbiof_ctrl,
         nbiof_new,
         nbiof_free,
+        nbiof_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_nbio_test(void)
@@ -137,7 +139,7 @@ static int nbiof_read(BIO *b, char *out, int outl)
 
         BIO_clear_retry_flags(b);
 #if 0
-        RAND_bytes(&n,1);
+        RAND_pseudo_bytes(&n,1);
         num=(n&0x07);
 
         if (outl > num) outl=num;
@@ -178,7 +180,7 @@ static int nbiof_write(BIO *b, char *in, int inl)
                 }
         else
                 {
-                RAND_bytes(&n,1);
+                RAND_pseudo_bytes(&n,1);
                 num=(n&7);
                 }
 
@@ -224,6 +226,20 @@ static long nbiof_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long nbiof_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int nbiof_gets(BIO *bp, char *buf, int size)
         {
         if (bp->next_bio == NULL) return(0);
diff --git a/src/lib/libssl/src/crypto/bio/bf_null.c b/src/lib/libssl/src/crypto/bio/bf_null.c
index 3254a55dce..0d183a6d9a 100644
--- a/src/lib/libssl/src/crypto/bio/bf_null.c
+++ b/src/lib/libssl/src/crypto/bio/bf_null.c
@@ -72,6 +72,7 @@ static int nullf_gets(BIO *h,char *str,int size);
 static long nullf_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int nullf_new(BIO *h);
 static int nullf_free(BIO *data);
+static long nullf_callback_ctrl(BIO *h,int cmd,void (*fp)());
 static BIO_METHOD methods_nullf=
         {
         BIO_TYPE_NULL_FILTER,
@@ -83,6 +84,7 @@ static BIO_METHOD methods_nullf=
         nullf_ctrl,
         nullf_new,
         nullf_free,
+        nullf_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_null(void)
@@ -152,6 +154,20 @@ static long nullf_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long nullf_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int nullf_gets(BIO *bp, char *buf, int size)
         {
         if (bp->next_bio == NULL) return(0);
diff --git a/src/lib/libssl/src/crypto/bio/bio.h b/src/lib/libssl/src/crypto/bio/bio.h
index 54bf622a3b..bc08401eeb 100644
--- a/src/lib/libssl/src/crypto/bio/bio.h
+++ b/src/lib/libssl/src/crypto/bio/bio.h
@@ -76,7 +76,7 @@ extern "C" {
 #define BIO_TYPE_SOCKET         (5|0x0400|0x0100)
 #define BIO_TYPE_NULL           (6|0x0400)
 #define BIO_TYPE_SSL            (7|0x0200)
-#define BIO_TYPE_MD             (8|0x0200)              /* pasive filter */
+#define BIO_TYPE_MD             (8|0x0200)              /* passive filter */
 #define BIO_TYPE_BUFFER         (9|0x0200)              /* filter */
 #define BIO_TYPE_CIPHER         (10|0x0200)             /* filter */
 #define BIO_TYPE_BASE64         (11|0x0200)             /* filter */
@@ -147,6 +147,11 @@ extern "C" {
 
 #define BIO_FLAGS_BASE64_NO_NL  0x100
 
+/* This is used with memory BIOs: it means we shouldn't free up or change the
+ * data in any way.
+ */
+#define BIO_FLAGS_MEM_RDONLY    0x200
+
 #define BIO_set_flags(b,f) ((b)->flags|=(f))
 #define BIO_get_flags(b) ((b)->flags)
 #define BIO_set_retry_special(b) \
@@ -163,7 +168,7 @@ extern "C" {
 #define BIO_get_retry_flags(b) \
                 ((b)->flags&(BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY))
 
-/* These shouldbe used by the application to tell why we should retry */
+/* These should be used by the application to tell why we should retry */
 #define BIO_should_read(a)              ((a)->flags & BIO_FLAGS_READ)
 #define BIO_should_write(a)             ((a)->flags & BIO_FLAGS_WRITE)
 #define BIO_should_io_special(a)        ((a)->flags & BIO_FLAGS_IO_SPECIAL)
@@ -214,6 +219,7 @@ typedef struct bio_method_st
         long (*ctrl)();
         int (*create)();
         int (*destroy)();
+        long (*callback_ctrl)();
         } BIO_METHOD;
 #else
 typedef struct bio_method_st
@@ -227,6 +233,7 @@ typedef struct bio_method_st
         long (_far *ctrl)();
         int (_far *create)();
         int (_far *destroy)();
+        long (_fat *callback_ctrl)();
         } BIO_METHOD;
 #endif
 
@@ -278,9 +285,6 @@ typedef struct bio_f_buffer_ctx_struct
 #define BIO_CONN_S_NBIO                 8
 /*#define BIO_CONN_get_param_hostname   BIO_ctrl */
 
-#define BIO_number_read(b)      ((b)->num_read)
-#define BIO_number_written(b)   ((b)->num_write)
-
 #define BIO_C_SET_CONNECT                       100
 #define BIO_C_DO_STATE_MACHINE                  101
 #define BIO_C_SET_NBIO                          102
@@ -325,9 +329,14 @@ typedef struct bio_f_buffer_ctx_struct
 #define BIO_C_GET_WRITE_GUARANTEE               140
 #define BIO_C_GET_READ_REQUEST                  141
 #define BIO_C_SHUTDOWN_WR                       142
+#define BIO_C_NREAD0                            143
+#define BIO_C_NREAD                             144
+#define BIO_C_NWRITE0                           145
+#define BIO_C_NWRITE                            146
+#define BIO_C_RESET_READ_REQUEST                147
 
 
-#define BIO_set_app_data(s,arg)         BIO_set_ex_data(s,0,(char *)arg)
+#define BIO_set_app_data(s,arg)         BIO_set_ex_data(s,0,arg)
 #define BIO_get_app_data(s)             BIO_get_ex_data(s,0)
 
 /* BIO_s_connect() and BIO_s_socks4a_connect() */
@@ -366,7 +375,7 @@ typedef struct bio_f_buffer_ctx_struct
 /* BIO_set_nbio(b,n) */
 #define BIO_set_filter_bio(b,s) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,2,(char *)(s))
 /* BIO *BIO_get_filter_bio(BIO *bio); */
-#define BIO_set_proxy_cb(b,cb) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,3,(char *)(cb))
+#define BIO_set_proxy_cb(b,cb) BIO_callback_ctrl(b,BIO_C_SET_PROXY_PARAM,3,(void *(*cb)()))
 #define BIO_set_proxy_header(b,sk) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,4,(char *)sk)
 #define BIO_set_no_connect_return(b,bool) BIO_int_ctrl(b,BIO_C_SET_PROXY_PARAM,5,bool)
 
@@ -445,8 +454,8 @@ int BIO_read_filename(BIO *b,const char *name);
 size_t BIO_ctrl_pending(BIO *b);
 size_t BIO_ctrl_wpending(BIO *b);
 #define BIO_flush(b)            (int)BIO_ctrl(b,BIO_CTRL_FLUSH,0,NULL)
-#define BIO_get_info_callback(b,cbp) (int)BIO_ctrl(b,BIO_CTRL_GET_CALLBACK,0,(char *)cbp)
-#define BIO_set_info_callback(b,cb) (int)BIO_ctrl(b,BIO_CTRL_SET_CALLBACK,0,(char *)cb)
+#define BIO_get_info_callback(b,cbp) (int)BIO_ctrl(b,BIO_CTRL_GET_CALLBACK,0,(void (**)())(cbp))
+#define BIO_set_info_callback(b,cb) (int)BIO_callback_ctrl(b,BIO_CTRL_SET_CALLBACK,(void (*)())(cb))
 
 /* For the BIO_f_buffer() type */
 #define BIO_buffer_get_num_lines(b) BIO_ctrl(b,BIO_CTRL_GET,0,NULL)
@@ -461,8 +470,7 @@ size_t BIO_ctrl_wpending(BIO *b);
 #define BIO_get_read_request(b)    (int)BIO_ctrl(b,BIO_C_GET_READ_REQUEST,0,NULL)
 size_t BIO_ctrl_get_write_guarantee(BIO *b);
 size_t BIO_ctrl_get_read_request(BIO *b);
-
-
+int BIO_ctrl_reset_read_request(BIO *b);
 
 #ifdef NO_STDIO
 #define NO_FP_API
@@ -472,10 +480,12 @@ size_t BIO_ctrl_get_read_request(BIO *b);
 /* These two aren't currently implemented */
 /* int BIO_get_ex_num(BIO *bio); */
 /* void BIO_set_ex_free_func(BIO *bio,int idx,void (*cb)()); */
-int BIO_set_ex_data(BIO *bio,int idx,char *data);
-char *BIO_get_ex_data(BIO *bio,int idx);
-int BIO_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int BIO_set_ex_data(BIO *bio,int idx,void *data);
+void *BIO_get_ex_data(BIO *bio,int idx);
+int BIO_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+unsigned long BIO_number_read(BIO *bio);
+unsigned long BIO_number_written(BIO *bio);
 
 #  if defined(WIN16) && defined(_WINDLL)
 BIO_METHOD *BIO_s_file_internal(void);
@@ -500,6 +510,7 @@ int	BIO_gets(BIO *bp,char *buf, int size);
 int     BIO_write(BIO *b, const char *data, int len);
 int     BIO_puts(BIO *bp,const char *buf);
 long    BIO_ctrl(BIO *bp,int cmd,long larg,void *parg);
+long    BIO_callback_ctrl(BIO *bp,int cmd,void (*fp)());
 char *  BIO_ptr_ctrl(BIO *bp,int cmd,long larg);
 long    BIO_int_ctrl(BIO *bp,int cmd,long larg,int iarg);
 BIO *   BIO_push(BIO *b,BIO *append);
@@ -510,6 +521,11 @@ BIO *	BIO_get_retry_BIO(BIO *bio, int *reason);
 int     BIO_get_retry_reason(BIO *bio);
 BIO *   BIO_dup_chain(BIO *in);
 
+int BIO_nread0(BIO *bio, char **buf);
+int BIO_nread(BIO *bio, char **buf, int num);
+int BIO_nwrite0(BIO *bio, char **buf);
+int BIO_nwrite(BIO *bio, char **buf, int num);
+
 #ifndef WIN16
 long BIO_debug_callback(BIO *bio,int cmd,const char *argp,int argi,
         long argl,long ret);
@@ -519,6 +535,7 @@ long _far _loadds BIO_debug_callback(BIO *bio,int cmd,const char *argp,int argi,
 #endif
 
 BIO_METHOD *BIO_s_mem(void);
+BIO *BIO_new_mem_buf(void *buf, int len);
 BIO_METHOD *BIO_s_socket(void);
 BIO_METHOD *BIO_s_connect(void);
 BIO_METHOD *BIO_s_accept(void);
@@ -597,11 +614,17 @@ int BIO_printf(BIO *bio, ...);
 #define BIO_F_BIO_MAKE_PAIR                              121
 #define BIO_F_BIO_NEW                                    108
 #define BIO_F_BIO_NEW_FILE                               109
+#define BIO_F_BIO_NEW_MEM_BUF                            126
+#define BIO_F_BIO_NREAD                                  123
+#define BIO_F_BIO_NREAD0                                 124
+#define BIO_F_BIO_NWRITE                                 125
+#define BIO_F_BIO_NWRITE0                                122
 #define BIO_F_BIO_PUTS                                   110
 #define BIO_F_BIO_READ                                   111
 #define BIO_F_BIO_SOCK_INIT                              112
 #define BIO_F_BIO_WRITE                                  113
 #define BIO_F_BUFFER_CTRL                                114
+#define BIO_F_CONN_CTRL                                  127
 #define BIO_F_CONN_STATE                                 115
 #define BIO_F_FILE_CTRL                                  116
 #define BIO_F_MEM_WRITE                                  117
@@ -634,6 +657,7 @@ int BIO_printf(BIO *bio, ...);
 #define BIO_R_UNABLE_TO_LISTEN_SOCKET                    119
 #define BIO_R_UNINITIALIZED                              120
 #define BIO_R_UNSUPPORTED_METHOD                         121
+#define BIO_R_WRITE_TO_READ_ONLY_BIO                     126
 #define BIO_R_WSASTARTUP                                 122
 
 #ifdef  __cplusplus
diff --git a/src/lib/libssl/src/crypto/bio/bio_err.c b/src/lib/libssl/src/crypto/bio/bio_err.c
index 712d98a3a1..b5f07de5a0 100644
--- a/src/lib/libssl/src/crypto/bio/bio_err.c
+++ b/src/lib/libssl/src/crypto/bio/bio_err.c
@@ -77,11 +77,17 @@ static ERR_STRING_DATA BIO_str_functs[]=
 {ERR_PACK(0,BIO_F_BIO_MAKE_PAIR,0),     "BIO_MAKE_PAIR"},
 {ERR_PACK(0,BIO_F_BIO_NEW,0),   "BIO_new"},
 {ERR_PACK(0,BIO_F_BIO_NEW_FILE,0),      "BIO_new_file"},
+{ERR_PACK(0,BIO_F_BIO_NEW_MEM_BUF,0),   "BIO_new_mem_buf"},
+{ERR_PACK(0,BIO_F_BIO_NREAD,0), "BIO_nread"},
+{ERR_PACK(0,BIO_F_BIO_NREAD0,0),        "BIO_nread0"},
+{ERR_PACK(0,BIO_F_BIO_NWRITE,0),        "BIO_nwrite"},
+{ERR_PACK(0,BIO_F_BIO_NWRITE0,0),       "BIO_nwrite0"},
 {ERR_PACK(0,BIO_F_BIO_PUTS,0),  "BIO_puts"},
 {ERR_PACK(0,BIO_F_BIO_READ,0),  "BIO_read"},
 {ERR_PACK(0,BIO_F_BIO_SOCK_INIT,0),     "BIO_sock_init"},
 {ERR_PACK(0,BIO_F_BIO_WRITE,0), "BIO_write"},
 {ERR_PACK(0,BIO_F_BUFFER_CTRL,0),       "BUFFER_CTRL"},
+{ERR_PACK(0,BIO_F_CONN_CTRL,0), "CONN_CTRL"},
 {ERR_PACK(0,BIO_F_CONN_STATE,0),        "CONN_STATE"},
 {ERR_PACK(0,BIO_F_FILE_CTRL,0), "FILE_CTRL"},
 {ERR_PACK(0,BIO_F_MEM_WRITE,0), "MEM_WRITE"},
@@ -117,6 +123,7 @@ static ERR_STRING_DATA BIO_str_reasons[]=
 {BIO_R_UNABLE_TO_LISTEN_SOCKET           ,"unable to listen socket"},
 {BIO_R_UNINITIALIZED                     ,"uninitialized"},
 {BIO_R_UNSUPPORTED_METHOD                ,"unsupported method"},
+{BIO_R_WRITE_TO_READ_ONLY_BIO            ,"write to read only bio"},
 {BIO_R_WSASTARTUP                        ,"wsastartup"},
 {0,NULL}
         };
diff --git a/src/lib/libssl/src/crypto/bio/bio_lib.c b/src/lib/libssl/src/crypto/bio/bio_lib.c
index b72688ea90..cf8e6150fd 100644
--- a/src/lib/libssl/src/crypto/bio/bio_lib.c
+++ b/src/lib/libssl/src/crypto/bio/bio_lib.c
@@ -63,7 +63,7 @@
 #include <openssl/bio.h>
 #include <openssl/stack.h>
 
-static STACK *bio_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *bio_meth=NULL;
 static int bio_meth_num=0;
 
 BIO *BIO_new(BIO_METHOD *method)
@@ -100,7 +100,7 @@ int BIO_set(BIO *bio, BIO_METHOD *method)
         bio->references=1;
         bio->num_read=0L;
         bio->num_write=0L;
-        CRYPTO_new_ex_data(bio_meth,(char *)bio,&bio->ex_data);
+        CRYPTO_new_ex_data(bio_meth,bio,&bio->ex_data);
         if (method->create != NULL)
                 if (!method->create(bio))
                         return(0);
@@ -129,7 +129,7 @@ int BIO_free(BIO *a)
                 ((i=(int)a->callback(a,BIO_CB_FREE,NULL,0,0L,1L)) <= 0))
                         return(i);
 
-        CRYPTO_free_ex_data(bio_meth,(char *)a,&a->ex_data);
+        CRYPTO_free_ex_data(bio_meth,a,&a->ex_data);
 
         if ((a->method == NULL) || (a->method->destroy == NULL)) return(1);
         ret=a->method->destroy(a);
@@ -317,16 +317,43 @@ long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
         return(ret);
         }
 
+long BIO_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret;
+        long (*cb)();
+
+        if (b == NULL) return(0);
+
+        if ((b->method == NULL) || (b->method->callback_ctrl == NULL))
+                {
+                BIOerr(BIO_F_BIO_CTRL,BIO_R_UNSUPPORTED_METHOD);
+                return(-2);
+                }
+
+        cb=b->callback;
+
+        if ((cb != NULL) &&
+                ((ret=cb(b,BIO_CB_CTRL,(void *)&fp,cmd,0,1L)) <= 0))
+                return(ret);
+
+        ret=b->method->callback_ctrl(b,cmd,fp);
+
+        if (cb != NULL)
+                ret=cb(b,BIO_CB_CTRL|BIO_CB_RETURN,(void *)&fp,cmd,
+                        0,ret);
+        return(ret);
+        }
+
 /* It is unfortunate to duplicate in functions what the BIO_(w)pending macros
  * do; but those macros have inappropriate return type, and for interfacing
  * from other programming languages, C macros aren't much of a help anyway. */
 size_t BIO_ctrl_pending(BIO *bio)
-    {
+        {
         return BIO_ctrl(bio, BIO_CTRL_PENDING, 0, NULL);
         }
 
 size_t BIO_ctrl_wpending(BIO *bio)
-    {
+        {
         return BIO_ctrl(bio, BIO_CTRL_WPENDING, 0, NULL);
         }
 
@@ -476,21 +503,32 @@ void BIO_copy_next_retry(BIO *b)
         b->retry_reason=b->next_bio->retry_reason;
         }
 
-int BIO_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-             int (*dup_func)(), void (*free_func)())
+int BIO_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         bio_meth_num++;
         return(CRYPTO_get_ex_new_index(bio_meth_num-1,&bio_meth,
                 argl,argp,new_func,dup_func,free_func));
         }
 
-int BIO_set_ex_data(BIO *bio, int idx, char *data)
+int BIO_set_ex_data(BIO *bio, int idx, void *data)
         {
         return(CRYPTO_set_ex_data(&(bio->ex_data),idx,data));
         }
 
-char *BIO_get_ex_data(BIO *bio, int idx)
+void *BIO_get_ex_data(BIO *bio, int idx)
         {
         return(CRYPTO_get_ex_data(&(bio->ex_data),idx));
         }
 
+unsigned long BIO_number_read(BIO *bio)
+{
+        if(bio) return bio->num_read;
+        return 0;
+}
+
+unsigned long BIO_number_written(BIO *bio)
+{
+        if(bio) return bio->num_write;
+        return 0;
+}
diff --git a/src/lib/libssl/src/crypto/bio/bss_acpt.c b/src/lib/libssl/src/crypto/bio/bss_acpt.c
index 47af80f76d..9afa636406 100644
--- a/src/lib/libssl/src/crypto/bio/bss_acpt.c
+++ b/src/lib/libssl/src/crypto/bio/bss_acpt.c
@@ -118,6 +118,7 @@ static BIO_METHOD methods_acceptp=
         acpt_ctrl,
         acpt_new,
         acpt_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_accept(void)
diff --git a/src/lib/libssl/src/crypto/bio/bss_bio.c b/src/lib/libssl/src/crypto/bio/bss_bio.c
index 562e9d8de2..0d0f9356f7 100644
--- a/src/lib/libssl/src/crypto/bio/bss_bio.c
+++ b/src/lib/libssl/src/crypto/bio/bss_bio.c
@@ -13,6 +13,7 @@
 #endif
 
 #include <assert.h>
+#include <limits.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -40,7 +41,8 @@ static BIO_METHOD methods_biop =
         NULL /* no bio_gets */,
         bio_ctrl,
         bio_new,
-        bio_free
+        bio_free,
+        NULL /* no bio_callback_ctrl */
 };
 
 BIO_METHOD *BIO_s_bio(void)
@@ -64,7 +66,7 @@ struct bio_bio_st
 
         size_t request; /* valid iff peer != NULL; 0 if len != 0,
                          * otherwise set by peer to number of bytes
-                         * it (unsuccesfully) tried to read,
+                         * it (unsuccessfully) tried to read,
                          * never more than buffer space (size-len) warrants. */
 };
 
@@ -195,6 +197,81 @@ static int bio_read(BIO *bio, char *buf, int size_)
         return size;
         }
 
+/* non-copying interface: provide pointer to available data in buffer
+ *    bio_nread0:  return number of available bytes
+ *    bio_nread:   also advance index
+ * (example usage:  bio_nread0(), read from buffer, bio_nread()
+ *  or just         bio_nread(), read from buffer)
+ */
+/* WARNING: The non-copying interface is largely untested as of yet
+ * and may contain bugs. */
+static size_t bio_nread0(BIO *bio, char **buf)
+        {
+        struct bio_bio_st *b, *peer_b;
+        size_t num;
+        
+        BIO_clear_retry_flags(bio);
+
+        if (!bio->init)
+                return 0;
+        
+        b = bio->ptr;
+        assert(b != NULL);
+        assert(b->peer != NULL);
+        peer_b = b->peer->ptr;
+        assert(peer_b != NULL);
+        assert(peer_b->buf != NULL);
+        
+        peer_b->request = 0;
+        
+        if (peer_b->len == 0)
+                {
+                char dummy;
+                
+                /* avoid code duplication -- nothing available for reading */
+                return bio_read(bio, &dummy, 1); /* returns 0 or -1 */
+                }
+
+        num = peer_b->len;
+        if (peer_b->size < peer_b->offset + num)
+                /* no ring buffer wrap-around for non-copying interface */
+                num = peer_b->size - peer_b->offset;
+        assert(num > 0);
+
+        if (buf != NULL)
+                *buf = peer_b->buf + peer_b->offset;
+        return num;
+        }
+
+static size_t bio_nread(BIO *bio, char **buf, size_t num)
+        {
+        struct bio_bio_st *b, *peer_b;
+        size_t available;
+
+        available = bio_nread0(bio, buf);
+        if (num > available)
+                num = available;
+        if (num == 0)
+                return num;
+
+        b = bio->ptr;
+        peer_b = b->peer->ptr;
+
+        peer_b->len -= num;
+        if (peer_b->len) 
+                {
+                peer_b->offset += num;
+                assert(peer_b->offset <= peer_b->size);
+                if (peer_b->offset == peer_b->size)
+                        peer_b->offset = 0;
+                }
+        else
+                peer_b->offset = 0;
+
+        return num;
+        }
+
+
 static int bio_write(BIO *bio, char *buf, int num_)
         {
         size_t num = num_;
@@ -268,6 +345,78 @@ static int bio_write(BIO *bio, char *buf, int num_)
         return num;
         }
 
+/* non-copying interface: provide pointer to region to write to
+ *   bio_nwrite0:  check how much space is available
+ *   bio_nwrite:   also increase length
+ * (example usage:  bio_nwrite0(), write to buffer, bio_nwrite()
+ *  or just         bio_nwrite(), write to buffer)
+ */
+static size_t bio_nwrite0(BIO *bio, char **buf)
+        {
+        struct bio_bio_st *b;
+        size_t num;
+        size_t write_offset;
+
+        BIO_clear_retry_flags(bio);
+
+        if (!bio->init)
+                return 0;
+
+        b = bio->ptr;           
+        assert(b != NULL);
+        assert(b->peer != NULL);
+        assert(b->buf != NULL);
+
+        b->request = 0;
+        if (b->closed)
+                {
+                BIOerr(BIO_F_BIO_NWRITE0, BIO_R_BROKEN_PIPE);
+                return -1;
+                }
+
+        assert(b->len <= b->size);
+
+        if (b->len == b->size)
+                {
+                BIO_set_retry_write(bio);
+                return -1;
+                }
+
+        num = b->size - b->len;
+        write_offset = b->offset + b->len;
+        if (write_offset >= b->size)
+                write_offset -= b->size;
+        if (write_offset + num > b->size)
+                /* no ring buffer wrap-around for non-copying interface
+                 * (to fulfil the promise by BIO_ctrl_get_write_guarantee,
+                 * BIO_nwrite may have to be called twice) */
+                num = b->size - write_offset;
+
+        if (buf != NULL)
+                *buf = b->buf + write_offset;
+        assert(write_offset + num <= b->size);
+
+        return num;
+        }
+
+static size_t bio_nwrite(BIO *bio, char **buf, size_t num)
+        {
+        struct bio_bio_st *b;
+        size_t space;
+
+        space = bio_nwrite0(bio, buf);
+        if (num > space)
+                num = space;
+        if (num == 0)
+                return num;
+        b = bio->ptr;
+        assert(b != NULL);
+        b->len += num;
+        assert(b->len <= b->size);
+
+        return num;
+        }
+
 
 static long bio_ctrl(BIO *bio, int cmd, long num, void *ptr)
         {
@@ -331,7 +480,7 @@ static long bio_ctrl(BIO *bio, int cmd, long num, void *ptr)
 
         case BIO_C_GET_WRITE_GUARANTEE:
                 /* How many bytes can the caller feed to the next write
-                 * withouth having to keep any? */
+                 * without having to keep any? */
                 if (b->peer == NULL || b->closed)
                         ret = 0;
                 else
@@ -339,18 +488,42 @@ static long bio_ctrl(BIO *bio, int cmd, long num, void *ptr)
                 break;
 
         case BIO_C_GET_READ_REQUEST:
-                /* If the peer unsuccesfully tried to read, how many bytes
+                /* If the peer unsuccessfully tried to read, how many bytes
                  * were requested?  (As with BIO_CTRL_PENDING, that number
                  * can usually be treated as boolean.) */
                 ret = (long) b->request;
                 break;
 
+        case BIO_C_RESET_READ_REQUEST:
+                /* Reset request.  (Can be useful after read attempts
+                 * at the other side that are meant to be non-blocking,
+                 * e.g. when probing SSL_read to see if any data is
+                 * available.) */
+                b->request = 0;
+                ret = 1;
+                break;
+
         case BIO_C_SHUTDOWN_WR:
                 /* similar to shutdown(..., SHUT_WR) */
                 b->closed = 1;
                 ret = 1;
                 break;
 
+        case BIO_C_NREAD:
+                /* non-copying read */
+                ret = (long) bio_nread(bio, ptr, (size_t) num);
+                break;
+                
+        case BIO_C_NWRITE0:
+                /* prepare for non-copying write */
+                ret = (long) bio_nwrite0(bio, ptr);
+                break;
+
+        case BIO_C_NWRITE:
+                /* non-copying write */
+                ret = (long) bio_nwrite(bio, ptr, (size_t) num);
+                break;
+                
 
         /* standard CTRL codes follow */
 
@@ -586,3 +759,78 @@ size_t BIO_ctrl_get_read_request(BIO *bio)
         {
         return BIO_ctrl(bio, BIO_C_GET_READ_REQUEST, 0, NULL);
         }
+
+int BIO_ctrl_reset_read_request(BIO *bio)
+        {
+        return (BIO_ctrl(bio, BIO_C_RESET_READ_REQUEST, 0, NULL) != 0);
+        }
+
+
+/* BIO_nread0/nread/nwrite0/nwrite are available only for BIO pairs for now
+ * (conceivably some other BIOs could allow non-copying reads and writes too.)
+ */
+int BIO_nread0(BIO *bio, char **buf)
+        {
+        long ret;
+
+        if (!bio->init)
+                {
+                BIOerr(BIO_F_BIO_NREAD0, BIO_R_UNINITIALIZED);
+                return -2;
+                }
+
+        ret = BIO_ctrl(bio, BIO_C_NREAD0, 0, buf);
+        if (ret > INT_MAX)
+                return INT_MAX;
+        else
+                return (int) ret;
+        }
+
+int BIO_nread(BIO *bio, char **buf, int num)
+        {
+        int ret;
+
+        if (!bio->init)
+                {
+                BIOerr(BIO_F_BIO_NREAD, BIO_R_UNINITIALIZED);
+                return -2;
+                }
+
+        ret = (int) BIO_ctrl(bio, BIO_C_NREAD, num, buf);
+        if (ret > 0)
+                bio->num_read += ret;
+        return ret;
+        }
+
+int BIO_nwrite0(BIO *bio, char **buf)
+        {
+        long ret;
+
+        if (!bio->init)
+                {
+                BIOerr(BIO_F_BIO_NWRITE0, BIO_R_UNINITIALIZED);
+                return -2;
+                }
+
+        ret = BIO_ctrl(bio, BIO_C_NWRITE0, 0, buf);
+        if (ret > INT_MAX)
+                return INT_MAX;
+        else
+                return (int) ret;
+        }
+
+int BIO_nwrite(BIO *bio, char **buf, int num)
+        {
+        int ret;
+
+        if (!bio->init)
+                {
+                BIOerr(BIO_F_BIO_NWRITE, BIO_R_UNINITIALIZED);
+                return -2;
+                }
+
+        ret = BIO_ctrl(bio, BIO_C_NWRITE, num, buf);
+        if (ret > 0)
+                bio->num_read += ret;
+        return ret;
+        }
diff --git a/src/lib/libssl/src/crypto/bio/bss_conn.c b/src/lib/libssl/src/crypto/bio/bss_conn.c
index 68c46e3d69..22d00b369e 100644
--- a/src/lib/libssl/src/crypto/bio/bss_conn.c
+++ b/src/lib/libssl/src/crypto/bio/bss_conn.c
@@ -90,11 +90,11 @@ typedef struct bio_connect_st
         struct sockaddr_in them;
 
         /* int socket; this will be kept in bio->num so that it is
-         * compatable with the bss_sock bio */ 
+         * compatible with the bss_sock bio */ 
 
         /* called when the connection is initially made
          *  callback(BIO,state,ret);  The callback should return
-         * 'ret'.  state is for compatablity with the ssl info_callback */
+         * 'ret'.  state is for compatibility with the ssl info_callback */
         int (*info_callback)();
         } BIO_CONNECT;
 
@@ -104,6 +104,7 @@ static int conn_puts(BIO *h,char *str);
 static long conn_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int conn_new(BIO *h);
 static int conn_free(BIO *data);
+static long conn_callback_ctrl(BIO *h,int cmd,void *(*fp)());
 
 static int conn_state(BIO *b, BIO_CONNECT *c);
 static void conn_close_socket(BIO *data);
@@ -121,6 +122,7 @@ static BIO_METHOD methods_connectp=
         conn_ctrl,
         conn_new,
         conn_free,
+        conn_callback_ctrl,
         };
 
 static int conn_state(BIO *b, BIO_CONNECT *c)
@@ -494,7 +496,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, char *ptr)
                                 *((int *)ptr)=data->port;
                                 }
                         if ((!b->init) || (ptr == NULL))
-                                *pptr="not initalised";
+                                *pptr="not initialized";
                         ret=1;
                         }
                 break;
@@ -564,16 +566,25 @@ static long conn_ctrl(BIO *b, int cmd, long num, char *ptr)
         case BIO_CTRL_FLUSH:
                 break;
         case BIO_CTRL_DUP:
+                {
                 dbio=(BIO *)ptr;
                 if (data->param_port)
                         BIO_set_conn_port(dbio,data->param_port);
                 if (data->param_hostname)
                         BIO_set_conn_hostname(dbio,data->param_hostname);
                 BIO_set_nbio(dbio,data->nbio);
-                (void)BIO_set_info_callback(dbio,data->info_callback);
+                (void)BIO_set_info_callback(dbio,(void *(*)())(data->info_callback));
+                }
                 break;
         case BIO_CTRL_SET_CALLBACK:
-                data->info_callback=(int (*)())ptr;
+                {
+#if 0 /* FIXME: Should this be used?  -- Richard Levitte */
+                BIOerr(BIO_F_CONN_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ret = -1;
+#else
+                ret=0;
+#endif
+                }
                 break;
         case BIO_CTRL_GET_CALLBACK:
                 {
@@ -590,6 +601,27 @@ static long conn_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long conn_callback_ctrl(BIO *b, int cmd, void *(*fp)())
+        {
+        long ret=1;
+        BIO_CONNECT *data;
+
+        data=(BIO_CONNECT *)b->ptr;
+
+        switch (cmd)
+                {
+        case BIO_CTRL_SET_CALLBACK:
+                {
+                data->info_callback=(int (*)())fp;
+                }
+                break;
+        default:
+                ret=0;
+                break;
+                }
+        return(ret);
+        }
+
 static int conn_puts(BIO *bp, char *str)
         {
         int n,ret;
diff --git a/src/lib/libssl/src/crypto/bio/bss_file.c b/src/lib/libssl/src/crypto/bio/bss_file.c
index 52c0c39df0..0d44dc3889 100644
--- a/src/lib/libssl/src/crypto/bio/bss_file.c
+++ b/src/lib/libssl/src/crypto/bio/bss_file.c
@@ -91,6 +91,7 @@ static BIO_METHOD methods_filep=
         file_ctrl,
         file_new,
         file_free,
+        NULL,
         };
 
 BIO *BIO_new_file(const char *filename, const char *mode)
@@ -171,7 +172,7 @@ static int MS_CALLBACK file_write(BIO *b, char *in, int inl)
                 if (fwrite(in,(int)inl,1,(FILE *)b->ptr))
                         ret=inl;
                 /* ret=fwrite(in,1,(int)inl,(FILE *)b->ptr); */
-                /* acording to Tim Hudson <tjh@cryptsoft.com>, the commented
+                /* according to Tim Hudson <tjh@cryptsoft.com>, the commented
                  * out version above can cause 'inl' write calls under
                  * some stupid stdio implementations (VMS) */
                 }
diff --git a/src/lib/libssl/src/crypto/bio/bss_log.c b/src/lib/libssl/src/crypto/bio/bss_log.c
index db82e757e7..4308b19663 100644
--- a/src/lib/libssl/src/crypto/bio/bss_log.c
+++ b/src/lib/libssl/src/crypto/bio/bss_log.c
@@ -72,6 +72,8 @@
 #else
 #include <syslog.h>
 #endif
+#else
+#include <process.h>
 #endif
 
 #include "cryptlib.h"
@@ -98,6 +100,7 @@ static BIO_METHOD methods_slg=
         slg_ctrl,
         slg_new,
         slg_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_log(void)
@@ -131,8 +134,10 @@ static int MS_CALLBACK slg_write(BIO *b, char *in, int inl)
         char* buf= in;
         char* pp;
 #if defined(WIN32)
-        LPTSTR lpszStrings[1];
+        LPCSTR lpszStrings[2];
         WORD evtype= EVENTLOG_ERROR_TYPE;
+        int pid = _getpid();
+        char pidbuf[20];
 #else
         int priority;
 #endif
@@ -156,10 +161,13 @@ static int MS_CALLBACK slg_write(BIO *b, char *in, int inl)
                 evtype= EVENTLOG_ERROR_TYPE;
                 pp= buf;
         }
-        lpszStrings[0]= pp;
+
+        sprintf(pidbuf, "[%d] ", pid);
+        lpszStrings[0] = pidbuf;
+        lpszStrings[1] = pp;
 
         if(b->ptr)
-                ReportEvent(b->ptr, evtype, 0, 1024, NULL, 1, 0,
+                ReportEvent(b->ptr, evtype, 0, 1024, NULL, 2, 0,
                                 lpszStrings, NULL);
 #else
         if(strncmp(buf, "ERR ", 4) == 0){
diff --git a/src/lib/libssl/src/crypto/bio/bss_mem.c b/src/lib/libssl/src/crypto/bio/bss_mem.c
index 7e749a503e..41eab92415 100644
--- a/src/lib/libssl/src/crypto/bio/bss_mem.c
+++ b/src/lib/libssl/src/crypto/bio/bss_mem.c
@@ -79,6 +79,7 @@ static BIO_METHOD mem_method=
         mem_ctrl,
         mem_new,
         mem_free,
+        NULL,
         };
 
 /* bio->num is used to hold the value to return on 'empty', if it is
@@ -89,6 +90,26 @@ BIO_METHOD *BIO_s_mem(void)
         return(&mem_method);
         }
 
+BIO *BIO_new_mem_buf(void *buf, int len)
+{
+        BIO *ret;
+        BUF_MEM *b;
+        if (!buf) {
+                BIOerr(BIO_F_BIO_NEW_MEM_BUF,BIO_R_NULL_PARAMETER);
+                return NULL;
+        }
+        if(len == -1) len = strlen(buf);
+        if(!(ret = BIO_new(BIO_s_mem())) ) return NULL;
+        b = (BUF_MEM *)ret->ptr;
+        b->data = buf;
+        b->length = len;
+        b->max = len;
+        ret->flags |= BIO_FLAGS_MEM_RDONLY;
+        /* Since this is static data retrying wont help */
+        ret->num = 0;
+        return ret;
+}
+
 static int mem_new(BIO *bi)
         {
         BUF_MEM *b;
@@ -109,7 +130,10 @@ static int mem_free(BIO *a)
                 {
                 if ((a->init) && (a->ptr != NULL))
                         {
-                        BUF_MEM_free((BUF_MEM *)a->ptr);
+                        BUF_MEM *b;
+                        b = (BUF_MEM *)a->ptr;
+                        if(a->flags & BIO_FLAGS_MEM_RDONLY) b->data = NULL;
+                        BUF_MEM_free(b);
                         a->ptr=NULL;
                         }
                 }
@@ -126,17 +150,18 @@ static int mem_read(BIO *b, char *out, int outl)
         bm=(BUF_MEM *)b->ptr;
         BIO_clear_retry_flags(b);
         ret=(outl > bm->length)?bm->length:outl;
-        if ((out != NULL) && (ret > 0))
-                {
+        if ((out != NULL) && (ret > 0)) {
                 memcpy(out,bm->data,ret);
                 bm->length-=ret;
                 /* memmove(&(bm->data[0]),&(bm->data[ret]), bm->length); */
-                from=(char *)&(bm->data[ret]);
-                to=(char *)&(bm->data[0]);
-                for (i=0; i<bm->length; i++)
-                        to[i]=from[i];
+                if(b->flags & BIO_FLAGS_MEM_RDONLY) bm->data += ret;
+                else {
+                        from=(char *)&(bm->data[ret]);
+                        to=(char *)&(bm->data[0]);
+                        for (i=0; i<bm->length; i++)
+                                to[i]=from[i];
                 }
-        else if (bm->length == 0)
+        } else if (bm->length == 0)
                 {
                 if (b->num != 0)
                         BIO_set_retry_read(b);
@@ -158,6 +183,11 @@ static int mem_write(BIO *b, char *in, int inl)
                 goto end;
                 }
 
+        if(b->flags & BIO_FLAGS_MEM_RDONLY) {
+                BIOerr(BIO_F_MEM_WRITE,BIO_R_WRITE_TO_READ_ONLY_BIO);
+                goto end;
+        }
+
         BIO_clear_retry_flags(b);
         blen=bm->length;
         if (BUF_MEM_grow(bm,blen+inl) != (blen+inl))
@@ -178,9 +208,15 @@ static long mem_ctrl(BIO *b, int cmd, long num, char *ptr)
         switch (cmd)
                 {
         case BIO_CTRL_RESET:
-                if (bm->data != NULL)
-                        memset(bm->data,0,bm->max);
-                bm->length=0;
+                if (bm->data != NULL) {
+                        /* For read only case reset to the start again */
+                        if(b->flags & BIO_FLAGS_MEM_RDONLY) 
+                                        bm->data -= bm->max - bm->length;
+                        else {
+                                memset(bm->data,0,bm->max);
+                                bm->length=0;
+                        }
+                }
                 break;
         case BIO_CTRL_EOF:
                 ret=(long)(bm->length == 0);
diff --git a/src/lib/libssl/src/crypto/bio/bss_null.c b/src/lib/libssl/src/crypto/bio/bss_null.c
index d04be888e5..aee18e3ada 100644
--- a/src/lib/libssl/src/crypto/bio/bss_null.c
+++ b/src/lib/libssl/src/crypto/bio/bss_null.c
@@ -79,6 +79,7 @@ static BIO_METHOD null_method=
         null_ctrl,
         null_new,
         null_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_null(void)
diff --git a/src/lib/libssl/src/crypto/bio/bss_rtcp.c b/src/lib/libssl/src/crypto/bio/bss_rtcp.c
index 2ef040057e..4ad0739464 100644
--- a/src/lib/libssl/src/crypto/bio/bss_rtcp.c
+++ b/src/lib/libssl/src/crypto/bio/bss_rtcp.c
@@ -107,6 +107,7 @@ static BIO_METHOD rtcp_method=
         rtcp_ctrl,
         rtcp_new,
         rtcp_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_rtcp(void)
diff --git a/src/lib/libssl/src/crypto/bio/bss_sock.c b/src/lib/libssl/src/crypto/bio/bss_sock.c
index d336b99fe8..8ce80ef68d 100644
--- a/src/lib/libssl/src/crypto/bio/bss_sock.c
+++ b/src/lib/libssl/src/crypto/bio/bss_sock.c
@@ -95,6 +95,7 @@ static BIO_METHOD methods_sockp=
         sock_ctrl,
         sock_new,
         sock_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_socket(void)
@@ -112,6 +113,7 @@ static BIO_METHOD methods_fdp=
         fd_ctrl,
         fd_new,
         fd_free,
+        NULL,
         };
 
 BIO_METHOD *BIO_s_fd(void)
@@ -163,8 +165,7 @@ static int fd_free(BIO *a)
                 if (a->init)
                         {
 #ifndef BIO_FD
-                        shutdown(a->num,2);
-                        closesocket(a->num);
+                        SHUTDOWN2(a->num);
 #else                   /* BIO_FD */
                         close(a->num);
 #endif
diff --git a/src/lib/libssl/src/crypto/bn/Makefile.ssl b/src/lib/libssl/src/crypto/bn/Makefile.ssl
index cf77869fab..fa23a43fa0 100644
--- a/src/lib/libssl/src/crypto/bn/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/bn/Makefile.ssl
@@ -20,6 +20,13 @@ BN_ASM=		bn_asm.o
 #BN_ASM=        bn86-elf.o
 
 CFLAGS= $(INCLUDES) $(CFLAG)
+
+# We let the C compiler driver to take care of .s files. This is done in
+# order to be excused from maintaining a separate set of architecture
+# dependent assembler flags. E.g. if you throw -mcpu=ultrasparc at SPARC
+# gcc, then the driver will automatically translate it to -xarch=v8plus
+# and pass it down to assembler.
+AS=$(CC) -c
 ASFLAGS=$(CFLAGS)
 
 GENERAL=Makefile
@@ -27,12 +34,12 @@ TEST=bntest.c exptest.c
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC= bn_add.c bn_div.c bn_exp.c bn_lib.c bn_mul.c \
+LIBSRC= bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c \
         bn_print.c bn_rand.c bn_shift.c bn_word.c bn_blind.c \
         bn_gcd.c bn_prime.c bn_err.c bn_sqr.c bn_asm.c bn_recp.c bn_mont.c \
         bn_mpi.c bn_exp2.c
 
-LIBOBJ= bn_add.o bn_div.o bn_exp.o bn_lib.o bn_mul.o \
+LIBOBJ= bn_add.o bn_div.o bn_exp.o bn_lib.o bn_ctx.o bn_mul.o \
         bn_print.o bn_rand.o bn_shift.o bn_word.o bn_blind.o \
         bn_gcd.o bn_prime.o bn_err.o bn_sqr.o $(BN_ASM) bn_recp.o bn_mont.o \
         bn_mpi.o bn_exp2.o
@@ -49,12 +56,14 @@ top:
 
 all:    lib
 
-knuth: bn_knuth.c
-        cc -pg -I.. -I../../include bn_knuth.c -o knuth $(LIB) #../../../libefence.a
+bn_prime.h: bn_prime.pl
+        $(PERL) bn_prime.pl >bn_prime.h
 
-knuth.fast: bn_knuth.c
-        cc -pg -fast -I.. -I../../include bn_knuth.c -o knuth $(LIB) #../../../libefence.a
+divtest: divtest.c ../../libcrypto.a
+        cc -I../../include divtest.c -o divtest ../../libcrypto.a
 
+bnbug: bnbug.c ../../libcrypto.a top
+        cc -g -I../../include bnbug.c -o bnbug ../../libcrypto.a
 
 lib:    $(LIBOBJ)
         $(AR) $(LIB) $(LIBOBJ)
@@ -113,13 +122,6 @@ asm/sparcv8plus-gcc27.o: asm/sparcv8plus.S
         $(CC) $(ASFLAGS) -E asm/sparcv8plus.S | \
                 /usr/ccs/bin/as -xarch=v8plus - -o asm/sparcv8plus-gcc27.o
 
-# MIPS 64 bit assember 
-asm/mips3.o: asm/mips3.s
-
-# MIPS 32 bit assember
-asm/mips1.o: asm/mips1.s
-        /usr/bin/as -O2 -o asm/mips1.o asm/mips1.s
-
 files:
         $(PERL) $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO
 
@@ -168,109 +170,117 @@ bn_add.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_add.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_add.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_add.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_add.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_add.o: ../cryptlib.h bn_lcl.h
+bn_add.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_add.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_asm.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_asm.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_asm.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_asm.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_asm.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_asm.o: ../cryptlib.h bn_lcl.h
+bn_asm.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_asm.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_blind.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_blind.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_blind.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_blind.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_blind.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_blind.o: ../cryptlib.h bn_lcl.h
+bn_blind.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_blind.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
+bn_ctx.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
+bn_ctx.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+bn_ctx.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+bn_ctx.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
+bn_ctx.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_ctx.o: ../../include/openssl/stack.h ../cryptlib.h
 bn_div.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_div.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_div.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_div.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_div.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_div.o: ../cryptlib.h bn_lcl.h
+bn_div.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_div.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_err.o: ../../include/openssl/bn.h ../../include/openssl/err.h
 bn_err.o: ../../include/openssl/opensslconf.h
 bn_exp.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_exp.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_exp.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_exp.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_exp.o: ../cryptlib.h bn_lcl.h
+bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_exp.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_exp2.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_exp2.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_exp2.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_exp2.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_exp2.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_exp2.o: ../cryptlib.h bn_lcl.h
+bn_exp2.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_exp2.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_gcd.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_gcd.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_gcd.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_gcd.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_gcd.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_gcd.o: ../cryptlib.h bn_lcl.h
+bn_gcd.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_gcd.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_lib.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_lib.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_lib.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_lib.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_lib.o: ../cryptlib.h bn_lcl.h
+bn_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_lib.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_mont.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_mont.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_mont.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_mont.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_mont.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_mont.o: ../cryptlib.h bn_lcl.h
+bn_mont.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_mont.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_mpi.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_mpi.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_mpi.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_mpi.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_mpi.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_mpi.o: ../cryptlib.h bn_lcl.h
+bn_mpi.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_mpi.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_mul.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_mul.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_mul.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_mul.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_mul.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_mul.o: ../cryptlib.h bn_lcl.h
+bn_mul.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_mul.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_prime.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_prime.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_prime.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_prime.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 bn_prime.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-bn_prime.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h bn_prime.h
+bn_prime.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bn_prime.o: ../cryptlib.h bn_lcl.h bn_prime.h
 bn_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_print.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_print.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_print.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_print.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_print.o: ../cryptlib.h bn_lcl.h
+bn_print.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_print.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_rand.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_rand.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_rand.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_rand.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 bn_rand.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-bn_rand.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
+bn_rand.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bn_rand.o: ../cryptlib.h bn_lcl.h
 bn_recp.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_recp.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_recp.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_recp.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_recp.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_recp.o: ../cryptlib.h bn_lcl.h
+bn_recp.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_recp.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_shift.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_shift.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_shift.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_shift.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_shift.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_shift.o: ../cryptlib.h bn_lcl.h
+bn_shift.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_shift.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_sqr.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_sqr.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_sqr.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_sqr.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_sqr.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_sqr.o: ../cryptlib.h bn_lcl.h
+bn_sqr.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_sqr.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
 bn_word.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 bn_word.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 bn_word.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 bn_word.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-bn_word.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-bn_word.o: ../cryptlib.h bn_lcl.h
+bn_word.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+bn_word.o: ../../include/openssl/stack.h ../cryptlib.h bn_lcl.h
diff --git a/src/lib/libssl/src/crypto/bn/asm/README b/src/lib/libssl/src/crypto/bn/asm/README
index d93fbff77f..86bf64cfc2 100644
--- a/src/lib/libssl/src/crypto/bn/asm/README
+++ b/src/lib/libssl/src/crypto/bn/asm/README
@@ -1,5 +1,5 @@
 All assember in this directory are just version of the file
-crypto/bn/bn_mulw.c.
+crypto/bn/bn_asm.c.
 
 Quite a few of these files are just the assember output from gcc since on 
 quite a few machines they are 2 times faster than the system compiler.
@@ -15,13 +15,6 @@ On the 2 alpha C compilers I had access to, it was not possible to do
 were 64 bits).  So the hand assember gives access to the 128 bit result and
 a 2 times speedup :-).
 
-The x86xxxx.obj files are the assembled version of x86xxxx.asm files.
-I had such a hard time finding a macro assember for Microsoft, I decided to
-include the object file to save others the hassle :-).
-
-I have also included uu encoded versions of the .obj incase they get
-trashed.
-
 There are 2 versions of assember for the HP PA-RISC.
 pa-risc.s is the origional one which works fine.
 pa-risc2.s is a new version that often generates warnings but if the
diff --git a/src/lib/libssl/src/crypto/bn/asm/alpha.s b/src/lib/libssl/src/crypto/bn/asm/alpha.s
index a351694ca2..555ff0b92d 100644
--- a/src/lib/libssl/src/crypto/bn/asm/alpha.s
+++ b/src/lib/libssl/src/crypto/bn/asm/alpha.s
@@ -694,567 +694,1868 @@ bn_mul_comba8:
 bn_mul_comba8..ng:
         .frame $30,0,$26,0
         .prologue 0
-
-        subq    $30,    16,     $30
-        ldq     $0,     0($17)
+        ldq     $1,     0($17)
+        ldq     $2,     0($18)
+        zapnot  $1,     15,     $7
+        srl     $2,     32,     $8
+        mulq    $8,     $7,     $22
+        srl     $1,     32,     $6
+        zapnot  $2,     15,     $5
+        mulq    $5,     $6,     $4
+        mulq    $7,     $5,     $24
+        addq    $22,    $4,     $22
+        cmpult  $22,    $4,     $1
+        mulq    $6,     $8,     $3
+        beq     $1,     $173
+        bis     $31,    1,      $1
+        sll     $1,     32,     $1
+        addq    $3,     $1,     $3
+$173:
+        sll     $22,    32,     $4
+        addq    $24,    $4,     $24
+        stq     $24,    0($16)
+        ldq     $2,     0($17)
+        ldq     $1,     8($18)
+        zapnot  $2,     15,     $7
+        srl     $1,     32,     $8
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $2,     32,     $6
+        mulq    $5,     $6,     $23
+        mulq    $6,     $8,     $6
+        srl     $22,    32,     $1
+        cmpult  $24,    $4,     $2
+        addq    $3,     $1,     $3
+        addq    $2,     $3,     $22
+        addq    $25,    $23,    $25
+        cmpult  $25,    $23,    $1
+        bis     $31,    1,      $2
+        beq     $1,     $177
+        sll     $2,     32,     $1
+        addq    $6,     $1,     $6
+$177:
+        sll     $25,    32,     $23
         ldq     $1,     0($18)
-        stq     $9,     0($30)
-        stq     $10,    8($30)
-        ldq     $2,     8($17)
-        ldq     $3,     8($18)
-        ldq     $4,     16($17)
-        ldq     $5,     16($18)
-        ldq     $6,     24($17)
-        ldq     $7,     24($18)
-        ldq     $8,     8($17)
-        ldq     $22,    8($18)
-        ldq     $23,    8($17)
-        ldq     $24,    8($18)
-        ldq     $25,    8($17)
-        ldq     $27,    8($18)
-        ldq     $28,    8($17)
-        ldq     $21,    8($18)
-        bis     $31,    $31,    $9
-        mulq    $0,     $1,     $20
-        umulh   $0,     $1,     $19
-        stq     $20,    0($16)
-        bis     $31,    $31,    $20
-        mulq    $0,     $3,     $10
-        umulh   $0,     $3,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $10
-        addq    $20,    $10,    $20
-        mulq    $2,     $1,     $18
-        umulh   $2,     $1,     $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        stq     $19,    8($16)
-        bis     $31,    $31,    $19
-        mulq    $0,     $5,     $10
-        umulh   $0,     $5,     $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        mulq    $2,     $3,     $18
-        umulh   $2,     $3,     $17
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $19,    $18,    $19
-        mulq    $4,     $1,     $10
-        umulh   $4,     $1,     $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        stq     $9,     16($16)
-        bis     $31,    $31,    $9
-        mulq    $0,     $7,     $18
-        umulh   $0,     $7,     $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $2,     $5,     $10
-        umulh   $2,     $5,     $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        mulq    $4,     $3,     $18
-        umulh   $4,     $3,     $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $6,     $1,     $10
-        umulh   $6,     $1,     $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        stq     $20,    24($16)
-        bis     $31,    $31,    $20
-        mulq    $0,     $22,    $18
-        umulh   $0,     $22,    $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        mulq    $2,     $7,     $10
-        umulh   $2,     $7,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $10
-        addq    $20,    $10,    $20
-        mulq    $4,     $5,     $18
-        umulh   $4,     $5,     $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        mulq    $6,     $3,     $10
-        umulh   $6,     $3,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $10
-        addq    $20,    $10,    $20
-        mulq    $8,     $1,     $18
-        umulh   $8,     $1,     $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        stq     $19,    32($16)
-        bis     $31,    $31,    $19
-        mulq    $0,     $24,    $10
-        umulh   $0,     $24,    $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        mulq    $2,     $22,    $18
-        umulh   $2,     $22,    $17
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $19,    $18,    $19
-        mulq    $4,     $7,     $10
-        umulh   $4,     $7,     $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        mulq    $6,     $5,     $18
-        umulh   $6,     $5,     $17
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $19,    $18,    $19
-        mulq    $8,     $3,     $10
-        umulh   $8,     $3,     $17
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $18
-        addq    $18,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        mulq    $23,    $1,     $18
-        umulh   $23,    $1,     $17
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $19,    $18,    $19
-        stq     $9,     40($16)
-        bis     $31,    $31,    $9
-        mulq    $0,     $27,    $10
-        umulh   $0,     $27,    $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        mulq    $2,     $24,    $18
-        umulh   $2,     $24,    $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $4,     $22,    $10
-        umulh   $4,     $22,    $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        mulq    $6,     $7,     $18
-        umulh   $6,     $7,     $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $8,     $5,     $10
-        umulh   $8,     $5,     $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        mulq    $23,    $3,     $18
-        umulh   $23,    $3,     $17
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $9,     $18,    $9
-        mulq    $25,    $1,     $10
-        umulh   $25,    $1,     $17
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $10
-        addq    $9,     $10,    $9
-        stq     $20,    48($16)
-        bis     $31,    $31,    $20
-        mulq    $0,     $21,    $18
-        umulh   $0,     $21,    $17
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $10
-        addq    $10,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $20,    $18,    $20
-        mulq    $2,     $27,    $10
-        umulh   $2,     $27,    $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $0
-        addq    $20,    $0,     $20
-        mulq    $4,     $24,    $10
-        umulh   $4,     $24,    $18
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $17
-        addq    $17,    $18,    $18
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $0
-        addq    $20,    $0,     $20
-        mulq    $6,     $22,    $10
-        umulh   $6,     $22,    $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $0
-        addq    $20,    $0,     $20
-        mulq    $8,     $7,     $10
-        umulh   $8,     $7,     $18
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $17
-        addq    $17,    $18,    $18
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $0
-        addq    $20,    $0,     $20
-        mulq    $23,    $5,     $10
-        umulh   $23,    $5,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $0
-        addq    $20,    $0,     $20
-        mulq    $25,    $3,     $10
-        umulh   $25,    $3,     $18
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $17
-        addq    $17,    $18,    $18
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $0
-        addq    $20,    $0,     $20
-        mulq    $28,    $1,     $10
-        umulh   $28,    $1,     $17
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $0
-        addq    $20,    $0,     $20
-        stq     $19,    56($16)
-        bis     $31,    $31,    $19
-        mulq    $2,     $21,    $10
-        umulh   $2,     $21,    $18
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $17
-        addq    $17,    $18,    $18
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $0
-        addq    $19,    $0,     $19
-        mulq    $4,     $27,    $1
-        umulh   $4,     $27,    $10
-        addq    $9,     $1,     $9
-        cmpult  $9,     $1,     $17
-        addq    $17,    $10,    $10
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $18
-        addq    $19,    $18,    $19
-        mulq    $6,     $24,    $0
-        umulh   $6,     $24,    $2
-        addq    $9,     $0,     $9
-        cmpult  $9,     $0,     $1
-        addq    $1,     $2,     $2
-        addq    $20,    $2,     $20
-        cmpult  $20,    $2,     $17
-        addq    $19,    $17,    $19
-        mulq    $8,     $22,    $10
-        umulh   $8,     $22,    $18
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $0
-        addq    $0,     $18,    $18
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $1
-        addq    $19,    $1,     $19
-        mulq    $23,    $7,     $2
-        umulh   $23,    $7,     $17
-        addq    $9,     $2,     $9
-        cmpult  $9,     $2,     $10
-        addq    $10,    $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $0
-        addq    $19,    $0,     $19
-        mulq    $25,    $5,     $18
-        umulh   $25,    $5,     $1
-        addq    $9,     $18,    $9
-        cmpult  $9,     $18,    $2
-        addq    $2,     $1,     $1
-        addq    $20,    $1,     $20
-        cmpult  $20,    $1,     $10
-        addq    $19,    $10,    $19
-        mulq    $28,    $3,     $17
-        umulh   $28,    $3,     $0
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $18
-        addq    $18,    $0,     $0
-        addq    $20,    $0,     $20
-        cmpult  $20,    $0,     $2
-        addq    $19,    $2,     $19
-        stq     $9,     64($16)
-        bis     $31,    $31,    $9
-        mulq    $4,     $21,    $1
-        umulh   $4,     $21,    $10
-        addq    $20,    $1,     $20
-        cmpult  $20,    $1,     $17
-        addq    $17,    $10,    $10
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $18
-        addq    $9,     $18,    $9
-        mulq    $6,     $27,    $0
-        umulh   $6,     $27,    $2
-        addq    $20,    $0,     $20
-        cmpult  $20,    $0,     $3
-        addq    $3,     $2,     $2
-        addq    $19,    $2,     $19
-        cmpult  $19,    $2,     $1
-        addq    $9,     $1,     $9
-        mulq    $8,     $24,    $17
-        umulh   $8,     $24,    $10
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $18
-        addq    $18,    $10,    $10
-        addq    $19,    $10,    $19
-        cmpult  $19,    $10,    $4
-        addq    $9,     $4,     $9
-        mulq    $23,    $22,    $0
-        umulh   $23,    $22,    $3
-        addq    $20,    $0,     $20
-        cmpult  $20,    $0,     $2
-        addq    $2,     $3,     $3
-        addq    $19,    $3,     $19
-        cmpult  $19,    $3,     $1
-        addq    $9,     $1,     $9
-        mulq    $25,    $7,     $17
-        umulh   $25,    $7,     $18
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $10,    $18,    $18
-        addq    $19,    $18,    $19
-        cmpult  $19,    $18,    $4
-        addq    $9,     $4,     $9
-        mulq    $28,    $5,     $0
-        umulh   $28,    $5,     $2
-        addq    $20,    $0,     $20
-        cmpult  $20,    $0,     $3
-        addq    $3,     $2,     $2
-        addq    $19,    $2,     $19
-        cmpult  $19,    $2,     $1
-        addq    $9,     $1,     $9
-        stq     $20,    72($16)
-        bis     $31,    $31,    $20
-        mulq    $6,     $21,    $17
-        umulh   $6,     $21,    $10
-        addq    $19,    $17,    $19
-        cmpult  $19,    $17,    $18
-        addq    $18,    $10,    $10
-        addq    $9,     $10,    $9
-        cmpult  $9,     $10,    $4
-        addq    $20,    $4,     $20
-        mulq    $8,     $27,    $0
-        umulh   $8,     $27,    $3
-        addq    $19,    $0,     $19
-        cmpult  $19,    $0,     $2
-        addq    $2,     $3,     $3
-        addq    $9,     $3,     $9
-        cmpult  $9,     $3,     $1
-        addq    $20,    $1,     $20
-        mulq    $23,    $24,    $5
-        umulh   $23,    $24,    $17
-        addq    $19,    $5,     $19
-        cmpult  $19,    $5,     $18
-        addq    $18,    $17,    $17
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $10
-        addq    $20,    $10,    $20
-        mulq    $25,    $22,    $4
-        umulh   $25,    $22,    $6
-        addq    $19,    $4,     $19
-        cmpult  $19,    $4,     $0
-        addq    $0,     $6,     $6
-        addq    $9,     $6,     $9
-        cmpult  $9,     $6,     $2
-        addq    $20,    $2,     $20
-        mulq    $28,    $7,     $3
-        umulh   $28,    $7,     $1
-        addq    $19,    $3,     $19
-        cmpult  $19,    $3,     $5
-        addq    $5,     $1,     $1
-        addq    $9,     $1,     $9
-        cmpult  $9,     $1,     $18
-        addq    $20,    $18,    $20
-        stq     $19,    80($16)
-        bis     $31,    $31,    $19
-        mulq    $8,     $21,    $17
-        umulh   $8,     $21,    $10
-        addq    $9,     $17,    $9
-        cmpult  $9,     $17,    $4
-        addq    $4,     $10,    $10
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $0
-        addq    $19,    $0,     $19
-        mulq    $23,    $27,    $6
-        umulh   $23,    $27,    $2
-        addq    $9,     $6,     $9
-        cmpult  $9,     $6,     $3
-        addq    $3,     $2,     $2
+        addq    $0,     $23,    $0
+        bis     $0,     $0,     $7
+        ldq     $3,     8($17)
+        addq    $22,    $7,     $22
+        srl     $1,     32,     $8
+        cmpult  $22,    $7,     $4
+        zapnot  $3,     15,     $7
+        mulq    $8,     $7,     $28
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $25,    32,     $1
+        cmpult  $0,     $23,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $4,     $6,     $24
+        srl     $3,     32,     $6
+        mulq    $5,     $6,     $2
+        mulq    $6,     $8,     $6
+        addq    $28,    $2,     $28
+        cmpult  $28,    $2,     $1
+        bis     $31,    1,      $2
+        beq     $1,     $181
+        sll     $2,     32,     $1
+        addq    $6,     $1,     $6
+$181:
+        sll     $28,    32,     $2
+        addq    $21,    $2,     $21
+        bis     $21,    $21,    $7
+        addq    $22,    $7,     $22
+        stq     $22,    8($16)
+        ldq     $3,     16($17)
+        ldq     $1,     0($18)
+        cmpult  $22,    $7,     $4
+        zapnot  $3,     15,     $7
+        srl     $1,     32,     $8
+        mulq    $8,     $7,     $22
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $20
+        srl     $28,    32,     $1
+        cmpult  $21,    $2,     $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $4,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $3,     32,     $6
+        mulq    $5,     $6,     $2
+        mulq    $6,     $8,     $6
+        addq    $22,    $2,     $22
+        cmpult  $22,    $2,     $1
+        bis     $31,    1,      $2
+        beq     $1,     $185
+        sll     $2,     32,     $1
+        addq    $6,     $1,     $6
+$185:
+        sll     $22,    32,     $2
+        ldq     $1,     8($18)
         addq    $20,    $2,     $20
-        cmpult  $20,    $2,     $5
-        addq    $19,    $5,     $19
-        mulq    $25,    $24,    $1
-        umulh   $25,    $24,    $18
-        addq    $9,     $1,     $9
-        cmpult  $9,     $1,     $7
-        addq    $7,     $18,    $18
-        addq    $20,    $18,    $20
-        cmpult  $20,    $18,    $17
-        addq    $19,    $17,    $19
-        mulq    $28,    $22,    $4
-        umulh   $28,    $22,    $10
-        addq    $9,     $4,     $9
-        cmpult  $9,     $4,     $0
-        addq    $0,     $10,    $10
-        addq    $20,    $10,    $20
-        cmpult  $20,    $10,    $8
-        addq    $19,    $8,     $19
-        stq     $9,     88($16)
-        bis     $31,    $31,    $9
-        mulq    $23,    $21,    $6
-        umulh   $23,    $21,    $3
-        addq    $20,    $6,     $20
-        cmpult  $20,    $6,     $2
-        addq    $2,     $3,     $3
-        addq    $19,    $3,     $19
-        cmpult  $19,    $3,     $5
-        addq    $9,     $5,     $9
-        mulq    $25,    $27,    $1
-        umulh   $25,    $27,    $7
-        addq    $20,    $1,     $20
-        cmpult  $20,    $1,     $18
-        addq    $18,    $7,     $7
-        addq    $19,    $7,     $19
-        cmpult  $19,    $7,     $17
-        addq    $9,     $17,    $9
-        mulq    $28,    $24,    $4
-        umulh   $28,    $24,    $0
-        addq    $20,    $4,     $20
-        cmpult  $20,    $4,     $10
-        addq    $10,    $0,     $0
-        addq    $19,    $0,     $19
-        cmpult  $19,    $0,     $8
-        addq    $9,     $8,     $9
-        stq     $20,    96($16)
-        bis     $31,    $31,    $20
-        mulq    $25,    $21,    $22
-        umulh   $25,    $21,    $6
-        addq    $19,    $22,    $19
-        cmpult  $19,    $22,    $2
+        bis     $20,    $20,    $7
+        ldq     $4,     8($17)
+        addq    $24,    $7,     $24
+        srl     $1,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $22,    32,     $1
+        cmpult  $20,    $2,     $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $22
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $189
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$189:
+        sll     $25,    32,     $5
+        ldq     $2,     16($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     0($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $193
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$193:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        stq     $24,    16($16)
+        ldq     $4,     0($17)
+        ldq     $5,     24($18)
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $24
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $0,     $24,    $0
+        cmpult  $0,     $24,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $197
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$197:
+        sll     $0,     32,     $24
+        ldq     $1,     16($18)
+        addq    $2,     $24,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     8($17)
+        addq    $23,    $7,     $23
+        srl     $1,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $24,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $24
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $201
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$201:
+        sll     $25,    32,     $5
+        ldq     $2,     8($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     16($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $205
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$205:
+        sll     $28,    32,     $25
+        ldq     $2,     0($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $209
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$209:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $23,    $7,     $23
+        stq     $23,    24($16)
+        ldq     $4,     32($17)
+        ldq     $5,     0($18)
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $23
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $28,    $23,    $28
+        cmpult  $28,    $23,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $213
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$213:
+        sll     $28,    32,     $23
+        ldq     $1,     8($18)
+        addq    $2,     $23,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     24($17)
+        addq    $22,    $7,     $22
+        srl     $1,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $23,    $2
+        addq    $6,     $1,     $6
         addq    $2,     $6,     $6
-        addq    $9,     $6,     $9
-        cmpult  $9,     $6,     $3
-        addq    $20,    $3,     $20
-        mulq    $28,    $27,    $5
-        umulh   $28,    $27,    $23
-        addq    $19,    $5,     $19
-        cmpult  $19,    $5,     $1
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $217
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$217:
+        sll     $25,    32,     $5
+        ldq     $2,     16($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     16($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
         addq    $1,     $23,    $23
-        addq    $9,     $23,    $9
-        cmpult  $9,     $23,    $18
-        addq    $20,    $18,    $20
-        stq     $19,    104($16)
-        bis     $31,    $31,    $19
-        mulq    $28,    $21,    $7
-        umulh   $28,    $21,    $17
-        addq    $9,     $7,     $9
-        cmpult  $9,     $7,     $4
-        addq    $4,     $17,    $17
-        addq    $20,    $17,    $20
-        cmpult  $20,    $17,    $10
-        addq    $19,    $10,    $19
-        stq     $9,     112($16)
-        stq     $20,    120($16)
-        ldq     $9,     0($30)
-        ldq     $10,    8($30)
-        addq    $30,    16,     $30
-        ret     $31,($26),1
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $221
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$221:
+        sll     $28,    32,     $25
+        ldq     $2,     24($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     8($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $225
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$225:
+        sll     $0,     32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     0($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $229
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$229:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $22,    $7,     $22
+        stq     $22,    32($16)
+        ldq     $4,     0($17)
+        ldq     $5,     40($18)
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $22
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $0,     $22,    $0
+        cmpult  $0,     $22,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $233
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$233:
+        sll     $0,     32,     $22
+        ldq     $1,     32($18)
+        addq    $2,     $22,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     8($17)
+        addq    $24,    $7,     $24
+        srl     $1,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $22,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $22
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $237
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$237:
+        sll     $25,    32,     $5
+        ldq     $2,     24($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     16($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $241
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$241:
+        sll     $28,    32,     $25
+        ldq     $2,     16($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $245
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$245:
+        sll     $0,     32,     $25
+        ldq     $2,     8($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     32($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $249
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$249:
+        sll     $28,    32,     $25
+        ldq     $2,     0($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     40($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $253
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$253:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        stq     $24,    40($16)
+        ldq     $4,     48($17)
+        ldq     $5,     0($18)
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $24
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $28,    $24,    $28
+        cmpult  $28,    $24,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $257
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$257:
+        sll     $28,    32,     $24
+        ldq     $1,     8($18)
+        addq    $2,     $24,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     40($17)
+        addq    $23,    $7,     $23
+        srl     $1,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $24,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $24
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $261
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$261:
+        sll     $25,    32,     $5
+        ldq     $2,     16($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     32($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $265
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$265:
+        sll     $28,    32,     $25
+        ldq     $2,     24($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $269
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$269:
+        sll     $0,     32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     16($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $273
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$273:
+        sll     $28,    32,     $25
+        ldq     $2,     40($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     8($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $277
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$277:
+        sll     $0,     32,     $25
+        ldq     $2,     48($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     0($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $281
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$281:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $23,    $7,     $23
+        stq     $23,    48($16)
+        ldq     $4,     0($17)
+        ldq     $5,     56($18)
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $23
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $0,     $23,    $0
+        cmpult  $0,     $23,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $285
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$285:
+        sll     $0,     32,     $23
+        ldq     $1,     48($18)
+        addq    $2,     $23,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     8($17)
+        addq    $22,    $7,     $22
+        srl     $1,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $23,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $289
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$289:
+        sll     $25,    32,     $5
+        ldq     $2,     40($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     16($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $293
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$293:
+        sll     $28,    32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $297
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$297:
+        sll     $0,     32,     $25
+        ldq     $2,     24($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     32($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $301
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$301:
+        sll     $28,    32,     $25
+        ldq     $2,     16($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     40($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $305
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$305:
+        sll     $0,     32,     $25
+        ldq     $2,     8($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     48($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $309
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$309:
+        sll     $28,    32,     $25
+        ldq     $2,     0($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     56($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $313
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$313:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $22,    $7,     $22
+        stq     $22,    56($16)
+        ldq     $4,     56($17)
+        ldq     $5,     8($18)
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $22
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $28,    $22,    $28
+        cmpult  $28,    $22,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $317
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$317:
+        sll     $28,    32,     $22
+        ldq     $1,     16($18)
+        addq    $2,     $22,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     48($17)
+        addq    $24,    $7,     $24
+        srl     $1,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $22,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $22
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $321
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$321:
+        sll     $25,    32,     $5
+        ldq     $2,     24($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     40($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $325
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$325:
+        sll     $28,    32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     32($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $329
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$329:
+        sll     $0,     32,     $25
+        ldq     $2,     40($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $333
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$333:
+        sll     $28,    32,     $25
+        ldq     $2,     48($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     16($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $337
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$337:
+        sll     $0,     32,     $25
+        ldq     $2,     56($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     8($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $341
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$341:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        stq     $24,    64($16)
+        ldq     $4,     16($17)
+        ldq     $5,     56($18)
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $24
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $0,     $24,    $0
+        cmpult  $0,     $24,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $345
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$345:
+        sll     $0,     32,     $24
+        ldq     $1,     48($18)
+        addq    $2,     $24,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     24($17)
+        addq    $23,    $7,     $23
+        srl     $1,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $24,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $24
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $349
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$349:
+        sll     $25,    32,     $5
+        ldq     $2,     40($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     32($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $353
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$353:
+        sll     $28,    32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     40($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $357
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$357:
+        sll     $0,     32,     $25
+        ldq     $2,     24($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     48($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $361
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$361:
+        sll     $28,    32,     $25
+        ldq     $2,     16($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     56($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $365
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$365:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $23,    $7,     $23
+        stq     $23,    72($16)
+        ldq     $4,     56($17)
+        ldq     $5,     24($18)
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $23
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $28,    $23,    $28
+        cmpult  $28,    $23,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $369
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$369:
+        sll     $28,    32,     $23
+        ldq     $1,     32($18)
+        addq    $2,     $23,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     48($17)
+        addq    $22,    $7,     $22
+        srl     $1,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $23,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $21
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $373
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$373:
+        sll     $25,    32,     $5
+        ldq     $2,     40($18)
+        addq    $0,     $5,     $0
+        bis     $0,     $0,     $7
+        ldq     $4,     40($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $0,     $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $377
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$377:
+        sll     $28,    32,     $25
+        ldq     $2,     48($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     32($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $23,    $23
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $381
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$381:
+        sll     $0,     32,     $25
+        ldq     $2,     56($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     24($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $385
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$385:
+        sll     $28,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $22,    $7,     $22
+        stq     $22,    80($16)
+        ldq     $4,     32($17)
+        ldq     $5,     56($18)
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $22
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $0,     $22,    $0
+        cmpult  $0,     $22,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $389
+        sll     $21,    32,     $1
+        addq    $6,     $1,     $6
+$389:
+        sll     $0,     32,     $22
+        ldq     $1,     48($18)
+        addq    $2,     $22,    $2
+        bis     $2,     $2,     $7
+        ldq     $4,     40($17)
+        addq    $24,    $7,     $24
+        srl     $1,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $25
+        zapnot  $1,     15,     $5
+        mulq    $7,     $5,     $21
+        srl     $0,     32,     $1
+        cmpult  $2,     $22,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $22
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $5
+        bis     $31,    1,      $20
+        addq    $25,    $5,     $25
+        cmpult  $25,    $5,     $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $393
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$393:
+        sll     $25,    32,     $5
+        ldq     $2,     40($18)
+        addq    $21,    $5,     $21
+        bis     $21,    $21,    $7
+        ldq     $4,     48($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $25,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $21,    $5,     $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $397
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$397:
+        sll     $28,    32,     $25
+        ldq     $2,     32($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     56($17)
+        addq    $24,    $7,     $24
+        srl     $2,     32,     $8
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $21
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $22,    $22
+        addq    $21,    $25,    $21
+        cmpult  $21,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $401
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$401:
+        sll     $21,    32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        stq     $24,    88($16)
+        ldq     $4,     56($17)
+        ldq     $5,     40($18)
+        cmpult  $24,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $0
+        srl     $21,    32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $23,    $6,     $23
+        cmpult  $23,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $24
+        mulq    $7,     $5,     $5
+        addq    $1,     $22,    $22
+        addq    $0,     $24,    $0
+        cmpult  $0,     $24,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $405
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$405:
+        sll     $0,     32,     $24
+        ldq     $2,     48($18)
+        addq    $5,     $24,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     48($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $24,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $24
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $5
+        addq    $28,    $25,    $28
+        cmpult  $28,    $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $409
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$409:
+        sll     $28,    32,     $25
+        ldq     $2,     56($18)
+        addq    $5,     $25,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     40($17)
+        addq    $23,    $7,     $23
+        srl     $2,     32,     $8
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $25,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $1,     $24,    $24
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $413
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$413:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $23,    $7,     $23
+        stq     $23,    96($16)
+        ldq     $4,     48($17)
+        ldq     $5,     56($18)
+        cmpult  $23,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $22,    $6,     $22
+        cmpult  $22,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $23
+        mulq    $7,     $5,     $5
+        addq    $1,     $24,    $24
+        addq    $28,    $23,    $28
+        cmpult  $28,    $23,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $417
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$417:
+        sll     $28,    32,     $23
+        ldq     $2,     48($18)
+        addq    $5,     $23,    $5
+        bis     $5,     $5,     $7
+        ldq     $4,     56($17)
+        addq    $22,    $7,     $22
+        srl     $2,     32,     $8
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        mulq    $8,     $7,     $0
+        srl     $28,    32,     $1
+        addq    $6,     $1,     $6
+        cmpult  $5,     $23,    $1
+        zapnot  $2,     15,     $5
+        addq    $1,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $23
+        srl     $4,     32,     $6
+        mulq    $5,     $6,     $25
+        mulq    $7,     $5,     $2
+        addq    $0,     $25,    $0
+        cmpult  $0,     $25,    $1
+        mulq    $6,     $8,     $6
+        beq     $1,     $421
+        sll     $20,    32,     $1
+        addq    $6,     $1,     $6
+$421:
+        sll     $0,     32,     $25
+        addq    $2,     $25,    $2
+        bis     $2,     $2,     $7
+        addq    $22,    $7,     $22
+        stq     $22,    104($16)
+        ldq     $4,     56($17)
+        ldq     $5,     56($18)
+        cmpult  $22,    $7,     $3
+        zapnot  $4,     15,     $7
+        srl     $5,     32,     $8
+        mulq    $8,     $7,     $28
+        srl     $0,     32,     $1
+        cmpult  $2,     $25,    $2
+        addq    $6,     $1,     $6
+        addq    $2,     $6,     $6
+        addq    $3,     $6,     $6
+        addq    $24,    $6,     $24
+        cmpult  $24,    $6,     $1
+        srl     $4,     32,     $6
+        zapnot  $5,     15,     $5
+        mulq    $5,     $6,     $22
+        mulq    $7,     $5,     $2
+        addq    $1,     $23,    $23
+        addq    $28,    $22,    $28
+        cmpult  $28,    $22,    $1
+        mulq    $6,     $8,     $3
+        beq     $1,     $425
+        sll     $20,    32,     $1
+        addq    $3,     $1,     $3
+$425:
+        sll     $28,    32,     $22
+        srl     $28,    32,     $1
+        addq    $2,     $22,    $2
+        addq    $3,     $1,     $3
+        bis     $2,     $2,     $7
+        addq    $24,    $7,     $24
+        cmpult  $7,     $22,    $1
+        cmpult  $24,    $7,     $2
+        addq    $1,     $3,     $6
+        addq    $2,     $6,     $6
+        stq     $24,    112($16)
+        addq    $23,    $6,     $23
+        stq     $23,    120($16)
+        ret     $31,    ($26),  1
         .end bn_mul_comba8
         .text
         .align 3
diff --git a/src/lib/libssl/src/crypto/bn/asm/mips3.s b/src/lib/libssl/src/crypto/bn/asm/mips3.s
index 191345d920..2df4dcd4b0 100644
--- a/src/lib/libssl/src/crypto/bn/asm/mips3.s
+++ b/src/lib/libssl/src/crypto/bn/asm/mips3.s
@@ -395,32 +395,32 @@ LEAF(bn_add_words)
 
 .L_bn_add_words_loop:
         ld      ta0,0(a2)
+        subu    a3,4
         ld      t1,8(a1)
-        ld      ta1,8(a2)
+        and     AT,a3,MINUS4
         ld      t2,16(a1)
-        ld      ta2,16(a2)
+        PTR_ADD a2,32
         ld      t3,24(a1)
-        ld      ta3,24(a2)
+        PTR_ADD a0,32
+        ld      ta1,-24(a2)
+        PTR_ADD a1,32
+        ld      ta2,-16(a2)
+        ld      ta3,-8(a2)
         daddu   ta0,t0
-        subu    a3,4
         sltu    t8,ta0,t0
         daddu   t0,ta0,v0
-        PTR_ADD a0,32
         sltu    v0,t0,ta0
         sd      t0,-32(a0)
         daddu   v0,t8
 
         daddu   ta1,t1
-        PTR_ADD a1,32
         sltu    t9,ta1,t1
         daddu   t1,ta1,v0
-        PTR_ADD a2,32
         sltu    v0,t1,ta1
         sd      t1,-24(a0)
         daddu   v0,t9
 
         daddu   ta2,t2
-        and     AT,a3,MINUS4
         sltu    t8,ta2,t2
         daddu   t2,ta2,v0
         sltu    v0,t2,ta2
@@ -495,25 +495,26 @@ LEAF(bn_sub_words)
 
 .L_bn_sub_words_loop:
         ld      ta0,0(a2)
+        subu    a3,4
         ld      t1,8(a1)
-        ld      ta1,8(a2)
+        and     AT,a3,MINUS4
         ld      t2,16(a1)
-        ld      ta2,16(a2)
+        PTR_ADD a2,32
         ld      t3,24(a1)
-        ld      ta3,24(a2)
+        PTR_ADD a0,32
+        ld      ta1,-24(a2)
+        PTR_ADD a1,32
+        ld      ta2,-16(a2)
+        ld      ta3,-8(a2)
         sltu    t8,t0,ta0
         dsubu   t0,ta0
-        subu    a3,4
         dsubu   ta0,t0,v0
-        and     AT,a3,MINUS4
-        sd      ta0,0(a0)
+        sd      ta0,-32(a0)
         MOVNZ   (t0,v0,t8)
 
         sltu    t9,t1,ta1
         dsubu   t1,ta1
-        PTR_ADD a0,32
         dsubu   ta1,t1,v0
-        PTR_ADD a1,32
         sd      ta1,-24(a0)
         MOVNZ   (t1,v0,t9)
 
@@ -521,7 +522,6 @@ LEAF(bn_sub_words)
         sltu    t8,t2,ta2
         dsubu   t2,ta2
         dsubu   ta2,t2,v0
-        PTR_ADD a2,32
         sd      ta2,-16(a0)
         MOVNZ   (t2,v0,t8)
 
@@ -574,6 +574,51 @@ END(bn_sub_words)
 
 #undef  MINUS4
 
+.align 5
+LEAF(bn_div_3_words)
+        .set    reorder
+        move    a3,a0           /* we know that bn_div_words doesn't
+                                 * touch a3, ta2, ta3 and preserves a2
+                                 * so that we can save two arguments
+                                 * and return address in registers
+                                 * instead of stack:-)
+                                 */
+        ld      a0,(a3)
+        move    ta2,a1
+        ld      a1,-8(a3)
+        move    ta3,ra
+        move    v1,zero
+        li      v0,-1
+        beq     a0,a2,.L_bn_div_3_words_skip_div
+        bal     bn_div_words
+        move    ra,ta3
+.L_bn_div_3_words_skip_div:
+        dmultu  ta2,v0
+        ld      t2,-16(a3)
+        move    ta0,zero
+        mfhi    t1
+        mflo    t0
+        sltu    t8,t1,v1
+.L_bn_div_3_words_inner_loop:
+        bnez    t8,.L_bn_div_3_words_inner_loop_done
+        sgeu    AT,t2,t0
+        seq     t9,t1,v1
+        and     AT,t9
+        sltu    t3,t0,ta2
+        daddu   v1,a2
+        dsubu   t1,t3
+        dsubu   t0,ta2
+        sltu    t8,t1,v1
+        sltu    ta0,v1,a2
+        or      t8,ta0
+        .set    noreorder
+        beqzl   AT,.L_bn_div_3_words_inner_loop
+        dsubu   v0,1
+        .set    reorder
+.L_bn_div_3_words_inner_loop_done:
+        jr      ra
+END(bn_div_3_words)
+
 .align  5
 LEAF(bn_div_words)
         .set    noreorder
@@ -633,16 +678,16 @@ LEAF(bn_div_words)
         seq     t8,HH,t1
         sltu    AT,HH,t1
         and     t2,t8
+        sltu    v0,t0,a2
         or      AT,t2
         .set    noreorder
         beqz    AT,.L_bn_div_words_inner_loop1_done
-        sltu    t2,t0,a2
-        .set    reorder
-        dsubu   QT,1
+        dsubu   t1,v0
         dsubu   t0,a2
-        dsubu   t1,t2
         b       .L_bn_div_words_inner_loop1
-.L_bn_div_words_inner_loop1_done:       
+        dsubu   QT,1
+        .set    reorder
+.L_bn_div_words_inner_loop1_done:
 
         dsll    a1,32
         dsubu   a0,t3,t0
@@ -655,6 +700,7 @@ LEAF(bn_div_words)
         ddivu   zero,a0,DH
         mflo    QT
 .L_bn_div_words_skip_div2:
+#undef  DH
         dmultu  a2,QT
         dsll    t3,a0,32
         dsrl    AT,a1,32
@@ -666,69 +712,26 @@ LEAF(bn_div_words)
         seq     t8,HH,t1
         sltu    AT,HH,t1
         and     t2,t8
+        sltu    v1,t0,a2
         or      AT,t2
         .set    noreorder
         beqz    AT,.L_bn_div_words_inner_loop2_done
-        sltu    t2,t0,a2
-        .set    reorder
-        dsubu   QT,1
+        dsubu   t1,v1
         dsubu   t0,a2
-        dsubu   t1,t2
         b       .L_bn_div_words_inner_loop2
+        dsubu   QT,1
+        .set    reorder
 .L_bn_div_words_inner_loop2_done:       
+#undef  HH
 
         dsubu   a0,t3,t0
         or      v0,QT
         dsrl    v1,a0,t9        /* v1 contains remainder if anybody wants it */
         dsrl    a2,t9           /* restore a2 */
         jr      ra
-#undef  HH
-#undef  DH
 #undef  QT
 END(bn_div_words)
 
-.align 5
-LEAF(bn_div_3_words)
-        .set    reorder
-        move    a3,a0           /* we know that bn_div_words doesn't
-                                 * touch a3, ta2, ta3 and preserves a2
-                                 * so that we can save two arguments
-                                 * and return address in registers
-                                 * instead of stack:-)
-                                 */
-        ld      a0,(a3)
-        move    ta2,a2
-        move    a2,a1
-        ld      a1,-8(a3)
-        move    ta3,ra
-        move    v1,zero
-        li      v0,-1
-        beq     a0,a2,.L_bn_div_3_words_skip_div
-        jal     bn_div_words
-        move    ra,ta3
-.L_bn_div_3_words_skip_div:
-        dmultu  ta2,v0
-        ld      t2,-16(a3)
-        mflo    t0
-        mfhi    t1
-.L_bn_div_3_words_inner_loop:
-        sgeu    AT,t2,t0
-        seq     t9,t1,v1
-        sltu    t8,t1,v1
-        and     AT,t9
-        or      AT,t8
-        bnez    AT,.L_bn_div_3_words_inner_loop_done
-        daddu   v1,a2
-        sltu    t3,t0,ta2
-        sltu    AT,v1,a2
-        dsubu   v0,1
-        dsubu   t0,ta2
-        dsubu   t1,t3
-        beqz    AT,.L_bn_div_3_words_inner_loop
-.L_bn_div_3_words_inner_loop_done:
-        jr      ra
-END(bn_div_3_words)
-
 #define a_0     t0
 #define a_1     t1
 #define a_2     t2
diff --git a/src/lib/libssl/src/crypto/bn/bn.h b/src/lib/libssl/src/crypto/bn/bn.h
index f935e1ca79..d8822610df 100644
--- a/src/lib/libssl/src/crypto/bn/bn.h
+++ b/src/lib/libssl/src/crypto/bn/bn.h
@@ -83,12 +83,12 @@ extern "C" {
  * The reason for this flag is that when the particular C compiler
  * library routine is used, and the library is linked with a different
  * compiler, the library is missing.  This mostly happens when the
- * library is built with gcc and then linked using nornal cc.  This would
- * be a common occurance because gcc normally produces code that is
+ * library is built with gcc and then linked using normal cc.  This would
+ * be a common occurrence because gcc normally produces code that is
  * 2 times faster than system compilers for the big number stuff.
  * For machines with only one compiler (or shared libraries), this should
  * be on.  Again this in only really a problem on machines
- * using "long long's", are 32bit, and are not using my assember code. */
+ * using "long long's", are 32bit, and are not using my assembler code. */
 #if defined(MSDOS) || defined(WINDOWS) || defined(linux)
 #define BN_DIV2W
 #endif
@@ -118,8 +118,8 @@ extern "C" {
 
 /* This is where the long long data type is 64 bits, but long is 32.
  * For machines where there are 64bit registers, this is the mode to use.
- * IRIX, on R4000 and above should use this mode, along with the relevent
- * assember code :-).  Do NOT define BN_LLONG.
+ * IRIX, on R4000 and above should use this mode, along with the relevant
+ * assembler code :-).  Do NOT define BN_LLONG.
  */
 #ifdef SIXTY_FOUR_BIT
 #undef BN_LLONG
@@ -240,11 +240,15 @@ typedef struct bignum_st
 
 /* Used for temp variables */
 #define BN_CTX_NUM      12
+#define BN_CTX_NUM_POS  12
 typedef struct bignum_ctx
         {
         int tos;
-        BIGNUM bn[BN_CTX_NUM+1];
+        BIGNUM bn[BN_CTX_NUM];
         int flags;
+        int depth;
+        int pos[BN_CTX_NUM_POS];
+        int too_many;
         } BN_CTX;
 
 typedef struct bn_blinding_st
@@ -257,16 +261,15 @@ typedef struct bn_blinding_st
 
 /* Used for montgomery multiplication */
 typedef struct bn_mont_ctx_st
-        {
-        int use_word;   /* 0 for word form, 1 for long form */
-        int ri;         /* number of bits in R */
-        BIGNUM RR;     /* used to convert to montgomery form */
-        BIGNUM N;      /* The modulus */
-        BIGNUM Ni;     /* The inverse of N */
-        BN_ULONG n0;    /* word form of inverse, normally only one of
-                         * Ni or n0 is defined */
+        {
+        int ri;        /* number of bits in R */
+        BIGNUM RR;     /* used to convert to montgomery form */
+        BIGNUM N;      /* The modulus */
+        BIGNUM Ni;     /* R*(1/R mod N) - N*Ni = 1
+                        * (Ni is only stored for bignum algorithm) */
+        BN_ULONG n0;   /* least significant word of Ni */
         int flags;
-        } BN_MONT_CTX;
+        } BN_MONT_CTX;
 
 /* Used for reciprocal division/mod functions
  * It cannot be shared between threads
@@ -283,7 +286,26 @@ typedef struct bn_recp_ctx_st
 #define BN_to_montgomery(r,a,mont,ctx)  BN_mod_mul_montgomery(\
         r,a,&((mont)->RR),(mont),ctx)
 
-#define BN_prime_checks         (5)
+#define BN_prime_checks 0 /* default: select number of iterations
+                             based on the size of the number */
+
+/* number of Miller-Rabin iterations for an error rate  of less than 2^-80
+ * for random 'b'-bit input, b >= 100 (taken from table 4.4 in the Handbook
+ * of Applied Cryptography [Menezes, van Oorschot, Vanstone; CRC Press 1996];
+ * original paper: Damgaard, Landrock, Pomerance: Average case error estimates
+ * for the strong probable prime test. -- Math. Comp. 61 (1993) 177-194) */
+#define BN_prime_checks_for_size(b) ((b) >= 1300 ?  2 : \
+                                (b) >=  850 ?  3 : \
+                                (b) >=  650 ?  4 : \
+                                (b) >=  550 ?  5 : \
+                                (b) >=  450 ?  6 : \
+                                (b) >=  400 ?  7 : \
+                                (b) >=  350 ?  8 : \
+                                (b) >=  300 ?  9 : \
+                                (b) >=  250 ? 12 : \
+                                (b) >=  200 ? 15 : \
+                                (b) >=  150 ? 18 : \
+                                /* b >= 100 */ 27)
 
 #define BN_num_bytes(a) ((BN_num_bits(a)+7)/8)
 #define BN_is_word(a,w) (((a)->top == 1) && ((a)->d[0] == (BN_ULONG)(w)))
@@ -296,26 +318,16 @@ typedef struct bn_recp_ctx_st
 /*#define BN_ascii2bn(a)        BN_hex2bn(a) */
 /*#define BN_bn2ascii(a)        BN_bn2hex(a) */
 
-#define bn_expand(n,b) ((((((b+BN_BITS2-1))/BN_BITS2)) <= (n)->max)?\
-        (n):bn_expand2((n),(b)/BN_BITS2+1))
-#define bn_wexpand(n,b) (((b) <= (n)->max)?(n):bn_expand2((n),(b)))
-
-#define bn_fix_top(a) \
-        { \
-        BN_ULONG *ftl; \
-        if ((a)->top > 0) \
-                { \
-                for (ftl= &((a)->d[(a)->top-1]); (a)->top > 0; (a)->top--) \
-                if (*(ftl--)) break; \
-                } \
-        }
-
 BIGNUM *BN_value_one(void);
 char *  BN_options(void);
 BN_CTX *BN_CTX_new(void);
 void    BN_CTX_init(BN_CTX *c);
 void    BN_CTX_free(BN_CTX *c);
+void    BN_CTX_start(BN_CTX *ctx);
+BIGNUM *BN_CTX_get(BN_CTX *ctx);
+void    BN_CTX_end(BN_CTX *ctx);
 int     BN_rand(BIGNUM *rnd, int bits, int top,int bottom);
+int     BN_pseudo_rand(BIGNUM *rnd, int bits, int top,int bottom);
 int     BN_num_bits(const BIGNUM *a);
 int     BN_num_bits_word(BN_ULONG);
 BIGNUM *BN_new(void);
@@ -329,13 +341,13 @@ int	BN_bn2mpi(const BIGNUM *a, unsigned char *to);
 int     BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int     BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int     BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
-int     BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b);
+int     BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int     BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx);
 int     BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
                BN_CTX *ctx);
-int     BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b,BN_CTX *ctx);
+int     BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
 int     BN_sqr(BIGNUM *r, BIGNUM *a,BN_CTX *ctx);
-BN_ULONG BN_mod_word(BIGNUM *a, BN_ULONG w);
+BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w);
 BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w);
 int     BN_mul_word(BIGNUM *a, BN_ULONG w);
 int     BN_add_word(BIGNUM *a, BN_ULONG w);
@@ -358,19 +370,18 @@ int	BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p,
         BIGNUM *m,BN_CTX *ctx);
 int     BN_mask_bits(BIGNUM *a,int n);
 int     BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx);
-#ifndef WIN16
-int     BN_print_fp(FILE *fp, BIGNUM *a);
+#ifndef NO_FP_API
+int     BN_print_fp(FILE *fp, const BIGNUM *a);
 #endif
 #ifdef HEADER_BIO_H
 int     BN_print(BIO *fp, const BIGNUM *a);
 #else
-int     BN_print(char *fp, const BIGNUM *a);
+int     BN_print(void *fp, const BIGNUM *a);
 #endif
 int     BN_reciprocal(BIGNUM *r, BIGNUM *m, int len, BN_CTX *ctx);
 int     BN_rshift(BIGNUM *r, BIGNUM *a, int n);
 int     BN_rshift1(BIGNUM *r, BIGNUM *a);
 void    BN_clear(BIGNUM *a);
-BIGNUM *bn_expand2(BIGNUM *b, int bits);
 BIGNUM *BN_dup(const BIGNUM *a);
 int     BN_ucmp(const BIGNUM *a, const BIGNUM *b);
 int     BN_set_bit(BIGNUM *a, int n);
@@ -381,19 +392,16 @@ int 	BN_hex2bn(BIGNUM **a, const char *str);
 int     BN_dec2bn(BIGNUM **a, const char *str);
 int     BN_gcd(BIGNUM *r,BIGNUM *in_a,BIGNUM *in_b,BN_CTX *ctx);
 BIGNUM *BN_mod_inverse(BIGNUM *ret,BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);
-BIGNUM *BN_generate_prime(BIGNUM *ret,int bits,int strong,BIGNUM *add,
+BIGNUM *BN_generate_prime(BIGNUM *ret,int bits,int safe,BIGNUM *add,
                 BIGNUM *rem,void (*callback)(int,int,void *),void *cb_arg);
-int     BN_is_prime(BIGNUM *p,int nchecks,void (*callback)(int,int,void *),
+int     BN_is_prime(const BIGNUM *p,int nchecks,
+                void (*callback)(int,int,void *),
                 BN_CTX *ctx,void *cb_arg);
+int     BN_is_prime_fasttest(const BIGNUM *p,int nchecks,
+                void (*callback)(int,int,void *),BN_CTX *ctx,void *cb_arg,
+                int do_trial_division);
 void    ERR_load_BN_strings(void );
 
-BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
-BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
-void     bn_sqr_words(BN_ULONG *rp, BN_ULONG *ap, int num);
-BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d);
-BN_ULONG bn_add_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
-BN_ULONG bn_sub_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
-
 BN_MONT_CTX *BN_MONT_CTX_new(void );
 void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
 int BN_mod_mul_montgomery(BIGNUM *r,BIGNUM *a,BIGNUM *b,BN_MONT_CTX *mont,
@@ -423,6 +431,39 @@ int	BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 int     BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m,
                 BN_RECP_CTX *recp, BN_CTX *ctx);
 
+/* library internal functions */
+
+#define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->max)?\
+        (a):bn_expand2((a),(bits)/BN_BITS2+1))
+#define bn_wexpand(a,words) (((words) <= (a)->max)?(a):bn_expand2((a),(words)))
+BIGNUM *bn_expand2(BIGNUM *a, int words);
+
+#define bn_fix_top(a) \
+        { \
+        BN_ULONG *ftl; \
+        if ((a)->top > 0) \
+                { \
+                for (ftl= &((a)->d[(a)->top-1]); (a)->top > 0; (a)->top--) \
+                if (*(ftl--)) break; \
+                } \
+        }
+
+BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
+BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
+void     bn_sqr_words(BN_ULONG *rp, BN_ULONG *ap, int num);
+BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d);
+BN_ULONG bn_add_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
+BN_ULONG bn_sub_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
+
+#ifdef BN_DEBUG
+  void bn_dump1(FILE *o, const char *a, BN_ULONG *b,int n);
+# define bn_print(a) {fprintf(stderr, #a "="); BN_print_fp(stderr,a); \
+   fprintf(stderr,"\n");}
+# define bn_dump(a,n) bn_dump1(stderr,#a,a,n);
+#else
+# define bn_print(a)
+# define bn_dump(a,b)
+#endif
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -438,6 +479,7 @@ int	BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m,
 #define BN_F_BN_BLINDING_UPDATE                          103
 #define BN_F_BN_BN2DEC                                   104
 #define BN_F_BN_BN2HEX                                   105
+#define BN_F_BN_CTX_GET                                  116
 #define BN_F_BN_CTX_NEW                                  106
 #define BN_F_BN_DIV                                      107
 #define BN_F_BN_EXPAND2                                  108
@@ -459,6 +501,7 @@ int	BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m,
 #define BN_R_INVALID_LENGTH                              106
 #define BN_R_NOT_INITIALIZED                             107
 #define BN_R_NO_INVERSE                                  108
+#define BN_R_TOO_MANY_TEMPORARY_VARIABLES                109
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/bn/bn_add.c b/src/lib/libssl/src/crypto/bn/bn_add.c
index c5ab066c9e..5d24691233 100644
--- a/src/lib/libssl/src/crypto/bn/bn_add.c
+++ b/src/lib/libssl/src/crypto/bn/bn_add.c
@@ -61,9 +61,9 @@
 #include "bn_lcl.h"
 
 /* r can == a or b */
-int BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b)
+int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         {
-        BIGNUM *tmp;
+        const BIGNUM *tmp;
 
         bn_check_top(a);
         bn_check_top(b);
diff --git a/src/lib/libssl/src/crypto/bn/bn_asm.c b/src/lib/libssl/src/crypto/bn/bn_asm.c
index 4d3da16a0c..3329cc18e6 100644
--- a/src/lib/libssl/src/crypto/bn/bn_asm.c
+++ b/src/lib/libssl/src/crypto/bn/bn_asm.c
@@ -56,31 +56,38 @@
  * [including the GNU Public Licence.]
  */
 
+#ifndef BN_DEBUG
+# undef NDEBUG /* avoid conflicting definitions */
+# define NDEBUG
+#endif
+
 #include <stdio.h>
+#include <assert.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-#ifdef BN_LLONG 
+#if defined(BN_LLONG) || defined(BN_UMULT_HIGH)
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
         {
         BN_ULONG c1=0;
 
-        bn_check_num(num);
+        assert(num >= 0);
         if (num <= 0) return(c1);
 
-        for (;;)
+        while (num&~3)
                 {
                 mul_add(rp[0],ap[0],w,c1);
-                if (--num == 0) break;
                 mul_add(rp[1],ap[1],w,c1);
-                if (--num == 0) break;
                 mul_add(rp[2],ap[2],w,c1);
-                if (--num == 0) break;
                 mul_add(rp[3],ap[3],w,c1);
-                if (--num == 0) break;
-                ap+=4;
-                rp+=4;
+                ap+=4; rp+=4; num-=4;
+                }
+        if (num)
+                {
+                mul_add(rp[0],ap[0],w,c1); if (--num==0) return c1;
+                mul_add(rp[1],ap[1],w,c1); if (--num==0) return c1;
+                mul_add(rp[2],ap[2],w,c1); return c1;
                 }
         
         return(c1);
@@ -90,63 +97,54 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
         {
         BN_ULONG c1=0;
 
-        bn_check_num(num);
+        assert(num >= 0);
         if (num <= 0) return(c1);
 
-        /* for (;;) */
-        while (1) /* circumvent egcs-1.1.2 bug */
+        while (num&~3)
                 {
                 mul(rp[0],ap[0],w,c1);
-                if (--num == 0) break;
                 mul(rp[1],ap[1],w,c1);
-                if (--num == 0) break;
                 mul(rp[2],ap[2],w,c1);
-                if (--num == 0) break;
                 mul(rp[3],ap[3],w,c1);
-                if (--num == 0) break;
-                ap+=4;
-                rp+=4;
+                ap+=4; rp+=4; num-=4;
+                }
+        if (num)
+                {
+                mul(rp[0],ap[0],w,c1); if (--num == 0) return c1;
+                mul(rp[1],ap[1],w,c1); if (--num == 0) return c1;
+                mul(rp[2],ap[2],w,c1);
                 }
         return(c1);
         } 
 
 void bn_sqr_words(BN_ULONG *r, BN_ULONG *a, int n)
         {
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return;
-        for (;;)
+        while (n&~3)
                 {
-                BN_ULLONG t;
-
-                t=(BN_ULLONG)(a[0])*(a[0]);
-                r[0]=Lw(t); r[1]=Hw(t);
-                if (--n == 0) break;
-
-                t=(BN_ULLONG)(a[1])*(a[1]);
-                r[2]=Lw(t); r[3]=Hw(t);
-                if (--n == 0) break;
-
-                t=(BN_ULLONG)(a[2])*(a[2]);
-                r[4]=Lw(t); r[5]=Hw(t);
-                if (--n == 0) break;
-
-                t=(BN_ULLONG)(a[3])*(a[3]);
-                r[6]=Lw(t); r[7]=Hw(t);
-                if (--n == 0) break;
-
-                a+=4;
-                r+=8;
+                sqr(r[0],r[1],a[0]);
+                sqr(r[2],r[3],a[1]);
+                sqr(r[4],r[5],a[2]);
+                sqr(r[6],r[7],a[3]);
+                a+=4; r+=8; n-=4;
+                }
+        if (n)
+                {
+                sqr(r[0],r[1],a[0]); if (--n == 0) return;
+                sqr(r[2],r[3],a[1]); if (--n == 0) return;
+                sqr(r[4],r[5],a[2]);
                 }
         }
 
-#else
+#else /* !(defined(BN_LLONG) || defined(BN_UMULT_HIGH)) */
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
         {
         BN_ULONG c=0;
         BN_ULONG bl,bh;
 
-        bn_check_num(num);
+        assert(num >= 0);
         if (num <= 0) return((BN_ULONG)0);
 
         bl=LBITS(w);
@@ -173,7 +171,7 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
         BN_ULONG carry=0;
         BN_ULONG bl,bh;
 
-        bn_check_num(num);
+        assert(num >= 0);
         if (num <= 0) return((BN_ULONG)0);
 
         bl=LBITS(w);
@@ -197,7 +195,7 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
 
 void bn_sqr_words(BN_ULONG *r, BN_ULONG *a, int n)
         {
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return;
         for (;;)
                 {
@@ -218,7 +216,7 @@ void bn_sqr_words(BN_ULONG *r, BN_ULONG *a, int n)
                 }
         }
 
-#endif
+#endif /* !(defined(BN_LLONG) || defined(BN_UMULT_HIGH)) */
 
 #if defined(BN_LLONG) && defined(BN_DIV2W)
 
@@ -300,14 +298,14 @@ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
         ret|=q;
         return(ret);
         }
-#endif
+#endif /* !defined(BN_LLONG) && defined(BN_DIV2W) */
 
 #ifdef BN_LLONG
 BN_ULONG bn_add_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
         BN_ULLONG ll=0;
 
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return((BN_ULONG)0);
 
         for (;;)
@@ -338,12 +336,12 @@ BN_ULONG bn_add_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
                 }
         return((BN_ULONG)ll);
         }
-#else
+#else /* !BN_LLONG */
 BN_ULONG bn_add_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
         BN_ULONG c,l,t;
 
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return((BN_ULONG)0);
 
         c=0;
@@ -387,14 +385,14 @@ BN_ULONG bn_add_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
                 }
         return((BN_ULONG)c);
         }
-#endif
+#endif /* !BN_LLONG */
 
 BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
         BN_ULONG t1,t2;
         int c=0;
 
-        bn_check_num(n);
+        assert(n >= 0);
         if (n <= 0) return((BN_ULONG)0);
 
         for (;;)
@@ -433,6 +431,11 @@ BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
 #undef bn_sqr_comba8
 #undef bn_sqr_comba4
 
+/* mul_add_c(a,b,c0,c1,c2)  -- c+=a*b for three word number c=(c2,c1,c0) */
+/* mul_add_c2(a,b,c0,c1,c2) -- c+=2*a*b for three word number c=(c2,c1,c0) */
+/* sqr_add_c(a,i,c0,c1,c2)  -- c+=a[i]^2 for three word number c=(c2,c1,c0) */
+/* sqr_add_c2(a,i,c0,c1,c2) -- c+=2*a[i]*a[j] for three word number c=(c2,c1,c0) */
+
 #ifdef BN_LLONG
 #define mul_add_c(a,b,c0,c1,c2) \
         t=(BN_ULLONG)a*b; \
@@ -460,7 +463,39 @@ BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
 
 #define sqr_add_c2(a,i,j,c0,c1,c2) \
         mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#else
+
+#elif defined(BN_UMULT_HIGH)
+
+#define mul_add_c(a,b,c0,c1,c2) {       \
+        BN_ULONG ta=(a),tb=(b);         \
+        t1 = ta * tb;                   \
+        t2 = BN_UMULT_HIGH(ta,tb);      \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define mul_add_c2(a,b,c0,c1,c2) {      \
+        BN_ULONG ta=(a),tb=(b),t0;      \
+        t1 = BN_UMULT_HIGH(ta,tb);      \
+        t0 = ta * tb;                   \
+        t2 = t1+t1; c2 += (t2<t1)?1:0;  \
+        t1 = t0+t0; t2 += (t1<t0)?1:0;  \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define sqr_add_c(a,i,c0,c1,c2) {       \
+        BN_ULONG ta=(a)[i];             \
+        t1 = ta * ta;                   \
+        t2 = BN_UMULT_HIGH(ta,ta);      \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define sqr_add_c2(a,i,j,c0,c1,c2)      \
+        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
+
+#else /* !BN_LLONG */
 #define mul_add_c(a,b,c0,c1,c2) \
         t1=LBITS(a); t2=HBITS(a); \
         bl=LBITS(b); bh=HBITS(b); \
@@ -487,7 +522,7 @@ BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
 
 #define sqr_add_c2(a,i,j,c0,c1,c2) \
         mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#endif
+#endif /* !BN_LLONG */
 
 void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
         {
@@ -762,7 +797,7 @@ void bn_sqr_comba4(BN_ULONG *r, BN_ULONG *a)
         r[6]=c1;
         r[7]=c2;
         }
-#else
+#else /* !BN_MUL_COMBA */
 
 /* hmm... is it faster just to do a multiply? */
 #undef bn_sqr_comba4
@@ -799,4 +834,4 @@ void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
         r[15]=bn_mul_add_words(&(r[7]),a,8,b[7]);
         }
 
-#endif /* BN_COMBA */
+#endif /* !BN_MUL_COMBA */
diff --git a/src/lib/libssl/src/crypto/bn/bn_comba.c b/src/lib/libssl/src/crypto/bn/bn_comba.c
index 7ad09b4a6d..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/bn_comba.c
+++ b/src/lib/libssl/src/crypto/bn/bn_comba.c
@@ -1,345 +0,0 @@
-/* crypto/bn/bn_comba.c */
-#include <stdio.h>
-#include "bn_lcl.h"
-/* Auto generated from crypto/bn/comba.pl
- */
-
-#undef bn_mul_comba8
-#undef bn_mul_comba4
-#undef bn_sqr_comba8
-#undef bn_sqr_comba4
-
-#ifdef BN_LLONG
-#define mul_add_c(a,b,c0,c1,c2) \
-        t=(BN_ULLONG)a*b; \
-        t1=(BN_ULONG)Lw(t); \
-        t2=(BN_ULONG)Hw(t); \
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define mul_add_c2(a,b,c0,c1,c2) \
-        t=(BN_ULLONG)a*b; \
-        tt=(t+t)&BN_MASK; \
-        if (tt < t) c2++; \
-        t1=(BN_ULONG)Lw(tt); \
-        t2=(BN_ULONG)Hw(tt); \
-        c0=(c0+t1)&BN_MASK2;  \
-        if ((c0 < t1) && (((++t2)&BN_MASK2) == 0)) c2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c(a,i,c0,c1,c2) \
-        t=(BN_ULLONG)a[i]*a[i]; \
-        t1=(BN_ULONG)Lw(t); \
-        t2=(BN_ULONG)Hw(t); \
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c2(a,i,j,c0,c1,c2) \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#else
-#define mul_add_c(a,b,c0,c1,c2) \
-        t1=LBITS(a); t2=HBITS(a); \
-        bl=LBITS(b); bh=HBITS(b); \
-        mul64(t1,t2,bl,bh); \
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define mul_add_c2(a,b,c0,c1,c2) \
-        t1=LBITS(a); t2=HBITS(a); \
-        bl=LBITS(b); bh=HBITS(b); \
-        mul64(t1,t2,bl,bh); \
-        if (t2 & BN_TBIT) c2++; \
-        t2=(t2+t2)&BN_MASK2; \
-        if (t1 & BN_TBIT) t2++; \
-        t1=(t1+t1)&BN_MASK2; \
-        c0=(c0+t1)&BN_MASK2;  \
-        if ((c0 < t1) && (((++t2)&BN_MASK2) == 0)) c2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c(a,i,c0,c1,c2) \
-        sqr64(t1,t2,(a)[i]); \
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c2(a,i,j,c0,c1,c2) \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#endif
-
-void bn_mul_comba88(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
-void bn_mul_comba44(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
-void bn_sqr_comba88(BN_ULONG *r,BN_ULONG *a);
-void bn_sqr_comba44(BN_ULONG *r,BN_ULONG *a);
-
-void bn_mul_comba88(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-        c1=0;
-        c2=0;
-        c3=0;
-        mul_add_c(a[0],b[0],c1,c2,c3);
-        r[0]=c1;
-        c1=0;
-        mul_add_c(a[0],b[1],c2,c3,c1);
-        mul_add_c(a[1],b[0],c2,c3,c1);
-        r[1]=c2;
-        c2=0;
-        mul_add_c(a[2],b[0],c3,c1,c2);
-        mul_add_c(a[1],b[1],c3,c1,c2);
-        mul_add_c(a[0],b[2],c3,c1,c2);
-        r[2]=c3;
-        c3=0;
-        mul_add_c(a[0],b[3],c1,c2,c3);
-        mul_add_c(a[1],b[2],c1,c2,c3);
-        mul_add_c(a[2],b[1],c1,c2,c3);
-        mul_add_c(a[3],b[0],c1,c2,c3);
-        r[3]=c1;
-        c1=0;
-        mul_add_c(a[4],b[0],c2,c3,c1);
-        mul_add_c(a[3],b[1],c2,c3,c1);
-        mul_add_c(a[2],b[2],c2,c3,c1);
-        mul_add_c(a[1],b[3],c2,c3,c1);
-        mul_add_c(a[0],b[4],c2,c3,c1);
-        r[4]=c2;
-        c2=0;
-        mul_add_c(a[0],b[5],c3,c1,c2);
-        mul_add_c(a[1],b[4],c3,c1,c2);
-        mul_add_c(a[2],b[3],c3,c1,c2);
-        mul_add_c(a[3],b[2],c3,c1,c2);
-        mul_add_c(a[4],b[1],c3,c1,c2);
-        mul_add_c(a[5],b[0],c3,c1,c2);
-        r[5]=c3;
-        c3=0;
-        mul_add_c(a[6],b[0],c1,c2,c3);
-        mul_add_c(a[5],b[1],c1,c2,c3);
-        mul_add_c(a[4],b[2],c1,c2,c3);
-        mul_add_c(a[3],b[3],c1,c2,c3);
-        mul_add_c(a[2],b[4],c1,c2,c3);
-        mul_add_c(a[1],b[5],c1,c2,c3);
-        mul_add_c(a[0],b[6],c1,c2,c3);
-        r[6]=c1;
-        c1=0;
-        mul_add_c(a[0],b[7],c2,c3,c1);
-        mul_add_c(a[1],b[6],c2,c3,c1);
-        mul_add_c(a[2],b[5],c2,c3,c1);
-        mul_add_c(a[3],b[4],c2,c3,c1);
-        mul_add_c(a[4],b[3],c2,c3,c1);
-        mul_add_c(a[5],b[2],c2,c3,c1);
-        mul_add_c(a[6],b[1],c2,c3,c1);
-        mul_add_c(a[7],b[0],c2,c3,c1);
-        r[7]=c2;
-        c2=0;
-        mul_add_c(a[7],b[1],c3,c1,c2);
-        mul_add_c(a[6],b[2],c3,c1,c2);
-        mul_add_c(a[5],b[3],c3,c1,c2);
-        mul_add_c(a[4],b[4],c3,c1,c2);
-        mul_add_c(a[3],b[5],c3,c1,c2);
-        mul_add_c(a[2],b[6],c3,c1,c2);
-        mul_add_c(a[1],b[7],c3,c1,c2);
-        r[8]=c3;
-        c3=0;
-        mul_add_c(a[2],b[7],c1,c2,c3);
-        mul_add_c(a[3],b[6],c1,c2,c3);
-        mul_add_c(a[4],b[5],c1,c2,c3);
-        mul_add_c(a[5],b[4],c1,c2,c3);
-        mul_add_c(a[6],b[3],c1,c2,c3);
-        mul_add_c(a[7],b[2],c1,c2,c3);
-        r[9]=c1;
-        c1=0;
-        mul_add_c(a[7],b[3],c2,c3,c1);
-        mul_add_c(a[6],b[4],c2,c3,c1);
-        mul_add_c(a[5],b[5],c2,c3,c1);
-        mul_add_c(a[4],b[6],c2,c3,c1);
-        mul_add_c(a[3],b[7],c2,c3,c1);
-        r[10]=c2;
-        c2=0;
-        mul_add_c(a[4],b[7],c3,c1,c2);
-        mul_add_c(a[5],b[6],c3,c1,c2);
-        mul_add_c(a[6],b[5],c3,c1,c2);
-        mul_add_c(a[7],b[4],c3,c1,c2);
-        r[11]=c3;
-        c3=0;
-        mul_add_c(a[7],b[5],c1,c2,c3);
-        mul_add_c(a[6],b[6],c1,c2,c3);
-        mul_add_c(a[5],b[7],c1,c2,c3);
-        r[12]=c1;
-        c1=0;
-        mul_add_c(a[6],b[7],c2,c3,c1);
-        mul_add_c(a[7],b[6],c2,c3,c1);
-        r[13]=c2;
-        c2=0;
-        mul_add_c(a[7],b[7],c3,c1,c2);
-        r[14]=c3;
-        r[15]=c1;
-        }
-
-void bn_mul_comba44(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-        c1=0;
-        c2=0;
-        c3=0;
-        mul_add_c(a[0],b[0],c1,c2,c3);
-        r[0]=c1;
-        c1=0;
-        mul_add_c(a[0],b[1],c2,c3,c1);
-        mul_add_c(a[1],b[0],c2,c3,c1);
-        r[1]=c2;
-        c2=0;
-        mul_add_c(a[2],b[0],c3,c1,c2);
-        mul_add_c(a[1],b[1],c3,c1,c2);
-        mul_add_c(a[0],b[2],c3,c1,c2);
-        r[2]=c3;
-        c3=0;
-        mul_add_c(a[0],b[3],c1,c2,c3);
-        mul_add_c(a[1],b[2],c1,c2,c3);
-        mul_add_c(a[2],b[1],c1,c2,c3);
-        mul_add_c(a[3],b[0],c1,c2,c3);
-        r[3]=c1;
-        c1=0;
-        mul_add_c(a[3],b[1],c2,c3,c1);
-        mul_add_c(a[2],b[2],c2,c3,c1);
-        mul_add_c(a[1],b[3],c2,c3,c1);
-        r[4]=c2;
-        c2=0;
-        mul_add_c(a[2],b[3],c3,c1,c2);
-        mul_add_c(a[3],b[2],c3,c1,c2);
-        r[5]=c3;
-        c3=0;
-        mul_add_c(a[3],b[3],c1,c2,c3);
-        r[6]=c1;
-        r[7]=c2;
-        }
-
-void bn_sqr_comba88(BN_ULONG *r, BN_ULONG *a)
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t,tt;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-        c1=0;
-        c2=0;
-        c3=0;
-        sqr_add_c(a,0,c1,c2,c3);
-        r[0]=c1;
-        c1=0;
-        sqr_add_c2(a,1,0,c2,c3,c1);
-        r[1]=c2;
-        c2=0;
-        sqr_add_c(a,1,c3,c1,c2);
-        sqr_add_c2(a,2,0,c3,c1,c2);
-        r[2]=c3;
-        c3=0;
-        sqr_add_c2(a,3,0,c1,c2,c3);
-        sqr_add_c2(a,2,1,c1,c2,c3);
-        r[3]=c1;
-        c1=0;
-        sqr_add_c(a,2,c2,c3,c1);
-        sqr_add_c2(a,3,1,c2,c3,c1);
-        sqr_add_c2(a,4,0,c2,c3,c1);
-        r[4]=c2;
-        c2=0;
-        sqr_add_c2(a,5,0,c3,c1,c2);
-        sqr_add_c2(a,4,1,c3,c1,c2);
-        sqr_add_c2(a,3,2,c3,c1,c2);
-        r[5]=c3;
-        c3=0;
-        sqr_add_c(a,3,c1,c2,c3);
-        sqr_add_c2(a,4,2,c1,c2,c3);
-        sqr_add_c2(a,5,1,c1,c2,c3);
-        sqr_add_c2(a,6,0,c1,c2,c3);
-        r[6]=c1;
-        c1=0;
-        sqr_add_c2(a,7,0,c2,c3,c1);
-        sqr_add_c2(a,6,1,c2,c3,c1);
-        sqr_add_c2(a,5,2,c2,c3,c1);
-        sqr_add_c2(a,4,3,c2,c3,c1);
-        r[7]=c2;
-        c2=0;
-        sqr_add_c(a,4,c3,c1,c2);
-        sqr_add_c2(a,5,3,c3,c1,c2);
-        sqr_add_c2(a,6,2,c3,c1,c2);
-        sqr_add_c2(a,7,1,c3,c1,c2);
-        r[8]=c3;
-        c3=0;
-        sqr_add_c2(a,7,2,c1,c2,c3);
-        sqr_add_c2(a,6,3,c1,c2,c3);
-        sqr_add_c2(a,5,4,c1,c2,c3);
-        r[9]=c1;
-        c1=0;
-        sqr_add_c(a,5,c2,c3,c1);
-        sqr_add_c2(a,6,4,c2,c3,c1);
-        sqr_add_c2(a,7,3,c2,c3,c1);
-        r[10]=c2;
-        c2=0;
-        sqr_add_c2(a,7,4,c3,c1,c2);
-        sqr_add_c2(a,6,5,c3,c1,c2);
-        r[11]=c3;
-        c3=0;
-        sqr_add_c(a,6,c1,c2,c3);
-        sqr_add_c2(a,7,5,c1,c2,c3);
-        r[12]=c1;
-        c1=0;
-        sqr_add_c2(a,7,6,c2,c3,c1);
-        r[13]=c2;
-        c2=0;
-        sqr_add_c(a,7,c3,c1,c2);
-        r[14]=c3;
-        r[15]=c1;
-        }
-
-void bn_sqr_comba44(BN_ULONG *r, BN_ULONG *a)
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t,tt;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-        c1=0;
-        c2=0;
-        c3=0;
-        sqr_add_c(a,0,c1,c2,c3);
-        r[0]=c1;
-        c1=0;
-        sqr_add_c2(a,1,0,c2,c3,c1);
-        r[1]=c2;
-        c2=0;
-        sqr_add_c(a,1,c3,c1,c2);
-        sqr_add_c2(a,2,0,c3,c1,c2);
-        r[2]=c3;
-        c3=0;
-        sqr_add_c2(a,3,0,c1,c2,c3);
-        sqr_add_c2(a,2,1,c1,c2,c3);
-        r[3]=c1;
-        c1=0;
-        sqr_add_c(a,2,c2,c3,c1);
-        sqr_add_c2(a,3,1,c2,c3,c1);
-        r[4]=c2;
-        c2=0;
-        sqr_add_c2(a,3,2,c3,c1,c2);
-        r[5]=c3;
-        c3=0;
-        sqr_add_c(a,3,c1,c2,c3);
-        r[6]=c1;
-        r[7]=c2;
-        }
diff --git a/src/lib/libssl/src/crypto/bn/bn_ctx.c b/src/lib/libssl/src/crypto/bn/bn_ctx.c
new file mode 100644
index 0000000000..46132fd180
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bn/bn_ctx.c
@@ -0,0 +1,144 @@
+/* crypto/bn/bn_ctx.c */
+/* Written by Ulf Moeller for the OpenSSL project. */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef BN_CTX_DEBUG
+# undef NDEBUG /* avoid conflicting definitions */
+# define NDEBUG
+#endif
+
+#include <stdio.h>
+#include <assert.h>
+#include "cryptlib.h"
+#include <openssl/bn.h>
+
+
+BN_CTX *BN_CTX_new(void)
+        {
+        BN_CTX *ret;
+
+        ret=(BN_CTX *)Malloc(sizeof(BN_CTX));
+        if (ret == NULL)
+                {
+                BNerr(BN_F_BN_CTX_NEW,ERR_R_MALLOC_FAILURE);
+                return(NULL);
+                }
+
+        BN_CTX_init(ret);
+        ret->flags=BN_FLG_MALLOCED;
+        return(ret);
+        }
+
+void BN_CTX_init(BN_CTX *ctx)
+        {
+        int i;
+        ctx->tos = 0;
+        ctx->flags = 0;
+        ctx->depth = 0;
+        ctx->too_many = 0;
+        for (i = 0; i < BN_CTX_NUM; i++)
+                BN_init(&(ctx->bn[i]));
+        }
+
+void BN_CTX_free(BN_CTX *ctx)
+        {
+        int i;
+
+        if (ctx == NULL) return;
+        assert(ctx->depth == 0);
+
+        for (i=0; i < BN_CTX_NUM; i++)
+                BN_clear_free(&(ctx->bn[i]));
+        if (ctx->flags & BN_FLG_MALLOCED)
+                Free(ctx);
+        }
+
+void BN_CTX_start(BN_CTX *ctx)
+        {
+        if (ctx->depth < BN_CTX_NUM_POS)
+                ctx->pos[ctx->depth] = ctx->tos;
+        ctx->depth++;
+        }
+
+BIGNUM *BN_CTX_get(BN_CTX *ctx)
+        {
+        if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
+                {
+                if (!ctx->too_many)
+                        {
+                        BNerr(BN_F_BN_CTX_GET,BN_R_TOO_MANY_TEMPORARY_VARIABLES);
+                        /* disable error code until BN_CTX_end is called: */
+                        ctx->too_many = 1;
+                        }
+                return NULL;
+                }
+        return (&(ctx->bn[ctx->tos++]));
+        }
+
+void BN_CTX_end(BN_CTX *ctx)
+        {
+        if (ctx == NULL) return;
+        assert(ctx->depth > 0);
+        if (ctx->depth == 0)
+                /* should never happen, but we can tolerate it if not in
+                 * debug mode (could be a 'goto err' in the calling function
+                 * before BN_CTX_start was reached) */
+                BN_CTX_start(ctx);
+
+        ctx->too_many = 0;
+        ctx->depth--;
+        if (ctx->depth < BN_CTX_NUM_POS)
+                ctx->tos = ctx->pos[ctx->depth];
+        }
diff --git a/src/lib/libssl/src/crypto/bn/bn_div.c b/src/lib/libssl/src/crypto/bn/bn_div.c
index 150dd289a5..07af1d3b44 100644
--- a/src/lib/libssl/src/crypto/bn/bn_div.c
+++ b/src/lib/libssl/src/crypto/bn/bn_div.c
@@ -63,9 +63,11 @@
 
 /* The old slow way */
 #if 0
-int BN_div(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx)
+int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
+           BN_CTX *ctx)
         {
         int i,nm,nd;
+        int ret = 0;
         BIGNUM *D;
 
         bn_check_top(m);
@@ -84,14 +86,17 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx)
                 return(1);
                 }
 
-        D= &(ctx->bn[ctx->tos]);
-        if (dv == NULL) dv= &(ctx->bn[ctx->tos+1]);
-        if (rem == NULL) rem= &(ctx->bn[ctx->tos+2]);
+        BN_CTX_start(ctx);
+        D = BN_CTX_get(ctx);
+        if (dv == NULL) dv = BN_CTX_get(ctx);
+        if (rem == NULL) rem = BN_CTX_get(ctx);
+        if (D == NULL || dv == NULL || rem == NULL)
+                goto end;
 
         nd=BN_num_bits(d);
         nm=BN_num_bits(m);
-        if (BN_copy(D,d) == NULL) return(0);
-        if (BN_copy(rem,m) == NULL) return(0);
+        if (BN_copy(D,d) == NULL) goto end;
+        if (BN_copy(rem,m) == NULL) goto end;
 
         /* The next 2 are needed so we can do a dv->d[0]|=1 later
          * since BN_lshift1 will only work once there is a value :-) */
@@ -99,25 +104,54 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx)
         bn_wexpand(dv,1);
         dv->top=1;
 
-        if (!BN_lshift(D,D,nm-nd)) return(0);
+        if (!BN_lshift(D,D,nm-nd)) goto end;
         for (i=nm-nd; i>=0; i--)
                 {
-                if (!BN_lshift1(dv,dv)) return(0);
+                if (!BN_lshift1(dv,dv)) goto end;
                 if (BN_ucmp(rem,D) >= 0)
                         {
                         dv->d[0]|=1;
-                        if (!BN_usub(rem,rem,D)) return(0);
+                        if (!BN_usub(rem,rem,D)) goto end;
                         }
 /* CAN IMPROVE (and have now :=) */
-                if (!BN_rshift1(D,D)) return(0);
+                if (!BN_rshift1(D,D)) goto end;
                 }
         rem->neg=BN_is_zero(rem)?0:m->neg;
         dv->neg=m->neg^d->neg;
-        return(1);
+        ret = 1;
+ end:
+        BN_CTX_end(ctx);
+        return(ret);
         }
 
 #else
 
+#if !defined(NO_ASM) && !defined(NO_INLINE_ASM) && !defined(PEDANTIC) && !defined(BN_DIV3W)
+# if defined(__GNUC__) && __GNUC__>=2
+#  if defined(__i386)
+   /*
+    * There were two reasons for implementing this template:
+    * - GNU C generates a call to a function (__udivdi3 to be exact)
+    *   in reply to ((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0 (I fail to
+    *   understand why...);
+    * - divl doesn't only calculate quotient, but also leaves
+    *   remainder in %edx which we can definitely use here:-)
+    *
+    *                                   <appro@fy.chalmers.se>
+    */
+#  define bn_div_words(n0,n1,d0)                \
+        ({  asm volatile (                      \
+                "divl   %4"                     \
+                : "=a"(q), "=d"(rem)            \
+                : "a"(n1), "d"(n0), "g"(d0)     \
+                : "cc");                        \
+            q;                                  \
+        })
+#  define REMAINDER_IS_ALREADY_CALCULATED
+#  endif /* __<cpu> */
+# endif /* __GNUC__ */
+#endif /* NO_ASM */
+
 int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
            BN_CTX *ctx)
         {
@@ -144,13 +178,15 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 return(1);
                 }
 
-        tmp= &(ctx->bn[ctx->tos]);
+        BN_CTX_start(ctx);
+        tmp=BN_CTX_get(ctx);
         tmp->neg=0;
-        snum= &(ctx->bn[ctx->tos+1]);
-        sdiv= &(ctx->bn[ctx->tos+2]);
+        snum=BN_CTX_get(ctx);
+        sdiv=BN_CTX_get(ctx);
         if (dv == NULL)
-                res= &(ctx->bn[ctx->tos+3]);
+                res=BN_CTX_get(ctx);
         else    res=dv;
+        if (res == NULL) goto err;
 
         /* First we normalise the numbers */
         norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
@@ -202,97 +238,76 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 {
                 BN_ULONG q,l0;
 #ifdef BN_DIV3W
-                q=bn_div_3_words(wnump,d0,d1);
+                q=bn_div_3_words(wnump,d1,d0);
 #else
-
-#if !defined(NO_ASM) && !defined(PEDANTIC)
-# if defined(__GNUC__) && __GNUC__>=2
-#  if defined(__i386)
-   /*
-    * There were two reasons for implementing this template:
-    * - GNU C generates a call to a function (__udivdi3 to be exact)
-    *   in reply to ((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0 (I fail to
-    *   understand why...);
-    * - divl doesn't only calculate quotient, but also leaves
-    *   remainder in %edx which we can definitely use here:-)
-    *
-    *                                   <appro@fy.chalmers.se>
-    */
-#  define bn_div_words(n0,n1,d0)                \
-        ({  asm volatile (                      \
-                "divl   %4"                     \
-                : "=a"(q), "=d"(rem)            \
-                : "a"(n1), "d"(n0), "g"(d0)     \
-                : "cc");                        \
-            q;                                  \
-        })
-#  define REMINDER_IS_ALREADY_CALCULATED
-#  endif /* __<cpu> */
-# endif /* __GNUC__ */
-#endif /* NO_ASM */
                 BN_ULONG n0,n1,rem=0;
 
                 n0=wnump[0];
                 n1=wnump[-1];
                 if (n0 == d0)
                         q=BN_MASK2;
-                else
+                else                    /* n0 < d0 */
+                        {
+#ifdef BN_LLONG
+                        BN_ULLONG t2;
+
 #if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
-                        q=((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0;
+                        q=(BN_ULONG)(((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0);
 #else
                         q=bn_div_words(n0,n1,d0);
 #endif
-                {
-#ifdef BN_LLONG
-                BN_ULLONG t2;
-
-#ifndef REMINDER_IS_ALREADY_CALCULATED
-                /*
-                 * rem doesn't have to be BN_ULLONG. The least we
-                 * know it's less that d0, isn't it?
-                 */
-                rem=(n1-q*d0)&BN_MASK2;
+
+#ifndef REMAINDER_IS_ALREADY_CALCULATED
+                        /*
+                         * rem doesn't have to be BN_ULLONG. The least we
+                         * know it's less that d0, isn't it?
+                         */
+                        rem=(n1-q*d0)&BN_MASK2;
 #endif
-                t2=(BN_ULLONG)d1*q;
+                        t2=(BN_ULLONG)d1*q;
+
+                        for (;;)
+                                {
+                                if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))
+                                        break;
+                                q--;
+                                rem += d0;
+                                if (rem < d0) break; /* don't let rem overflow */
+                                t2 -= d1;
+                                }
+#else /* !BN_LLONG */
+                        BN_ULONG t2l,t2h,ql,qh;
 
-                for (;;)
-                        {
-                        if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))
-                                break;
-                        q--;
-                        rem += d0;
-                        if (rem < d0) break; /* don't let rem overflow */
-                        t2 -= d1;
-                        }
+                        q=bn_div_words(n0,n1,d0);
+#ifndef REMAINDER_IS_ALREADY_CALCULATED
+                        rem=(n1-q*d0)&BN_MASK2;
+#endif
+
+#ifdef BN_UMULT_HIGH
+                        t2l = d1 * q;
+                        t2h = BN_UMULT_HIGH(d1,q);
 #else
-                BN_ULONG t2l,t2h,ql,qh;
-
-#ifndef REMINDER_IS_ALREADY_CALCULATED
-                /*
-                 * It's more than enough with the only multiplication.
-                 * See the comment above in BN_LLONG section...
-                 */
-                rem=(n1-q*d0)&BN_MASK2;
+                        t2l=LBITS(d1); t2h=HBITS(d1);
+                        ql =LBITS(q);  qh =HBITS(q);
+                        mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1*q; */
 #endif
-                t2l=LBITS(d1); t2h=HBITS(d1);
-                ql =LBITS(q);  qh =HBITS(q);
-                mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1*q; */
 
-                for (;;)
-                        {
-                        if ((t2h < rem) ||
-                                ((t2h == rem) && (t2l <= wnump[-2])))
-                                break;
-                        q--;
-                        rem += d0;
-                        if (rem < d0) break; /* don't let rem overflow */
-                        if (t2l < d1) t2h--; t2l -= d1;
+                        for (;;)
+                                {
+                                if ((t2h < rem) ||
+                                        ((t2h == rem) && (t2l <= wnump[-2])))
+                                        break;
+                                q--;
+                                rem += d0;
+                                if (rem < d0) break; /* don't let rem overflow */
+                                if (t2l < d1) t2h--; t2l -= d1;
+                                }
+#endif /* !BN_LLONG */
                         }
-#endif
-                }
 #endif /* !BN_DIV3W */
-                wnum.d--; wnum.top++;
+
                 l0=bn_mul_words(tmp->d,sdiv->d,div_n,q);
+                wnum.d--; wnum.top++;
                 tmp->d[div_n]=l0;
                 for (j=div_n+1; j>0; j--)
                         if (tmp->d[j-1]) break;
@@ -318,8 +333,10 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 BN_rshift(rm,snum,norm_shift);
                 rm->neg=num->neg;
                 }
+        BN_CTX_end(ctx);
         return(1);
 err:
+        BN_CTX_end(ctx);
         return(0);
         }
 
@@ -335,22 +352,27 @@ int BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
         if (BN_ucmp(m,d) < 0)
                 return((BN_copy(rem,m) == NULL)?0:1);
 
-        dv= &(ctx->bn[ctx->tos]);
+        BN_CTX_start(ctx);
+        dv=BN_CTX_get(ctx);
 
-        if (!BN_copy(rem,m)) return(0);
+        if (!BN_copy(rem,m)) goto err;
 
         nm=BN_num_bits(rem);
         nd=BN_num_bits(d);
-        if (!BN_lshift(dv,d,nm-nd)) return(0);
+        if (!BN_lshift(dv,d,nm-nd)) goto err;
         for (i=nm-nd; i>=0; i--)
                 {
                 if (BN_cmp(rem,dv) >= 0)
                         {
-                        if (!BN_sub(rem,rem,dv)) return(0);
+                        if (!BN_sub(rem,rem,dv)) goto err;
                         }
-                if (!BN_rshift1(dv,dv)) return(0);
+                if (!BN_rshift1(dv,dv)) goto err;
                 }
+        BN_CTX_end(ctx);
         return(1);
+ err:
+        BN_CTX_end(ctx);
+        return(0);
 #else
         return(BN_div(NULL,rem,m,d,ctx));
 #endif
diff --git a/src/lib/libssl/src/crypto/bn/bn_err.c b/src/lib/libssl/src/crypto/bn/bn_err.c
index 73e80774e5..f3b9497dca 100644
--- a/src/lib/libssl/src/crypto/bn/bn_err.c
+++ b/src/lib/libssl/src/crypto/bn/bn_err.c
@@ -71,6 +71,7 @@ static ERR_STRING_DATA BN_str_functs[]=
 {ERR_PACK(0,BN_F_BN_BLINDING_UPDATE,0), "BN_BLINDING_update"},
 {ERR_PACK(0,BN_F_BN_BN2DEC,0),  "BN_bn2dec"},
 {ERR_PACK(0,BN_F_BN_BN2HEX,0),  "BN_bn2hex"},
+{ERR_PACK(0,BN_F_BN_CTX_GET,0), "BN_CTX_get"},
 {ERR_PACK(0,BN_F_BN_CTX_NEW,0), "BN_CTX_new"},
 {ERR_PACK(0,BN_F_BN_DIV,0),     "BN_div"},
 {ERR_PACK(0,BN_F_BN_EXPAND2,0), "bn_expand2"},
@@ -95,6 +96,7 @@ static ERR_STRING_DATA BN_str_reasons[]=
 {BN_R_INVALID_LENGTH                     ,"invalid length"},
 {BN_R_NOT_INITIALIZED                    ,"not initialized"},
 {BN_R_NO_INVERSE                         ,"no inverse"},
+{BN_R_TOO_MANY_TEMPORARY_VARIABLES       ,"too many temporary variables"},
 {0,NULL}
         };
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_exp.c b/src/lib/libssl/src/crypto/bn/bn_exp.c
index 2df1614ada..0c11601675 100644
--- a/src/lib/libssl/src/crypto/bn/bn_exp.c
+++ b/src/lib/libssl/src/crypto/bn/bn_exp.c
@@ -59,6 +59,12 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
+#ifdef ATALLA
+# include <alloca.h>
+# include <atasi.h>
+# include <assert.h>
+# include <dlfcn.h>
+#endif
 
 #define TABLE_SIZE      16
 
@@ -72,7 +78,8 @@ int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx)
         bn_check_top(b);
         bn_check_top(m);
 
-        t= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        if ((t = BN_CTX_get(ctx)) == NULL) goto err;
         if (a == b)
                 { if (!BN_sqr(t,a,ctx)) goto err; }
         else
@@ -80,7 +87,7 @@ int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx)
         if (!BN_mod(ret,t,m,ctx)) goto err;
         r=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         return(r);
         }
 
@@ -91,8 +98,10 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
         int i,bits,ret=0;
         BIGNUM *v,*tmp;
 
-        v= &(ctx->bn[ctx->tos++]);
-        tmp= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        v = BN_CTX_get(ctx);
+        tmp = BN_CTX_get(ctx);
+        if (v == NULL || tmp == NULL) goto err;
 
         if (BN_copy(v,a) == NULL) goto err;
         bits=BN_num_bits(p);
@@ -113,7 +122,7 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
                 }
         ret=1;
 err:
-        ctx->tos-=2;
+        BN_CTX_end(ctx);
         return(ret);
         }
 
@@ -122,15 +131,15 @@ err:
 /* this one works - simple but works */
 int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx)
         {
-        int i,bits,ret=0,tos;
+        int i,bits,ret=0;
         BIGNUM *v,*rr;
 
-        tos=ctx->tos;
-        v= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
         if ((r == a) || (r == p))
-                rr= &(ctx->bn[ctx->tos++]);
+                rr = BN_CTX_get(ctx);
         else
-                rr=r;
+                rr = r;
+        if ((v = BN_CTX_get(ctx)) == NULL) goto err;
 
         if (BN_copy(v,a) == NULL) goto err;
         bits=BN_num_bits(p);
@@ -149,11 +158,178 @@ int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx)
                 }
         ret=1;
 err:
-        ctx->tos=tos;
         if (r != rr) BN_copy(r,rr);
+        BN_CTX_end(ctx);
         return(ret);
         }
 
+#ifdef ATALLA
+
+/*
+ * This routine will dynamically check for the existance of an Atalla AXL-200
+ * SSL accelerator module.  If one is found, the variable
+ * asi_accelerator_present is set to 1 and the function pointers
+ * ptr_ASI_xxxxxx above will be initialized to corresponding ASI API calls.
+ */
+typedef int tfnASI_GetPerformanceStatistics(int reset_flag,
+                                            unsigned int *ret_buf);
+typedef int tfnASI_GetHardwareConfig(long card_num, unsigned int *ret_buf);
+typedef int tfnASI_RSAPrivateKeyOpFn(RSAPrivateKey * rsaKey,
+                                     unsigned char *output,
+                                     unsigned char *input,
+                                     unsigned int modulus_len);
+
+static tfnASI_GetHardwareConfig *ptr_ASI_GetHardwareConfig;
+static tfnASI_RSAPrivateKeyOpFn *ptr_ASI_RSAPrivateKeyOpFn;
+static tfnASI_GetPerformanceStatistics *ptr_ASI_GetPerformanceStatistics;
+static int asi_accelerator_present;
+static int tried_atalla;
+
+void atalla_initialize_accelerator_handle(void)
+        {
+        void *dl_handle;
+        int status;
+        unsigned int config_buf[1024]; 
+        static int tested;
+
+        if(tested)
+                return;
+
+        tested=1;
+
+        bzero((void *)config_buf, 1024);
+
+        /*
+         * Check to see if the library is present on the system
+         */
+        dl_handle = dlopen("atasi.so", RTLD_NOW);
+        if (dl_handle == (void *) NULL)
+                {
+/*              printf("atasi.so library is not present on the system\n");
+                printf("No HW acceleration available\n");*/
+                return;
+                }
+
+        /*
+         * The library is present.  Now we'll check to insure that the
+         * LDM is up and running. First we'll get the address of the
+         * function in the atasi library that we need to see if the
+         * LDM is operating.
+         */
+
+        ptr_ASI_GetHardwareConfig =
+          (tfnASI_GetHardwareConfig *)dlsym(dl_handle,"ASI_GetHardwareConfig");
+
+        if (ptr_ASI_GetHardwareConfig)
+                {
+                /*
+                 * We found the call, now we'll get our config
+                 * status.  If we get a non 0 result, the LDM is not
+                 * running and we cannot use the Atalla ASI *
+                 * library.
+                 */
+                status = (*ptr_ASI_GetHardwareConfig)(0L, config_buf);
+                if (status != 0)
+                        {
+                        printf("atasi.so library is present but not initialized\n");
+                        printf("No HW acceleration available\n");
+                        return;
+                        }    
+                }
+        else
+                {
+/*              printf("We found the library, but not the function. Very Strange!\n");*/
+                return ;
+                }
+
+        /* 
+         * It looks like we have acceleration capabilities.  Load up the
+         * pointers to our ASI API calls.
+         */
+        ptr_ASI_RSAPrivateKeyOpFn=
+          (tfnASI_RSAPrivateKeyOpFn *)dlsym(dl_handle, "ASI_RSAPrivateKeyOpFn");
+        if (ptr_ASI_RSAPrivateKeyOpFn == NULL)
+                {
+/*              printf("We found the library, but no RSA function. Very Strange!\n");*/
+                return;
+                }
+
+        ptr_ASI_GetPerformanceStatistics =
+          (tfnASI_GetPerformanceStatistics *)dlsym(dl_handle, "ASI_GetPerformanceStatistics");
+        if (ptr_ASI_GetPerformanceStatistics == NULL)
+                {
+/*              printf("We found the library, but no stat function. Very Strange!\n");*/
+                return;
+              }
+
+        /*
+         * Indicate that acceleration is available
+         */
+        asi_accelerator_present = 1;
+
+/*      printf("This system has acceleration!\n");*/
+
+        return;
+        }
+
+/* make sure this only gets called once when bn_mod_exp calls bn_mod_exp_mont */
+int BN_mod_exp_atalla(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m)
+        {
+        unsigned char *abin;
+        unsigned char *pbin;
+        unsigned char *mbin;
+        unsigned char *rbin;
+        int an,pn,mn,ret;
+        RSAPrivateKey keydata;
+
+        atalla_initialize_accelerator_handle();
+        if(!asi_accelerator_present)
+                return 0;
+
+
+/* We should be able to run without size testing */
+# define ASIZE  128
+        an=BN_num_bytes(a);
+        pn=BN_num_bytes(p);
+        mn=BN_num_bytes(m);
+
+        if(an <= ASIZE && pn <= ASIZE && mn <= ASIZE)
+            {
+            int size=mn;
+
+            assert(an <= mn);
+            abin=alloca(size);
+            memset(abin,'\0',mn);
+            BN_bn2bin(a,abin+size-an);
+
+            pbin=alloca(pn);
+            BN_bn2bin(p,pbin);
+
+            mbin=alloca(size);
+            memset(mbin,'\0',mn);
+            BN_bn2bin(m,mbin+size-mn);
+
+            rbin=alloca(size);
+
+            memset(&keydata,'\0',sizeof keydata);
+            keydata.privateExponent.data=pbin;
+            keydata.privateExponent.len=pn;
+            keydata.modulus.data=mbin;
+            keydata.modulus.len=size;
+
+            ret=(*ptr_ASI_RSAPrivateKeyOpFn)(&keydata,rbin,abin,keydata.modulus.len);
+/*fprintf(stderr,"!%s\n",BN_bn2hex(a));*/
+            if(!ret)
+                {
+                BN_bin2bn(rbin,keydata.modulus.len,r);
+/*fprintf(stderr,"?%s\n",BN_bn2hex(r));*/
+                return 1;
+                }
+            }
+        return 0;
+        }
+#endif /* def ATALLA */
+
 int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
                BN_CTX *ctx)
         {
@@ -163,6 +339,13 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
         bn_check_top(p);
         bn_check_top(m);
 
+#ifdef ATALLA
+        if(BN_mod_exp_atalla(r,a,p,m))
+            return 1;
+/* If it fails, try the other methods (but don't try atalla again) */
+        tried_atalla=1;
+#endif
+
 #ifdef MONT_MUL_MOD
         /* I have finally been able to take out this pre-condition of
          * the top bit being set.  It was caused by an error in BN_div
@@ -180,6 +363,10 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
                 { ret=BN_mod_exp_simple(r,a,p,m,ctx); }
 #endif
 
+#ifdef ATALLA
+        tried_atalla=0;
+#endif
+
         return(ret);
         }
 
@@ -193,7 +380,6 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
         BIGNUM val[TABLE_SIZE];
         BN_RECP_CTX recp;
 
-        aa= &(ctx->bn[ctx->tos++]);
         bits=BN_num_bits(p);
 
         if (bits == 0)
@@ -201,6 +387,10 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                 BN_one(r);
                 return(1);
                 }
+
+        BN_CTX_start(ctx);
+        if ((aa = BN_CTX_get(ctx)) == NULL) goto err;
+
         BN_RECP_CTX_init(&recp);
         if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
 
@@ -289,7 +479,7 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                 }
         ret=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         for (i=0; i<ts; i++)
                 BN_clear_free(&(val[i]));
         BN_RECP_CTX_free(&recp);
@@ -312,19 +502,27 @@ int BN_mod_exp_mont(BIGNUM *rr, BIGNUM *a, const BIGNUM *p,
         bn_check_top(p);
         bn_check_top(m);
 
+#ifdef ATALLA
+        if(!tried_atalla && BN_mod_exp_atalla(rr,a,p,m))
+            return 1;
+/* If it fails, try the other methods */
+#endif
+
         if (!(m->d[0] & 1))
                 {
                 BNerr(BN_F_BN_MOD_EXP_MONT,BN_R_CALLED_WITH_EVEN_MODULUS);
                 return(0);
                 }
-        d= &(ctx->bn[ctx->tos++]);
-        r= &(ctx->bn[ctx->tos++]);
         bits=BN_num_bits(p);
         if (bits == 0)
                 {
-                BN_one(r);
+                BN_one(rr);
                 return(1);
                 }
+        BN_CTX_start(ctx);
+        d = BN_CTX_get(ctx);
+        r = BN_CTX_get(ctx);
+        if (d == NULL || r == NULL) goto err;
 
         /* If this is not done, things will break in the montgomery
          * part */
@@ -432,7 +630,7 @@ int BN_mod_exp_mont(BIGNUM *rr, BIGNUM *a, const BIGNUM *p,
         ret=1;
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
-        ctx->tos-=2;
+        BN_CTX_end(ctx);
         for (i=0; i<ts; i++)
                 BN_clear_free(&(val[i]));
         return(ret);
@@ -448,7 +646,6 @@ int BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,
         BIGNUM *d;
         BIGNUM val[TABLE_SIZE];
 
-        d= &(ctx->bn[ctx->tos++]);
         bits=BN_num_bits(p);
 
         if (bits == 0)
@@ -457,6 +654,9 @@ int BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,
                 return(1);
                 }
 
+        BN_CTX_start(ctx);
+        if ((d = BN_CTX_get(ctx)) == NULL) goto err;
+
         BN_init(&(val[0]));
         ts=1;
         if (!BN_mod(&(val[0]),a,m,ctx)) goto err;               /* 1 */
@@ -541,7 +741,7 @@ int BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,
                 }
         ret=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         for (i=0; i<ts; i++)
                 BN_clear_free(&(val[i]));
         return(ret);
diff --git a/src/lib/libssl/src/crypto/bn/bn_exp2.c b/src/lib/libssl/src/crypto/bn/bn_exp2.c
index 1132d53365..4f4e9e3299 100644
--- a/src/lib/libssl/src/crypto/bn/bn_exp2.c
+++ b/src/lib/libssl/src/crypto/bn/bn_exp2.c
@@ -9,7 +9,7 @@
  * bits=1  75.4%  79.4%
  * bits=2  61.2%  62.4%
  * bits=3  61.3%  59.3%
- * The lack of speed improvment is also a function of the pre-calculation
+ * The lack of speed improvement is also a function of the pre-calculation
  * which could be removed.
  */
 #define EXP2_TABLE_BITS 2 /* 1  2  3  4  5  */
@@ -35,15 +35,19 @@ int BN_mod_exp2_mont(BIGNUM *rr, BIGNUM *a1, BIGNUM *p1, BIGNUM *a2,
                 BNerr(BN_F_BN_MOD_EXP_MONT,BN_R_CALLED_WITH_EVEN_MODULUS);
                 return(0);
                 }
-        d= &(ctx->bn[ctx->tos++]);
-        r= &(ctx->bn[ctx->tos++]);
         bits1=BN_num_bits(p1);
         bits2=BN_num_bits(p2);
         if ((bits1 == 0) && (bits2 == 0))
                 {
-                BN_one(r);
+                BN_one(rr);
                 return(1);
                 }
+
+        BN_CTX_start(ctx);
+        d = BN_CTX_get(ctx);
+        r = BN_CTX_get(ctx);
+        if (d == NULL || r == NULL) goto err;
+
         bits=(bits1 > bits2)?bits1:bits2;
 
         /* If this is not done, things will break in the montgomery
@@ -183,7 +187,7 @@ int BN_mod_exp2_mont(BIGNUM *rr, BIGNUM *a1, BIGNUM *p1, BIGNUM *a2,
         ret=1;
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
-        ctx->tos-=2;
+        BN_CTX_end(ctx);
         for (i=0; i<ts; i++)
                 {
                 for (j=0; j<ts; j++)
diff --git a/src/lib/libssl/src/crypto/bn/bn_gcd.c b/src/lib/libssl/src/crypto/bn/bn_gcd.c
index 64a76f4498..398207196b 100644
--- a/src/lib/libssl/src/crypto/bn/bn_gcd.c
+++ b/src/lib/libssl/src/crypto/bn/bn_gcd.c
@@ -61,6 +61,7 @@
 #include "bn_lcl.h"
 
 static BIGNUM *euclid(BIGNUM *a, BIGNUM *b);
+
 int BN_gcd(BIGNUM *r, BIGNUM *in_a, BIGNUM *in_b, BN_CTX *ctx)
         {
         BIGNUM *a,*b,*t;
@@ -69,8 +70,10 @@ int BN_gcd(BIGNUM *r, BIGNUM *in_a, BIGNUM *in_b, BN_CTX *ctx)
         bn_check_top(in_a);
         bn_check_top(in_b);
 
-        a= &(ctx->bn[ctx->tos]);
-        b= &(ctx->bn[ctx->tos+1]);
+        BN_CTX_start(ctx);
+        a = BN_CTX_get(ctx);
+        b = BN_CTX_get(ctx);
+        if (a == NULL || b == NULL) goto err;
 
         if (BN_copy(a,in_a) == NULL) goto err;
         if (BN_copy(b,in_b) == NULL) goto err;
@@ -82,6 +85,7 @@ int BN_gcd(BIGNUM *r, BIGNUM *in_a, BIGNUM *in_b, BN_CTX *ctx)
         if (BN_copy(r,t) == NULL) goto err;
         ret=1;
 err:
+        BN_CTX_end(ctx);
         return(ret);
         }
 
@@ -142,20 +146,22 @@ err:
 /* solves ax == 1 (mod n) */
 BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
         {
-        BIGNUM *A,*B,*X,*Y,*M,*D,*R;
+        BIGNUM *A,*B,*X,*Y,*M,*D,*R=NULL;
         BIGNUM *T,*ret=NULL;
         int sign;
 
         bn_check_top(a);
         bn_check_top(n);
 
-        A= &(ctx->bn[ctx->tos]);
-        B= &(ctx->bn[ctx->tos+1]);
-        X= &(ctx->bn[ctx->tos+2]);
-        D= &(ctx->bn[ctx->tos+3]);
-        M= &(ctx->bn[ctx->tos+4]);
-        Y= &(ctx->bn[ctx->tos+5]);
-        ctx->tos+=6;
+        BN_CTX_start(ctx);
+        A = BN_CTX_get(ctx);
+        B = BN_CTX_get(ctx);
+        X = BN_CTX_get(ctx);
+        D = BN_CTX_get(ctx);
+        M = BN_CTX_get(ctx);
+        Y = BN_CTX_get(ctx);
+        if (Y == NULL) goto err;
+
         if (in == NULL)
                 R=BN_new();
         else
@@ -198,7 +204,7 @@ BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
         ret=R;
 err:
         if ((ret == NULL) && (in == NULL)) BN_free(R);
-        ctx->tos-=6;
+        BN_CTX_end(ctx);
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_lcl.h b/src/lib/libssl/src/crypto/bn/bn_lcl.h
index 85a372695b..e36ccbc4c2 100644
--- a/src/lib/libssl/src/crypto/bn/bn_lcl.h
+++ b/src/lib/libssl/src/crypto/bn/bn_lcl.h
@@ -73,18 +73,53 @@ extern "C" {
 #define BN_MUL_LOW_RECURSIVE_SIZE_NORMAL        (32) /* 32 */
 #define BN_MONT_CTX_SET_SIZE_WORD               (64) /* 32 */
 
-#if 0
-#ifndef BN_MUL_COMBA
-/* #define bn_mul_comba8(r,a,b) bn_mul_normal(r,a,8,b,8) */
-/* #define bn_mul_comba4(r,a,b) bn_mul_normal(r,a,4,b,4) */
-#endif
-
-#ifndef BN_SQR_COMBA
-/* This is probably faster than using the C code - I need to check */
-#define bn_sqr_comba8(r,a)      bn_mul_normal(r,a,8,a,8)
-#define bn_sqr_comba4(r,a)      bn_mul_normal(r,a,4,a,4)
-#endif
-#endif
+#if !defined(NO_ASM) && !defined(NO_INLINE_ASM) && !defined(PEDANTIC)
+/*
+ * BN_UMULT_HIGH section.
+ *
+ * No, I'm not trying to overwhelm you when stating that the
+ * product of N-bit numbers is 2*N bits wide:-) No, I don't expect
+ * you to be impressed when I say that if the compiler doesn't
+ * support 2*N integer type, then you have to replace every N*N
+ * multiplication with 4 (N/2)*(N/2) accompanied by some shifts
+ * and additions which unavoidably results in severe performance
+ * penalties. Of course provided that the hardware is capable of
+ * producing 2*N result... That's when you normally start
+ * considering assembler implementation. However! It should be
+ * pointed out that some CPUs (most notably Alpha, PowerPC and
+ * upcoming IA-64 family:-) provide *separate* instruction
+ * calculating the upper half of the product placing the result
+ * into a general purpose register. Now *if* the compiler supports
+ * inline assembler, then it's not impossible to implement the
+ * "bignum" routines (and have the compiler optimize 'em)
+ * exhibiting "native" performance in C. That's what BN_UMULT_HIGH
+ * macro is about:-)
+ *
+ *                                      <appro@fy.chalmers.se>
+ */
+# if defined(__alpha) && (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT))
+#  if defined(__DECC)
+#   include <c_asm.h>
+#   define BN_UMULT_HIGH(a,b)   (BN_ULONG)asm("umulh %a0,%a1,%v0",(a),(b))
+#  elif defined(__GNUC__)
+#   define BN_UMULT_HIGH(a,b)   ({      \
+        register BN_ULONG ret;          \
+        asm ("umulh     %1,%2,%0"       \
+             : "=r"(ret)                \
+             : "r"(a), "r"(b));         \
+        ret;                    })
+#  endif        /* compiler */
+# elif defined(_ARCH_PPC) && defined(__64BIT__) && defined(SIXTY_FOUR_BIT_LONG)
+#  if defined(__GNUC__)
+#   define BN_UMULT_HIGH(a,b)   ({      \
+        register BN_ULONG ret;          \
+        asm ("mulhdu    %0,%1,%2"       \
+             : "=r"(ret)                \
+             : "r"(a), "r"(b));         \
+        ret;                    })
+#  endif        /* compiler */
+# endif         /* cpu */
+#endif          /* NO_ASM */
 
 /*************************************************************
  * Using the long long type
@@ -92,15 +127,12 @@ extern "C" {
 #define Lw(t)    (((BN_ULONG)(t))&BN_MASK2)
 #define Hw(t)    (((BN_ULONG)((t)>>BN_BITS2))&BN_MASK2)
 
-/* These are used for internal error checking and are not normally used */
+/* This is used for internal error checking and is not normally used */
 #ifdef BN_DEBUG
-#define bn_check_top(a) \
-        { if (((a)->top < 0) || ((a)->top > (a)->max)) \
-                { char *nullp=NULL; *nullp='z'; } }
-#define bn_check_num(a) if ((a) < 0) { char *nullp=NULL; *nullp='z'; }
+# include <assert.h>
+# define bn_check_top(a) assert ((a)->top >= 0 && (a)->top <= (a)->max);
 #else
-#define bn_check_top(a)
-#define bn_check_num(a)
+# define bn_check_top(a)
 #endif
 
 /* This macro is to add extra stuff for development checking */
@@ -134,8 +166,6 @@ extern "C" {
         bn_set_max(r); \
         }
 
-/* #define bn_expand(n,b) ((((b)/BN_BITS2) <= (n)->max)?(n):bn_expand2((n),(b))) */
-
 #ifdef BN_LLONG
 #define mul_add(r,a,w,c) { \
         BN_ULLONG t; \
@@ -151,6 +181,43 @@ extern "C" {
         (c)= Hw(t); \
         }
 
+#define sqr(r0,r1,a) { \
+        BN_ULLONG t; \
+        t=(BN_ULLONG)(a)*(a); \
+        (r0)=Lw(t); \
+        (r1)=Hw(t); \
+        }
+
+#elif defined(BN_UMULT_HIGH)
+#define mul_add(r,a,w,c) {              \
+        BN_ULONG high,low,ret,tmp=(a);  \
+        ret =  (r);                     \
+        high=  BN_UMULT_HIGH(w,tmp);    \
+        ret += (c);                     \
+        low =  (w) * tmp;               \
+        (c) =  (ret<(c))?1:0;           \
+        (c) += high;                    \
+        ret += low;                     \
+        (c) += (ret<low)?1:0;           \
+        (r) =  ret;                     \
+        }
+
+#define mul(r,a,w,c)    {               \
+        BN_ULONG high,low,ret,ta=(a);   \
+        low =  (w) * ta;                \
+        high=  BN_UMULT_HIGH(w,ta);     \
+        ret =  low + (c);               \
+        (c) =  high;                    \
+        (c) += (ret<low)?1:0;           \
+        (r) =  ret;                     \
+        }
+
+#define sqr(r0,r1,a)    {               \
+        BN_ULONG tmp=(a);               \
+        (r0) = tmp * tmp;               \
+        (r1) = BN_UMULT_HIGH(tmp,tmp);  \
+        }
+
 #else
 /*************************************************************
  * No long long type
@@ -228,21 +295,7 @@ extern "C" {
         (c)=h&BN_MASK2; \
         (r)=l&BN_MASK2; \
         }
-
-#endif
-
-OPENSSL_EXTERN int bn_limit_bits;
-OPENSSL_EXTERN int bn_limit_num;        /* (1<<bn_limit_bits) */
-/* Recursive 'low' limit */
-OPENSSL_EXTERN int bn_limit_bits_low;
-OPENSSL_EXTERN int bn_limit_num_low;    /* (1<<bn_limit_bits_low) */
-/* Do modified 'high' part calculation' */
-OPENSSL_EXTERN int bn_limit_bits_high;
-OPENSSL_EXTERN int bn_limit_num_high;   /* (1<<bn_limit_bits_high) */
-OPENSSL_EXTERN int bn_limit_bits_mont;
-OPENSSL_EXTERN int bn_limit_num_mont;   /* (1<<bn_limit_bits_mont) */
-
-BIGNUM *bn_expand2(BIGNUM *b, int bits);
+#endif /* !BN_LLONG */
 
 void bn_mul_normal(BN_ULONG *r,BN_ULONG *a,int na,BN_ULONG *b,int nb);
 void bn_mul_comba8(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
diff --git a/src/lib/libssl/src/crypto/bn/bn_lib.c b/src/lib/libssl/src/crypto/bn/bn_lib.c
index 5d62d88e8b..0e6b12d9c3 100644
--- a/src/lib/libssl/src/crypto/bn/bn_lib.c
+++ b/src/lib/libssl/src/crypto/bn/bn_lib.c
@@ -71,14 +71,14 @@ const char *BN_version="Big Number" OPENSSL_VERSION_PTEXT;
  * 7 - 128 == 4096
  * 8 - 256 == 8192
  */
-OPENSSL_GLOBAL int bn_limit_bits=0;
-OPENSSL_GLOBAL int bn_limit_num=8;        /* (1<<bn_limit_bits) */
-OPENSSL_GLOBAL int bn_limit_bits_low=0;
-OPENSSL_GLOBAL int bn_limit_num_low=8;    /* (1<<bn_limit_bits_low) */
-OPENSSL_GLOBAL int bn_limit_bits_high=0;
-OPENSSL_GLOBAL int bn_limit_num_high=8;   /* (1<<bn_limit_bits_high) */
-OPENSSL_GLOBAL int bn_limit_bits_mont=0;
-OPENSSL_GLOBAL int bn_limit_num_mont=8;   /* (1<<bn_limit_bits_mont) */
+static int bn_limit_bits=0;
+static int bn_limit_num=8;        /* (1<<bn_limit_bits) */
+static int bn_limit_bits_low=0;
+static int bn_limit_num_low=8;    /* (1<<bn_limit_bits_low) */
+static int bn_limit_bits_high=0;
+static int bn_limit_num_high=8;   /* (1<<bn_limit_bits_high) */
+static int bn_limit_bits_mont=0;
+static int bn_limit_num_mont=8;   /* (1<<bn_limit_bits_mont) */
 
 void BN_set_params(int mult, int high, int low, int mont)
         {
@@ -304,42 +304,10 @@ BIGNUM *BN_new(void)
         return(ret);
         }
 
-
-BN_CTX *BN_CTX_new(void)
-        {
-        BN_CTX *ret;
-
-        ret=(BN_CTX *)Malloc(sizeof(BN_CTX));
-        if (ret == NULL)
-                {
-                BNerr(BN_F_BN_CTX_NEW,ERR_R_MALLOC_FAILURE);
-                return(NULL);
-                }
-
-        BN_CTX_init(ret);
-        ret->flags=BN_FLG_MALLOCED;
-        return(ret);
-        }
-
-void BN_CTX_init(BN_CTX *ctx)
-        {
-        memset(ctx,0,sizeof(BN_CTX));
-        ctx->tos=0;
-        ctx->flags=0;
-        }
-
-void BN_CTX_free(BN_CTX *c)
-        {
-        int i;
-
-        if(c == NULL)
-            return;
-
-        for (i=0; i<BN_CTX_NUM; i++)
-                BN_clear_free(&(c->bn[i]));
-        if (c->flags & BN_FLG_MALLOCED)
-                Free(c);
-        }
+/* This is an internal function that should not be used in applications.
+ * It ensures that 'b' has enough room for a 'words' word number number.
+ * It is mostly used by the various BIGNUM routines. If there is an error,
+ * NULL is returned. If not, 'b' is returned. */
 
 BIGNUM *bn_expand2(BIGNUM *b, int words)
         {
@@ -389,7 +357,7 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)
  * if A and B happen to share same cache line such code is going to
  * cause severe cache trashing. Both factors have severe impact on
  * performance of modern CPUs and this is the reason why this
- * particulare piece of code is #ifdefed away and replaced by more
+ * particular piece of code is #ifdefed away and replaced by more
  * "friendly" version found in #else section below. This comment
  * also applies to BN_copy function.
  *
@@ -420,7 +388,7 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)
                                 A[0]=B[0];
                         case 0:
                                 /* I need the 'case 0' entry for utrix cc.
-                                 * If the optimiser is turned on, it does the
+                                 * If the optimizer is turned on, it does the
                                  * switch table by doing
                                  * a=top&7
                                  * a--;
diff --git a/src/lib/libssl/src/crypto/bn/bn_mont.c b/src/lib/libssl/src/crypto/bn/bn_mont.c
index ee0f410c22..7bb0b91223 100644
--- a/src/lib/libssl/src/crypto/bn/bn_mont.c
+++ b/src/lib/libssl/src/crypto/bn/bn_mont.c
@@ -57,25 +57,27 @@
  */
 
 /*
- * Details about Montgomery multiplication algorithms can be found at:
- * http://www.ece.orst.edu/ISL/Publications.html
- * http://www.ece.orst.edu/ISL/Koc/papers/j37acmon.pdf
+ * Details about Montgomery multiplication algorithms can be found at
+ * http://security.ece.orst.edu/publications.html, e.g.
+ * http://security.ece.orst.edu/koc/papers/j37acmon.pdf and
+ * sections 3.8 and 4.2 in http://security.ece.orst.edu/koc/papers/r01rsasw.pdf
  */
 
 #include <stdio.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-#define MONT_WORD
+#define MONT_WORD /* use the faster word-based algorithm */
 
 int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
                           BN_MONT_CTX *mont, BN_CTX *ctx)
         {
         BIGNUM *tmp,*tmp2;
 
-        tmp= &(ctx->bn[ctx->tos]);
-        tmp2= &(ctx->bn[ctx->tos]);
-        ctx->tos+=2;
+        BN_CTX_start(ctx);
+        tmp = BN_CTX_get(ctx);
+        tmp2 = BN_CTX_get(ctx);
+        if (tmp == NULL || tmp2 == NULL) goto err;
 
         bn_check_top(tmp);
         bn_check_top(tmp2);
@@ -99,7 +101,7 @@ int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
                 }
         /* reduce from aRR to aR */
         if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
-        ctx->tos-=2;
+        BN_CTX_end(ctx);
         return(1);
 err:
         return(0);
@@ -108,160 +110,123 @@ err:
 int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont,
              BN_CTX *ctx)
         {
-#ifdef BN_RECURSION_MONT
-        if (mont->use_word)
-#endif
-                {
-                BIGNUM *n,*r;
-                BN_ULONG *ap,*np,*rp,n0,v,*nrp;
-                int al,nl,max,i,x,ri;
-                int retn=0;
+        int retn=0;
 
-                r= &(ctx->bn[ctx->tos]);
+#ifdef MONT_WORD
+        BIGNUM *n,*r;
+        BN_ULONG *ap,*np,*rp,n0,v,*nrp;
+        int al,nl,max,i,x,ri;
 
-                if (!BN_copy(r,a)) goto err1;
-                n= &(mont->N);
+        BN_CTX_start(ctx);
+        if ((r = BN_CTX_get(ctx)) == NULL) goto err;
 
-                ap=a->d;
-                /* mont->ri is the size of mont->N in bits/words */
-                al=ri=mont->ri/BN_BITS2;
+        if (!BN_copy(r,a)) goto err;
+        n= &(mont->N);
 
-                nl=n->top;
-                if ((al == 0) || (nl == 0)) { r->top=0; return(1); }
+        ap=a->d;
+        /* mont->ri is the size of mont->N in bits (rounded up
+           to the word size) */
+        al=ri=mont->ri/BN_BITS2;
+        
+        nl=n->top;
+        if ((al == 0) || (nl == 0)) { r->top=0; return(1); }
 
-                max=(nl+al+1); /* allow for overflow (no?) XXX */
-                if (bn_wexpand(r,max) == NULL) goto err1;
-                if (bn_wexpand(ret,max) == NULL) goto err1;
+        max=(nl+al+1); /* allow for overflow (no?) XXX */
+        if (bn_wexpand(r,max) == NULL) goto err;
+        if (bn_wexpand(ret,max) == NULL) goto err;
 
-                r->neg=a->neg^n->neg;
-                np=n->d;
-                rp=r->d;
-                nrp= &(r->d[nl]);
+        r->neg=a->neg^n->neg;
+        np=n->d;
+        rp=r->d;
+        nrp= &(r->d[nl]);
 
-                /* clear the top words of T */
+        /* clear the top words of T */
 #if 1
-                for (i=r->top; i<max; i++) /* memset? XXX */
-                        r->d[i]=0;
+        for (i=r->top; i<max; i++) /* memset? XXX */
+                r->d[i]=0;
 #else
-                memset(&(r->d[r->top]),0,(max-r->top)*sizeof(BN_ULONG)); 
+        memset(&(r->d[r->top]),0,(max-r->top)*sizeof(BN_ULONG)); 
 #endif
 
-                r->top=max;
-                n0=mont->n0;
+        r->top=max;
+        n0=mont->n0;
 
 #ifdef BN_COUNT
-printf("word BN_from_montgomery %d * %d\n",nl,nl);
+        printf("word BN_from_montgomery %d * %d\n",nl,nl);
 #endif
-                for (i=0; i<nl; i++)
-                        {
-                        v=bn_mul_add_words(rp,np,nl,(rp[0]*n0)&BN_MASK2);
-                        nrp++;
-                        rp++;
-                        if (((nrp[-1]+=v)&BN_MASK2) >= v)
-                                continue;
-                        else
-                                {
-                                if (((++nrp[0])&BN_MASK2) != 0) continue;
-                                if (((++nrp[1])&BN_MASK2) != 0) continue;
-                                for (x=2; (((++nrp[x])&BN_MASK2) == 0); x++) ;
-                                }
-                        }
-                bn_fix_top(r);
-
-                /* mont->ri will be a multiple of the word size */
-#if 0
-                BN_rshift(ret,r,mont->ri);
-#else
-                x=ri;
-                rp=ret->d;
-                ap= &(r->d[x]);
-                if (r->top < x)
-                        al=0;
+        for (i=0; i<nl; i++)
+                {
+                v=bn_mul_add_words(rp,np,nl,(rp[0]*n0)&BN_MASK2);
+                nrp++;
+                rp++;
+                if (((nrp[-1]+=v)&BN_MASK2) >= v)
+                        continue;
                 else
-                        al=r->top-x;
-                ret->top=al;
-                al-=4;
-                for (i=0; i<al; i+=4)
                         {
-                        BN_ULONG t1,t2,t3,t4;
-
-                        t1=ap[i+0];
-                        t2=ap[i+1];
-                        t3=ap[i+2];
-                        t4=ap[i+3];
-                        rp[i+0]=t1;
-                        rp[i+1]=t2;
-                        rp[i+2]=t3;
-                        rp[i+3]=t4;
+                        if (((++nrp[0])&BN_MASK2) != 0) continue;
+                        if (((++nrp[1])&BN_MASK2) != 0) continue;
+                        for (x=2; (((++nrp[x])&BN_MASK2) == 0); x++) ;
                         }
-                al+=4;
-                for (; i<al; i++)
-                        rp[i]=ap[i];
-#endif
-
-                if (BN_ucmp(ret, &(mont->N)) >= 0)
-                        {
-                        BN_usub(ret,ret,&(mont->N)); /* XXX */
-                        }
-                retn=1;
-err1:
-                return(retn);
                 }
-#ifdef BN_RECURSION_MONT
-        else /* bignum version */ 
+        bn_fix_top(r);
+        
+        /* mont->ri will be a multiple of the word size */
+#if 0
+        BN_rshift(ret,r,mont->ri);
+#else
+        x=ri;
+        rp=ret->d;
+        ap= &(r->d[x]);
+        if (r->top < x)
+                al=0;
+        else
+                al=r->top-x;
+        ret->top=al;
+        al-=4;
+        for (i=0; i<al; i+=4)
                 {
-                BIGNUM *t1,*t2,*t3;
-                int j,i;
-
-#ifdef BN_COUNT
-printf("number BN_from_montgomery\n");
-#endif
-
-                t1= &(ctx->bn[ctx->tos]);
-                t2= &(ctx->bn[ctx->tos+1]);
-                t3= &(ctx->bn[ctx->tos+2]);
-
-                i=mont->Ni.top;
-                bn_wexpand(ret,i); /* perhaps only i*2 */
-                bn_wexpand(t1,i*4); /* perhaps only i*2 */
-                bn_wexpand(t2,i*2); /* perhaps only i   */
-
-                bn_mul_low_recursive(t2->d,a->d,mont->Ni.d,i,t1->d);
-
-                BN_zero(t3);
-                BN_set_bit(t3,mont->N.top*BN_BITS2);
-                bn_sub_words(t3->d,t3->d,a->d,i);
-                bn_mul_high(ret->d,t2->d,mont->N.d,t3->d,i,t1->d);
-
-                /* hmm... if a is between i and 2*i, things are bad */
-                if (a->top > i)
-                        {
-                        j=(int)(bn_add_words(ret->d,ret->d,&(a->d[i]),i));
-                        if (j) /* overflow */
-                                bn_sub_words(ret->d,ret->d,mont->N.d,i);
-                        }
-                ret->top=i;
-                bn_fix_top(ret);
-                if (a->d[0])
-                        BN_add_word(ret,1); /* Always? */
-                else    /* Very very rare */
-                        {
-                        for (i=1; i<mont->N.top-1; i++)
-                                {
-                                if (a->d[i])
-                                        {
-                                        BN_add_word(ret,1); /* Always? */
-                                        break;
-                                        }
-                                }
-                        }
-
-                if (BN_ucmp(ret,&(mont->N)) >= 0)
-                        BN_usub(ret,ret,&(mont->N));
-
-                return(1);
+                BN_ULONG t1,t2,t3,t4;
+                
+                t1=ap[i+0];
+                t2=ap[i+1];
+                t3=ap[i+2];
+                t4=ap[i+3];
+                rp[i+0]=t1;
+                rp[i+1]=t2;
+                rp[i+2]=t3;
+                rp[i+3]=t4;
                 }
+        al+=4;
+        for (; i<al; i++)
+                rp[i]=ap[i];
 #endif
+#else /* !MONT_WORD */ 
+        BIGNUM *t1,*t2;
+
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        t2 = BN_CTX_get(ctx);
+        if (t1 == NULL || t2 == NULL) goto err;
+        
+        if (!BN_copy(t1,a)) goto err;
+        BN_mask_bits(t1,mont->ri);
+
+        if (!BN_mul(t2,t1,&mont->Ni,ctx)) goto err;
+        BN_mask_bits(t2,mont->ri);
+
+        if (!BN_mul(t1,t2,&mont->N,ctx)) goto err;
+        if (!BN_add(t2,a,t1)) goto err;
+        BN_rshift(ret,t2,mont->ri);
+#endif /* MONT_WORD */
+
+        if (BN_ucmp(ret, &(mont->N)) >= 0)
+                {
+                BN_usub(ret,ret,&(mont->N));
+                }
+        retn=1;
+ err:
+        BN_CTX_end(ctx);
+        return(retn);
         }
 
 BN_MONT_CTX *BN_MONT_CTX_new(void)
@@ -278,7 +243,6 @@ BN_MONT_CTX *BN_MONT_CTX_new(void)
 
 void BN_MONT_CTX_init(BN_MONT_CTX *ctx)
         {
-        ctx->use_word=0;
         ctx->ri=0;
         BN_init(&(ctx->RR));
         BN_init(&(ctx->N));
@@ -306,85 +270,53 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
         R= &(mont->RR);                                 /* grab RR as a temp */
         BN_copy(&(mont->N),mod);                        /* Set N */
 
-#ifdef BN_RECURSION_MONT
-        if (mont->N.top < BN_MONT_CTX_SET_SIZE_WORD)
-#endif
+#ifdef MONT_WORD
                 {
                 BIGNUM tmod;
                 BN_ULONG buf[2];
 
-                mont->use_word=1;
-
                 mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
                 BN_zero(R);
-                BN_set_bit(R,BN_BITS2);
-                /* I was bad, this modification of a passed variable was
-                 * breaking the multithreaded stuff :-(
-                 * z=mod->top;
-                 * mod->top=1; */
+                BN_set_bit(R,BN_BITS2);                 /* R */
 
-                buf[0]=mod->d[0];
+                buf[0]=mod->d[0]; /* tmod = N mod word size */
                 buf[1]=0;
                 tmod.d=buf;
                 tmod.top=1;
-                tmod.max=mod->max;
+                tmod.max=2;
                 tmod.neg=mod->neg;
-
+                                                        /* Ri = R^-1 mod N*/
                 if ((BN_mod_inverse(&Ri,R,&tmod,ctx)) == NULL)
                         goto err;
-                BN_lshift(&Ri,&Ri,BN_BITS2);                    /* R*Ri */
+                BN_lshift(&Ri,&Ri,BN_BITS2);            /* R*Ri */
                 if (!BN_is_zero(&Ri))
-                        {
-#if 1
                         BN_sub_word(&Ri,1);
-#else
-                        BN_usub(&Ri,&Ri,BN_value_one());        /* R*Ri - 1 */
-#endif
-                        }
-                else
-                        {
-                        /* This is not common..., 1 in BN_MASK2,
-                         * It happens when buf[0] was == 1.  So for 8 bit,
-                         * this is 1/256, 16bit, 1 in 2^16 etc.
-                         */
-                        BN_set_word(&Ri,BN_MASK2);
-                        }
-                BN_div(&Ri,NULL,&Ri,&tmod,ctx);
+                else /* if N mod word size == 1 */
+                        BN_set_word(&Ri,BN_MASK2);  /* Ri-- (mod word size) */
+                BN_div(&Ri,NULL,&Ri,&tmod,ctx); /* Ni = (R*Ri-1)/N,
+                                                 * keep only least significant word: */
                 mont->n0=Ri.d[0];
                 BN_free(&Ri);
-                /* mod->top=z; */
                 }
-#ifdef BN_RECURSION_MONT
-        else
-                {
-                mont->use_word=0;
-                mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
-#if 1
+#else /* !MONT_WORD */
+                { /* bignum version */
+                mont->ri=BN_num_bits(mod);
                 BN_zero(R);
-                BN_set_bit(R,mont->ri);
-#else
-                BN_lshift(R,BN_value_one(),mont->ri);   /* R */
-#endif
+                BN_set_bit(R,mont->ri);                 /* R = 2^ri */
+                                                        /* Ri = R^-1 mod N*/
                 if ((BN_mod_inverse(&Ri,R,mod,ctx)) == NULL)
                         goto err;
                 BN_lshift(&Ri,&Ri,mont->ri);            /* R*Ri */
-#if 1
                 BN_sub_word(&Ri,1);
-#else
-                BN_usub(&Ri,&Ri,BN_value_one());        /* R*Ri - 1 */
-#endif
+                                                        /* Ni = (R*Ri-1) / N */
                 BN_div(&(mont->Ni),NULL,&Ri,mod,ctx);
                 BN_free(&Ri);
                 }
 #endif
 
         /* setup RR for conversions */
-#if 1
         BN_zero(&(mont->RR));
         BN_set_bit(&(mont->RR),mont->ri*2);
-#else
-        BN_lshift(mont->RR,BN_value_one(),mont->ri*2);
-#endif
         BN_mod(&(mont->RR),&(mont->RR),&(mont->N),ctx);
 
         return(1);
@@ -399,7 +331,6 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
         BN_copy(&(to->RR),&(from->RR));
         BN_copy(&(to->N),&(from->N));
         BN_copy(&(to->Ni),&(from->Ni));
-        to->use_word=from->use_word;
         to->ri=from->ri;
         to->n0=from->n0;
         return(to);
diff --git a/src/lib/libssl/src/crypto/bn/bn_mul.c b/src/lib/libssl/src/crypto/bn/bn_mul.c
index 38c47f3d1f..eb007e19e9 100644
--- a/src/lib/libssl/src/crypto/bn/bn_mul.c
+++ b/src/lib/libssl/src/crypto/bn/bn_mul.c
@@ -66,7 +66,7 @@
  * n2 must be a power of 2.
  * We multiply and return the result.
  * t must be 2*n2 words in size
- * We calulate
+ * We calculate
  * a[0]*b[0]
  * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
  * a[1]*b[1]
@@ -78,21 +78,23 @@ void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
         unsigned int neg,zero;
         BN_ULONG ln,lo,*p;
 
-#ifdef BN_COUNT
-printf(" bn_mul_recursive %d * %d\n",n2,n2);
-#endif
-#ifdef BN_MUL_COMBA
-/*      if (n2 == 4)
+# ifdef BN_COUNT
+        printf(" bn_mul_recursive %d * %d\n",n2,n2);
+# endif
+# ifdef BN_MUL_COMBA
+#  if 0
+        if (n2 == 4)
                 {
                 bn_mul_comba4(r,a,b);
                 return;
                 }
-        else */ if (n2 == 8)
+#  endif
+        if (n2 == 8)
                 {
                 bn_mul_comba8(r,a,b);
                 return; 
                 }
-#endif
+# endif /* BN_MUL_COMBA */
         if (n2 < BN_MUL_RECURSIVE_SIZE_NORMAL)
                 {
                 /* This should not happen */
@@ -136,7 +138,7 @@ printf(" bn_mul_recursive %d * %d\n",n2,n2);
                 break;
                 }
 
-#ifdef BN_MUL_COMBA
+# ifdef BN_MUL_COMBA
         if (n == 4)
                 {
                 if (!zero)
@@ -158,7 +160,7 @@ printf(" bn_mul_recursive %d * %d\n",n2,n2);
                 bn_mul_comba8(&(r[n2]),&(a[n]),&(b[n]));
                 }
         else
-#endif
+# endif /* BN_MUL_COMBA */
                 {
                 p= &(t[n2*2]);
                 if (!zero)
@@ -219,12 +221,12 @@ void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
              int n, BN_ULONG *t)
         {
         int i,j,n2=n*2;
-        unsigned int c1;
+        unsigned int c1,c2,neg,zero;
         BN_ULONG ln,lo,*p;
 
-#ifdef BN_COUNT
-printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
-#endif
+# ifdef BN_COUNT
+        printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
+# endif
         if (n < 8)
                 {
                 i=tn+n;
@@ -233,17 +235,54 @@ printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
                 }
 
         /* r=(a[0]-a[1])*(b[1]-b[0]) */
-        bn_sub_words(t,      a,      &(a[n]),n); /* + */
-        bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
-
-/*      if (n == 4)
+        c1=bn_cmp_words(a,&(a[n]),n);
+        c2=bn_cmp_words(&(b[n]),b,n);
+        zero=neg=0;
+        switch (c1*3+c2)
+                {
+        case -4:
+                bn_sub_words(t,      &(a[n]),a,      n); /* - */
+                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
+                break;
+        case -3:
+                zero=1;
+                /* break; */
+        case -2:
+                bn_sub_words(t,      &(a[n]),a,      n); /* - */
+                bn_sub_words(&(t[n]),&(b[n]),b,      n); /* + */
+                neg=1;
+                break;
+        case -1:
+        case 0:
+        case 1:
+                zero=1;
+                /* break; */
+        case 2:
+                bn_sub_words(t,      a,      &(a[n]),n); /* + */
+                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
+                neg=1;
+                break;
+        case 3:
+                zero=1;
+                /* break; */
+        case 4:
+                bn_sub_words(t,      a,      &(a[n]),n);
+                bn_sub_words(&(t[n]),&(b[n]),b,      n);
+                break;
+                }
+                /* The zero case isn't yet implemented here. The speedup
+                   would probably be negligible. */
+# if 0
+        if (n == 4)
                 {
                 bn_mul_comba4(&(t[n2]),t,&(t[n]));
                 bn_mul_comba4(r,a,b);
                 bn_mul_normal(&(r[n2]),&(a[n]),tn,&(b[n]),tn);
                 memset(&(r[n2+tn*2]),0,sizeof(BN_ULONG)*(n2-tn*2));
                 }
-        else */ if (n == 8)
+        else
+# endif
+        if (n == 8)
                 {
                 bn_mul_comba8(&(t[n2]),t,&(t[n]));
                 bn_mul_comba8(r,a,b);
@@ -308,7 +347,16 @@ printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
          */
 
         c1=(int)(bn_add_words(t,r,&(r[n2]),n2));
-        c1-=(int)(bn_sub_words(&(t[n2]),t,&(t[n2]),n2));
+
+        if (neg) /* if t[32] is negative */
+                {
+                c1-=(int)(bn_sub_words(&(t[n2]),t,&(t[n2]),n2));
+                }
+        else
+                {
+                /* Might have a carry */
+                c1+=(int)(bn_add_words(&(t[n2]),&(t[n2]),t,n2));
+                }
 
         /* t[32] holds (a[0]-a[1])*(b[1]-b[0])+(a[0]*b[0])+(a[1]*b[1])
          * r[10] holds (a[0]*b[0])
@@ -345,9 +393,9 @@ void bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
         {
         int n=n2/2;
 
-#ifdef BN_COUNT
-printf(" bn_mul_low_recursive %d * %d\n",n2,n2);
-#endif
+# ifdef BN_COUNT
+        printf(" bn_mul_low_recursive %d * %d\n",n2,n2);
+# endif
 
         bn_mul_recursive(r,a,b,n,&(t[0]));
         if (n >= BN_MUL_LOW_RECURSIVE_SIZE_NORMAL)
@@ -379,9 +427,9 @@ void bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2,
         int neg,oneg,zero;
         BN_ULONG ll,lc,*lp,*mp;
 
-#ifdef BN_COUNT
-printf(" bn_mul_high %d * %d\n",n2,n2);
-#endif
+# ifdef BN_COUNT
+        printf(" bn_mul_high %d * %d\n",n2,n2);
+# endif
         n=n2/2;
 
         /* Calculate (al-ah)*(bh-bl) */
@@ -424,14 +472,14 @@ printf(" bn_mul_high %d * %d\n",n2,n2);
         oneg=neg;
         /* t[10] = (a[0]-a[1])*(b[1]-b[0]) */
         /* r[10] = (a[1]*b[1]) */
-#ifdef BN_MUL_COMBA
+# ifdef BN_MUL_COMBA
         if (n == 8)
                 {
                 bn_mul_comba8(&(t[0]),&(r[0]),&(r[n]));
                 bn_mul_comba8(r,&(a[n]),&(b[n]));
                 }
         else
-#endif
+# endif
                 {
                 bn_mul_recursive(&(t[0]),&(r[0]),&(r[n]),n,&(t[n2]));
                 bn_mul_recursive(r,&(a[n]),&(b[n]),n,&(t[n2]));
@@ -555,19 +603,23 @@ printf(" bn_mul_high %d * %d\n",n2,n2);
                         }
                 }
         }
-#endif
+#endif /* BN_RECURSION */
 
 int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
         {
         int top,al,bl;
         BIGNUM *rr;
+        int ret = 0;
+#if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
+        int i;
+#endif
 #ifdef BN_RECURSION
         BIGNUM *t;
-        int i,j,k;
+        int j,k;
 #endif
 
 #ifdef BN_COUNT
-printf("BN_mul %d * %d\n",a->top,b->top);
+        printf("BN_mul %d * %d\n",a->top,b->top);
 #endif
 
         bn_check_top(a);
@@ -585,115 +637,99 @@ printf("BN_mul %d * %d\n",a->top,b->top);
                 }
         top=al+bl;
 
+        BN_CTX_start(ctx);
         if ((r == a) || (r == b))
-                rr= &(ctx->bn[ctx->tos+1]);
+                {
+                if ((rr = BN_CTX_get(ctx)) == NULL) goto err;
+                }
         else
-                rr=r;
+                rr = r;
 
 #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
-        if (al == bl)
+        i = al-bl;
+#endif
+#ifdef BN_MUL_COMBA
+        if (i == 0)
                 {
-#  ifdef BN_MUL_COMBA
-/*              if (al == 4)
+# if 0
+                if (al == 4)
                         {
-                        if (bn_wexpand(rr,8) == NULL) return(0);
+                        if (bn_wexpand(rr,8) == NULL) goto err;
                         rr->top=8;
                         bn_mul_comba4(rr->d,a->d,b->d);
                         goto end;
                         }
-                else */ if (al == 8)
+# endif
+                if (al == 8)
                         {
-                        if (bn_wexpand(rr,16) == NULL) return(0);
+                        if (bn_wexpand(rr,16) == NULL) goto err;
                         rr->top=16;
                         bn_mul_comba8(rr->d,a->d,b->d);
                         goto end;
                         }
-                else
-#  endif
-#ifdef BN_RECURSION
-                if (al < BN_MULL_SIZE_NORMAL)
-#endif
-                        {
-                        if (bn_wexpand(rr,top) == NULL) return(0);
-                        rr->top=top;
-                        bn_mul_normal(rr->d,a->d,al,b->d,bl);
-                        goto end;
-                        }
-#  ifdef BN_RECURSION
-                goto symetric;
-#  endif
                 }
-#endif
+#endif /* BN_MUL_COMBA */
 #ifdef BN_RECURSION
-        else if ((al < BN_MULL_SIZE_NORMAL) || (bl < BN_MULL_SIZE_NORMAL))
+        if ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))
                 {
-                if (bn_wexpand(rr,top) == NULL) return(0);
-                rr->top=top;
-                bn_mul_normal(rr->d,a->d,al,b->d,bl);
-                goto end;
-                }
-        else
-                {
-                i=(al-bl);
-                if ((i ==  1) && !BN_get_flags(b,BN_FLG_STATIC_DATA))
+                if (i == 1 && !BN_get_flags(b,BN_FLG_STATIC_DATA))
                         {
                         bn_wexpand(b,al);
                         b->d[bl]=0;
                         bl++;
-                        goto symetric;
+                        i--;
                         }
-                else if ((i ==  -1) && !BN_get_flags(a,BN_FLG_STATIC_DATA))
+                else if (i == -1 && !BN_get_flags(a,BN_FLG_STATIC_DATA))
                         {
                         bn_wexpand(a,bl);
                         a->d[al]=0;
                         al++;
-                        goto symetric;
+                        i++;
+                        }
+                if (i == 0)
+                        {
+                        /* symmetric and > 4 */
+                        /* 16 or larger */
+                        j=BN_num_bits_word((BN_ULONG)al);
+                        j=1<<(j-1);
+                        k=j+j;
+                        t = BN_CTX_get(ctx);
+                        if (al == j) /* exact multiple */
+                                {
+                                bn_wexpand(t,k*2);
+                                bn_wexpand(rr,k*2);
+                                bn_mul_recursive(rr->d,a->d,b->d,al,t->d);
+                                }
+                        else
+                                {
+                                bn_wexpand(a,k);
+                                bn_wexpand(b,k);
+                                bn_wexpand(t,k*4);
+                                bn_wexpand(rr,k*4);
+                                for (i=a->top; i<k; i++)
+                                        a->d[i]=0;
+                                for (i=b->top; i<k; i++)
+                                        b->d[i]=0;
+                                bn_mul_part_recursive(rr->d,a->d,b->d,al-j,j,t->d);
+                                }
+                        rr->top=top;
+                        goto end;
                         }
                 }
-#endif
-
-        /* asymetric and >= 4 */ 
-        if (bn_wexpand(rr,top) == NULL) return(0);
+#endif /* BN_RECURSION */
+        if (bn_wexpand(rr,top) == NULL) goto err;
         rr->top=top;
         bn_mul_normal(rr->d,a->d,al,b->d,bl);
 
-#ifdef BN_RECURSION
-        if (0)
-                {
-symetric:
-                /* symetric and > 4 */
-                /* 16 or larger */
-                j=BN_num_bits_word((BN_ULONG)al);
-                j=1<<(j-1);
-                k=j+j;
-                t= &(ctx->bn[ctx->tos]);
-                if (al == j) /* exact multiple */
-                        {
-                        bn_wexpand(t,k*2);
-                        bn_wexpand(rr,k*2);
-                        bn_mul_recursive(rr->d,a->d,b->d,al,t->d);
-                        }
-                else
-                        {
-                        bn_wexpand(a,k);
-                        bn_wexpand(b,k);
-                        bn_wexpand(t,k*4);
-                        bn_wexpand(rr,k*4);
-                        for (i=a->top; i<k; i++)
-                                a->d[i]=0;
-                        for (i=b->top; i<k; i++)
-                                b->d[i]=0;
-                        bn_mul_part_recursive(rr->d,a->d,b->d,al-j,j,t->d);
-                        }
-                rr->top=top;
-                }
-#endif
 #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
 end:
 #endif
         bn_fix_top(rr);
         if (r != rr) BN_copy(r,rr);
-        return(1);
+        ret=1;
+err:
+        BN_CTX_end(ctx);
+        return(ret);
         }
 
 void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
@@ -701,7 +737,7 @@ void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
         BN_ULONG *rr;
 
 #ifdef BN_COUNT
-printf(" bn_mul_normal %d * %d\n",na,nb);
+        printf(" bn_mul_normal %d * %d\n",na,nb);
 #endif
 
         if (na < nb)
@@ -735,7 +771,7 @@ printf(" bn_mul_normal %d * %d\n",na,nb);
 void bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
 #ifdef BN_COUNT
-printf(" bn_mul_low_normal %d * %d\n",n,n);
+        printf(" bn_mul_low_normal %d * %d\n",n,n);
 #endif
         bn_mul_words(r,a,n,b[0]);
 
@@ -753,4 +789,3 @@ printf(" bn_mul_low_normal %d * %d\n",n,n);
                 b+=4;
                 }
         }
-
diff --git a/src/lib/libssl/src/crypto/bn/bn_opts.c b/src/lib/libssl/src/crypto/bn/bn_opts.c
index 381be529b2..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/bn_opts.c
+++ b/src/lib/libssl/src/crypto/bn/bn_opts.c
@@ -1,324 +0,0 @@
-/* crypto/bn/expspeed.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-/* most of this code has been pilfered from my libdes speed.c program */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <signal.h>
-#include <string.h>
-#include <openssl/crypto.h>
-#include <openssl/tmdiff.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-
-#define DEFAULT_SIZE    512
-#define DEFAULT_TIME    3
-
-int verbose=1;
-
-typedef struct parms_st
-        {
-        char *name;
-        void (*func)();
-        BIGNUM r;
-        BIGNUM a;
-        BIGNUM b;
-        BIGNUM c;
-        BIGNUM low;
-        BN_CTX *ctx;
-        BN_MONT_CTX *mont;
-        int w;
-        } PARMS;
-
-void do_mul_exp(int num,PARMS *p);
-void do_mul(int num,PARMS *p);
-void do_sqr(int num,PARMS *p);
-void do_mul_low(int num,PARMS *p);
-void do_mul_high(int num,PARMS *p);
-void do_from_montgomery(int num,PARMS *p);
-int time_it(int sec, PARMS *p);
-void do_it(int sec, PARMS *p);
-
-#define P_EXP   1
-#define P_MUL   2
-#define P_SQR   3
-#define P_MULL  4
-#define P_MULH  5
-#define P_MRED  6
-
-int main(int argc, char **argv)
-        {
-        PARMS p;
-        BN_MONT_CTX *mont;
-        int size=0,num;
-        char *name;
-        int type=P_EXP;
-
-        mont=BN_MONT_CTX_new();
-        p.mont=NULL;
-        p.ctx=BN_CTX_new();
-        BN_init(&p.r);
-        BN_init(&p.a);
-        BN_init(&p.b);
-        BN_init(&p.c);
-        BN_init(&p.low);
-        p.w=0;
-
-        for (;;)
-                {
-                if (argc > 1)
-                        {
-                        if (argv[1][0] == '-')
-                                {
-                                switch(argv[1][1])
-                                        {
-                                case 'e': type=P_EXP; break;
-                                case 'm': type=P_MUL; break;
-                                case 's': type=P_SQR; break;
-                                case 'l': type=P_MULL; break;
-                                case 'h': type=P_MULH; break;
-                                case 'r': type=P_MRED; break;
-                                default:
-                                        fprintf(stderr,"options: -[emslhr]\n");
-                                        exit(1);
-                                        }
-                                }
-                        else
-                                {
-                                size=atoi(argv[1]);
-                                }
-                        argc--;
-                        argv++;
-                        }
-                else
-                        break;
-                }
-        if (size == 0)
-                size=DEFAULT_SIZE;
-
-        printf("bit size:%5d\n",size);
-
-        BN_rand(&p.a,size,1,0);
-        BN_rand(&p.b,size,1,0);
-        BN_rand(&p.c,size,1,1);
-        BN_mod(&p.a,&p.a,&p.c,p.ctx);
-        BN_mod(&p.b,&p.b,&p.c,p.ctx);
-        p.w=(p.a.top+1)/2;
-
-        BN_mul(&p.low,&p.a,&p.b,p.ctx);
-        p.low.top=p.a.top;
-        
-        switch(type)
-                {
-        case P_EXP:
-                p.name="r=a^b%c";
-                p.func=do_mul_exp;
-                p.mont=mont;
-                break;
-        case P_MUL:
-                p.name="r=a*b";
-                p.func=do_mul;
-                break;
-        case P_SQR:
-                p.name="r=a*a";
-                p.func=do_sqr;
-                break;
-        case P_MULL:
-                p.name="r=low(a*b)";
-                p.func=do_mul_low;
-                break;
-        case P_MULH:
-                p.name="r=high(a*b)";
-                p.func=do_mul_high;
-                break;
-        case P_MRED:
-                p.name="r=montgomery_reduction(a)";
-                p.func=do_from_montgomery;
-                p.mont=mont;
-                break;
-        default:
-                fprintf(stderr,"options: -[emslhr]\n");
-                exit(1);
-                }
-
-        num=time_it(DEFAULT_TIME,&p);
-        do_it(num,&p);
-        }
-
-void do_it(int num, PARMS *p)
-        {
-        char *start,*end;
-        int i,j,number;
-        double d;
-
-        start=ms_time_new();
-        end=ms_time_new();
-
-        number=BN_num_bits_word((BN_ULONG)BN_num_bits(&(p->c)))-
-                BN_num_bits_word(BN_BITS2)+2;
-        for (i=number-1; i >=0; i--)
-                {
-                if (i == 1) continue;
-                BN_set_params(i,i,i,1);
-                if (p->mont != NULL)
-                        BN_MONT_CTX_set(p->mont,&(p->c),p->ctx);
-
-                printf("Timing %5d (%2d bit) %2d %2d %2d %2d :",
-                        (1<<i)*BN_BITS2,i,
-                                BN_get_params(0),
-                                BN_get_params(1),
-                                BN_get_params(2),
-                                BN_get_params(3));
-                fflush(stdout);
-
-                ms_time_get(start);
-                p->func(num,p);
-                ms_time_get(end);
-                d=ms_time_diff(start,end);
-                printf("%6.6f sec, or %d in %.4f seconds\n",
-                        (double)d/num,num,d);
-                }
-        }
-
-int time_it(int sec, PARMS *p)
-        {
-        char *start,*end;
-        int i,j;
-        double d;
-
-        if (p->mont != NULL)
-                BN_MONT_CTX_set(p->mont,&(p->c),p->ctx);
-
-        start=ms_time_new();
-        end=ms_time_new();
-
-        i=1;
-        for (;;)
-                {
-                if (verbose)
-                        printf("timing %s for %d interations\n",p->name,i);
-
-                ms_time_get(start);
-                p->func(i,p);
-                ms_time_get(end);
-                d=ms_time_diff(start,end);
-
-                if      (d < 0.01) i*=100;
-                else if (d < 0.1 ) i*=10;
-                else if (d > (double)sec) break;
-                else
-                        {
-                        i=(int)(1.0*i*sec/d);
-                        break;
-                        }
-                }
-        if (verbose)
-                printf("using %d interations\n",i);
-        return(i);
-        }
-
-void do_mul_exp(int num, PARMS *p)
-        {
-        int i;
-
-        for (i=0; i<num; i++)
-                BN_mod_exp_mont(&(p->r),&(p->a),&(p->b),&(p->c),
-                        p->ctx,p->mont);
-        }
-
-void do_mul(int num, PARMS *p)
-        {
-        int i;
-
-        for (i=0; i<num; i++)
-                BN_mul(&(p->r),&(p->a),&(p->b),p->ctx);
-        }
-
-void do_sqr(int num, PARMS *p)
-        {
-        int i;
-
-        for (i=0; i<num; i++)
-                        BN_sqr(&(p->r),&(p->a),p->ctx);
-        }
-
-void do_mul_low(int num, PARMS *p)
-        {
-        int i;
-        
-        for (i=0; i<num; i++)
-                BN_mul_low(&(p->r),&(p->a),&(p->b),p->w,p->ctx);
-        }
-
-void do_mul_high(int num, PARMS *p)
-        {
-        int i;
-
-        for (i=0; i<num; i++)
-                BN_mul_low(&(p->r),&(p->a),&(p->b),&(p->low),p->w,p->ctx);
-        }
-
-void do_from_montgomery(int num, PARMS *p)
-        {
-        int i;
-        
-        for (i=0; i<num; i++)
-                BN_from_montgomery(&(p->r),&(p->a),p->mont,p->ctx);
-        }
-
diff --git a/src/lib/libssl/src/crypto/bn/bn_prime.c b/src/lib/libssl/src/crypto/bn/bn_prime.c
index 6fa0f9be1e..a5f01b92eb 100644
--- a/src/lib/libssl/src/crypto/bn/bn_prime.c
+++ b/src/lib/libssl/src/crypto/bn/bn_prime.c
@@ -55,6 +55,59 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
 #include <stdio.h>
 #include <time.h>
@@ -62,26 +115,29 @@
 #include "bn_lcl.h"
 #include <openssl/rand.h>
 
-/* The quick seive algorithm approach to weeding out primes is
+/* The quick sieve algorithm approach to weeding out primes is
  * Philip Zimmermann's, as implemented in PGP.  I have had a read of
  * his comments and implemented my own version.
  */
 #include "bn_prime.h"
 
-static int witness(BIGNUM *a, BIGNUM *n, BN_CTX *ctx,BN_CTX *ctx2,
-        BN_MONT_CTX *mont);
+static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1,
+        const BIGNUM *a1_odd, int k, BN_CTX *ctx, BN_MONT_CTX *mont);
 static int probable_prime(BIGNUM *rnd, int bits);
 static int probable_prime_dh(BIGNUM *rnd, int bits,
         BIGNUM *add, BIGNUM *rem, BN_CTX *ctx);
-static int probable_prime_dh_strong(BIGNUM *rnd, int bits,
+static int probable_prime_dh_safe(BIGNUM *rnd, int bits,
         BIGNUM *add, BIGNUM *rem, BN_CTX *ctx);
-BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int strong, BIGNUM *add,
+
+BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe, BIGNUM *add,
              BIGNUM *rem, void (*callback)(int,int,void *), void *cb_arg)
         {
         BIGNUM *rnd=NULL;
         BIGNUM t;
+        int found=0;
         int i,j,c1=0;
         BN_CTX *ctx;
+        int checks = BN_prime_checks_for_size(bits);
 
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
@@ -100,9 +156,9 @@ loop:
                 }
         else
                 {
-                if (strong)
+                if (safe)
                         {
-                        if (!probable_prime_dh_strong(rnd,bits,add,rem,ctx))
+                        if (!probable_prime_dh_safe(rnd,bits,add,rem,ctx))
                                  goto err;
                         }
                 else
@@ -114,160 +170,185 @@ loop:
         /* if (BN_mod_word(rnd,(BN_ULONG)3) == 1) goto loop; */
         if (callback != NULL) callback(0,c1++,cb_arg);
 
-        if (!strong)
+        if (!safe)
                 {
-                i=BN_is_prime(rnd,BN_prime_checks,callback,ctx,cb_arg);
+                i=BN_is_prime_fasttest(rnd,checks,callback,ctx,cb_arg,0);
                 if (i == -1) goto err;
                 if (i == 0) goto loop;
                 }
         else
                 {
-                /* for a strong prime generation,
+                /* for "safe prime" generation,
                  * check that (p-1)/2 is prime.
                  * Since a prime is odd, We just
                  * need to divide by 2 */
                 if (!BN_rshift1(&t,rnd)) goto err;
 
-                for (i=0; i<BN_prime_checks; i++)
+                for (i=0; i<checks; i++)
                         {
-                        j=BN_is_prime(rnd,1,callback,ctx,cb_arg);
+                        j=BN_is_prime_fasttest(rnd,1,callback,ctx,cb_arg,0);
                         if (j == -1) goto err;
                         if (j == 0) goto loop;
 
-                        j=BN_is_prime(&t,1,callback,ctx,cb_arg);
+                        j=BN_is_prime_fasttest(&t,1,callback,ctx,cb_arg,0);
                         if (j == -1) goto err;
                         if (j == 0) goto loop;
 
                         if (callback != NULL) callback(2,c1-1,cb_arg);
-                        /* We have a strong prime test pass */
+                        /* We have a safe prime test pass */
                         }
                 }
         /* we have a prime :-) */
-        ret=rnd;
+        found = 1;
 err:
-        if ((ret == NULL) && (rnd != NULL)) BN_free(rnd);
+        if (!found && (ret == NULL) && (rnd != NULL)) BN_free(rnd);
         BN_free(&t);
         if (ctx != NULL) BN_CTX_free(ctx);
-        return(ret);
+        return(found ? rnd : NULL);
         }
 
-int BN_is_prime(BIGNUM *a, int checks, void (*callback)(int,int,void *),
-             BN_CTX *ctx_passed, void *cb_arg)
+int BN_is_prime(const BIGNUM *a, int checks, void (*callback)(int,int,void *),
+        BN_CTX *ctx_passed, void *cb_arg)
         {
-        int i,j,c2=0,ret= -1;
-        BIGNUM *check;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
-        BN_MONT_CTX *mont=NULL;
+        return BN_is_prime_fasttest(a, checks, callback, ctx_passed, cb_arg, 0);
+        }
 
+int BN_is_prime_fasttest(const BIGNUM *a, int checks,
+                void (*callback)(int,int,void *),
+                BN_CTX *ctx_passed, void *cb_arg,
+                int do_trial_division)
+        {
+        int i, j, ret = -1;
+        int k;
+        BN_CTX *ctx = NULL;
+        BIGNUM *A1, *A1_odd, *check; /* taken from ctx */
+        BN_MONT_CTX *mont = NULL;
+        const BIGNUM *A = NULL;
+
+        if (checks == BN_prime_checks)
+                checks = BN_prime_checks_for_size(BN_num_bits(a));
+
+        /* first look for small factors */
         if (!BN_is_odd(a))
                 return(0);
+        if (do_trial_division)
+                {
+                for (i = 1; i < NUMPRIMES; i++)
+                        if (BN_mod_word(a, primes[i]) == 0) 
+                                return 0;
+                if (callback != NULL) callback(1, -1, cb_arg);
+                }
+
         if (ctx_passed != NULL)
-                ctx=ctx_passed;
+                ctx = ctx_passed;
         else
-                if ((ctx=BN_CTX_new()) == NULL) goto err;
-
-        if ((ctx2=BN_CTX_new()) == NULL) goto err;
-        if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
-
-        check= &(ctx->bn[ctx->tos++]);
+                if ((ctx=BN_CTX_new()) == NULL)
+                        goto err;
+        BN_CTX_start(ctx);
 
-        /* Setup the montgomery structure */
-        if (!BN_MONT_CTX_set(mont,a,ctx2)) goto err;
+        /* A := abs(a) */
+        if (a->neg)
+                {
+                BIGNUM *t;
+                if ((t = BN_CTX_get(ctx)) == NULL) goto err;
+                BN_copy(t, a);
+                t->neg = 0;
+                A = t;
+                }
+        else
+                A = a;
+        A1 = BN_CTX_get(ctx);
+        A1_odd = BN_CTX_get(ctx);
+        check = BN_CTX_get(ctx);
+        if (check == NULL) goto err;
+
+        /* compute A1 := A - 1 */
+        if (!BN_copy(A1, A))
+                goto err;
+        if (!BN_sub_word(A1, 1))
+                goto err;
+        if (BN_is_zero(A1))
+                {
+                ret = 0;
+                goto err;
+                }
 
-        for (i=0; i<checks; i++)
+        /* write  A1  as  A1_odd * 2^k */
+        k = 1;
+        while (!BN_is_bit_set(A1, k))
+                k++;
+        if (!BN_rshift(A1_odd, A1, k))
+                goto err;
+
+        /* Montgomery setup for computations mod A */
+        mont = BN_MONT_CTX_new();
+        if (mont == NULL)
+                goto err;
+        if (!BN_MONT_CTX_set(mont, A, ctx))
+                goto err;
+        
+        for (i = 0; i < checks; i++)
                 {
-                if (!BN_rand(check,BN_num_bits(a)-1,0,0)) goto err;
-                j=witness(check,a,ctx,ctx2,mont);
+                if (!BN_pseudo_rand(check, BN_num_bits(A1), 0, 0))
+                        goto err;
+                if (BN_cmp(check, A1) >= 0)
+                        if (!BN_sub(check, check, A1))
+                                goto err;
+                if (!BN_add_word(check, 1))
+                        goto err;
+                /* now 1 <= check < A */
+
+                j = witness(check, A, A1, A1_odd, k, ctx, mont);
                 if (j == -1) goto err;
                 if (j)
                         {
                         ret=0;
                         goto err;
                         }
-                if (callback != NULL) callback(1,c2++,cb_arg);
+                if (callback != NULL) callback(1,i,cb_arg);
                 }
         ret=1;
 err:
-        ctx->tos--;
-        if ((ctx_passed == NULL) && (ctx != NULL))
-                BN_CTX_free(ctx);
-        if (ctx2 != NULL)
-                BN_CTX_free(ctx2);
-        if (mont != NULL) BN_MONT_CTX_free(mont);
-                
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                if (ctx_passed == NULL)
+                        BN_CTX_free(ctx);
+                }
+        if (mont != NULL)
+                BN_MONT_CTX_free(mont);
+
         return(ret);
         }
 
-#define RECP_MUL_MOD
-
-static int witness(BIGNUM *a, BIGNUM *n, BN_CTX *ctx, BN_CTX *ctx2,
-             BN_MONT_CTX *mont)
+static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1,
+        const BIGNUM *a1_odd, int k, BN_CTX *ctx, BN_MONT_CTX *mont)
         {
-        int k,i,ret= -1,good;
-        BIGNUM *d,*dd,*tmp,*d1,*d2,*n1;
-        BIGNUM *mont_one,*mont_n1,*mont_a;
-
-        d1= &(ctx->bn[ctx->tos]);
-        d2= &(ctx->bn[ctx->tos+1]);
-        n1= &(ctx->bn[ctx->tos+2]);
-        ctx->tos+=3;
-
-        mont_one= &(ctx2->bn[ctx2->tos]);
-        mont_n1= &(ctx2->bn[ctx2->tos+1]);
-        mont_a= &(ctx2->bn[ctx2->tos+2]);
-        ctx2->tos+=3;
-
-        d=d1;
-        dd=d2;
-        if (!BN_one(d)) goto err;
-        if (!BN_sub(n1,n,d)) goto err; /* n1=n-1; */
-        k=BN_num_bits(n1);
-
-        if (!BN_to_montgomery(mont_one,BN_value_one(),mont,ctx2)) goto err;
-        if (!BN_to_montgomery(mont_n1,n1,mont,ctx2)) goto err;
-        if (!BN_to_montgomery(mont_a,a,mont,ctx2)) goto err;
-
-        BN_copy(d,mont_one);
-        for (i=k-1; i>=0; i--)
+        if (!BN_mod_exp_mont(w, w, a1_odd, a, ctx, mont)) /* w := w^a1_odd mod a */
+                return -1;
+        if (BN_is_one(w))
+                return 0; /* probably prime */
+        if (BN_cmp(w, a1) == 0)
+                return 0; /* w == -1 (mod a),  'a' is probably prime */
+        while (--k)
                 {
-                if (    (BN_cmp(d,mont_one) != 0) &&
-                        (BN_cmp(d,mont_n1) != 0))
-                        good=1;
-                else
-                        good=0;
-
-                BN_mod_mul_montgomery(dd,d,d,mont,ctx2);
-
-                if (good && (BN_cmp(dd,mont_one) == 0))
-                        {
-                        ret=1;
-                        goto err;
-                        }
-                if (BN_is_bit_set(n1,i))
-                        {
-                        BN_mod_mul_montgomery(d,dd,mont_a,mont,ctx2);
-                        }
-                else
-                        {
-                        tmp=d;
-                        d=dd;
-                        dd=tmp;
-                        }
+                if (!BN_mod_mul(w, w, w, a, ctx)) /* w := w^2 mod a */
+                        return -1;
+                if (BN_is_one(w))
+                        return 1; /* 'a' is composite, otherwise a previous 'w' would
+                                   * have been == -1 (mod 'a') */
+                if (BN_cmp(w, a1) == 0)
+                        return 0; /* w == -1 (mod a), 'a' is probably prime */
                 }
-        if (BN_cmp(d,mont_one) == 0)
-                i=0;
-        else    i=1;
-        ret=i;
-err:
-        ctx->tos-=3;
-        ctx2->tos-=3;
-        return(ret);
+        /* If we get here, 'w' is the (a-1)/2-th power of the original 'w',
+         * and it is neither -1 nor +1 -- so 'a' cannot be prime */
+        return 1;
         }
 
 static int probable_prime(BIGNUM *rnd, int bits)
         {
         int i;
-        MS_STATIC BN_ULONG mods[NUMPRIMES];
+        BN_ULONG mods[NUMPRIMES];
         BN_ULONG delta,d;
 
 again:
@@ -285,7 +366,7 @@ again:
                         d=delta;
                         delta+=2;
                         /* perhaps need to check for overflow of
-                         * delta (but delta can be upto 2^32)
+                         * delta (but delta can be up to 2^32)
                          * 21-May-98 eay - added overflow check */
                         if (delta < d) goto again;
                         goto loop;
@@ -301,7 +382,8 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, BIGNUM *add, BIGNUM *rem,
         int i,ret=0;
         BIGNUM *t1;
 
-        t1= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        if ((t1 = BN_CTX_get(ctx)) == NULL) goto err;
 
         if (!BN_rand(rnd,bits,0,1)) goto err;
 
@@ -327,20 +409,22 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, BIGNUM *add, BIGNUM *rem,
                 }
         ret=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         return(ret);
         }
 
-static int probable_prime_dh_strong(BIGNUM *p, int bits, BIGNUM *padd,
+static int probable_prime_dh_safe(BIGNUM *p, int bits, BIGNUM *padd,
              BIGNUM *rem, BN_CTX *ctx)
         {
         int i,ret=0;
-        BIGNUM *t1,*qadd=NULL,*q=NULL;
+        BIGNUM *t1,*qadd,*q;
 
         bits--;
-        t1= &(ctx->bn[ctx->tos++]);
-        q= &(ctx->bn[ctx->tos++]);
-        qadd= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        q = BN_CTX_get(ctx);
+        qadd = BN_CTX_get(ctx);
+        if (qadd == NULL) goto err;
 
         if (!BN_rshift1(qadd,padd)) goto err;
                 
@@ -376,72 +460,6 @@ static int probable_prime_dh_strong(BIGNUM *p, int bits, BIGNUM *padd,
                 }
         ret=1;
 err:
-        ctx->tos-=3;
-        return(ret);
-        }
-
-#if 0
-static int witness(BIGNUM *a, BIGNUM *n, BN_CTX *ctx)
-        {
-        int k,i,nb,ret= -1;
-        BIGNUM *d,*dd,*tmp;
-        BIGNUM *d1,*d2,*x,*n1,*inv;
-
-        d1= &(ctx->bn[ctx->tos]);
-        d2= &(ctx->bn[ctx->tos+1]);
-        x=  &(ctx->bn[ctx->tos+2]);
-        n1= &(ctx->bn[ctx->tos+3]);
-        inv=&(ctx->bn[ctx->tos+4]);
-        ctx->tos+=5;
-
-        d=d1;
-        dd=d2;
-        if (!BN_one(d)) goto err;
-        if (!BN_sub(n1,n,d)) goto err; /* n1=n-1; */
-        k=BN_num_bits(n1);
-
-        /* i=BN_num_bits(n); */
-#ifdef RECP_MUL_MOD
-        nb=BN_reciprocal(inv,n,ctx); /**/
-        if (nb == -1) goto err;
-#endif
-
-        for (i=k-1; i>=0; i--)
-                {
-                if (BN_copy(x,d) == NULL) goto err;
-#ifndef RECP_MUL_MOD
-                if (!BN_mod_mul(dd,d,d,n,ctx)) goto err;
-#else
-                if (!BN_mod_mul_reciprocal(dd,d,d,n,inv,nb,ctx)) goto err;
-#endif
-                if (    BN_is_one(dd) &&
-                        !BN_is_one(x) &&
-                        (BN_cmp(x,n1) != 0))
-                        {
-                        ret=1;
-                        goto err;
-                        }
-                if (BN_is_bit_set(n1,i))
-                        {
-#ifndef RECP_MUL_MOD
-                        if (!BN_mod_mul(d,dd,a,n,ctx)) goto err;
-#else
-                        if (!BN_mod_mul_reciprocal(d,dd,a,n,inv,nb,ctx)) goto err; 
-#endif
-                        }
-                else
-                        {
-                        tmp=d;
-                        d=dd;
-                        dd=tmp;
-                        }
-                }
-        if (BN_is_one(d))
-                i=0;
-        else    i=1;
-        ret=i;
-err:
-        ctx->tos-=5;
+        BN_CTX_end(ctx);
         return(ret);
         }
-#endif
diff --git a/src/lib/libssl/src/crypto/bn/bn_prime.h b/src/lib/libssl/src/crypto/bn/bn_prime.h
index 6fce0210cd..b7cf9a9bfe 100644
--- a/src/lib/libssl/src/crypto/bn/bn_prime.h
+++ b/src/lib/libssl/src/crypto/bn/bn_prime.h
@@ -1,4 +1,4 @@
-/* crypto/bn/bn_prime.h */
+/* Auto generated by bn_prime.pl */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -61,7 +61,7 @@
 #else
 #define NUMPRIMES 54
 #endif
-static unsigned int primes[NUMPRIMES]=
+static const unsigned int primes[NUMPRIMES]=
         {
            2,   3,   5,   7,  11,  13,  17,  19,
           23,  29,  31,  37,  41,  43,  47,  53,
diff --git a/src/lib/libssl/src/crypto/bn/bn_prime.pl b/src/lib/libssl/src/crypto/bn/bn_prime.pl
index 979385a334..9fc3765486 100644
--- a/src/lib/libssl/src/crypto/bn/bn_prime.pl
+++ b/src/lib/libssl/src/crypto/bn/bn_prime.pl
@@ -18,13 +18,74 @@ loop: while ($#primes < $num-1)
         push(@primes,$p);
         }
 
-print <<"EOF";
+# print <<"EOF";
+# /* Auto generated by bn_prime.pl */
+# /* Copyright (C) 1995-1997 Eric Young (eay\@mincom.oz.au).
+#  * All rights reserved.
+#  * Copyright remains Eric Young's, and as such any Copyright notices in
+#  * the code are not to be removed.
+#  * See the COPYRIGHT file in the SSLeay distribution for more details.
+#  */
+# 
+# EOF
+
+print <<\EOF;
 /* Auto generated by bn_prime.pl */
-/* Copyright (C) 1995-1997 Eric Young (eay\@mincom.oz.au).
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
  * Copyright remains Eric Young's, and as such any Copyright notices in
  * the code are not to be removed.
- * See the COPYRIGHT file in the SSLeay distribution for more details.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
  */
 
 EOF
@@ -43,7 +104,7 @@ printf "#define NUMPRIMES %d\n",$num;
 printf "#else\n";
 printf "#define NUMPRIMES %d\n",$eight;
 printf "#endif\n";
-print "static unsigned int primes[NUMPRIMES]=\n\t{\n\t";
+print "static const unsigned int primes[NUMPRIMES]=\n\t{\n\t";
 $init=0;
 for ($i=0; $i <= $#primes; $i++)
         {
diff --git a/src/lib/libssl/src/crypto/bn/bn_print.c b/src/lib/libssl/src/crypto/bn/bn_print.c
index 2f5ab2617b..782a96e7e0 100644
--- a/src/lib/libssl/src/crypto/bn/bn_print.c
+++ b/src/lib/libssl/src/crypto/bn/bn_print.c
@@ -137,7 +137,7 @@ char *BN_bn2dec(const BIGNUM *a)
                         }
                 lp--;
                 /* We now have a series of blocks, BN_DEC_NUM chars
-                 * in length, where the last one needs trucation.
+                 * in length, where the last one needs truncation.
                  * The blocks need to be reversed in order. */
                 sprintf(p,BN_DEC_FMT1,*lp);
                 while (*p) p++;
@@ -171,7 +171,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a)
         num=i+neg;
         if (bn == NULL) return(num);
 
-        /* a is the start of the hex digets, and it is 'i' long */
+        /* a is the start of the hex digits, and it is 'i' long */
         if (*bn == NULL)
                 {
                 if ((ret=BN_new()) == NULL) return(0);
@@ -185,7 +185,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a)
         /* i is the number of hex digests; */
         if (bn_expand(ret,i*4) == NULL) goto err;
 
-        j=i; /* least significate 'hex' */
+        j=i; /* least significant 'hex' */
         m=0;
         h=0;
         while (j > 0)
@@ -236,8 +236,8 @@ int BN_dec2bn(BIGNUM **bn, const char *a)
         num=i+neg;
         if (bn == NULL) return(num);
 
-        /* a is the start of the digets, and it is 'i' long.
-         * We chop it into BN_DEC_NUM digets at a time */
+        /* a is the start of the digits, and it is 'i' long.
+         * We chop it into BN_DEC_NUM digits at a time */
         if (*bn == NULL)
                 {
                 if ((ret=BN_new()) == NULL) return(0);
@@ -278,9 +278,8 @@ err:
         }
 
 #ifndef NO_BIO
-
 #ifndef NO_FP_API
-int BN_print_fp(FILE *fp, BIGNUM *a)
+int BN_print_fp(FILE *fp, const BIGNUM *a)
         {
         BIO *b;
         int ret;
@@ -319,5 +318,15 @@ int BN_print(BIO *bp, const BIGNUM *a)
 end:
         return(ret);
         }
+#endif
 
+#ifdef BN_DEBUG
+void bn_dump1(FILE *o, const char *a, BN_ULONG *b,int n)
+        {
+        int i;
+        fprintf(o, "%s=", a);
+        for (i=n-1;i>=0;i--)
+                fprintf(o, "%08lX", b[i]); /* assumes 32-bit BN_ULONG */
+        fprintf(o, "\n");
+        }
 #endif
diff --git a/src/lib/libssl/src/crypto/bn/bn_rand.c b/src/lib/libssl/src/crypto/bn/bn_rand.c
index 91b8e34ae6..943712c15b 100644
--- a/src/lib/libssl/src/crypto/bn/bn_rand.c
+++ b/src/lib/libssl/src/crypto/bn/bn_rand.c
@@ -62,7 +62,7 @@
 #include "bn_lcl.h"
 #include <openssl/rand.h>
 
-int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
+static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
         {
         unsigned char *buf=NULL;
         int ret=0,bit,bytes,mask;
@@ -81,9 +81,19 @@ int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
 
         /* make a random number and set the top and bottom bits */
         time(&tim);
-        RAND_seed(&tim,sizeof(tim));
+        RAND_add(&tim,sizeof(tim),0);
+
+        if (pseudorand)
+                {
+                if (RAND_pseudo_bytes(buf, bytes) == -1)
+                        goto err;
+                }
+        else
+                {
+                if (RAND_bytes(buf, bytes) <= 0)
+                        goto err;
+                }
 
-        RAND_bytes(buf,(int)bytes);
         if (top)
                 {
                 if (bit == 0)
@@ -115,3 +125,12 @@ err:
         return(ret);
         }
 
+int     BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
+        {
+        return bnrand(0, rnd, bits, top, bottom);
+        }
+
+int     BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)
+        {
+        return bnrand(1, rnd, bits, top, bottom);
+        }
diff --git a/src/lib/libssl/src/crypto/bn/bn_recp.c b/src/lib/libssl/src/crypto/bn/bn_recp.c
index c1b0e230ea..a8796bd0aa 100644
--- a/src/lib/libssl/src/crypto/bn/bn_recp.c
+++ b/src/lib/libssl/src/crypto/bn/bn_recp.c
@@ -106,7 +106,8 @@ int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_RECP_CTX *recp,
         int ret=0;
         BIGNUM *a;
 
-        a= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        if ((a = BN_CTX_get(ctx)) == NULL) goto err;
         if (y != NULL)
                 {
                 if (x == y)
@@ -120,33 +121,34 @@ int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_RECP_CTX *recp,
         BN_div_recp(NULL,r,a,recp,ctx);
         ret=1;
 err:
-        ctx->tos--;
+        BN_CTX_end(ctx);
         return(ret);
         }
 
 int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
              BN_CTX *ctx)
         {
-        int i,j,tos,ret=0,ex;
+        int i,j,ret=0;
         BIGNUM *a,*b,*d,*r;
 
-        tos=ctx->tos;
-        a= &(ctx->bn[ctx->tos++]);
-        b= &(ctx->bn[ctx->tos++]);
+        BN_CTX_start(ctx);
+        a=BN_CTX_get(ctx);
+        b=BN_CTX_get(ctx);
         if (dv != NULL)
                 d=dv;
         else
-                d= &(ctx->bn[ctx->tos++]);
+                d=BN_CTX_get(ctx);
         if (rem != NULL)
                 r=rem;
         else
-                r= &(ctx->bn[ctx->tos++]);
+                r=BN_CTX_get(ctx);
+        if (a == NULL || b == NULL || d == NULL || r == NULL) goto err;
 
         if (BN_ucmp(m,&(recp->N)) < 0)
                 {
                 BN_zero(d);
                 BN_copy(r,m);
-                ctx->tos=tos;
+                BN_CTX_end(ctx);
                 return(1);
                 }
 
@@ -157,33 +159,24 @@ int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
          */
         i=BN_num_bits(m);
 
-        j=recp->num_bits*2;
-        if (j > i)
-                {
-                i=j;
-                ex=0;
-                }
-        else
-                {
-                ex=(i-j)/2;
-                }
-
-        j=i/2;
+        j=recp->num_bits<<1;
+        if (j>i) i=j;
+        j>>=1;
 
         if (i != recp->shift)
                 recp->shift=BN_reciprocal(&(recp->Nr),&(recp->N),
                         i,ctx);
 
-        if (!BN_rshift(a,m,j-ex)) goto err;
+        if (!BN_rshift(a,m,j)) goto err;
         if (!BN_mul(b,a,&(recp->Nr),ctx)) goto err;
-        if (!BN_rshift(d,b,j+ex)) goto err;
+        if (!BN_rshift(d,b,i-j)) goto err;
         d->neg=0;
         if (!BN_mul(b,&(recp->N),d,ctx)) goto err;
         if (!BN_usub(r,m,b)) goto err;
         r->neg=0;
 
-        j=0;
 #if 1
+        j=0;
         while (BN_ucmp(r,&(recp->N)) >= 0)
                 {
                 if (j++ > 2)
@@ -200,7 +193,7 @@ int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
         d->neg=m->neg^recp->N.neg;
         ret=1;
 err:
-        ctx->tos=tos;
+        BN_CTX_end(ctx);
         return(ret);
         } 
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_sqr.c b/src/lib/libssl/src/crypto/bn/bn_sqr.c
index 12cce4d7ce..fe00c5f69a 100644
--- a/src/lib/libssl/src/crypto/bn/bn_sqr.c
+++ b/src/lib/libssl/src/crypto/bn/bn_sqr.c
@@ -65,14 +65,13 @@
 int BN_sqr(BIGNUM *r, BIGNUM *a, BN_CTX *ctx)
         {
         int max,al;
+        int ret = 0;
         BIGNUM *tmp,*rr;
 
 #ifdef BN_COUNT
 printf("BN_sqr %d * %d\n",a->top,a->top);
 #endif
         bn_check_top(a);
-        tmp= &(ctx->bn[ctx->tos]);
-        rr=(a != r)?r: (&ctx->bn[ctx->tos+1]);
 
         al=a->top;
         if (al <= 0)
@@ -81,8 +80,13 @@ printf("BN_sqr %d * %d\n",a->top,a->top);
                 return(1);
                 }
 
+        BN_CTX_start(ctx);
+        rr=(a != r) ? r : BN_CTX_get(ctx);
+        tmp=BN_CTX_get(ctx);
+        if (tmp == NULL) goto err;
+
         max=(al+al);
-        if (bn_wexpand(rr,max+1) == NULL) return(0);
+        if (bn_wexpand(rr,max+1) == NULL) goto err;
 
         r->neg=0;
         if (al == 4)
@@ -120,18 +124,18 @@ printf("BN_sqr %d * %d\n",a->top,a->top);
                         k=j+j;
                         if (al == j)
                                 {
-                                if (bn_wexpand(a,k*2) == NULL) return(0);
-                                if (bn_wexpand(tmp,k*2) == NULL) return(0);
+                                if (bn_wexpand(a,k*2) == NULL) goto err;
+                                if (bn_wexpand(tmp,k*2) == NULL) goto err;
                                 bn_sqr_recursive(rr->d,a->d,al,tmp->d);
                                 }
                         else
                                 {
-                                if (bn_wexpand(tmp,max) == NULL) return(0);
+                                if (bn_wexpand(tmp,max) == NULL) goto err;
                                 bn_sqr_normal(rr->d,a->d,al,tmp->d);
                                 }
                         }
 #else
-                if (bn_wexpand(tmp,max) == NULL) return(0);
+                if (bn_wexpand(tmp,max) == NULL) goto err;
                 bn_sqr_normal(rr->d,a->d,al,tmp->d);
 #endif
                 }
@@ -139,7 +143,10 @@ printf("BN_sqr %d * %d\n",a->top,a->top);
         rr->top=max;
         if ((max > 0) && (rr->d[max-1] == 0)) rr->top--;
         if (rr != r) BN_copy(r,rr);
-        return(1);
+        ret = 1;
+ err:
+        BN_CTX_end(ctx);
+        return(ret);
         }
 
 /* tmp must have 2*n words */
@@ -185,7 +192,7 @@ void bn_sqr_normal(BN_ULONG *r, BN_ULONG *a, int n, BN_ULONG *tmp)
  * n must be a power of 2.
  * We multiply and return the result.
  * t must be 2*n words in size
- * We calulate
+ * We calculate
  * a[0]*b[0]
  * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
  * a[1]*b[1]
diff --git a/src/lib/libssl/src/crypto/bn/bn_word.c b/src/lib/libssl/src/crypto/bn/bn_word.c
index c0cfbc6797..73157a7d43 100644
--- a/src/lib/libssl/src/crypto/bn/bn_word.c
+++ b/src/lib/libssl/src/crypto/bn/bn_word.c
@@ -60,7 +60,7 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-BN_ULONG BN_mod_word(BIGNUM *a, BN_ULONG w)
+BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w)
         {
 #ifndef BN_LLONG
         BN_ULONG ret=0;
diff --git a/src/lib/libssl/src/crypto/bn/bnspeed.c b/src/lib/libssl/src/crypto/bn/bnspeed.c
index 0922aa3e16..20fc7e08ff 100644
--- a/src/lib/libssl/src/crypto/bn/bnspeed.c
+++ b/src/lib/libssl/src/crypto/bn/bnspeed.c
@@ -1,3 +1,5 @@
+/* unused */
+
 /* crypto/bn/bnspeed.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
diff --git a/src/lib/libssl/src/crypto/bn/bntest.c b/src/lib/libssl/src/crypto/bn/bntest.c
index df4b81f5b2..41c22f5954 100644
--- a/src/lib/libssl/src/crypto/bn/bntest.c
+++ b/src/lib/libssl/src/crypto/bn/bntest.c
@@ -72,6 +72,10 @@
 #include "../bio/bss_file.c"
 #endif
 
+const int num0 = 100; /* number of tests */
+const int num1 = 50;  /* additional tests for some functions */
+const int num2 = 5;   /* number of tests for slow functions */
+
 int test_add(BIO *bp);
 int test_sub(BIO *bp);
 int test_lshift1(BIO *bp);
@@ -95,15 +99,33 @@ static int results=0;
 #include "bss_file.c"
 #endif
 
-static unsigned char lst1[]="\xC6\x4F\x43\x04\x2A\xEA\xCA\x6E\x58\x36\x80\x5B\xE8\xC9"
+static unsigned char lst[]="\xC6\x4F\x43\x04\x2A\xEA\xCA\x6E\x58\x36\x80\x5B\xE8\xC9"
 "\x9B\x04\x5D\x48\x36\xC2\xFD\x16\xC9\x64\xF0";
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
+static void message(BIO *out, char *m)
+        {
+        fprintf(stderr, "test %s\n", m);
+#if defined(linux) || defined(__FreeBSD__) /* can we use GNU bc features? */
+        BIO_puts(out, "print \"test ");
+        BIO_puts(out, m);
+        BIO_puts(out, "\\n\"\n");
+#endif
+        }
+
 int main(int argc, char *argv[])
         {
         BN_CTX *ctx;
         BIO *out;
         char *outfile=NULL;
 
+        results = 0;
+
+        RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_rand may fail, and we don't
+                                               * even check its return value
+                                               * (which we should) */
+
         argc--;
         argv++;
         while (argc >= 1)
@@ -141,78 +163,81 @@ int main(int argc, char *argv[])
         if (!results)
                 BIO_puts(out,"obase=16\nibase=16\n");
 
-        fprintf(stderr,"test BN_add\n");
+        message(out,"BN_add");
         if (!test_add(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_sub\n");
+        message(out,"BN_sub");
         if (!test_sub(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_lshift1\n");
+        message(out,"BN_lshift1");
         if (!test_lshift1(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_lshift (fixed)\n");
-        if (!test_lshift(out,ctx,BN_bin2bn(lst1,sizeof(lst1)-1,NULL)))
+        message(out,"BN_lshift (fixed)");
+        if (!test_lshift(out,ctx,BN_bin2bn(lst,sizeof(lst)-1,NULL)))
             goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_lshift\n");
+        message(out,"BN_lshift");
         if (!test_lshift(out,ctx,NULL)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_rshift1\n");
+        message(out,"BN_rshift1");
         if (!test_rshift1(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_rshift\n");
+        message(out,"BN_rshift");
         if (!test_rshift(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_sqr\n");
+        message(out,"BN_sqr");
         if (!test_sqr(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_mul\n");
+        message(out,"BN_mul");
         if (!test_mul(out)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_div\n");
+        message(out,"BN_div");
         if (!test_div(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_div_recp\n");
+        message(out,"BN_div_recp");
         if (!test_div_recp(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_mod\n");
+        message(out,"BN_mod");
         if (!test_mod(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_mod_mul\n");
+        message(out,"BN_mod_mul");
         if (!test_mod_mul(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-/*
-        fprintf(stderr,"test BN_mont\n");
+        message(out,"BN_mont");
         if (!test_mont(out,ctx)) goto err;
-        fflush(stdout);
-*/
-        fprintf(stderr,"test BN_mod_exp\n");
+        BIO_flush(out);
+
+        message(out,"BN_mod_exp");
         if (!test_mod_exp(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
 
-        fprintf(stderr,"test BN_exp\n");
+        message(out,"BN_exp");
         if (!test_exp(out,ctx)) goto err;
-        fflush(stdout);
+        BIO_flush(out);
+
+        BN_CTX_free(ctx);
+        BIO_free(out);
 
 /**/
         exit(0);
 err:
         BIO_puts(out,"1\n"); /* make sure bc fails if we are piping to it */
+        BIO_flush(out);
         ERR_load_crypto_strings();
-        ERR_print_errors(out);
+        ERR_print_errors_fp(stderr);
         exit(1);
         return(1);
         }
@@ -228,7 +253,7 @@ int test_add(BIO *bp)
         BN_init(&c);
 
         BN_rand(&a,512,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rand(&b,450+i,0,0);
                 a.neg=rand_neg();
@@ -255,7 +280,7 @@ int test_add(BIO *bp)
                 BN_add(&c,&c,&a);
                 if(!BN_is_zero(&c))
                     {
-                    BIO_puts(bp,"Add test failed!\n");
+                    fprintf(stderr,"Add test failed!\n");
                     return 0;
                     }
                 }
@@ -275,12 +300,21 @@ int test_sub(BIO *bp)
         BN_init(&b);
         BN_init(&c);
 
-        BN_rand(&a,512,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0+num1; i++)
                 {
-                BN_rand(&b,400+i,0,0);
-                a.neg=rand_neg();
-                b.neg=rand_neg();
+                if (i < num1)
+                        {
+                        BN_rand(&a,512,0,0);
+                        BN_copy(&b,&a);
+                        if (BN_set_bit(&a,i)==0) return(0);
+                        BN_add_word(&b,i);
+                        }
+                else
+                        {
+                        BN_rand(&b,400+i-num1,0,0);
+                        a.neg=rand_neg();
+                        b.neg=rand_neg();
+                        }
                 if (bp == NULL)
                         for (j=0; j<10000; j++)
                                 BN_sub(&c,&a,&b);
@@ -301,7 +335,7 @@ int test_sub(BIO *bp)
                 BN_sub(&c,&c,&a);
                 if(!BN_is_zero(&c))
                     {
-                    BIO_puts(bp,"Subtract test failed!\n");
+                    fprintf(stderr,"Subtract test failed!\n");
                     return 0;
                     }
                 }
@@ -323,10 +357,17 @@ int test_div(BIO *bp, BN_CTX *ctx)
         BN_init(&d);
         BN_init(&e);
 
-        BN_rand(&a,400,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0+num1; i++)
                 {
-                BN_rand(&b,50+i,0,0);
+                if (i < num1)
+                        {
+                        BN_rand(&a,400,0,0);
+                        BN_copy(&b,&a);
+                        BN_lshift(&a,&a,i);
+                        BN_add_word(&a,i);
+                        }
+                else
+                        BN_rand(&b,50+3*(i-num1),0,0);
                 a.neg=rand_neg();
                 b.neg=rand_neg();
                 if (bp == NULL)
@@ -360,7 +401,7 @@ int test_div(BIO *bp, BN_CTX *ctx)
                 BN_sub(&d,&d,&a);
                 if(!BN_is_zero(&d))
                     {
-                    BIO_puts(bp,"Division test failed!\n");
+                    fprintf(stderr,"Division test failed!\n");
                     return 0;
                     }
                 }
@@ -386,10 +427,17 @@ int test_div_recp(BIO *bp, BN_CTX *ctx)
         BN_init(&d);
         BN_init(&e);
 
-        BN_rand(&a,400,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0+num1; i++)
                 {
-                BN_rand(&b,50+i,0,0);
+                if (i < num1)
+                        {
+                        BN_rand(&a,400,0,0);
+                        BN_copy(&b,&a);
+                        BN_lshift(&a,&a,i);
+                        BN_add_word(&a,i);
+                        }
+                else
+                        BN_rand(&b,50+3*(i-num1),0,0);
                 a.neg=rand_neg();
                 b.neg=rand_neg();
                 BN_RECP_CTX_set(&recp,&b,ctx);
@@ -424,7 +472,12 @@ int test_div_recp(BIO *bp, BN_CTX *ctx)
                 BN_sub(&d,&d,&a);
                 if(!BN_is_zero(&d))
                     {
-                    BIO_puts(bp,"Reciprocal division test failed!\n");
+                    fprintf(stderr,"Reciprocal division test failed!\n");
+                    fprintf(stderr,"a=");
+                    BN_print_fp(stderr,&a);
+                    fprintf(stderr,"\nb=");
+                    BN_print_fp(stderr,&b);
+                    fprintf(stderr,"\n");
                     return 0;
                     }
                 }
@@ -451,11 +504,15 @@ int test_mul(BIO *bp)
         BN_init(&d);
         BN_init(&e);
 
-        BN_rand(&a,200,0,0);
-        for (i=0; i<100; i++)
+        for (i=0; i<num0+num1; i++)
                 {
-                BN_rand(&b,250+i,0,0);
-                BN_rand(&b,200,0,0);
+                if (i <= num1)
+                        {
+                        BN_rand(&a,100,0,0);
+                        BN_rand(&b,100,0,0);
+                        }
+                else
+                        BN_rand(&b,i-num1,0,0);
                 a.neg=rand_neg();
                 b.neg=rand_neg();
                 if (bp == NULL)
@@ -478,7 +535,7 @@ int test_mul(BIO *bp)
                 BN_sub(&d,&d,&b);
                 if(!BN_is_zero(&d) || !BN_is_zero(&e))
                     {
-                    BIO_puts(bp,"Multiplication test failed!\n");
+                    fprintf(stderr,"Multiplication test failed!\n");
                     return 0;
                     }
                 }
@@ -502,7 +559,7 @@ int test_sqr(BIO *bp, BN_CTX *ctx)
         BN_init(&d);
         BN_init(&e);
 
-        for (i=0; i<40; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rand(&a,40+i*10,0,0);
                 a.neg=rand_neg();
@@ -526,7 +583,7 @@ int test_sqr(BIO *bp, BN_CTX *ctx)
                 BN_sub(&d,&d,&a);
                 if(!BN_is_zero(&d) || !BN_is_zero(&e))
                     {
-                    BIO_puts(bp,"Square test failed!\n");
+                    fprintf(stderr,"Square test failed!\n");
                     return 0;
                     }
                 }
@@ -557,9 +614,13 @@ int test_mont(BIO *bp, BN_CTX *ctx)
 
         BN_rand(&a,100,0,0); /**/
         BN_rand(&b,100,0,0); /**/
-        for (i=0; i<10; i++)
+        for (i=0; i<num2; i++)
                 {
-                BN_rand(&n,(100%BN_BITS2+1)*BN_BITS2*i*BN_BITS2,0,1); /**/
+                int bits = (200*(i+1))/num2;
+
+                if (bits == 0)
+                        continue;
+                BN_rand(&n,bits,0,1);
                 BN_MONT_CTX_set(mont,&n,ctx);
 
                 BN_to_montgomery(&A,&a,mont,ctx);
@@ -594,7 +655,7 @@ BN_num_bits(mont->N));
                 BN_sub(&d,&d,&A);
                 if(!BN_is_zero(&d))
                     {
-                    BIO_puts(bp,"Montgomery multiplication test failed!\n");
+                    fprintf(stderr,"Montgomery multiplication test failed!\n");
                     return 0;
                     }
                 }
@@ -622,7 +683,7 @@ int test_mod(BIO *bp, BN_CTX *ctx)
         e=BN_new();
 
         BN_rand(a,1024,0,0); /**/
-        for (i=0; i<20; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rand(b,450+i*10,0,0); /**/
                 a->neg=rand_neg();
@@ -647,7 +708,7 @@ int test_mod(BIO *bp, BN_CTX *ctx)
                 BN_sub(e,e,c);
                 if(!BN_is_zero(e))
                     {
-                    BIO_puts(bp,"Modulo test failed!\n");
+                    fprintf(stderr,"Modulo test failed!\n");
                     return 0;
                     }
                 }
@@ -671,10 +732,10 @@ int test_mod_mul(BIO *bp, BN_CTX *ctx)
         e=BN_new();
 
         BN_rand(c,1024,0,0); /**/
-        for (i=0; i<10; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rand(a,475+i*10,0,0); /**/
-                BN_rand(b,425+i*10,0,0); /**/
+                BN_rand(b,425+i*11,0,0); /**/
                 a->neg=rand_neg();
                 b->neg=rand_neg();
         /*      if (bp == NULL)
@@ -709,7 +770,7 @@ int test_mod_mul(BIO *bp, BN_CTX *ctx)
                 BN_div(a,b,d,c,ctx);
                 if(!BN_is_zero(b))
                     {
-                    BIO_puts(bp,"Modulo multiply test failed!\n");
+                    fprintf(stderr,"Modulo multiply test failed!\n");
                     return 0;
                     }
                 }
@@ -733,7 +794,7 @@ int test_mod_exp(BIO *bp, BN_CTX *ctx)
         e=BN_new();
 
         BN_rand(c,30,0,1); /* must be odd for montgomery */
-        for (i=0; i<6; i++)
+        for (i=0; i<num2; i++)
                 {
                 BN_rand(a,20+i*5,0,0); /**/
                 BN_rand(b,2+i,0,0); /**/
@@ -760,7 +821,7 @@ int test_mod_exp(BIO *bp, BN_CTX *ctx)
                 BN_div(a,b,e,c,ctx);
                 if(!BN_is_zero(b))
                     {
-                    BIO_puts(bp,"Modulo exponentiation test failed!\n");
+                    fprintf(stderr,"Modulo exponentiation test failed!\n");
                     return 0;
                     }
                 }
@@ -784,7 +845,7 @@ int test_exp(BIO *bp, BN_CTX *ctx)
         one=BN_new();
         BN_one(one);
 
-        for (i=0; i<6; i++)
+        for (i=0; i<num2; i++)
                 {
                 BN_rand(a,20+i*5,0,0); /**/
                 BN_rand(b,2+i,0,0); /**/
@@ -810,7 +871,7 @@ int test_exp(BIO *bp, BN_CTX *ctx)
                 BN_sub(e,e,d);
                 if(!BN_is_zero(e))
                     {
-                    BIO_puts(bp,"Exponentiation test failed!\n");
+                    fprintf(stderr,"Exponentiation test failed!\n");
                     return 0;
                     }
                 }
@@ -840,7 +901,7 @@ int test_lshift(BIO *bp,BN_CTX *ctx,BIGNUM *a_)
             BN_rand(a,200,0,0); /**/
             a->neg=rand_neg();
             }
-        for (i=0; i<70; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_lshift(b,a,i+1);
                 BN_add(c,c,c);
@@ -860,16 +921,16 @@ int test_lshift(BIO *bp,BN_CTX *ctx,BIGNUM *a_)
                 BN_sub(d,d,b);
                 if(!BN_is_zero(d))
                     {
-                    BIO_puts(bp,"Left shift test failed!\n");
-                    BIO_puts(bp,"a=");
-                    BN_print(bp,a);
-                    BIO_puts(bp,"\nb=");
-                    BN_print(bp,b);
-                    BIO_puts(bp,"\nc=");
-                    BN_print(bp,c);
-                    BIO_puts(bp,"\nd=");
-                    BN_print(bp,d);
-                    BIO_puts(bp,"\n");
+                    fprintf(stderr,"Left shift test failed!\n");
+                    fprintf(stderr,"a=");
+                    BN_print_fp(stderr,a);
+                    fprintf(stderr,"\nb=");
+                    BN_print_fp(stderr,b);
+                    fprintf(stderr,"\nc=");
+                    BN_print_fp(stderr,c);
+                    fprintf(stderr,"\nd=");
+                    BN_print_fp(stderr,d);
+                    fprintf(stderr,"\n");
                     return 0;
                     }
                 }
@@ -891,7 +952,7 @@ int test_lshift1(BIO *bp)
 
         BN_rand(a,200,0,0); /**/
         a->neg=rand_neg();
-        for (i=0; i<70; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_lshift1(b,a);
                 if (bp != NULL)
@@ -909,7 +970,7 @@ int test_lshift1(BIO *bp)
                 BN_sub(a,b,c);
                 if(!BN_is_zero(a))
                     {
-                    BIO_puts(bp,"Left shift one test failed!\n");
+                    fprintf(stderr,"Left shift one test failed!\n");
                     return 0;
                     }
                 
@@ -935,7 +996,7 @@ int test_rshift(BIO *bp,BN_CTX *ctx)
 
         BN_rand(a,200,0,0); /**/
         a->neg=rand_neg();
-        for (i=0; i<70; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rshift(b,a,i+1);
                 BN_add(c,c,c);
@@ -955,7 +1016,7 @@ int test_rshift(BIO *bp,BN_CTX *ctx)
                 BN_sub(d,d,b);
                 if(!BN_is_zero(d))
                     {
-                    BIO_puts(bp,"Right shift test failed!\n");
+                    fprintf(stderr,"Right shift test failed!\n");
                     return 0;
                     }
                 }
@@ -978,7 +1039,7 @@ int test_rshift1(BIO *bp)
 
         BN_rand(a,200,0,0); /**/
         a->neg=rand_neg();
-        for (i=0; i<70; i++)
+        for (i=0; i<num0; i++)
                 {
                 BN_rshift1(b,a);
                 if (bp != NULL)
@@ -996,7 +1057,7 @@ int test_rshift1(BIO *bp)
                 BN_sub(c,c,b);
                 if(!BN_is_zero(c) && !BN_is_one(c))
                     {
-                    BIO_puts(bp,"Right shift one test failed!\n");
+                    fprintf(stderr,"Right shift one test failed!\n");
                     return 0;
                     }
                 BN_copy(a,b);
diff --git a/src/lib/libssl/src/crypto/bn/comba.pl b/src/lib/libssl/src/crypto/bn/comba.pl
index 211a8b45c7..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/comba.pl
+++ b/src/lib/libssl/src/crypto/bn/comba.pl
@@ -1,285 +0,0 @@
-#!/usr/local/bin/perl
-
-$num=8;
-$num2=8/2;
-
-print <<"EOF";
-/* crypto/bn/bn_comba.c */
-#include <stdio.h>
-#include "bn_lcl.h"
-/* Auto generated from crypto/bn/comba.pl
- */
-
-#undef bn_mul_comba8
-#undef bn_mul_comba4
-#undef bn_sqr_comba8
-#undef bn_sqr_comba4
-
-#ifdef BN_LLONG
-#define mul_add_c(a,b,c0,c1,c2) \\
-        t=(BN_ULLONG)a*b; \\
-        t1=(BN_ULONG)Lw(t); \\
-        t2=(BN_ULONG)Hw(t); \\
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define mul_add_c2(a,b,c0,c1,c2) \\
-        t=(BN_ULLONG)a*b; \\
-        tt=(t+t)&BN_MASK; \\
-        if (tt < t) c2++; \\
-        t1=(BN_ULONG)Lw(tt); \\
-        t2=(BN_ULONG)Hw(tt); \\
-        c0=(c0+t1)&BN_MASK2;  \\
-        if ((c0 < t1) && (((++t2)&BN_MASK2) == 0)) c2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c(a,i,c0,c1,c2) \\
-        t=(BN_ULLONG)a[i]*a[i]; \\
-        t1=(BN_ULONG)Lw(t); \\
-        t2=(BN_ULONG)Hw(t); \\
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c2(a,i,j,c0,c1,c2) \\
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#else
-#define mul_add_c(a,b,c0,c1,c2) \\
-        t1=LBITS(a); t2=HBITS(a); \\
-        bl=LBITS(b); bh=HBITS(b); \\
-        mul64(t1,t2,bl,bh); \\
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define mul_add_c2(a,b,c0,c1,c2) \\
-        t1=LBITS(a); t2=HBITS(a); \\
-        bl=LBITS(b); bh=HBITS(b); \\
-        mul64(t1,t2,bl,bh); \\
-        if (t2 & BN_TBIT) c2++; \\
-        t2=(t2+t2)&BN_MASK2; \\
-        if (t1 & BN_TBIT) t2++; \\
-        t1=(t1+t1)&BN_MASK2; \\
-        c0=(c0+t1)&BN_MASK2;  \\
-        if ((c0 < t1) && (((++t2)&BN_MASK2) == 0)) c2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c(a,i,c0,c1,c2) \\
-        sqr64(t1,t2,(a)[i]); \\
-        c0=(c0+t1)&BN_MASK2; if ((c0) < t1) t2++; \\
-        c1=(c1+t2)&BN_MASK2; if ((c1) < t2) c2++;
-
-#define sqr_add_c2(a,i,j,c0,c1,c2) \\
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-#endif
-
-void bn_mul_comba${num}(r,a,b)
-BN_ULONG *r,*a,*b;
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-EOF
-$ret=&combas_mul("r","a","b",$num,"c1","c2","c3");
-printf <<"EOF";
-        }
-
-void bn_mul_comba${num2}(r,a,b)
-BN_ULONG *r,*a,*b;
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-EOF
-$ret=&combas_mul("r","a","b",$num2,"c1","c2","c3");
-printf <<"EOF";
-        }
-
-void bn_sqr_comba${num}(r,a)
-BN_ULONG *r,*a;
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t,tt;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-EOF
-$ret=&combas_sqr("r","a",$num,"c1","c2","c3");
-printf <<"EOF";
-        }
-
-void bn_sqr_comba${num2}(r,a)
-BN_ULONG *r,*a;
-        {
-#ifdef BN_LLONG
-        BN_ULLONG t,tt;
-#else
-        BN_ULONG bl,bh;
-#endif
-        BN_ULONG t1,t2;
-        BN_ULONG c1,c2,c3;
-
-EOF
-$ret=&combas_sqr("r","a",$num2,"c1","c2","c3");
-printf <<"EOF";
-        }
-EOF
-
-sub bn_str
-        {
-        local($var,$val)=@_;
-        print "\t$var=$val;\n";
-        }
-
-sub bn_ary
-        {
-        local($var,$idx)=@_;
-        return("${var}[$idx]");
-        }
-
-sub bn_clr
-        {
-        local($var)=@_;
-
-        print "\t$var=0;\n";
-        }
-
-sub bn_mad
-        {
-        local($a,$b,$c0,$c1,$c2,$num)=@_;
-
-        if ($num == 2)
-                { printf("\tmul_add_c2($a,$b,$c0,$c1,$c2);\n"); }
-        else
-                { printf("\tmul_add_c($a,$b,$c0,$c1,$c2);\n"); }
-        }
-
-sub bn_sad
-        {
-        local($a,$i,$j,$c0,$c1,$c2,$num)=@_;
-
-        if ($num == 2)
-                { printf("\tsqr_add_c2($a,$i,$j,$c0,$c1,$c2);\n"); }
-        else
-                { printf("\tsqr_add_c($a,$i,$c0,$c1,$c2);\n"); }
-        }
-
-sub combas_mul
-        {
-        local($r,$a,$b,$num,$c0,$c1,$c2)=@_;
-        local($i,$as,$ae,$bs,$be,$ai,$bi);
-        local($tot,$end);
-
-        $as=0;
-        $ae=0;
-        $bs=0;
-        $be=0;
-        $tot=$num+$num-1;
-        &bn_clr($c0);
-        &bn_clr($c1);
-        for ($i=0; $i<$tot; $i++)
-                {
-                $ai=$as;
-                $bi=$bs;
-                $end=$be+1;
-                @numa=@numb=();
-
-#print "($as $ae) ($bs $be) $bs -> $end [$i $num]\n";
-                for ($j=$bs; $j<$end; $j++)
-                        {
-                        push(@numa,$ai);
-                        push(@numb,$bi);
-                        $ai--;
-                        $bi++;
-                        }
-
-                if ($i & 1)
-                        {
-                        @numa=reverse(@numa);
-                        @numb=reverse(@numb);
-                        }
-
-                &bn_clr($c2);
-                for ($j=0; $j<=$#numa; $j++)
-                        {
-                        &bn_mad(&bn_ary($a,$numa[$j]),
-                                &bn_ary($b,$numb[$j]),$c0,$c1,$c2,1);
-                        }
-                &bn_str(&bn_ary($r,$i),$c0);
-                ($c0,$c1,$c2)=($c1,$c2,$c0);
-
-                $as++ if ($i < ($num-1));
-                $ae++ if ($i >= ($num-1));
-
-                $bs++ if ($i >= ($num-1));
-                $be++ if ($i < ($num-1));
-                }
-        &bn_str(&bn_ary($r,$i),$c0);
-        }
-
-sub combas_sqr
-        {
-        local($r,$a,$num,$c0,$c1,$c2)=@_;
-        local($i,$as,$ae,$bs,$be,$ai,$bi);
-        local($b,$tot,$end,$half);
-
-        $b=$a;
-        $as=0;
-        $ae=0;
-        $bs=0;
-        $be=0;
-        $tot=$num+$num-1;
-        &bn_clr($c0);
-        &bn_clr($c1);
-        for ($i=0; $i<$tot; $i++)
-                {
-                $ai=$as;
-                $bi=$bs;
-                $end=$be+1;
-                @numa=@numb=();
-
-#print "($as $ae) ($bs $be) $bs -> $end [$i $num]\n";
-                for ($j=$bs; $j<$end; $j++)
-                        {
-                        push(@numa,$ai);
-                        push(@numb,$bi);
-                        $ai--;
-                        $bi++;
-                        last if ($ai < $bi);
-                        }
-                if (!($i & 1))
-                        {
-                        @numa=reverse(@numa);
-                        @numb=reverse(@numb);
-                        }
-
-                &bn_clr($c2);
-                for ($j=0; $j <= $#numa; $j++)
-                        {
-                        if ($numa[$j] == $numb[$j])
-                                {&bn_sad($a,$numa[$j],$numb[$j],$c0,$c1,$c2,1);}
-                        else
-                                {&bn_sad($a,$numa[$j],$numb[$j],$c0,$c1,$c2,2);}
-                        }
-                &bn_str(&bn_ary($r,$i),$c0);
-                ($c0,$c1,$c2)=($c1,$c2,$c0);
-
-                $as++ if ($i < ($num-1));
-                $ae++ if ($i >= ($num-1));
-
-                $bs++ if ($i >= ($num-1));
-                $be++ if ($i < ($num-1));
-                }
-        &bn_str(&bn_ary($r,$i),$c0);
-        }
diff --git a/src/lib/libssl/src/crypto/bn/d.c b/src/lib/libssl/src/crypto/bn/d.c
index ced2291b25..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/d.c
+++ b/src/lib/libssl/src/crypto/bn/d.c
@@ -1,72 +0,0 @@
-#include <stdio.h>
-#include <openssl/bio.h>
-#include "bn_lcl.h"
-
-#define SIZE_A (100*4+4)
-#define SIZE_B (13*4)
-
-main(argc,argv)
-int argc;
-char *argv[];
-        {
-        BN_CTX ctx;
-        BN_RECP_CTX recp;
-        BIGNUM a,b,dd,d,r,rr,t,l;
-        int i;
-
-        MemCheck_start();
-        MemCheck_on();
-        BN_CTX_init(&ctx);
-        BN_RECP_CTX_init(&recp);
-
-        BN_init(&r);
-        BN_init(&rr);
-        BN_init(&d);
-        BN_init(&dd);
-        BN_init(&a);
-        BN_init(&b);
-
-        {
-        BN_rand(&a,SIZE_A,0,0);
-        BN_rand(&b,SIZE_B,0,0);
-
-        a.neg=1;
-        BN_RECP_CTX_set(&recp,&b,&ctx);
-
-        BN_print_fp(stdout,&a); printf(" a\n");
-        BN_print_fp(stdout,&b); printf(" b\n");
-
-        BN_print_fp(stdout,&recp.N); printf(" N\n");
-        BN_print_fp(stdout,&recp.Nr); printf(" Nr num_bits=%d\n",recp.num_bits);
-
-        BN_div_recp(&r,&d,&a,&recp,&ctx);
-
-for (i=0; i<300; i++)
-        BN_div(&rr,&dd,&a,&b,&ctx);
-
-        BN_print_fp(stdout,&r); printf(" div recp\n");
-        BN_print_fp(stdout,&rr); printf(" div\n");
-        BN_print_fp(stdout,&d); printf(" rem recp\n");
-        BN_print_fp(stdout,&dd); printf(" rem\n");
-        }
-        BN_CTX_free(&ctx);
-        BN_RECP_CTX_free(&recp);
-
-        BN_free(&r);
-        BN_free(&rr);
-        BN_free(&d);
-        BN_free(&dd);
-        BN_free(&a);
-        BN_free(&b);
-
-        {
-        BIO *out;
-
-        if ((out=BIO_new(BIO_s_file())) != NULL)
-                BIO_set_fp(out,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
-
-        CRYPTO_mem_leaks(out);
-        BIO_free(out);
-        }
-
-        }
diff --git a/src/lib/libssl/src/crypto/bn/divtest.c b/src/lib/libssl/src/crypto/bn/divtest.c
new file mode 100644
index 0000000000..13ba86e3c4
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bn/divtest.c
@@ -0,0 +1,41 @@
+#include <openssl/bn.h>
+#include <openssl/rand.h>
+
+static int rand(n)
+{
+    unsigned char x[2];
+    RAND_pseudo_bytes(x,2);
+    return (x[0] + 2*x[1]);
+}
+
+static void bug(char *m, BIGNUM *a, BIGNUM *b)
+{
+    printf("%s!\na=",m);
+    BN_print_fp(stdout, a);
+    printf("\nb=");
+    BN_print_fp(stdout, b);
+    printf("\n");
+    fflush(stdout);
+}
+
+main()
+{
+    BIGNUM *a=BN_new(), *b=BN_new(), *c=BN_new(), *d=BN_new(),
+        *C=BN_new(), *D=BN_new();
+    BN_RECP_CTX *recp=BN_RECP_CTX_new();
+    BN_CTX *ctx=BN_CTX_new();
+
+    for(;;) {
+        BN_pseudo_rand(a,rand(),0,0);
+        BN_pseudo_rand(b,rand(),0,0);
+        if (BN_is_zero(b)) continue;
+
+        BN_RECP_CTX_set(recp,b,ctx);
+        if (BN_div(C,D,a,b,ctx) != 1)
+            bug("BN_div failed",a,b);
+        if (BN_div_recp(c,d,a,recp,ctx) != 1)
+            bug("BN_div_recp failed",a,b);
+        else if (BN_cmp(c,C) != 0 || BN_cmp(c,C) != 0)
+            bug("mismatch",a,b);
+    }
+}
diff --git a/src/lib/libssl/src/crypto/bn/exp.c b/src/lib/libssl/src/crypto/bn/exp.c
index ec443459d8..4865b0ef74 100644
--- a/src/lib/libssl/src/crypto/bn/exp.c
+++ b/src/lib/libssl/src/crypto/bn/exp.c
@@ -1,3 +1,5 @@
+/* unused */
+
 #include <stdio.h>
 #include <openssl/tmdiff.h>
 #include "bn_lcl.h"
diff --git a/src/lib/libssl/src/crypto/bn/expspeed.c b/src/lib/libssl/src/crypto/bn/expspeed.c
index 3656d5bb4c..2044ab9bff 100644
--- a/src/lib/libssl/src/crypto/bn/expspeed.c
+++ b/src/lib/libssl/src/crypto/bn/expspeed.c
@@ -1,3 +1,5 @@
+/* unused */
+
 /* crypto/bn/expspeed.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
diff --git a/src/lib/libssl/src/crypto/bn/exptest.c b/src/lib/libssl/src/crypto/bn/exptest.c
index 9e4ae91d20..3e86f2ea0e 100644
--- a/src/lib/libssl/src/crypto/bn/exptest.c
+++ b/src/lib/libssl/src/crypto/bn/exptest.c
@@ -69,6 +69,8 @@
 
 #define NUM_BITS        (BN_BITS*2)
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
 int main(int argc, char *argv[])
         {
         BN_CTX *ctx;
@@ -77,6 +79,10 @@ int main(int argc, char *argv[])
         unsigned char c;
         BIGNUM *r_mont,*r_recp,*r_simple,*a,*b,*m;
 
+        RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_rand may fail, and we don't
+                                               * even check its return value
+                                               * (which we should) */
+
         ERR_load_BN_strings();
 
         ctx=BN_CTX_new();
@@ -160,7 +166,16 @@ int main(int argc, char *argv[])
                         exit(1);
                         }
                 }
+        BN_free(r_mont);
+        BN_free(r_recp);
+        BN_free(r_simple);
+        BN_free(a);
+        BN_free(b);
+        BN_free(m);
+        BN_CTX_free(ctx);
+        ERR_remove_state(0);
         CRYPTO_mem_leaks(out);
+        BIO_free(out);
         printf(" done\n");
         exit(0);
 err:
diff --git a/src/lib/libssl/src/crypto/bn/new b/src/lib/libssl/src/crypto/bn/new
index 285d506f19..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/new
+++ b/src/lib/libssl/src/crypto/bn/new
@@ -1,23 +0,0 @@
-void BN_RECP_CTX_init(BN_RECP_CTX *recp);
-BN_RECP_CTX *BN_RECP_CTX_new();
-void BN_RECP_CTX_free(BN_RECP_CTX *recp);
-int BN_RECP_CTX_set(BN_RECP_CTX *recp,BIGNUM *div,BN_CTX *ctx);
-
-int BN_mod_exp_recp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,
-        BN_RECP_CTX *recp,BN_CTX *ctx);
-
-int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d,
-        BN_RECP_CTX *recp, BN_CTX *ctx);
-int BN_mod_recp(BIGNUM *rem, BIGNUM *m, BIGNUM *d,
-        BN_RECP_CTX *recp, BN_CTX *ctx);
-int BN_mod_mul_recp(BIGNUM *ret,BIGNUM *a,BIGNUM *b,BIGNUM *m
-
-int BN_mod_exp_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *p,
-        BN_MONT_CTX *m_ctx,BN_CTX *ctx);
-int BN_mod_exp2_montgomery(BIGNUM *r, BIGNUM *a1, BIGNUM *p1,BIGNUM *a2,
-                BIGNUM *p2,BN_MONT_CTX *m_ctx,BN_CTX *ctx);
-
-
-bn_div64 -> bn_div_words
-
-
diff --git a/src/lib/libssl/src/crypto/bn/old/b_sqr.c b/src/lib/libssl/src/crypto/bn/old/b_sqr.c
index 715cb1c8ab..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/b_sqr.c
+++ b/src/lib/libssl/src/crypto/bn/old/b_sqr.c
@@ -1,199 +0,0 @@
-/* crypto/bn/bn_mul.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-static int bn_mm(BIGNUM *m,BIGNUM *A,BIGNUM *B, BIGNUM *sk,BN_CTX *ctx);
-
-/* r must be different to a and b */
-/* int BN_mmul(r, a, b) */
-int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b)
-        {
-        BN_ULONG *ap,*bp,*rp;
-        BIGNUM *sk;
-        int i,n,ret;
-        int max,al,bl;
-        BN_CTX ctx;
-
-        bn_check_top(a);
-        bn_check_top(b);
-
-        al=a->top;
-        bl=b->top;
-        if ((al == 0) || (bl == 0))
-                {
-                r->top=0;
-                return(1);
-                }
-#ifdef BN_MUL_DEBUG
-printf("BN_mul(%d,%d)\n",a->top,b->top);
-#endif
-
-        if (    (bn_limit_bits > 0) &&
-                (bl > bn_limit_num) && (al > bn_limit_num))
-                {
-                n=(BN_num_bits_word(al|bl)-bn_limit_bits);
-                n*=2;
-                sk=(BIGNUM *)Malloc(sizeof(BIGNUM)*n);
-                memset(sk,0,sizeof(BIGNUM)*n);
-                memset(&ctx,0,sizeof(ctx));
-
-                ret=bn_mm(r,a,b,&(sk[0]),&ctx);
-                for (i=0; i<n; i+=2)
-                        {
-                        BN_clear_free(&sk[i]);
-                        BN_clear_free(&sk[i+1]);
-                        }
-                Free(sk);
-                return(ret);
-                }
-
-        max=(al+bl);
-        if (bn_wexpand(r,max) == NULL) return(0);
-        r->top=max;
-        r->neg=a->neg^b->neg;
-        ap=a->d;
-        bp=b->d;
-        rp=r->d;
-
-        rp[al]=bn_mul_words(rp,ap,al,*(bp++));
-        rp++;
-        for (i=1; i<bl; i++)
-                {
-                rp[al]=bn_mul_add_words(rp,ap,al,*(bp++));
-                rp++;
-                }
-        if ((max > 0) && (r->d[max-1] == 0)) r->top--;
-        return(1);
-        }
-
-
-#define ahal    (sk[0])
-#define blbh    (sk[1])
-
-/* r must be different to a and b */
-int bn_mm(BIGNUM *m, BIGNUM *A, BIGNUM *B, BIGNUM *sk, BN_CTX *ctx)
-        {
-        int n,num,sqr=0;
-        int an,bn;
-        BIGNUM ah,al,bh,bl;
-
-        an=A->top;
-        bn=B->top;
-#ifdef BN_MUL_DEBUG
-printf("bn_mm(%d,%d)\n",A->top,B->top);
-#endif
-
-        if (A == B) sqr=1;
-        num=(an>bn)?an:bn;
-        n=(num+1)/2;
-        /* Are going to now chop things into 'num' word chunks. */
-
-        BN_init(&ah);
-        BN_init(&al);
-        BN_init(&bh);
-        BN_init(&bl);
-
-        bn_set_low (&al,A,n);
-        bn_set_high(&ah,A,n);
-        bn_set_low (&bl,B,n);
-        bn_set_high(&bh,B,n);
-
-        BN_sub(&ahal,&ah,&al);
-        BN_sub(&blbh,&bl,&bh);
-
-        if (num <= (bn_limit_num+bn_limit_num))
-                {
-                BN_mul(m,&ahal,&blbh);
-                if (sqr)
-                        {
-                        BN_sqr(&ahal,&al,ctx);
-                        BN_sqr(&blbh,&ah,ctx);
-                        }
-                else
-                        {
-                        BN_mul(&ahal,&al,&bl);
-                        BN_mul(&blbh,&ah,&bh);
-                        }
-                }
-        else
-                {
-                bn_mm(m,&ahal,&blbh,&(sk[2]),ctx);
-                bn_mm(&ahal,&al,&bl,&(sk[2]),ctx);
-                bn_mm(&blbh,&ah,&bh,&(sk[2]),ctx);
-                }
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        BN_lshift(m,m,n*BN_BITS2);
-        BN_lshift(&blbh,&blbh,n*BN_BITS2*2);
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        m->neg=A->neg^B->neg;
-        return(1);
-        }
-#undef ahal     (sk[0])
-#undef blbh     (sk[1])
-
-#include "bn_low.c"
-#include "bn_high.c"
diff --git a/src/lib/libssl/src/crypto/bn/old/bn_com.c b/src/lib/libssl/src/crypto/bn/old/bn_com.c
index 7666b2304c..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/bn_com.c
+++ b/src/lib/libssl/src/crypto/bn/old/bn_com.c
@@ -1,90 +0,0 @@
-/* crypto/bn/bn_mulw.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-#ifdef BN_LLONG 
-
-ab
-12
-   a2 b2
-a1 b1
-
-abc
-123
-      a3 b3 c3
-   a2 b2 c2
-a1 b1 c1
-
-abcd
-1234
-         a4 b4 c4 d4
-      a3 b3 c3 d3
-   a2 b2 c2 d2
-a1 b1 c1 d1
-
-abcde
-01234
-               a5 b5 c5 d5 e5
-            a4 b4 c4 d4 e4
-         a3 b3 c3 d3 e3
-      a2 b2 c2 d2 e2
-   a1 b1 c1 d1 e1
-a0 b0 c0 d0 e0
diff --git a/src/lib/libssl/src/crypto/bn/old/bn_high.c b/src/lib/libssl/src/crypto/bn/old/bn_high.c
index 763bcb605b..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/bn_high.c
+++ b/src/lib/libssl/src/crypto/bn/old/bn_high.c
@@ -1,135 +0,0 @@
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-#undef BN_MUL_HIGH_DEBUG
-
-#ifdef BN_MUL_HIGH_DEBUG
-#define debug_BN_print(a,b,c) BN_print_fp(a,b); printf(c);
-#else
-#define debug_BN_print(a,b,c)
-#endif
-
-int BN_mul_high(BIGNUM *r,BIGNUM *a,BIGNUM *b,BIGNUM *low, int words);
-
-#undef t1
-#undef t2
-
-int BN_mul_high(BIGNUM *r, BIGNUM *a, BIGNUM *b, BIGNUM *low, int words)
-        {
-        int w2,borrow=0,full=0;
-        BIGNUM t1,t2,t3,h,ah,al,bh,bl,m,s0,s1;
-        BN_ULONG ul1,ul2;
-        
-        BN_mul(r,a,b);
-        BN_rshift(r,r,words*BN_BITS2);
-        return(1);
-
-        w2=(words+1)/2;
-
-#ifdef BN_MUL_HIGH_DEBUG
-fprintf(stdout,"words=%d w2=%d\n",words,w2);
-#endif
-debug_BN_print(stdout,a," a\n");
-debug_BN_print(stdout,b," b\n");
-debug_BN_print(stdout,low," low\n");
-        BN_init(&al); BN_init(&ah);
-        BN_init(&bl); BN_init(&bh);
-        BN_init(&t1); BN_init(&t2); BN_init(&t3);
-        BN_init(&s0); BN_init(&s1);
-        BN_init(&h); BN_init(&m);
-
-        bn_set_low (&al,a,w2);
-        bn_set_high(&ah,a,w2);
-        bn_set_low (&bl,b,w2);
-        bn_set_high(&bh,b,w2);
-
-        bn_set_low(&s0,low,w2);
-        bn_set_high(&s1,low,w2);
-
-debug_BN_print(stdout,&al," al\n");
-debug_BN_print(stdout,&ah," ah\n");
-debug_BN_print(stdout,&bl," bl\n");
-debug_BN_print(stdout,&bh," bh\n");
-debug_BN_print(stdout,&s0," s0\n");
-debug_BN_print(stdout,&s1," s1\n");
-
-        /* Calculate (al-ah)*(bh-bl) */
-        BN_sub(&t1,&al,&ah);
-        BN_sub(&t2,&bh,&bl);
-        BN_mul(&m,&t1,&t2);
-
-        /* Calculate ah*bh */
-        BN_mul(&h,&ah,&bh);
-
-        /* s0 == low(al*bl)
-         * s1 == low(ah*bh)+low((al-ah)*(bh-bl))+low(al*bl)+high(al*bl)
-         * We know s0 and s1 so the only unknown is high(al*bl)
-         * high(al*bl) == s1 - low(ah*bh+(al-ah)*(bh-bl)+s0)
-         */
-        BN_add(&m,&m,&h);
-        BN_add(&t2,&m,&s0);
-
-debug_BN_print(stdout,&t2," middle value\n");
-
-        /* Quick and dirty mask off of high words */
-        if (w2 < t2.top) t2.top=w2;
-#if 0
-        bn_set_low(&t3,&t2,w2);
-#endif
-
-debug_BN_print(stdout,&t2," low middle value\n");
-        BN_sub(&t1,&s1,&t2);
-
-        if (t1.neg)
-                {
-debug_BN_print(stdout,&t1," before\n");
-                BN_zero(&t2);
-                BN_set_bit(&t2,w2*BN_BITS2);
-                BN_add(&t1,&t2,&t1);
-                /* BN_mask_bits(&t1,w2*BN_BITS2); */
-                /* if (words < t1.top) t1.top=words; */
-debug_BN_print(stdout,&t1," after\n");
-                borrow=1;
-                }
-
-/* XXXXX SPEED THIS UP */
-        /* al*bl == high(al*bl)<<words+s0 */
-        BN_lshift(&t1,&t1,w2*BN_BITS2);
-        BN_add(&t1,&t1,&s0);
-        if (w2*2 < t1.top) t1.top=w2*2; /* This should not happen? */
-        
-        /* We now have
-         * al*bl                        - t1
-         * (al-ah)*(bh-bl)+ah*bh        - m
-         * ah*bh                        - h
-         */
-#if 0
-        BN_add(&m,&m,&t1);
-debug_BN_print(stdout,&t1," s10\n");
-debug_BN_print(stdout,&m," s21\n");
-debug_BN_print(stdout,&h," s32\n");
-        BN_lshift(&m,&m,w2*BN_BITS2);
-        BN_lshift(&h,&h,w2*2*BN_BITS2);
-        BN_add(r,&m,&t1);
-        BN_add(r,r,&h);
-        BN_rshift(r,r,w2*2*BN_BITS2);
-#else
-        BN_add(&m,&m,&t1);              /* Do a cmp then +1 if needed? */
-        bn_set_high(&t3,&t1,w2);
-        BN_add(&m,&m,&t3);
-        bn_set_high(&t3,&m,w2);
-        BN_add(r,&h,&t3);
-#endif
-
-#ifdef BN_MUL_HIGH_DEBUG
-printf("carry=%d\n",borrow);
-#endif
-debug_BN_print(stdout,r," ret\n");
-        BN_free(&t1); BN_free(&t2);
-        BN_free(&m); BN_free(&h);
-        return(1);
-        }
-
-
-
diff --git a/src/lib/libssl/src/crypto/bn/old/bn_ka.c b/src/lib/libssl/src/crypto/bn/old/bn_ka.c
index 378c94dc5a..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/bn_ka.c
+++ b/src/lib/libssl/src/crypto/bn/old/bn_ka.c
@@ -1,567 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <strings.h>
-#include "bn_lcl.h"
-
-/* r is 2*n2 words in size,
- * a and b are both n2 words in size.
- * n2 must be a power of 2.
- * We multiply and return the result.
- * t must be 2*n2 words in size
- * We calulate
- * a[0]*b[0]
- * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
- * a[1]*b[1]
- */
-void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
-             BN_ULONG *t)
-        {
-        int n=n2/2;
-        int neg,zero,c1,c2;
-        BN_ULONG ln,lo,*p;
-
-#ifdef BN_COUNT
-printf(" bn_mul_recursive %d * %d\n",n2,n2);
-#endif
-        if (n2 <= 8)
-                {
-                if (n2 == 8)
-                        bn_mul_comba8(r,a,b);
-                else
-                        bn_mul_normal(r,a,n2,b,n2);
-                return;
-                }
-
-        if (n2 < BN_MUL_RECURSIVE_SIZE_NORMAL)
-                {
-                /* This should not happen */
-                /*abort(); */
-                bn_mul_normal(r,a,n2,b,n2);
-                return;
-                }
-        /* r=(a[0]-a[1])*(b[1]-b[0]) */
-        c1=bn_cmp_words(a,&(a[n]),n);
-        c2=bn_cmp_words(&(b[n]),b,n);
-        zero=neg=0;
-        switch (c1*3+c2)
-                {
-        case -4:
-                bn_sub_words(t,      &(a[n]),a,      n); /* - */
-                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
-                break;
-        case -3:
-                zero=1;
-                break;
-        case -2:
-                bn_sub_words(t,      &(a[n]),a,      n); /* - */
-                bn_sub_words(&(t[n]),&(b[n]),b,      n); /* + */
-                neg=1;
-                break;
-        case -1:
-        case 0:
-        case 1:
-                zero=1;
-                break;
-        case 2:
-                bn_sub_words(t,      a,      &(a[n]),n); /* + */
-                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
-                neg=1;
-                break;
-        case 3:
-                zero=1;
-                break;
-        case 4:
-                bn_sub_words(t,      a,      &(a[n]),n);
-                bn_sub_words(&(t[n]),&(b[n]),b,      n);
-                break;
-                }
-
-        if (n == 8)
-                {
-                if (!zero)
-                        bn_mul_comba8(&(t[n2]),t,&(t[n]));
-                else
-                        memset(&(t[n2]),0,8*sizeof(BN_ULONG));
-                
-                bn_mul_comba8(r,a,b);
-                bn_mul_comba8(&(r[n2]),&(a[n]),&(b[n]));
-                }
-        else
-                {
-                p= &(t[n2*2]);
-                if (!zero)
-                        bn_mul_recursive(&(t[n2]),t,&(t[n]),n,p);
-                else
-                        memset(&(t[n2]),0,n*sizeof(BN_ULONG));
-                bn_mul_recursive(r,a,b,n,p);
-                bn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),n,p);
-                }
-
-        /* t[32] holds (a[0]-a[1])*(b[1]-b[0]), c1 is the sign
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         */
-
-        c1=bn_add_words(t,r,&(r[n2]),n2);
-
-        if (neg) /* if t[32] is negative */
-                {
-                c1-=bn_sub_words(&(t[n2]),t,&(t[n2]),n2);
-                }
-        else
-                {
-                /* Might have a carry */
-                c1+=bn_add_words(&(t[n2]),&(t[n2]),t,n2);
-                }
-
-        /* t[32] holds (a[0]-a[1])*(b[1]-b[0])+(a[0]*b[0])+(a[1]*b[1])
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         * c1 holds the carry bits
-         */
-        c1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);
-        if (c1)
-                {
-                p= &(r[n+n2]);
-                lo= *p;
-                ln=(lo+c1)&BN_MASK2;
-                *p=ln;
-
-                /* The overflow will stop before we over write
-                 * words we should not overwrite */
-                if (ln < c1)
-                        {
-                        do      {
-                                p++;
-                                lo= *p;
-                                ln=(lo+1)&BN_MASK2;
-                                *p=ln;
-                                } while (ln == 0);
-                        }
-                }
-        }
-
-/* n+tn is the word length
- * t needs to be n*4 is size, as does r */
-void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
-             int n, BN_ULONG *t)
-        {
-        int n2=n*2,i,j;
-        int c1;
-        BN_ULONG ln,lo,*p;
-
-#ifdef BN_COUNT
-printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
-#endif
-        if (n < 8)
-                {
-                i=tn+n;
-                bn_mul_normal(r,a,i,b,i);
-                return;
-                }
-
-        /* r=(a[0]-a[1])*(b[1]-b[0]) */
-        bn_sub_words(t,      a,      &(a[n]),n); /* + */
-        bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
-
-        if (n == 8)
-                {
-                bn_mul_comba8(&(t[n2]),t,&(t[n]));
-                bn_mul_comba8(r,a,b);
-                bn_mul_normal(&(r[n2]),&(a[n]),tn,&(b[n]),tn);
-                memset(&(r[n2+tn*2]),0,sizeof(BN_ULONG)*(n2-tn*2));
-                }
-        else
-                {
-                p= &(t[n2*2]);
-                bn_mul_recursive(&(t[n2]),t,&(t[n]),n,p);
-                bn_mul_recursive(r,a,b,n,p);
-                i=n/2;
-                /* If there is only a bottom half to the number,
-                 * just do it */
-                j=tn-i;
-                if (j == 0)
-                        {
-                        bn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),i,p);
-                        memset(&(r[n2+i*2]),0,sizeof(BN_ULONG)*(n2-i*2));
-                        }
-                else if (j > 0) /* eg, n == 16, i == 8 and tn == 11 */
-                                {
-                                bn_mul_part_recursive(&(r[n2]),&(a[n]),&(b[n]),
-                                        j,i,p);
-                                memset(&(r[n2+tn*2]),0,
-                                        sizeof(BN_ULONG)*(n2-tn*2));
-                                }
-                else /* (j < 0) eg, n == 16, i == 8 and tn == 5 */
-                        {
-                        memset(&(r[n2]),0,sizeof(BN_ULONG)*(tn*2));
-                        for (;;)
-                                {
-                                i/=2;
-                                if (i < tn)
-                                        {
-                                        bn_mul_part_recursive(&(r[n2]),
-                                                &(a[n]),&(b[n]),
-                                                tn-i,i,p);
-                                        break;
-                                        }
-                                else if (i == tn)
-                                        {
-                                        bn_mul_recursive(&(r[n2]),
-                                                &(a[n]),&(b[n]),
-                                                i,p);
-                                        break;
-                                        }
-                                }
-                        }
-                }
-
-        /* t[32] holds (a[0]-a[1])*(b[1]-b[0]), c1 is the sign
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         */
-
-        c1=bn_add_words(t,r,&(r[n2]),n2);
-        c1-=bn_sub_words(&(t[n2]),t,&(t[n2]),n2);
-
-        /* t[32] holds (a[0]-a[1])*(b[1]-b[0])+(a[0]*b[0])+(a[1]*b[1])
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         * c1 holds the carry bits
-         */
-        c1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);
-        if (c1)
-                {
-                p= &(r[n+n2]);
-                lo= *p;
-                ln=(lo+c1)&BN_MASK2;
-                *p=ln;
-
-                /* The overflow will stop before we over write
-                 * words we should not overwrite */
-                if (ln < c1)
-                        {
-                        do      {
-                                p++;
-                                lo= *p;
-                                ln=(lo+1)&BN_MASK2;
-                                *p=ln;
-                                } while (ln == 0);
-                        }
-                }
-        }
-
-/* r is 2*n words in size,
- * a and b are both n words in size.
- * n must be a power of 2.
- * We multiply and return the result.
- * t must be 2*n words in size
- * We calulate
- * a[0]*b[0]
- * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
- * a[1]*b[1]
- */
-void bn_sqr_recursive(BN_ULONG *r, BN_ULONG *a, int n2, BN_ULONG *t)
-        {
-        int n=n2/2;
-        int zero,c1;
-        BN_ULONG ln,lo,*p;
-
-#ifdef BN_COUNT
-printf(" bn_sqr_recursive %d * %d\n",n2,n2);
-#endif
-        if (n2 == 4)
-                {
-                bn_sqr_comba4(r,a);
-                return;
-                }
-        else if (n2 == 8)
-                {
-                bn_sqr_comba8(r,a);
-                return;
-                }
-        if (n2 < BN_SQR_RECURSIVE_SIZE_NORMAL)
-                {
-                bn_sqr_normal(r,a,n2,t);
-                return;
-                abort();
-                }
-        /* r=(a[0]-a[1])*(a[1]-a[0]) */
-        c1=bn_cmp_words(a,&(a[n]),n);
-        zero=0;
-        if (c1 > 0)
-                bn_sub_words(t,a,&(a[n]),n);
-        else if (c1 < 0)
-                bn_sub_words(t,&(a[n]),a,n);
-        else
-                zero=1;
-
-        /* The result will always be negative unless it is zero */
-
-        if (n == 8)
-                {
-                if (!zero)
-                        bn_sqr_comba8(&(t[n2]),t);
-                else
-                        memset(&(t[n2]),0,8*sizeof(BN_ULONG));
-                
-                bn_sqr_comba8(r,a);
-                bn_sqr_comba8(&(r[n2]),&(a[n]));
-                }
-        else
-                {
-                p= &(t[n2*2]);
-                if (!zero)
-                        bn_sqr_recursive(&(t[n2]),t,n,p);
-                else
-                        memset(&(t[n2]),0,n*sizeof(BN_ULONG));
-                bn_sqr_recursive(r,a,n,p);
-                bn_sqr_recursive(&(r[n2]),&(a[n]),n,p);
-                }
-
-        /* t[32] holds (a[0]-a[1])*(a[1]-a[0]), it is negative or zero
-         * r[10] holds (a[0]*b[0])
-         * r[32] holds (b[1]*b[1])
-         */
-
-        c1=bn_add_words(t,r,&(r[n2]),n2);
-
-        /* t[32] is negative */
-        c1-=bn_sub_words(&(t[n2]),t,&(t[n2]),n2);
-
-        /* t[32] holds (a[0]-a[1])*(a[1]-a[0])+(a[0]*a[0])+(a[1]*a[1])
-         * r[10] holds (a[0]*a[0])
-         * r[32] holds (a[1]*a[1])
-         * c1 holds the carry bits
-         */
-        c1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);
-        if (c1)
-                {
-                p= &(r[n+n2]);
-                lo= *p;
-                ln=(lo+c1)&BN_MASK2;
-                *p=ln;
-
-                /* The overflow will stop before we over write
-                 * words we should not overwrite */
-                if (ln < c1)
-                        {
-                        do      {
-                                p++;
-                                lo= *p;
-                                ln=(lo+1)&BN_MASK2;
-                                *p=ln;
-                                } while (ln == 0);
-                        }
-                }
-        }
-
-#if 1
-/* a and b must be the same size, which is n2.
- * r needs to be n2 words and t needs to be n2*2
- */
-void bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
-             BN_ULONG *t)
-        {
-        int n=n2/2;
-
-#ifdef BN_COUNT
-printf(" bn_mul_low_recursive %d * %d\n",n2,n2);
-#endif
-
-        bn_mul_recursive(r,a,b,n,&(t[0]));
-        if (n > BN_MUL_LOW_RECURSIVE_SIZE_NORMAL)
-                {
-                bn_mul_low_recursive(&(t[0]),&(a[0]),&(b[n]),n,&(t[n2]));
-                bn_add_words(&(r[n]),&(r[n]),&(t[0]),n);
-                bn_mul_low_recursive(&(t[0]),&(a[n]),&(b[0]),n,&(t[n2]));
-                bn_add_words(&(r[n]),&(r[n]),&(t[0]),n);
-                }
-        else
-                {
-                bn_mul_low_normal(&(t[0]),&(a[0]),&(b[n]),n);
-                bn_mul_low_normal(&(t[n]),&(a[n]),&(b[0]),n);
-                bn_add_words(&(r[n]),&(r[n]),&(t[0]),n);
-                bn_add_words(&(r[n]),&(r[n]),&(t[n]),n);
-                }
-        }
-
-/* a and b must be the same size, which is n2.
- * r needs to be n2 words and t needs to be n2*2
- * l is the low words of the output.
- * t needs to be n2*3
- */
-void bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2,
-             BN_ULONG *t)
-        {
-        int j,i,n,c1,c2;
-        int neg,oneg,zero;
-        BN_ULONG ll,lc,*lp,*mp;
-
-#ifdef BN_COUNT
-printf(" bn_mul_high %d * %d\n",n2,n2);
-#endif
-        n=(n2+1)/2;
-
-        /* Calculate (al-ah)*(bh-bl) */
-        neg=zero=0;
-        c1=bn_cmp_words(&(a[0]),&(a[n]),n);
-        c2=bn_cmp_words(&(b[n]),&(b[0]),n);
-        switch (c1*3+c2)
-                {
-        case -4:
-                bn_sub_words(&(r[0]),&(a[n]),&(a[0]),n);
-                bn_sub_words(&(r[n]),&(b[0]),&(b[n]),n);
-                break;
-        case -3:
-                zero=1;
-                break;
-        case -2:
-                bn_sub_words(&(r[0]),&(a[n]),&(a[0]),n);
-                bn_sub_words(&(r[n]),&(b[n]),&(b[0]),n);
-                neg=1;
-                break;
-        case -1:
-        case 0:
-        case 1:
-                zero=1;
-                break;
-        case 2:
-                bn_sub_words(&(r[0]),&(a[0]),&(a[n]),n);
-                bn_sub_words(&(r[n]),&(b[0]),&(b[n]),n);
-                neg=1;
-                break;
-        case 3:
-                zero=1;
-                break;
-        case 4:
-                bn_sub_words(&(r[0]),&(a[0]),&(a[n]),n);
-                bn_sub_words(&(r[n]),&(b[n]),&(b[0]),n);
-                break;
-                }
-                
-        oneg=neg;
-        /* t[10] = (a[0]-a[1])*(b[1]-b[0]) */
-        bn_mul_recursive(&(t[0]),&(r[0]),&(r[n]),n,&(t[n2]));
-        /* r[10] = (a[1]*b[1]) */
-        bn_mul_recursive(r,&(a[n]),&(b[n]),n,&(t[n2]));
-
-        /* s0 == low(al*bl)
-         * s1 == low(ah*bh)+low((al-ah)*(bh-bl))+low(al*bl)+high(al*bl)
-         * We know s0 and s1 so the only unknown is high(al*bl)
-         * high(al*bl) == s1 - low(ah*bh+s0+(al-ah)*(bh-bl))
-         * high(al*bl) == s1 - (r[0]+l[0]+t[0])
-         */
-        if (l != NULL)
-                {
-                lp= &(t[n2+n]);
-                c1=bn_add_words(lp,&(r[0]),&(l[0]),n);
-                }
-        else
-                {
-                c1=0;
-                lp= &(r[0]);
-                }
-
-        if (neg)
-                neg=bn_sub_words(&(t[n2]),lp,&(t[0]),n);
-        else
-                {
-                bn_add_words(&(t[n2]),lp,&(t[0]),n);
-                neg=0;
-                }
-
-        if (l != NULL)
-                {
-                bn_sub_words(&(t[n2+n]),&(l[n]),&(t[n2]),n);
-                }
-        else
-                {
-                lp= &(t[n2+n]);
-                mp= &(t[n2]);
-                for (i=0; i<n; i++)
-                        lp[i]=((~mp[i])+1)&BN_MASK2;
-                }
-
-        /* s[0] = low(al*bl)
-         * t[3] = high(al*bl)
-         * t[10] = (a[0]-a[1])*(b[1]-b[0]) neg is the sign
-         * r[10] = (a[1]*b[1])
-         */
-        /* R[10] = al*bl
-         * R[21] = al*bl + ah*bh + (a[0]-a[1])*(b[1]-b[0])
-         * R[32] = ah*bh
-         */
-        /* R[1]=t[3]+l[0]+r[0](+-)t[0] (have carry/borrow)
-         * R[2]=r[0]+t[3]+r[1](+-)t[1] (have carry/borrow)
-         * R[3]=r[1]+(carry/borrow)
-         */
-        if (l != NULL)
-                {
-                lp= &(t[n2]);
-                c1= bn_add_words(lp,&(t[n2+n]),&(l[0]),n);
-                }
-        else
-                {
-                lp= &(t[n2+n]);
-                c1=0;
-                }
-        c1+=bn_add_words(&(t[n2]),lp,  &(r[0]),n);
-        if (oneg)
-                c1-=bn_sub_words(&(t[n2]),&(t[n2]),&(t[0]),n);
-        else
-                c1+=bn_add_words(&(t[n2]),&(t[n2]),&(t[0]),n);
-
-        c2 =bn_add_words(&(r[0]),&(r[0]),&(t[n2+n]),n);
-        c2+=bn_add_words(&(r[0]),&(r[0]),&(r[n]),n);
-        if (oneg)
-                c2-=bn_sub_words(&(r[0]),&(r[0]),&(t[n]),n);
-        else
-                c2+=bn_add_words(&(r[0]),&(r[0]),&(t[n]),n);
-        
-        if (c1 != 0) /* Add starting at r[0], could be +ve or -ve */
-                {
-                i=0;
-                if (c1 > 0)
-                        {
-                        lc=c1;
-                        do      {
-                                ll=(r[i]+lc)&BN_MASK2;
-                                r[i++]=ll;
-                                lc=(lc > ll);
-                                } while (lc);
-                        }
-                else
-                        {
-                        lc= -c1;
-                        do      {
-                                ll=r[i];
-                                r[i++]=(ll-lc)&BN_MASK2;
-                                lc=(lc > ll);
-                                } while (lc);
-                        }
-                }
-        if (c2 != 0) /* Add starting at r[1] */
-                {
-                i=n;
-                if (c2 > 0)
-                        {
-                        lc=c2;
-                        do      {
-                                ll=(r[i]+lc)&BN_MASK2;
-                                r[i++]=ll;
-                                lc=(lc > ll);
-                                } while (lc);
-                        }
-                else
-                        {
-                        lc= -c2;
-                        do      {
-                                ll=r[i];
-                                r[i++]=(ll-lc)&BN_MASK2;
-                                lc=(lc > ll);
-                                } while (lc);
-                        }
-                }
-        }
-#endif
diff --git a/src/lib/libssl/src/crypto/bn/old/bn_low.c b/src/lib/libssl/src/crypto/bn/old/bn_low.c
index cbc406751c..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/bn_low.c
+++ b/src/lib/libssl/src/crypto/bn/old/bn_low.c
@@ -1,194 +0,0 @@
-/* crypto/bn/bn_mul.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-static int bn_mm_low(BIGNUM *m,BIGNUM *A,BIGNUM *B, int num,
-                BIGNUM *sk,BN_CTX *ctx);
-int BN_mul_low(BIGNUM *r, BIGNUM *a, BIGNUM *b,int words);
-
-/* r must be different to a and b */
-int BN_mul_low(BIGNUM *r, BIGNUM *a, BIGNUM *b, int num)
-        {
-        BN_ULONG *ap,*bp,*rp;
-        BIGNUM *sk;
-        int j,i,n,ret;
-        int max,al,bl;
-        BN_CTX ctx;
-
-        bn_check_top(a);
-        bn_check_top(b);
-
-#ifdef BN_MUL_DEBUG
-printf("BN_mul_low(%d,%d,%d)\n",a->top,b->top,num);
-#endif
-
-        al=a->top;
-        bl=b->top;
-        if ((al == 0) || (bl == 0))
-                {
-                r->top=0;
-                return(1);
-                }
-
-        if ((bn_limit_bits_low > 0) && (num > bn_limit_num_low))
-                {
-                n=BN_num_bits_word(num*2)-bn_limit_bits_low;
-                n*=2;
-                sk=(BIGNUM *)Malloc(sizeof(BIGNUM)*n);
-                memset(sk,0,sizeof(BIGNUM)*n);
-                memset(&ctx,0,sizeof(ctx));
-
-                ret=bn_mm_low(r,a,b,num,&(sk[0]),&ctx);
-                for (i=0; i<n; i+=2)
-                        {
-                        BN_clear_free(&sk[i]);
-                        BN_clear_free(&sk[i+1]);
-                        }
-                Free(sk);
-                return(ret);
-                }
-
-        max=(al+bl);
-        if (bn_wexpand(r,max) == NULL) return(0);
-        r->neg=a->neg^b->neg;
-        ap=a->d;
-        bp=b->d;
-        rp=r->d;
-        r->top=(max > num)?num:max;
-
-        rp[al]=bn_mul_words(rp,ap,al,*(bp++));
-        rp++;
-        j=bl;
-        for (i=1; i<j; i++)
-                {
-                if (al >= num--)
-                        {
-                        al--;
-                        if (al <= 0) break;
-                        }
-                rp[al]=bn_mul_add_words(rp,ap,al,*(bp++));
-                rp++;
-                }
-        
-        while ((r->top > 0) && (r->d[r->top-1] == 0))
-                r->top--;
-        return(1);
-        }
-
-
-#define t1      (sk[0])
-#define t2      (sk[1])
-
-/* r must be different to a and b */
-int bn_mm_low(BIGNUM *m, BIGNUM *A, BIGNUM *B, int num, BIGNUM *sk,
-             BN_CTX *ctx)
-        {
-        int n; /* ,sqr=0; */
-        int an,bn;
-        BIGNUM ah,al,bh,bl;
-
-        bn_wexpand(m,num+3);
-        an=A->top;
-        bn=B->top;
-
-#ifdef BN_MUL_DEBUG
-printf("bn_mm_low(%d,%d,%d)\n",A->top,B->top,num);
-#endif
-
-        n=(num+1)/2;
-
-        BN_init(&ah); BN_init(&al); BN_init(&bh); BN_init(&bl);
-
-        bn_set_low( &al,A,n);
-        bn_set_high(&ah,A,n);
-        bn_set_low( &bl,B,n);
-        bn_set_high(&bh,B,n);
-
-        if (num <= (bn_limit_num_low+bn_limit_num_low))
-                {
-                BN_mul(m,&al,&bl);
-                BN_mul_low(&t1,&al,&bh,n);
-                BN_mul_low(&t2,&ah,&bl,n);
-                }
-        else
-                {
-                bn_mm(m  ,&al,&bl,&(sk[2]),ctx);
-                bn_mm_low(&t1,&al,&bh,n,&(sk[2]),ctx);
-                bn_mm_low(&t2,&ah,&bl,n,&(sk[2]),ctx);
-                }
-
-        BN_add(&t1,&t1,&t2);
-
-        /* We will now do an evil hack instead of
-         * BN_lshift(&t1,&t1,n*BN_BITS2);
-         * BN_add(m,m,&t1);
-         * BN_mask_bits(m,num*BN_BITS2);
-         */
-        bn_set_high(&ah,m,n); ah.max=num+2;
-        BN_add(&ah,&ah,&t1);
-        m->top=num;
-
-        m->neg=A->neg^B->neg;
-        return(1);
-        }
-
-#undef t1       (sk[0])
-#undef t2       (sk[1])
diff --git a/src/lib/libssl/src/crypto/bn/old/bn_m.c b/src/lib/libssl/src/crypto/bn/old/bn_m.c
index 522beb02bc..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/bn_m.c
+++ b/src/lib/libssl/src/crypto/bn/old/bn_m.c
@@ -1,139 +0,0 @@
-/* crypto/bn/bn_m.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-/*#include "cryptlib.h"*/
-#include "bn_lcl.h"
-
-#define limit_bits 5                    /* 2^5, or 32 words */
-#define limit_num (1<<limit_bits)
-
-int BN_m(BIGNUM *r, BIGNUM *a, BIGNUM *b)
-        {
-        BIGNUM *sk;
-        int i,n;
-
-        n=(BN_num_bits_word(a->top|b->top)-limit_bits);
-        n*=2;
-        sk=(BIGNUM *)malloc(sizeof(BIGNUM)*n);
-        for (i=0; i<n; i++)
-                BN_init(&(sk[i]));
-
-        return(BN_mm(r,a,b,&(sk[0])));
-        }
-
-#define ahal    (sk[0])
-#define blbh    (sk[1])
-
-/* r must be different to a and b */
-int BN_mm(BIGNUM *m, BIGNUM *A, BIGNUM *B, BIGNUM *sk)
-        {
-        int i,num,anum,bnum;
-        int an,bn;
-        BIGNUM ah,al,bh,bl;
-
-        an=A->top;
-        bn=B->top;
-        if ((an <= limit_num) || (bn <= limit_num))
-                {
-                return(BN_mul(m,A,B));
-                }
-
-        anum=(an>bn)?an:bn;
-        num=(anum)/2;
-
-        /* Are going to now chop things into 'num' word chunks. */
-        bnum=num*BN_BITS2;
-
-        BN_init(&ahal);
-        BN_init(&blbh);
-        BN_init(&ah);
-        BN_init(&al);
-        BN_init(&bh);
-        BN_init(&bl);
-
-        al.top=num;
-        al.d=A->d;
-        ah.top=A->top-num;
-        ah.d= &(A->d[num]);
-
-        bl.top=num;
-        bl.d=B->d;
-        bh.top=B->top-num;
-        bh.d= &(B->d[num]);
-
-        BN_sub(&ahal,&ah,&al);
-        BN_sub(&blbh,&bl,&bh);
-
-        BN_mm(m,&ahal,&blbh,&(sk[2]));
-        BN_mm(&ahal,&al,&bl,&(sk[2]));
-        BN_mm(&blbh,&ah,&bh,&(sk[2]));
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        BN_lshift(m,m,bnum);
-        BN_add(m,m,&ahal);
-
-        BN_lshift(&blbh,&blbh,bnum*2);
-        BN_add(m,m,&blbh);
-
-        m->neg=A->neg^B->neg;
-        return(1);
-        }
-
diff --git a/src/lib/libssl/src/crypto/bn/old/bn_mul.c.works b/src/lib/libssl/src/crypto/bn/old/bn_mul.c.works
index 6d565d44a2..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/bn_mul.c.works
+++ b/src/lib/libssl/src/crypto/bn/old/bn_mul.c.works
@@ -1,219 +0,0 @@
-/* crypto/bn/bn_mul.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-int bn_mm(BIGNUM *m,BIGNUM *A,BIGNUM *B, BIGNUM *sk,BN_CTX *ctx);
-
-/* r must be different to a and b */
-int BN_mul(r, a, b)
-BIGNUM *r;
-BIGNUM *a;
-BIGNUM *b;
-        {
-        BN_ULONG *ap,*bp,*rp;
-        BIGNUM *sk;
-        int i,n,ret;
-        int max,al,bl;
-        BN_CTX ctx;
-
-        bn_check_top(a);
-        bn_check_top(b);
-
-        al=a->top;
-        bl=b->top;
-        if ((al == 0) || (bl == 0))
-                {
-                r->top=0;
-                return(1);
-                }
-#ifdef BN_MUL_DEBUG
-printf("BN_mul(%d,%d)\n",a->top,b->top);
-#endif
-
-#ifdef BN_RECURSION
-        if (    (bn_limit_bits > 0) &&
-                (bl > bn_limit_num) && (al > bn_limit_num))
-                {
-                n=(BN_num_bits_word(al|bl)-bn_limit_bits);
-                n*=2;
-                sk=(BIGNUM *)Malloc(sizeof(BIGNUM)*n);
-                memset(sk,0,sizeof(BIGNUM)*n);
-                memset(&ctx,0,sizeof(ctx));
-
-                ret=bn_mm(r,a,b,&(sk[0]),&ctx);
-                for (i=0; i<n; i+=2)
-                        {
-                        BN_clear_free(&sk[i]);
-                        BN_clear_free(&sk[i+1]);
-                        }
-                Free(sk);
-                return(ret);
-                }
-#endif
-
-        max=(al+bl);
-        if (bn_wexpand(r,max) == NULL) return(0);
-        r->top=max;
-        r->neg=a->neg^b->neg;
-        ap=a->d;
-        bp=b->d;
-        rp=r->d;
-
-#ifdef BN_RECURSION
-        if ((al == bl) && (al == 8))
-                {
-                bn_mul_comba8(rp,ap,bp);
-                }
-        else
-#endif
-                {
-                rp[al]=bn_mul_words(rp,ap,al,*(bp++));
-                rp++;
-                for (i=1; i<bl; i++)
-                        {
-                        rp[al]=bn_mul_add_words(rp,ap,al,*(bp++));
-                        rp++;
-                        }
-                }
-        if ((max > 0) && (r->d[max-1] == 0)) r->top--;
-        return(1);
-        }
-
-#ifdef BN_RECURSION
-
-#define ahal    (sk[0])
-#define blbh    (sk[1])
-
-/* r must be different to a and b */
-int bn_mm(m, A, B, sk,ctx)
-BIGNUM *m,*A,*B;
-BIGNUM *sk;
-BN_CTX *ctx;
-        {
-        int n,num,sqr=0;
-        int an,bn;
-        BIGNUM ah,al,bh,bl;
-
-        an=A->top;
-        bn=B->top;
-#ifdef BN_MUL_DEBUG
-printf("bn_mm(%d,%d)\n",A->top,B->top);
-#endif
-
-        if (A == B) sqr=1;
-        num=(an>bn)?an:bn;
-        n=(num+1)/2;
-        /* Are going to now chop things into 'num' word chunks. */
-
-        BN_init(&ah);
-        BN_init(&al);
-        BN_init(&bh);
-        BN_init(&bl);
-
-        bn_set_low (&al,A,n);
-        bn_set_high(&ah,A,n);
-        bn_set_low (&bl,B,n);
-        bn_set_high(&bh,B,n);
-
-        BN_sub(&ahal,&ah,&al);
-        BN_sub(&blbh,&bl,&bh);
-
-        if (num <= (bn_limit_num+bn_limit_num))
-                {
-                BN_mul(m,&ahal,&blbh);
-                if (sqr)
-                        {
-                        BN_sqr(&ahal,&al,ctx);
-                        BN_sqr(&blbh,&ah,ctx);
-                        }
-                else
-                        {
-                        BN_mul(&ahal,&al,&bl);
-                        BN_mul(&blbh,&ah,&bh);
-                        }
-                }
-        else
-                {
-                bn_mm(m,&ahal,&blbh,&(sk[2]),ctx);
-                bn_mm(&ahal,&al,&bl,&(sk[2]),ctx);
-                bn_mm(&blbh,&ah,&bh,&(sk[2]),ctx);
-                }
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        BN_lshift(m,m,n*BN_BITS2);
-        BN_lshift(&blbh,&blbh,n*BN_BITS2*2);
-
-        BN_add(m,m,&ahal);
-        BN_add(m,m,&blbh);
-
-        m->neg=A->neg^B->neg;
-        return(1);
-        }
-#undef ahal     (sk[0])
-#undef blbh     (sk[1])
-
-#include "bn_low.c"
-#include "bn_high.c"
-#include "f.c"
-
-#endif
diff --git a/src/lib/libssl/src/crypto/bn/old/bn_wmul.c b/src/lib/libssl/src/crypto/bn/old/bn_wmul.c
index a467b2f17a..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/bn_wmul.c
+++ b/src/lib/libssl/src/crypto/bn/old/bn_wmul.c
@@ -1,173 +0,0 @@
-#include <stdio.h>
-#include "bn_lcl.h"
-
-#if 1
-
-int bn_mull(BIGNUM *r,BIGNUM *a,BIGNUM *b, BN_CTX *ctx);
-
-int bn_mull(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
-        {
-        int top,i,j,k,al,bl;
-        BIGNUM *t;
-
-#ifdef BN_COUNT
-printf("bn_mull %d * %d\n",a->top,b->top);
-#endif
-
-        bn_check_top(a);
-        bn_check_top(b);
-        bn_check_top(r);
-
-        al=a->top;
-        bl=b->top;
-        r->neg=a->neg^b->neg;
-
-        top=al+bl;
-        if ((al < 4) || (bl < 4))
-                {
-                if (bn_wexpand(r,top) == NULL) return(0);
-                r->top=top;
-                bn_mul_normal(r->d,a->d,al,b->d,bl);
-                goto end;
-                }
-        else if (al == bl) /* A good start, they are the same size */
-                goto symetric;
-        else
-                {
-                i=(al-bl);
-                if ((i ==  1) && !BN_get_flags(b,BN_FLG_STATIC_DATA))
-                        {
-                        bn_wexpand(b,al);
-                        b->d[bl]=0;
-                        bl++;
-                        goto symetric;
-                        }
-                else if ((i ==  -1) && !BN_get_flags(a,BN_FLG_STATIC_DATA))
-                        {
-                        bn_wexpand(a,bl);
-                        a->d[al]=0;
-                        al++;
-                        goto symetric;
-                        }
-                }
-
-        /* asymetric and >= 4 */ 
-        if (bn_wexpand(r,top) == NULL) return(0);
-        r->top=top;
-        bn_mul_normal(r->d,a->d,al,b->d,bl);
-
-        if (0)
-                {
-                /* symetric and > 4 */
-symetric:
-                if (al == 4)
-                        {
-                        if (bn_wexpand(r,al*2) == NULL) return(0);
-                        r->top=top;
-                        bn_mul_comba4(r->d,a->d,b->d);
-                        goto end;
-                        }
-                if (al == 8)
-                        {
-                        if (bn_wexpand(r,al*2) == NULL) return(0);
-                        r->top=top;
-                        bn_mul_comba8(r->d,a->d,b->d);
-                        goto end;
-                        }
-                if (al <= BN_MULL_NORMAL_SIZE)
-                        {
-                        if (bn_wexpand(r,al*2) == NULL) return(0);
-                        r->top=top;
-                        bn_mul_normal(r->d,a->d,al,b->d,bl);
-                        goto end;
-                        }
-                /* 16 or larger */
-                j=BN_num_bits_word((BN_ULONG)al);
-                j=1<<(j-1);
-                k=j+j;
-                t= &(ctx->bn[ctx->tos]);
-                if (al == j) /* exact multiple */
-                        {
-                        bn_wexpand(t,k*2);
-                        bn_wexpand(r,k*2);
-                        bn_mul_recursive(r->d,a->d,b->d,al,t->d);
-                        }
-                else
-                        {
-                        bn_wexpand(a,k);
-                        bn_wexpand(b,k);
-                        bn_wexpand(t,k*4);
-                        bn_wexpand(r,k*4);
-                        for (i=a->top; i<k; i++)
-                                a->d[i]=0;
-                        for (i=b->top; i<k; i++)
-                                b->d[i]=0;
-                        bn_mul_part_recursive(r->d,a->d,b->d,al-j,j,t->d);
-                        }
-                r->top=top;
-                }
-end:
-        bn_fix_top(r);
-        return(1);
-        }
-#endif
-
-void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
-        {
-        BN_ULONG *rr;
-
-#ifdef BN_COUNT
-printf(" bn_mul_normal %d * %d\n",na,nb);
-#endif
-
-        if (na < nb)
-                {
-                int itmp;
-                BN_ULONG *ltmp;
-
-                itmp=na; na=nb; nb=itmp;
-                ltmp=a;   a=b;   b=ltmp;
-
-                }
-        rr= &(r[na]);
-        rr[0]=bn_mul_words(r,a,na,b[0]);
-
-        for (;;)
-                {
-                if (--nb <= 0) return;
-                rr[1]=bn_mul_add_words(&(r[1]),a,na,b[1]);
-                if (--nb <= 0) return;
-                rr[2]=bn_mul_add_words(&(r[2]),a,na,b[2]);
-                if (--nb <= 0) return;
-                rr[3]=bn_mul_add_words(&(r[3]),a,na,b[3]);
-                if (--nb <= 0) return;
-                rr[4]=bn_mul_add_words(&(r[4]),a,na,b[4]);
-                rr+=4;
-                r+=4;
-                b+=4;
-                }
-        }
-
-#if 1
-void bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
-        {
-#ifdef BN_COUNT
-printf(" bn_mul_low_normal %d * %d\n",n,n);
-#endif
-        bn_mul_words(r,a,n,b[0]);
-
-        for (;;)
-                {
-                if (--n <= 0) return;
-                bn_mul_add_words(&(r[1]),a,n,b[1]);
-                if (--n <= 0) return;
-                bn_mul_add_words(&(r[2]),a,n,b[2]);
-                if (--n <= 0) return;
-                bn_mul_add_words(&(r[3]),a,n,b[3]);
-                if (--n <= 0) return;
-                bn_mul_add_words(&(r[4]),a,n,b[4]);
-                r+=4;
-                b+=4;
-                }
-        }
-#endif
diff --git a/src/lib/libssl/src/crypto/bn/old/build b/src/lib/libssl/src/crypto/bn/old/build
index 8cd99e5f17..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/build
+++ b/src/lib/libssl/src/crypto/bn/old/build
@@ -1,3 +0,0 @@
-#!/bin/sh -x
-
-gcc -g -I../../include test.c -L../.. -lcrypto
diff --git a/src/lib/libssl/src/crypto/bn/old/info b/src/lib/libssl/src/crypto/bn/old/info
index 5ac99c3b23..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/info
+++ b/src/lib/libssl/src/crypto/bn/old/info
@@ -1,22 +0,0 @@
-Given A1A0 * B1B0 == S3S2S1S0
-
-S0=     low(A0*B0)
-S1=     low( (A1-A0)*(B0-B1)) +low( A1*B1) +high(A0*B0)
-S2=     high((A1-A0)*(B0-B1)) +high(A1*B1) +low( A1*B1)
-S3=     high(A1*B1);
-
-Assume we know S1 and S0, and can calulate A1*B1 and high((A1-A0)*(B0-B1))
-
-k0=     S0 == low(A0*B0)
-k1=     S1
-k2=     low( A1*B1)
-k3=     high(A1*B1)
-k4=     high((A1-A0)*(B0-B1))
-
-k1=     low((A1-A0)*(B0-B1)) +k2 +high(A0*B0)
-S2=     k4 +k3 +k2
-S3=     k3
-
-S1-k2= low((A1-A0)*(B0-B1)) +high(A0*B0)
-
-We potentially have a carry or a borrow from S1
diff --git a/src/lib/libssl/src/crypto/bn/old/test.works b/src/lib/libssl/src/crypto/bn/old/test.works
index 127c7b415d..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/old/test.works
+++ b/src/lib/libssl/src/crypto/bn/old/test.works
@@ -1,205 +0,0 @@
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-#define SIZE    128
-
-#define BN_MONT_CTX_set         bn_mcs
-#define BN_from_montgomery      bn_fm
-#define BN_mod_mul_montgomery   bn_mmm
-#undef BN_to_montgomery
-#define BN_to_montgomery(r,a,mont,ctx)  bn_mmm(\
-        r,a,(mont)->RR,(mont),ctx)
-
-main()
-        {
-        BIGNUM prime,a,b,r,A,B,R;
-        BN_MONT_CTX *mont;
-        BN_CTX *ctx;
-        int i;
-
-        ctx=BN_CTX_new();
-        BN_init(&prime);
-        BN_init(&a); BN_init(&b); BN_init(&r);
-        BN_init(&A); BN_init(&B); BN_init(&R);
-
-        BN_generate_prime(&prime,SIZE,0,NULL,NULL,NULL,NULL);
-        BN_rand(&A,SIZE,1,0);
-        BN_rand(&B,SIZE,1,0);
-        BN_mod(&A,&A,&prime,ctx);
-        BN_mod(&B,&B,&prime,ctx);
-
-        mont=BN_MONT_CTX_new();
-        BN_MONT_CTX_set(mont,&prime,ctx);
-
-        BN_to_montgomery(&a,&A,mont,ctx);
-        BN_to_montgomery(&b,&B,mont,ctx);
-
-        BN_mul(&r,&a,&b);
-        BN_print_fp(stdout,&r); printf("\n");
-        BN_from_montgomery(&r,&r,mont,ctx);
-        BN_print_fp(stdout,&r); printf("\n");
-        BN_from_montgomery(&r,&r,mont,ctx);
-        BN_print_fp(stdout,&r); printf("\n");
-
-        BN_mod_mul(&R,&A,&B,&prime,ctx);
-
-        BN_print_fp(stdout,&a); printf("\n");
-        BN_print_fp(stdout,&b); printf("\n");
-        BN_print_fp(stdout,&prime); printf("\n");
-        BN_print_fp(stdout,&r); printf("\n\n");
-
-        BN_print_fp(stdout,&A); printf("\n");
-        BN_print_fp(stdout,&B); printf("\n");
-        BN_print_fp(stdout,&prime); printf("\n");
-        BN_print_fp(stdout,&R); printf("\n\n");
-
-        BN_mul(&r,&a,&b);
-        BN_print_fp(stdout,&r); printf(" <- BA*DC\n");
-        BN_copy(&A,&r);
-        i=SIZE/2;
-        BN_mask_bits(&A,i*2);
-//      BN_print_fp(stdout,&A); printf(" <- low(BA*DC)\n");
-        bn_do_lower(&r,&a,&b,&A,i);
-//      BN_print_fp(stdout,&r); printf(" <- low(BA*DC)\n");
-        }
-
-int bn_mul_low(r,a,b,low,i)
-BIGNUM *r,*a,*b,*low;
-int i;
-        {
-        int w;
-        BIGNUM Kh,Km,t1,t2,h,ah,al,bh,bl,l,m,s0,s1;
-
-        BN_init(&Kh); BN_init(&Km); BN_init(&t1); BN_init(&t2); BN_init(&l);
-        BN_init(&ah); BN_init(&al); BN_init(&bh); BN_init(&bl); BN_init(&h);
-        BN_init(&m); BN_init(&s0); BN_init(&s1);
-
-        BN_copy(&al,a); BN_mask_bits(&al,i); BN_rshift(&ah,a,i);
-        BN_copy(&bl,b); BN_mask_bits(&bl,i); BN_rshift(&bh,b,i);
-
-
-        BN_sub(&t1,&al,&ah);
-        BN_sub(&t2,&bh,&bl);
-        BN_mul(&m,&t1,&t2);
-        BN_mul(&h,&ah,&bh);
-
-        BN_copy(&s0,low); BN_mask_bits(&s0,i);
-        BN_rshift(&s1,low,i);
-
-        BN_add(&t1,&h,&m);
-        BN_add(&t1,&t1,&s0);
-
-        BN_copy(&t2,&t1); BN_mask_bits(&t2,i);
-        BN_sub(&t1,&s1,&t2);
-        BN_lshift(&t1,&t1,i);
-        BN_add(&t1,&t1,&s0);
-        if (t1.neg)
-                {
-                BN_lshift(&t2,BN_value_one(),i*2);
-                BN_add(&t1,&t2,&t1);
-                BN_mask_bits(&t1,i*2);
-                }
-        
-        BN_free(&Kh); BN_free(&Km); BN_free(&t1); BN_free(&t2);
-        BN_free(&ah); BN_free(&al); BN_free(&bh); BN_free(&bl);
-        }
-
-int BN_mod_mul_montgomery(r,a,b,mont,ctx)
-BIGNUM *r,*a,*b;
-BN_MONT_CTX *mont;
-BN_CTX *ctx;
-        {
-        BIGNUM *tmp;
-
-        tmp= &(ctx->bn[ctx->tos++]);
-
-        if (a == b)
-                {
-                if (!BN_sqr(tmp,a,ctx)) goto err;
-                }
-        else
-                {
-                if (!BN_mul(tmp,a,b)) goto err;
-                }
-        /* reduce from aRR to aR */
-        if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
-        ctx->tos--;
-        return(1);
-err:
-        return(0);
-        }
-
-int BN_from_montgomery(r,a,mont,ctx)
-BIGNUM *r;
-BIGNUM *a;
-BN_MONT_CTX *mont;
-BN_CTX *ctx;
-        {
-        BIGNUM z1;
-        BIGNUM *t1,*t2;
-        BN_ULONG *ap,*bp,*rp;
-        int j,i,bl,al;
-
-        BN_init(&z1);
-        t1= &(ctx->bn[ctx->tos]);
-        t2= &(ctx->bn[ctx->tos+1]);
-
-        if (!BN_copy(t1,a)) goto err;
-        /* can cheat */
-        BN_mask_bits(t1,mont->ri);
-        if (!BN_mul(t2,t1,mont->Ni)) goto err;
-        BN_mask_bits(t2,mont->ri);
-
-        if (!BN_mul(t1,t2,mont->N)) goto err;
-        if (!BN_add(t2,t1,a)) goto err;
-
-        /* At this point, t2 has the bottom ri bits set to zero.
-         * This means that the bottom ri bits == the 1^ri minus the bottom
-         * ri bits of a.
-         * This means that only the bits above 'ri' in a need to be added,
-         * and XXXXXXXXXXXXXXXXXXXXXXXX
-         */
-BN_print_fp(stdout,t2); printf("\n");
-        BN_rshift(r,t2,mont->ri);
-
-        if (BN_ucmp(r,mont->N) >= 0)
-                bn_qsub(r,r,mont->N);
-
-        return(1);
-err:
-        return(0);
-        }
-
-int BN_MONT_CTX_set(mont,mod,ctx)
-BN_MONT_CTX *mont;
-BIGNUM *mod;
-BN_CTX *ctx;
-        {
-        BIGNUM *Ri=NULL,*R=NULL;
-
-        if (mont->RR == NULL) mont->RR=BN_new();
-        if (mont->N == NULL)  mont->N=BN_new();
-
-        R=mont->RR;                                     /* grab RR as a temp */
-        BN_copy(mont->N,mod);                           /* Set N */
-
-        mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
-        BN_lshift(R,BN_value_one(),mont->ri);                   /* R */
-        if ((Ri=BN_mod_inverse(NULL,R,mod,ctx)) == NULL) goto err;/* Ri */
-        BN_lshift(Ri,Ri,mont->ri);                              /* R*Ri */
-        bn_qsub(Ri,Ri,BN_value_one());                          /* R*Ri - 1 */
-        BN_div(Ri,NULL,Ri,mod,ctx);
-        if (mont->Ni != NULL) BN_free(mont->Ni);
-        mont->Ni=Ri;                                    /* Ni=(R*Ri-1)/N */
-
-        /* setup RR for conversions */
-        BN_lshift(mont->RR,BN_value_one(),mont->ri*2);
-        BN_mod(mont->RR,mont->RR,mont->N,ctx);
-
-        return(1);
-err:
-        return(0);
-        }
-
-
diff --git a/src/lib/libssl/src/crypto/bn/test.c b/src/lib/libssl/src/crypto/bn/test.c
index a048b9f878..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/bn/test.c
+++ b/src/lib/libssl/src/crypto/bn/test.c
@@ -1,241 +0,0 @@
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-
-#define SIZE    32
-
-#define BN_MONT_CTX_set         bn_mcs
-#define BN_from_montgomery      bn_fm
-#define BN_mod_mul_montgomery   bn_mmm
-#undef BN_to_montgomery
-#define BN_to_montgomery(r,a,mont,ctx)  bn_mmm(\
-        r,a,(mont)->RR,(mont),ctx)
-
-main()
-        {
-        BIGNUM prime,a,b,r,A,B,R;
-        BN_MONT_CTX *mont;
-        BN_CTX *ctx;
-        int i;
-
-        ctx=BN_CTX_new();
-        BN_init(&prime);
-        BN_init(&a); BN_init(&b); BN_init(&r);
-        BN_init(&A); BN_init(&B); BN_init(&R);
-
-        BN_generate_prime(&prime,SIZE,0,NULL,NULL,NULL,NULL);
-        BN_rand(&A,SIZE,1,0);
-        BN_rand(&B,SIZE,1,0);
-        BN_mod(&A,&A,&prime,ctx);
-        BN_mod(&B,&B,&prime,ctx);
-
-        i=A.top;
-        BN_mul(&R,&A,&B,ctx);
-        BN_mask_bits(&R,i*BN_BITS2);
-
-
-        BN_print_fp(stdout,&A); printf(" <- a\n");
-        BN_print_fp(stdout,&B); printf(" <- b\n");
-        BN_mul_high(&r,&A,&B,&R,i);
-        BN_print_fp(stdout,&r); printf(" <- high(BA*DC)\n");
-
-        BN_mask_bits(&A,i*32);
-        BN_mask_bits(&B,i*32);
-
-        BN_mul(&R,&A,&B);
-        BN_rshift(&R,&R,i*32);
-        BN_print_fp(stdout,&R); printf(" <- norm BA*DC\n");
-        BN_sub(&R,&R,&r);
-        BN_print_fp(stdout,&R); printf(" <- diff\n");
-        }
-
-#if 0
-int bn_mul_high(BIGNUM *r, BIGNUM *a, BIGNUM *b, BIGNUM *low, int words)
-        {
-        int i;
-        BIGNUM t1,t2,t3,h,ah,al,bh,bl,m,s0,s1;
-
-        BN_init(&al); BN_init(&ah);
-        BN_init(&bl); BN_init(&bh);
-        BN_init(&t1); BN_init(&t2); BN_init(&t3);
-        BN_init(&s0); BN_init(&s1);
-        BN_init(&h); BN_init(&m);
-
-        i=a->top;
-        if (i >= words)
-                {
-                al.top=words;
-                ah.top=a->top-words;
-                ah.d= &(a->d[ah.top]);
-                }
-        else
-                al.top=i;
-        al.d=a->d;
-
-        i=b->top;
-        if (i >= words)
-                {
-                bl.top=words;
-                bh.top=i-words;
-                bh.d= &(b->d[bh.top]);
-                }
-        else
-                bl.top=i;
-        bl.d=b->d;
-
-        i=low->top;
-        if (i >= words)
-                {
-                s0.top=words;
-                s1.top=i-words;
-                s1.d= &(low->d[s1.top]);
-                }
-        else
-                s0.top=i;
-        s0.d=low->d;
-
-al.max=al.top; ah.max=ah.top;
-bl.max=bl.top; bh.max=bh.top;
-s0.max=bl.top; s1.max=bh.top;
-
-        /* Calculate (al-ah)*(bh-bl) */
-        BN_sub(&t1,&al,&ah);
-        BN_sub(&t2,&bh,&bl);
-        BN_mul(&m,&t1,&t2);
-
-        /* Calculate ah*bh */
-        BN_mul(&h,&ah,&bh);
-
-        /* s0 == low(al*bl)
-         * s1 == low(ah*bh)+low((al-ah)*(bh-bl))+low(al*bl)+high(al*bl)
-         * We know s0 and s1 so the only unknown is high(al*bl)
-         * high(al*bl) == s1 - low(ah*bh+(al-ah)*(bh-bl)+s0)
-         */
-        BN_add(&m,&m,&h);
-        BN_add(&t2,&m,&s0);
-        /* Quick and dirty mask off of high words */
-        t3.d=t2.d;
-        t3.top=(t2.top > words)?words:t2.top;
-        t3.neg=t2.neg;
-t3.max=t3.top;
-/* BN_print_fp(stdout,&s1); printf(" s1\n"); */
-/* BN_print_fp(stdout,&t2); printf(" middle value\n"); */
-/* BN_print_fp(stdout,&t3); printf(" low middle value\n"); */
-        BN_sub(&t1,&s1,&t3);
-
-        if (t1.neg)
-                {
-/*printf("neg fixup\n"); BN_print_fp(stdout,&t1); printf(" before\n"); */
-                BN_lshift(&t2,BN_value_one(),words*32);
-                BN_add(&t1,&t2,&t1);
-                BN_mask_bits(&t1,words*32);
-/* BN_print_fp(stdout,&t1); printf(" after\n"); */
-                }
-        /* al*bl == high(al*bl)<<words+s0 */
-        BN_lshift(&t1,&t1,words*32);
-        BN_add(&t1,&t1,&s0);
-        
-        /* We now have
-         * al*bl                        - t1
-         * (al-ah)*(bh-bl)+ah*bh        - m
-         * ah*bh                        - h
-         */
-        BN_copy(r,&t1);
-        BN_mask_bits(r,words*32*2);
-
-        /*BN_lshift(&m,&m,words*/
-
-        BN_free(&t1); BN_free(&t2);
-        BN_free(&m); BN_free(&h);
-        }
-
-int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_MONT_CTX *mont,
-             BN_CTX *ctx)
-        {
-        BIGNUM *tmp;
-
-        tmp= &(ctx->bn[ctx->tos++]);
-
-        if (a == b)
-                {
-                if (!BN_sqr(tmp,a,ctx)) goto err;
-                }
-        else
-                {
-                if (!BN_mul(tmp,a,b)) goto err;
-                }
-        /* reduce from aRR to aR */
-        if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
-        ctx->tos--;
-        return(1);
-err:
-        return(0);
-        }
-
-int BN_from_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont, BN_CTX *ctx)
-        {
-        BIGNUM z1;
-        BIGNUM *t1,*t2;
-        BN_ULONG *ap,*bp,*rp;
-        int j,i,bl,al;
-
-        BN_init(&z1);
-        t1= &(ctx->bn[ctx->tos]);
-        t2= &(ctx->bn[ctx->tos+1]);
-
-        if (!BN_copy(t1,a)) goto err;
-        /* can cheat */
-        BN_mask_bits(t1,mont->ri);
-        if (!BN_mul(t2,t1,mont->Ni)) goto err;
-        BN_mask_bits(t2,mont->ri);
-
-        if (!BN_mul(t1,t2,mont->N)) goto err;
-        if (!BN_add(t2,t1,a)) goto err;
-
-        /* At this point, t2 has the bottom ri bits set to zero.
-         * This means that the bottom ri bits == the 1^ri minus the bottom
-         * ri bits of a.
-         * This means that only the bits above 'ri' in a need to be added,
-         * and XXXXXXXXXXXXXXXXXXXXXXXX
-         */
-BN_print_fp(stdout,t2); printf("\n");
-        BN_rshift(r,t2,mont->ri);
-
-        if (BN_ucmp(r,mont->N) >= 0)
-                BN_usub(r,r,mont->N);
-
-        return(1);
-err:
-        return(0);
-        }
-
-int BN_MONT_CTX_set(BN_MONT_CTX *mont, BIGNUM *mod, BN_CTX *ctx)
-        {
-        BIGNUM *Ri=NULL,*R=NULL;
-
-        if (mont->RR == NULL) mont->RR=BN_new();
-        if (mont->N == NULL)  mont->N=BN_new();
-
-        R=mont->RR;                                     /* grab RR as a temp */
-        BN_copy(mont->N,mod);                           /* Set N */
-
-        mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
-        BN_lshift(R,BN_value_one(),mont->ri);                   /* R */
-        if ((Ri=BN_mod_inverse(NULL,R,mod,ctx)) == NULL) goto err;/* Ri */
-        BN_lshift(Ri,Ri,mont->ri);                              /* R*Ri */
-        BN_usub(Ri,Ri,BN_value_one());                          /* R*Ri - 1 */
-        BN_div(Ri,NULL,Ri,mod,ctx);
-        if (mont->Ni != NULL) BN_free(mont->Ni);
-        mont->Ni=Ri;                                    /* Ni=(R*Ri-1)/N */
-
-        /* setup RR for conversions */
-        BN_lshift(mont->RR,BN_value_one(),mont->ri*2);
-        BN_mod(mont->RR,mont->RR,mont->N,ctx);
-
-        return(1);
-err:
-        return(0);
-        }
-
-
-#endif
diff --git a/src/lib/libssl/src/crypto/buffer/Makefile.ssl b/src/lib/libssl/src/crypto/buffer/Makefile.ssl
index f23de89e33..506708c37f 100644
--- a/src/lib/libssl/src/crypto/buffer/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/buffer/Makefile.ssl
@@ -83,4 +83,5 @@ buffer.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 buffer.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 buffer.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 buffer.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-buffer.o: ../../include/openssl/stack.h ../cryptlib.h
+buffer.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+buffer.o: ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/cast/c_ecb.c b/src/lib/libssl/src/crypto/cast/c_ecb.c
index 33182f2b71..0b3da9ad87 100644
--- a/src/lib/libssl/src/crypto/cast/c_ecb.c
+++ b/src/lib/libssl/src/crypto/cast/c_ecb.c
@@ -60,7 +60,7 @@
 #include "cast_lcl.h"
 #include <openssl/opensslv.h>
 
-char *CAST_version="CAST" OPENSSL_VERSION_PTEXT;
+const char *CAST_version="CAST" OPENSSL_VERSION_PTEXT;
 
 void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out,
                       CAST_KEY *ks, int enc)
diff --git a/src/lib/libssl/src/crypto/cast/cast_lcl.h b/src/lib/libssl/src/crypto/cast/cast_lcl.h
index 83cf382a91..cfe3842e91 100644
--- a/src/lib/libssl/src/crypto/cast/cast_lcl.h
+++ b/src/lib/libssl/src/crypto/cast/cast_lcl.h
@@ -216,11 +216,11 @@
         }
 #endif
 
-OPENSSL_EXTERN CAST_LONG CAST_S_table0[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table1[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table2[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table3[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table4[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table5[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table6[256];
-OPENSSL_EXTERN CAST_LONG CAST_S_table7[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table0[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table1[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table2[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table3[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table4[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table5[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table6[256];
+OPENSSL_EXTERN const CAST_LONG CAST_S_table7[256];
diff --git a/src/lib/libssl/src/crypto/cast/cast_s.h b/src/lib/libssl/src/crypto/cast/cast_s.h
index 9af28972c5..c483fd5e43 100644
--- a/src/lib/libssl/src/crypto/cast/cast_s.h
+++ b/src/lib/libssl/src/crypto/cast/cast_s.h
@@ -55,7 +55,7 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
-OPENSSL_GLOBAL CAST_LONG CAST_S_table0[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table0[256]={
         0x30fb40d4,0x9fa0ff0b,0x6beccd2f,0x3f258c7a,
         0x1e213f2f,0x9c004dd3,0x6003e540,0xcf9fc949,
         0xbfd4af27,0x88bbbdb5,0xe2034090,0x98d09675,
@@ -121,7 +121,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table0[256]={
         0x1a69e783,0x02cc4843,0xa2f7c579,0x429ef47d,
         0x427b169c,0x5ac9f049,0xdd8f0f00,0x5c8165bf,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table1[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table1[256]={
         0x1f201094,0xef0ba75b,0x69e3cf7e,0x393f4380,
         0xfe61cf7a,0xeec5207a,0x55889c94,0x72fc0651,
         0xada7ef79,0x4e1d7235,0xd55a63ce,0xde0436ba,
@@ -187,7 +187,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table1[256]={
         0x43d79572,0x7e6dd07c,0x06dfdf1e,0x6c6cc4ef,
         0x7160a539,0x73bfbe70,0x83877605,0x4523ecf1,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table2[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table2[256]={
         0x8defc240,0x25fa5d9f,0xeb903dbf,0xe810c907,
         0x47607fff,0x369fe44b,0x8c1fc644,0xaececa90,
         0xbeb1f9bf,0xeefbcaea,0xe8cf1950,0x51df07ae,
@@ -253,7 +253,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table2[256]={
         0xf7baefd5,0x4142ed9c,0xa4315c11,0x83323ec5,
         0xdfef4636,0xa133c501,0xe9d3531c,0xee353783,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table3[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table3[256]={
         0x9db30420,0x1fb6e9de,0xa7be7bef,0xd273a298,
         0x4a4f7bdb,0x64ad8c57,0x85510443,0xfa020ed1,
         0x7e287aff,0xe60fb663,0x095f35a1,0x79ebf120,
@@ -319,7 +319,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table3[256]={
         0x7ae5290c,0x3cb9536b,0x851e20fe,0x9833557e,
         0x13ecf0b0,0xd3ffb372,0x3f85c5c1,0x0aef7ed2,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table4[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table4[256]={
         0x7ec90c04,0x2c6e74b9,0x9b0e66df,0xa6337911,
         0xb86a7fff,0x1dd358f5,0x44dd9d44,0x1731167f,
         0x08fbf1fa,0xe7f511cc,0xd2051b00,0x735aba00,
@@ -385,7 +385,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table4[256]={
         0xe822fe15,0x88570983,0x750e6249,0xda627e55,
         0x5e76ffa8,0xb1534546,0x6d47de08,0xefe9e7d4,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table5[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table5[256]={
         0xf6fa8f9d,0x2cac6ce1,0x4ca34867,0xe2337f7c,
         0x95db08e7,0x016843b4,0xeced5cbc,0x325553ac,
         0xbf9f0960,0xdfa1e2ed,0x83f0579d,0x63ed86b9,
@@ -451,7 +451,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table5[256]={
         0xa2d762cf,0x49c92f54,0x38b5f331,0x7128a454,
         0x48392905,0xa65b1db8,0x851c97bd,0xd675cf2f,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table6[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table6[256]={
         0x85e04019,0x332bf567,0x662dbfff,0xcfc65693,
         0x2a8d7f6f,0xab9bc912,0xde6008a1,0x2028da1f,
         0x0227bce7,0x4d642916,0x18fac300,0x50f18b82,
@@ -517,7 +517,7 @@ OPENSSL_GLOBAL CAST_LONG CAST_S_table6[256]={
         0x518f36b2,0x84b1d370,0x0fedce83,0x878ddada,
         0xf2a279c7,0x94e01be8,0x90716f4b,0x954b8aa3,
         };
-OPENSSL_GLOBAL CAST_LONG CAST_S_table7[256]={
+OPENSSL_GLOBAL const CAST_LONG CAST_S_table7[256]={
         0xe216300d,0xbbddfffc,0xa7ebdabd,0x35648095,
         0x7789f8b7,0xe6c1121b,0x0e241600,0x052ce8b5,
         0x11a9cfb0,0xe5952f11,0xece7990a,0x9386d174,
diff --git a/src/lib/libssl/src/crypto/cast/cast_spd.c b/src/lib/libssl/src/crypto/cast/cast_spd.c
index c0726906c2..0af915cf20 100644
--- a/src/lib/libssl/src/crypto/cast/cast_spd.c
+++ b/src/lib/libssl/src/crypto/cast/cast_spd.c
@@ -183,7 +183,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libssl/src/crypto/cast/castopts.c b/src/lib/libssl/src/crypto/cast/castopts.c
index 642e9725af..c783796610 100644
--- a/src/lib/libssl/src/crypto/cast/castopts.c
+++ b/src/lib/libssl/src/crypto/cast/castopts.c
@@ -252,7 +252,7 @@ int main(int argc, char **argv)
                 }
 
 #ifndef TIMES
-        fprintf(stderr,"To get the most acurate results, try to run this\n");
+        fprintf(stderr,"To get the most accurate results, try to run this\n");
         fprintf(stderr,"program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libssl/src/crypto/cast/casttest.c b/src/lib/libssl/src/crypto/cast/casttest.c
index 3244b119e9..ab2aeac606 100644
--- a/src/lib/libssl/src/crypto/cast/casttest.c
+++ b/src/lib/libssl/src/crypto/cast/casttest.c
@@ -71,32 +71,32 @@ int main(int argc, char *argv[])
 
 #define FULL_TEST
 
-unsigned char k[16]={
+static unsigned char k[16]={
         0x01,0x23,0x45,0x67,0x12,0x34,0x56,0x78,
         0x23,0x45,0x67,0x89,0x34,0x56,0x78,0x9A
         };
 
-unsigned char in[8]={ 0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF};
+static unsigned char in[8]={ 0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF};
 
-int k_len[3]={16,10,5};
-unsigned char c[3][8]={
+static int k_len[3]={16,10,5};
+static unsigned char c[3][8]={
         {0x23,0x8B,0x4F,0xE5,0x84,0x7E,0x44,0xB2},
         {0xEB,0x6A,0x71,0x1A,0x2C,0x02,0x27,0x1B},
         {0x7A,0xC8,0x16,0xD1,0x6E,0x9B,0x30,0x2E},
         };
-unsigned char out[80];
+static unsigned char out[80];
 
-unsigned char in_a[16]={
+static unsigned char in_a[16]={
         0x01,0x23,0x45,0x67,0x12,0x34,0x56,0x78,
         0x23,0x45,0x67,0x89,0x34,0x56,0x78,0x9A};
-unsigned char in_b[16]={
+static unsigned char in_b[16]={
         0x01,0x23,0x45,0x67,0x12,0x34,0x56,0x78,
         0x23,0x45,0x67,0x89,0x34,0x56,0x78,0x9A};
 
-unsigned char c_a[16]={
+static unsigned char c_a[16]={
         0xEE,0xA9,0xD0,0xA2,0x49,0xFD,0x3B,0xA6,
         0xB3,0x43,0x6F,0xB8,0x9D,0x6D,0xCA,0x92};
-unsigned char c_b[16]={
+static unsigned char c_b[16]={
         0xB2,0xC9,0x5E,0xB0,0x0C,0x31,0xAD,0x71,
         0x80,0xAC,0x05,0xB8,0xE8,0x3D,0x69,0x6E};
 
diff --git a/src/lib/libssl/src/crypto/comp/comp.h b/src/lib/libssl/src/crypto/comp/comp.h
index 93bd9c34c8..811cb5833d 100644
--- a/src/lib/libssl/src/crypto/comp/comp.h
+++ b/src/lib/libssl/src/crypto/comp/comp.h
@@ -17,6 +17,7 @@ typedef struct comp_method_st
         int (*compress)();
         int (*expand)();
         long (*ctrl)();
+        long (*callback_ctrl)();
         } COMP_METHOD;
 
 typedef struct comp_ctx_st
diff --git a/src/lib/libssl/src/crypto/conf/conf.c b/src/lib/libssl/src/crypto/conf/conf.c
index 7d8b89168a..3031fa3b44 100644
--- a/src/lib/libssl/src/crypto/conf/conf.c
+++ b/src/lib/libssl/src/crypto/conf/conf.c
@@ -86,28 +86,25 @@ const char *CONF_version="CONF" OPENSSL_VERSION_PTEXT;
 LHASH *CONF_load(LHASH *h, const char *file, long *line)
         {
         LHASH *ltmp;
-        FILE *in=NULL;
+        BIO *in=NULL;
 
 #ifdef VMS
-        in=fopen(file,"r");
+        in=BIO_new_file(file, "r");
 #else
-        in=fopen(file,"rb");
+        in=BIO_new_file(file, "rb");
 #endif
         if (in == NULL)
                 {
-                SYSerr(SYS_F_FOPEN,get_last_sys_error());
-                ERR_set_error_data(BUF_strdup(file),
-                        ERR_TXT_MALLOCED|ERR_TXT_STRING);
                 CONFerr(CONF_F_CONF_LOAD,ERR_R_SYS_LIB);
                 return NULL;
                 }
 
-        ltmp = CONF_load_fp(h, in, line);
-        fclose(in);
+        ltmp = CONF_load_bio(h, in, line);
+        BIO_free(in);
 
         return ltmp;
 }
-
+#ifndef NO_FP_API
 LHASH *CONF_load_fp(LHASH *h, FILE *in, long *line)
 {
         BIO *btmp;
@@ -120,6 +117,7 @@ LHASH *CONF_load_fp(LHASH *h, FILE *in, long *line)
         BIO_free(btmp);
         return ltmp;
 }
+#endif
 
 LHASH *CONF_load_bio(LHASH *h, BIO *in, long *line)
         {
@@ -338,7 +336,7 @@ again:
                                                         ERR_R_MALLOC_FAILURE);
                                 goto err;
                                 }
-                        vv=(CONF_VALUE *)lh_insert(ret,(char *)v);
+                        vv=(CONF_VALUE *)lh_insert(ret,v);
                         if (vv != NULL)
                                 {
                                 sk_CONF_VALUE_delete_ptr(ts,vv);
@@ -380,7 +378,7 @@ char *CONF_get_string(LHASH *conf, char *section, char *name)
                         {
                         vv.name=name;
                         vv.section=section;
-                        v=(CONF_VALUE *)lh_retrieve(conf,(char *)&vv);
+                        v=(CONF_VALUE *)lh_retrieve(conf,&vv);
                         if (v != NULL) return(v->value);
                         if (strcmp(section,"ENV") == 0)
                                 {
@@ -390,7 +388,7 @@ char *CONF_get_string(LHASH *conf, char *section, char *name)
                         }
                 vv.section="default";
                 vv.name=name;
-                v=(CONF_VALUE *)lh_retrieve(conf,(char *)&vv);
+                v=(CONF_VALUE *)lh_retrieve(conf,&vv);
                 if (v != NULL)
                         return(v->value);
                 else
@@ -407,7 +405,7 @@ static CONF_VALUE *get_section(LHASH *conf, char *section)
         if ((conf == NULL) || (section == NULL)) return(NULL);
         vv.name=NULL;
         vv.section=section;
-        v=(CONF_VALUE *)lh_retrieve(conf,(char *)&vv);
+        v=(CONF_VALUE *)lh_retrieve(conf,&vv);
         return(v);
         }
 
@@ -445,12 +443,12 @@ void CONF_free(LHASH *conf)
 
         conf->down_load=0;      /* evil thing to make sure the 'Free()'
                                  * works as expected */
-        lh_doall_arg(conf,(void (*)())value_free_hash,(char *)conf);
+        lh_doall_arg(conf,(void (*)())value_free_hash,conf);
 
         /* We now have only 'section' entries in the hash table.
          * Due to problems with */
 
-        lh_doall_arg(conf,(void (*)())value_free_stack,(char *)conf);
+        lh_doall_arg(conf,(void (*)())value_free_stack,conf);
         lh_free(conf);
         }
 
@@ -458,7 +456,7 @@ static void value_free_hash(CONF_VALUE *a, LHASH *conf)
         {
         if (a->name != NULL)
                 {
-                a=(CONF_VALUE *)lh_delete(conf,(char *)a);
+                a=(CONF_VALUE *)lh_delete(conf,a);
                 }
         }
 
@@ -710,7 +708,7 @@ static CONF_VALUE *new_section(LHASH *conf, char *section)
         v->name=NULL;
         v->value=(char *)sk;
         
-        vv=(CONF_VALUE *)lh_insert(conf,(char *)v);
+        vv=(CONF_VALUE *)lh_insert(conf,v);
         if (vv != NULL)
                 {
 #if !defined(NO_STDIO) && !defined(WIN16)
diff --git a/src/lib/libssl/src/crypto/conf/conf.h b/src/lib/libssl/src/crypto/conf/conf.h
index e7c5150097..21831a92a3 100644
--- a/src/lib/libssl/src/crypto/conf/conf.h
+++ b/src/lib/libssl/src/crypto/conf/conf.h
@@ -78,7 +78,9 @@ typedef struct
 DECLARE_STACK_OF(CONF_VALUE)
 
 LHASH *CONF_load(LHASH *conf,const char *file,long *eline);
+#ifndef NO_FP_API
 LHASH *CONF_load_fp(LHASH *conf, FILE *fp,long *eline);
+#endif
 LHASH *CONF_load_bio(LHASH *conf, BIO *bp,long *eline);
 STACK_OF(CONF_VALUE) *CONF_get_section(LHASH *conf,char *section);
 char *CONF_get_string(LHASH *conf,char *group,char *name);
diff --git a/src/lib/libssl/src/crypto/cryptlib.c b/src/lib/libssl/src/crypto/cryptlib.c
index 356c476a99..a8f29f1e65 100644
--- a/src/lib/libssl/src/crypto/cryptlib.c
+++ b/src/lib/libssl/src/crypto/cryptlib.c
@@ -92,7 +92,9 @@ static const char* lock_names[CRYPTO_NUM_LOCKS] =
         "getservbyname",
         "readdir",
         "RSA_blinding",
-#if CRYPTO_NUM_LOCKS != 24
+        "dh",
+        "debug_malloc2",
+#if CRYPTO_NUM_LOCKS != 26
 # error "Inconsistency between crypto.h and cryptlib.c"
 #endif
         };
@@ -181,7 +183,7 @@ unsigned long CRYPTO_thread_id(void)
                 ret=(unsigned long)GetCurrentTask();
 #elif defined(WIN32)
                 ret=(unsigned long)GetCurrentThreadId();
-#elif defined(MSDOS)
+#elif defined(GETPID_IS_MEANINGLESS)
                 ret=1L;
 #else
                 ret=(unsigned long)getpid();
diff --git a/src/lib/libssl/src/crypto/crypto-lib.com b/src/lib/libssl/src/crypto/crypto-lib.com
index bf916528eb..79d86771e8 100644
--- a/src/lib/libssl/src/crypto/crypto-lib.com
+++ b/src/lib/libssl/src/crypto/crypto-lib.com
@@ -14,7 +14,14 @@ $!
 $!  It was re-written so it would try to determine what "C" compiler to use 
 $!  or you can specify which "C" compiler to use.
 $!
-$!  Specify RSAREF as P1 to compile with the RSAREF library instead of
+$!  Specify the following as P1 to build just that part or ALL to just
+$!  build everything.
+$!
+$!              LIBRARY    To just compile the [.xxx.EXE.CRYPTO]LIBCRYPTO.OLB Library.
+$!              APPS       To just compile the [.xxx.EXE.CRYPTO]*.EXE
+$!              ALL        To do both LIBRARY and APPS
+$!
+$!  Specify RSAREF as P2 to compile with the RSAREF library instead of
 $!  the regular one.  If you specify NORSAREF it will compile with the
 $!  regular RSAREF routines.  (Note: If you are in the United States
 $!  you MUST compile with RSAREF unless you have a license from RSA).
@@ -26,10 +33,10 @@ $!        directory structure stored.  You have to extract the file
 $!        into the [.RSAREF] directory under the root directory as that
 $!        is where the scripts will look for the files.
 $!
-$!  Specify DEBUG or NODEBUG as P2 to compile with or without debugger
+$!  Specify DEBUG or NODEBUG as P3 to compile with or without debugger
 $!  information.
 $!
-$!  Specify which compiler at P3 to try to compile under.
+$!  Specify which compiler at P4 to try to compile under.
 $!
 $!         VAXC  For VAX C.
 $!         DECC  For DEC C.
@@ -38,15 +45,15 @@ $!
 $!  If you don't speficy a compiler, it will try to determine which
 $!  "C" compiler to use.
 $!
-$!  P4, if defined, sets a TCP/IP library to use, through one of the following
+$!  P5, if defined, sets a TCP/IP library to use, through one of the following
 $!  keywords:
 $!
 $!      UCX             for UCX
 $!      SOCKETSHR       for SOCKETSHR+NETLIB
 $!
-$!  P5, if defined, sets a compiler thread NOT needed on OpenVMS 7.1 (and up)
+$!  P6, if defined, sets a compiler thread NOT needed on OpenVMS 7.1 (and up)
 $!
-$!  P6, if defined, sets a choice of crypto methods to compile.
+$!  P7, if defined, sets a choice of crypto methods to compile.
 $!  WARNING: this should only be done to recompile some part of an already
 $!  fully compiled library.
 $!
@@ -79,12 +86,13 @@ $ ENDIF
 $!
 $! Define The Different Encryption Types.
 $!
-$ ENCRYPT_TYPES = ",MD2,MD5,SHA,MDC2,HMAC,RIPEMD,"+ -
+$ ENCRYPT_TYPES = "Basic,MD2,MD5,SHA,MDC2,HMAC,RIPEMD,"+ -
                   "DES,RC2,RC4,RC5,IDEA,BF,CAST,"+ -
                   "BN,RSA,DSA,DH,"+ -
                   "BUFFER,BIO,STACK,LHASH,RAND,ERR,OBJECTS,"+ -
                   "EVP,EVP_2,ASN1,ASN1_2,PEM,X509,X509V3,"+ -
                   "CONF,TXT_DB,PKCS7,PKCS12,COMP"
+$ ENCRYPT_PROGRAMS = "DES,PKCS7"
 $!
 $! Check To Make Sure We Have Valid Command Line Parameters.
 $!
@@ -136,6 +144,14 @@ $! Define The Library Name.
 $!
 $ LIB_NAME := 'EXE_DIR'LIBCRYPTO.OLB
 $!
+$! Define The CRYPTO-LIB We Are To Use.
+$!
+$ CRYPTO_LIB := 'EXE_DIR'LIBCRYPTO.OLB
+$!
+$! Define The RSAREF-LIB We Are To Use.
+$!
+$ RSAREF_LIB := SYS$DISK:[-.'ARCH'.EXE.RSAREF]LIBRSAGLUE.OLB
+$!
 $! Check To See If We Already Have A "[.xxx.EXE.CRYPTO]LIBCRYPTO.OLB" Library...
 $!
 $ IF (F$SEARCH(LIB_NAME).EQS."")
@@ -149,9 +165,16 @@ $! End The Library Check.
 $!
 $ ENDIF
 $!
+$! Build our options file for the application
+$!
+$ GOSUB CHECK_OPT_FILE
+$!
 $! Define The Different Encryption "library" Strings.
 $!
-$ LIB_ = "cryptlib,mem,cversion,ex_data,tmdiff,cpt_err"
+$ APPS_DES = "DES/DES,CBC3_ENC"
+$ APPS_PKCS7 = "ENC/ENC;DEC/DEC;SIGN/SIGN;VERIFY/VERIFY,EXAMPLE"
+$
+$ LIB_ = "cryptlib,mem,mem_dbg,cversion,ex_data,tmdiff,cpt_err"
 $ LIB_MD2 = "md2_dgst,md2_one"
 $ LIB_MD5 = "md5_dgst,md5_one"
 $ LIB_SHA = "sha_dgst,sha1dgst,sha_one,sha1_one"
@@ -171,14 +194,14 @@ $ LIB_IDEA = "i_cbc,i_cfb64,i_ofb64,i_ecb,i_skey"
 $ LIB_BF = "bf_skey,bf_ecb,bf_enc,bf_cfb64,bf_ofb64"
 $ LIB_CAST = "c_skey,c_ecb,c_enc,c_cfb64,c_ofb64"
 $ LIB_BN_ASM = "[.asm]vms.mar,vms-helper"
-$ IF F$TRNLNM("OPENSSL_NO_ASM") .NES. "" THEN LIB_BN_ASM = "bn_asm"
-$ LIB_BN = "bn_add,bn_div,bn_exp,bn_lib,bn_mul,"+ -
+$ IF F$TRNLNM("OPENSSL_NO_ASM").OR.ARCH.EQS."AXP" THEN LIB_BN_ASM = "bn_asm"
+$ LIB_BN = "bn_add,bn_div,bn_exp,bn_lib,bn_ctx,bn_mul,"+ -
         "bn_print,bn_rand,bn_shift,bn_word,bn_blind,"+ -
         "bn_gcd,bn_prime,bn_err,bn_sqr,"+LIB_BN_ASM+",bn_recp,bn_mont,"+ -
         "bn_mpi,bn_exp2"
 $ LIB_RSA = "rsa_eay,rsa_gen,rsa_lib,rsa_sign,rsa_saos,rsa_err,"+ -
-        "rsa_pk1,rsa_ssl,rsa_none,rsa_oaep,rsa_chk"
-$ LIB_DSA = "dsa_gen,dsa_key,dsa_lib,dsa_asn1,dsa_vrf,dsa_sign,dsa_err"
+        "rsa_pk1,rsa_ssl,rsa_none,rsa_oaep,rsa_chk,rsa_null"
+$ LIB_DSA = "dsa_gen,dsa_key,dsa_lib,dsa_asn1,dsa_vrf,dsa_sign,dsa_err,dsa_ossl"
 $ LIB_DH = "dh_gen,dh_key,dh_lib,dh_check,dh_err"
 $ LIB_BUFFER = "buffer,buf_err"
 $ LIB_BIO = "bio_lib,bio_cb,bio_err,"+ -
@@ -188,7 +211,7 @@ $ LIB_BIO = "bio_lib,bio_cb,bio_err,"+ -
         "b_sock,bss_acpt,bf_nbio,bss_rtcp,bss_bio" ! + ",bss_log" for syslog
 $ LIB_STACK = "stack"
 $ LIB_LHASH = "lhash,lh_stats"
-$ LIB_RAND = "md_rand,randfile,rand_lib"
+$ LIB_RAND = "md_rand,randfile,rand_lib,rand_err,rand_egd"
 $ LIB_ERR = "err,err_all,err_prn"
 $ LIB_OBJECTS = "o_names,obj_dat,obj_lib,obj_err"
 $ LIB_EVP = "encode,digest,evp_enc,evp_key,"+ -
@@ -204,38 +227,39 @@ $ LIB_EVP_2 = "e_ecb_c,e_cbc_c,e_cfb_c,e_ofb_c,"+ -
         "m_ripemd,"+ -
         "p_open,p_seal,p_sign,p_verify,p_lib,p_enc,p_dec,"+ -
         "bio_md,bio_b64,bio_enc,evp_err,e_null,"+ -
-        "c_all,evp_lib,bio_ok,evp_pkey,evp_pbe,p5_crpt,p5_crpt2"
+        "c_all,c_allc,c_alld,evp_lib,bio_ok,"+-
+        "evp_pkey,evp_pbe,p5_crpt,p5_crpt2"
 $ LIB_ASN1 = "a_object,a_bitstr,a_utctm,a_gentm,a_time,a_int,a_octet,"+ -
-        "a_print,a_type,a_set,a_dup,a_d2i_fp,a_i2d_fp,a_bmp,"+ -
-        "a_enum,a_vis,a_utf8,a_sign,a_digest,a_verify,"+ -
+        "a_null,a_print,a_type,a_set,a_dup,a_d2i_fp,a_i2d_fp,a_bmp,"+ -
+        "a_enum,a_vis,a_utf8,a_sign,a_digest,a_verify,a_mbstr,"+ -
         "x_algor,x_val,x_pubkey,x_sig,x_req,x_attrib,"+ -
-        "x_name,x_cinf,x_x509,x_crl,x_info,x_spki,nsseq,"+ -
+        "x_name,x_cinf,x_x509,x_x509a,x_crl,x_info,x_spki,nsseq,"+ -
         "d2i_r_pr,i2d_r_pr,d2i_r_pu,i2d_r_pu,"+ -
         "d2i_s_pr,i2d_s_pr,d2i_s_pu,i2d_s_pu,"+ -
         "d2i_pu,d2i_pr,i2d_pu,i2d_pr"
-$ LIB_ASN1_2 = "t_req,t_x509,t_crl,t_pkey,"+ -
+$ LIB_ASN1_2 = "t_req,t_x509,t_x509a,t_crl,t_pkey,t_spki,t_bitst,"+ -
         "p7_i_s,p7_signi,p7_signd,p7_recip,p7_enc_c,p7_evp,"+ -
         "p7_dgst,p7_s_e,p7_enc,p7_lib,"+ -
         "f_int,f_string,i2d_dhp,i2d_dsap,d2i_dhp,d2i_dsap,n_pkey,"+ -
         "f_enum,a_hdr,x_pkey,a_bool,x_exten,"+ -
-        "asn1_par,asn1_lib,asn1_err,a_meth,a_bytes,"+ -
+        "asn1_par,asn1_lib,asn1_err,a_meth,a_bytes,a_strnid,"+ -
         "evp_asn1,asn_pack,p5_pbe,p5_pbev2,p8_pkey"
 $ LIB_PEM = "pem_sign,pem_seal,pem_info,pem_lib,pem_all,pem_err"
 $ LIB_X509 = "x509_def,x509_d2,x509_r2x,x509_cmp,"+ -
-        "x509_obj,x509_req,x509_vfy,"+ -
+        "x509_obj,x509_req,x509spki,x509_vfy,"+ -
         "x509_set,x509rset,x509_err,"+ -
-        "x509name,x509_v3,x509_ext,"+ -
+        "x509name,x509_v3,x509_ext,x509_att,"+ -
         "x509type,x509_lu,x_all,x509_txt,"+ -
-        "by_file,by_dir"
+        "x509_trs,by_file,by_dir"
 $ LIB_X509V3 = "v3_bcons,v3_bitst,v3_conf,v3_extku,v3_ia5,v3_lib,"+ -
         "v3_prn,v3_utl,v3err,v3_genn,v3_alt,v3_skey,v3_akey,v3_pku,"+ -
-        "v3_int,v3_enum,v3_sxnet,v3_cpols,v3_crld"
+        "v3_int,v3_enum,v3_sxnet,v3_cpols,v3_crld,v3_purp,v3_info"
 $ LIB_CONF = "conf,conf_err"
 $ LIB_TXT_DB = "txt_db"
-$ LIB_PKCS7 = "pk7_lib,pkcs7err,pk7_doit"
+$ LIB_PKCS7 = "pk7_lib,pkcs7err,pk7_doit,pk7_smime,pk7_attr,pk7_mime"
 $ LIB_PKCS12 = "p12_add,p12_attr,p12_bags,p12_crpt,p12_crt,p12_decr,"+ -
         "p12_init,p12_key,p12_kiss,p12_lib,p12_mac,p12_mutl,"+ -
-        "p12_sbag,p12_utl,pk12err"
+        "p12_sbag,p12_utl,p12_npas,pk12err"
 $ LIB_COMP = "comp_lib,"+ -
         "c_rle,c_zlib"
 $!
@@ -248,7 +272,8 @@ $ COMPILEWITH_CC5 = ",md2_dgst,md5_dgst,mdc2dgst,sha_dgst,sha1dgst," + -
 $!
 $! Check To See If We Are Going To Use RSAREF.
 $!
-$ IF (RSAREF.EQS."TRUE" .AND. ENCRYPT_TYPES - "RSA".NES.ENCRYPT_TYPES)
+$ IF (RSAREF.EQS."TRUE" .AND. ENCRYPT_TYPES - "RSA".NES.ENCRYPT_TYPES -
+      .AND. (BUILDALL .EQS. "TRUE" .OR. BUILDALL .EQS. "LIBRARY"))
 $ THEN
 $!
 $!  Check To See If The File [-.RSAREF]RSAREF.C Is Actually There.
@@ -340,6 +365,8 @@ $!
 $! Extract The Module Name From The Encryption List.
 $!
 $ MODULE_NAME = F$ELEMENT(MODULE_COUNTER,",",ENCRYPT_TYPES)
+$ IF MODULE_NAME.EQS."Basic" THEN MODULE_NAME = ""
+$ MODULE_NAME1 = MODULE_NAME
 $!
 $! Check To See If We Are At The End Of The Module List.
 $!
@@ -358,20 +385,10 @@ $! Increment The Moudle Counter.
 $!
 $ MODULE_COUNTER = MODULE_COUNTER + 1
 $!
-$! Tell The User What Module We Are Building.
-$!
-$ IF (MODULE_NAME.NES."") 
-$ THEN
-$   WRITE SYS$OUTPUT "Compiling The ",MODULE_NAME," Files."
-$ ENDIF
-$!
-$!  Define A File Counter And Set It To "0".
-$!
-$ FILE_COUNTER = 0
-$!
-$! Create The Library Module Name.
+$! Create The Library and Apps Module Names.
 $!
 $ LIB_MODULE = "LIB_" + MODULE_NAME
+$ APPS_MODULE = "APPS_" + MODULE_NAME
 $ IF (MODULE_NAME.EQS."ASN1_2")
 $ THEN
 $   MODULE_NAME = "ASN1"
@@ -381,6 +398,11 @@ $ THEN
 $   MODULE_NAME = "EVP"
 $ ENDIF
 $!
+$! Set state (can be LIB and APPS)
+$!
+$ STATE = "LIB"
+$ IF BUILDALL .EQS. "APPS" THEN STATE = "APPS"
+$!
 $! Check if the library module name actually is defined
 $!
 $ IF F$TYPE('LIB_MODULE') .EQS. ""
@@ -391,22 +413,92 @@ $   WRITE SYS$ERROR ""
 $   GOTO MODULE_NEXT
 $ ENDIF
 $!
+$! Top Of The Module Loop.
+$!
+$ MODULE_AGAIN:
+$!
+$! Tell The User What Module We Are Building.
+$!
+$ IF (MODULE_NAME1.NES."") 
+$ THEN
+$   IF STATE .EQS. "LIB"
+$   THEN
+$     WRITE SYS$OUTPUT "Compiling The ",MODULE_NAME1," Library Files. (",BUILDALL,",",STATE,")"
+$   ELSE IF F$TYPE('APPS_MODULE') .NES. ""
+$     THEN
+$       WRITE SYS$OUTPUT "Compiling The ",MODULE_NAME1," Applications. (",BUILDALL,",",STATE,")"
+$     ENDIF
+$   ENDIF
+$ ENDIF
+$!
+$!  Define A File Counter And Set It To "0".
+$!
+$ FILE_COUNTER = 0
+$ APPLICATION = ""
+$ APPLICATION_COUNTER = 0
+$!
 $! Top Of The File Loop.
 $!
 $ NEXT_FILE:
 $!
-$! O.K, Extract The File Name From The File List.
+$! Look in the LIB_MODULE is we're in state LIB
+$!
+$ IF STATE .EQS. "LIB"
+$ THEN
+$!
+$!   O.K, Extract The File Name From The File List.
+$!
+$   FILE_NAME = F$ELEMENT(FILE_COUNTER,",",'LIB_MODULE')
+$!
+$!   else
+$!
+$ ELSE
+$   FILE_NAME = ","
+$!
+$   IF F$TYPE('APPS_MODULE') .NES. ""
+$   THEN
+$!
+$!     Extract The File Name From The File List.
+$!     This part is a bit more complicated.
 $!
-$ FILE_NAME = F$ELEMENT(FILE_COUNTER,",",'LIB_MODULE')
+$     IF APPLICATION .EQS. ""
+$     THEN
+$       APPLICATION = F$ELEMENT(APPLICATION_COUNTER,";",'APPS_MODULE')
+$       APPLICATION_COUNTER = APPLICATION_COUNTER + 1
+$       APPLICATION_OBJECTS = F$ELEMENT(1,"/",APPLICATION)
+$       APPLICATION = F$ELEMENT(0,"/",APPLICATION)
+$       FILE_COUNTER = 0
+$     ENDIF
+$
+$!     WRITE SYS$OUTPUT "DEBUG: SHOW SYMBOL APPLICATION*"
+$!     SHOW SYMBOL APPLICATION*
+$!
+$     IF APPLICATION .NES. ";"
+$     THEN
+$       FILE_NAME = F$ELEMENT(FILE_COUNTER,",",APPLICATION_OBJECTS)
+$       IF FILE_NAME .EQS. ","
+$       THEN
+$         APPLICATION = ""
+$         GOTO NEXT_FILE
+$       ENDIF
+$     ENDIF
+$   ENDIF
+$ ENDIF
 $!
 $! Check To See If We Are At The End Of The File List.
 $!
 $ IF (FILE_NAME.EQS.",") 
 $ THEN 
 $!
-$!  We Are At The End Of The File List, Goto FILE_DONE.
+$!  We Are At The End Of The File List, Change State Or Goto FILE_DONE.
 $!
-$   GOTO FILE_DONE
+$   IF STATE .EQS. "LIB" .AND. BUILDALL .NES. "LIBRARY"
+$   THEN
+$     STATE = "APPS"
+$     GOTO MODULE_AGAIN
+$   ELSE
+$     GOTO FILE_DONE
+$   ENDIF
 $!
 $! End The File List Check.
 $!
@@ -458,7 +550,7 @@ $! Tell The User We Are Compiling The File.
 $!
 $ IF (MODULE_NAME.EQS."")
 $ THEN
-     WRITE SYS$OUTPUT "Compiling The ",FILE_NAME," File."
+$   WRITE SYS$OUTPUT "Compiling The ",FILE_NAME," File.  (",BUILDALL,",",STATE,")"
 $ ENDIF
 $ IF (MODULE_NAME.NES."")
 $ THEN 
@@ -490,14 +582,17 @@ $       ENDIF
 $     ENDIF
 $   ENDIF
 $ ENDIF
+$ IF STATE .EQS. "LIB"
+$ THEN 
 $!
-$! Add It To The Library.
+$!   Add It To The Library.
 $!
-$ LIBRARY/REPLACE 'LIB_NAME' 'OBJECT_FILE'
+$   LIBRARY/REPLACE 'LIB_NAME' 'OBJECT_FILE'
 $!
-$! Time To Clean Up The Object File.
+$!   Time To Clean Up The Object File.
 $!
-$ DELETE 'OBJECT_FILE';*
+$   DELETE 'OBJECT_FILE';*
+$ ENDIF
 $!
 $! Go Back And Do It Again.
 $!
@@ -507,6 +602,99 @@ $! All Done With This Library Part.
 $!
 $ FILE_DONE:
 $!
+$! Time To Build Some Applications
+$!
+$ IF F$TYPE('APPS_MODULE') .NES. "" .AND. BUILDALL .NES. "LIBRARY"
+$ THEN
+$   APPLICATION_COUNTER = 0
+$ NEXT_APPLICATION:
+$   APPLICATION = F$ELEMENT(APPLICATION_COUNTER,";",'APPS_MODULE')
+$   IF APPLICATION .EQS. ";" THEN GOTO APPLICATION_DONE
+$
+$   APPLICATION_COUNTER = APPLICATION_COUNTER + 1
+$   APPLICATION_OBJECTS = F$ELEMENT(1,"/",APPLICATION)
+$   APPLICATION = F$ELEMENT(0,"/",APPLICATION)
+$
+$!   WRITE SYS$OUTPUT "DEBUG: SHOW SYMBOL APPLICATION*"
+$!   SHOW SYMBOL APPLICATION*
+$!
+$! Tell the user what happens
+$!
+$   WRITE SYS$OUTPUT "  ",APPLICATION,".exe"
+$!
+$! Link The Program, Check To See If We Need To Link With RSAREF Or Not.
+$!
+$   IF (RSAREF.EQS."TRUE")
+$   THEN
+$!
+$!  Check To See If We Are To Link With A Specific TCP/IP Library.
+$!
+$     IF (TCPIP_LIB.NES."")
+$     THEN
+$!
+$!    Link With The RSAREF Library And A Specific TCP/IP Library.
+$!
+$       LINK/'DEBUGGER'/'TRACEBACK'/EXE='EXE_DIR''APPLICATION'.EXE -
+            'OBJ_DIR''APPLICATION_OBJECTS', -
+            'CRYPTO_LIB'/LIBRARY,'RSAREF_LIB'/LIBRARY, -
+            'TCPIP_LIB','OPT_FILE'/OPTION
+$!
+$!    Else...
+$!
+$     ELSE
+$!
+$!      Link With The RSAREF Library And NO TCP/IP Library.
+$!
+$       LINK/'DEBUGGER'/'TRACEBACK'/EXE='EXE_DIR''APPLICATION'.EXE -
+            'OBJ_DIR''APPLICATION_OBJECTS', -
+            'CRYPTO_LIB'/LIBRARY,'RSAREF_LIB'/LIBRARY, -
+            'OPT_FILE'/OPTION
+$!
+$!    End The TCP/IP Library Check.
+$!
+$     ENDIF
+$!
+$!   Else...
+$!
+$   ELSE
+$!
+$!    Don't Link With The RSAREF Routines.
+$!
+$!
+$!    Check To See If We Are To Link With A Specific TCP/IP Library.
+$!
+$     IF (TCPIP_LIB.NES."")
+$     THEN
+$!
+$!      Don't Link With The RSAREF Routines And TCP/IP Library.
+$!
+$       LINK/'DEBUGGER'/'TRACEBACK'/EXE='EXE_DIR''APPLICATION'.EXE -
+            'OBJ_DIR''APPLICATION_OBJECTS', -
+            'CRYPTO_LIB'/LIBRARY, -
+            'TCPIP_LIB','OPT_FILE'/OPTION
+$!
+$!    Else...
+$!
+$     ELSE
+$!
+$!      Don't Link With The RSAREF Routines And Link With A TCP/IP Library.
+$!
+$       LINK/'DEBUGGER'/'TRACEBACK'/EXE='EXE_DIR''APPLICATION'.EXE -
+            'OBJ_DIR''APPLICATION_OBJECTS',-
+            'CRYPTO_LIB'/LIBRARY, -
+            'OPT_FILE'/OPTION
+$!
+$!    End The TCP/IP Library Check.
+$!
+$     ENDIF
+$!
+$!   End The RSAREF Link Check.
+$!
+$   ENDIF
+$   GOTO NEXT_APPLICATION
+$  APPLICATION_DONE:
+$ ENDIF
+$!
 $! Go Back And Get The Next Module.
 $!
 $ GOTO MODULE_NEXT
@@ -653,17 +841,70 @@ $ CHECK_OPTIONS:
 $!
 $! Check To See If P1 Is Blank.
 $!
-$ IF (P1.EQS."NORSAREF")
+$ IF (P1.EQS."ALL")
 $ THEN
 $!
-$!   P1 Is NORSAREF, So Compile With The Regular RSA Libraries.
+$!   P1 Is Blank, So Build Everything.
+$!
+$    BUILDALL = "TRUE"
+$!
+$! Else...
+$!
+$ ELSE
+$!
+$!  Else, Check To See If P1 Has A Valid Arguement.
+$!
+$   IF (P1.EQS."LIBRARY").OR.(P1.EQS."APPS")
+$   THEN
+$!
+$!    A Valid Arguement.
+$!
+$     BUILDALL = P1
+$!
+$!  Else...
+$!
+$   ELSE
+$!
+$!    Tell The User We Don't Know What They Want.
+$!
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "The Option ",P1," Is Invalid.  The Valid Options Are:"
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "    ALL      :  Just Build Everything."
+$     WRITE SYS$OUTPUT "    LIBRARY  :  To Compile Just The [.xxx.EXE.SSL]LIBCRYPTO.OLB Library."
+$     WRITE SYS$OUTPUT "    APPS     :  To Compile Just The [.xxx.EXE.SSL]*.EXE Programs."
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT " Where 'xxx' Stands For:"
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "        AXP  :  Alpha Architecture."
+$     WRITE SYS$OUTPUT "        VAX  :  VAX Architecture."
+$     WRITE SYS$OUTPUT ""
+$!
+$!    Time To EXIT.
+$!
+$     EXIT
+$!
+$!  End The Valid Arguement Check.
+$!
+$   ENDIF
+$!
+$! End The P1 Check.
+$!
+$ ENDIF
+$!
+$! Check To See If P2 Is Blank.
+$!
+$ IF (P2.EQS."NORSAREF")
+$ THEN
+$!
+$!   P2 Is NORSAREF, So Compile With The Regular RSA Libraries.
 $!
 $    RSAREF = "FALSE"
 $ ELSE
 $!
 $!  Check To See If We Are To Use The RSAREF Library.
 $!
-$   IF (P1.EQS."RSAREF")
+$   IF (P2.EQS."RSAREF")
 $   THEN
 $!
 $!    Check To Make Sure We Have The RSAREF Source Code Directory.
@@ -697,7 +938,7 @@ $!
 $!    They Entered An Invalid Option..
 $!
 $     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT "The Option ",P1," Is Invalid.  The Valid Options Are:"
+$     WRITE SYS$OUTPUT "The Option ",P2," Is Invalid.  The Valid Options Are:"
 $     WRITE SYS$OUTPUT ""
 $     WRITE SYS$OUTPUT "     RSAREF   :  Compile With The RSAREF Library."
 $     WRITE SYS$OUTPUT "     NORSAREF :  Compile With The Regular RSA Library."
@@ -711,16 +952,16 @@ $!  End The Valid Arguement Check.
 $!
 $   ENDIF
 $!
-$! End The P1 Check.
+$! End The P2 Check.
 $!
 $ ENDIF
 $!
-$! Check To See If P2 Is Blank.
+$! Check To See If P3 Is Blank.
 $!
-$ IF (P2.EQS."NODEBUG")
+$ IF (P3.EQS."NODEBUG")
 $ THEN
 $!
-$!   P2 Is NODEBUG, So Compile Without The Debugger Information.
+$!   P3 Is NODEBUG, So Compile Without The Debugger Information.
 $!
 $    DEBUGGER = "NODEBUG"
 $    TRACEBACK = "NOTRACEBACK" 
@@ -733,7 +974,7 @@ $ ELSE
 $!
 $!  Check To See If We Are To Compile With Debugger Information.
 $!
-$   IF (P2.EQS."DEBUG")
+$   IF (P3.EQS."DEBUG")
 $   THEN
 $!
 $!    Compile With Debugger Information.
@@ -750,7 +991,7 @@ $!
 $!    They Entered An Invalid Option..
 $!
 $     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT "The Option ",P2," Is Invalid.  The Valid Options Are:"
+$     WRITE SYS$OUTPUT "The Option ",P3," Is Invalid.  The Valid Options Are:"
 $     WRITE SYS$OUTPUT ""
 $     WRITE SYS$OUTPUT "     DEBUG   :  Compile With The Debugger Information."
 $     WRITE SYS$OUTPUT "     NODEBUG :  Compile Without The Debugger Information."
@@ -764,7 +1005,7 @@ $!  End The Valid Arguement Check.
 $!
 $   ENDIF
 $!
-$! End The P2 Check.
+$! End The P3 Check.
 $!
 $ ENDIF
 $!
@@ -774,9 +1015,9 @@ $! Written By:  Richard Levitte
 $!              richard@levitte.org
 $!
 $!
-$! Check To See If We Have A Option For P5.
+$! Check To See If We Have A Option For P6.
 $!
-$ IF (P5.EQS."")
+$ IF (P6.EQS."")
 $ THEN
 $!
 $!  Get The Version Of VMS We Are Using.
@@ -798,13 +1039,13 @@ $!  End The VMS Version Check.
 $!
 $   ENDIF
 $!
-$! End The P5 Check.
+$! End The P6 Check.
 $!
 $ ENDIF
 $!
-$! Check To See If P3 Is Blank.
+$! Check To See If P4 Is Blank.
 $!
-$ IF (P3.EQS."")
+$ IF (P4.EQS."")
 $ THEN
 $!
 $!  O.K., The User Didn't Specify A Compiler, Let's Try To
@@ -817,7 +1058,7 @@ $   THEN
 $!
 $!    Looks Like GNUC, Set To Use GNUC.
 $!
-$     P3 = "GNUC"
+$     P4 = "GNUC"
 $!
 $!  Else...
 $!
@@ -830,7 +1071,7 @@ $     THEN
 $!
 $!      Looks Like DECC, Set To Use DECC.
 $!
-$       P3 = "DECC"
+$       P4 = "DECC"
 $!
 $!    Else...
 $!
@@ -838,7 +1079,7 @@ $     ELSE
 $!
 $!      Looks Like VAXC, Set To Use VAXC.
 $!
-$       P3 = "VAXC"
+$       P4 = "VAXC"
 $!
 $!    End The VAXC Compiler Check.
 $!
@@ -852,9 +1093,9 @@ $!  End The Compiler Check.
 $!
 $ ENDIF
 $!
-$! Check To See If We Have A Option For P4.
+$! Check To See If We Have A Option For P5.
 $!
-$ IF (P4.EQS."")
+$ IF (P5.EQS."")
 $ THEN
 $!
 $!  Find out what socket library we have available
@@ -864,7 +1105,7 @@ $   THEN
 $!
 $!    We have SOCKETSHR, and it is my opinion that it's the best to use.
 $!
-$     P4 = "SOCKETSHR"
+$     P5 = "SOCKETSHR"
 $!
 $!    Tell the user
 $!
@@ -884,7 +1125,7 @@ $     THEN
 $!
 $!      Last resort: a UCX or UCX-compatible library
 $!
-$       P4 = "UCX"
+$       P5 = "UCX"
 $!
 $!      Tell the user
 $!
@@ -898,22 +1139,46 @@ $ ENDIF
 $!
 $! Set Up Initial CC Definitions, Possibly With User Ones
 $!
-$ CCDEFS = "VMS=1,TCPIP_TYPE_''P4'"
+$ CCDEFS = "VMS=1,TCPIP_TYPE_''P5'"
+$ IF F$TRNLNM("OPENSSL_NO_ASM") THEN CCDEFS = CCDEFS + ",NO_ASM"
+$ IF F$TRNLNM("OPENSSL_NO_RSA") THEN CCDEFS = CCDEFS + ",NO_RSA"
+$ IF F$TRNLNM("OPENSSL_NO_DSA") THEN CCDEFS = CCDEFS + ",NO_DSA"
+$ IF F$TRNLNM("OPENSSL_NO_DH") THEN CCDEFS = CCDEFS + ",NO_DH"
+$ IF F$TRNLNM("OPENSSL_NO_MD2") THEN CCDEFS = CCDEFS + ",NO_MD2"
+$ IF F$TRNLNM("OPENSSL_NO_MD5") THEN CCDEFS = CCDEFS + ",NO_MD5"
+$ IF F$TRNLNM("OPENSSL_NO_RIPEMD") THEN CCDEFS = CCDEFS + ",NO_RIPEMD"
+$ IF F$TRNLNM("OPENSSL_NO_SHA") THEN CCDEFS = CCDEFS + ",NO_SHA"
+$ IF F$TRNLNM("OPENSSL_NO_SHA0") THEN CCDEFS = CCDEFS + ",NO_SHA0"
+$ IF F$TRNLNM("OPENSSL_NO_SHA1") THEN CCDEFS = CCDEFS + ",NO_SHA1"
+$ IF F$TRNLNM("OPENSSL_NO_DES")
+$ THEN
+$   CCDEFS = CCDEFS + ",NO_DES,NO_MDC2"
+$ ELSE
+$   IF F$TRNLNM("OPENSSL_NO_MDC2") THEN CCDEFS = CCDEFS + ",NO_MDC2"
+$ ENDIF
+$ IF F$TRNLNM("OPENSSL_NO_RC2") THEN CCDEFS = CCDEFS + ",NO_RC2"
+$ IF F$TRNLNM("OPENSSL_NO_RC4") THEN CCDEFS = CCDEFS + ",NO_RC4"
+$ IF F$TRNLNM("OPENSSL_NO_RC5") THEN CCDEFS = CCDEFS + ",NO_RC5"
+$ IF F$TRNLNM("OPENSSL_NO_IDEA") THEN CCDEFS = CCDEFS + ",NO_IDEA"
+$ IF F$TRNLNM("OPENSSL_NO_BF") THEN CCDEFS = CCDEFS + ",NO_BF"
+$ IF F$TRNLNM("OPENSSL_NO_CAST") THEN CCDEFS = CCDEFS + ",NO_CAST"
+$ IF F$TRNLNM("OPENSSL_NO_HMAC") THEN CCDEFS = CCDEFS + ",NO_HMAC"
+$ IF F$TRNLNM("OPENSSL_NO_SSL2") THEN CCDEFS = CCDEFS + ",NO_SSL2"
 $ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS
 $ CCEXTRAFLAGS = ""
 $ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS
-$ CCDISABLEWARNINGS = ""
+$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"
 $ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -
-        CCDISABLEWARNINGS = USER_CCDISABLEWARNINGS
+        CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS
 $!
 $!  Check To See If The User Entered A Valid Paramter.
 $!
-$ IF (P3.EQS."VAXC").OR.(P3.EQS."DECC").OR.(P3.EQS."GNUC")
+$ IF (P4.EQS."VAXC").OR.(P4.EQS."DECC").OR.(P4.EQS."GNUC")
 $ THEN
 $!
 $!    Check To See If The User Wanted DECC.
 $!
-$   IF (P3.EQS."DECC")
+$   IF (P4.EQS."DECC")
 $   THEN
 $!
 $!    Looks Like DECC, Set To Use DECC.
@@ -942,7 +1207,7 @@ $   ENDIF
 $!
 $!  Check To See If We Are To Use VAXC.
 $!
-$   IF (P3.EQS."VAXC")
+$   IF (P4.EQS."VAXC")
 $   THEN
 $!
 $!    Looks Like VAXC, Set To Use VAXC.
@@ -980,7 +1245,7 @@ $   ENDIF
 $!
 $!  Check To See If We Are To Use GNU C.
 $!
-$   IF (P3.EQS."GNUC")
+$   IF (P4.EQS."GNUC")
 $   THEN
 $!
 $!    Looks Like GNUC, Set To Use GNUC.
@@ -1051,7 +1316,7 @@ $     CC4DISABLEWARNINGS = ""
 $   ENDIF
 $   CC3 = CC + "/DEFINE=(" + CCDEFS + ISSEVEN + ")" + CCDISABLEWARNINGS
 $   CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS
-$   IF ARCH .EQS. "VAX" .AND. COMPILER .EQS. "DECC" .AND. P2 .NES. "DEBUG"
+$   IF ARCH .EQS. "VAX" .AND. COMPILER .EQS. "DECC" .AND. P3 .NES. "DEBUG"
 $   THEN
 $     CC5 = CC + "/OPTIMIZE=NODISJOINT"
 $   ELSE
@@ -1070,7 +1335,7 @@ $!
 $!  Tell The User We Don't Know What They Want.
 $!
 $   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "The Option ",P3," Is Invalid.  The Valid Options Are:"
+$   WRITE SYS$OUTPUT "The Option ",P4," Is Invalid.  The Valid Options Are:"
 $   WRITE SYS$OUTPUT ""
 $   WRITE SYS$OUTPUT "    VAXC  :  To Compile With VAX C."
 $   WRITE SYS$OUTPUT "    DECC  :  To Compile With DEC C."
@@ -1096,12 +1361,12 @@ $   WRITE SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO
 $!
 $! Time to check the contents, and to make sure we get the correct library.
 $!
-$ IF P4.EQS."SOCKETSHR" .OR. P4.EQS."MULTINET" .OR. P4.EQS."UCX"
+$ IF P5.EQS."SOCKETSHR" .OR. P5.EQS."MULTINET" .OR. P5.EQS."UCX"
 $ THEN
 $!
 $!  Check to see if SOCKETSHR was chosen
 $!
-$   IF P4.EQS."SOCKETSHR"
+$   IF P5.EQS."SOCKETSHR"
 $   THEN
 $!
 $!    Set the library to use SOCKETSHR
@@ -1114,12 +1379,12 @@ $   ENDIF
 $!
 $!  Check to see if MULTINET was chosen
 $!
-$   IF P4.EQS."MULTINET"
+$   IF P5.EQS."MULTINET"
 $   THEN
 $!
 $!    Set the library to use UCX emulation.
 $!
-$     P4 = "UCX"
+$     P5 = "UCX"
 $!
 $!    Done with MULTINET
 $!
@@ -1127,7 +1392,7 @@ $   ENDIF
 $!
 $!  Check to see if UCX was chosen
 $!
-$   IF P4.EQS."UCX"
+$   IF P5.EQS."UCX"
 $   THEN
 $!
 $!    Set the library to use UCX.
@@ -1156,7 +1421,7 @@ $!
 $!  Tell The User We Don't Know What They Want.
 $!
 $   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "The Option ",P4," Is Invalid.  The Valid Options Are:"
+$   WRITE SYS$OUTPUT "The Option ",P5," Is Invalid.  The Valid Options Are:"
 $   WRITE SYS$OUTPUT ""
 $   WRITE SYS$OUTPUT "    SOCKETSHR  :  To link with SOCKETSHR TCP/IP library."
 $   WRITE SYS$OUTPUT "    UCX        :  To link with UCX TCP/IP library."
@@ -1173,9 +1438,9 @@ $!
 $! Check if the user wanted to compile just a subset of all the encryption
 $! methods.
 $!
-$ IF P6 .NES. ""
+$ IF P7 .NES. ""
 $ THEN
-$   ENCRYPT_TYPES = P6
+$   ENCRYPT_TYPES = P7
 $ ENDIF
 $!
 $!  Time To RETURN...
diff --git a/src/lib/libssl/src/crypto/crypto.h b/src/lib/libssl/src/crypto/crypto.h
index 8ad8c25e5a..41c937966e 100644
--- a/src/lib/libssl/src/crypto/crypto.h
+++ b/src/lib/libssl/src/crypto/crypto.h
@@ -63,17 +63,25 @@
 extern "C" {
 #endif
 
+#include <stdlib.h>
+
 #ifndef NO_FP_API
 #include <stdio.h>
 #endif
 
 #include <openssl/stack.h>
+#include <openssl/safestack.h>
 #include <openssl/opensslv.h>
 
 #ifdef CHARSET_EBCDIC
 #include <openssl/ebcdic.h>
 #endif
 
+#if defined(VMS) || defined(__VMS)
+#include "vms_idhacks.h"
+#endif
+
+
 /* Backward compatibility to SSLeay */
 /* This is more to be used to check the correct DLL is being used
  * in the MS world. */
@@ -111,7 +119,9 @@ extern "C" {
 #define CRYPTO_LOCK_GETSERVBYNAME       21
 #define CRYPTO_LOCK_READDIR             22
 #define CRYPTO_LOCK_RSA_BLINDING        23
-#define CRYPTO_NUM_LOCKS                24
+#define CRYPTO_LOCK_DH                  24
+#define CRYPTO_LOCK_MALLOC2             25
+#define CRYPTO_NUM_LOCKS                26
 
 #define CRYPTO_LOCK             1
 #define CRYPTO_UNLOCK           2
@@ -147,14 +157,16 @@ extern "C" {
 #define CRYPTO_MEM_CHECK_ENABLE 0x2     /* a bit */
 #define CRYPTO_MEM_CHECK_DISABLE 0x3    /* an enume */
 
-/*
-typedef struct crypto_mem_st
-        {
-        char *(*malloc_func)();
-        char *(*realloc_func)();
-        void (*free_func)();
-        } CRYPTO_MEM_FUNC;
-*/
+/* The following are bit values to turn on or off options connected to the
+ * malloc checking functionality */
+
+/* Adds time to the memory checking information */
+#define V_CRYPTO_MDEBUG_TIME    0x1 /* a bit */
+/* Adds thread number to the memory checking information */
+#define V_CRYPTO_MDEBUG_THREAD  0x2 /* a bit */
+
+#define V_CRYPTO_MDEBUG_ALL (V_CRYPTO_MDEBUG_TIME | V_CRYPTO_MDEBUG_THREAD)
+
 
 /* predec of the BIO type */
 typedef struct bio_st BIO_dummy;
@@ -165,24 +177,30 @@ typedef struct crypto_ex_data_st
         int dummy; /* gcc is screwing up this data structure :-( */
         } CRYPTO_EX_DATA;
 
+/* Called when a new object is created */
+typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+/* Called when an object is free()ed */
+typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+/* Called when we need to dup an object */
+typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d, 
+                                        int idx, long argl, void *argp);
+
 /* This stuff is basically class callback functions
- * The current classes are SSL_CTX, SSL, SSL_SESION, and a few more */
+ * The current classes are SSL_CTX, SSL, SSL_SESSION, and a few more */
+
 typedef struct crypto_ex_data_func_st
         {
         long argl;      /* Arbitary long */
-        char *argp;     /* Arbitary char * */
-        /* Called when a new object is created */
-        int (*new_func)(/*char *obj,
-                        char *item,int index,long argl,char *argp*/);
-        /* Called when this object is free()ed */
-        void (*free_func)(/*char *obj,
-                        char *item,int index,long argl,char *argp*/);
-
-        /* Called when we need to dup this one */
-        int (*dup_func)(/*char *obj_to,char *obj_from,
-                        char **new,int index,long argl,char *argp*/);
+        void *argp;     /* Arbitary void * */
+        CRYPTO_EX_new *new_func;
+        CRYPTO_EX_free *free_func;
+        CRYPTO_EX_dup *dup_func;
         } CRYPTO_EX_DATA_FUNCS;
 
+DECLARE_STACK_OF(CRYPTO_EX_DATA_FUNCS)
+
 /* Per class, we have a STACK of CRYPTO_EX_DATA_FUNCS for each CRYPTO_EX_DATA
  * entry.
  */
@@ -194,63 +212,54 @@ typedef struct crypto_ex_data_func_st
 #define CRYPTO_EX_INDEX_X509_STORE      4
 #define CRYPTO_EX_INDEX_X509_STORE_CTX  5
 
-/* Use this for win32 DLL's */
-#define CRYPTO_malloc_init()    CRYPTO_set_mem_functions(\
-        (char *(*)())malloc,\
-        (char *(*)())realloc,\
-        (void (*)())free)
 
-#ifdef CRYPTO_MDEBUG_ALL
-# ifndef CRYPTO_MDEBUG_TIME
-#  define CRYPTO_MDEBUG_TIME
-# endif
-# ifndef CRYPTO_MDEBUG_THREAD
-#  define CRYPTO_MDEBUG_THREAD
-# endif
-#endif
+/* This is the default callbacks, but we can have others as well:
+ * this is needed in Win32 where the application malloc and the
+ * library malloc may not be the same.
+ */
+#define CRYPTO_malloc_init()    CRYPTO_set_mem_functions(\
+        malloc, realloc, free)
 
-#if defined CRYPTO_MDEBUG_TIME || defined CRYPTO_MDEBUG_THREAD
+#if defined CRYPTO_MDEBUG_ALL || defined CRYPTO_MDEBUG_TIME || defined CRYPTO_MDEBUG_THREAD
 # ifndef CRYPTO_MDEBUG /* avoid duplicate #define */
 #  define CRYPTO_MDEBUG
 # endif
 #endif
 
-#ifdef CRYPTO_MDEBUG
+/* Set standard debugging functions (not done by default
+ * unless CRYPTO_MDEBUG is defined) */
+#define CRYPTO_malloc_debug_init()      do {\
+        CRYPTO_set_mem_debug_functions(\
+                (void (*)())CRYPTO_dbg_malloc,\
+                (void (*)())CRYPTO_dbg_realloc,\
+                (void (*)())CRYPTO_dbg_free,\
+                (void (*)())CRYPTO_dbg_set_options,\
+                (long (*)())CRYPTO_dbg_get_options);\
+        } while(0)
+
+int CRYPTO_mem_ctrl(int mode);
+int CRYPTO_is_mem_check_on(void);
+
+/* for applications */
 #define MemCheck_start() CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON)
 #define MemCheck_stop() CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_OFF)
+
+/* for library-internal use */
 #define MemCheck_on()   CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE)
 #define MemCheck_off()  CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE)
-#define Malloc(num)     CRYPTO_dbg_malloc((int)num,__FILE__,__LINE__)
+#define is_MemCheck_on() CRYPTO_is_mem_check_on()
+
+#define Malloc(num)     CRYPTO_malloc((int)num,__FILE__,__LINE__)
 #define Realloc(addr,num) \
-        CRYPTO_dbg_realloc((char *)addr,(int)num,__FILE__,__LINE__)
+        CRYPTO_realloc((char *)addr,(int)num,__FILE__,__LINE__)
 #define Remalloc(addr,num) \
-        CRYPTO_dbg_remalloc((char **)addr,(int)num,__FILE__,__LINE__)
-#define FreeFunc        CRYPTO_dbg_free
-#define Free(addr)      CRYPTO_dbg_free(addr)
-#define Malloc_locked(num) CRYPTO_malloc_locked((int)num)
-#define Free_locked(addr) CRYPTO_free_locked(addr)
-#else
-#define MemCheck_start()
-#define MemCheck_stop()
-#define MemCheck_on()
-#define MemCheck_off()
-#define Remalloc        CRYPTO_remalloc
-#if defined(WIN32) || defined(MFUNC)
-#define Malloc          CRYPTO_malloc
-#define Realloc(a,n)    CRYPTO_realloc(a,(n))
+        CRYPTO_remalloc((char **)addr,(int)num,__FILE__,__LINE__)
 #define FreeFunc        CRYPTO_free
 #define Free(addr)      CRYPTO_free(addr)
-#define Malloc_locked   CRYPTO_malloc_locked
+
+#define Malloc_locked(num) CRYPTO_malloc_locked((int)num,__FILE__,__LINE__)
 #define Free_locked(addr) CRYPTO_free_locked(addr)
-#else
-#define Malloc          malloc
-#define Realloc         realloc
-#define FreeFunc        free
-#define Free(addr)      free(addr)
-#define Malloc_locked   malloc
-#define Free_locked(addr) free(addr)
-#endif /* WIN32 || MFUNC */
-#endif /* MDEBUG */
+
 
 /* Case insensiteve linking causes problems.... */
 #if defined(WIN16) || defined(VMS)
@@ -261,15 +270,15 @@ typedef struct crypto_ex_data_func_st
 const char *SSLeay_version(int type);
 unsigned long SSLeay(void);
 
-int CRYPTO_get_ex_new_index(int idx,STACK **sk,long argl,char *argp,
-        int (*new_func)(),int (*dup_func)(),void (*free_func)());
-int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad,int idx,char *val);
-char *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad,int idx);
-int CRYPTO_dup_ex_data(STACK *meth,CRYPTO_EX_DATA *from,CRYPTO_EX_DATA *to);
-void CRYPTO_free_ex_data(STACK *meth,char *obj,CRYPTO_EX_DATA *ad);
-void CRYPTO_new_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad);
+int CRYPTO_get_ex_new_index(int idx, STACK_OF(CRYPTO_EX_DATA_FUNCS) **skp, long argl, void *argp,
+             CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val);
+void *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad,int idx);
+int CRYPTO_dup_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, CRYPTO_EX_DATA *to,
+             CRYPTO_EX_DATA *from);
+void CRYPTO_free_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, void *obj, CRYPTO_EX_DATA *ad);
+void CRYPTO_new_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, void *obj, CRYPTO_EX_DATA *ad);
 
-int CRYPTO_mem_ctrl(int mode);
 int CRYPTO_get_new_lockid(char *name);
 
 int CRYPTO_num_locks(void); /* return CRYPTO_NUM_LOCKS (shared libs!) */
@@ -289,22 +298,51 @@ const char *CRYPTO_get_lock_name(int type);
 int CRYPTO_add_lock(int *pointer,int amount,int type, const char *file,
                     int line);
 
-void CRYPTO_set_mem_functions(char *(*m)(),char *(*r)(), void (*free_func)());
-void CRYPTO_get_mem_functions(char *(**m)(),char *(**r)(), void (**f)());
-void CRYPTO_set_locked_mem_functions(char *(*m)(), void (*free_func)());
-void CRYPTO_get_locked_mem_functions(char *(**m)(), void (**f)());
+/* CRYPTO_set_mem_functions includes CRYPTO_set_locked_mem_functions --
+ * call the latter last if you need different functions */
+int CRYPTO_set_mem_functions(void *(*m)(size_t),void *(*r)(void *,size_t), void (*f)(void *));
+int CRYPTO_set_locked_mem_functions(void *(*m)(size_t), void (*free_func)(void *));
+int CRYPTO_set_mem_debug_functions(void (*m)(),void (*r)(),void (*f)(),void (*so)(),long (*go)());
+void CRYPTO_get_mem_functions(void *(**m)(size_t),void *(**r)(void *, size_t), void (**f)(void *));
+void CRYPTO_get_locked_mem_functions(void *(**m)(size_t), void (**f)(void *));
+void CRYPTO_get_mem_debug_functions(void (**m)(),void (**r)(),void (**f)(),void (**so)(),long (**go)());
 
-void *CRYPTO_malloc_locked(int num);
+void *CRYPTO_malloc_locked(int num, const char *file, int line);
 void CRYPTO_free_locked(void *);
-void *CRYPTO_malloc(int num);
+void *CRYPTO_malloc(int num, const char *file, int line);
 void CRYPTO_free(void *);
-void *CRYPTO_realloc(void *addr,int num);
-void *CRYPTO_remalloc(void *addr,int num);
+void *CRYPTO_realloc(void *addr,int num, const char *file, int line);
+void *CRYPTO_remalloc(void *addr,int num, const char *file, int line);
+
+void CRYPTO_set_mem_debug_options(long bits);
+long CRYPTO_get_mem_debug_options(void);
+
+#define CRYPTO_push_info(info) \
+        CRYPTO_push_info_(info, __FILE__, __LINE__);
+int CRYPTO_push_info_(const char *info, const char *file, int line);
+int CRYPTO_pop_info(void);
+int CRYPTO_remove_all_info(void);
+
+/* The last argument has the following significance:
+ *
+ * 0:   called before the actual memory allocation has taken place
+ * 1:   called after the actual memory allocation has taken place
+ */
+void CRYPTO_dbg_malloc(void *addr,int num,const char *file,int line,int before_p);
+void CRYPTO_dbg_realloc(void *addr1,void *addr2,int num,const char *file,int line,int before_p);
+void CRYPTO_dbg_free(void *addr,int before_p);
+
+/* Tell the debugging code about options.  By default, the following values
+ * apply:
+ *
+ * 0:   Clear all options.
+ * 1:   Set the "Show Time" option.
+ * 2:   Set the "Show Thread Number" option.
+ * 3:   1 + 2
+ */
+void CRYPTO_dbg_set_options(long bits);
+long CRYPTO_dbg_get_options(void);
 
-void *CRYPTO_dbg_malloc(int num,const char *file,int line);
-void *CRYPTO_dbg_realloc(void *addr,int num,const char *file,int line);
-void CRYPTO_dbg_free(void *);
-void *CRYPTO_dbg_remalloc(void *addr,int num,const char *file,int line);
 #ifndef NO_FP_API
 void CRYPTO_mem_leaks_fp(FILE *);
 #endif
@@ -312,7 +350,7 @@ void CRYPTO_mem_leaks(struct bio_st *bio);
 /* unsigned long order, char *file, int line, int num_bytes, char *addr */
 void CRYPTO_mem_leaks_cb(void (*cb)());
 
-void ERR_load_CRYPTO_strings(void );
+void ERR_load_CRYPTO_strings(void);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
diff --git a/src/lib/libssl/src/crypto/des/Makefile.ssl b/src/lib/libssl/src/crypto/des/Makefile.ssl
index 7f9600cf02..41976655e9 100644
--- a/src/lib/libssl/src/crypto/des/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/des/Makefile.ssl
@@ -15,6 +15,7 @@ MAKE=		make -f Makefile.ssl
 MAKEDEPEND=     $(TOP)/util/domd $(TOP)
 MAKEFILE=       Makefile.ssl
 AR=             ar r
+RANLIB=         ranlib
 DES_ENC=        des_enc.o fcrypt_b.o
 # or use
 #DES_ENC=       dx86-elf.o yx86-elf.o
@@ -162,14 +163,15 @@ enc_read.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 enc_read.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 enc_read.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 enc_read.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-enc_read.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-enc_read.o: ../cryptlib.h des_locl.h
+enc_read.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+enc_read.o: ../../include/openssl/stack.h ../cryptlib.h des_locl.h
 enc_writ.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 enc_writ.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 enc_writ.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 enc_writ.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 enc_writ.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-enc_writ.o: ../../include/openssl/stack.h ../cryptlib.h des_locl.h
+enc_writ.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+enc_writ.o: ../cryptlib.h des_locl.h
 fcrypt.o: ../../include/openssl/des.h ../../include/openssl/des.h
 fcrypt.o: ../../include/openssl/e_os2.h ../../include/openssl/e_os2.h
 fcrypt.o: ../../include/openssl/opensslconf.h
@@ -187,15 +189,15 @@ pcbc_enc.o: ../../include/openssl/opensslconf.h des_locl.h
 qud_cksm.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
 qud_cksm.o: ../../include/openssl/opensslconf.h des_locl.h
 rand_key.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
-rand_key.o: ../../include/openssl/opensslconf.h des_locl.h
+rand_key.o: ../../include/openssl/opensslconf.h ../../include/openssl/rand.h
 read2pwd.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
 read2pwd.o: ../../include/openssl/opensslconf.h des_locl.h
 read_pwd.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 read_pwd.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 read_pwd.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 read_pwd.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
-read_pwd.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-read_pwd.o: ../cryptlib.h des_locl.h
+read_pwd.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+read_pwd.o: ../../include/openssl/stack.h ../cryptlib.h des_locl.h
 rpc_enc.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
 rpc_enc.o: ../../include/openssl/opensslconf.h des_locl.h des_ver.h rpc_des.h
 set_key.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
diff --git a/src/lib/libssl/src/crypto/des/cbc3_enc.c b/src/lib/libssl/src/crypto/des/cbc3_enc.c
index 3863a676d4..527e74f3de 100644
--- a/src/lib/libssl/src/crypto/des/cbc3_enc.c
+++ b/src/lib/libssl/src/crypto/des/cbc3_enc.c
@@ -58,7 +58,7 @@
 
 #include "des_locl.h"
 
-/* HAS BUGS? DON'T USE - this is only present for use in des.c */
+/* HAS BUGS! DON'T USE - this is only present for use in des.c */
 void des_3cbc_encrypt(des_cblock *input, des_cblock *output, long length,
              des_key_schedule ks1, des_key_schedule ks2, des_cblock *iv1,
              des_cblock *iv2, int enc)
@@ -69,11 +69,14 @@ void des_3cbc_encrypt(des_cblock *input, des_cblock *output, long length,
 
         if (enc == DES_ENCRYPT)
                 {
-                des_cbc_encrypt(input,output,length,ks1,iv1,enc);
+                des_cbc_encrypt((unsigned char*)input,
+                                (unsigned char*)output,length,ks1,iv1,enc);
                 if (length >= sizeof(des_cblock))
                         memcpy(niv1,output[off],sizeof(des_cblock));
-                des_cbc_encrypt(output,output,l8,ks2,iv1,!enc);
-                des_cbc_encrypt(output,output,l8,ks1,iv2, enc);
+                des_cbc_encrypt((unsigned char*)output,
+                                (unsigned char*)output,l8,ks2,iv1,!enc);
+                des_cbc_encrypt((unsigned char*)output,
+                                (unsigned char*)output,l8,ks1,iv2,enc);
                 if (length >= sizeof(des_cblock))
                         memcpy(niv2,output[off],sizeof(des_cblock));
                 }
@@ -81,11 +84,14 @@ void des_3cbc_encrypt(des_cblock *input, des_cblock *output, long length,
                 {
                 if (length >= sizeof(des_cblock))
                         memcpy(niv2,input[off],sizeof(des_cblock));
-                des_cbc_encrypt(input,output,l8,ks1,iv2,enc);
-                des_cbc_encrypt(output,output,l8,ks2,iv1,!enc);
+                des_cbc_encrypt((unsigned char*)input,
+                                (unsigned char*)output,l8,ks1,iv2,enc);
+                des_cbc_encrypt((unsigned char*)output,
+                                (unsigned char*)output,l8,ks2,iv1,!enc);
                 if (length >= sizeof(des_cblock))
                         memcpy(niv1,output[off],sizeof(des_cblock));
-                des_cbc_encrypt(output,output,length,ks1,iv1, enc);
+                des_cbc_encrypt((unsigned char*)output,
+                                (unsigned char*)output,length,ks1,iv1,enc);
                 }
         memcpy(*iv1,niv1,sizeof(des_cblock));
         memcpy(*iv2,niv2,sizeof(des_cblock));
diff --git a/src/lib/libssl/src/crypto/des/des.c b/src/lib/libssl/src/crypto/des/des.c
index b2d7f0da78..91d7153b34 100644
--- a/src/lib/libssl/src/crypto/des/des.c
+++ b/src/lib/libssl/src/crypto/des/des.c
@@ -325,25 +325,25 @@ void usage(void)
 "des <options> [input-file [output-file]]",
 "options:",
 "-v         : des(1) version number",
-"-e         : encrypt using sunOS compatible user key to DES key conversion.",
+"-e         : encrypt using SunOS compatible user key to DES key conversion.",
 "-E         : encrypt ",
-"-d         : decrypt using sunOS compatible user key to DES key conversion.",
+"-d         : decrypt using SunOS compatible user key to DES key conversion.",
 "-D         : decrypt ",
-"-c[ckname] : generate a cbc_cksum using sunOS compatible user key to",
+"-c[ckname] : generate a cbc_cksum using SunOS compatible user key to",
 "             DES key conversion and output to ckname (stdout default,",
 "             stderr if data being output on stdout).  The checksum is",
 "             generated before encryption and after decryption if used",
 "             in conjunction with -[eEdD].",
 "-C[ckname] : generate a cbc_cksum as for -c but compatible with -[ED].",
 "-k key     : use key 'key'",
-"-h         : the key that is entered will be a hexidecimal number",
+"-h         : the key that is entered will be a hexadecimal number",
 "             that is used directly as the des key",
 "-u[uuname] : input file is uudecoded if -[dD] or output uuencoded data if -[eE]",
 "             (uuname is the filename to put in the uuencode header).",
-"-b         : encrypt using DES in ecb encryption mode, the defaut is cbc mode.",
-"-3         : encrypt using tripple DES encryption.  This uses 2 keys",
+"-b         : encrypt using DES in ecb encryption mode, the default is cbc mode.",
+"-3         : encrypt using triple DES encryption.  This uses 2 keys",
 "             generated from the input key.  If the input key is less",
-"             than 8 characters long, this is equivelent to normal",
+"             than 8 characters long, this is equivalent to normal",
 "             encryption.  Default is triple cbc, -b makes it triple ecb.",
 NULL
 };
@@ -425,7 +425,7 @@ void doencryption(void)
                         else
                                 k2[i-8]=k;
                         }
-                des_set_key(&k2,ks2);
+                des_set_key_unchecked(&k2,ks2);
                 memset(k2,0,sizeof(k2));
                 }
         else if (longk || flag3)
@@ -433,7 +433,7 @@ void doencryption(void)
                 if (flag3)
                         {
                         des_string_to_2keys(key,&kk,&k2);
-                        des_set_key(&k2,ks2);
+                        des_set_key_unchecked(&k2,ks2);
                         memset(k2,0,sizeof(k2));
                         }
                 else
@@ -455,7 +455,7 @@ void doencryption(void)
                                 kk[i]=key[i]|0x80;
                         }
 
-        des_set_key(&kk,ks);
+        des_set_key_unchecked(&kk,ks);
         memset(key,0,sizeof(key));
         memset(kk,0,sizeof(kk));
         /* woops - A bug that does not showup under unix :-( */
@@ -484,7 +484,7 @@ void doencryption(void)
                         if (feof(DES_IN))
                                 {
                                 for (i=7-rem; i>0; i--)
-                                        RAND_bytes(buf + l++, 1);
+                                        RAND_pseudo_bytes(buf + l++, 1);
                                 buf[l++]=rem;
                                 ex=1;
                                 len+=rem;
diff --git a/src/lib/libssl/src/crypto/des/des.h b/src/lib/libssl/src/crypto/des/des.h
index 67f90aaf17..98a9c4127c 100644
--- a/src/lib/libssl/src/crypto/des/des.h
+++ b/src/lib/libssl/src/crypto/des/des.h
@@ -186,15 +186,20 @@ void des_pcbc_encrypt(const unsigned char *input,unsigned char *output,
 DES_LONG des_quad_cksum(const unsigned char *input,des_cblock output[],
                         long length,int out_count,des_cblock *seed);
 void des_random_seed(des_cblock *key);
-void des_random_key(des_cblock *ret);
+int des_random_key(des_cblock *ret);
 int des_read_password(des_cblock *key,const char *prompt,int verify);
 int des_read_2passwords(des_cblock *key1,des_cblock *key2,
                         const char *prompt,int verify);
 int des_read_pw_string(char *buf,int length,const char *prompt,int verify);
 void des_set_odd_parity(des_cblock *key);
 int des_is_weak_key(const_des_cblock *key);
+/* des_set_key (= set_key = des_key_sched = key_sched) calls
+ * des_set_key_checked if global variable des_check_key is set,
+ * des_set_key_unchecked otherwise. */
 int des_set_key(const_des_cblock *key,des_key_schedule schedule);
 int des_key_sched(const_des_cblock *key,des_key_schedule schedule);
+int des_set_key_checked(const_des_cblock *key,des_key_schedule schedule);
+void des_set_key_unchecked(const_des_cblock *key,des_key_schedule schedule);
 void des_string_to_key(const char *str,des_cblock *key);
 void des_string_to_2keys(const char *str,des_cblock *key1,des_cblock *key2);
 void des_cfb64_encrypt(const unsigned char *in,unsigned char *out,long length,
diff --git a/src/lib/libssl/src/crypto/des/des_locl.h b/src/lib/libssl/src/crypto/des/des_locl.h
index d6ea17cb68..4dfed199a7 100644
--- a/src/lib/libssl/src/crypto/des/des_locl.h
+++ b/src/lib/libssl/src/crypto/des/des_locl.h
@@ -72,7 +72,11 @@
 
 #ifndef MSDOS
 #if !defined(VMS) || defined(__DECC)
-#include OPENSSL_UNISTD
+#ifdef OPENSSL_UNISTD
+# include OPENSSL_UNISTD
+#else
+# include <unistd.h>
+#endif
 #include <math.h>
 #endif
 #endif
@@ -178,14 +182,14 @@
 #endif
 
 /* The changes to this macro may help or hinder, depending on the
- * compiler and the achitecture.  gcc2 always seems to do well :-).
+ * compiler and the architecture.  gcc2 always seems to do well :-).
  * Inspired by Dana How <how@isl.stanford.edu>
  * DO NOT use the alternative version on machines with 8 byte longs.
  * It does not seem to work on the Alpha, even when DES_LONG is 4
  * bytes, probably an issue of accessing non-word aligned objects :-( */
 #ifdef DES_PTR
 
-/* It recently occured to me that 0^0^0^0^0^0^0 == 0, so there
+/* It recently occurred to me that 0^0^0^0^0^0^0 == 0, so there
  * is no reason to not xor all the sub items together.  This potentially
  * saves a register since things can be xored directly into L */
 
diff --git a/src/lib/libssl/src/crypto/des/des_opts.c b/src/lib/libssl/src/crypto/des/des_opts.c
index 746c456f8f..b2ca7ac31d 100644
--- a/src/lib/libssl/src/crypto/des/des_opts.c
+++ b/src/lib/libssl/src/crypto/des/des_opts.c
@@ -434,17 +434,17 @@ int main(int argc, char **argv)
                 }
 
 #ifndef TIMES
-        fprintf(stderr,"To get the most acurate results, try to run this\n");
+        fprintf(stderr,"To get the most accurate results, try to run this\n");
         fprintf(stderr,"program when this computer is idle.\n");
 #endif
 
-        des_set_key(&key,sch);
-        des_set_key(&key2,sch2);
-        des_set_key(&key3,sch3);
+        des_set_key_unchecked(&key,sch);
+        des_set_key_unchecked(&key2,sch2);
+        des_set_key_unchecked(&key3,sch3);
 
 #ifndef SIGALRM
         fprintf(stderr,"First we calculate the approximate speed ...\n");
-        des_set_key(&key,sch);
+        des_set_key_unchecked(&key,sch);
         count=10;
         do      {
                 long i;
diff --git a/src/lib/libssl/src/crypto/des/destest.c b/src/lib/libssl/src/crypto/des/destest.c
index 5a04fc9298..9ad4ecb072 100644
--- a/src/lib/libssl/src/crypto/des/destest.c
+++ b/src/lib/libssl/src/crypto/des/destest.c
@@ -234,7 +234,7 @@ static unsigned char cipher_ecb2[NUM_TESTS-1][8]={
         {0x08,0xD7,0xB4,0xFB,0x62,0x9D,0x08,0x85}};
 
 static unsigned char cbc_key [8]={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
-static unsigned char cbc2_key[8]={0xf0,0xe1,0xd2,0xc3,0xb4,0xa5,0x96,0x87};
+static unsigned char cbc2_key[8]={0xf1,0xe0,0xd3,0xc2,0xb5,0xa4,0x97,0x86};
 static unsigned char cbc3_key[8]={0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10};
 static unsigned char cbc_iv  [8]={0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10};
 /* Changed the following text constant to binary so it will work on ebcdic
@@ -254,12 +254,24 @@ static unsigned char cbc_ok[32]={
         0x46,0x8e,0x91,0x15,0x78,0x88,0xba,0x68,
         0x1d,0x26,0x93,0x97,0xf7,0xfe,0x62,0xb4};
 
+#ifdef SCREW_THE_PARITY
+#error "SCREW_THE_PARITY is not ment to be defined."
+#error "Original vectors are preserved for reference only."
+static unsigned char cbc2_key[8]={0xf0,0xe1,0xd2,0xc3,0xb4,0xa5,0x96,0x87};
 static unsigned char xcbc_ok[32]={
         0x86,0x74,0x81,0x0D,0x61,0xA4,0xA5,0x48,
         0xB9,0x93,0x03,0xE1,0xB8,0xBB,0xBD,0xBD,
         0x64,0x30,0x0B,0xB9,0x06,0x65,0x81,0x76,
         0x04,0x1D,0x77,0x62,0x17,0xCA,0x2B,0xD2,
         };
+#else
+static unsigned char xcbc_ok[32]={
+        0x84,0x6B,0x29,0x14,0x85,0x1E,0x9A,0x29,
+        0x54,0x73,0x2F,0x8A,0xA0,0xA6,0x11,0xC1,
+        0x15,0xCD,0xC2,0xD7,0x95,0x1B,0x10,0x53,
+        0xA6,0x3C,0x5E,0x03,0xB2,0x1A,0xA3,0xC4,
+        };
+#endif
 
 static unsigned char cbc3_ok[32]={
         0x3F,0xE3,0x01,0xC9,0x62,0xAC,0x01,0xD0,
@@ -309,8 +321,8 @@ static unsigned char ofb_cipher[24]=
         0x3d,0x6d,0x5b,0xe3,0x25,0x5a,0xf8,0xc3
         };
 
-DES_LONG cbc_cksum_ret=0xB462FEF7L;
-unsigned char cbc_cksum_data[8]={0x1D,0x26,0x93,0x97,0xf7,0xfe,0x62,0xb4};
+static DES_LONG cbc_cksum_ret=0xB462FEF7L;
+static unsigned char cbc_cksum_data[8]={0x1D,0x26,0x93,0x97,0xf7,0xfe,0x62,0xb4};
 
 static char *pt(unsigned char *p);
 static int cfb_test(int bits, unsigned char *cfb_cipher);
@@ -331,17 +343,17 @@ int main(int argc, char *argv[])
 
 #ifndef NO_DESCBCM
         printf("Doing cbcm\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
                 }
-        if ((j=des_key_sched(&cbc2_key,ks2)) != 0)
+        if ((j=des_set_key_checked(&cbc2_key,ks2)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
                 }
-        if ((j=des_key_sched(&cbc3_key,ks3)) != 0)
+        if ((j=des_set_key_checked(&cbc3_key,ks3)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -385,11 +397,7 @@ int main(int argc, char *argv[])
         printf("Doing ecb\n");
         for (i=0; i<NUM_TESTS; i++)
                 {
-                if ((j=des_key_sched(&key_data[i],ks)) != 0)
-                        {
-                        printf("Key error %2d:%d\n",i+1,j);
-                        err=1;
-                        }
+                des_set_key_unchecked(&key_data[i],ks);
                 memcpy(in,plain_data[i],8);
                 memset(out,0,8);
                 memset(outin,0,8);
@@ -415,21 +423,9 @@ int main(int argc, char *argv[])
         printf("Doing ede ecb\n");
         for (i=0; i<(NUM_TESTS-1); i++)
                 {
-                if ((j=des_key_sched(&key_data[i],ks)) != 0)
-                        {
-                        err=1;
-                        printf("Key error %2d:%d\n",i+1,j);
-                        }
-                if ((j=des_key_sched(&key_data[i+1],ks2)) != 0)
-                        {
-                        printf("Key error %2d:%d\n",i+2,j);
-                        err=1;
-                        }
-                if ((j=des_key_sched(&key_data[i+2],ks3)) != 0)
-                        {
-                        printf("Key error %2d:%d\n",i+3,j);
-                        err=1;
-                        }
+                des_set_key_unchecked(&key_data[i],ks);
+                des_set_key_unchecked(&key_data[i+1],ks2);
+                des_set_key_unchecked(&key_data[i+2],ks3);
                 memcpy(in,plain_data[i],8);
                 memset(out,0,8);
                 memset(outin,0,8);
@@ -453,7 +449,7 @@ int main(int argc, char *argv[])
 #endif
 
         printf("Doing cbc\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -464,7 +460,10 @@ int main(int argc, char *argv[])
         des_ncbc_encrypt(cbc_data,cbc_out,strlen((char *)cbc_data)+1,ks,
                          &iv3,DES_ENCRYPT);
         if (memcmp(cbc_out,cbc_ok,32) != 0)
+                {
                 printf("cbc_encrypt encrypt error\n");
+                err=1;
+                }
 
         memcpy(iv3,cbc_iv,sizeof(cbc_iv));
         des_ncbc_encrypt(cbc_out,cbc_in,strlen((char *)cbc_data)+1,ks,
@@ -477,7 +476,7 @@ int main(int argc, char *argv[])
 
 #ifndef LIBDES_LIT
         printf("Doing desx cbc\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -490,6 +489,7 @@ int main(int argc, char *argv[])
         if (memcmp(cbc_out,xcbc_ok,32) != 0)
                 {
                 printf("des_xcbc_encrypt encrypt error\n");
+                err=1;
                 }
         memcpy(iv3,cbc_iv,sizeof(cbc_iv));
         des_xcbc_encrypt(cbc_out,cbc_in,strlen((char *)cbc_data)+1,ks,
@@ -502,17 +502,17 @@ int main(int argc, char *argv[])
 #endif
 
         printf("Doing ede cbc\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
                 }
-        if ((j=des_key_sched(&cbc2_key,ks2)) != 0)
+        if ((j=des_set_key_checked(&cbc2_key,ks2)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
                 }
-        if ((j=des_key_sched(&cbc3_key,ks3)) != 0)
+        if ((j=des_set_key_checked(&cbc3_key,ks3)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -543,7 +543,7 @@ int main(int argc, char *argv[])
 
 #ifndef LIBDES_LIT
         printf("Doing pcbc\n");
-        if ((j=des_key_sched(&cbc_key,ks)) != 0)
+        if ((j=des_set_key_checked(&cbc_key,ks)) != 0)
                 {
                 printf("Key error %d\n",j);
                 err=1;
@@ -606,7 +606,7 @@ int main(int argc, char *argv[])
         printf("done\n");
 
         printf("Doing ofb\n");
-        des_key_sched(&ofb_key,ks);
+        des_set_key_checked(&ofb_key,ks);
         memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
         des_ofb_encrypt(plain,ofb_buf1,64,sizeof(plain)/8,ks,&ofb_tmp);
         if (memcmp(ofb_cipher,ofb_buf1,sizeof(ofb_buf1)) != 0)
@@ -635,7 +635,7 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 }
 
         printf("Doing ofb64\n");
-        des_key_sched(&ofb_key,ks);
+        des_set_key_checked(&ofb_key,ks);
         memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
         memset(ofb_buf1,0,sizeof(ofb_buf1));
         memset(ofb_buf2,0,sizeof(ofb_buf1));
@@ -660,7 +660,7 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 }
 
         printf("Doing ede_ofb64\n");
-        des_key_sched(&ofb_key,ks);
+        des_set_key_checked(&ofb_key,ks);
         memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
         memset(ofb_buf1,0,sizeof(ofb_buf1));
         memset(ofb_buf2,0,sizeof(ofb_buf1));
@@ -686,7 +686,7 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 }
 
         printf("Doing cbc_cksum\n");
-        des_key_sched(&cbc_key,ks);
+        des_set_key_checked(&cbc_key,ks);
         cs=des_cbc_cksum(cbc_data,&cret,strlen((char *)cbc_data),ks,&cbc_iv);
         if (cs != cbc_cksum_ret)
                 {
@@ -795,8 +795,7 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 err=1;
                 }
         printf("\n");
-        exit(err);
-        return(0);
+        return(err);
         }
 
 static char *pt(unsigned char *p)
@@ -825,7 +824,7 @@ static int cfb_test(int bits, unsigned char *cfb_cipher)
         des_key_schedule ks;
         int i,err=0;
 
-        des_key_sched(&cfb_key,ks);
+        des_set_key_checked(&cfb_key,ks);
         memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
         des_cfb_encrypt(plain,cfb_buf1,bits,sizeof(plain),ks,&cfb_tmp,
                         DES_ENCRYPT);
@@ -854,7 +853,7 @@ static int cfb64_test(unsigned char *cfb_cipher)
         des_key_schedule ks;
         int err=0,i,n;
 
-        des_key_sched(&cfb_key,ks);
+        des_set_key_checked(&cfb_key,ks);
         memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
         n=0;
         des_cfb64_encrypt(plain,cfb_buf1,12,ks,&cfb_tmp,&n,DES_ENCRYPT);
@@ -887,7 +886,7 @@ static int ede_cfb64_test(unsigned char *cfb_cipher)
         des_key_schedule ks;
         int err=0,i,n;
 
-        des_key_sched(&cfb_key,ks);
+        des_set_key_checked(&cfb_key,ks);
         memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
         n=0;
         des_ede3_cfb64_encrypt(plain,cfb_buf1,12,ks,ks,ks,&cfb_tmp,&n,
diff --git a/src/lib/libssl/src/crypto/des/enc_read.c b/src/lib/libssl/src/crypto/des/enc_read.c
index 694970ccd2..7399ff7269 100644
--- a/src/lib/libssl/src/crypto/des/enc_read.c
+++ b/src/lib/libssl/src/crypto/des/enc_read.c
@@ -147,7 +147,7 @@ int des_enc_read(int fd, void *buf, int len, des_key_schedule sched,
         /* first - get the length */
         while (net_num < HDRSIZE) 
                 {
-                i=read(fd,&(net[net_num]),HDRSIZE-net_num);
+                i=read(fd,(void *)&(net[net_num]),HDRSIZE-net_num);
 #ifdef EINTR
                 if ((i == -1) && (errno == EINTR)) continue;
 #endif
@@ -169,7 +169,7 @@ int des_enc_read(int fd, void *buf, int len, des_key_schedule sched,
         net_num=0;
         while (net_num < rnum)
                 {
-                i=read(fd,&(net[net_num]),rnum-net_num);
+                i=read(fd,(void *)&(net[net_num]),rnum-net_num);
 #ifdef EINTR
                 if ((i == -1) && (errno == EINTR)) continue;
 #endif
diff --git a/src/lib/libssl/src/crypto/des/enc_writ.c b/src/lib/libssl/src/crypto/des/enc_writ.c
index ba3f0822ef..4d3452724e 100644
--- a/src/lib/libssl/src/crypto/des/enc_writ.c
+++ b/src/lib/libssl/src/crypto/des/enc_writ.c
@@ -130,12 +130,12 @@ int des_enc_write(int fd, const void *_buf, int len,
                 {
                 cp=shortbuf;
                 memcpy(shortbuf,buf,len);
-                RAND_bytes(shortbuf+len, 8-len);
+                RAND_pseudo_bytes(shortbuf+len, 8-len);
                 rnum=8;
                 }
         else
                 {
-                cp=(unsigned char*)buf;
+                cp=buf;
                 rnum=((len+7)/8*8); /* round up to nearest eight */
                 }
 
@@ -152,13 +152,16 @@ int des_enc_write(int fd, const void *_buf, int len,
         for (j=0; j<outnum; j+=i)
                 {
                 /* eay 26/08/92 I was not doing writing from where we
-                 * got upto. */
-                i=write(fd,&(outbuf[j]),outnum-j);
+                 * got up to. */
+                i=write(fd,(void *)&(outbuf[j]),outnum-j);
                 if (i == -1)
                         {
+#ifdef EINTR
                         if (errno == EINTR)
                                 i=0;
-                        else    /* This is really a bad error - very bad
+                        else
+#endif
+                                /* This is really a bad error - very bad
                                  * It will stuff-up both ends. */
                                 return(-1);
                         }
diff --git a/src/lib/libssl/src/crypto/des/fcrypt.c b/src/lib/libssl/src/crypto/des/fcrypt.c
index f36746b376..fa1b8aa34a 100644
--- a/src/lib/libssl/src/crypto/des/fcrypt.c
+++ b/src/lib/libssl/src/crypto/des/fcrypt.c
@@ -1,7 +1,7 @@
 /* NOCW */
 #include <stdio.h>
 
-/* This version of crypt has been developed from my MIT compatable
+/* This version of crypt has been developed from my MIT compatible
  * DES library.
  * The library is available at pub/Crypto/DES at ftp.psy.uq.oz.au
  * Eric Young (eay@cryptsoft.com)
@@ -11,7 +11,7 @@
  * I have included directive PARA for shared memory computers.
  * I have included a directive LONGCRYPT to using this routine to cipher
  * passwords with more then 8 bytes like HP-UX 10.x it used. The MAXPLEN
- * definition is the maximum of lenght of password and can changed. I have
+ * definition is the maximum of length of password and can changed. I have
  * defined 24.
  */
 
@@ -103,8 +103,8 @@ char *ret;
          * returns *\0XXXXXXXXX
          * The \0 makes the string look like * so the pwd "*" would
          * crypt to "*".  This was found when replacing the crypt in
-         * our shared libraries.  People found that the disbled
-         * accounts effectivly had no passwd :-(. */
+         * our shared libraries.  People found that the disabled
+         * accounts effectively had no passwd :-(. */
         x=ret[0]=((salt[0] == '\0')?'A':salt[0]);
         Eswap0=con_salt[x]<<2;
         x=ret[1]=((salt[1] == '\0')?'A':salt[1]);
@@ -123,7 +123,7 @@ r=(r+7)/8;
         for (; i<8; i++)
                 key[i]=0;
 
-        des_set_key((des_cblock *)(key),ks);
+        des_set_key_unchecked(&key,ks);
         fcrypt_body(&(out[0]),ks,Eswap0,Eswap1);
 
         ll=out[0]; l2c(ll,b);
diff --git a/src/lib/libssl/src/crypto/des/fcrypt_b.c b/src/lib/libssl/src/crypto/des/fcrypt_b.c
index 9cbea97c1f..83c94054e3 100644
--- a/src/lib/libssl/src/crypto/des/fcrypt_b.c
+++ b/src/lib/libssl/src/crypto/des/fcrypt_b.c
@@ -58,7 +58,7 @@
 
 #include <stdio.h>
 
-/* This version of crypt has been developed from my MIT compatable
+/* This version of crypt has been developed from my MIT compatible
  * DES library.
  * The library is available at pub/Crypto/DES at ftp.psy.uq.oz.au
  * Eric Young (eay@cryptsoft.com)
diff --git a/src/lib/libssl/src/crypto/des/rand_key.c b/src/lib/libssl/src/crypto/des/rand_key.c
index fc11792cda..7816a8f25c 100644
--- a/src/lib/libssl/src/crypto/des/rand_key.c
+++ b/src/lib/libssl/src/crypto/des/rand_key.c
@@ -1,114 +1,69 @@
 /* crypto/des/rand_key.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
  * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
  */
 
-#include "des_locl.h"
-#include <time.h>
-
-static int seed=0;
-static des_cblock init;
+#include <openssl/des.h>
+#include <openssl/rand.h>
 
 void des_random_seed(des_cblock *key)
         {
-        memcpy(&init,key,sizeof(des_cblock));
-        seed=1;
+        RAND_seed(key, sizeof(des_cblock));
         }
 
-void des_random_key(des_cblock *ret)
+int des_random_key(des_cblock *ret)
         {
-        des_key_schedule ks;
-        static DES_LONG c=0;
-        static unsigned short pid=0;
-        static des_cblock data={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
-        des_cblock key;
-        unsigned char *p;
-        DES_LONG t;
-        int i;
-
-#ifdef MSDOS
-        pid=1;
-#else
-        if (!pid) pid=getpid();
-#endif
-        p=key;
-        if (seed)
-                {
-                for (i=0; i<8; i++)
-                        {
-                        data[i] ^= init[i];
-                        init[i]=0;
-                        }
-                seed=0;
-                }
-        t=(DES_LONG)time(NULL);
-        l2c(t,p);
-        t=(DES_LONG)((pid)|((c++)<<16));
-        l2c(t,p);
-
-        des_set_odd_parity(&data);
-        des_set_key(&data,ks);
-        des_cbc_cksum(key,&key,sizeof(key),ks,&data);
-
-        des_set_odd_parity(&key);
-        des_set_key(&key,ks);
-        des_cbc_cksum(key,&data,sizeof(key),ks,&key);
-
-        memcpy(ret,data,sizeof(key));
-        memset(key,0,sizeof(key));
-        memset(ks,0,sizeof(ks));
-        t=0;
+        int r = RAND_bytes((unsigned char *)ret, sizeof(des_cblock));
+        des_set_odd_parity(ret);
+        return r;
         }
diff --git a/src/lib/libssl/src/crypto/des/read_pwd.c b/src/lib/libssl/src/crypto/des/read_pwd.c
index fed49652c0..fa2d67da64 100644
--- a/src/lib/libssl/src/crypto/des/read_pwd.c
+++ b/src/lib/libssl/src/crypto/des/read_pwd.c
@@ -58,7 +58,11 @@
 
 #if !defined(MSDOS) && !defined(VMS) && !defined(WIN32)
 #include <openssl/opensslconf.h>
-#include OPENSSL_UNISTD
+#ifdef OPENSSL_UNISTD
+# include OPENSSL_UNISTD
+#else
+# include <unistd.h>
+#endif
 /* If unistd.h defines _POSIX_VERSION, we conclude that we
  * are on a POSIX system and have sigaction and termios. */
 #if defined(_POSIX_VERSION)
@@ -123,7 +127,7 @@
 #undef  SGTTY
 #endif
 
-#if !defined(TERMIO) && !defined(TERMIOS) && !defined(VMS) && !defined(MSDOS)
+#if !defined(TERMIO) && !defined(TERMIOS) && !defined(VMS) && !defined(MSDOS) && !defined(MAC_OS_pre_X) && !defined(MAC_OS_GUSI_SOURCE)
 #undef  TERMIOS
 #undef  TERMIO
 #define SGTTY
@@ -153,7 +157,7 @@
 #define TTY_set(tty,data)       ioctl(tty,TIOCSETP,data)
 #endif
 
-#if !defined(_LIBC) && !defined(MSDOS) && !defined(VMS)
+#if !defined(_LIBC) && !defined(MSDOS) && !defined(VMS) && !defined(MAC_OS_pre_X)
 #include <sys/ioctl.h>
 #endif
 
@@ -174,6 +178,15 @@ struct IOSB {
         };
 #endif
 
+#if defined(MAC_OS_pre_X) || defined(MAC_OS_GUSI_SOURCE)
+/*
+ * This one needs work. As a matter of fact the code is unoperational
+ * and this is only a trick to get it compiled.
+ *                                      <appro@fy.chalmers.se>
+ */
+#define TTY_STRUCT int
+#endif
+
 #ifndef NX509_SIG
 #define NX509_SIG 32
 #endif
diff --git a/src/lib/libssl/src/crypto/des/rpc_enc.c b/src/lib/libssl/src/crypto/des/rpc_enc.c
index c96c204147..32d96d5cae 100644
--- a/src/lib/libssl/src/crypto/des/rpc_enc.c
+++ b/src/lib/libssl/src/crypto/des/rpc_enc.c
@@ -66,7 +66,7 @@ int _des_crypt(char *buf, int len, struct desparams *desp)
         des_key_schedule ks;
         int enc;
 
-        des_set_key(&desp->des_key,ks);
+        des_set_key_unchecked(&desp->des_key,ks);
         enc=(desp->des_dir == ENCRYPT)?DES_ENCRYPT:DES_DECRYPT;
 
         if (desp->des_mode == CBC)
diff --git a/src/lib/libssl/src/crypto/des/set_key.c b/src/lib/libssl/src/crypto/des/set_key.c
index 52553a4c16..bbdc71ba6b 100644
--- a/src/lib/libssl/src/crypto/des/set_key.c
+++ b/src/lib/libssl/src/crypto/des/set_key.c
@@ -125,7 +125,7 @@ int des_is_weak_key(const_des_cblock *key)
         int i;
 
         for (i=0; i<NUM_WEAK_KEY; i++)
-                /* Added == 0 to comparision, I obviously don't run
+                /* Added == 0 to comparison, I obviously don't run
                  * this section very often :-(, thanks to
                  * engineering@MorningStar.Com for the fix
                  * eay 93/06/29
@@ -145,11 +145,34 @@ int des_is_weak_key(const_des_cblock *key)
 #define HPERM_OP(a,t,n,m) ((t)=((((a)<<(16-(n)))^(a))&(m)),\
         (a)=(a)^(t)^(t>>(16-(n))))
 
+int des_set_key(const_des_cblock *key, des_key_schedule schedule)
+        {
+        if (des_check_key)
+                {
+                return des_set_key_checked(key, schedule);
+                }
+        else
+                {
+                des_set_key_unchecked(key, schedule);
+                return 0;
+                }
+        }
+
 /* return 0 if key parity is odd (correct),
  * return -1 if key parity error,
  * return -2 if illegal weak key.
  */
-int des_set_key(const_des_cblock *key, des_key_schedule schedule)
+int des_set_key_checked(const_des_cblock *key, des_key_schedule schedule)
+        {
+        if (!check_parity(key))
+                return(-1);
+        if (des_is_weak_key(key))
+                return(-2);
+        des_set_key_unchecked(key, schedule);
+        return 0;
+        }
+
+void des_set_key_unchecked(const_des_cblock *key, des_key_schedule schedule)
         {
         static int shifts2[16]={0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0};
         register DES_LONG c,d,t,s,t2;
@@ -157,15 +180,6 @@ int des_set_key(const_des_cblock *key, des_key_schedule schedule)
         register DES_LONG *k;
         register int i;
 
-        if (des_check_key)
-                {
-                if (!check_parity(key))
-                        return(-1);
-
-                if (des_is_weak_key(key))
-                        return(-2);
-                }
-
         k = &schedule->ks.deslong[0];
         in = &(*key)[0];
 
@@ -225,7 +239,6 @@ int des_set_key(const_des_cblock *key, des_key_schedule schedule)
                 t2=((s>>16L)|(t&0xffff0000L));
                 *(k++)=ROTATE(t2,26)&0xffffffffL;
                 }
-        return(0);
         }
 
 int des_key_sched(const_des_cblock *key, des_key_schedule schedule)
diff --git a/src/lib/libssl/src/crypto/des/speed.c b/src/lib/libssl/src/crypto/des/speed.c
index da41abcb03..814b86f4ae 100644
--- a/src/lib/libssl/src/crypto/des/speed.c
+++ b/src/lib/libssl/src/crypto/des/speed.c
@@ -186,16 +186,16 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
-        des_set_key(&key2,sch2);
-        des_set_key(&key3,sch3);
+        des_set_key_unchecked(&key2,sch2);
+        des_set_key_unchecked(&key3,sch3);
 
 #ifndef SIGALRM
         printf("First we calculate the approximate speed ...\n");
-        des_set_key(&key,sch);
+        des_set_key_unchecked(&key,sch);
         count=10;
         do      {
                 long i;
@@ -225,7 +225,7 @@ int main(int argc, char **argv)
 
         Time_F(START);
         for (count=0,run=1; COND(ca); count++)
-                des_set_key(&key,sch);
+                des_set_key_unchecked(&key,sch);
         d=Time_F(STOP);
         printf("%ld set_key's in %.2f seconds\n",count,d);
         a=((double)COUNT(ca))/d;
diff --git a/src/lib/libssl/src/crypto/des/str2key.c b/src/lib/libssl/src/crypto/des/str2key.c
index 24841452f1..c6abb87201 100644
--- a/src/lib/libssl/src/crypto/des/str2key.c
+++ b/src/lib/libssl/src/crypto/des/str2key.c
@@ -58,8 +58,6 @@
 
 #include "des_locl.h"
 
-OPENSSL_EXTERN int des_check_key;
-
 void des_string_to_key(const char *str, des_cblock *key)
         {
         des_key_schedule ks;
@@ -88,11 +86,8 @@ void des_string_to_key(const char *str, des_cblock *key)
                 }
 #endif
         des_set_odd_parity(key);
-        i=des_check_key;
-        des_check_key=0;
-        des_set_key(key,ks);
-        des_check_key=i;
-        des_cbc_cksum((unsigned char*)str,key,length,ks,key);
+        des_set_key_unchecked(key,ks);
+        des_cbc_cksum((const unsigned char*)str,key,length,ks,key);
         memset(ks,0,sizeof(ks));
         des_set_odd_parity(key);
         }
@@ -150,13 +145,10 @@ void des_string_to_2keys(const char *str, des_cblock *key1, des_cblock *key2)
 #endif
         des_set_odd_parity(key1);
         des_set_odd_parity(key2);
-        i=des_check_key;
-        des_check_key=0;
-        des_set_key(key1,ks);
-        des_cbc_cksum((unsigned char*)str,key1,length,ks,key1);
-        des_set_key(key2,ks);
-        des_cbc_cksum((unsigned char*)str,key2,length,ks,key2);
-        des_check_key=i;
+        des_set_key_unchecked(key1,ks);
+        des_cbc_cksum((const unsigned char*)str,key1,length,ks,key1);
+        des_set_key_unchecked(key2,ks);
+        des_cbc_cksum((const unsigned char*)str,key2,length,ks,key2);
         memset(ks,0,sizeof(ks));
         des_set_odd_parity(key1);
         des_set_odd_parity(key2);
diff --git a/src/lib/libssl/src/crypto/dh/Makefile.ssl b/src/lib/libssl/src/crypto/dh/Makefile.ssl
index 3b5ec0e115..8df60872ef 100644
--- a/src/lib/libssl/src/crypto/dh/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/dh/Makefile.ssl
@@ -83,26 +83,30 @@ dh_check.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dh_check.o: ../../include/openssl/dh.h ../../include/openssl/e_os.h
 dh_check.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dh_check.o: ../../include/openssl/opensslconf.h
-dh_check.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-dh_check.o: ../cryptlib.h
-dh_err.o: ../../include/openssl/bn.h ../../include/openssl/dh.h
-dh_err.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
+dh_check.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+dh_check.o: ../../include/openssl/stack.h ../cryptlib.h
+dh_err.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
+dh_err.o: ../../include/openssl/dh.h ../../include/openssl/err.h
+dh_err.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+dh_err.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 dh_gen.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dh_gen.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dh_gen.o: ../../include/openssl/dh.h ../../include/openssl/e_os.h
 dh_gen.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dh_gen.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-dh_gen.o: ../../include/openssl/stack.h ../cryptlib.h
+dh_gen.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+dh_gen.o: ../cryptlib.h
 dh_key.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dh_key.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dh_key.o: ../../include/openssl/dh.h ../../include/openssl/e_os.h
 dh_key.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dh_key.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-dh_key.o: ../../include/openssl/rand.h ../../include/openssl/stack.h
-dh_key.o: ../cryptlib.h
+dh_key.o: ../../include/openssl/rand.h ../../include/openssl/safestack.h
+dh_key.o: ../../include/openssl/stack.h ../cryptlib.h
 dh_lib.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dh_lib.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dh_lib.o: ../../include/openssl/dh.h ../../include/openssl/e_os.h
 dh_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dh_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-dh_lib.o: ../../include/openssl/stack.h ../cryptlib.h
+dh_lib.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+dh_lib.o: ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/dh/dh.h b/src/lib/libssl/src/crypto/dh/dh.h
index 2cc3797a94..c15b2ad483 100644
--- a/src/lib/libssl/src/crypto/dh/dh.h
+++ b/src/lib/libssl/src/crypto/dh/dh.h
@@ -68,10 +68,28 @@ extern "C" {
 #endif
 
 #include <openssl/bn.h>
+#include <openssl/crypto.h>
         
 #define DH_FLAG_CACHE_MONT_P    0x01
 
-typedef struct dh_st
+typedef struct dh_st DH;
+
+typedef struct dh_method {
+        const char *name;
+        /* Methods here */
+        int (*generate_key)(DH *dh);
+        int (*compute_key)(unsigned char *key,BIGNUM *pub_key,DH *dh);
+        int (*bn_mod_exp)(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx); /* Can be null */
+
+        int (*init)(DH *dh);
+        int (*finish)(DH *dh);
+        int flags;
+        char *app_data;
+} DH_METHOD;
+
+struct dh_st
         {
         /* This first argument is used to pick up errors when
          * a DH is passed instead of a EVP_PKEY */
@@ -80,12 +98,22 @@ typedef struct dh_st
         BIGNUM *p;
         BIGNUM *g;
         int length; /* optional */
-        BIGNUM *pub_key;        /* y */
+        BIGNUM *pub_key;        /* g^x */
         BIGNUM *priv_key;       /* x */
 
         int flags;
         char *method_mont_p;
-        } DH;
+        /* Place holders if we want to do X9.42 DH */
+        BIGNUM *q;
+        BIGNUM *j;
+        unsigned char *seed;
+        int seedlen;
+        BIGNUM *counter;
+
+        int references;
+        CRYPTO_EX_DATA ex_data;
+        DH_METHOD *meth;
+        };
 
 #define DH_GENERATOR_2          2
 /* #define DH_GENERATOR_3       3 */
@@ -93,10 +121,14 @@ typedef struct dh_st
 
 /* DH_check error codes */
 #define DH_CHECK_P_NOT_PRIME            0x01
-#define DH_CHECK_P_NOT_STRONG_PRIME     0x02
+#define DH_CHECK_P_NOT_SAFE_PRIME       0x02
 #define DH_UNABLE_TO_CHECK_GENERATOR    0x04
 #define DH_NOT_SUITABLE_GENERATOR       0x08
 
+/* primes p where (p-1)/2 is prime too are called "safe"; we define
+   this for backward compatibility: */
+#define DH_CHECK_P_NOT_STRONG_PRIME     DH_CHECK_P_NOT_SAFE_PRIME
+
 #define DHparams_dup(x) (DH *)ASN1_dup((int (*)())i2d_DHparams, \
                 (char *(*)())d2i_DHparams,(char *)(x))
 #define d2i_DHparams_fp(fp,x) (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
@@ -113,9 +145,20 @@ typedef struct dh_st
                 (unsigned char *)(x))
 #endif
 
+DH_METHOD *DH_OpenSSL(void);
+
+void DH_set_default_method(DH_METHOD *meth);
+DH_METHOD *DH_get_default_method(void);
+DH_METHOD *DH_set_method(DH *dh, DH_METHOD *meth);
+DH *DH_new_method(DH_METHOD *meth);
+
 DH *    DH_new(void);
 void    DH_free(DH *dh);
 int     DH_size(DH *dh);
+int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int DH_set_ex_data(DH *d, int idx, void *arg);
+void *DH_get_ex_data(DH *d, int idx);
 DH *    DH_generate_parameters(int prime_len,int generator,
                 void (*callback)(int,int,void *),void *cb_arg);
 int     DH_check(DH *dh,int *codes);
diff --git a/src/lib/libssl/src/crypto/dh/dh_check.c b/src/lib/libssl/src/crypto/dh/dh_check.c
index 95ce9cfad0..7e5cfd8bfc 100644
--- a/src/lib/libssl/src/crypto/dh/dh_check.c
+++ b/src/lib/libssl/src/crypto/dh/dh_check.c
@@ -61,7 +61,7 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
-/* Check that p is a strong prime and
+/* Check that p is a safe prime and
  * if g is 2, 3 or 5, check that is is a suitable generator
  * where
  * for 2, p mod 24 == 11
@@ -88,11 +88,13 @@ int DH_check(DH *dh, int *ret)
                 l=BN_mod_word(dh->p,24);
                 if (l != 11) *ret|=DH_NOT_SUITABLE_GENERATOR;
                 }
-/*      else if (BN_is_word(dh->g,DH_GENERATOR_3))
+#if 0
+        else if (BN_is_word(dh->g,DH_GENERATOR_3))
                 {
                 l=BN_mod_word(dh->p,12);
                 if (l != 5) *ret|=DH_NOT_SUITABLE_GENERATOR;
-                }*/
+                }
+#endif
         else if (BN_is_word(dh->g,DH_GENERATOR_5))
                 {
                 l=BN_mod_word(dh->p,10);
@@ -108,7 +110,7 @@ int DH_check(DH *dh, int *ret)
                 {
                 if (!BN_rshift1(q,dh->p)) goto err;
                 if (!BN_is_prime(q,BN_prime_checks,NULL,ctx,NULL))
-                        *ret|=DH_CHECK_P_NOT_STRONG_PRIME;
+                        *ret|=DH_CHECK_P_NOT_SAFE_PRIME;
                 }
         ok=1;
 err:
diff --git a/src/lib/libssl/src/crypto/dh/dh_gen.c b/src/lib/libssl/src/crypto/dh/dh_gen.c
index b7bcd2c7a4..7a6a38fbb4 100644
--- a/src/lib/libssl/src/crypto/dh/dh_gen.c
+++ b/src/lib/libssl/src/crypto/dh/dh_gen.c
@@ -72,14 +72,14 @@
  * Having said all that,
  * there is another special case method for the generators 2, 3 and 5.
  * for 2, p mod 24 == 11
- * for 3, p mod 12 == 5  <<<<< does not work for strong primes.
+ * for 3, p mod 12 == 5  <<<<< does not work for safe primes.
  * for 5, p mod 10 == 3 or 7
  *
  * Thanks to Phil Karn <karn@qualcomm.com> for the pointers about the
  * special generators and for answering some of my questions.
  *
  * I've implemented the second simple method :-).
- * Since DH should be using a strong prime (both p and q are prime),
+ * Since DH should be using a safe prime (both p and q are prime),
  * this generator function can take a very very long time to run.
  */
 
@@ -95,9 +95,10 @@ DH *DH_generate_parameters(int prime_len, int generator,
         if (ret == NULL) goto err;
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
-        t1= &(ctx->bn[0]);
-        t2= &(ctx->bn[1]);
-        ctx->tos=2;
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        t2 = BN_CTX_get(ctx);
+        if (t1 == NULL || t2 == NULL) goto err;
         
         if (generator == DH_GENERATOR_2)
                 {
@@ -105,7 +106,7 @@ DH *DH_generate_parameters(int prime_len, int generator,
                 BN_set_word(t2,11);
                 g=2;
                 }
-#ifdef undef  /* does not work for strong primes */
+#ifdef undef  /* does not work for safe primes */
         else if (generator == DH_GENERATOR_3)
                 {
                 BN_set_word(t1,12);
@@ -138,7 +139,11 @@ err:
                 ok=0;
                 }
 
-        if (ctx != NULL) BN_CTX_free(ctx);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
         if (!ok && (ret != NULL))
                 {
                 DH_free(ret);
diff --git a/src/lib/libssl/src/crypto/dh/dh_key.c b/src/lib/libssl/src/crypto/dh/dh_key.c
index cede53bfc1..0c7eeaf260 100644
--- a/src/lib/libssl/src/crypto/dh/dh_key.c
+++ b/src/lib/libssl/src/crypto/dh/dh_key.c
@@ -62,8 +62,42 @@
 #include <openssl/rand.h>
 #include <openssl/dh.h>
 
+static int generate_key(DH *dh);
+static int compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh);
+static int dh_bn_mod_exp(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *m, BN_CTX *ctx,
+                        BN_MONT_CTX *m_ctx);
+static int dh_init(DH *dh);
+static int dh_finish(DH *dh);
+
 int DH_generate_key(DH *dh)
         {
+        return dh->meth->generate_key(dh);
+        }
+
+int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
+        {
+        return dh->meth->compute_key(key, pub_key, dh);
+        }
+
+static DH_METHOD dh_ossl = {
+"OpenSSL DH Method",
+generate_key,
+compute_key,
+dh_bn_mod_exp,
+dh_init,
+dh_finish,
+0,
+NULL
+};
+
+DH_METHOD *DH_OpenSSL(void)
+{
+        return &dh_ossl;
+}
+
+static int generate_key(DH *dh)
+        {
         int ok=0;
         unsigned int i;
         BN_CTX ctx;
@@ -103,7 +137,8 @@ int DH_generate_key(DH *dh)
                 }
         mont=(BN_MONT_CTX *)dh->method_mont_p;
 
-        if (!BN_mod_exp_mont(pub_key,dh->g,priv_key,dh->p,&ctx,mont)) goto err;
+        if (!dh->meth->bn_mod_exp(dh, pub_key,dh->g,priv_key,dh->p,&ctx,mont))
+                                                                goto err;
                 
         dh->pub_key=pub_key;
         dh->priv_key=priv_key;
@@ -118,7 +153,7 @@ err:
         return(ok);
         }
 
-int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
+static int compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
         {
         BN_CTX ctx;
         BN_MONT_CTX *mont;
@@ -126,7 +161,8 @@ int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
         int ret= -1;
 
         BN_CTX_init(&ctx);
-        tmp= &(ctx.bn[ctx.tos++]);
+        BN_CTX_start(&ctx);
+        tmp = BN_CTX_get(&ctx);
         
         if (dh->priv_key == NULL)
                 {
@@ -141,7 +177,7 @@ int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
                 }
 
         mont=(BN_MONT_CTX *)dh->method_mont_p;
-        if (!BN_mod_exp_mont(tmp,pub_key,dh->priv_key,dh->p,&ctx,mont))
+        if (!dh->meth->bn_mod_exp(dh, tmp,pub_key,dh->priv_key,dh->p,&ctx,mont))
                 {
                 DHerr(DH_F_DH_COMPUTE_KEY,ERR_R_BN_LIB);
                 goto err;
@@ -149,6 +185,27 @@ int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh)
 
         ret=BN_bn2bin(tmp,key);
 err:
+        BN_CTX_end(&ctx);
         BN_CTX_free(&ctx);
         return(ret);
         }
+
+static int dh_bn_mod_exp(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *m, BN_CTX *ctx,
+                        BN_MONT_CTX *m_ctx)
+{
+        return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx);
+}
+
+static int dh_init(DH *dh)
+{
+        dh->flags |= DH_FLAG_CACHE_MONT_P;
+        return(1);
+}
+
+static int dh_finish(DH *dh)
+{
+        if(dh->method_mont_p)
+                BN_MONT_CTX_free((BN_MONT_CTX *)dh->method_mont_p);
+        return(1);
+}
diff --git a/src/lib/libssl/src/crypto/dh/dh_lib.c b/src/lib/libssl/src/crypto/dh/dh_lib.c
index 61e0720e8a..6c21463028 100644
--- a/src/lib/libssl/src/crypto/dh/dh_lib.c
+++ b/src/lib/libssl/src/crypto/dh/dh_lib.c
@@ -63,16 +63,49 @@
 
 const char *DH_version="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
 
+static DH_METHOD *default_DH_method;
+static int dh_meth_num = 0;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *dh_meth = NULL;
+
+void DH_set_default_method(DH_METHOD *meth)
+{
+        default_DH_method = meth;
+}
+
+DH_METHOD *DH_get_default_method(void)
+{
+        if(!default_DH_method) default_DH_method = DH_OpenSSL();
+        return default_DH_method;
+}
+
+DH_METHOD *DH_set_method(DH *dh, DH_METHOD *meth)
+{
+        DH_METHOD *mtmp;
+        mtmp = dh->meth;
+        if (mtmp->finish) mtmp->finish(dh);
+        dh->meth = meth;
+        if (meth->init) meth->init(dh);
+        return mtmp;
+}
+
 DH *DH_new(void)
+{
+        return DH_new_method(NULL);
+}
+
+DH *DH_new_method(DH_METHOD *meth)
         {
         DH *ret;
-
         ret=(DH *)Malloc(sizeof(DH));
+
         if (ret == NULL)
                 {
                 DHerr(DH_F_DH_NEW,ERR_R_MALLOC_FAILURE);
                 return(NULL);
                 }
+        if(!default_DH_method) default_DH_method = DH_OpenSSL();
+        if(meth) ret->meth = meth;
+        else ret->meth = default_DH_method;
         ret->pad=0;
         ret->version=0;
         ret->p=NULL;
@@ -80,23 +113,74 @@ DH *DH_new(void)
         ret->length=0;
         ret->pub_key=NULL;
         ret->priv_key=NULL;
-        ret->flags=DH_FLAG_CACHE_MONT_P;
+        ret->q=NULL;
+        ret->j=NULL;
+        ret->seed = NULL;
+        ret->seedlen = 0;
+        ret->counter = NULL;
         ret->method_mont_p=NULL;
+        ret->references = 1;
+        ret->flags=ret->meth->flags;
+        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
+                {
+                Free(ret);
+                ret=NULL;
+                }
+        else
+                CRYPTO_new_ex_data(dh_meth,ret,&ret->ex_data);
         return(ret);
         }
 
 void DH_free(DH *r)
         {
+        int i;
         if(r == NULL) return;
+        i = CRYPTO_add(&r->references, -1, CRYPTO_LOCK_DH);
+#ifdef REF_PRINT
+        REF_PRINT("DH",r);
+#endif
+        if (i > 0) return;
+#ifdef REF_CHECK
+        if (i < 0)
+                {
+                fprintf(stderr,"DH_free, bad reference count\n");
+                abort();
+        }
+#endif
+
+        CRYPTO_free_ex_data(dh_meth, r, &r->ex_data);
+
+        if(r->meth->finish) r->meth->finish(r);
+
         if (r->p != NULL) BN_clear_free(r->p);
         if (r->g != NULL) BN_clear_free(r->g);
+        if (r->q != NULL) BN_clear_free(r->q);
+        if (r->j != NULL) BN_clear_free(r->j);
+        if (r->seed) Free(r->seed);
+        if (r->counter != NULL) BN_clear_free(r->counter);
         if (r->pub_key != NULL) BN_clear_free(r->pub_key);
         if (r->priv_key != NULL) BN_clear_free(r->priv_key);
-        if (r->method_mont_p != NULL)
-                BN_MONT_CTX_free((BN_MONT_CTX *)r->method_mont_p);
         Free(r);
         }
 
+int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        dh_meth_num++;
+        return(CRYPTO_get_ex_new_index(dh_meth_num-1,
+                &dh_meth,argl,argp,new_func,dup_func,free_func));
+        }
+
+int DH_set_ex_data(DH *d, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&d->ex_data,idx,arg));
+        }
+
+void *DH_get_ex_data(DH *d, int idx)
+        {
+        return(CRYPTO_get_ex_data(&d->ex_data,idx));
+        }
+
 int DH_size(DH *dh)
         {
         return(BN_num_bytes(dh->p));
diff --git a/src/lib/libssl/src/crypto/dh/dhtest.c b/src/lib/libssl/src/crypto/dh/dhtest.c
index 770331971f..d66c28455e 100644
--- a/src/lib/libssl/src/crypto/dh/dhtest.c
+++ b/src/lib/libssl/src/crypto/dh/dhtest.c
@@ -65,6 +65,7 @@
 #include <openssl/crypto.h>
 #include <openssl/bio.h>
 #include <openssl/bn.h>
+#include <openssl/rand.h>
 
 #ifdef NO_DH
 int main(int argc, char *argv[])
@@ -87,19 +88,23 @@ static void MS_CALLBACK cb(int p, int n, void *arg);
 #include "bss_file.c"
 #endif
 
-BIO *out=NULL;
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 
 int main(int argc, char *argv[])
         {
-        DH *a,*b;
+        DH *a;
+        DH *b=NULL;
         char buf[12];
         unsigned char *abuf=NULL,*bbuf=NULL;
         int i,alen,blen,aout,bout,ret=1;
+        BIO *out;
 
 #ifdef WIN32
         CRYPTO_malloc_init();
 #endif
 
+        RAND_seed(rnd_seed, sizeof rnd_seed);
+
         out=BIO_new(BIO_s_file());
         if (out == NULL) exit(1);
         BIO_set_fp(out,stdout,BIO_NOCLOSE);
@@ -167,6 +172,9 @@ int main(int argc, char *argv[])
 err:
         if (abuf != NULL) Free(abuf);
         if (bbuf != NULL) Free(bbuf);
+        if(b != NULL) DH_free(b);
+        if(a != NULL) DH_free(a);
+        BIO_free(out);
         exit(ret);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/dsa/Makefile.ssl b/src/lib/libssl/src/crypto/dsa/Makefile.ssl
index 4bc74a2f7c..b0bcf974fb 100644
--- a/src/lib/libssl/src/crypto/dsa/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/dsa/Makefile.ssl
@@ -22,8 +22,10 @@ TEST=dsatest.c
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC= dsa_gen.c dsa_key.c dsa_lib.c dsa_asn1.c dsa_vrf.c dsa_sign.c dsa_err.c
-LIBOBJ= dsa_gen.o dsa_key.o dsa_lib.o dsa_asn1.o dsa_vrf.o dsa_sign.o dsa_err.o
+LIBSRC= dsa_gen.c dsa_key.c dsa_lib.c dsa_asn1.c dsa_vrf.c dsa_sign.c \
+        dsa_err.c dsa_ossl.c
+LIBOBJ= dsa_gen.o dsa_key.o dsa_lib.o dsa_asn1.o dsa_vrf.o dsa_sign.o \
+        dsa_err.o dsa_ossl.o
 
 SRC= $(LIBSRC)
 
@@ -86,25 +88,27 @@ dsa_asn1.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 dsa_asn1.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 dsa_asn1.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
 dsa_asn1.o: ../../include/openssl/stack.h ../cryptlib.h
-dsa_err.o: ../../include/openssl/bn.h ../../include/openssl/dh.h
-dsa_err.o: ../../include/openssl/dsa.h ../../include/openssl/err.h
-dsa_err.o: ../../include/openssl/opensslconf.h
+dsa_err.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
+dsa_err.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+dsa_err.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
+dsa_err.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+dsa_err.o: ../../include/openssl/stack.h
 dsa_gen.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dsa_gen.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dsa_gen.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 dsa_gen.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 dsa_gen.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 dsa_gen.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-dsa_gen.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-dsa_gen.o: ../cryptlib.h
+dsa_gen.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+dsa_gen.o: ../../include/openssl/stack.h ../cryptlib.h
 dsa_key.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dsa_key.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dsa_key.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 dsa_key.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 dsa_key.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 dsa_key.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-dsa_key.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-dsa_key.o: ../cryptlib.h
+dsa_key.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+dsa_key.o: ../../include/openssl/stack.h ../cryptlib.h
 dsa_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 dsa_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 dsa_lib.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
@@ -113,6 +117,15 @@ dsa_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 dsa_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 dsa_lib.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 dsa_lib.o: ../cryptlib.h
+dsa_ossl.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+dsa_ossl.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+dsa_ossl.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
+dsa_ossl.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+dsa_ossl.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+dsa_ossl.o: ../../include/openssl/opensslconf.h
+dsa_ossl.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
+dsa_ossl.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+dsa_ossl.o: ../cryptlib.h
 dsa_sign.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 dsa_sign.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 dsa_sign.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
diff --git a/src/lib/libssl/src/crypto/dsa/dsa.h b/src/lib/libssl/src/crypto/dsa/dsa.h
index 20b3f8d90a..68d9912cbc 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa.h
+++ b/src/lib/libssl/src/crypto/dsa/dsa.h
@@ -74,13 +74,41 @@ extern "C" {
 #endif
 
 #include <openssl/bn.h>
+#include <openssl/crypto.h>
 #ifndef NO_DH
 # include <openssl/dh.h>
 #endif
 
 #define DSA_FLAG_CACHE_MONT_P   0x01
 
-typedef struct dsa_st
+typedef struct dsa_st DSA;
+
+typedef struct DSA_SIG_st
+        {
+        BIGNUM *r;
+        BIGNUM *s;
+        } DSA_SIG;
+
+typedef struct dsa_method {
+        const char *name;
+        DSA_SIG * (*dsa_do_sign)(const unsigned char *dgst, int dlen, DSA *dsa);
+        int (*dsa_sign_setup)(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
+                                                                BIGNUM **rp);
+        int (*dsa_do_verify)(const unsigned char *dgst, int dgst_len,
+                                                        DSA_SIG *sig, DSA *dsa);
+        int (*dsa_mod_exp)(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
+                        BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
+                        BN_MONT_CTX *in_mont);
+        int (*bn_mod_exp)(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx); /* Can be null */
+        int (*init)(DSA *dsa);
+        int (*finish)(DSA *dsa);
+        int flags;
+        char *app_data;
+} DSA_METHOD;
+
+struct dsa_st
         {
         /* This first variable is used to pick up errors where
          * a DSA is passed instead of of a EVP_PKEY */
@@ -100,15 +128,10 @@ typedef struct dsa_st
         int flags;
         /* Normally used to cache montgomery values */
         char *method_mont_p;
-
         int references;
-        } DSA;
-
-typedef struct DSA_SIG_st
-        {
-        BIGNUM *r;
-        BIGNUM *s;
-        } DSA_SIG;
+        CRYPTO_EX_DATA ex_data;
+        DSA_METHOD *meth;
+        };
 
 #define DSAparams_dup(x) (DSA *)ASN1_dup((int (*)())i2d_DSAparams, \
                 (char *(*)())d2i_DSAparams,(char *)(x))
@@ -131,7 +154,14 @@ DSA_SIG * DSA_do_sign(const unsigned char *dgst,int dlen,DSA *dsa);
 int     DSA_do_verify(const unsigned char *dgst,int dgst_len,
                       DSA_SIG *sig,DSA *dsa);
 
+DSA_METHOD *DSA_OpenSSL(void);
+
+void        DSA_set_default_method(DSA_METHOD *);
+DSA_METHOD *DSA_get_default_method(void);
+DSA_METHOD *DSA_set_method(DSA *dsa, DSA_METHOD *);
+
 DSA *   DSA_new(void);
+DSA *   DSA_new_method(DSA_METHOD *meth);
 int     DSA_size(DSA *);
         /* next 4 return -1 on error */
 int     DSA_sign_setup( DSA *dsa,BN_CTX *ctx_in,BIGNUM **kinvp,BIGNUM **rp);
@@ -140,6 +170,10 @@ int	DSA_sign(int type,const unsigned char *dgst,int dlen,
 int     DSA_verify(int type,const unsigned char *dgst,int dgst_len,
                 unsigned char *sigbuf, int siglen, DSA *dsa);
 void    DSA_free (DSA *r);
+int DSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int DSA_set_ex_data(DSA *d, int idx, void *arg);
+void *DSA_get_ex_data(DSA *d, int idx);
 
 void    ERR_load_DSA_strings(void );
 
@@ -148,7 +182,7 @@ DSA *	d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length);
 DSA *   d2i_DSAparams(DSA **a, unsigned char **pp, long length);
 DSA *   DSA_generate_parameters(int bits, unsigned char *seed,int seed_len,
                 int *counter_ret, unsigned long *h_ret,void
-                (*callback)(),char *cb_arg);
+                (*callback)(int, int, void *),void *cb_arg);
 int     DSA_generate_key(DSA *a);
 int     i2d_DSAPublicKey(DSA *a, unsigned char **pp);
 int     i2d_DSAPrivateKey(DSA *a, unsigned char **pp);
@@ -163,7 +197,11 @@ int	DSAparams_print_fp(FILE *fp, DSA *x);
 int     DSA_print_fp(FILE *bp, DSA *x, int off);
 #endif
 
-int DSA_is_prime(BIGNUM *q,void (*callback)(),char *cb_arg);
+#define DSS_prime_checks 50
+/* Primality test according to FIPS PUB 186[-1], Appendix 2.1:
+ * 50 rounds of Rabin-Miller */
+#define DSA_is_prime(n, callback, cb_arg) \
+        BN_is_prime(n, DSS_prime_checks, callback, NULL, cb_arg)
 
 #ifndef NO_DH
 /* Convert DSA structure (key or just parameters) into DH structure
@@ -184,7 +222,6 @@ DH *DSA_dup_DH(DSA *r);
 #define DSA_F_DSAPARAMS_PRINT_FP                         101
 #define DSA_F_DSA_DO_SIGN                                112
 #define DSA_F_DSA_DO_VERIFY                              113
-#define DSA_F_DSA_IS_PRIME                               102
 #define DSA_F_DSA_NEW                                    103
 #define DSA_F_DSA_PRINT                                  104
 #define DSA_F_DSA_PRINT_FP                               105
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_asn1.c b/src/lib/libssl/src/crypto/dsa/dsa_asn1.c
index 7523b21654..c9b32b4db7 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_asn1.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_asn1.c
@@ -83,7 +83,7 @@ DSA_SIG *d2i_DSA_SIG(DSA_SIG **a, unsigned char **pp, long length)
         M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
         if ((ret->s=BN_bin2bn(bs->data,bs->length,ret->s)) == NULL)
                 goto err_bn;
-        ASN1_BIT_STRING_free(bs);
+        M_ASN1_BIT_STRING_free(bs);
         M_ASN1_D2I_Finish_2(a);
 
 err_bn:
@@ -91,6 +91,6 @@ err_bn:
 err:
         DSAerr(DSA_F_D2I_DSA_SIG,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_SIG_free(ret);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
+        if (bs != NULL) M_ASN1_BIT_STRING_free(bs);
         return(NULL);
 }
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_err.c b/src/lib/libssl/src/crypto/dsa/dsa_err.c
index 33a8270afd..38e4af968c 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_err.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_err.c
@@ -70,7 +70,6 @@ static ERR_STRING_DATA DSA_str_functs[]=
 {ERR_PACK(0,DSA_F_DSAPARAMS_PRINT_FP,0),        "DSAparams_print_fp"},
 {ERR_PACK(0,DSA_F_DSA_DO_SIGN,0),       "DSA_do_sign"},
 {ERR_PACK(0,DSA_F_DSA_DO_VERIFY,0),     "DSA_do_verify"},
-{ERR_PACK(0,DSA_F_DSA_IS_PRIME,0),      "DSA_is_prime"},
 {ERR_PACK(0,DSA_F_DSA_NEW,0),   "DSA_new"},
 {ERR_PACK(0,DSA_F_DSA_PRINT,0), "DSA_print"},
 {ERR_PACK(0,DSA_F_DSA_PRINT_FP,0),      "DSA_print_fp"},
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_gen.c b/src/lib/libssl/src/crypto/dsa/dsa_gen.c
index b5e5ec06e5..2294a362d9 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_gen.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_gen.c
@@ -59,12 +59,18 @@
 #undef GENUINE_DSA
 
 #ifdef GENUINE_DSA
+/* Parameter generation follows the original release of FIPS PUB 186,
+ * Appendix 2.2 (i.e. use SHA as defined in FIPS PUB 180) */
 #define HASH    SHA
 #else
+/* Parameter generation follows the updated Appendix 2.2 for FIPS PUB 186,
+ * also Appendix 2.2 of FIPS PUB 186-1 (i.e. use SHA as defined in
+ * FIPS PUB 180-1) */
 #define HASH    SHA1
 #endif 
 
 #ifndef NO_SHA
+
 #include <stdio.h>
 #include <time.h>
 #include "cryptlib.h"
@@ -74,8 +80,9 @@
 #include <openssl/rand.h>
 
 DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
-             int *counter_ret, unsigned long *h_ret, void (*callback)(),
-             char *cb_arg)
+                int *counter_ret, unsigned long *h_ret,
+                void (*callback)(int, int, void *),
+                void *cb_arg)
         {
         int ok=0;
         unsigned char seed[SHA_DIGEST_LENGTH];
@@ -86,47 +93,63 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
         BN_MONT_CTX *mont=NULL;
         int k,n=0,i,b,m=0;
         int counter=0;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
+        int r=0;
+        BN_CTX *ctx=NULL,*ctx2=NULL,*ctx3=NULL;
         unsigned int h=2;
         DSA *ret=NULL;
 
         if (bits < 512) bits=512;
         bits=(bits+63)/64*64;
 
+        if (seed_len < 20)
+                seed_in = NULL; /* seed buffer too small -- ignore */
+        if (seed_len > 20) 
+                seed_len = 20; /* App. 2.2 of FIPS PUB 186 allows larger SEED,
+                                * but our internal buffers are restricted to 160 bits*/
         if ((seed_in != NULL) && (seed_len == 20))
                 memcpy(seed,seed_in,seed_len);
 
         if ((ctx=BN_CTX_new()) == NULL) goto err;
         if ((ctx2=BN_CTX_new()) == NULL) goto err;
+        if ((ctx3=BN_CTX_new()) == NULL) goto err;
         if ((ret=DSA_new()) == NULL) goto err;
 
         if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
 
-        r0= &(ctx2->bn[0]);
-        g= &(ctx2->bn[1]);
-        W= &(ctx2->bn[2]);
-        q= &(ctx2->bn[3]);
-        X= &(ctx2->bn[4]);
-        c= &(ctx2->bn[5]);
-        p= &(ctx2->bn[6]);
-        test= &(ctx2->bn[7]);
+        BN_CTX_start(ctx2);
+        r0 = BN_CTX_get(ctx2);
+        g = BN_CTX_get(ctx2);
+        W = BN_CTX_get(ctx2);
+        q = BN_CTX_get(ctx2);
+        X = BN_CTX_get(ctx2);
+        c = BN_CTX_get(ctx2);
+        p = BN_CTX_get(ctx2);
+        test = BN_CTX_get(ctx2);
 
         BN_lshift(test,BN_value_one(),bits-1);
 
         for (;;)
                 {
-                for (;;)
+                for (;;) /* find q */
                         {
+                        int seed_is_random;
+
                         /* step 1 */
                         if (callback != NULL) callback(0,m++,cb_arg);
 
                         if (!seed_len)
-                                RAND_bytes(seed,SHA_DIGEST_LENGTH);
+                                {
+                                RAND_pseudo_bytes(seed,SHA_DIGEST_LENGTH);
+                                seed_is_random = 1;
+                                }
                         else
-                                seed_len=0;
-
+                                {
+                                seed_is_random = 0;
+                                seed_len=0; /* use random seed if 'seed_in' turns out to be bad*/
+                                }
                         memcpy(buf,seed,SHA_DIGEST_LENGTH);
                         memcpy(buf2,seed,SHA_DIGEST_LENGTH);
+                        /* precompute "SEED + 1" for step 7: */
                         for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
                                 {
                                 buf[i]++;
@@ -142,10 +165,15 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                         /* step 3 */
                         md[0]|=0x80;
                         md[SHA_DIGEST_LENGTH-1]|=0x01;
-                        if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) abort();
+                        if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) goto err;
 
                         /* step 4 */
-                        if (DSA_is_prime(q,callback,cb_arg) > 0) break;
+                        r = BN_is_prime_fasttest(q, DSS_prime_checks, callback, ctx3, cb_arg, seed_is_random);
+                        if (r > 0)
+                                break;
+                        if (r != 0)
+                                goto err;
+
                         /* do a callback call */
                         /* step 5 */
                         }
@@ -155,16 +183,22 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
 
                 /* step 6 */
                 counter=0;
+                /* "offset = 2" */
 
                 n=(bits-1)/160;
                 b=(bits-1)-n*160;
 
                 for (;;)
                         {
+                        if (callback != NULL && counter != 0)
+                                callback(0,counter,cb_arg);
+
                         /* step 7 */
                         BN_zero(W);
+                        /* now 'buf' contains "SEED + offset - 1" */
                         for (k=0; k<=n; k++)
                                 {
+                                /* obtain "SEED + offset + k" by incrementing: */
                                 for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
                                         {
                                         buf[i]++;
@@ -174,7 +208,8 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                                 HASH(buf,SHA_DIGEST_LENGTH,md);
 
                                 /* step 8 */
-                                if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0)) abort();
+                                if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0))
+                                        goto err;
                                 BN_lshift(r0,r0,160*k);
                                 BN_add(W,W,r0);
                                 }
@@ -194,23 +229,25 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                         if (BN_cmp(p,test) >= 0)
                                 {
                                 /* step 11 */
-                                if (DSA_is_prime(p,callback,cb_arg) > 0)
-                                        goto end;
+                                r = BN_is_prime_fasttest(p, DSS_prime_checks, callback, ctx3, cb_arg, 1);
+                                if (r > 0)
+                                                goto end; /* found it */
+                                if (r != 0)
+                                        goto err;
                                 }
 
                         /* step 13 */
                         counter++;
+                        /* "offset = offset + n + 1" */
 
                         /* step 14 */
                         if (counter >= 4096) break;
-
-                        if (callback != NULL) callback(0,counter,cb_arg);
                         }
                 }
 end:
         if (callback != NULL) callback(2,1,cb_arg);
 
-        /* We now need to gernerate g */
+        /* We now need to generate g */
         /* Set r0=(p-1)/q */
         BN_sub(test,p,BN_value_one());
         BN_div(r0,NULL,test,q,ctx);
@@ -245,89 +282,13 @@ err:
                 if (h_ret != NULL) *h_ret=h;
                 }
         if (ctx != NULL) BN_CTX_free(ctx);
-        if (ctx != NULL) BN_CTX_free(ctx2);
-        if (mont != NULL) BN_MONT_CTX_free(mont);
-        return(ok?ret:NULL);
-        }
-
-int DSA_is_prime(BIGNUM *w, void (*callback)(), char *cb_arg)
-        {
-        int ok= -1,j,i,n;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
-        BIGNUM *w_1,*b,*m,*z,*tmp,*mont_1;
-        int a;
-        BN_MONT_CTX *mont=NULL;
-
-        if (!BN_is_bit_set(w,0)) return(0);
-
-        if ((ctx=BN_CTX_new()) == NULL) goto err;
-        if ((ctx2=BN_CTX_new()) == NULL) goto err;
-        if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
-
-        m=   &(ctx2->bn[2]);
-        b=   &(ctx2->bn[3]);
-        z=   &(ctx2->bn[4]);
-        w_1= &(ctx2->bn[5]);
-        tmp= &(ctx2->bn[6]);
-        mont_1= &(ctx2->bn[7]);
-
-        /* step 1 */
-        n=50;
-
-        /* step 2 */
-        if (!BN_sub(w_1,w,BN_value_one())) goto err;
-        for (a=1; !BN_is_bit_set(w_1,a); a++)
-                ;
-        if (!BN_rshift(m,w_1,a)) goto err;
-
-        BN_MONT_CTX_set(mont,w,ctx);
-        BN_to_montgomery(mont_1,BN_value_one(),mont,ctx);
-        BN_to_montgomery(w_1,w_1,mont,ctx);
-        for (i=1; i < n; i++)
+        if (ctx2 != NULL)
                 {
-                /* step 3 */
-                BN_rand(b,BN_num_bits(w)-2/*-1*/,0,0);
-                /* BN_set_word(b,0x10001L); */
-
-                /* step 4 */
-                j=0;
-                if (!BN_mod_exp_mont(z,b,m,w,ctx,mont)) goto err;
-
-                if (!BN_to_montgomery(z,z,mont,ctx)) goto err;
-
-                /* step 5 */
-                for (;;)
-                        {
-                        if (((j == 0) && (BN_cmp(z,mont_1) == 0)) ||
-                                (BN_cmp(z,w_1) == 0))
-                                break;
-
-                        /* step 6 */
-                        if ((j > 0) && (BN_cmp(z,mont_1) == 0))
-                                {
-                                ok=0;
-                                goto err;
-                                }
-
-                        j++;
-                        if (j >= a)
-                                {
-                                ok=0;
-                                goto err;
-                                }
-
-                        if (!BN_mod_mul_montgomery(z,z,z,mont,ctx)) goto err;
-                        if (callback != NULL) callback(1,j,cb_arg);
-                        }
+                BN_CTX_end(ctx2);
+                BN_CTX_free(ctx2);
                 }
-
-        ok=1;
-err:
-        if (ok == -1) DSAerr(DSA_F_DSA_IS_PRIME,ERR_R_BN_LIB);
-        BN_CTX_free(ctx);
-        BN_CTX_free(ctx2);
-        BN_MONT_CTX_free(mont);
-        
-        return(ok);
+        if (ctx3 != NULL) BN_CTX_free(ctx3);
+        if (mont != NULL) BN_MONT_CTX_free(mont);
+        return(ok?ret:NULL);
         }
 #endif
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_lib.c b/src/lib/libssl/src/crypto/dsa/dsa_lib.c
index ce8e204f7e..224e412afc 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_lib.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_lib.c
@@ -66,7 +66,38 @@
 
 const char *DSA_version="DSA" OPENSSL_VERSION_PTEXT;
 
+static DSA_METHOD *default_DSA_method;
+static int dsa_meth_num = 0;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *dsa_meth = NULL;
+
+void DSA_set_default_method(DSA_METHOD *meth)
+{
+        default_DSA_method = meth;
+}
+
+DSA_METHOD *DSA_get_default_method(void)
+{
+        if(!default_DSA_method) default_DSA_method = DSA_OpenSSL();
+        return default_DSA_method;
+}
+
 DSA *DSA_new(void)
+{
+        return DSA_new_method(NULL);
+}
+
+DSA_METHOD *DSA_set_method(DSA *dsa, DSA_METHOD *meth)
+{
+        DSA_METHOD *mtmp;
+        mtmp = dsa->meth;
+        if (mtmp->finish) mtmp->finish(dsa);
+        dsa->meth = meth;
+        if (meth->init) meth->init(dsa);
+        return mtmp;
+}
+
+
+DSA *DSA_new_method(DSA_METHOD *meth)
         {
         DSA *ret;
 
@@ -76,13 +107,15 @@ DSA *DSA_new(void)
                 DSAerr(DSA_F_DSA_NEW,ERR_R_MALLOC_FAILURE);
                 return(NULL);
                 }
+        if(!default_DSA_method) default_DSA_method = DSA_OpenSSL();
+        if(meth) ret->meth = meth;
+        else ret->meth = default_DSA_method;
         ret->pad=0;
         ret->version=0;
         ret->write_params=1;
         ret->p=NULL;
         ret->q=NULL;
         ret->g=NULL;
-        ret->flags=DSA_FLAG_CACHE_MONT_P;
 
         ret->pub_key=NULL;
         ret->priv_key=NULL;
@@ -92,6 +125,15 @@ DSA *DSA_new(void)
         ret->method_mont_p=NULL;
 
         ret->references=1;
+        ret->flags=ret->meth->flags;
+        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
+                {
+                Free(ret);
+                ret=NULL;
+                }
+        else
+                CRYPTO_new_ex_data(dsa_meth,ret,&ret->ex_data);
+        
         return(ret);
         }
 
@@ -114,6 +156,10 @@ void DSA_free(DSA *r)
                 }
 #endif
 
+        CRYPTO_free_ex_data(dsa_meth, r, &r->ex_data);
+
+        if(r->meth->finish) r->meth->finish(r);
+
         if (r->p != NULL) BN_clear_free(r->p);
         if (r->q != NULL) BN_clear_free(r->q);
         if (r->g != NULL) BN_clear_free(r->g);
@@ -121,8 +167,6 @@ void DSA_free(DSA *r)
         if (r->priv_key != NULL) BN_clear_free(r->priv_key);
         if (r->kinv != NULL) BN_clear_free(r->kinv);
         if (r->r != NULL) BN_clear_free(r->r);
-        if (r->method_mont_p != NULL)
-                BN_MONT_CTX_free((BN_MONT_CTX *)r->method_mont_p);
         Free(r);
         }
 
@@ -145,6 +189,24 @@ int DSA_size(DSA *r)
         return(ret);
         }
 
+int DSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        dsa_meth_num++;
+        return(CRYPTO_get_ex_new_index(dsa_meth_num-1,
+                &dsa_meth,argl,argp,new_func,dup_func,free_func));
+        }
+
+int DSA_set_ex_data(DSA *d, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&d->ex_data,idx,arg));
+        }
+
+void *DSA_get_ex_data(DSA *d, int idx)
+        {
+        return(CRYPTO_get_ex_data(&d->ex_data,idx));
+        }
+
 #ifndef NO_DH
 DH *DSA_dup_DH(DSA *r)
         {
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_ossl.c b/src/lib/libssl/src/crypto/dsa/dsa_ossl.c
new file mode 100644
index 0000000000..b51cf6ad8d
--- /dev/null
+++ b/src/lib/libssl/src/crypto/dsa/dsa_ossl.c
@@ -0,0 +1,321 @@
+/* crypto/dsa/dsa_ossl.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+/* Original version from Steven Schoch <schoch@sheba.arc.nasa.gov> */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/bn.h>
+#include <openssl/dsa.h>
+#include <openssl/rand.h>
+#include <openssl/asn1.h>
+
+static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp);
+static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
+                  DSA *dsa);
+static int dsa_init(DSA *dsa);
+static int dsa_finish(DSA *dsa);
+static int dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
+                BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *in_mont);
+static int dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx);
+
+static DSA_METHOD openssl_dsa_meth = {
+"OpenSSL DSA method",
+dsa_do_sign,
+dsa_sign_setup,
+dsa_do_verify,
+dsa_mod_exp,
+dsa_bn_mod_exp,
+dsa_init,
+dsa_finish,
+0,
+NULL
+};
+
+DSA_METHOD *DSA_OpenSSL(void)
+{
+        return &openssl_dsa_meth;
+}
+
+static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
+        {
+        BIGNUM *kinv=NULL,*r=NULL,*s=NULL;
+        BIGNUM m;
+        BIGNUM xr;
+        BN_CTX *ctx=NULL;
+        int i,reason=ERR_R_BN_LIB;
+        DSA_SIG *ret=NULL;
+
+        BN_init(&m);
+        BN_init(&xr);
+        s=BN_new();
+        if (s == NULL) goto err;
+
+        i=BN_num_bytes(dsa->q); /* should be 20 */
+        if ((dlen > i) || (dlen > 50))
+                {
+                reason=DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE;
+                goto err;
+                }
+
+        ctx=BN_CTX_new();
+        if (ctx == NULL) goto err;
+
+        if ((dsa->kinv == NULL) || (dsa->r == NULL))
+                {
+                if (!DSA_sign_setup(dsa,ctx,&kinv,&r)) goto err;
+                }
+        else
+                {
+                kinv=dsa->kinv;
+                dsa->kinv=NULL;
+                r=dsa->r;
+                dsa->r=NULL;
+                }
+
+        if (BN_bin2bn(dgst,dlen,&m) == NULL) goto err;
+
+        /* Compute  s = inv(k) (m + xr) mod q */
+        if (!BN_mod_mul(&xr,dsa->priv_key,r,dsa->q,ctx)) goto err;/* s = xr */
+        if (!BN_add(s, &xr, &m)) goto err;              /* s = m + xr */
+        if (BN_cmp(s,dsa->q) > 0)
+                BN_sub(s,s,dsa->q);
+        if (!BN_mod_mul(s,s,kinv,dsa->q,ctx)) goto err;
+
+        ret=DSA_SIG_new();
+        if (ret == NULL) goto err;
+        ret->r = r;
+        ret->s = s;
+        
+err:
+        if (!ret)
+                {
+                DSAerr(DSA_F_DSA_DO_SIGN,reason);
+                BN_free(r);
+                BN_free(s);
+                }
+        if (ctx != NULL) BN_CTX_free(ctx);
+        BN_clear_free(&m);
+        BN_clear_free(&xr);
+        if (kinv != NULL) /* dsa->kinv is NULL now if we used it */
+            BN_clear_free(kinv);
+        return(ret);
+        }
+
+static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
+        {
+        BN_CTX *ctx;
+        BIGNUM k,*kinv=NULL,*r=NULL;
+        int ret=0;
+
+        if (ctx_in == NULL)
+                {
+                if ((ctx=BN_CTX_new()) == NULL) goto err;
+                }
+        else
+                ctx=ctx_in;
+
+        BN_init(&k);
+        if ((r=BN_new()) == NULL) goto err;
+        kinv=NULL;
+
+        /* Get random k */
+        for (;;)
+                {
+                if (!BN_rand(&k, BN_num_bits(dsa->q), 1, 0)) goto err;
+                if (BN_cmp(&k,dsa->q) >= 0)
+                        BN_sub(&k,&k,dsa->q);
+                if (!BN_is_zero(&k)) break;
+                }
+
+        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
+                {
+                if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
+                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
+                                dsa->p,ctx)) goto err;
+                }
+
+        /* Compute r = (g^k mod p) mod q */
+        if (!dsa->meth->bn_mod_exp(dsa, r,dsa->g,&k,dsa->p,ctx,
+                (BN_MONT_CTX *)dsa->method_mont_p)) goto err;
+        if (!BN_mod(r,r,dsa->q,ctx)) goto err;
+
+        /* Compute  part of 's = inv(k) (m + xr) mod q' */
+        if ((kinv=BN_mod_inverse(NULL,&k,dsa->q,ctx)) == NULL) goto err;
+
+        if (*kinvp != NULL) BN_clear_free(*kinvp);
+        *kinvp=kinv;
+        kinv=NULL;
+        if (*rp != NULL) BN_clear_free(*rp);
+        *rp=r;
+        ret=1;
+err:
+        if (!ret)
+                {
+                DSAerr(DSA_F_DSA_SIGN_SETUP,ERR_R_BN_LIB);
+                if (kinv != NULL) BN_clear_free(kinv);
+                if (r != NULL) BN_clear_free(r);
+                }
+        if (ctx_in == NULL) BN_CTX_free(ctx);
+        if (kinv != NULL) BN_clear_free(kinv);
+        BN_clear_free(&k);
+        return(ret);
+        }
+
+static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
+                  DSA *dsa)
+        {
+        BN_CTX *ctx;
+        BIGNUM u1,u2,t1;
+        BN_MONT_CTX *mont=NULL;
+        int ret = -1;
+
+        if ((ctx=BN_CTX_new()) == NULL) goto err;
+        BN_init(&u1);
+        BN_init(&u2);
+        BN_init(&t1);
+
+        /* Calculate W = inv(S) mod Q
+         * save W in u2 */
+        if ((BN_mod_inverse(&u2,sig->s,dsa->q,ctx)) == NULL) goto err;
+
+        /* save M in u1 */
+        if (BN_bin2bn(dgst,dgst_len,&u1) == NULL) goto err;
+
+        /* u1 = M * w mod q */
+        if (!BN_mod_mul(&u1,&u1,&u2,dsa->q,ctx)) goto err;
+
+        /* u2 = r * w mod q */
+        if (!BN_mod_mul(&u2,sig->r,&u2,dsa->q,ctx)) goto err;
+
+        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
+                {
+                if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
+                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
+                                dsa->p,ctx)) goto err;
+                }
+        mont=(BN_MONT_CTX *)dsa->method_mont_p;
+
+#if 0
+        {
+        BIGNUM t2;
+
+        BN_init(&t2);
+        /* v = ( g^u1 * y^u2 mod p ) mod q */
+        /* let t1 = g ^ u1 mod p */
+        if (!BN_mod_exp_mont(&t1,dsa->g,&u1,dsa->p,ctx,mont)) goto err;
+        /* let t2 = y ^ u2 mod p */
+        if (!BN_mod_exp_mont(&t2,dsa->pub_key,&u2,dsa->p,ctx,mont)) goto err;
+        /* let u1 = t1 * t2 mod p */
+        if (!BN_mod_mul(&u1,&t1,&t2,dsa->p,ctx)) goto err_bn;
+        BN_free(&t2);
+        }
+        /* let u1 = u1 mod q */
+        if (!BN_mod(&u1,&u1,dsa->q,ctx)) goto err;
+#else
+        {
+        if (!dsa->meth->dsa_mod_exp(dsa, &t1,dsa->g,&u1,dsa->pub_key,&u2,
+                                                dsa->p,ctx,mont)) goto err;
+        /* BN_copy(&u1,&t1); */
+        /* let u1 = u1 mod q */
+        if (!BN_mod(&u1,&t1,dsa->q,ctx)) goto err;
+        }
+#endif
+        /* V is now in u1.  If the signature is correct, it will be
+         * equal to R. */
+        ret=(BN_ucmp(&u1, sig->r) == 0);
+
+        err:
+        if (ret != 1) DSAerr(DSA_F_DSA_DO_VERIFY,ERR_R_BN_LIB);
+        if (ctx != NULL) BN_CTX_free(ctx);
+        BN_free(&u1);
+        BN_free(&u2);
+        BN_free(&t1);
+        return(ret);
+        }
+
+static int dsa_init(DSA *dsa)
+{
+        dsa->flags|=DSA_FLAG_CACHE_MONT_P;
+        return(1);
+}
+
+static int dsa_finish(DSA *dsa)
+{
+        if(dsa->method_mont_p)
+                BN_MONT_CTX_free((BN_MONT_CTX *)dsa->method_mont_p);
+        return(1);
+}
+
+static int dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
+                BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *in_mont)
+{
+        return BN_mod_exp2_mont(rr, a1, p1, a2, p2, m, ctx, in_mont);
+}
+        
+static int dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx)
+{
+        return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx);
+}
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_sign.c b/src/lib/libssl/src/crypto/dsa/dsa_sign.c
index 774c161964..89205026f0 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_sign.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_sign.c
@@ -67,73 +67,9 @@
 
 DSA_SIG * DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
         {
-        BIGNUM *kinv=NULL,*r=NULL,*s=NULL;
-        BIGNUM m;
-        BIGNUM xr;
-        BN_CTX *ctx=NULL;
-        int i,reason=ERR_R_BN_LIB;
-        DSA_SIG *ret=NULL;
-
-        BN_init(&m);
-        BN_init(&xr);
-        s=BN_new();
-        if (s == NULL) goto err;
-
-        i=BN_num_bytes(dsa->q); /* should be 20 */
-        if ((dlen > i) || (dlen > 50))
-                {
-                reason=DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE;
-                goto err;
-                }
-
-        ctx=BN_CTX_new();
-        if (ctx == NULL) goto err;
-
-        if ((dsa->kinv == NULL) || (dsa->r == NULL))
-                {
-                if (!DSA_sign_setup(dsa,ctx,&kinv,&r)) goto err;
-                }
-        else
-                {
-                kinv=dsa->kinv;
-                dsa->kinv=NULL;
-                r=dsa->r;
-                dsa->r=NULL;
-                }
-
-        if (BN_bin2bn(dgst,dlen,&m) == NULL) goto err;
-
-        /* Compute  s = inv(k) (m + xr) mod q */
-        if (!BN_mod_mul(&xr,dsa->priv_key,r,dsa->q,ctx)) goto err;/* s = xr */
-        if (!BN_add(s, &xr, &m)) goto err;              /* s = m + xr */
-        if (BN_cmp(s,dsa->q) > 0)
-                BN_sub(s,s,dsa->q);
-        if (!BN_mod_mul(s,s,kinv,dsa->q,ctx)) goto err;
-
-        ret=DSA_SIG_new();
-        if (ret == NULL) goto err;
-        ret->r = r;
-        ret->s = s;
-        
-err:
-        if (!ret)
-                {
-                DSAerr(DSA_F_DSA_DO_SIGN,reason);
-                BN_free(r);
-                BN_free(s);
-                }
-        if (ctx != NULL) BN_CTX_free(ctx);
-        BN_clear_free(&m);
-        BN_clear_free(&xr);
-        if (kinv != NULL) /* dsa->kinv is NULL now if we used it */
-            BN_clear_free(kinv);
-        return(ret);
+        return dsa->meth->dsa_do_sign(dgst, dlen, dsa);
         }
 
-/* data has already been hashed (probably with SHA or SHA-1). */
-
-/* unsigned char *sig:  out    */
-/* unsigned int *siglen:  out    */
 int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig,
              unsigned int *siglen, DSA *dsa)
         {
@@ -151,61 +87,6 @@ int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig,
 
 int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
         {
-        BN_CTX *ctx;
-        BIGNUM k,*kinv=NULL,*r=NULL;
-        int ret=0;
-
-        if (ctx_in == NULL)
-                {
-                if ((ctx=BN_CTX_new()) == NULL) goto err;
-                }
-        else
-                ctx=ctx_in;
-
-        BN_init(&k);
-        if ((r=BN_new()) == NULL) goto err;
-        kinv=NULL;
-
-        /* Get random k */
-        for (;;)
-                {
-                if (!BN_rand(&k, BN_num_bits(dsa->q), 1, 0)) goto err;
-                if (BN_cmp(&k,dsa->q) >= 0)
-                        BN_sub(&k,&k,dsa->q);
-                if (!BN_is_zero(&k)) break;
-                }
-
-        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
-                {
-                if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
-                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
-                                dsa->p,ctx)) goto err;
-                }
-
-        /* Compute r = (g^k mod p) mod q */
-        if (!BN_mod_exp_mont(r,dsa->g,&k,dsa->p,ctx,
-                (BN_MONT_CTX *)dsa->method_mont_p)) goto err;
-        if (!BN_mod(r,r,dsa->q,ctx)) goto err;
-
-        /* Compute  part of 's = inv(k) (m + xr) mod q' */
-        if ((kinv=BN_mod_inverse(NULL,&k,dsa->q,ctx)) == NULL) goto err;
-
-        if (*kinvp != NULL) BN_clear_free(*kinvp);
-        *kinvp=kinv;
-        kinv=NULL;
-        if (*rp != NULL) BN_clear_free(*rp);
-        *rp=r;
-        ret=1;
-err:
-        if (!ret)
-                {
-                DSAerr(DSA_F_DSA_SIGN_SETUP,ERR_R_BN_LIB);
-                if (kinv != NULL) BN_clear_free(kinv);
-                if (r != NULL) BN_clear_free(r);
-                }
-        if (ctx_in == NULL) BN_CTX_free(ctx);
-        if (kinv != NULL) BN_clear_free(kinv);
-        BN_clear_free(&k);
-        return(ret);
+        return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
         }
 
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_vrf.c b/src/lib/libssl/src/crypto/dsa/dsa_vrf.c
index ff552208aa..03277f80fd 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_vrf.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_vrf.c
@@ -69,73 +69,7 @@
 int DSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
                   DSA *dsa)
         {
-        BN_CTX *ctx;
-        BIGNUM u1,u2,t1;
-        BN_MONT_CTX *mont=NULL;
-        int ret = -1;
-
-        if ((ctx=BN_CTX_new()) == NULL) goto err;
-        BN_init(&u1);
-        BN_init(&u2);
-        BN_init(&t1);
-
-        /* Calculate W = inv(S) mod Q
-         * save W in u2 */
-        if ((BN_mod_inverse(&u2,sig->s,dsa->q,ctx)) == NULL) goto err;
-
-        /* save M in u1 */
-        if (BN_bin2bn(dgst,dgst_len,&u1) == NULL) goto err;
-
-        /* u1 = M * w mod q */
-        if (!BN_mod_mul(&u1,&u1,&u2,dsa->q,ctx)) goto err;
-
-        /* u2 = r * w mod q */
-        if (!BN_mod_mul(&u2,sig->r,&u2,dsa->q,ctx)) goto err;
-
-        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
-                {
-                if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
-                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
-                                dsa->p,ctx)) goto err;
-                }
-        mont=(BN_MONT_CTX *)dsa->method_mont_p;
-
-#if 0
-        {
-        BIGNUM t2;
-
-        BN_init(&t2);
-        /* v = ( g^u1 * y^u2 mod p ) mod q */
-        /* let t1 = g ^ u1 mod p */
-        if (!BN_mod_exp_mont(&t1,dsa->g,&u1,dsa->p,ctx,mont)) goto err;
-        /* let t2 = y ^ u2 mod p */
-        if (!BN_mod_exp_mont(&t2,dsa->pub_key,&u2,dsa->p,ctx,mont)) goto err;
-        /* let u1 = t1 * t2 mod p */
-        if (!BN_mod_mul(&u1,&t1,&t2,dsa->p,ctx)) goto err_bn;
-        BN_free(&t2);
-        }
-        /* let u1 = u1 mod q */
-        if (!BN_mod(&u1,&u1,dsa->q,ctx)) goto err;
-#else
-        {
-        if (!BN_mod_exp2_mont(&t1,dsa->g,&u1,dsa->pub_key,&u2,dsa->p,ctx,mont))
-                goto err;
-        /* BN_copy(&u1,&t1); */
-        /* let u1 = u1 mod q */
-        if (!BN_mod(&u1,&t1,dsa->q,ctx)) goto err;
-        }
-#endif
-        /* V is now in u1.  If the signature is correct, it will be
-         * equal to R. */
-        ret=(BN_ucmp(&u1, sig->r) == 0);
-
-        err:
-        if (ret != 1) DSAerr(DSA_F_DSA_DO_VERIFY,ERR_R_BN_LIB);
-        if (ctx != NULL) BN_CTX_free(ctx);
-        BN_free(&u1);
-        BN_free(&u2);
-        BN_free(&t1);
-        return(ret);
+        return dsa->meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
         }
 
 /* data has already been hashed (probably with SHA or SHA-1). */
diff --git a/src/lib/libssl/src/crypto/dsa/dsatest.c b/src/lib/libssl/src/crypto/dsa/dsatest.c
index fc25c9a1b7..309a7cda89 100644
--- a/src/lib/libssl/src/crypto/dsa/dsatest.c
+++ b/src/lib/libssl/src/crypto/dsa/dsatest.c
@@ -84,7 +84,10 @@ int main(int argc, char *argv[])
 #define MS_CALLBACK
 #endif
 
-static void MS_CALLBACK dsa_cb(int p, int n, char *arg);
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg);
+
+/* seed, out_p, out_q, out_g are taken from the updated Appendix 5 to
+ * FIPS PUB 186 and also appear in Appendix 5 to FIPS PIB 186-1 */
 static unsigned char seed[20]={
         0xd5,0x01,0x4e,0x4b,0x60,0xef,0x2b,0xa8,0xb6,0x21,0x1b,0x40,
         0x62,0xba,0x32,0x24,0xe0,0x42,0x7d,0xd3,
@@ -120,6 +123,8 @@ static unsigned char out_g[]={
 
 static const unsigned char str1[]="12345678901234567890";
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
 static BIO *bio_err=NULL;
 
 int main(int argc, char **argv)
@@ -131,15 +136,17 @@ int main(int argc, char **argv)
         unsigned char sig[256];
         unsigned int siglen;
 
+        ERR_load_crypto_strings();
+        RAND_seed(rnd_seed, sizeof rnd_seed);
+
         if (bio_err == NULL)
                 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
 
         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 
         BIO_printf(bio_err,"test generation of DSA parameters\n");
-        BIO_printf(bio_err,"expect '.*' followed by 5 lines of '.'s and '+'s\n");
-        dsa=DSA_generate_parameters(512,seed,20,&counter,&h,dsa_cb,
-                (char *)bio_err);
+
+        dsa=DSA_generate_parameters(512,seed,20,&counter,&h,dsa_cb,bio_err);
 
         BIO_printf(bio_err,"seed\n");
         for (i=0; i<20; i+=4)
@@ -193,13 +200,18 @@ end:
         if (!ret)
                 ERR_print_errors(bio_err);
         if (dsa != NULL) DSA_free(dsa);
+        ERR_remove_state(0);
         CRYPTO_mem_leaks(bio_err);
-        if (bio_err != NULL) BIO_free(bio_err);
+        if (bio_err != NULL)
+                {
+                BIO_free(bio_err);
+                bio_err = NULL;
+                }
         exit(!ret);
         return(0);
         }
 
-static void MS_CALLBACK dsa_cb(int p, int n, char *arg)
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
         {
         char c='*';
         static int ok=0,num=0;
@@ -208,8 +220,8 @@ static void MS_CALLBACK dsa_cb(int p, int n, char *arg)
         if (p == 1) c='+';
         if (p == 2) { c='*'; ok++; }
         if (p == 3) c='\n';
-        BIO_write((BIO *)arg,&c,1);
-        (void)BIO_flush((BIO *)arg);
+        BIO_write(arg,&c,1);
+        (void)BIO_flush(arg);
 
         if (!ok && (p == 0) && (num > 1))
                 {
diff --git a/src/lib/libssl/src/crypto/ebcdic.c b/src/lib/libssl/src/crypto/ebcdic.c
new file mode 100644
index 0000000000..31397b2add
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ebcdic.c
@@ -0,0 +1,217 @@
+/* crypto/ebcdic.c */
+
+#ifdef CHARSET_EBCDIC
+#include "ebcdic.h"
+/*      Initial Port for  Apache-1.3     by <Martin.Kraemer@Mch.SNI.De>
+ *      Adapted for       OpenSSL-0.9.4  by <Martin.Kraemer@Mch.SNI.De>
+ */
+
+#ifdef _OSD_POSIX
+/*
+    "BS2000 OSD" is a POSIX subsystem on a main frame.
+    It is made by Siemens AG, Germany, for their BS2000 mainframe machines.
+    Within the POSIX subsystem, the same character set was chosen as in
+    "native BS2000", namely EBCDIC. (EDF04)
+
+    The name "ASCII" in these routines is misleading: actually, conversion
+    is not between EBCDIC and ASCII, but EBCDIC(EDF04) and ISO-8859.1;
+    that means that (western european) national characters are preserved.
+
+    This table is identical to the one used by rsh/rcp/ftp and other POSIX tools.
+*/
+
+/* Here's the bijective ebcdic-to-ascii table: */
+const unsigned char os_toascii[256] = {
+/*00*/ 0x00, 0x01, 0x02, 0x03, 0x85, 0x09, 0x86, 0x7f,
+       0x87, 0x8d, 0x8e, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /*................*/
+/*10*/ 0x10, 0x11, 0x12, 0x13, 0x8f, 0x0a, 0x08, 0x97,
+       0x18, 0x19, 0x9c, 0x9d, 0x1c, 0x1d, 0x1e, 0x1f, /*................*/
+/*20*/ 0x80, 0x81, 0x82, 0x83, 0x84, 0x92, 0x17, 0x1b,
+       0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x05, 0x06, 0x07, /*................*/
+/*30*/ 0x90, 0x91, 0x16, 0x93, 0x94, 0x95, 0x96, 0x04,
+       0x98, 0x99, 0x9a, 0x9b, 0x14, 0x15, 0x9e, 0x1a, /*................*/
+/*40*/ 0x20, 0xa0, 0xe2, 0xe4, 0xe0, 0xe1, 0xe3, 0xe5,
+       0xe7, 0xf1, 0x60, 0x2e, 0x3c, 0x28, 0x2b, 0x7c, /* .........`.<(+|*/
+/*50*/ 0x26, 0xe9, 0xea, 0xeb, 0xe8, 0xed, 0xee, 0xef,
+       0xec, 0xdf, 0x21, 0x24, 0x2a, 0x29, 0x3b, 0x9f, /*&.........!$*);.*/
+/*60*/ 0x2d, 0x2f, 0xc2, 0xc4, 0xc0, 0xc1, 0xc3, 0xc5,
+       0xc7, 0xd1, 0x5e, 0x2c, 0x25, 0x5f, 0x3e, 0x3f, /*-/........^,%_>?*/
+/*70*/ 0xf8, 0xc9, 0xca, 0xcb, 0xc8, 0xcd, 0xce, 0xcf,
+       0xcc, 0xa8, 0x3a, 0x23, 0x40, 0x27, 0x3d, 0x22, /*..........:#@'="*/
+/*80*/ 0xd8, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
+       0x68, 0x69, 0xab, 0xbb, 0xf0, 0xfd, 0xfe, 0xb1, /*.abcdefghi......*/
+/*90*/ 0xb0, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70,
+       0x71, 0x72, 0xaa, 0xba, 0xe6, 0xb8, 0xc6, 0xa4, /*.jklmnopqr......*/
+/*a0*/ 0xb5, 0xaf, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78,
+       0x79, 0x7a, 0xa1, 0xbf, 0xd0, 0xdd, 0xde, 0xae, /*..stuvwxyz......*/
+/*b0*/ 0xa2, 0xa3, 0xa5, 0xb7, 0xa9, 0xa7, 0xb6, 0xbc,
+       0xbd, 0xbe, 0xac, 0x5b, 0x5c, 0x5d, 0xb4, 0xd7, /*...........[\]..*/
+/*c0*/ 0xf9, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+       0x48, 0x49, 0xad, 0xf4, 0xf6, 0xf2, 0xf3, 0xf5, /*.ABCDEFGHI......*/
+/*d0*/ 0xa6, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50,
+       0x51, 0x52, 0xb9, 0xfb, 0xfc, 0xdb, 0xfa, 0xff, /*.JKLMNOPQR......*/
+/*e0*/ 0xd9, 0xf7, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58,
+       0x59, 0x5a, 0xb2, 0xd4, 0xd6, 0xd2, 0xd3, 0xd5, /*..STUVWXYZ......*/
+/*f0*/ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+       0x38, 0x39, 0xb3, 0x7b, 0xdc, 0x7d, 0xda, 0x7e  /*0123456789.{.}.~*/
+};
+
+
+/* The ascii-to-ebcdic table: */
+const unsigned char os_toebcdic[256] = {
+/*00*/  0x00, 0x01, 0x02, 0x03, 0x37, 0x2d, 0x2e, 0x2f,
+        0x16, 0x05, 0x15, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,  /*................*/
+/*10*/  0x10, 0x11, 0x12, 0x13, 0x3c, 0x3d, 0x32, 0x26,
+        0x18, 0x19, 0x3f, 0x27, 0x1c, 0x1d, 0x1e, 0x1f,  /*................*/
+/*20*/  0x40, 0x5a, 0x7f, 0x7b, 0x5b, 0x6c, 0x50, 0x7d,
+        0x4d, 0x5d, 0x5c, 0x4e, 0x6b, 0x60, 0x4b, 0x61,  /* !"#$%&'()*+,-./ */
+/*30*/  0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+        0xf8, 0xf9, 0x7a, 0x5e, 0x4c, 0x7e, 0x6e, 0x6f,  /*0123456789:;<=>?*/
+/*40*/  0x7c, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+        0xc8, 0xc9, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6,  /*@ABCDEFGHIJKLMNO*/
+/*50*/  0xd7, 0xd8, 0xd9, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6,
+        0xe7, 0xe8, 0xe9, 0xbb, 0xbc, 0xbd, 0x6a, 0x6d,  /*PQRSTUVWXYZ[\]^_*/
+/*60*/  0x4a, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
+        0x88, 0x89, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96,  /*`abcdefghijklmno*/
+/*70*/  0x97, 0x98, 0x99, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6,
+        0xa7, 0xa8, 0xa9, 0xfb, 0x4f, 0xfd, 0xff, 0x07,  /*pqrstuvwxyz{|}~.*/
+/*80*/  0x20, 0x21, 0x22, 0x23, 0x24, 0x04, 0x06, 0x08,
+        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x09, 0x0a, 0x14,  /*................*/
+/*90*/  0x30, 0x31, 0x25, 0x33, 0x34, 0x35, 0x36, 0x17,
+        0x38, 0x39, 0x3a, 0x3b, 0x1a, 0x1b, 0x3e, 0x5f,  /*................*/
+/*a0*/  0x41, 0xaa, 0xb0, 0xb1, 0x9f, 0xb2, 0xd0, 0xb5,
+        0x79, 0xb4, 0x9a, 0x8a, 0xba, 0xca, 0xaf, 0xa1,  /*................*/
+/*b0*/  0x90, 0x8f, 0xea, 0xfa, 0xbe, 0xa0, 0xb6, 0xb3,
+        0x9d, 0xda, 0x9b, 0x8b, 0xb7, 0xb8, 0xb9, 0xab,  /*................*/
+/*c0*/  0x64, 0x65, 0x62, 0x66, 0x63, 0x67, 0x9e, 0x68,
+        0x74, 0x71, 0x72, 0x73, 0x78, 0x75, 0x76, 0x77,  /*................*/
+/*d0*/  0xac, 0x69, 0xed, 0xee, 0xeb, 0xef, 0xec, 0xbf,
+        0x80, 0xe0, 0xfe, 0xdd, 0xfc, 0xad, 0xae, 0x59,  /*................*/
+/*e0*/  0x44, 0x45, 0x42, 0x46, 0x43, 0x47, 0x9c, 0x48,
+        0x54, 0x51, 0x52, 0x53, 0x58, 0x55, 0x56, 0x57,  /*................*/
+/*f0*/  0x8c, 0x49, 0xcd, 0xce, 0xcb, 0xcf, 0xcc, 0xe1,
+        0x70, 0xc0, 0xde, 0xdb, 0xdc, 0x8d, 0x8e, 0xdf   /*................*/
+};
+
+#else  /*_OSD_POSIX*/
+
+/*
+This code does basic character mapping for IBM's TPF and OS/390 operating systems.
+It is a modified version of the BS2000 table.
+
+Bijective EBCDIC (character set IBM-1047) to US-ASCII table:
+This table is bijective - there are no ambigous or duplicate characters.
+*/
+const unsigned char os_toascii[256] = {
+    0x00, 0x01, 0x02, 0x03, 0x85, 0x09, 0x86, 0x7f, /* 00-0f:           */
+    0x87, 0x8d, 0x8e, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* ................ */
+    0x10, 0x11, 0x12, 0x13, 0x8f, 0x0a, 0x08, 0x97, /* 10-1f:           */
+    0x18, 0x19, 0x9c, 0x9d, 0x1c, 0x1d, 0x1e, 0x1f, /* ................ */
+    0x80, 0x81, 0x82, 0x83, 0x84, 0x92, 0x17, 0x1b, /* 20-2f:           */
+    0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x05, 0x06, 0x07, /* ................ */
+    0x90, 0x91, 0x16, 0x93, 0x94, 0x95, 0x96, 0x04, /* 30-3f:           */
+    0x98, 0x99, 0x9a, 0x9b, 0x14, 0x15, 0x9e, 0x1a, /* ................ */
+    0x20, 0xa0, 0xe2, 0xe4, 0xe0, 0xe1, 0xe3, 0xe5, /* 40-4f:           */
+    0xe7, 0xf1, 0xa2, 0x2e, 0x3c, 0x28, 0x2b, 0x7c, /*  ...........<(+| */
+    0x26, 0xe9, 0xea, 0xeb, 0xe8, 0xed, 0xee, 0xef, /* 50-5f:           */
+    0xec, 0xdf, 0x21, 0x24, 0x2a, 0x29, 0x3b, 0x5e, /* &.........!$*);^ */
+    0x2d, 0x2f, 0xc2, 0xc4, 0xc0, 0xc1, 0xc3, 0xc5, /* 60-6f:           */
+    0xc7, 0xd1, 0xa6, 0x2c, 0x25, 0x5f, 0x3e, 0x3f, /* -/.........,%_>? */
+    0xf8, 0xc9, 0xca, 0xcb, 0xc8, 0xcd, 0xce, 0xcf, /* 70-7f:           */
+    0xcc, 0x60, 0x3a, 0x23, 0x40, 0x27, 0x3d, 0x22, /* .........`:#@'=" */
+    0xd8, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, /* 80-8f:           */
+    0x68, 0x69, 0xab, 0xbb, 0xf0, 0xfd, 0xfe, 0xb1, /* .abcdefghi...... */
+    0xb0, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, /* 90-9f:           */
+    0x71, 0x72, 0xaa, 0xba, 0xe6, 0xb8, 0xc6, 0xa4, /* .jklmnopqr...... */
+    0xb5, 0x7e, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, /* a0-af:           */
+    0x79, 0x7a, 0xa1, 0xbf, 0xd0, 0x5b, 0xde, 0xae, /* .~stuvwxyz...[.. */
+    0xac, 0xa3, 0xa5, 0xb7, 0xa9, 0xa7, 0xb6, 0xbc, /* b0-bf:           */
+    0xbd, 0xbe, 0xdd, 0xa8, 0xaf, 0x5d, 0xb4, 0xd7, /* .............].. */
+    0x7b, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* c0-cf:           */
+    0x48, 0x49, 0xad, 0xf4, 0xf6, 0xf2, 0xf3, 0xf5, /* {ABCDEFGHI...... */
+    0x7d, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, /* d0-df:           */
+    0x51, 0x52, 0xb9, 0xfb, 0xfc, 0xf9, 0xfa, 0xff, /* }JKLMNOPQR...... */
+    0x5c, 0xf7, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, /* e0-ef:           */
+    0x59, 0x5a, 0xb2, 0xd4, 0xd6, 0xd2, 0xd3, 0xd5, /* \.STUVWXYZ...... */
+    0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* f0-ff:           */
+    0x38, 0x39, 0xb3, 0xdb, 0xdc, 0xd9, 0xda, 0x9f  /* 0123456789...... */
+};
+
+
+/*
+The US-ASCII to EBCDIC (character set IBM-1047) table:
+This table is bijective (no ambiguous or duplicate characters)
+*/
+const unsigned char os_toebcdic[256] = {
+    0x00, 0x01, 0x02, 0x03, 0x37, 0x2d, 0x2e, 0x2f, /* 00-0f:           */
+    0x16, 0x05, 0x15, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* ................ */
+    0x10, 0x11, 0x12, 0x13, 0x3c, 0x3d, 0x32, 0x26, /* 10-1f:           */
+    0x18, 0x19, 0x3f, 0x27, 0x1c, 0x1d, 0x1e, 0x1f, /* ................ */
+    0x40, 0x5a, 0x7f, 0x7b, 0x5b, 0x6c, 0x50, 0x7d, /* 20-2f:           */
+    0x4d, 0x5d, 0x5c, 0x4e, 0x6b, 0x60, 0x4b, 0x61, /*  !"#$%&'()*+,-./ */
+    0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, /* 30-3f:           */
+    0xf8, 0xf9, 0x7a, 0x5e, 0x4c, 0x7e, 0x6e, 0x6f, /* 0123456789:;<=>? */
+    0x7c, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 40-4f:           */
+    0xc8, 0xc9, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, /* @ABCDEFGHIJKLMNO */
+    0xd7, 0xd8, 0xd9, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, /* 50-5f:           */
+    0xe7, 0xe8, 0xe9, 0xad, 0xe0, 0xbd, 0x5f, 0x6d, /* PQRSTUVWXYZ[\]^_ */
+    0x79, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 60-6f:           */
+    0x88, 0x89, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, /* `abcdefghijklmno */
+    0x97, 0x98, 0x99, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, /* 70-7f:           */
+    0xa7, 0xa8, 0xa9, 0xc0, 0x4f, 0xd0, 0xa1, 0x07, /* pqrstuvwxyz{|}~. */
+    0x20, 0x21, 0x22, 0x23, 0x24, 0x04, 0x06, 0x08, /* 80-8f:           */
+    0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x09, 0x0a, 0x14, /* ................ */
+    0x30, 0x31, 0x25, 0x33, 0x34, 0x35, 0x36, 0x17, /* 90-9f:           */
+    0x38, 0x39, 0x3a, 0x3b, 0x1a, 0x1b, 0x3e, 0xff, /* ................ */
+    0x41, 0xaa, 0x4a, 0xb1, 0x9f, 0xb2, 0x6a, 0xb5, /* a0-af:           */
+    0xbb, 0xb4, 0x9a, 0x8a, 0xb0, 0xca, 0xaf, 0xbc, /* ................ */
+    0x90, 0x8f, 0xea, 0xfa, 0xbe, 0xa0, 0xb6, 0xb3, /* b0-bf:           */
+    0x9d, 0xda, 0x9b, 0x8b, 0xb7, 0xb8, 0xb9, 0xab, /* ................ */
+    0x64, 0x65, 0x62, 0x66, 0x63, 0x67, 0x9e, 0x68, /* c0-cf:           */
+    0x74, 0x71, 0x72, 0x73, 0x78, 0x75, 0x76, 0x77, /* ................ */
+    0xac, 0x69, 0xed, 0xee, 0xeb, 0xef, 0xec, 0xbf, /* d0-df:           */
+    0x80, 0xfd, 0xfe, 0xfb, 0xfc, 0xba, 0xae, 0x59, /* ................ */
+    0x44, 0x45, 0x42, 0x46, 0x43, 0x47, 0x9c, 0x48, /* e0-ef:           */
+    0x54, 0x51, 0x52, 0x53, 0x58, 0x55, 0x56, 0x57, /* ................ */
+    0x8c, 0x49, 0xcd, 0xce, 0xcb, 0xcf, 0xcc, 0xe1, /* f0-ff:           */
+    0x70, 0xdd, 0xde, 0xdb, 0xdc, 0x8d, 0x8e, 0xdf  /* ................ */
+};
+#endif /*_OSD_POSIX*/
+
+/* Translate a memory block from EBCDIC (host charset) to ASCII (net charset)
+ * dest and srce may be identical, or separate memory blocks, but
+ * should not overlap. These functions intentionally have an interface
+ * compatible to memcpy(3).
+ */
+
+void *
+ebcdic2ascii(void *dest, const void *srce, size_t count)
+{
+    unsigned char *udest = dest;
+    const unsigned char *usrce = srce;
+
+    while (count-- != 0) {
+        *udest++ = os_toascii[*usrce++];
+    }
+
+    return dest;
+}
+
+void *
+ascii2ebcdic(void *dest, const void *srce, size_t count)
+{
+    unsigned char *udest = dest;
+    const unsigned char *usrce = srce;
+
+    while (count-- != 0) {
+        *udest++ = os_toebcdic[*usrce++];
+    }
+
+    return dest;
+}
+
+#else /*CHARSET_EBCDIC*/
+#ifdef PEDANTIC
+static void *dummy=&dummy;
+#endif
+#endif
diff --git a/src/lib/libssl/src/crypto/ebcdic.h b/src/lib/libssl/src/crypto/ebcdic.h
index d3b4e98b12..6d65afcf9e 100644
--- a/src/lib/libssl/src/crypto/ebcdic.h
+++ b/src/lib/libssl/src/crypto/ebcdic.h
@@ -1,17 +1,19 @@
+/* crypto/ebcdic.h */
+
 #ifndef HEADER_EBCDIC_H
 #define HEADER_EBCDIC_H
 
 #include <sys/types.h>
 
 /* Avoid name clashes with other applications */
-#define os_toascii   _eay2000_os_toascii
-#define os_toebcdic  _eay2000_os_toebcdic
-#define ebcdic2ascii _eay2000_ebcdic2ascii
-#define ascii2ebcdic _eay2000_ascii2ebcdic
+#define os_toascii   _openssl_os_toascii
+#define os_toebcdic  _openssl_os_toebcdic
+#define ebcdic2ascii _openssl_ebcdic2ascii
+#define ascii2ebcdic _openssl_ascii2ebcdic
 
 extern const unsigned char os_toascii[256];
 extern const unsigned char os_toebcdic[256];
-void ebcdic2ascii(unsigned char *dest, const unsigned char *srce, size_t count);
-void ascii2ebcdic(unsigned char *dest, const unsigned char *srce, size_t count);
+void *ebcdic2ascii(void *dest, const void *srce, size_t count);
+void *ascii2ebcdic(void *dest, const void *srce, size_t count);
 
 #endif
diff --git a/src/lib/libssl/src/crypto/err/Makefile.ssl b/src/lib/libssl/src/crypto/err/Makefile.ssl
index ae827edddb..fb74e4eb13 100644
--- a/src/lib/libssl/src/crypto/err/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/err/Makefile.ssl
@@ -82,8 +82,8 @@ err.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 err.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 err.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
-err.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-err.o: ../cryptlib.h
+err.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+err.o: ../../include/openssl/stack.h ../cryptlib.h
 err_all.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 err_all.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 err_all.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -96,15 +96,16 @@ err_all.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
 err_all.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
 err_all.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 err_all.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs12.h
-err_all.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
-err_all.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
-err_all.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
-err_all.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-err_all.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-err_all.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+err_all.o: ../../include/openssl/pkcs7.h ../../include/openssl/rand.h
+err_all.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+err_all.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+err_all.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+err_all.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+err_all.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+err_all.o: ../../include/openssl/x509v3.h
 err_prn.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 err_prn.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 err_prn.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 err_prn.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
-err_prn.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-err_prn.o: ../cryptlib.h
+err_prn.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+err_prn.o: ../../include/openssl/stack.h ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/err/err.c b/src/lib/libssl/src/crypto/err/err.c
index 8810d838c6..93c64cbc4f 100644
--- a/src/lib/libssl/src/crypto/err/err.c
+++ b/src/lib/libssl/src/crypto/err/err.c
@@ -91,7 +91,7 @@ static ERR_STRING_DATA ERR_str_libraries[]=
 {ERR_PACK(ERR_LIB_PEM,0,0)              ,"PEM routines"},
 {ERR_PACK(ERR_LIB_ASN1,0,0)             ,"asn1 encoding routines"},
 {ERR_PACK(ERR_LIB_X509,0,0)             ,"x509 certificate routines"},
-{ERR_PACK(ERR_LIB_CONF,0,0)             ,"configuation file routines"},
+{ERR_PACK(ERR_LIB_CONF,0,0)             ,"configuration file routines"},
 {ERR_PACK(ERR_LIB_METH,0,0)             ,"X509 lookup 'method' routines"},
 {ERR_PACK(ERR_LIB_SSL,0,0)              ,"SSL routines"},
 {ERR_PACK(ERR_LIB_RSAREF,0,0)           ,"RSAref routines"},
@@ -100,6 +100,7 @@ static ERR_STRING_DATA ERR_str_libraries[]=
 {ERR_PACK(ERR_LIB_PKCS7,0,0)            ,"PKCS7 routines"},
 {ERR_PACK(ERR_LIB_X509V3,0,0)           ,"X509 V3 routines"},
 {ERR_PACK(ERR_LIB_PKCS12,0,0)           ,"PKCS12 routines"},
+{ERR_PACK(ERR_LIB_RAND,0,0)             ,"random number generator"},
 {0,NULL},
         };
 
@@ -221,7 +222,7 @@ void ERR_load_strings(int lib, ERR_STRING_DATA *str)
         while (str->error)
                 {
                 str->error|=ERR_PACK(lib,0,0);
-                lh_insert(error_hash,(char *)str);
+                lh_insert(error_hash,str);
                 str++;
                 }
         CRYPTO_w_unlock(CRYPTO_LOCK_ERR_HASH);
@@ -427,7 +428,7 @@ const char *ERR_lib_error_string(unsigned long e)
         if (error_hash != NULL)
                 {
                 d.error=ERR_PACK(l,0,0);
-                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,(char *)&d);
+                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,&d);
                 }
 
         CRYPTO_r_unlock(CRYPTO_LOCK_ERR_HASH);
@@ -448,7 +449,7 @@ const char *ERR_func_error_string(unsigned long e)
         if (error_hash != NULL)
                 {
                 d.error=ERR_PACK(l,f,0);
-                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,(char *)&d);
+                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,&d);
                 }
 
         CRYPTO_r_unlock(CRYPTO_LOCK_ERR_HASH);
@@ -469,12 +470,11 @@ const char *ERR_reason_error_string(unsigned long e)
         if (error_hash != NULL)
                 {
                 d.error=ERR_PACK(l,0,r);
-                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,(char *)&d);
+                p=(ERR_STRING_DATA *)lh_retrieve(error_hash,&d);
                 if (p == NULL)
                         {
                         d.error=ERR_PACK(0,0,r);
-                        p=(ERR_STRING_DATA *)lh_retrieve(error_hash,
-                                (char *)&d);
+                        p=(ERR_STRING_DATA *)lh_retrieve(error_hash,&d);
                         }
                 }
 
@@ -517,7 +517,7 @@ void ERR_remove_state(unsigned long pid)
                 pid=(unsigned long)CRYPTO_thread_id();
         tmp.pid=pid;
         CRYPTO_w_lock(CRYPTO_LOCK_ERR);
-        p=(ERR_STATE *)lh_delete(thread_hash,(char *)&tmp);
+        p=(ERR_STATE *)lh_delete(thread_hash,&tmp);
         CRYPTO_w_unlock(CRYPTO_LOCK_ERR);
 
         if (p != NULL) ERR_STATE_free(p);
@@ -551,7 +551,7 @@ ERR_STATE *ERR_get_state(void)
         else
                 {
                 tmp.pid=pid;
-                ret=(ERR_STATE *)lh_retrieve(thread_hash,(char *)&tmp);
+                ret=(ERR_STATE *)lh_retrieve(thread_hash,&tmp);
                 CRYPTO_r_unlock(CRYPTO_LOCK_ERR);
                 }
 
@@ -569,7 +569,7 @@ ERR_STATE *ERR_get_state(void)
                         ret->err_data_flags[i]=0;
                         }
                 CRYPTO_w_lock(CRYPTO_LOCK_ERR);
-                tmpp=(ERR_STATE *)lh_insert(thread_hash,(char *)ret);
+                tmpp=(ERR_STATE *)lh_insert(thread_hash,ret);
                 CRYPTO_w_unlock(CRYPTO_LOCK_ERR);
                 if (tmpp != NULL) /* old entry - should not happen */
                         {
diff --git a/src/lib/libssl/src/crypto/err/err.h b/src/lib/libssl/src/crypto/err/err.h
index 9411fb3568..15bafbff43 100644
--- a/src/lib/libssl/src/crypto/err/err.h
+++ b/src/lib/libssl/src/crypto/err/err.h
@@ -122,6 +122,7 @@ typedef struct err_state_st
 #define ERR_LIB_PKCS7           33
 #define ERR_LIB_X509V3          34
 #define ERR_LIB_PKCS12          35
+#define ERR_LIB_RAND            36
 
 #define ERR_LIB_USER            128
 
@@ -149,6 +150,7 @@ typedef struct err_state_st
 #define PKCS7err(f,r) ERR_PUT_error(ERR_LIB_PKCS7,(f),(r),ERR_file_name,__LINE__)
 #define X509V3err(f,r) ERR_PUT_error(ERR_LIB_X509V3,(f),(r),ERR_file_name,__LINE__)
 #define PKCS12err(f,r) ERR_PUT_error(ERR_LIB_PKCS12,(f),(r),ERR_file_name,__LINE__)
+#define RANDerr(f,r) ERR_PUT_error(ERR_LIB_RAND,(f),(r),ERR_file_name,__LINE__)
 
 /* Borland C seems too stupid to be able to shift and do longs in
  * the pre-processor :-( */
@@ -160,7 +162,7 @@ typedef struct err_state_st
 #define ERR_GET_REASON(l)       (int)((l)&0xfffL)
 #define ERR_FATAL_ERROR(l)      (int)((l)&ERR_R_FATAL)
 
-/* OS fuctions */
+/* OS functions */
 #define SYS_F_FOPEN             1
 #define SYS_F_CONNECT           2
 #define SYS_F_GETSERVBYNAME     3
@@ -239,9 +241,9 @@ void ERR_print_errors(BIO *bp);
 void ERR_add_error_data(int num, ...);
 #endif
 void ERR_load_strings(int lib,ERR_STRING_DATA str[]);
-void ERR_load_ERR_strings(void );
-void ERR_load_crypto_strings(void );
-void ERR_free_strings(void );
+void ERR_load_ERR_strings(void);
+void ERR_load_crypto_strings(void);
+void ERR_free_strings(void);
 
 void ERR_remove_state(unsigned long pid); /* if zero we look it up */
 ERR_STATE *ERR_get_state(void);
diff --git a/src/lib/libssl/src/crypto/err/err_all.c b/src/lib/libssl/src/crypto/err/err_all.c
index ad820227d2..10c463b389 100644
--- a/src/lib/libssl/src/crypto/err/err_all.c
+++ b/src/lib/libssl/src/crypto/err/err_all.c
@@ -80,6 +80,7 @@
 #include <openssl/x509v3.h>
 #include <openssl/conf.h>
 #include <openssl/pkcs12.h>
+#include <openssl/rand.h>
 #include <openssl/err.h>
 
 void ERR_load_crypto_strings(void)
@@ -116,5 +117,6 @@ void ERR_load_crypto_strings(void)
         ERR_load_CRYPTO_strings();
         ERR_load_PKCS7_strings();
         ERR_load_PKCS12_strings();
+        ERR_load_RAND_strings();
 #endif
         }
diff --git a/src/lib/libssl/src/crypto/err/openssl.ec b/src/lib/libssl/src/crypto/err/openssl.ec
index c2a8acff0c..e132ba3182 100644
--- a/src/lib/libssl/src/crypto/err/openssl.ec
+++ b/src/lib/libssl/src/crypto/err/openssl.ec
@@ -21,6 +21,7 @@ L PKCS12	crypto/pkcs12/pkcs12.h		crypto/pkcs12/pk12err.c
 L RSAREF        rsaref/rsaref.h                 rsaref/rsar_err.c
 L SSL           ssl/ssl.h                       ssl/ssl_err.c
 L COMP          crypto/comp/comp.h              crypto/comp/comp_err.c
+L RAND          crypto/rand/rand.h              crypto/rand/rand_err.c
 
 
 F RSAREF_F_RSA_BN2BIN
@@ -47,11 +48,11 @@ R SSL_R_TLSV1_ALERT_UNKNOWN_CA			1048
 R SSL_R_TLSV1_ALERT_ACCESS_DENIED               1049
 R SSL_R_TLSV1_ALERT_DECODE_ERROR                1050
 R SSL_R_TLSV1_ALERT_DECRYPT_ERROR               1051
-R SSL_R_TLSV1_ALERT_EXPORT_RESTRICION           1060
+R SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION          1060
 R SSL_R_TLSV1_ALERT_PROTOCOL_VERSION            1070
 R SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY       1071
 R SSL_R_TLSV1_ALERT_INTERNAL_ERROR              1080
-R SSL_R_TLSV1_ALERT_USER_CANCLED                1090
+R SSL_R_TLSV1_ALERT_USER_CANCELLED              1090
 R SSL_R_TLSV1_ALERT_NO_RENEGOTIATION            1100
 
 R RSAREF_R_CONTENT_ENCODING                     0x0400
diff --git a/src/lib/libssl/src/crypto/evp/Makefile.ssl b/src/lib/libssl/src/crypto/evp/Makefile.ssl
index 753479a015..c763b5ccd6 100644
--- a/src/lib/libssl/src/crypto/evp/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/evp/Makefile.ssl
@@ -35,7 +35,8 @@ LIBSRC= encode.c digest.c evp_enc.c evp_key.c \
         m_ripemd.c \
         p_open.c p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c p_dec.c \
         bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \
-        c_all.c evp_lib.c bio_ok.c evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c
+        c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \
+        evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c
 
 LIBOBJ= encode.o digest.o evp_enc.o evp_key.o \
         e_ecb_d.o e_cbc_d.o e_cfb_d.o e_ofb_d.o \
@@ -50,7 +51,8 @@ LIBOBJ=	encode.o digest.o evp_enc.o evp_key.o \
         m_ripemd.o \
         p_open.o p_seal.o p_sign.o p_verify.o p_lib.o p_enc.o p_dec.o \
         bio_md.o bio_b64.o bio_enc.o evp_err.o e_null.o \
-        c_all.o evp_lib.o bio_ok.o evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o
+        c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \
+        evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o
 
 SRC= $(LIBSRC)
 
@@ -176,13 +178,45 @@ c_all.o: ../../include/openssl/err.h ../../include/openssl/evp.h
 c_all.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
 c_all.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 c_all.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-c_all.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
-c_all.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+c_all.o: ../../include/openssl/opensslv.h ../../include/openssl/rc2.h
 c_all.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 c_all.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 c_all.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-c_all.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-c_all.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+c_all.o: ../../include/openssl/stack.h ../cryptlib.h
+c_allc.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+c_allc.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+c_allc.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+c_allc.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+c_allc.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+c_allc.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+c_allc.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+c_allc.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+c_allc.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+c_allc.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+c_allc.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
+c_allc.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+c_allc.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+c_allc.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+c_allc.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+c_allc.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+c_allc.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+c_alld.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+c_alld.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+c_alld.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+c_alld.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+c_alld.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+c_alld.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+c_alld.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+c_alld.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+c_alld.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+c_alld.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+c_alld.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
+c_alld.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+c_alld.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+c_alld.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+c_alld.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+c_alld.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+c_alld.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 digest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 digest.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 digest.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
diff --git a/src/lib/libssl/src/crypto/evp/bio_b64.c b/src/lib/libssl/src/crypto/evp/bio_b64.c
index 84729119df..bd5e24f993 100644
--- a/src/lib/libssl/src/crypto/evp/bio_b64.c
+++ b/src/lib/libssl/src/crypto/evp/bio_b64.c
@@ -69,6 +69,7 @@ static int b64_read(BIO *h,char *buf,int size);
 static long b64_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int b64_new(BIO *h);
 static int b64_free(BIO *data);
+static long b64_callback_ctrl(BIO *h,int cmd,void (*fp)());
 #define B64_BLOCK_SIZE  1024
 #define B64_BLOCK_SIZE2 768
 #define B64_NONE        0
@@ -100,6 +101,7 @@ static BIO_METHOD methods_b64=
         b64_ctrl,
         b64_new,
         b64_free,
+        b64_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_base64(void)
@@ -237,8 +239,8 @@ static int b64_read(BIO *b, char *out, int outl)
                                                         &(ctx->tmp[0]));
                                                 for (x=0; x < i; x++)
                                                         ctx->tmp[x]=p[x];
-                                                EVP_DecodeInit(&ctx->base64);
                                                 }
+                                        EVP_DecodeInit(&ctx->base64);
                                         ctx->start=0;
                                         break;
                                         }
@@ -522,3 +524,17 @@ again:
         return(ret);
         }
 
+static long b64_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
diff --git a/src/lib/libssl/src/crypto/evp/bio_enc.c b/src/lib/libssl/src/crypto/evp/bio_enc.c
index 0a7b1ecf07..629bf4b95d 100644
--- a/src/lib/libssl/src/crypto/evp/bio_enc.c
+++ b/src/lib/libssl/src/crypto/evp/bio_enc.c
@@ -69,6 +69,7 @@ static int enc_read(BIO *h,char *buf,int size);
 static long enc_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int enc_new(BIO *h);
 static int enc_free(BIO *data);
+static long enc_callback_ctrl(BIO *h,int cmd,void (*fp)());
 #define ENC_BLOCK_SIZE  (1024*4)
 
 typedef struct enc_struct
@@ -92,6 +93,7 @@ static BIO_METHOD methods_enc=
         enc_ctrl,
         enc_new,
         enc_free,
+        enc_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_cipher(void)
@@ -184,9 +186,11 @@ static int enc_read(BIO *b, char *out, int outl)
                                 ctx->ok=i;
                                 ctx->buf_off=0;
                                 }
-                        else
+                        else 
+                                {
                                 ret=(ret == 0)?i:ret;
-                        break;
+                                break;
+                                }
                         }
                 else
                         {
@@ -194,13 +198,19 @@ static int enc_read(BIO *b, char *out, int outl)
                                 (unsigned char *)ctx->buf,&ctx->buf_len,
                                 (unsigned char *)&(ctx->buf[8]),i);
                         ctx->cont=1;
+                        /* Note: it is possible for EVP_CipherUpdate to
+                         * decrypt zero bytes because this is or looks like
+                         * the final block: if this happens we should retry
+                         * and either read more data or decrypt the final
+                         * block
+                         */
+                        if(ctx->buf_len == 0) continue;
                         }
 
                 if (ctx->buf_len <= outl)
                         i=ctx->buf_len;
                 else
                         i=outl;
-
                 if (i <= 0) break;
                 memcpy(out,ctx->buf,i);
                 ret+=i;
@@ -360,6 +370,20 @@ again:
         return(ret);
         }
 
+static long enc_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 /*
 void BIO_set_cipher_ctx(b,c)
 BIO *b;
diff --git a/src/lib/libssl/src/crypto/evp/bio_md.c b/src/lib/libssl/src/crypto/evp/bio_md.c
index 317167f9c4..aef928dd8f 100644
--- a/src/lib/libssl/src/crypto/evp/bio_md.c
+++ b/src/lib/libssl/src/crypto/evp/bio_md.c
@@ -72,6 +72,8 @@ static int md_gets(BIO *h,char *str,int size);
 static long md_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int md_new(BIO *h);
 static int md_free(BIO *data);
+static long md_callback_ctrl(BIO *h,int cmd,void (*fp)());
+
 static BIO_METHOD methods_md=
         {
         BIO_TYPE_MD,"message digest",
@@ -82,6 +84,7 @@ static BIO_METHOD methods_md=
         md_ctrl,
         md_new,
         md_free,
+        md_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_md(void)
@@ -220,6 +223,20 @@ static long md_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long md_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int md_gets(BIO *bp, char *buf, int size)
         {
         EVP_MD_CTX *ctx;
diff --git a/src/lib/libssl/src/crypto/evp/bio_ok.c b/src/lib/libssl/src/crypto/evp/bio_ok.c
index 101275d648..e6ff5f2cdb 100644
--- a/src/lib/libssl/src/crypto/evp/bio_ok.c
+++ b/src/lib/libssl/src/crypto/evp/bio_ok.c
@@ -67,7 +67,7 @@
         and everything was OK. BUT if user types wrong password 
         BIO_f_cipher outputs only garbage and my function crashes. Yes
         I can and I should fix my function, but BIO_f_cipher is 
-        easy way to add encryption support to many exisiting applications
+        easy way to add encryption support to many existing applications
         and it's hard to debug and fix them all. 
 
         So I wanted another BIO which would catch the incorrect passwords and
@@ -80,10 +80,10 @@
         1) you must somehow separate checksum from actual data. 
         2) you need lot's of memory when reading the file, because you 
         must read to the end of the file and verify the checksum before
-        leting the application to read the data. 
+        letting the application to read the data. 
         
         BIO_f_reliable tries to solve both problems, so that you can 
-        read and write arbitraly long streams using only fixed amount
+        read and write arbitrary long streams using only fixed amount
         of memory.
 
         BIO_f_reliable splits data stream into blocks. Each block is prefixed
@@ -91,7 +91,7 @@
         several Kbytes of memory to buffer single block before verifying 
         it's digest. 
 
-        BIO_f_reliable goes futher and adds several important capabilities:
+        BIO_f_reliable goes further and adds several important capabilities:
 
         1) the digest of the block is computed over the whole stream 
         -- so nobody can rearrange the blocks or remove or replace them.
@@ -110,7 +110,7 @@
         and then compare the digest output.
 
         Bad things: BIO_f_reliable knows what's going on in EVP_Digest. I 
-        initialy wrote and tested this code on x86 machine and wrote the
+        initially wrote and tested this code on x86 machine and wrote the
         digests out in machine-dependent order :( There are people using
         this code and I cannot change this easily without making existing
         data files unreadable.
@@ -130,6 +130,8 @@ static int ok_read(BIO *h,char *buf,int size);
 static long ok_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int ok_new(BIO *h);
 static int ok_free(BIO *data);
+static long ok_callback_ctrl(BIO *h,int cmd,void (*fp)());
+
 static void sig_out(BIO* b);
 static void sig_in(BIO* b);
 static void block_out(BIO* b);
@@ -173,6 +175,7 @@ static BIO_METHOD methods_ok=
         ok_ctrl,
         ok_new,
         ok_free,
+        ok_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_reliable(void)
@@ -428,6 +431,20 @@ static long ok_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long ok_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static void longswap(void *_ptr, int len)
 {
 #ifndef L_ENDIAN
@@ -451,12 +468,12 @@ static void sig_out(BIO* b)
         if(ctx->buf_len+ 2* md->digest->md_size > OK_BLOCK_SIZE) return;
 
         EVP_DigestInit(md, md->digest);
-        RAND_bytes(&(md->md.base[0]), md->digest->md_size);
+        RAND_pseudo_bytes(&(md->md.base[0]), md->digest->md_size);
         memcpy(&(ctx->buf[ctx->buf_len]), &(md->md.base[0]), md->digest->md_size);
         longswap(&(ctx->buf[ctx->buf_len]), md->digest->md_size);
         ctx->buf_len+= md->digest->md_size;
 
-        EVP_DigestUpdate(md, (unsigned char*)WELLKNOWN, strlen(WELLKNOWN));
+        EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN));
         md->digest->final(&(ctx->buf[ctx->buf_len]), &(md->md.base[0]));
         ctx->buf_len+= md->digest->md_size;
         ctx->blockout= 1;
@@ -480,7 +497,7 @@ static void sig_in(BIO* b)
         longswap(&(md->md.base[0]), md->digest->md_size);
         ctx->buf_off+= md->digest->md_size;
 
-        EVP_DigestUpdate(md, (unsigned char*)WELLKNOWN, strlen(WELLKNOWN));
+        EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN));
         md->digest->final(tmp, &(md->md.base[0]));
         ret= memcmp(&(ctx->buf[ctx->buf_off]), tmp, md->digest->md_size) == 0;
         ctx->buf_off+= md->digest->md_size;
diff --git a/src/lib/libssl/src/crypto/evp/c_all.c b/src/lib/libssl/src/crypto/evp/c_all.c
index a4d3b43fb9..1e185830a3 100644
--- a/src/lib/libssl/src/crypto/evp/c_all.c
+++ b/src/lib/libssl/src/crypto/evp/c_all.c
@@ -59,135 +59,9 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/evp.h>
-#include <openssl/pkcs12.h>
-#include <openssl/objects.h>
 
-void SSLeay_add_all_algorithms(void)
-        {
-        SSLeay_add_all_ciphers();
-        SSLeay_add_all_digests();
-        }
-
-void SSLeay_add_all_ciphers(void)
-        {
-#ifndef NO_DES
-        EVP_add_cipher(EVP_des_cfb());
-        EVP_add_cipher(EVP_des_ede_cfb());
-        EVP_add_cipher(EVP_des_ede3_cfb());
-
-        EVP_add_cipher(EVP_des_ofb());
-        EVP_add_cipher(EVP_des_ede_ofb());
-        EVP_add_cipher(EVP_des_ede3_ofb());
-
-        EVP_add_cipher(EVP_desx_cbc());
-        EVP_add_cipher_alias(SN_desx_cbc,"DESX");
-        EVP_add_cipher_alias(SN_desx_cbc,"desx");
-
-        EVP_add_cipher(EVP_des_cbc());
-        EVP_add_cipher_alias(SN_des_cbc,"DES");
-        EVP_add_cipher_alias(SN_des_cbc,"des");
-        EVP_add_cipher(EVP_des_ede_cbc());
-        EVP_add_cipher(EVP_des_ede3_cbc());
-        EVP_add_cipher_alias(SN_des_ede3_cbc,"DES3");
-        EVP_add_cipher_alias(SN_des_ede3_cbc,"des3");
-
-        EVP_add_cipher(EVP_des_ecb());
-        EVP_add_cipher(EVP_des_ede());
-        EVP_add_cipher(EVP_des_ede3());
-#endif
-
-#ifndef NO_RC4
-        EVP_add_cipher(EVP_rc4());
-        EVP_add_cipher(EVP_rc4_40());
-#endif
-
-#ifndef NO_IDEA
-        EVP_add_cipher(EVP_idea_ecb());
-        EVP_add_cipher(EVP_idea_cfb());
-        EVP_add_cipher(EVP_idea_ofb());
-        EVP_add_cipher(EVP_idea_cbc());
-        EVP_add_cipher_alias(SN_idea_cbc,"IDEA");
-        EVP_add_cipher_alias(SN_idea_cbc,"idea");
-#endif
-
-#ifndef NO_RC2
-        EVP_add_cipher(EVP_rc2_ecb());
-        EVP_add_cipher(EVP_rc2_cfb());
-        EVP_add_cipher(EVP_rc2_ofb());
-        EVP_add_cipher(EVP_rc2_cbc());
-        EVP_add_cipher(EVP_rc2_40_cbc());
-        EVP_add_cipher(EVP_rc2_64_cbc());
-        EVP_add_cipher_alias(SN_rc2_cbc,"RC2");
-        EVP_add_cipher_alias(SN_rc2_cbc,"rc2");
-#endif
-
-#ifndef NO_BF
-        EVP_add_cipher(EVP_bf_ecb());
-        EVP_add_cipher(EVP_bf_cfb());
-        EVP_add_cipher(EVP_bf_ofb());
-        EVP_add_cipher(EVP_bf_cbc());
-        EVP_add_cipher_alias(SN_bf_cbc,"BF");
-        EVP_add_cipher_alias(SN_bf_cbc,"bf");
-        EVP_add_cipher_alias(SN_bf_cbc,"blowfish");
-#endif
-
-#ifndef NO_CAST
-        EVP_add_cipher(EVP_cast5_ecb());
-        EVP_add_cipher(EVP_cast5_cfb());
-        EVP_add_cipher(EVP_cast5_ofb());
-        EVP_add_cipher(EVP_cast5_cbc());
-        EVP_add_cipher_alias(SN_cast5_cbc,"CAST");
-        EVP_add_cipher_alias(SN_cast5_cbc,"cast");
-        EVP_add_cipher_alias(SN_cast5_cbc,"CAST-cbc");
-        EVP_add_cipher_alias(SN_cast5_cbc,"cast-cbc");
-#endif
-
-#ifndef NO_RC5
-        EVP_add_cipher(EVP_rc5_32_12_16_ecb());
-        EVP_add_cipher(EVP_rc5_32_12_16_cfb());
-        EVP_add_cipher(EVP_rc5_32_12_16_ofb());
-        EVP_add_cipher(EVP_rc5_32_12_16_cbc());
-        EVP_add_cipher_alias(SN_rc5_cbc,"rc5");
-        EVP_add_cipher_alias(SN_rc5_cbc,"RC5");
-#endif
-        }
-
-
-void SSLeay_add_all_digests(void)
-        {
-#ifndef NO_MD2
-        EVP_add_digest(EVP_md2());
-#endif
-#ifndef NO_MD5
-        EVP_add_digest(EVP_md5());
-        EVP_add_digest_alias(SN_md5,"ssl2-md5");
-        EVP_add_digest_alias(SN_md5,"ssl3-md5");
-#endif
-#ifndef NO_SHA
-        EVP_add_digest(EVP_sha());
-#ifndef NO_DSA
-        EVP_add_digest(EVP_dss());
-#endif
-#endif
-#ifndef NO_SHA
-        EVP_add_digest(EVP_sha1());
-        EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
-        EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA);
-#ifndef NO_DSA
-        EVP_add_digest(EVP_dss1());
-        EVP_add_digest_alias(SN_dsaWithSHA1,SN_dsaWithSHA1_2);
-        EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1");
-        EVP_add_digest_alias(SN_dsaWithSHA1,"dss1");
-#endif
-#endif
-#if !defined(NO_MDC2) && !defined(NO_DES)
-        EVP_add_digest(EVP_mdc2());
-#endif
-#ifndef NO_RIPEMD
-        EVP_add_digest(EVP_ripemd160());
-        EVP_add_digest_alias(SN_ripemd160,"ripemd");
-        EVP_add_digest_alias(SN_ripemd160,"rmd160");
-#endif
-        PKCS12_PBE_add();
-        PKCS5_PBE_add();
-        }
+void OpenSSL_add_all_algorithms(void)
+{
+        OpenSSL_add_all_ciphers();
+        OpenSSL_add_all_digests();
+}
diff --git a/src/lib/libssl/src/crypto/evp/c_allc.c b/src/lib/libssl/src/crypto/evp/c_allc.c
new file mode 100644
index 0000000000..f24d3756c9
--- /dev/null
+++ b/src/lib/libssl/src/crypto/evp/c_allc.c
@@ -0,0 +1,149 @@
+/* crypto/evp/c_allc.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/pkcs12.h>
+#include <openssl/objects.h>
+
+void OpenSSL_add_all_ciphers(void)
+        {
+#ifndef NO_DES
+        EVP_add_cipher(EVP_des_cfb());
+        EVP_add_cipher(EVP_des_ede_cfb());
+        EVP_add_cipher(EVP_des_ede3_cfb());
+
+        EVP_add_cipher(EVP_des_ofb());
+        EVP_add_cipher(EVP_des_ede_ofb());
+        EVP_add_cipher(EVP_des_ede3_ofb());
+
+        EVP_add_cipher(EVP_desx_cbc());
+        EVP_add_cipher_alias(SN_desx_cbc,"DESX");
+        EVP_add_cipher_alias(SN_desx_cbc,"desx");
+
+        EVP_add_cipher(EVP_des_cbc());
+        EVP_add_cipher_alias(SN_des_cbc,"DES");
+        EVP_add_cipher_alias(SN_des_cbc,"des");
+        EVP_add_cipher(EVP_des_ede_cbc());
+        EVP_add_cipher(EVP_des_ede3_cbc());
+        EVP_add_cipher_alias(SN_des_ede3_cbc,"DES3");
+        EVP_add_cipher_alias(SN_des_ede3_cbc,"des3");
+
+        EVP_add_cipher(EVP_des_ecb());
+        EVP_add_cipher(EVP_des_ede());
+        EVP_add_cipher(EVP_des_ede3());
+#endif
+
+#ifndef NO_RC4
+        EVP_add_cipher(EVP_rc4());
+        EVP_add_cipher(EVP_rc4_40());
+#endif
+
+#ifndef NO_IDEA
+        EVP_add_cipher(EVP_idea_ecb());
+        EVP_add_cipher(EVP_idea_cfb());
+        EVP_add_cipher(EVP_idea_ofb());
+        EVP_add_cipher(EVP_idea_cbc());
+        EVP_add_cipher_alias(SN_idea_cbc,"IDEA");
+        EVP_add_cipher_alias(SN_idea_cbc,"idea");
+#endif
+
+#ifndef NO_RC2
+        EVP_add_cipher(EVP_rc2_ecb());
+        EVP_add_cipher(EVP_rc2_cfb());
+        EVP_add_cipher(EVP_rc2_ofb());
+        EVP_add_cipher(EVP_rc2_cbc());
+        EVP_add_cipher(EVP_rc2_40_cbc());
+        EVP_add_cipher(EVP_rc2_64_cbc());
+        EVP_add_cipher_alias(SN_rc2_cbc,"RC2");
+        EVP_add_cipher_alias(SN_rc2_cbc,"rc2");
+#endif
+
+#ifndef NO_BF
+        EVP_add_cipher(EVP_bf_ecb());
+        EVP_add_cipher(EVP_bf_cfb());
+        EVP_add_cipher(EVP_bf_ofb());
+        EVP_add_cipher(EVP_bf_cbc());
+        EVP_add_cipher_alias(SN_bf_cbc,"BF");
+        EVP_add_cipher_alias(SN_bf_cbc,"bf");
+        EVP_add_cipher_alias(SN_bf_cbc,"blowfish");
+#endif
+
+#ifndef NO_CAST
+        EVP_add_cipher(EVP_cast5_ecb());
+        EVP_add_cipher(EVP_cast5_cfb());
+        EVP_add_cipher(EVP_cast5_ofb());
+        EVP_add_cipher(EVP_cast5_cbc());
+        EVP_add_cipher_alias(SN_cast5_cbc,"CAST");
+        EVP_add_cipher_alias(SN_cast5_cbc,"cast");
+        EVP_add_cipher_alias(SN_cast5_cbc,"CAST-cbc");
+        EVP_add_cipher_alias(SN_cast5_cbc,"cast-cbc");
+#endif
+
+#ifndef NO_RC5
+        EVP_add_cipher(EVP_rc5_32_12_16_ecb());
+        EVP_add_cipher(EVP_rc5_32_12_16_cfb());
+        EVP_add_cipher(EVP_rc5_32_12_16_ofb());
+        EVP_add_cipher(EVP_rc5_32_12_16_cbc());
+        EVP_add_cipher_alias(SN_rc5_cbc,"rc5");
+        EVP_add_cipher_alias(SN_rc5_cbc,"RC5");
+#endif
+        PKCS12_PBE_add();
+        PKCS5_PBE_add();
+        }
diff --git a/src/lib/libssl/src/crypto/evp/c_alld.c b/src/lib/libssl/src/crypto/evp/c_alld.c
new file mode 100644
index 0000000000..febe51a3ee
--- /dev/null
+++ b/src/lib/libssl/src/crypto/evp/c_alld.c
@@ -0,0 +1,100 @@
+/* crypto/evp/c_alld.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/pkcs12.h>
+#include <openssl/objects.h>
+
+void OpenSSL_add_all_digests(void)
+        {
+#ifndef NO_MD2
+        EVP_add_digest(EVP_md2());
+#endif
+#ifndef NO_MD5
+        EVP_add_digest(EVP_md5());
+        EVP_add_digest_alias(SN_md5,"ssl2-md5");
+        EVP_add_digest_alias(SN_md5,"ssl3-md5");
+#endif
+#ifndef NO_SHA
+        EVP_add_digest(EVP_sha());
+#ifndef NO_DSA
+        EVP_add_digest(EVP_dss());
+#endif
+#endif
+#ifndef NO_SHA
+        EVP_add_digest(EVP_sha1());
+        EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
+        EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA);
+#ifndef NO_DSA
+        EVP_add_digest(EVP_dss1());
+        EVP_add_digest_alias(SN_dsaWithSHA1,SN_dsaWithSHA1_2);
+        EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1");
+        EVP_add_digest_alias(SN_dsaWithSHA1,"dss1");
+#endif
+#endif
+#if !defined(NO_MDC2) && !defined(NO_DES)
+        EVP_add_digest(EVP_mdc2());
+#endif
+#ifndef NO_RIPEMD
+        EVP_add_digest(EVP_ripemd160());
+        EVP_add_digest_alias(SN_ripemd160,"ripemd");
+        EVP_add_digest_alias(SN_ripemd160,"rmd160");
+#endif
+        }
diff --git a/src/lib/libssl/src/crypto/evp/e_cbc_3d.c b/src/lib/libssl/src/crypto/evp/e_cbc_3d.c
index 02ccc6dc90..5d16b865c5 100644
--- a/src/lib/libssl/src/crypto/evp/e_cbc_3d.c
+++ b/src/lib/libssl/src/crypto/evp/e_cbc_3d.c
@@ -115,8 +115,8 @@ static void des_cbc_ede_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
                 memcpy( (char *)ctx->c.des_ede.ks3,
                         (char *)ctx->c.des_ede.ks1,
                         sizeof(ctx->c.des_ede.ks1));
@@ -134,9 +134,9 @@ static void des_cbc_ede3_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
-                des_set_key(&deskey[2],ctx->c.des_ede.ks3);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[2],ctx->c.des_ede.ks3);
                 }
         }
 
diff --git a/src/lib/libssl/src/crypto/evp/e_cbc_d.c b/src/lib/libssl/src/crypto/evp/e_cbc_d.c
index 9203f3f52d..5b4e5b8601 100644
--- a/src/lib/libssl/src/crypto/evp/e_cbc_d.c
+++ b/src/lib/libssl/src/crypto/evp/e_cbc_d.c
@@ -93,7 +93,7 @@ static void des_cbc_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
                 memcpy(&(ctx->oiv[0]),iv,8);
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
-                des_set_key(deskey,ctx->c.des_ks);
+                des_set_key_unchecked(deskey,ctx->c.des_ks);
         }
 
 static void des_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libssl/src/crypto/evp/e_cfb_3d.c b/src/lib/libssl/src/crypto/evp/e_cfb_3d.c
index bd32b072e2..b364bd4e31 100644
--- a/src/lib/libssl/src/crypto/evp/e_cfb_3d.c
+++ b/src/lib/libssl/src/crypto/evp/e_cfb_3d.c
@@ -116,8 +116,8 @@ static void des_ede_cfb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
                 memcpy( (char *)ctx->c.des_ede.ks3,
                         (char *)ctx->c.des_ede.ks1,
                         sizeof(ctx->c.des_ede.ks1));
@@ -136,9 +136,9 @@ static void des_ede3_cfb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
-                des_set_key(&deskey[2],ctx->c.des_ede.ks3);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[2],ctx->c.des_ede.ks3);
                 }
         }
 
diff --git a/src/lib/libssl/src/crypto/evp/e_cfb_d.c b/src/lib/libssl/src/crypto/evp/e_cfb_d.c
index 6bdf20b646..9e1714bd15 100644
--- a/src/lib/libssl/src/crypto/evp/e_cfb_d.c
+++ b/src/lib/libssl/src/crypto/evp/e_cfb_d.c
@@ -95,7 +95,7 @@ static void des_cfb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
                 memcpy(&(ctx->oiv[0]),iv,8);
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
-                des_set_key(deskey,ctx->c.des_ks);
+                des_set_key_unchecked(deskey,ctx->c.des_ks);
         }
 
 static void des_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libssl/src/crypto/evp/e_ecb_3d.c b/src/lib/libssl/src/crypto/evp/e_ecb_3d.c
index 354a8b79a7..806e971d36 100644
--- a/src/lib/libssl/src/crypto/evp/e_ecb_3d.c
+++ b/src/lib/libssl/src/crypto/evp/e_ecb_3d.c
@@ -110,8 +110,8 @@ static void des_ede_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
                 memcpy( (char *)ctx->c.des_ede.ks3,
                         (char *)ctx->c.des_ede.ks1,
                         sizeof(ctx->c.des_ede.ks1));
@@ -125,9 +125,9 @@ static void des_ede3_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
-                des_set_key(&deskey[2],ctx->c.des_ede.ks3);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[2],ctx->c.des_ede.ks3);
                 }
         }
 
diff --git a/src/lib/libssl/src/crypto/evp/e_ecb_d.c b/src/lib/libssl/src/crypto/evp/e_ecb_d.c
index 5fb4e64b1c..c11bef55ef 100644
--- a/src/lib/libssl/src/crypto/evp/e_ecb_d.c
+++ b/src/lib/libssl/src/crypto/evp/e_ecb_d.c
@@ -90,7 +90,7 @@ static void des_ecb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         des_cblock *deskey = (des_cblock *)key;
 
         if (deskey != NULL)
-                des_set_key(deskey,ctx->c.des_ks);
+                des_set_key_unchecked(deskey,ctx->c.des_ks);
         }
 
 static void des_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libssl/src/crypto/evp/e_ofb_3d.c b/src/lib/libssl/src/crypto/evp/e_ofb_3d.c
index 5233567c0c..d1a33e2ecd 100644
--- a/src/lib/libssl/src/crypto/evp/e_ofb_3d.c
+++ b/src/lib/libssl/src/crypto/evp/e_ofb_3d.c
@@ -116,8 +116,8 @@ static void des_ede_ofb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
                 memcpy( (char *)ctx->c.des_ede.ks3,
                         (char *)ctx->c.des_ede.ks1,
                         sizeof(ctx->c.des_ede.ks1));
@@ -136,9 +136,9 @@ static void des_ede3_ofb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(&deskey[0],ctx->c.des_ede.ks1);
-                des_set_key(&deskey[1],ctx->c.des_ede.ks2);
-                des_set_key(&deskey[2],ctx->c.des_ede.ks3);
+                des_set_key_unchecked(&deskey[0],ctx->c.des_ede.ks1);
+                des_set_key_unchecked(&deskey[1],ctx->c.des_ede.ks2);
+                des_set_key_unchecked(&deskey[2],ctx->c.des_ede.ks3);
                 }
         }
 
diff --git a/src/lib/libssl/src/crypto/evp/e_ofb_d.c b/src/lib/libssl/src/crypto/evp/e_ofb_d.c
index 398b3a002e..d51ce230f4 100644
--- a/src/lib/libssl/src/crypto/evp/e_ofb_d.c
+++ b/src/lib/libssl/src/crypto/evp/e_ofb_d.c
@@ -95,7 +95,7 @@ static void des_ofb_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
                 memcpy(&(ctx->oiv[0]),iv,8);
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
-                des_set_key(deskey,ctx->c.des_ks);
+                des_set_key_unchecked(deskey,ctx->c.des_ks);
         }
 
 static void des_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libssl/src/crypto/evp/e_xcbc_d.c b/src/lib/libssl/src/crypto/evp/e_xcbc_d.c
index 3a6628a75c..7568fad4ff 100644
--- a/src/lib/libssl/src/crypto/evp/e_xcbc_d.c
+++ b/src/lib/libssl/src/crypto/evp/e_xcbc_d.c
@@ -94,7 +94,7 @@ static void desx_cbc_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
         memcpy(&(ctx->iv[0]),&(ctx->oiv[0]),8);
         if (deskey != NULL)
                 {
-                des_set_key(deskey,ctx->c.desx_cbc.ks);
+                des_set_key_unchecked(deskey,ctx->c.desx_cbc.ks);
                 memcpy(&(ctx->c.desx_cbc.inw[0]),&(key[8]),8);
                 memcpy(&(ctx->c.desx_cbc.outw[0]),&(key[16]),8);
                 }
diff --git a/src/lib/libssl/src/crypto/evp/encode.c b/src/lib/libssl/src/crypto/evp/encode.c
index 0152624a76..14a4cb11f6 100644
--- a/src/lib/libssl/src/crypto/evp/encode.c
+++ b/src/lib/libssl/src/crypto/evp/encode.c
@@ -185,7 +185,7 @@ void EVP_EncodeFinal(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl)
         *outl=ret;
         }
 
-int EVP_EncodeBlock(unsigned char *t, unsigned char *f, int dlen)
+int EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int dlen)
         {
         int i,ret=0;
         unsigned long l;
@@ -337,7 +337,7 @@ end:
         return(rv);
         }
 
-int EVP_DecodeBlock(unsigned char *t, unsigned char *f, int n)
+int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
         {
         int i,ret=0,a,b,c,d;
         unsigned long l;
diff --git a/src/lib/libssl/src/crypto/evp/evp.h b/src/lib/libssl/src/crypto/evp/evp.h
index 570fe27d39..54215b0905 100644
--- a/src/lib/libssl/src/crypto/evp/evp.h
+++ b/src/lib/libssl/src/crypto/evp/evp.h
@@ -149,7 +149,7 @@ extern "C" {
 
 /* Type needs to be a bit field
  * Sub-type needs to be for variations on the method, as in, can it do
- * arbitary encryption.... */
+ * arbitrary encryption.... */
 typedef struct evp_pkey_st
         {
         int type;
@@ -343,7 +343,7 @@ typedef struct evp_cipher_ctx_st
         unsigned char buf[EVP_MAX_IV_LENGTH];   /* saved partial block */
         int num;                                /* used by cfb/ofb mode */
 
-        char *app_data;         /* aplication stuff */
+        char *app_data;         /* application stuff */
         union   {
 #ifndef NO_RC4
                 struct
@@ -421,9 +421,10 @@ typedef int (EVP_PBE_KEYGEN)(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
 #define EVP_MD_size(e)                  ((e)->md_size)
 #define EVP_MD_block_size(e)            ((e)->block_size)
 
+#define EVP_MD_CTX_md(e)                ((e)->digest)
 #define EVP_MD_CTX_size(e)              EVP_MD_size((e)->digest)
 #define EVP_MD_CTX_block_size(e)        EVP_MD_block_size((e)->digest)
-#define EVP_MD_CTX_type(e)              ((e)->digest)
+#define EVP_MD_CTX_type(e)              EVP_MD_type((e)->digest)
 
 #define EVP_CIPHER_nid(e)               ((e)->nid)
 #define EVP_CIPHER_block_size(e)        ((e)->block_size)
@@ -521,15 +522,14 @@ void	EVP_EncodeInit(EVP_ENCODE_CTX *ctx);
 void    EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx,unsigned char *out,
                 int *outl,unsigned char *in,int inl);
 void    EVP_EncodeFinal(EVP_ENCODE_CTX *ctx,unsigned char *out,int *outl);
-int     EVP_EncodeBlock(unsigned char *t, unsigned char *f, int n);
+int     EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int n);
 
 void    EVP_DecodeInit(EVP_ENCODE_CTX *ctx);
 int     EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx,unsigned char *out,int *outl,
                 unsigned char *in, int inl);
 int     EVP_DecodeFinal(EVP_ENCODE_CTX *ctx, unsigned
                 char *out, int *outl);
-int     EVP_DecodeBlock(unsigned char *t, unsigned
-                char *f, int n);
+int     EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n);
 
 void    ERR_load_EVP_strings(void );
 
@@ -594,9 +594,12 @@ EVP_CIPHER *EVP_rc5_32_12_16_ecb(void);
 EVP_CIPHER *EVP_rc5_32_12_16_cfb(void);
 EVP_CIPHER *EVP_rc5_32_12_16_ofb(void);
 
-void SSLeay_add_all_algorithms(void);
-void SSLeay_add_all_ciphers(void);
-void SSLeay_add_all_digests(void);
+void OpenSSL_add_all_algorithms(void);
+void OpenSSL_add_all_ciphers(void);
+void OpenSSL_add_all_digests(void);
+#define SSLeay_add_all_algorithms() OpenSSL_add_all_algorithms()
+#define SSLeay_add_all_ciphers() OpenSSL_add_all_ciphers()
+#define SSLeay_add_all_digests() OpenSSL_add_all_digests()
 
 int EVP_add_cipher(EVP_CIPHER *cipher);
 int EVP_add_digest(EVP_MD *digest);
@@ -613,6 +616,18 @@ int		EVP_PKEY_type(int type);
 int             EVP_PKEY_bits(EVP_PKEY *pkey);
 int             EVP_PKEY_size(EVP_PKEY *pkey);
 int             EVP_PKEY_assign(EVP_PKEY *pkey,int type,char *key);
+#ifndef NO_RSA
+int             EVP_PKEY_set1_RSA(EVP_PKEY *pkey,RSA *key);
+RSA *           EVP_PKEY_get1_RSA(EVP_PKEY *pkey);
+#endif
+#ifndef NO_DSA
+int             EVP_PKEY_set1_DSA(EVP_PKEY *pkey,DSA *key);
+DSA *           EVP_PKEY_get1_DSA(EVP_PKEY *pkey);
+#endif
+#ifndef NO_DH
+int             EVP_PKEY_set1_DH(EVP_PKEY *pkey,DH *key);
+DH *            EVP_PKEY_get1_DH(EVP_PKEY *pkey);
+#endif
 EVP_PKEY *      EVP_PKEY_new(void);
 void            EVP_PKEY_free(EVP_PKEY *pkey);
 EVP_PKEY *      d2i_PublicKey(int type,EVP_PKEY **a, unsigned char **pp,
@@ -621,6 +636,8 @@ int		i2d_PublicKey(EVP_PKEY *a, unsigned char **pp);
 
 EVP_PKEY *      d2i_PrivateKey(int type,EVP_PKEY **a, unsigned char **pp,
                         long length);
+EVP_PKEY *      d2i_AutoPrivateKey(EVP_PKEY **a, unsigned char **pp,
+                        long length);
 int             i2d_PrivateKey(EVP_PKEY *a, unsigned char **pp);
 
 int EVP_PKEY_copy_parameters(EVP_PKEY *to,EVP_PKEY *from);
@@ -677,6 +694,9 @@ void EVP_PBE_cleanup(void);
 #define EVP_F_EVP_PKEY_COPY_PARAMETERS                   103
 #define EVP_F_EVP_PKEY_DECRYPT                           104
 #define EVP_F_EVP_PKEY_ENCRYPT                           105
+#define EVP_F_EVP_PKEY_GET1_DH                           119
+#define EVP_F_EVP_PKEY_GET1_DSA                          120
+#define EVP_F_EVP_PKEY_GET1_RSA                          121
 #define EVP_F_EVP_PKEY_NEW                               106
 #define EVP_F_EVP_SIGNFINAL                              107
 #define EVP_F_EVP_VERIFYFINAL                            108
@@ -693,10 +713,13 @@ void EVP_PBE_cleanup(void);
 #define EVP_R_DIFFERENT_KEY_TYPES                        101
 #define EVP_R_ENCODE_ERROR                               115
 #define EVP_R_EVP_PBE_CIPHERINIT_ERROR                   119
+#define EVP_R_EXPECTING_AN_RSA_KEY                       127
+#define EVP_R_EXPECTING_A_DH_KEY                         128
+#define EVP_R_EXPECTING_A_DSA_KEY                        129
 #define EVP_R_INPUT_NOT_INITIALIZED                      111
 #define EVP_R_IV_TOO_LARGE                               102
 #define EVP_R_KEYGEN_FAILURE                             120
-#define EVP_R_MISSING_PARMATERS                          103
+#define EVP_R_MISSING_PARAMETERS                         103
 #define EVP_R_NO_DSA_PARAMETERS                          116
 #define EVP_R_NO_SIGN_FUNCTION_CONFIGURED                104
 #define EVP_R_NO_VERIFY_FUNCTION_CONFIGURED              105
diff --git a/src/lib/libssl/src/crypto/evp/evp_err.c b/src/lib/libssl/src/crypto/evp/evp_err.c
index c61cc922e8..97953a0fc1 100644
--- a/src/lib/libssl/src/crypto/evp/evp_err.c
+++ b/src/lib/libssl/src/crypto/evp/evp_err.c
@@ -77,6 +77,9 @@ static ERR_STRING_DATA EVP_str_functs[]=
 {ERR_PACK(0,EVP_F_EVP_PKEY_COPY_PARAMETERS,0),  "EVP_PKEY_copy_parameters"},
 {ERR_PACK(0,EVP_F_EVP_PKEY_DECRYPT,0),  "EVP_PKEY_decrypt"},
 {ERR_PACK(0,EVP_F_EVP_PKEY_ENCRYPT,0),  "EVP_PKEY_encrypt"},
+{ERR_PACK(0,EVP_F_EVP_PKEY_GET1_DH,0),  "EVP_PKEY_get1_DH"},
+{ERR_PACK(0,EVP_F_EVP_PKEY_GET1_DSA,0), "EVP_PKEY_get1_DSA"},
+{ERR_PACK(0,EVP_F_EVP_PKEY_GET1_RSA,0), "EVP_PKEY_get1_RSA"},
 {ERR_PACK(0,EVP_F_EVP_PKEY_NEW,0),      "EVP_PKEY_new"},
 {ERR_PACK(0,EVP_F_EVP_SIGNFINAL,0),     "EVP_SignFinal"},
 {ERR_PACK(0,EVP_F_EVP_VERIFYFINAL,0),   "EVP_VerifyFinal"},
@@ -96,10 +99,13 @@ static ERR_STRING_DATA EVP_str_reasons[]=
 {EVP_R_DIFFERENT_KEY_TYPES               ,"different key types"},
 {EVP_R_ENCODE_ERROR                      ,"encode error"},
 {EVP_R_EVP_PBE_CIPHERINIT_ERROR          ,"evp pbe cipherinit error"},
+{EVP_R_EXPECTING_AN_RSA_KEY              ,"expecting an rsa key"},
+{EVP_R_EXPECTING_A_DH_KEY                ,"expecting a dh key"},
+{EVP_R_EXPECTING_A_DSA_KEY               ,"expecting a dsa key"},
 {EVP_R_INPUT_NOT_INITIALIZED             ,"input not initialized"},
 {EVP_R_IV_TOO_LARGE                      ,"iv too large"},
 {EVP_R_KEYGEN_FAILURE                    ,"keygen failure"},
-{EVP_R_MISSING_PARMATERS                 ,"missing parmaters"},
+{EVP_R_MISSING_PARAMETERS                ,"missing parameters"},
 {EVP_R_NO_DSA_PARAMETERS                 ,"no dsa parameters"},
 {EVP_R_NO_SIGN_FUNCTION_CONFIGURED       ,"no sign function configured"},
 {EVP_R_NO_VERIFY_FUNCTION_CONFIGURED     ,"no verify function configured"},
diff --git a/src/lib/libssl/src/crypto/evp/evp_key.c b/src/lib/libssl/src/crypto/evp/evp_key.c
index 21eda418bc..667c21cca8 100644
--- a/src/lib/libssl/src/crypto/evp/evp_key.c
+++ b/src/lib/libssl/src/crypto/evp/evp_key.c
@@ -81,15 +81,18 @@ char *EVP_get_pw_prompt(void)
                 return(prompt_string);
         }
 
-#ifdef NO_DES
-int des_read_pw_string(char *buf,int len,const char *prompt,int verify);
-#endif
-
+/* For historical reasons, the standard function for reading passwords is
+ * in the DES library -- if someone ever wants to disable DES,
+ * this function will fail */
 int EVP_read_pw_string(char *buf, int len, const char *prompt, int verify)
         {
+#ifndef NO_DES
         if ((prompt == NULL) && (prompt_string[0] != '\0'))
                 prompt=prompt_string;
         return(des_read_pw_string(buf,len,prompt,verify));
+#else
+        return -1;
+#endif
         }
 
 int EVP_BytesToKey(const EVP_CIPHER *type, EVP_MD *md, unsigned char *salt,
diff --git a/src/lib/libssl/src/crypto/evp/evp_lib.c b/src/lib/libssl/src/crypto/evp/evp_lib.c
index 3f9bf55828..a431945ef5 100644
--- a/src/lib/libssl/src/crypto/evp/evp_lib.c
+++ b/src/lib/libssl/src/crypto/evp/evp_lib.c
@@ -115,6 +115,7 @@ int EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
 int EVP_CIPHER_type(const EVP_CIPHER *ctx)
 {
         int nid;
+        ASN1_OBJECT *otmp;
         nid = EVP_CIPHER_nid(ctx);
 
         switch(nid) {
@@ -131,7 +132,10 @@ int EVP_CIPHER_type(const EVP_CIPHER *ctx)
                 return NID_rc4;
 
                 default:
-
+                /* Check it has an OID and it is valid */
+                otmp = OBJ_nid2obj(nid);
+                if(!otmp || !otmp->data) nid = NID_undef;
+                ASN1_OBJECT_free(otmp);
                 return nid;
         }
 }
diff --git a/src/lib/libssl/src/crypto/evp/evp_pkey.c b/src/lib/libssl/src/crypto/evp/evp_pkey.c
index 421e452db1..d5e6f5880f 100644
--- a/src/lib/libssl/src/crypto/evp/evp_pkey.c
+++ b/src/lib/libssl/src/crypto/evp/evp_pkey.c
@@ -62,19 +62,22 @@
 #include <openssl/x509.h>
 #include <openssl/rand.h>
 
+static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8inf, EVP_PKEY *pkey);
+
 /* Extract a private key from a PKCS8 structure */
 
 EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
 {
-        EVP_PKEY *pkey;
+        EVP_PKEY *pkey = NULL;
 #ifndef NO_RSA
-        RSA *rsa;
+        RSA *rsa = NULL;
 #endif
 #ifndef NO_DSA
-        DSA *dsa;
-        ASN1_INTEGER *dsapriv;
-        STACK *ndsa;
-        BN_CTX *ctx;
+        DSA *dsa = NULL;
+        ASN1_INTEGER *privkey;
+        ASN1_TYPE *t1, *t2, *param = NULL;
+        STACK *ndsa = NULL;
+        BN_CTX *ctx = NULL;
         int plen;
 #endif
         X509_ALGOR *a;
@@ -82,21 +85,14 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
         int pkeylen;
         char obj_tmp[80];
 
-        switch (p8->broken) {
-                case PKCS8_OK:
+        if(p8->pkey->type == V_ASN1_OCTET_STRING) {
+                p8->broken = PKCS8_OK;
                 p = p8->pkey->value.octet_string->data;
                 pkeylen = p8->pkey->value.octet_string->length;
-                break;
-
-                case PKCS8_NO_OCTET:
+        } else {
+                p8->broken = PKCS8_NO_OCTET;
                 p = p8->pkey->value.sequence->data;
                 pkeylen = p8->pkey->value.sequence->length;
-                break;
-
-                default:
-                EVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE);
-                return NULL;
-                break;
         }
         if (!(pkey = EVP_PKEY_new())) {
                 EVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);
@@ -121,65 +117,83 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
                  * be recalculated.
                  */
         
-                /* Check for broken Netscape Database DSA PKCS#8, UGH! */
+                /* Check for broken DSA PKCS#8, UGH! */
                 if(*p == (V_ASN1_SEQUENCE|V_ASN1_CONSTRUCTED)) {
                     if(!(ndsa = ASN1_seq_unpack(p, pkeylen, 
-                                        (char *(*)())d2i_ASN1_INTEGER,
-                                                         ASN1_STRING_free))) {
+                                        (char *(*)())d2i_ASN1_TYPE,
+                                                         ASN1_TYPE_free))) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
-                        return NULL;
+                        goto dsaerr;
                     }
                     if(sk_num(ndsa) != 2 ) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
-                        sk_pop_free(ndsa, ASN1_STRING_free);
-                        return NULL;
+                        goto dsaerr;
                     }
-                    dsapriv = (ASN1_INTEGER *) sk_pop(ndsa);
-                    sk_pop_free(ndsa, ASN1_STRING_free);
-                } else if (!(dsapriv=d2i_ASN1_INTEGER (NULL, &p, pkeylen))) {
+                    /* Handle Two broken types:
+                     * SEQUENCE {parameters, priv_key}
+                     * SEQUENCE {pub_key, priv_key}
+                     */
+                     
+                    t1 = (ASN1_TYPE *)sk_value(ndsa, 0);
+                    t2 = (ASN1_TYPE *)sk_value(ndsa, 1);
+                    if(t1->type == V_ASN1_SEQUENCE) {
+                        p8->broken = PKCS8_EMBEDDED_PARAM;
+                        param = t1;
+                    } else if(a->parameter->type == V_ASN1_SEQUENCE) {
+                        p8->broken = PKCS8_NS_DB;
+                        param = a->parameter;
+                    } else {
                         EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
-                        return NULL;
-                }
-                /* Retrieve parameters */
-                if (a->parameter->type != V_ASN1_SEQUENCE) {
-                        EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_NO_DSA_PARAMETERS);
-                        return NULL;
+                        goto dsaerr;
+                    }
+
+                    if(t2->type != V_ASN1_INTEGER) {
+                        EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
+                        goto dsaerr;
+                    }
+                    privkey = t2->value.integer;
+                } else if (!(privkey=d2i_ASN1_INTEGER (NULL, &p, pkeylen))) {
+                        EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
+                        goto dsaerr;
                 }
-                p = a->parameter->value.sequence->data;
-                plen = a->parameter->value.sequence->length;
+                p = param->value.sequence->data;
+                plen = param->value.sequence->length;
                 if (!(dsa = d2i_DSAparams (NULL, &p, plen))) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
-                        return NULL;
+                        goto dsaerr;
                 }
                 /* We have parameters now set private key */
-                if (!(dsa->priv_key = ASN1_INTEGER_to_BN(dsapriv, NULL))) {
+                if (!(dsa->priv_key = ASN1_INTEGER_to_BN(privkey, NULL))) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_BN_DECODE_ERROR);
-                        DSA_free (dsa);
-                        return NULL;
+                        goto dsaerr;
                 }
                 /* Calculate public key (ouch!) */
                 if (!(dsa->pub_key = BN_new())) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);
-                        DSA_free (dsa);
-                        return NULL;
+                        goto dsaerr;
                 }
                 if (!(ctx = BN_CTX_new())) {
                         EVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);
-                        DSA_free (dsa);
-                        return NULL;
+                        goto dsaerr;
                 }
                         
                 if (!BN_mod_exp(dsa->pub_key, dsa->g,
                                                  dsa->priv_key, dsa->p, ctx)) {
                         
                         EVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_BN_PUBKEY_ERROR);
-                        BN_CTX_free (ctx);
-                        DSA_free (dsa);
-                        return NULL;
+                        goto dsaerr;
                 }
 
-                EVP_PKEY_assign_DSA (pkey, dsa);
+                EVP_PKEY_assign_DSA(pkey, dsa);
                 BN_CTX_free (ctx);
+                sk_pop_free(ndsa, ASN1_TYPE_free);
+                break;
+                dsaerr:
+                BN_CTX_free (ctx);
+                sk_pop_free(ndsa, ASN1_TYPE_free);
+                DSA_free(dsa);
+                EVP_PKEY_free(pkey);
+                return NULL;
                 break;
 #endif
                 default:
@@ -193,30 +207,35 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
         return pkey;
 }
 
+PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)
+{
+        return EVP_PKEY2PKCS8_broken(pkey, PKCS8_OK);
+}
+
 /* Turn a private key into a PKCS8 structure */
 
-PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)
+PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken)
 {
         PKCS8_PRIV_KEY_INFO *p8;
-#ifndef NO_DSA
-        ASN1_INTEGER *dpkey;
-        unsigned char *p, *q;
-        int len;
-#endif
+
         if (!(p8 = PKCS8_PRIV_KEY_INFO_new())) {        
                 EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
+        p8->broken = broken;
         ASN1_INTEGER_set (p8->version, 0);
         if (!(p8->pkeyalg->parameter = ASN1_TYPE_new ())) {
                 EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                 PKCS8_PRIV_KEY_INFO_free (p8);
                 return NULL;
         }
+        p8->pkey->type = V_ASN1_OCTET_STRING;
         switch (EVP_PKEY_type(pkey->type)) {
 #ifndef NO_RSA
                 case EVP_PKEY_RSA:
 
+                if(p8->broken == PKCS8_NO_OCTET) p8->pkey->type = V_ASN1_SEQUENCE;
+
                 p8->pkeyalg->algorithm = OBJ_nid2obj(NID_rsaEncryption);
                 p8->pkeyalg->parameter->type = V_ASN1_NULL;
                 if (!ASN1_pack_string ((char *)pkey, i2d_PrivateKey,
@@ -229,36 +248,11 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)
 #endif
 #ifndef NO_DSA
                 case EVP_PKEY_DSA:
-                p8->pkeyalg->algorithm = OBJ_nid2obj(NID_dsa);
-
-                /* get paramaters and place in AlgorithmIdentifier */
-                len = i2d_DSAparams (pkey->pkey.dsa, NULL);
-                if (!(p = Malloc(len))) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                if(!dsa_pkey2pkcs8(p8, pkey)) {
                         PKCS8_PRIV_KEY_INFO_free (p8);
                         return NULL;
                 }
-                q = p;
-                i2d_DSAparams (pkey->pkey.dsa, &q);
-                p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
-                p8->pkeyalg->parameter->value.sequence = ASN1_STRING_new();
-                ASN1_STRING_set(p8->pkeyalg->parameter->value.sequence, p, len);
-                Free(p);
-                /* Get private key into an integer and pack */
-                if (!(dpkey = BN_to_ASN1_INTEGER (pkey->pkey.dsa->priv_key, NULL))) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
-                        PKCS8_PRIV_KEY_INFO_free (p8);
-                        return NULL;
-                }
-                
-                if (!ASN1_pack_string((char *)dpkey, i2d_ASN1_INTEGER,
-                                         &p8->pkey->value.octet_string)) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
-                        ASN1_INTEGER_free (dpkey);
-                        PKCS8_PRIV_KEY_INFO_free (p8);
-                        return NULL;
-                }
-                ASN1_INTEGER_free (dpkey);
+
                 break;
 #endif
                 default:
@@ -266,9 +260,8 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)
                 PKCS8_PRIV_KEY_INFO_free (p8);
                 return NULL;
         }
-        p8->pkey->type = V_ASN1_OCTET_STRING;
-        RAND_seed (p8->pkey->value.octet_string->data,
-                                         p8->pkey->value.octet_string->length);
+        RAND_add(p8->pkey->value.octet_string->data,
+                 p8->pkey->value.octet_string->length, 0);
         return p8;
 }
 
@@ -295,4 +288,112 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken)
         }
 }
 
+#ifndef NO_DSA
+static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
+{
+        ASN1_STRING *params;
+        ASN1_INTEGER *prkey;
+        ASN1_TYPE *ttmp;
+        STACK *ndsa;
+        unsigned char *p, *q;
+        int len;
+        p8->pkeyalg->algorithm = OBJ_nid2obj(NID_dsa);
+        len = i2d_DSAparams (pkey->pkey.dsa, NULL);
+        if (!(p = Malloc(len))) {
+                EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                PKCS8_PRIV_KEY_INFO_free (p8);
+                return 0;
+        }
+        q = p;
+        i2d_DSAparams (pkey->pkey.dsa, &q);
+        params = ASN1_STRING_new();
+        ASN1_STRING_set(params, p, len);
+        Free(p);
+        /* Get private key into integer */
+        if (!(prkey = BN_to_ASN1_INTEGER (pkey->pkey.dsa->priv_key, NULL))) {
+                EVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
+                return 0;
+        }
+
+        switch(p8->broken) {
 
+                case PKCS8_OK:
+                case PKCS8_NO_OCTET:
+
+                if (!ASN1_pack_string((char *)prkey, i2d_ASN1_INTEGER,
+                                         &p8->pkey->value.octet_string)) {
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        M_ASN1_INTEGER_free (prkey);
+                        return 0;
+                }
+
+                M_ASN1_INTEGER_free (prkey);
+                p8->pkeyalg->parameter->value.sequence = params;
+                p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
+
+                break;
+
+                case PKCS8_NS_DB:
+
+                p8->pkeyalg->parameter->value.sequence = params;
+                p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
+                ndsa = sk_new_null();
+                ttmp = ASN1_TYPE_new();
+                if (!(ttmp->value.integer = BN_to_ASN1_INTEGER (pkey->pkey.dsa->pub_key, NULL))) {
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
+                        PKCS8_PRIV_KEY_INFO_free(p8);
+                        return 0;
+                }
+                ttmp->type = V_ASN1_INTEGER;
+                sk_push(ndsa, (char *)ttmp);
+
+                ttmp = ASN1_TYPE_new();
+                ttmp->value.integer = prkey;
+                ttmp->type = V_ASN1_INTEGER;
+                sk_push(ndsa, (char *)ttmp);
+
+                p8->pkey->value.octet_string = ASN1_OCTET_STRING_new();
+
+                if (!ASN1_seq_pack(ndsa, i2d_ASN1_TYPE,
+                                         &p8->pkey->value.octet_string->data,
+                                         &p8->pkey->value.octet_string->length)) {
+
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        sk_pop_free(ndsa, ASN1_TYPE_free);
+                        M_ASN1_INTEGER_free(prkey);
+                        return 0;
+                }
+                sk_pop_free(ndsa, ASN1_TYPE_free);
+                break;
+
+                case PKCS8_EMBEDDED_PARAM:
+
+                p8->pkeyalg->parameter->type = V_ASN1_NULL;
+                ndsa = sk_new_null();
+                ttmp = ASN1_TYPE_new();
+                ttmp->value.sequence = params;
+                ttmp->type = V_ASN1_SEQUENCE;
+                sk_push(ndsa, (char *)ttmp);
+
+                ttmp = ASN1_TYPE_new();
+                ttmp->value.integer = prkey;
+                ttmp->type = V_ASN1_INTEGER;
+                sk_push(ndsa, (char *)ttmp);
+
+                p8->pkey->value.octet_string = ASN1_OCTET_STRING_new();
+
+                if (!ASN1_seq_pack(ndsa, i2d_ASN1_TYPE,
+                                         &p8->pkey->value.octet_string->data,
+                                         &p8->pkey->value.octet_string->length)) {
+
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        sk_pop_free(ndsa, ASN1_TYPE_free);
+                        M_ASN1_INTEGER_free (prkey);
+                        return 0;
+                }
+                sk_pop_free(ndsa, ASN1_TYPE_free);
+                break;
+        }
+        return 1;
+}
+#endif
diff --git a/src/lib/libssl/src/crypto/evp/p_lib.c b/src/lib/libssl/src/crypto/evp/p_lib.c
index 3422b77de6..4cb387f8de 100644
--- a/src/lib/libssl/src/crypto/evp/p_lib.c
+++ b/src/lib/libssl/src/crypto/evp/p_lib.c
@@ -119,7 +119,7 @@ int EVP_PKEY_copy_parameters(EVP_PKEY *to, EVP_PKEY *from)
 
         if (EVP_PKEY_missing_parameters(from))
                 {
-                EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS,EVP_R_MISSING_PARMATERS);
+                EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS,EVP_R_MISSING_PARAMETERS);
                 goto err;
                 }
 #ifndef NO_DSA
@@ -202,8 +202,66 @@ int EVP_PKEY_assign(EVP_PKEY *pkey, int type, char *key)
         pkey->type=EVP_PKEY_type(type);
         pkey->save_type=type;
         pkey->pkey.ptr=key;
-        return(1);
+        return(key != NULL);
+        }
+
+#ifndef NO_RSA
+int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key)
+{
+        int ret = EVP_PKEY_assign_RSA(pkey, key);
+        if(ret) CRYPTO_add(&key->references, 1, CRYPTO_LOCK_RSA);
+        return ret;
+}
+
+RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey)
+        {
+        if(pkey->type != EVP_PKEY_RSA) {
+                EVPerr(EVP_F_EVP_PKEY_GET1_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
+                return NULL;
+        }
+        CRYPTO_add(&pkey->pkey.rsa->references, 1, CRYPTO_LOCK_RSA);
+        return pkey->pkey.rsa;
+}
+#endif
+
+#ifndef NO_DSA
+int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key)
+{
+        int ret = EVP_PKEY_assign_DSA(pkey, key);
+        if(ret) CRYPTO_add(&key->references, 1, CRYPTO_LOCK_DSA);
+        return ret;
+}
+
+DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey)
+        {
+        if(pkey->type != EVP_PKEY_DSA) {
+                EVPerr(EVP_F_EVP_PKEY_GET1_DSA, EVP_R_EXPECTING_A_DSA_KEY);
+                return NULL;
+        }
+        CRYPTO_add(&pkey->pkey.dsa->references, 1, CRYPTO_LOCK_DSA);
+        return pkey->pkey.dsa;
+}
+#endif
+
+#ifndef NO_DH
+
+int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key)
+{
+        int ret = EVP_PKEY_assign_DH(pkey, key);
+        if(ret) CRYPTO_add(&key->references, 1, CRYPTO_LOCK_DH);
+        return ret;
+}
+
+DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey)
+        {
+        if(pkey->type != EVP_PKEY_DH) {
+                EVPerr(EVP_F_EVP_PKEY_GET1_DH, EVP_R_EXPECTING_A_DH_KEY);
+                return NULL;
         }
+        CRYPTO_add(&pkey->pkey.dh->references, 1, CRYPTO_LOCK_DH);
+        return pkey->pkey.dh;
+}
+#endif
 
 int EVP_PKEY_type(int type)
         {
@@ -244,7 +302,7 @@ void EVP_PKEY_free(EVP_PKEY *x)
                 }
 #endif
         EVP_PKEY_free_it(x);
-        Free((char *)x);
+        Free(x);
         }
 
 static void EVP_PKEY_free_it(EVP_PKEY *x)
diff --git a/src/lib/libssl/src/crypto/evp/p_open.c b/src/lib/libssl/src/crypto/evp/p_open.c
index ddb9fd6942..b9ca7892c2 100644
--- a/src/lib/libssl/src/crypto/evp/p_open.c
+++ b/src/lib/libssl/src/crypto/evp/p_open.c
@@ -110,4 +110,10 @@ int EVP_OpenFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         EVP_DecryptInit(ctx,NULL,NULL,NULL);
         return(i);
         }
+#else /* !NO_RSA */
+
+# ifdef PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/crypto/evp/p_seal.c b/src/lib/libssl/src/crypto/evp/p_seal.c
index 09b46f4b0e..d449e892bf 100644
--- a/src/lib/libssl/src/crypto/evp/p_seal.c
+++ b/src/lib/libssl/src/crypto/evp/p_seal.c
@@ -73,9 +73,10 @@ int EVP_SealInit(EVP_CIPHER_CTX *ctx, EVP_CIPHER *type, unsigned char **ek,
         int i;
         
         if (npubk <= 0) return(0);
-        RAND_bytes(key,EVP_MAX_KEY_LENGTH);
+        if (RAND_bytes(key,EVP_MAX_KEY_LENGTH) <= 0)
+                return(0);
         if (type->iv_len > 0)
-                RAND_bytes(iv,type->iv_len);
+                RAND_pseudo_bytes(iv,type->iv_len);
 
         EVP_CIPHER_CTX_init(ctx);
         EVP_EncryptInit(ctx,type,key,iv);
diff --git a/src/lib/libssl/src/crypto/ex_data.c b/src/lib/libssl/src/crypto/ex_data.c
index 176574766b..a057dd3b68 100644
--- a/src/lib/libssl/src/crypto/ex_data.c
+++ b/src/lib/libssl/src/crypto/ex_data.c
@@ -63,15 +63,15 @@
 #include <openssl/lhash.h>
 #include "cryptlib.h"
 
-int CRYPTO_get_ex_new_index(int idx, STACK **skp, long argl, char *argp,
-             int (*new_func)(), int (*dup_func)(), void (*free_func)())
+int CRYPTO_get_ex_new_index(int idx, STACK_OF(CRYPTO_EX_DATA_FUNCS) **skp, long argl, void *argp,
+             CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         int ret= -1;
         CRYPTO_EX_DATA_FUNCS *a;
 
         MemCheck_off();
         if (*skp == NULL)
-                *skp=sk_new_null();
+                *skp=sk_CRYPTO_EX_DATA_FUNCS_new_null();
         if (*skp == NULL)
                 {
                 CRYPTOerr(CRYPTO_F_CRYPTO_GET_EX_NEW_INDEX,ERR_R_MALLOC_FAILURE);
@@ -88,23 +88,23 @@ int CRYPTO_get_ex_new_index(int idx, STACK **skp, long argl, char *argp,
         a->new_func=new_func;
         a->dup_func=dup_func;
         a->free_func=free_func;
-        while (sk_num(*skp) <= idx)
+        while (sk_CRYPTO_EX_DATA_FUNCS_num(*skp) <= idx)
                 {
-                if (!sk_push(*skp,NULL))
+                if (!sk_CRYPTO_EX_DATA_FUNCS_push(*skp,NULL))
                         {
                         CRYPTOerr(CRYPTO_F_CRYPTO_GET_EX_NEW_INDEX,ERR_R_MALLOC_FAILURE);
                         Free(a);
                         goto err;
                         }
                 }
-        sk_set(*skp,idx, (char *)a);
+        sk_CRYPTO_EX_DATA_FUNCS_set(*skp,idx, a);
         ret=idx;
 err:
         MemCheck_on();
         return(idx);
         }
 
-int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, char *val)
+int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val)
         {
         int i;
 
@@ -131,7 +131,7 @@ int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, char *val)
         return(1);
         }
 
-char *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad, int idx)
+void *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad, int idx)
         {
         if (ad->sk == NULL)
                 return(0);
@@ -145,7 +145,7 @@ char *CRYPTO_get_ex_data(CRYPTO_EX_DATA *ad, int idx)
  * being duplicated, a pointer to the
  * 'new' object to be inserted, the index, and the argi/argp
  */
-int CRYPTO_dup_ex_data(STACK *meth, CRYPTO_EX_DATA *to,
+int CRYPTO_dup_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, CRYPTO_EX_DATA *to,
              CRYPTO_EX_DATA *from)
         {
         int i,j,m,r;
@@ -154,14 +154,14 @@ int CRYPTO_dup_ex_data(STACK *meth, CRYPTO_EX_DATA *to,
 
         if (meth == NULL) return(1);
         if (from->sk == NULL) return(1);
-        m=sk_num(meth);
+        m=sk_CRYPTO_EX_DATA_FUNCS_num(meth);
         j=sk_num(from->sk);
         for (i=0; i<j; i++)
                 {
                 from_d=CRYPTO_get_ex_data(from,i);
                 if (i < m)
                         {
-                        mm=(CRYPTO_EX_DATA_FUNCS *)sk_value(meth,i);
+                        mm=sk_CRYPTO_EX_DATA_FUNCS_value(meth,i);
                         if (mm->dup_func != NULL)
                                 r=mm->dup_func(to,from,(char **)&from_d,i,
                                         mm->argl,mm->argp);
@@ -172,18 +172,18 @@ int CRYPTO_dup_ex_data(STACK *meth, CRYPTO_EX_DATA *to,
         }
 
 /* Call each free callback */
-void CRYPTO_free_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad)
+void CRYPTO_free_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, void *obj, CRYPTO_EX_DATA *ad)
         {
         CRYPTO_EX_DATA_FUNCS *m;
-        char *ptr;
+        void *ptr;
         int i,max;
 
         if (meth != NULL)
                 {
-                max=sk_num(meth);
+                max=sk_CRYPTO_EX_DATA_FUNCS_num(meth);
                 for (i=0; i<max; i++)
                         {
-                        m=(CRYPTO_EX_DATA_FUNCS *)sk_value(meth,i);
+                        m=sk_CRYPTO_EX_DATA_FUNCS_value(meth,i);
                         if ((m != NULL) && (m->free_func != NULL))
                                 {
                                 ptr=CRYPTO_get_ex_data(ad,i);
@@ -198,19 +198,19 @@ void CRYPTO_free_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad)
                 }
         }
 
-void CRYPTO_new_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad)
+void CRYPTO_new_ex_data(STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth, void *obj, CRYPTO_EX_DATA *ad)
         {
         CRYPTO_EX_DATA_FUNCS *m;
-        char *ptr;
+        void *ptr;
         int i,max;
 
         ad->sk=NULL;
         if (meth != NULL)
                 {
-                max=sk_num(meth);
+                max=sk_CRYPTO_EX_DATA_FUNCS_num(meth);
                 for (i=0; i<max; i++)
                         {
-                        m=(CRYPTO_EX_DATA_FUNCS *)sk_value(meth,i);
+                        m=sk_CRYPTO_EX_DATA_FUNCS_value(meth,i);
                         if ((m != NULL) && (m->new_func != NULL))
                                 {
                                 ptr=CRYPTO_get_ex_data(ad,i);
@@ -220,4 +220,4 @@ void CRYPTO_new_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad)
                 }
         }
 
-
+IMPLEMENT_STACK_OF(CRYPTO_EX_DATA_FUNCS)
diff --git a/src/lib/libssl/src/crypto/hmac/hmac.c b/src/lib/libssl/src/crypto/hmac/hmac.c
index 5c349bbb56..23b7c98f8f 100644
--- a/src/lib/libssl/src/crypto/hmac/hmac.c
+++ b/src/lib/libssl/src/crypto/hmac/hmac.c
@@ -109,7 +109,7 @@ void HMAC_Init(HMAC_CTX *ctx, const void *key, int len,
         memcpy(&ctx->md_ctx,&ctx->i_ctx,sizeof(ctx->i_ctx));
         }
 
-void HMAC_Update(HMAC_CTX *ctx, unsigned char *data, int len)
+void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, int len)
         {
         EVP_DigestUpdate(&(ctx->md_ctx),data,len);
         }
@@ -134,7 +134,7 @@ void HMAC_cleanup(HMAC_CTX *ctx)
         }
 
 unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
-                    unsigned char *d, int n, unsigned char *md,
+                    const unsigned char *d, int n, unsigned char *md,
                     unsigned int *md_len)
         {
         HMAC_CTX c;
diff --git a/src/lib/libssl/src/crypto/hmac/hmac.h b/src/lib/libssl/src/crypto/hmac/hmac.h
index f928975fcd..223eeda7f3 100644
--- a/src/lib/libssl/src/crypto/hmac/hmac.h
+++ b/src/lib/libssl/src/crypto/hmac/hmac.h
@@ -85,11 +85,11 @@ typedef struct hmac_ctx_st
 
 void HMAC_Init(HMAC_CTX *ctx, const void *key, int len,
                const EVP_MD *md);
-void HMAC_Update(HMAC_CTX *ctx,unsigned char *key, int len);
+void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, int len);
 void HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len);
 void HMAC_cleanup(HMAC_CTX *ctx);
 unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
-                    unsigned char *d, int n, unsigned char *md,
+                    const unsigned char *d, int n, unsigned char *md,
                     unsigned int *md_len);
 
 
diff --git a/src/lib/libssl/src/crypto/hmac/hmactest.c b/src/lib/libssl/src/crypto/hmac/hmactest.c
index 9a67dff36a..4b56b8ee13 100644
--- a/src/lib/libssl/src/crypto/hmac/hmactest.c
+++ b/src/lib/libssl/src/crypto/hmac/hmactest.c
@@ -73,7 +73,7 @@ int main(int argc, char *argv[])
 #include <openssl/ebcdic.h>
 #endif
 
-struct test_st
+static struct test_st
         {
         unsigned char key[16];
         int key_len;
diff --git a/src/lib/libssl/src/crypto/install.com b/src/lib/libssl/src/crypto/install.com
index b75d1b44b2..44cfc4e89a 100644
--- a/src/lib/libssl/src/crypto/install.com
+++ b/src/lib/libssl/src/crypto/install.com
@@ -90,6 +90,7 @@ $	  COPY 'tmp' WRK_SSLINCLUDE: /LOG
 $       ELSE
 $         COPY [.'D']'tmp' WRK_SSLINCLUDE: /LOG
 $       ENDIF
+$       SET FILE/PROT=WORLD:RE WRK_SSLINCLUDE:'tmp'
 $       GOTO LOOP_SDIRS
 $ LOOP_SDIRS_END:
 $
diff --git a/src/lib/libssl/src/crypto/lhash/Makefile.ssl b/src/lib/libssl/src/crypto/lhash/Makefile.ssl
index d6845d6caa..eef4000460 100644
--- a/src/lib/libssl/src/crypto/lhash/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/lhash/Makefile.ssl
@@ -82,7 +82,8 @@ lh_stats.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 lh_stats.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 lh_stats.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 lh_stats.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
-lh_stats.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-lh_stats.o: ../cryptlib.h
+lh_stats.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+lh_stats.o: ../../include/openssl/stack.h ../cryptlib.h
 lhash.o: ../../include/openssl/crypto.h ../../include/openssl/lhash.h
-lhash.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
+lhash.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+lhash.o: ../../include/openssl/stack.h
diff --git a/src/lib/libssl/src/crypto/lhash/lhash.c b/src/lib/libssl/src/crypto/lhash/lhash.c
index 801322beb6..6a340a2403 100644
--- a/src/lib/libssl/src/crypto/lhash/lhash.c
+++ b/src/lib/libssl/src/crypto/lhash/lhash.c
@@ -64,11 +64,11 @@
  *
  * 2.1 eay - Added an 'error in last operation' flag. eay 6-May-98
  *
- * 2.0 eay - Fixed a bug that occured when using lh_delete
+ * 2.0 eay - Fixed a bug that occurred when using lh_delete
  *           from inside lh_doall().  As entries were deleted,
  *           the 'table' was 'contract()ed', making some entries
  *           jump from the end of the table to the start, there by
- *           skiping the lh_doall() processing. eay - 4/12/95
+ *           skipping the lh_doall() processing. eay - 4/12/95
  *
  * 1.9 eay - Fixed a memory leak in lh_free, the LHASH_NODEs
  *           were not being free()ed. 21/11/95
@@ -107,12 +107,9 @@ const char *lh_version="lhash" OPENSSL_VERSION_PTEXT;
 #define UP_LOAD         (2*LH_LOAD_MULT) /* load times 256  (default 2) */
 #define DOWN_LOAD       (LH_LOAD_MULT)   /* load times 256  (default 1) */
 
-
-#define P_CP    char *
-#define P_CPP   char *,char *
 static void expand(LHASH *lh);
 static void contract(LHASH *lh);
-static LHASH_NODE **getrn(LHASH *lh, char *data, unsigned long *rhash);
+static LHASH_NODE **getrn(LHASH *lh, void *data, unsigned long *rhash);
 
 LHASH *lh_new(unsigned long (*h)(), int (*c)())
         {
@@ -152,7 +149,7 @@ LHASH *lh_new(unsigned long (*h)(), int (*c)())
         ret->error=0;
         return(ret);
 err1:
-        Free((char *)ret);
+        Free(ret);
 err0:
         return(NULL);
         }
@@ -175,15 +172,15 @@ void lh_free(LHASH *lh)
                         n=nn;
                         }
                 }
-        Free((char *)lh->b);
-        Free((char *)lh);
+        Free(lh->b);
+        Free(lh);
         }
 
-char *lh_insert(LHASH *lh, char *data)
+void *lh_insert(LHASH *lh, void *data)
         {
         unsigned long hash;
         LHASH_NODE *nn,**rn;
-        char *ret;
+        void *ret;
 
         lh->error=0;
         if (lh->up_load <= (lh->num_items*LH_LOAD_MULT/lh->num_nodes))
@@ -217,11 +214,11 @@ char *lh_insert(LHASH *lh, char *data)
         return(ret);
         }
 
-char *lh_delete(LHASH *lh, char *data)
+void *lh_delete(LHASH *lh, void *data)
         {
         unsigned long hash;
         LHASH_NODE *nn,**rn;
-        char *ret;
+        void *ret;
 
         lh->error=0;
         rn=getrn(lh,data,&hash);
@@ -236,7 +233,7 @@ char *lh_delete(LHASH *lh, char *data)
                 nn= *rn;
                 *rn=nn->next;
                 ret=nn->data;
-                Free((char *)nn);
+                Free(nn);
                 lh->num_delete++;
                 }
 
@@ -248,11 +245,11 @@ char *lh_delete(LHASH *lh, char *data)
         return(ret);
         }
 
-char *lh_retrieve(LHASH *lh, char *data)
+void *lh_retrieve(LHASH *lh, void *data)
         {
         unsigned long hash;
         LHASH_NODE **rn;
-        char *ret;
+        void *ret;
 
         lh->error=0;
         rn=getrn(lh,data,&hash);
@@ -275,7 +272,7 @@ void lh_doall(LHASH *lh, void (*func)())
         lh_doall_arg(lh,func,NULL);
         }
 
-void lh_doall_arg(LHASH *lh, void (*func)(), char *arg)
+void lh_doall_arg(LHASH *lh, void (*func)(), void *arg)
         {
         int i;
         LHASH_NODE *a,*n;
@@ -332,7 +329,7 @@ static void expand(LHASH *lh)
         if ((lh->p) >= lh->pmax)
                 {
                 j=(int)lh->num_alloc_nodes*2;
-                n=(LHASH_NODE **)Realloc((char *)lh->b,
+                n=(LHASH_NODE **)Realloc(lh->b,
                         (unsigned int)sizeof(LHASH_NODE *)*j);
                 if (n == NULL)
                         {
@@ -360,7 +357,7 @@ static void contract(LHASH *lh)
         lh->b[lh->p+lh->pmax-1]=NULL; /* 24/07-92 - eay - weird but :-( */
         if (lh->p == 0)
                 {
-                n=(LHASH_NODE **)Realloc((char *)lh->b,
+                n=(LHASH_NODE **)Realloc(lh->b,
                         (unsigned int)(sizeof(LHASH_NODE *)*lh->pmax));
                 if (n == NULL)
                         {
@@ -391,7 +388,7 @@ static void contract(LHASH *lh)
                 }
         }
 
-static LHASH_NODE **getrn(LHASH *lh, char *data, unsigned long *rhash)
+static LHASH_NODE **getrn(LHASH *lh, void *data, unsigned long *rhash)
         {
         LHASH_NODE **ret,*n1;
         unsigned long hash,nn;
@@ -426,8 +423,7 @@ static LHASH_NODE **getrn(LHASH *lh, char *data, unsigned long *rhash)
         }
 
 /*
-static unsigned long lh_strhash(str)
-char *str;
+unsigned long lh_strhash(char *str)
         {
         int i,l;
         unsigned long ret=0;
diff --git a/src/lib/libssl/src/crypto/lhash/lhash.h b/src/lib/libssl/src/crypto/lhash/lhash.h
index 6e5a1fe708..6f6eeb2698 100644
--- a/src/lib/libssl/src/crypto/lhash/lhash.h
+++ b/src/lib/libssl/src/crypto/lhash/lhash.h
@@ -73,7 +73,7 @@ extern "C" {
 
 typedef struct lhash_node_st
         {
-        char *data;
+        void *data;
         struct lhash_node_st *next;
 #ifndef NO_HASH_COMP
         unsigned long hash;
@@ -116,13 +116,13 @@ typedef struct lhash_st
  * in lh_insert(). */
 #define lh_error(lh)    ((lh)->error)
 
-LHASH *lh_new(unsigned long (*h)(), int (*c)());
+LHASH *lh_new(unsigned long (*h)(/* void *a */), int (*c)(/* void *a,void *b */));
 void lh_free(LHASH *lh);
-char *lh_insert(LHASH *lh, char *data);
-char *lh_delete(LHASH *lh, char *data);
-char *lh_retrieve(LHASH *lh, char *data);
-void lh_doall(LHASH *lh, void (*func)(/* char *b */));
-void lh_doall_arg(LHASH *lh, void (*func)(/*char *a,char *b*/),char *arg);
+void *lh_insert(LHASH *lh, void *data);
+void *lh_delete(LHASH *lh, void *data);
+void *lh_retrieve(LHASH *lh, void *data);
+    void lh_doall(LHASH *lh, void (*func)(/*void *b*/));
+void lh_doall_arg(LHASH *lh, void (*func)(/*void *a,void *b*/),void *arg);
 unsigned long lh_strhash(const char *c);
 
 #ifndef NO_FP_API
diff --git a/src/lib/libssl/src/crypto/md2/Makefile.ssl b/src/lib/libssl/src/crypto/md2/Makefile.ssl
index 4274354b5f..eab615a5be 100644
--- a/src/lib/libssl/src/crypto/md2/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/md2/Makefile.ssl
@@ -84,5 +84,5 @@ md2_one.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 md2_one.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 md2_one.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 md2_one.o: ../../include/openssl/md2.h ../../include/openssl/opensslconf.h
-md2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-md2_one.o: ../cryptlib.h
+md2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+md2_one.o: ../../include/openssl/stack.h ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/md2/md2.h b/src/lib/libssl/src/crypto/md2/md2.h
index 0d3592506c..582bffb859 100644
--- a/src/lib/libssl/src/crypto/md2/md2.h
+++ b/src/lib/libssl/src/crypto/md2/md2.h
@@ -81,9 +81,9 @@ typedef struct MD2state_st
 
 const char *MD2_options(void);
 void MD2_Init(MD2_CTX *c);
-void MD2_Update(MD2_CTX *c, register unsigned char *data, unsigned long len);
+void MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len);
 void MD2_Final(unsigned char *md, MD2_CTX *c);
-unsigned char *MD2(unsigned char *d, unsigned long n,unsigned char *md);
+unsigned char *MD2(const unsigned char *d, unsigned long n,unsigned char *md);
 #ifdef  __cplusplus
 }
 #endif
diff --git a/src/lib/libssl/src/crypto/md2/md2_dgst.c b/src/lib/libssl/src/crypto/md2/md2_dgst.c
index c7d8d6aef5..608baefa8f 100644
--- a/src/lib/libssl/src/crypto/md2/md2_dgst.c
+++ b/src/lib/libssl/src/crypto/md2/md2_dgst.c
@@ -69,9 +69,9 @@ const char *MD2_version="MD2" OPENSSL_VERSION_PTEXT;
 
 #define UCHAR   unsigned char
 
-static void md2_block(MD2_CTX *c, unsigned char *d);
+static void md2_block(MD2_CTX *c, const unsigned char *d);
 /* The magic S table - I have converted it to hex since it is
- * basicaly just a random byte string. */
+ * basically just a random byte string. */
 static MD2_INT S[256]={
         0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01,
         0x3D, 0x36, 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13,
@@ -123,7 +123,7 @@ void MD2_Init(MD2_CTX *c)
         memset(c->data,0,MD2_BLOCK);
         }
 
-void MD2_Update(MD2_CTX *c, register unsigned char *data, unsigned long len)
+void MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
         {
         register UCHAR *p;
 
@@ -161,7 +161,7 @@ void MD2_Update(MD2_CTX *c, register unsigned char *data, unsigned long len)
         c->num=(int)len;
         }
 
-static void md2_block(MD2_CTX *c, unsigned char *d)
+static void md2_block(MD2_CTX *c, const unsigned char *d)
         {
         register MD2_INT t,*sp1,*sp2;
         register int i,j;
diff --git a/src/lib/libssl/src/crypto/md2/md2_one.c b/src/lib/libssl/src/crypto/md2/md2_one.c
index 7157299d95..b12c37ce4d 100644
--- a/src/lib/libssl/src/crypto/md2/md2_one.c
+++ b/src/lib/libssl/src/crypto/md2/md2_one.c
@@ -63,7 +63,7 @@
 /* This is a separate file so that #defines in cryptlib.h can
  * map my MD functions to different names */
 
-unsigned char *MD2(unsigned char *d, unsigned long n, unsigned char *md)
+unsigned char *MD2(const unsigned char *d, unsigned long n, unsigned char *md)
         {
         MD2_CTX c;
         static unsigned char m[MD2_DIGEST_LENGTH];
diff --git a/src/lib/libssl/src/crypto/md2/md2test.c b/src/lib/libssl/src/crypto/md2/md2test.c
index 461d124957..e3f4fb4c34 100644
--- a/src/lib/libssl/src/crypto/md2/md2test.c
+++ b/src/lib/libssl/src/crypto/md2/md2test.c
@@ -73,7 +73,7 @@ int main(int argc, char *argv[])
 #include <openssl/ebcdic.h>
 #endif
 
-char *test[]={
+static char *test[]={
         "",
         "a",
         "abc",
@@ -84,7 +84,7 @@ char *test[]={
         NULL,
         };
 
-char *ret[]={
+static char *ret[]={
         "8350e5a3e24c153df2275c9f80692773",
         "32ec01ec4a6dac72c0ab96fb34c0b5d1",
         "da853b0d3f88d99b30283a69e6ded6bb",
diff --git a/src/lib/libssl/src/crypto/md32_common.h b/src/lib/libssl/src/crypto/md32_common.h
index 2b91f9eef2..1a404a458d 100644
--- a/src/lib/libssl/src/crypto/md32_common.h
+++ b/src/lib/libssl/src/crypto/md32_common.h
@@ -94,6 +94,8 @@
  *      in original (data) byte order, implemented externally (it
  *      actually is optional if data and host are of the same
  *      "endianess").
+ * HASH_MAKE_STRING
+ *      macro convering context variables to an ASCII hash string.
  *
  * Optional macros:
  *
@@ -178,8 +180,17 @@
 #undef ROTATE
 #ifndef PEDANTIC
 # if defined(_MSC_VER)
-#  define ROTATE(a,n)     _lrotl(a,n)
-# elif defined(__GNUC__) && __GNUC__>=2 && !defined(NO_ASM)
+#  define ROTATE(a,n)   _lrotl(a,n)
+# elif defined(__MWERKS__)
+#  if defined(__POWERPC__)
+#   define ROTATE(a,n)  __rlwinm(a,n,0,31)
+#  elif defined(__MC68K__)
+    /* Motorola specific tweak. <appro@fy.chalmers.se> */
+#   define ROTATE(a,n)  ( n<24 ? __rol(a,n) : __ror(a,32-n) )
+#  else
+#   define ROTATE(a,n)  __rol(a,n)
+#  endif
+# elif defined(__GNUC__) && __GNUC__>=2 && !defined(NO_ASM) && !defined(NO_INLINE_ASM)
   /*
    * Some GNU C inline assembler templates. Note that these are
    * rotates by *constant* number of bits! But that's exactly
@@ -189,16 +200,16 @@
    */
 #  if defined(__i386)
 #   define ROTATE(a,n)  ({ register unsigned int ret;   \
-                                asm volatile (          \
+                                asm (                   \
                                 "roll %1,%0"            \
                                 : "=r"(ret)             \
                                 : "I"(n), "0"(a)        \
                                 : "cc");                \
                            ret;                         \
                         })
-#  elif defined(__powerpc)
+#  elif defined(__powerpc) || defined(__ppc)
 #   define ROTATE(a,n)  ({ register unsigned int ret;   \
-                                asm volatile (          \
+                                asm (                   \
                                 "rlwinm %0,%1,%2,0,31"  \
                                 : "=r"(ret)             \
                                 : "r"(a), "I"(n));      \
@@ -211,18 +222,18 @@
  * Engage compiler specific "fetch in reverse byte order"
  * intrinsic function if available.
  */
-# if defined(__GNUC__) && __GNUC__>=2 && !defined(NO_ASM)
+# if defined(__GNUC__) && __GNUC__>=2 && !defined(NO_ASM) && !defined(NO_INLINE_ASM)
   /* some GNU C inline assembler templates by <appro@fy.chalmers.se> */
 #  if defined(__i386) && !defined(I386_ONLY)
 #   define BE_FETCH32(a)        ({ register unsigned int l=(a);\
-                                asm volatile (          \
+                                asm (                   \
                                 "bswapl %0"             \
                                 : "=r"(l) : "0"(l));    \
                           l;                            \
                         })
 #  elif defined(__powerpc)
 #   define LE_FETCH32(a)        ({ register unsigned int l;     \
-                                asm volatile (          \
+                                asm (                   \
                                 "lwbrx %0,0,%1"         \
                                 : "=r"(l)               \
                                 : "r"(a));              \
@@ -231,7 +242,7 @@
 
 #  elif defined(__sparc) && defined(ULTRASPARC)
 #  define LE_FETCH32(a) ({ register unsigned int l;             \
-                                asm volatile (                  \
+                                asm (                           \
                                 "lda [%1]#ASI_PRIMARY_LITTLE,%0"\
                                 : "=r"(l)                       \
                                 : "r"(a));                      \
@@ -399,8 +410,9 @@
  * Time for some action:-)
  */
 
-void HASH_UPDATE (HASH_CTX *c, const unsigned char *data, unsigned long len)
+void HASH_UPDATE (HASH_CTX *c, const void *data_, unsigned long len)
         {
+        const unsigned char *data=data_;
         register HASH_LONG * p;
         register unsigned long l;
         int sw,sc,ew,ec;
@@ -581,10 +593,11 @@ void HASH_FINAL (unsigned char *md, HASH_CTX *c)
 #endif
         HASH_BLOCK_HOST_ORDER (c,p,1);
 
-        l=c->A; HOST_l2c(l,md);
-        l=c->B; HOST_l2c(l,md);
-        l=c->C; HOST_l2c(l,md);
-        l=c->D; HOST_l2c(l,md);
+#ifndef HASH_MAKE_STRING
+#error "HASH_MAKE_STRING must be defined!"
+#else
+        HASH_MAKE_STRING(c,md);
+#endif
 
         c->num=0;
         /* clear stuff, HASH_BLOCK may be leaving some stuff on the stack
diff --git a/src/lib/libssl/src/crypto/md5/Makefile.ssl b/src/lib/libssl/src/crypto/md5/Makefile.ssl
index cc73fba2ba..d50f967be7 100644
--- a/src/lib/libssl/src/crypto/md5/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/md5/Makefile.ssl
@@ -19,6 +19,13 @@ AR=             ar r
 MD5_ASM_OBJ=
 
 CFLAGS= $(INCLUDES) $(CFLAG)
+
+# We let the C compiler driver to take care of .s files. This is done in
+# order to be excused from maintaining a separate set of architecture
+# dependent assembler flags. E.g. if you throw -mcpu=ultrasparc at SPARC
+# gcc, then the driver will automatically translate it to -xarch=v8plus
+# and pass it down to assembler.
+AS=$(CC) -c
 ASFLAGS=$(CFLAGS)
 
 GENERAL=Makefile
@@ -77,7 +84,7 @@ asm/md5-sparcv8plus.o: asm/md5-sparcv9.S
 # if they didn't bother to upgrade GNU assembler. Such users should
 # not choose this option, but be adviced to *remove* GNU assembler
 # or upgrade it.
-sm/md5-sparcv8plus-gcc27.o: asm/md5-sparcv9.S
+asm/md5-sparcv8plus-gcc27.o: asm/md5-sparcv9.S
         $(CC) $(ASFLAGS) -DMD5_BLOCK_DATA_ORDER -E asm/md5-sparcv9.S | \
                 /usr/ccs/bin/as -xarch=v8plus - -o asm/md5-sparcv8plus-gcc27.o
 
diff --git a/src/lib/libssl/src/crypto/md5/md5.h b/src/lib/libssl/src/crypto/md5/md5.h
index bdab6d45e8..d10bc8397f 100644
--- a/src/lib/libssl/src/crypto/md5/md5.h
+++ b/src/lib/libssl/src/crypto/md5/md5.h
@@ -103,9 +103,9 @@ typedef struct MD5state_st
         } MD5_CTX;
 
 void MD5_Init(MD5_CTX *c);
-void MD5_Update(MD5_CTX *c, const unsigned char *data, unsigned long len);
+void MD5_Update(MD5_CTX *c, const void *data, unsigned long len);
 void MD5_Final(unsigned char *md, MD5_CTX *c);
-unsigned char *MD5(unsigned char *d, unsigned long n, unsigned char *md);
+unsigned char *MD5(const unsigned char *d, unsigned long n, unsigned char *md);
 void MD5_Transform(MD5_CTX *c, const unsigned char *b);
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/md5/md5_dgst.c b/src/lib/libssl/src/crypto/md5/md5_dgst.c
index ba0115ae79..23d196b8d4 100644
--- a/src/lib/libssl/src/crypto/md5/md5_dgst.c
+++ b/src/lib/libssl/src/crypto/md5/md5_dgst.c
@@ -60,7 +60,7 @@
 #include "md5_locl.h"
 #include <openssl/opensslv.h>
 
-char *MD5_version="MD5" OPENSSL_VERSION_PTEXT;
+const char *MD5_version="MD5" OPENSSL_VERSION_PTEXT;
 
 /* Implemented from RFC1321 The MD5 Message-Digest Algorithm
  */
@@ -186,6 +186,9 @@ void md5_block_host_order (MD5_CTX *c, const void *data, int num)
 #endif
 
 #ifndef md5_block_data_order
+#ifdef X
+#undef X
+#endif
 void md5_block_data_order (MD5_CTX *c, const void *data_, int num)
         {
         const unsigned char *data=data_;
@@ -204,16 +207,15 @@ void md5_block_data_order (MD5_CTX *c, const void *data_, int num)
          *
          *                              <appro@fy.chalmers.se>
          */
-        MD5_LONG X[MD5_LBLOCK];
-        /*
-         * In case you wonder why don't I use c->data for this.
-         * RISCs usually have a handful of registers and if X is
-         * declared as automatic array good optimizing compiler
-         * shall accomodate at least part of it in register bank
-         * instead of memory.
-         *
-         *                              <appro@fy.chalmers.se>
-         */
+#ifndef MD32_XARRAY
+        /* See comment in crypto/sha/sha_locl.h for details. */
+        unsigned long   XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
+                        XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
+# define X(i)   XX##i
+#else
+        MD5_LONG XX[MD5_LBLOCK];
+# define X(i)   XX[i]
+#endif
 
         A=c->A;
         B=c->B;
@@ -222,75 +224,75 @@ void md5_block_data_order (MD5_CTX *c, const void *data_, int num)
 
         for (;num--;)
                 {
-        HOST_c2l(data,l); X[ 0]=l;              HOST_c2l(data,l); X[ 1]=l;
+        HOST_c2l(data,l); X( 0)=l;              HOST_c2l(data,l); X( 1)=l;
         /* Round 0 */
-        R0(A,B,C,D,X[ 0], 7,0xd76aa478L);       HOST_c2l(data,l); X[ 2]=l;
-        R0(D,A,B,C,X[ 1],12,0xe8c7b756L);       HOST_c2l(data,l); X[ 3]=l;
-        R0(C,D,A,B,X[ 2],17,0x242070dbL);       HOST_c2l(data,l); X[ 4]=l;
-        R0(B,C,D,A,X[ 3],22,0xc1bdceeeL);       HOST_c2l(data,l); X[ 5]=l;
-        R0(A,B,C,D,X[ 4], 7,0xf57c0fafL);       HOST_c2l(data,l); X[ 6]=l;
-        R0(D,A,B,C,X[ 5],12,0x4787c62aL);       HOST_c2l(data,l); X[ 7]=l;
-        R0(C,D,A,B,X[ 6],17,0xa8304613L);       HOST_c2l(data,l); X[ 8]=l;
-        R0(B,C,D,A,X[ 7],22,0xfd469501L);       HOST_c2l(data,l); X[ 9]=l;
-        R0(A,B,C,D,X[ 8], 7,0x698098d8L);       HOST_c2l(data,l); X[10]=l;
-        R0(D,A,B,C,X[ 9],12,0x8b44f7afL);       HOST_c2l(data,l); X[11]=l;
-        R0(C,D,A,B,X[10],17,0xffff5bb1L);       HOST_c2l(data,l); X[12]=l;
-        R0(B,C,D,A,X[11],22,0x895cd7beL);       HOST_c2l(data,l); X[13]=l;
-        R0(A,B,C,D,X[12], 7,0x6b901122L);       HOST_c2l(data,l); X[14]=l;
-        R0(D,A,B,C,X[13],12,0xfd987193L);       HOST_c2l(data,l); X[15]=l;
-        R0(C,D,A,B,X[14],17,0xa679438eL);
-        R0(B,C,D,A,X[15],22,0x49b40821L);
+        R0(A,B,C,D,X( 0), 7,0xd76aa478L);       HOST_c2l(data,l); X( 2)=l;
+        R0(D,A,B,C,X( 1),12,0xe8c7b756L);       HOST_c2l(data,l); X( 3)=l;
+        R0(C,D,A,B,X( 2),17,0x242070dbL);       HOST_c2l(data,l); X( 4)=l;
+        R0(B,C,D,A,X( 3),22,0xc1bdceeeL);       HOST_c2l(data,l); X( 5)=l;
+        R0(A,B,C,D,X( 4), 7,0xf57c0fafL);       HOST_c2l(data,l); X( 6)=l;
+        R0(D,A,B,C,X( 5),12,0x4787c62aL);       HOST_c2l(data,l); X( 7)=l;
+        R0(C,D,A,B,X( 6),17,0xa8304613L);       HOST_c2l(data,l); X( 8)=l;
+        R0(B,C,D,A,X( 7),22,0xfd469501L);       HOST_c2l(data,l); X( 9)=l;
+        R0(A,B,C,D,X( 8), 7,0x698098d8L);       HOST_c2l(data,l); X(10)=l;
+        R0(D,A,B,C,X( 9),12,0x8b44f7afL);       HOST_c2l(data,l); X(11)=l;
+        R0(C,D,A,B,X(10),17,0xffff5bb1L);       HOST_c2l(data,l); X(12)=l;
+        R0(B,C,D,A,X(11),22,0x895cd7beL);       HOST_c2l(data,l); X(13)=l;
+        R0(A,B,C,D,X(12), 7,0x6b901122L);       HOST_c2l(data,l); X(14)=l;
+        R0(D,A,B,C,X(13),12,0xfd987193L);       HOST_c2l(data,l); X(15)=l;
+        R0(C,D,A,B,X(14),17,0xa679438eL);
+        R0(B,C,D,A,X(15),22,0x49b40821L);
         /* Round 1 */
-        R1(A,B,C,D,X[ 1], 5,0xf61e2562L);
-        R1(D,A,B,C,X[ 6], 9,0xc040b340L);
-        R1(C,D,A,B,X[11],14,0x265e5a51L);
-        R1(B,C,D,A,X[ 0],20,0xe9b6c7aaL);
-        R1(A,B,C,D,X[ 5], 5,0xd62f105dL);
-        R1(D,A,B,C,X[10], 9,0x02441453L);
-        R1(C,D,A,B,X[15],14,0xd8a1e681L);
-        R1(B,C,D,A,X[ 4],20,0xe7d3fbc8L);
-        R1(A,B,C,D,X[ 9], 5,0x21e1cde6L);
-        R1(D,A,B,C,X[14], 9,0xc33707d6L);
-        R1(C,D,A,B,X[ 3],14,0xf4d50d87L);
-        R1(B,C,D,A,X[ 8],20,0x455a14edL);
-        R1(A,B,C,D,X[13], 5,0xa9e3e905L);
-        R1(D,A,B,C,X[ 2], 9,0xfcefa3f8L);
-        R1(C,D,A,B,X[ 7],14,0x676f02d9L);
-        R1(B,C,D,A,X[12],20,0x8d2a4c8aL);
+        R1(A,B,C,D,X( 1), 5,0xf61e2562L);
+        R1(D,A,B,C,X( 6), 9,0xc040b340L);
+        R1(C,D,A,B,X(11),14,0x265e5a51L);
+        R1(B,C,D,A,X( 0),20,0xe9b6c7aaL);
+        R1(A,B,C,D,X( 5), 5,0xd62f105dL);
+        R1(D,A,B,C,X(10), 9,0x02441453L);
+        R1(C,D,A,B,X(15),14,0xd8a1e681L);
+        R1(B,C,D,A,X( 4),20,0xe7d3fbc8L);
+        R1(A,B,C,D,X( 9), 5,0x21e1cde6L);
+        R1(D,A,B,C,X(14), 9,0xc33707d6L);
+        R1(C,D,A,B,X( 3),14,0xf4d50d87L);
+        R1(B,C,D,A,X( 8),20,0x455a14edL);
+        R1(A,B,C,D,X(13), 5,0xa9e3e905L);
+        R1(D,A,B,C,X( 2), 9,0xfcefa3f8L);
+        R1(C,D,A,B,X( 7),14,0x676f02d9L);
+        R1(B,C,D,A,X(12),20,0x8d2a4c8aL);
         /* Round 2 */
-        R2(A,B,C,D,X[ 5], 4,0xfffa3942L);
-        R2(D,A,B,C,X[ 8],11,0x8771f681L);
-        R2(C,D,A,B,X[11],16,0x6d9d6122L);
-        R2(B,C,D,A,X[14],23,0xfde5380cL);
-        R2(A,B,C,D,X[ 1], 4,0xa4beea44L);
-        R2(D,A,B,C,X[ 4],11,0x4bdecfa9L);
-        R2(C,D,A,B,X[ 7],16,0xf6bb4b60L);
-        R2(B,C,D,A,X[10],23,0xbebfbc70L);
-        R2(A,B,C,D,X[13], 4,0x289b7ec6L);
-        R2(D,A,B,C,X[ 0],11,0xeaa127faL);
-        R2(C,D,A,B,X[ 3],16,0xd4ef3085L);
-        R2(B,C,D,A,X[ 6],23,0x04881d05L);
-        R2(A,B,C,D,X[ 9], 4,0xd9d4d039L);
-        R2(D,A,B,C,X[12],11,0xe6db99e5L);
-        R2(C,D,A,B,X[15],16,0x1fa27cf8L);
-        R2(B,C,D,A,X[ 2],23,0xc4ac5665L);
+        R2(A,B,C,D,X( 5), 4,0xfffa3942L);
+        R2(D,A,B,C,X( 8),11,0x8771f681L);
+        R2(C,D,A,B,X(11),16,0x6d9d6122L);
+        R2(B,C,D,A,X(14),23,0xfde5380cL);
+        R2(A,B,C,D,X( 1), 4,0xa4beea44L);
+        R2(D,A,B,C,X( 4),11,0x4bdecfa9L);
+        R2(C,D,A,B,X( 7),16,0xf6bb4b60L);
+        R2(B,C,D,A,X(10),23,0xbebfbc70L);
+        R2(A,B,C,D,X(13), 4,0x289b7ec6L);
+        R2(D,A,B,C,X( 0),11,0xeaa127faL);
+        R2(C,D,A,B,X( 3),16,0xd4ef3085L);
+        R2(B,C,D,A,X( 6),23,0x04881d05L);
+        R2(A,B,C,D,X( 9), 4,0xd9d4d039L);
+        R2(D,A,B,C,X(12),11,0xe6db99e5L);
+        R2(C,D,A,B,X(15),16,0x1fa27cf8L);
+        R2(B,C,D,A,X( 2),23,0xc4ac5665L);
         /* Round 3 */
-        R3(A,B,C,D,X[ 0], 6,0xf4292244L);
-        R3(D,A,B,C,X[ 7],10,0x432aff97L);
-        R3(C,D,A,B,X[14],15,0xab9423a7L);
-        R3(B,C,D,A,X[ 5],21,0xfc93a039L);
-        R3(A,B,C,D,X[12], 6,0x655b59c3L);
-        R3(D,A,B,C,X[ 3],10,0x8f0ccc92L);
-        R3(C,D,A,B,X[10],15,0xffeff47dL);
-        R3(B,C,D,A,X[ 1],21,0x85845dd1L);
-        R3(A,B,C,D,X[ 8], 6,0x6fa87e4fL);
-        R3(D,A,B,C,X[15],10,0xfe2ce6e0L);
-        R3(C,D,A,B,X[ 6],15,0xa3014314L);
-        R3(B,C,D,A,X[13],21,0x4e0811a1L);
-        R3(A,B,C,D,X[ 4], 6,0xf7537e82L);
-        R3(D,A,B,C,X[11],10,0xbd3af235L);
-        R3(C,D,A,B,X[ 2],15,0x2ad7d2bbL);
-        R3(B,C,D,A,X[ 9],21,0xeb86d391L);
+        R3(A,B,C,D,X( 0), 6,0xf4292244L);
+        R3(D,A,B,C,X( 7),10,0x432aff97L);
+        R3(C,D,A,B,X(14),15,0xab9423a7L);
+        R3(B,C,D,A,X( 5),21,0xfc93a039L);
+        R3(A,B,C,D,X(12), 6,0x655b59c3L);
+        R3(D,A,B,C,X( 3),10,0x8f0ccc92L);
+        R3(C,D,A,B,X(10),15,0xffeff47dL);
+        R3(B,C,D,A,X( 1),21,0x85845dd1L);
+        R3(A,B,C,D,X( 8), 6,0x6fa87e4fL);
+        R3(D,A,B,C,X(15),10,0xfe2ce6e0L);
+        R3(C,D,A,B,X( 6),15,0xa3014314L);
+        R3(B,C,D,A,X(13),21,0x4e0811a1L);
+        R3(A,B,C,D,X( 4), 6,0xf7537e82L);
+        R3(D,A,B,C,X(11),10,0xbd3af235L);
+        R3(C,D,A,B,X( 2),15,0x2ad7d2bbL);
+        R3(B,C,D,A,X( 9),21,0xeb86d391L);
 
         A = c->A += A;
         B = c->B += B;
diff --git a/src/lib/libssl/src/crypto/md5/md5_locl.h b/src/lib/libssl/src/crypto/md5/md5_locl.h
index 9d04696dbd..06af633228 100644
--- a/src/lib/libssl/src/crypto/md5/md5_locl.h
+++ b/src/lib/libssl/src/crypto/md5/md5_locl.h
@@ -66,7 +66,7 @@
 #endif
 
 #ifdef MD5_ASM
-# if defined(__i386) || defined(_M_IX86)
+# if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
 #  define md5_block_host_order md5_block_asm_host_order
 # elif defined(__sparc) && defined(ULTRASPARC)
    void md5_block_asm_data_order_aligned (MD5_CTX *c, const MD5_LONG *p,int num);
@@ -77,11 +77,11 @@
 void md5_block_host_order (MD5_CTX *c, const void *p,int num);
 void md5_block_data_order (MD5_CTX *c, const void *p,int num);
 
-#if defined(__i386) || defined(_M_IX86)
+#if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
 /*
  * *_block_host_order is expected to handle aligned data while
  * *_block_data_order - unaligned. As algorithm and host (x86)
- * are in this case of the same "endianess" these two are
+ * are in this case of the same "endianness" these two are
  * otherwise indistinguishable. But normally you don't want to
  * call the same function because unaligned access in places
  * where alignment is expected is usually a "Bad Thing". Indeed,
@@ -112,6 +112,13 @@ void md5_block_data_order (MD5_CTX *c, const void *p,int num);
 #define HASH_UPDATE             MD5_Update
 #define HASH_TRANSFORM          MD5_Transform
 #define HASH_FINAL              MD5_Final
+#define HASH_MAKE_STRING(c,s)   do {    \
+        unsigned long ll;               \
+        ll=(c)->A; HOST_l2c(ll,(s));    \
+        ll=(c)->B; HOST_l2c(ll,(s));    \
+        ll=(c)->C; HOST_l2c(ll,(s));    \
+        ll=(c)->D; HOST_l2c(ll,(s));    \
+        } while (0)
 #define HASH_BLOCK_HOST_ORDER   md5_block_host_order
 #if !defined(L_ENDIAN) || defined(md5_block_data_order)
 #define HASH_BLOCK_DATA_ORDER   md5_block_data_order
@@ -119,7 +126,7 @@ void md5_block_data_order (MD5_CTX *c, const void *p,int num);
  * Little-endians (Intel and Alpha) feel better without this.
  * It looks like memcpy does better job than generic
  * md5_block_data_order on copying-n-aligning input data.
- * But franlky speaking I didn't expect such result on Alpha.
+ * But frankly speaking I didn't expect such result on Alpha.
  * On the other hand I've got this with egcs-1.0.2 and if
  * program is compiled with another (better?) compiler it
  * might turn out other way around.
@@ -140,7 +147,7 @@ void md5_block_data_order (MD5_CTX *c, const void *p,int num);
 */
 
 /* As pointed out by Wei Dai <weidai@eskimo.com>, the above can be
- * simplified to the code below.  Wei attributes these optimisations
+ * simplified to the code below.  Wei attributes these optimizations
  * to Peter Gutmann's SHS code, and he attributes it to Rich Schroeppel.
  */
 #define F(b,c,d)        ((((c) ^ (d)) & (b)) ^ (d))
diff --git a/src/lib/libssl/src/crypto/md5/md5_one.c b/src/lib/libssl/src/crypto/md5/md5_one.c
index 4b10e7f940..b89dec850d 100644
--- a/src/lib/libssl/src/crypto/md5/md5_one.c
+++ b/src/lib/libssl/src/crypto/md5/md5_one.c
@@ -64,7 +64,7 @@
 #include <openssl/ebcdic.h>
 #endif
 
-unsigned char *MD5(unsigned char *d, unsigned long n, unsigned char *md)
+unsigned char *MD5(const unsigned char *d, unsigned long n, unsigned char *md)
         {
         MD5_CTX c;
         static unsigned char m[MD5_DIGEST_LENGTH];
diff --git a/src/lib/libssl/src/crypto/md5/md5test.c b/src/lib/libssl/src/crypto/md5/md5test.c
index a192a62bb3..6bd8656302 100644
--- a/src/lib/libssl/src/crypto/md5/md5test.c
+++ b/src/lib/libssl/src/crypto/md5/md5test.c
@@ -69,7 +69,7 @@ int main(int argc, char *argv[])
 #else
 #include <openssl/md5.h>
 
-char *test[]={
+static char *test[]={
         "",
         "a",
         "abc",
@@ -80,7 +80,7 @@ char *test[]={
         NULL,
         };
 
-char *ret[]={
+static char *ret[]={
         "d41d8cd98f00b204e9800998ecf8427e",
         "0cc175b9c0f1b6a831c399e269772661",
         "900150983cd24fb0d6963f7d28e17f72",
diff --git a/src/lib/libssl/src/crypto/mdc2/Makefile.ssl b/src/lib/libssl/src/crypto/mdc2/Makefile.ssl
index f8c824c4a8..7c28103350 100644
--- a/src/lib/libssl/src/crypto/mdc2/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/mdc2/Makefile.ssl
@@ -83,7 +83,7 @@ mdc2_one.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 mdc2_one.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 mdc2_one.o: ../../include/openssl/err.h ../../include/openssl/mdc2.h
 mdc2_one.o: ../../include/openssl/opensslconf.h
-mdc2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-mdc2_one.o: ../cryptlib.h
+mdc2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+mdc2_one.o: ../../include/openssl/stack.h ../cryptlib.h
 mdc2dgst.o: ../../include/openssl/des.h ../../include/openssl/e_os2.h
 mdc2dgst.o: ../../include/openssl/mdc2.h ../../include/openssl/opensslconf.h
diff --git a/src/lib/libssl/src/crypto/mdc2/mdc2.h b/src/lib/libssl/src/crypto/mdc2/mdc2.h
index ec8e159fc9..00acd707cd 100644
--- a/src/lib/libssl/src/crypto/mdc2/mdc2.h
+++ b/src/lib/libssl/src/crypto/mdc2/mdc2.h
@@ -82,9 +82,10 @@ typedef struct mdc2_ctx_st
 
 
 void MDC2_Init(MDC2_CTX *c);
-void MDC2_Update(MDC2_CTX *c, unsigned char *data, unsigned long len);
+void MDC2_Update(MDC2_CTX *c, const unsigned char *data, unsigned long len);
 void MDC2_Final(unsigned char *md, MDC2_CTX *c);
-unsigned char *MDC2(unsigned char *d, unsigned long n, unsigned char *md);
+unsigned char *MDC2(const unsigned char *d, unsigned long n,
+        unsigned char *md);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/mem.c b/src/lib/libssl/src/crypto/mem.c
index 61fc1e184e..5a661e5f45 100644
--- a/src/lib/libssl/src/crypto/mem.c
+++ b/src/lib/libssl/src/crypto/mem.c
@@ -59,371 +59,203 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <openssl/crypto.h>
-#ifdef CRYPTO_MDEBUG_TIME
-# include <time.h>      
-#endif
-#include <openssl/buffer.h>
-#include <openssl/bio.h>
-#include <openssl/lhash.h>
 #include "cryptlib.h"
 
-/* #ifdef CRYPTO_MDEBUG */
-/* static int mh_mode=CRYPTO_MEM_CHECK_ON; */
-/* #else */
-static int mh_mode=CRYPTO_MEM_CHECK_OFF;
-/* #endif */
-/* State CRYPTO_MEM_CHECK_ON exists only temporarily when the library
- * thinks that certain allocations should not be checked (e.g. the data
- * structures used for memory checking).  It is not suitable as an initial
- * state: the library will unexpectedly enable memory checking when it
- * executes one of those sections that want to disable checking
- * temporarily.
- *
- * State CRYPTO_MEM_CHECK_ENABLE without ..._ON makes no sense whatsoever.
- */
-
-static unsigned long order=0;
-
-static LHASH *mh=NULL;
 
-typedef struct mem_st
-        {
-        char *addr;
-        int num;
-        const char *file;
-        int line;
-#ifdef CRYPTO_MDEBUG_THREAD
-        unsigned long thread;
+static int allow_customize = 1;      /* we provide flexible functions for */
+static int allow_customize_debug = 1;/* exchanging memory-related functions at
+                                      * run-time, but this must be done
+                                      * before any blocks are actually
+                                      * allocated; or we'll run into huge
+                                      * problems when malloc/free pairs
+                                      * don't match etc. */
+
+/* may be changed as long as `allow_customize' is set */
+static void *(*malloc_locked_func)(size_t)  = malloc;
+static void (*free_locked_func)(void *)     = free;
+static void *(*malloc_func)(size_t)         = malloc;
+static void *(*realloc_func)(void *, size_t)= realloc;
+static void (*free_func)(void *)            = free;
+
+/* may be changed as long as `allow_customize_debug' is set */
+/* XXX use correct function pointer types */
+#ifdef CRYPTO_MDEBUG
+  /* use default functions from mem_dbg.c */
+  static void (*malloc_debug_func)()= (void (*)())CRYPTO_dbg_malloc;
+  static void (*realloc_debug_func)()= (void (*)())CRYPTO_dbg_realloc;
+  static void (*free_debug_func)()= (void (*)())CRYPTO_dbg_free;
+  static void (*set_debug_options_func)()= (void (*)())CRYPTO_dbg_set_options;
+  static long (*get_debug_options_func)()= (long (*)())CRYPTO_dbg_get_options;
+#else
+  /* applications can use CRYPTO_malloc_debug_init() to select above case
+   * at run-time */
+  static void (*malloc_debug_func)()= NULL;
+  static void (*realloc_debug_func)()= NULL;
+  static void (*free_debug_func)()= NULL;
+  static void (*set_debug_options_func)()= NULL;
+  static long (*get_debug_options_func)()= NULL;
 #endif
-        unsigned long order;
-#ifdef CRYPTO_MDEBUG_TIME
-        time_t time;
-#endif
-        } MEM;
-
-int CRYPTO_mem_ctrl(int mode)
-        {
-        int ret=mh_mode;
-
-        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-        switch (mode)
-                {
-        /* for applications: */
-        case CRYPTO_MEM_CHECK_ON: /* aka MemCheck_start() */
-                mh_mode = CRYPTO_MEM_CHECK_ON|CRYPTO_MEM_CHECK_ENABLE;
-                break;
-        case CRYPTO_MEM_CHECK_OFF: /* aka MemCheck_stop() */
-                mh_mode = 0;
-                break;
 
-        /* switch off temporarily (for library-internal use): */
-        case CRYPTO_MEM_CHECK_DISABLE: /* aka MemCheck_off() */
-                mh_mode&= ~CRYPTO_MEM_CHECK_ENABLE;
-                break;
-        case CRYPTO_MEM_CHECK_ENABLE: /* aka MemCheck_on() */
-                if (mh_mode&CRYPTO_MEM_CHECK_ON)
-                        mh_mode|=CRYPTO_MEM_CHECK_ENABLE;
-                break;
 
-        default:
-                break;
-                }
-        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-        return(ret);
-        }
-
-static int mem_cmp(MEM *a, MEM *b)
-        {
-        return(a->addr - b->addr);
-        }
-
-static unsigned long mem_hash(MEM *a)
+int CRYPTO_set_mem_functions(void *(*m)(size_t), void *(*r)(void *, size_t),
+        void (*f)(void *))
         {
-        unsigned long ret;
-
-        ret=(unsigned long)a->addr;
-
-        ret=ret*17851+(ret>>14)*7+(ret>>4)*251;
-        return(ret);
-        }
-
-static char *(*malloc_locked_func)()=(char *(*)())malloc;
-static void (*free_locked_func)()=(void (*)())free;
-static char *(*malloc_func)()=  (char *(*)())malloc;
-static char *(*realloc_func)()= (char *(*)())realloc;
-static void (*free_func)()=     (void (*)())free;
-
-void CRYPTO_set_mem_functions(char *(*m)(), char *(*r)(), void (*f)())
-        {
-        if ((m == NULL) || (r == NULL) || (f == NULL)) return;
+        if (!allow_customize)
+                return 0;
+        if ((m == NULL) || (r == NULL) || (f == NULL))
+                return 0;
         malloc_func=m;
         realloc_func=r;
         free_func=f;
         malloc_locked_func=m;
         free_locked_func=f;
+        return 1;
         }
 
-void CRYPTO_set_locked_mem_functions(char *(*m)(), void (*f)())
+int CRYPTO_set_locked_mem_functions(void *(*m)(size_t), void (*f)(void *))
         {
-        if ((m == NULL) || (f == NULL)) return;
+        if (!allow_customize)
+                return 0;
+        if ((m == NULL) || (f == NULL))
+                return 0;
         malloc_locked_func=m;
         free_locked_func=f;
+        return 1;
+        }
+
+int CRYPTO_set_mem_debug_functions(void (*m)(), void (*r)(), void (*f)(),void (*so)(),long (*go)())
+        {
+        if (!allow_customize_debug)
+                return 0;
+        malloc_debug_func=m;
+        realloc_debug_func=r;
+        free_debug_func=f;
+        set_debug_options_func=so;
+        get_debug_options_func=go;
+        return 1;
         }
 
-void CRYPTO_get_mem_functions(char *(**m)(), char *(**r)(), void (**f)())
+void CRYPTO_get_mem_functions(void *(**m)(size_t), void *(**r)(void *, size_t),
+        void (**f)(void *))
         {
         if (m != NULL) *m=malloc_func;
         if (r != NULL) *r=realloc_func;
         if (f != NULL) *f=free_func;
         }
 
-void CRYPTO_get_locked_mem_functions(char *(**m)(), void (**f)())
+void CRYPTO_get_locked_mem_functions(void *(**m)(size_t), void (**f)(void *))
         {
         if (m != NULL) *m=malloc_locked_func;
         if (f != NULL) *f=free_locked_func;
         }
 
-void *CRYPTO_malloc_locked(int num)
+void CRYPTO_get_mem_debug_functions(void (**m)(), void (**r)(), void (**f)(),void (**so)(),long (**go)())
         {
-        return(malloc_locked_func(num));
+        if (m != NULL) *m=malloc_debug_func;
+        if (r != NULL) *r=realloc_debug_func;
+        if (f != NULL) *f=free_debug_func;
+        if (so != NULL) *so=set_debug_options_func;
+        if (go != NULL) *go=get_debug_options_func;
         }
 
-void CRYPTO_free_locked(void *str)
-        {
-        free_locked_func(str);
-        }
 
-void *CRYPTO_malloc(int num)
+void *CRYPTO_malloc_locked(int num, const char *file, int line)
         {
-        return(malloc_func(num));
-        }
+        char *ret = NULL;
 
-void *CRYPTO_realloc(void *str, int num)
-        {
-        return(realloc_func(str,num));
-        }
-
-void CRYPTO_free(void *str)
-        {
-        free_func(str);
-        }
-
-static unsigned long break_order_num=0;
-void *CRYPTO_dbg_malloc(int num, const char *file, int line)
-        {
-        char *ret;
-        MEM *m,*mm;
-
-        if ((ret=malloc_func(num)) == NULL)
-                return(NULL);
-
-        if (mh_mode & CRYPTO_MEM_CHECK_ENABLE)
+        allow_customize = 0;
+        if (malloc_debug_func != NULL)
                 {
-                MemCheck_off();
-                if ((m=(MEM *)Malloc(sizeof(MEM))) == NULL)
-                        {
-                        Free(ret);
-                        MemCheck_on();
-                        return(NULL);
-                        }
-                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-                if (mh == NULL)
-                        {
-                        if ((mh=lh_new(mem_hash,mem_cmp)) == NULL)
-                                {
-                                Free(ret);
-                                Free(m);
-                                ret=NULL;
-                                goto err;
-                                }
-                        }
-
-                m->addr=ret;
-                m->file=file;
-                m->line=line;
-                m->num=num;
-#ifdef CRYPTO_MDEBUG_THREAD
-                m->thread=CRYPTO_thread_id();
-#endif
-                if (order == break_order_num)
-                        {
-                        /* BREAK HERE */
-                        m->order=order;
-                        }
-                m->order=order++;
-#ifdef CRYPTO_MDEBUG_TIME
-                m->time=time(NULL);
-#endif
-                if ((mm=(MEM *)lh_insert(mh,(char *)m)) != NULL)
-                        {
-                        /* Not good, but don't sweat it */
-                        Free(mm);
-                        }
-err:
-                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-                MemCheck_on();
+                allow_customize_debug = 0;
+                malloc_debug_func(NULL, num, file, line, 0);
                 }
-        return(ret);
+        ret = malloc_locked_func(num);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         > 0x%p (%d)\n", ret, num);
+#endif
+        if (malloc_debug_func != NULL)
+                malloc_debug_func(ret, num, file, line, 1);
+
+        return ret;
         }
 
-void CRYPTO_dbg_free(void *addr)
+void CRYPTO_free_locked(void *str)
         {
-        MEM m,*mp;
-
-        if ((mh_mode & CRYPTO_MEM_CHECK_ENABLE) && (mh != NULL))
-                {
-                MemCheck_off();
-                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-                m.addr=addr;
-                mp=(MEM *)lh_delete(mh,(char *)&m);
-                if (mp != NULL)
-                        Free(mp);
-                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-                MemCheck_on();
-                }
-        free_func(addr);
+        if (free_debug_func != NULL)
+                free_debug_func(str, 0);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         < 0x%p\n", str);
+#endif
+        free_locked_func(str);
+        if (free_debug_func != NULL)
+                free_debug_func(NULL, 1);
         }
 
-void *CRYPTO_dbg_realloc(void *addr, int num, const char *file, int line)
+void *CRYPTO_malloc(int num, const char *file, int line)
         {
-        char *ret;
-        MEM m,*mp;
-
-        ret=realloc_func(addr,num);
-        if (ret == addr) return(ret);
+        char *ret = NULL;
 
-        if (mh_mode & CRYPTO_MEM_CHECK_ENABLE)
+        allow_customize = 0;
+        if (malloc_debug_func != NULL)
                 {
-                MemCheck_off();
-                if (ret == NULL) return(NULL);
-                m.addr=addr;
-                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-                mp=(MEM *)lh_delete(mh,(char *)&m);
-                if (mp != NULL)
-                        {
-                        mp->addr=ret;
-                        lh_insert(mh,(char *)mp);
-                        }
-                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-                MemCheck_on();
+                allow_customize_debug = 0;
+                malloc_debug_func(NULL, num, file, line, 0);
                 }
-        return(ret);
-        }
-
-void *CRYPTO_remalloc(void *a, int n)
-        {
-        if (a != NULL) Free(a);
-        a=(char *)Malloc(n);
-        return(a);
-        }
+        ret = malloc_func(num);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         > 0x%p (%d)\n", ret, num);
+#endif
+        if (malloc_debug_func != NULL)
+                malloc_debug_func(ret, num, file, line, 1);
 
-void *CRYPTO_dbg_remalloc(void *a, int n, const char *file, int line)
-        {
-        if (a != NULL) CRYPTO_dbg_free(a);
-        a=(char *)CRYPTO_dbg_malloc(n,file,line);
-        return(a);
+        return ret;
         }
 
-
-typedef struct mem_leak_st
+void *CRYPTO_realloc(void *str, int num, const char *file, int line)
         {
-        BIO *bio;
-        int chunks;
-        long bytes;
-        } MEM_LEAK;
+        char *ret = NULL;
 
-static void print_leak(MEM *m, MEM_LEAK *l)
-        {
-        char buf[128];
-#ifdef CRYPTO_MDEBUG_TIME
-        struct tm *lcl;
+        if (realloc_debug_func != NULL)
+                realloc_debug_func(str, NULL, num, file, line, 0);
+        ret = realloc_func(str,num);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         | 0x%p -> 0x%p (%d)\n", str, ret, num);
 #endif
+        if (realloc_debug_func != NULL)
+                realloc_debug_func(str, ret, num, file, line, 1);
 
-        if(m->addr == (char *)l->bio)
-            return;
-
-#ifdef CRYPTO_MDEBUG_TIME
-        lcl = localtime(&m->time);
-#endif
-
-        sprintf(buf,
-#ifdef CRYPTO_MDEBUG_TIME
-                "[%02d:%02d:%02d] "
-#endif
-                "%5lu file=%s, line=%d, "
-#ifdef CRYPTO_MDEBUG_THREAD
-                "thread=%lu, "
-#endif
-                "number=%d, address=%08lX\n",
-#ifdef CRYPTO_MDEBUG_TIME
-                lcl->tm_hour,lcl->tm_min,lcl->tm_sec,
-#endif
-                m->order,m->file,m->line,
-#ifdef CRYPTO_MDEBUG_THREAD
-                m->thread,
-#endif
-                m->num,(unsigned long)m->addr);
-
-        BIO_puts(l->bio,buf);
-        l->chunks++;
-        l->bytes+=m->num;
+        return ret;
         }
 
-void CRYPTO_mem_leaks(BIO *b)
+void CRYPTO_free(void *str)
         {
-        MEM_LEAK ml;
-        char buf[80];
-
-        if (mh == NULL) return;
-        ml.bio=b;
-        ml.bytes=0;
-        ml.chunks=0;
-        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-        lh_doall_arg(mh,(void (*)())print_leak,(char *)&ml);
-        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
-        if (ml.chunks != 0)
-                {
-                sprintf(buf,"%ld bytes leaked in %d chunks\n",
-                        ml.bytes,ml.chunks);
-                BIO_puts(b,buf);
-                }
-
-#if 0
-        lh_stats_bio(mh,b);
-        lh_node_stats_bio(mh,b);
-        lh_node_usage_stats_bio(mh,b);
+        if (free_debug_func != NULL)
+                free_debug_func(str, 0);
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG:         < 0x%p\n", str);
 #endif
+        free_func(str);
+        if (free_debug_func != NULL)
+                free_debug_func(NULL, 1);
         }
 
-static void (*mem_cb)()=NULL;
-
-static void cb_leak(MEM *m, char *cb)
+void *CRYPTO_remalloc(void *a, int num, const char *file, int line)
         {
-        void (*mem_callback)()=(void (*)())cb;
-        mem_callback(m->order,m->file,m->line,m->num,m->addr);
+        if (a != NULL) Free(a);
+        a=(char *)Malloc(num);
+        return(a);
         }
 
-void CRYPTO_mem_leaks_cb(void (*cb)())
+
+void CRYPTO_set_mem_debug_options(long bits)
         {
-        if (mh == NULL) return;
-        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
-        mem_cb=cb;
-        lh_doall_arg(mh,(void (*)())cb_leak,(char *)mem_cb);
-        mem_cb=NULL;
-        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
+        if (set_debug_options_func != NULL)
+                set_debug_options_func(bits);
         }
 
-#ifndef NO_FP_API
-void CRYPTO_mem_leaks_fp(FILE *fp)
+long CRYPTO_get_mem_debug_options(void)
         {
-        BIO *b;
-
-        if (mh == NULL) return;
-        if ((b=BIO_new(BIO_s_file())) == NULL)
-                return;
-        BIO_set_fp(b,fp,BIO_NOCLOSE);
-        CRYPTO_mem_leaks(b);
-        BIO_free(b);
+        if (get_debug_options_func != NULL)
+                return get_debug_options_func();
+        return 0;
         }
-#endif
-
diff --git a/src/lib/libssl/src/crypto/mem_dbg.c b/src/lib/libssl/src/crypto/mem_dbg.c
new file mode 100644
index 0000000000..14770c0733
--- /dev/null
+++ b/src/lib/libssl/src/crypto/mem_dbg.c
@@ -0,0 +1,703 @@
+/* crypto/mem_dbg.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>       
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/bio.h>
+#include <openssl/lhash.h>
+#include "cryptlib.h"
+
+static int mh_mode=CRYPTO_MEM_CHECK_OFF;
+/* The state changes to CRYPTO_MEM_CHECK_ON | CRYPTO_MEM_CHECK_ENABLE
+ * when the application asks for it (usually after library initialisation
+ * for which no book-keeping is desired).
+ *
+ * State CRYPTO_MEM_CHECK_ON exists only temporarily when the library
+ * thinks that certain allocations should not be checked (e.g. the data
+ * structures used for memory checking).  It is not suitable as an initial
+ * state: the library will unexpectedly enable memory checking when it
+ * executes one of those sections that want to disable checking
+ * temporarily.
+ *
+ * State CRYPTO_MEM_CHECK_ENABLE without ..._ON makes no sense whatsoever.
+ */
+
+static unsigned long order = 0; /* number of memory requests */
+static LHASH *mh=NULL; /* hash-table of memory requests (address as key) */
+
+
+typedef struct app_mem_info_st
+/* For application-defined information (static C-string `info')
+ * to be displayed in memory leak list.
+ * Each thread has its own stack.  For applications, there is
+ *   CRYPTO_push_info("...")     to push an entry,
+ *   CRYPTO_pop_info()           to pop an entry,
+ *   CRYPTO_remove_all_info()    to pop all entries.
+ */
+        {       
+        unsigned long thread;
+        const char *file;
+        int line;
+        const char *info;
+        struct app_mem_info_st *next; /* tail of thread's stack */
+        int references;
+        } APP_INFO;
+
+static LHASH *amih=NULL; /* hash-table with those app_mem_info_st's
+                          * that are at the top of their thread's stack
+                          * (with `thread' as key) */
+
+typedef struct mem_st
+/* memory-block description */
+        {
+        char *addr;
+        int num;
+        const char *file;
+        int line;
+        unsigned long thread;
+        unsigned long order;
+        time_t time;
+        APP_INFO *app_info;
+        } MEM;
+
+static long options =             /* extra information to be recorded */
+#if defined(CRYPTO_MDEBUG_TIME) || defined(CRYPTO_MDEBUG_ALL)
+        V_CRYPTO_MDEBUG_TIME |
+#endif
+#if defined(CRYPTO_MDEBUG_THREAD) || defined(CRYPTO_MDEBUG_ALL)
+        V_CRYPTO_MDEBUG_THREAD |
+#endif
+        0;
+
+
+static unsigned long disabling_thread = 0;
+
+int CRYPTO_mem_ctrl(int mode)
+        {
+        int ret=mh_mode;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
+        switch (mode)
+                {
+        /* for applications: */
+        case CRYPTO_MEM_CHECK_ON: /* aka MemCheck_start() */
+                mh_mode = CRYPTO_MEM_CHECK_ON|CRYPTO_MEM_CHECK_ENABLE;
+                disabling_thread = 0;
+                break;
+        case CRYPTO_MEM_CHECK_OFF: /* aka MemCheck_stop() */
+                mh_mode = 0;
+                disabling_thread = 0;
+                break;
+
+        /* switch off temporarily (for library-internal use): */
+        case CRYPTO_MEM_CHECK_DISABLE: /* aka MemCheck_off() */
+                if (mh_mode & CRYPTO_MEM_CHECK_ON)
+                        {
+                        mh_mode&= ~CRYPTO_MEM_CHECK_ENABLE;
+                        if (disabling_thread != CRYPTO_thread_id()) /* otherwise we already have the MALLOC2 lock */
+                                {
+                                /* Long-time lock CRYPTO_LOCK_MALLOC2 must not be claimed while
+                                 * we're holding CRYPTO_LOCK_MALLOC, or we'll deadlock if
+                                 * somebody else holds CRYPTO_LOCK_MALLOC2 (and cannot release
+                                 * it because we block entry to this function).
+                                 * Give them a chance, first, and then claim the locks in
+                                 * appropriate order (long-time lock first).
+                                 */
+                                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
+                                /* Note that after we have waited for CRYPTO_LOCK_MALLOC2
+                                 * and CRYPTO_LOCK_MALLOC, we'll still be in the right
+                                 * "case" and "if" branch because MemCheck_start and
+                                 * MemCheck_stop may never be used while there are multiple
+                                 * OpenSSL threads. */
+                                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC2);
+                                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
+                                disabling_thread=CRYPTO_thread_id();
+                                }
+                        }
+                break;
+        case CRYPTO_MEM_CHECK_ENABLE: /* aka MemCheck_on() */
+                if (mh_mode & CRYPTO_MEM_CHECK_ON)
+                        {
+                        mh_mode|=CRYPTO_MEM_CHECK_ENABLE;
+                        if (disabling_thread != 0)
+                                {
+                                disabling_thread=0;
+                                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC2);
+                                }
+                        }
+                break;
+
+        default:
+                break;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
+        return(ret);
+        }
+
+int CRYPTO_is_mem_check_on(void)
+        {
+        int ret = 0;
+
+        if (mh_mode & CRYPTO_MEM_CHECK_ON)
+                {
+                CRYPTO_w_lock(CRYPTO_LOCK_MALLOC);
+
+                ret = (mh_mode & CRYPTO_MEM_CHECK_ENABLE)
+                        && disabling_thread != CRYPTO_thread_id();
+
+                CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC);
+                }
+        return(ret);
+        }       
+
+
+void CRYPTO_dbg_set_options(long bits)
+        {
+        options = bits;
+        }
+
+long CRYPTO_dbg_get_options(void)
+        {
+        return options;
+        }
+
+static int mem_cmp(MEM *a, MEM *b)
+        {
+        return(a->addr - b->addr);
+        }
+
+static unsigned long mem_hash(MEM *a)
+        {
+        unsigned long ret;
+
+        ret=(unsigned long)a->addr;
+
+        ret=ret*17851+(ret>>14)*7+(ret>>4)*251;
+        return(ret);
+        }
+
+static int app_info_cmp(APP_INFO *a, APP_INFO *b)
+        {
+        return(a->thread != b->thread);
+        }
+
+static unsigned long app_info_hash(APP_INFO *a)
+        {
+        unsigned long ret;
+
+        ret=(unsigned long)a->thread;
+
+        ret=ret*17851+(ret>>14)*7+(ret>>4)*251;
+        return(ret);
+        }
+
+static APP_INFO *pop_info()
+        {
+        APP_INFO tmp;
+        APP_INFO *ret = NULL;
+
+        if (amih != NULL)
+                {
+                tmp.thread=CRYPTO_thread_id();
+                if ((ret=(APP_INFO *)lh_delete(amih,&tmp)) != NULL)
+                        {
+                        APP_INFO *next=ret->next;
+
+                        if (next != NULL)
+                                {
+                                next->references++;
+                                lh_insert(amih,(char *)next);
+                                }
+#ifdef LEVITTE_DEBUG
+                        if (ret->thread != tmp.thread)
+                                {
+                                fprintf(stderr, "pop_info(): deleted info has other thread ID (%lu) than the current thread (%lu)!!!!\n",
+                                        ret->thread, tmp.thread);
+                                abort();
+                                }
+#endif
+                        if (--(ret->references) <= 0)
+                                {
+                                ret->next = NULL;
+                                if (next != NULL)
+                                        next->references--;
+                                Free(ret);
+                                }
+                        }
+                }
+        return(ret);
+        }
+
+int CRYPTO_push_info_(const char *info, const char *file, int line)
+        {
+        APP_INFO *ami, *amim;
+        int ret=0;
+
+        if (is_MemCheck_on())
+                {
+                MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+
+                if ((ami = (APP_INFO *)Malloc(sizeof(APP_INFO))) == NULL)
+                        {
+                        ret=0;
+                        goto err;
+                        }
+                if (amih == NULL)
+                        {
+                        if ((amih=lh_new(app_info_hash,app_info_cmp)) == NULL)
+                                {
+                                Free(ami);
+                                ret=0;
+                                goto err;
+                                }
+                        }
+
+                ami->thread=CRYPTO_thread_id();
+                ami->file=file;
+                ami->line=line;
+                ami->info=info;
+                ami->references=1;
+                ami->next=NULL;
+
+                if ((amim=(APP_INFO *)lh_insert(amih,(char *)ami)) != NULL)
+                        {
+#ifdef LEVITTE_DEBUG
+                        if (ami->thread != amim->thread)
+                                {
+                                fprintf(stderr, "CRYPTO_push_info(): previous info has other thread ID (%lu) than the current thread (%lu)!!!!\n",
+                                        amim->thread, ami->thread);
+                                abort();
+                                }
+#endif
+                        ami->next=amim;
+                        }
+ err:
+                MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                }
+
+        return(ret);
+        }
+
+int CRYPTO_pop_info(void)
+        {
+        int ret=0;
+
+        if (is_MemCheck_on()) /* _must_ be true, or something went severely wrong */
+                {
+                MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+
+                ret=(pop_info() != NULL);
+
+                MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                }
+        return(ret);
+        }
+
+int CRYPTO_remove_all_info(void)
+        {
+        int ret=0;
+
+        if (is_MemCheck_on()) /* _must_ be true */
+                {
+                MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+
+                while(pop_info() != NULL)
+                        ret++;
+
+                MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                }
+        return(ret);
+        }
+
+
+static unsigned long break_order_num=0;
+void CRYPTO_dbg_malloc(void *addr, int num, const char *file, int line,
+        int before_p)
+        {
+        MEM *m,*mm;
+        APP_INFO tmp,*amim;
+
+        switch(before_p & 127)
+                {
+        case 0:
+                break;
+        case 1:
+                if (addr == NULL)
+                        break;
+
+                if (is_MemCheck_on())
+                        {
+                        MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+                        if ((m=(MEM *)Malloc(sizeof(MEM))) == NULL)
+                                {
+                                Free(addr);
+                                MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                                return;
+                                }
+                        if (mh == NULL)
+                                {
+                                if ((mh=lh_new(mem_hash,mem_cmp)) == NULL)
+                                        {
+                                        Free(addr);
+                                        Free(m);
+                                        addr=NULL;
+                                        goto err;
+                                        }
+                                }
+
+                        m->addr=addr;
+                        m->file=file;
+                        m->line=line;
+                        m->num=num;
+                        if (options & V_CRYPTO_MDEBUG_THREAD)
+                                m->thread=CRYPTO_thread_id();
+                        else
+                                m->thread=0;
+
+                        if (order == break_order_num)
+                                {
+                                /* BREAK HERE */
+                                m->order=order;
+                                }
+                        m->order=order++;
+#ifdef LEVITTE_DEBUG
+                        fprintf(stderr, "LEVITTE_DEBUG: [%5d] %c 0x%p (%d)\n",
+                                m->order,
+                                (before_p & 128) ? '*' : '+',
+                                m->addr, m->num);
+#endif
+                        if (options & V_CRYPTO_MDEBUG_TIME)
+                                m->time=time(NULL);
+                        else
+                                m->time=0;
+
+                        tmp.thread=CRYPTO_thread_id();
+                        m->app_info=NULL;
+                        if (amih != NULL
+                                && (amim=(APP_INFO *)lh_retrieve(amih,(char *)&tmp)) != NULL)
+                                {
+                                m->app_info = amim;
+                                amim->references++;
+                                }
+
+                        if ((mm=(MEM *)lh_insert(mh,(char *)m)) != NULL)
+                                {
+                                /* Not good, but don't sweat it */
+                                if (mm->app_info != NULL)
+                                        {
+                                        mm->app_info->references--;
+                                        }
+                                Free(mm);
+                                }
+                err:
+                        MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                        }
+                break;
+                }
+        return;
+        }
+
+void CRYPTO_dbg_free(void *addr, int before_p)
+        {
+        MEM m,*mp;
+
+        switch(before_p)
+                {
+        case 0:
+                if (addr == NULL)
+                        break;
+
+                if (is_MemCheck_on() && (mh != NULL))
+                        {
+                        MemCheck_off();
+
+                        m.addr=addr;
+                        mp=(MEM *)lh_delete(mh,(char *)&m);
+                        if (mp != NULL)
+                                {
+#ifdef LEVITTE_DEBUG
+                        fprintf(stderr, "LEVITTE_DEBUG: [%5d] - 0x%p (%d)\n",
+                                mp->order, mp->addr, mp->num);
+#endif
+                                if (mp->app_info != NULL)
+                                        {
+                                        mp->app_info->references--;
+                                        }
+                                Free(mp);
+                                }
+
+                        MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                        }
+                break;
+        case 1:
+                break;
+                }
+        }
+
+void CRYPTO_dbg_realloc(void *addr1, void *addr2, int num,
+        const char *file, int line, int before_p)
+        {
+        MEM m,*mp;
+
+#ifdef LEVITTE_DEBUG
+        fprintf(stderr, "LEVITTE_DEBUG: --> CRYPTO_dbg_malloc(addr1 = %p, addr2 = %p, num = %d, file = \"%s\", line = %d, before_p = %d)\n",
+                addr1, addr2, num, file, line, before_p);
+#endif
+
+        switch(before_p)
+                {
+        case 0:
+                break;
+        case 1:
+                if (addr2 == NULL)
+                        break;
+
+                if (addr1 == NULL)
+                        {
+                        CRYPTO_dbg_malloc(addr2, num, file, line, 128 | before_p);
+                        break;
+                        }
+
+                if (is_MemCheck_on())
+                        {
+                        MemCheck_off(); /* obtains CRYPTO_LOCK_MALLOC2 */
+
+                        m.addr=addr1;
+                        mp=(MEM *)lh_delete(mh,(char *)&m);
+                        if (mp != NULL)
+                                {
+#ifdef LEVITTE_DEBUG
+                                fprintf(stderr, "LEVITTE_DEBUG: [%5d] * 0x%p (%d) -> 0x%p (%d)\n",
+                                        mp->order,
+                                        mp->addr, mp->num,
+                                        addr2, num);
+#endif
+                                mp->addr=addr2;
+                                mp->num=num;
+                                lh_insert(mh,(char *)mp);
+                                }
+
+                        MemCheck_on(); /* releases CRYPTO_LOCK_MALLOC2 */
+                        }
+                break;
+                }
+        return;
+        }
+
+
+typedef struct mem_leak_st
+        {
+        BIO *bio;
+        int chunks;
+        long bytes;
+        } MEM_LEAK;
+
+static void print_leak(MEM *m, MEM_LEAK *l)
+        {
+        char buf[1024];
+        char *bufp = buf;
+        APP_INFO *amip;
+        int ami_cnt;
+        struct tm *lcl = NULL;
+        unsigned long ti;
+
+        if(m->addr == (char *)l->bio)
+            return;
+
+        if (options & V_CRYPTO_MDEBUG_TIME)
+                {
+                lcl = localtime(&m->time);
+        
+                sprintf(bufp, "[%02d:%02d:%02d] ",
+                        lcl->tm_hour,lcl->tm_min,lcl->tm_sec);
+                bufp += strlen(bufp);
+                }
+
+        sprintf(bufp, "%5lu file=%s, line=%d, ",
+                m->order,m->file,m->line);
+        bufp += strlen(bufp);
+
+        if (options & V_CRYPTO_MDEBUG_THREAD)
+                {
+                sprintf(bufp, "thread=%lu, ", m->thread);
+                bufp += strlen(bufp);
+                }
+
+        sprintf(bufp, "number=%d, address=%08lX\n",
+                m->num,(unsigned long)m->addr);
+        bufp += strlen(bufp);
+
+        BIO_puts(l->bio,buf);
+        
+        l->chunks++;
+        l->bytes+=m->num;
+
+        amip=m->app_info;
+        ami_cnt=0;
+        if (!amip)
+                return;
+        ti=amip->thread;
+        
+        do
+                {
+                int buf_len;
+                int info_len;
+
+                ami_cnt++;
+                memset(buf,'>',ami_cnt);
+                sprintf(buf + ami_cnt,
+                        " thread=%lu, file=%s, line=%d, info=\"",
+                        amip->thread, amip->file, amip->line);
+                buf_len=strlen(buf);
+                info_len=strlen(amip->info);
+                if (128 - buf_len - 3 < info_len)
+                        {
+                        memcpy(buf + buf_len, amip->info, 128 - buf_len - 3);
+                        buf_len = 128 - 3;
+                        }
+                else
+                        {
+                        strcpy(buf + buf_len, amip->info);
+                        buf_len = strlen(buf);
+                        }
+                sprintf(buf + buf_len, "\"\n");
+                
+                BIO_puts(l->bio,buf);
+
+                amip = amip->next;
+                }
+        while(amip && amip->thread == ti);
+                
+#ifdef LEVITTE_DEBUG
+        if (amip)
+                {
+                fprintf(stderr, "Thread switch detected in backtrace!!!!\n");
+                abort();
+                }
+#endif
+        }
+
+void CRYPTO_mem_leaks(BIO *b)
+        {
+        MEM_LEAK ml;
+        char buf[80];
+
+        if (mh == NULL) return;
+        ml.bio=b;
+        ml.bytes=0;
+        ml.chunks=0;
+        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC2);
+        lh_doall_arg(mh,(void (*)())print_leak,(char *)&ml);
+        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC2);
+        if (ml.chunks != 0)
+                {
+                sprintf(buf,"%ld bytes leaked in %d chunks\n",
+                        ml.bytes,ml.chunks);
+                BIO_puts(b,buf);
+                }
+
+#if 0
+        lh_stats_bio(mh,b);
+        lh_node_stats_bio(mh,b);
+        lh_node_usage_stats_bio(mh,b);
+#endif
+        }
+
+union void_fn_to_char_u
+        {
+        char *char_p;
+        void (*fn_p)();
+        };
+
+static void cb_leak(MEM *m, char *cb)
+        {
+        union void_fn_to_char_u mem_callback;
+
+        mem_callback.char_p=cb;
+        mem_callback.fn_p(m->order,m->file,m->line,m->num,m->addr);
+        }
+
+void CRYPTO_mem_leaks_cb(void (*cb)())
+        {
+        union void_fn_to_char_u mem_cb;
+
+        if (mh == NULL) return;
+        CRYPTO_w_lock(CRYPTO_LOCK_MALLOC2);
+        mem_cb.fn_p=cb;
+        lh_doall_arg(mh,(void (*)())cb_leak,mem_cb.char_p);
+        mem_cb.char_p=NULL;
+        CRYPTO_w_unlock(CRYPTO_LOCK_MALLOC2);
+        }
+
+#ifndef NO_FP_API
+void CRYPTO_mem_leaks_fp(FILE *fp)
+        {
+        BIO *b;
+
+        if (mh == NULL) return;
+        if ((b=BIO_new(BIO_s_file())) == NULL)
+                return;
+        BIO_set_fp(b,fp,BIO_NOCLOSE);
+        CRYPTO_mem_leaks(b);
+        BIO_free(b);
+        }
+#endif
+
diff --git a/src/lib/libssl/src/crypto/objects/Makefile.ssl b/src/lib/libssl/src/crypto/objects/Makefile.ssl
index 53450f8754..f05e15df96 100644
--- a/src/lib/libssl/src/crypto/objects/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/objects/Makefile.ssl
@@ -37,9 +37,6 @@ top:
 
 all:    obj_dat.h lib
 
-obj_dat.h: objects.h obj_dat.pl
-        $(PERL) ./obj_dat.pl < objects.h > obj_dat.h
-
 lib:    $(LIBOBJ)
         $(AR) $(LIB) $(LIBOBJ)
         $(RANLIB) $(LIB)
diff --git a/src/lib/libssl/src/crypto/objects/o_names.c b/src/lib/libssl/src/crypto/objects/o_names.c
index 4da5e45b9c..d654eb220e 100644
--- a/src/lib/libssl/src/crypto/objects/o_names.c
+++ b/src/lib/libssl/src/crypto/objects/o_names.c
@@ -4,15 +4,25 @@
 
 #include <openssl/lhash.h>
 #include <openssl/objects.h>
+#include <openssl/safestack.h>
 
 /* I use the ex_data stuff to manage the identifiers for the obj_name_types
  * that applications may define.  I only really use the free function field.
  */
 static LHASH *names_lh=NULL;
 static int names_type_num=OBJ_NAME_TYPE_NUM;
-static STACK *names_cmp=NULL;
-static STACK *names_hash=NULL;
-static STACK *names_free=NULL;
+
+typedef struct name_funcs_st
+        {
+        unsigned long (*hash_func)();
+        int (*cmp_func)();
+        void (*free_func)();
+        } NAME_FUNCS;
+
+DECLARE_STACK_OF(NAME_FUNCS)
+IMPLEMENT_STACK_OF(NAME_FUNCS)
+
+STACK_OF(NAME_FUNCS) *name_funcs_stack;
 
 static unsigned long obj_name_hash(OBJ_NAME *a);
 static int obj_name_cmp(OBJ_NAME *a,OBJ_NAME *b);
@@ -31,51 +41,57 @@ int OBJ_NAME_new_index(unsigned long (*hash_func)(), int (*cmp_func)(),
         {
         int ret;
         int i;
+        NAME_FUNCS *name_funcs;
 
-        if (names_free == NULL)
+        if (name_funcs_stack == NULL)
                 {
                 MemCheck_off();
-                names_hash=sk_new_null();
-                names_cmp=sk_new_null();
-                names_free=sk_new_null();
+                name_funcs_stack=sk_NAME_FUNCS_new_null();
                 MemCheck_on();
                 }
-        if ((names_free == NULL) || (names_hash == NULL) || (names_cmp == NULL))
+        if ((name_funcs_stack == NULL))
                 {
                 /* ERROR */
                 return(0);
                 }
         ret=names_type_num;
         names_type_num++;
-        for (i=sk_num(names_free); i<names_type_num; i++)
+        for (i=sk_NAME_FUNCS_num(name_funcs_stack); i<names_type_num; i++)
                 {
                 MemCheck_off();
-                sk_push(names_hash,(char *)strcmp);
-                sk_push(names_cmp,(char *)lh_strhash);
-                sk_push(names_free,NULL);
+                name_funcs = Malloc(sizeof(NAME_FUNCS));
+                name_funcs->hash_func = lh_strhash;
+                name_funcs->cmp_func = (int (*)())strcmp;
+                name_funcs->free_func = 0; /* NULL is often declared to
+                                            * ((void *)0), which according
+                                            * to Compaq C is not really
+                                            * compatible with a function
+                                            * pointer.  -- Richard Levitte*/
+                sk_NAME_FUNCS_push(name_funcs_stack,name_funcs);
                 MemCheck_on();
                 }
+        name_funcs = sk_NAME_FUNCS_value(name_funcs_stack, ret);
         if (hash_func != NULL)
-                sk_set(names_hash,ret,(char *)hash_func);
+                name_funcs->hash_func = hash_func;
         if (cmp_func != NULL)
-                sk_set(names_cmp,ret,(char *)cmp_func);
+                name_funcs->cmp_func = cmp_func;
         if (free_func != NULL)
-                sk_set(names_free,ret,(char *)free_func);
+                name_funcs->free_func = free_func;
         return(ret);
         }
 
 static int obj_name_cmp(OBJ_NAME *a, OBJ_NAME *b)
         {
         int ret;
-        int (*cmp)();
 
         ret=a->type-b->type;
         if (ret == 0)
                 {
-                if ((names_cmp != NULL) && (sk_num(names_cmp) > a->type))
+                if ((name_funcs_stack != NULL)
+                        && (sk_NAME_FUNCS_num(name_funcs_stack) > a->type))
                         {
-                        cmp=(int (*)())sk_value(names_cmp,a->type);
-                        ret=cmp(a->name,b->name);
+                        ret=sk_NAME_FUNCS_value(name_funcs_stack,a->type)
+                                ->cmp_func(a->name,b->name);
                         }
                 else
                         ret=strcmp(a->name,b->name);
@@ -86,12 +102,11 @@ static int obj_name_cmp(OBJ_NAME *a, OBJ_NAME *b)
 static unsigned long obj_name_hash(OBJ_NAME *a)
         {
         unsigned long ret;
-        unsigned long (*hash)();
 
-        if ((names_hash != NULL) && (sk_num(names_hash) > a->type))
+        if ((name_funcs_stack != NULL) && (sk_NAME_FUNCS_num(name_funcs_stack) > a->type))
                 {
-                hash=(unsigned long (*)())sk_value(names_hash,a->type);
-                ret=hash(a->name);
+                ret=sk_NAME_FUNCS_value(name_funcs_stack,a->type)
+                        ->hash_func(a->name);
                 }
         else
                 {
@@ -117,7 +132,7 @@ const char *OBJ_NAME_get(const char *name, int type)
 
         for (;;)
                 {
-                ret=(OBJ_NAME *)lh_retrieve(names_lh,(char *)&on);
+                ret=(OBJ_NAME *)lh_retrieve(names_lh,&on);
                 if (ret == NULL) return(NULL);
                 if ((ret->alias) && !alias)
                         {
@@ -133,7 +148,6 @@ const char *OBJ_NAME_get(const char *name, int type)
 
 int OBJ_NAME_add(const char *name, int type, const char *data)
         {
-        void (*f)();
         OBJ_NAME *onp,*ret;
         int alias;
 
@@ -154,16 +168,20 @@ int OBJ_NAME_add(const char *name, int type, const char *data)
         onp->type=type;
         onp->data=data;
 
-        ret=(OBJ_NAME *)lh_insert(names_lh,(char *)onp);
+        ret=(OBJ_NAME *)lh_insert(names_lh,onp);
         if (ret != NULL)
                 {
                 /* free things */
-                if ((names_free != NULL) && (sk_num(names_free) > ret->type))
+                if ((name_funcs_stack != NULL) && (sk_NAME_FUNCS_num(name_funcs_stack) > ret->type))
                         {
-                        f=(void (*)())sk_value(names_free,ret->type);
-                        f(ret->name,ret->type,ret->data);
+                        /* XXX: I'm not sure I understand why the free
+                         * function should get three arguments...
+                         * -- Richard Levitte
+                         */
+                        sk_NAME_FUNCS_value(name_funcs_stack,ret->type)
+                                ->free_func(ret->name,ret->type,ret->data);
                         }
-                Free((char *)ret);
+                Free(ret);
                 }
         else
                 {
@@ -179,23 +197,26 @@ int OBJ_NAME_add(const char *name, int type, const char *data)
 int OBJ_NAME_remove(const char *name, int type)
         {
         OBJ_NAME on,*ret;
-        void (*f)();
 
         if (names_lh == NULL) return(0);
 
         type&= ~OBJ_NAME_ALIAS;
         on.name=name;
         on.type=type;
-        ret=(OBJ_NAME *)lh_delete(names_lh,(char *)&on);
+        ret=(OBJ_NAME *)lh_delete(names_lh,&on);
         if (ret != NULL)
                 {
                 /* free things */
-                if ((names_free != NULL) && (sk_num(names_free) > type))
+                if ((name_funcs_stack != NULL) && (sk_NAME_FUNCS_num(name_funcs_stack) > ret->type))
                         {
-                        f=(void (*)())sk_value(names_free,type);
-                        f(ret->name,ret->type,ret->data);
+                        /* XXX: I'm not sure I understand why the free
+                         * function should get three arguments...
+                         * -- Richard Levitte
+                         */
+                        sk_NAME_FUNCS_value(name_funcs_stack,ret->type)
+                                ->free_func(ret->name,ret->type,ret->data);
                         }
-                Free((char *)ret);
+                Free(ret);
                 return(1);
                 }
         else
@@ -215,6 +236,11 @@ static void names_lh_free(OBJ_NAME *onp, int type)
                 }
         }
 
+static void name_funcs_free(NAME_FUNCS *ptr)
+        {
+        Free(ptr);
+        }
+
 void OBJ_NAME_cleanup(int type)
         {
         unsigned long down_load;
@@ -229,13 +255,9 @@ void OBJ_NAME_cleanup(int type)
         if (type < 0)
                 {
                 lh_free(names_lh);
-                sk_free(names_hash);
-                sk_free(names_cmp);
-                sk_free(names_free);
+                sk_NAME_FUNCS_pop_free(name_funcs_stack,name_funcs_free);
                 names_lh=NULL;
-                names_hash=NULL;
-                names_cmp=NULL;
-                names_free=NULL;
+                name_funcs_stack = NULL;
                 }
         else
                 names_lh->down_load=down_load;
diff --git a/src/lib/libssl/src/crypto/objects/obj_dat.c b/src/lib/libssl/src/crypto/objects/obj_dat.c
index d47b874399..da6df3762a 100644
--- a/src/lib/libssl/src/crypto/objects/obj_dat.c
+++ b/src/lib/libssl/src/crypto/objects/obj_dat.c
@@ -214,16 +214,12 @@ int OBJ_new_nid(int num)
 int OBJ_add_object(ASN1_OBJECT *obj)
         {
         ASN1_OBJECT *o;
-        ADDED_OBJ *ao[4],*aop;
+        ADDED_OBJ *ao[4]={NULL,NULL,NULL,NULL},*aop;
         int i;
 
         if (added == NULL)
                 if (!init_added()) return(0);
         if ((o=OBJ_dup(obj)) == NULL) goto err;
-        ao[ADDED_DATA]=NULL;
-        ao[ADDED_SNAME]=NULL;
-        ao[ADDED_LNAME]=NULL;
-        ao[ADDED_NID]=NULL;
         ao[ADDED_NID]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));
         if ((o->length != 0) && (obj->data != NULL))
                 ao[ADDED_DATA]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));
@@ -238,7 +234,7 @@ int OBJ_add_object(ASN1_OBJECT *obj)
                         {
                         ao[i]->type=i;
                         ao[i]->obj=o;
-                        aop=(ADDED_OBJ *)lh_insert(added,(char *)ao[i]);
+                        aop=(ADDED_OBJ *)lh_insert(added,ao[i]);
                         /* memory leak, buit should not normally matter */
                         if (aop != NULL)
                                 Free(aop);
@@ -276,7 +272,7 @@ ASN1_OBJECT *OBJ_nid2obj(int n)
                 ad.type=ADDED_NID;
                 ad.obj= &ob;
                 ob.nid=n;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL)
                         return(adp->obj);
                 else
@@ -308,7 +304,7 @@ const char *OBJ_nid2sn(int n)
                 ad.type=ADDED_NID;
                 ad.obj= &ob;
                 ob.nid=n;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL)
                         return(adp->obj->sn);
                 else
@@ -340,7 +336,7 @@ const char *OBJ_nid2ln(int n)
                 ad.type=ADDED_NID;
                 ad.obj= &ob;
                 ob.nid=n;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL)
                         return(adp->obj->ln);
                 else
@@ -365,7 +361,7 @@ int OBJ_obj2nid(ASN1_OBJECT *a)
                 {
                 ad.type=ADDED_DATA;
                 ad.obj=a;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL) return (adp->obj->nid);
                 }
         op=(ASN1_OBJECT **)OBJ_bsearch((char *)&a,(char *)obj_objs,NUM_OBJ,
@@ -504,7 +500,7 @@ int OBJ_ln2nid(const char *s)
                 {
                 ad.type=ADDED_LNAME;
                 ad.obj= &o;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL) return (adp->obj->nid);
                 }
         op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)ln_objs,NUM_LN,
@@ -523,7 +519,7 @@ int OBJ_sn2nid(const char *s)
                 {
                 ad.type=ADDED_SNAME;
                 ad.obj= &o;
-                adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+                adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL) return (adp->obj->nid);
                 }
         op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)sn_objs,NUM_SN,
@@ -647,7 +643,7 @@ int OBJ_create(char *oid, char *sn, char *ln)
         ok=OBJ_add_object(op);
 err:
         ASN1_OBJECT_free(op);
-        Free((char *)buf);
+        Free(buf);
         return(ok);
         }
 
diff --git a/src/lib/libssl/src/crypto/objects/obj_dat.pl b/src/lib/libssl/src/crypto/objects/obj_dat.pl
index 5043daef2a..e6e3c3b9c0 100644
--- a/src/lib/libssl/src/crypto/objects/obj_dat.pl
+++ b/src/lib/libssl/src/crypto/objects/obj_dat.pl
@@ -38,7 +38,10 @@ sub expand_obj
         return(%objn);
         }
 
-while (<>)
+open (IN,"$ARGV[0]") || die "Can't open input file $ARGV[0]";
+open (OUT,">$ARGV[1]") || die "Can't open output file $ARGV[1]";
+
+while (<IN>)
         {
         next unless /^\#define\s+(\S+)\s+(.*)$/;
         $v=$1;
@@ -55,6 +58,7 @@ while (<>)
                 $objd{$v}=$d;
                 }
         }
+close IN;
 
 %ob=&expand_obj(*objd);
 
@@ -132,7 +136,7 @@ foreach (sort obj_cmp @a)
         push(@ob,sprintf("&(nid_objs[%2d]),/* %-32s %s */\n",$_,$m,$v));
         }
 
-print <<'EOF';
+print OUT <<'EOF';
 /* lib/obj/obj_dat.h */
 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
@@ -193,21 +197,21 @@ print <<'EOF';
 
 /* THIS FILE IS GENERATED FROM Objects.h by obj_dat.pl via the
  * following command:
- * perl obj_dat.pl < objects.h > obj_dat.h
+ * perl obj_dat.pl objects.h obj_dat.h
  */
 
 EOF
 
-printf "#define NUM_NID %d\n",$n;
-printf "#define NUM_SN %d\n",$#sn+1;
-printf "#define NUM_LN %d\n",$#ln+1;
-printf "#define NUM_OBJ %d\n\n",$#ob+1;
+printf OUT "#define NUM_NID %d\n",$n;
+printf OUT "#define NUM_SN %d\n",$#sn+1;
+printf OUT "#define NUM_LN %d\n",$#ln+1;
+printf OUT "#define NUM_OBJ %d\n\n",$#ob+1;
 
-printf "static unsigned char lvalues[%d]={\n",$lvalues+1;
-print @lvalues;
-print "};\n\n";
+printf OUT "static unsigned char lvalues[%d]={\n",$lvalues+1;
+print OUT @lvalues;
+print OUT "};\n\n";
 
-printf "static ASN1_OBJECT nid_objs[NUM_NID]={\n";
+printf OUT "static ASN1_OBJECT nid_objs[NUM_NID]={\n";
 foreach (@out)
         {
         if (length($_) > 75)
@@ -218,30 +222,32 @@ foreach (@out)
                         $t=$out.$_.",";
                         if (length($t) > 70)
                                 {
-                                print "$out\n";
+                                print OUT "$out\n";
                                 $t="\t$_,";
                                 }
                         $out=$t;
                         }
                 chop $out;
-                print "$out";
+                print OUT "$out";
                 }
         else
-                { print $_; }
+                { print OUT $_; }
         }
-print  "};\n\n";
+print  OUT "};\n\n";
+
+printf OUT "static ASN1_OBJECT *sn_objs[NUM_SN]={\n";
+print  OUT @sn;
+print  OUT "};\n\n";
 
-printf "static ASN1_OBJECT *sn_objs[NUM_SN]={\n";
-print  @sn;
-print  "};\n\n";
+printf OUT "static ASN1_OBJECT *ln_objs[NUM_LN]={\n";
+print  OUT @ln;
+print  OUT "};\n\n";
 
-printf "static ASN1_OBJECT *ln_objs[NUM_LN]={\n";
-print  @ln;
-print  "};\n\n";
+printf OUT "static ASN1_OBJECT *obj_objs[NUM_OBJ]={\n";
+print  OUT @ob;
+print  OUT "};\n\n";
 
-printf "static ASN1_OBJECT *obj_objs[NUM_OBJ]={\n";
-print  @ob;
-print  "};\n\n";
+close OUT;
 
 sub der_it
         {
diff --git a/src/lib/libssl/src/crypto/objects/objects.h b/src/lib/libssl/src/crypto/objects/objects.h
index d03748e022..d1a5ad2502 100644
--- a/src/lib/libssl/src/crypto/objects/objects.h
+++ b/src/lib/libssl/src/crypto/objects/objects.h
@@ -110,10 +110,12 @@ extern "C" {
 #define NID_md5WithRSAEncryption        8
 #define OBJ_md5WithRSAEncryption        OBJ_pkcs,1L,4L
 
+#define SN_pbeWithMD2AndDES_CBC         "PBE-MD2-DES"
 #define LN_pbeWithMD2AndDES_CBC         "pbeWithMD2AndDES-CBC"
 #define NID_pbeWithMD2AndDES_CBC        9
 #define OBJ_pbeWithMD2AndDES_CBC        OBJ_pkcs,5L,1L
 
+#define SN_pbeWithMD5AndDES_CBC         "PBE-MD5-DES"
 #define LN_pbeWithMD5AndDES_CBC         "pbeWithMD5AndDES-CBC"
 #define NID_pbeWithMD5AndDES_CBC        10
 #define OBJ_pbeWithMD5AndDES_CBC        OBJ_pkcs,5L,3L
@@ -230,6 +232,7 @@ extern "C" {
 #define SN_idea_cbc                     "IDEA-CBC"
 #define LN_idea_cbc                     "idea-cbc"
 #define NID_idea_cbc                    34
+#define OBJ_idea_cbc                    1L,3L,6L,1L,4L,1L,188L,7L,1L,1L,2L
 
 #define SN_idea_cfb64                   "IDEA-CFB"
 #define LN_idea_cfb64                   "idea-cfb"
@@ -380,6 +383,7 @@ extern "C" {
 #define OBJ_dsa_2                       OBJ_algorithm,12L
 
 /* proposed by microsoft to RSA */
+#define SN_pbeWithSHA1AndRC2_CBC        "PBE-SHA1-RC2-64"
 #define LN_pbeWithSHA1AndRC2_CBC        "pbeWithSHA1AndRC2-CBC"
 #define NID_pbeWithSHA1AndRC2_CBC       68
 #define OBJ_pbeWithSHA1AndRC2_CBC       OBJ_pkcs,5L,11L 
@@ -499,6 +503,7 @@ extern "C" {
 #define SN_bf_cbc                       "BF-CBC"
 #define LN_bf_cbc                       "bf-cbc"
 #define NID_bf_cbc                      91
+#define OBJ_bf_cbc                      1L,3L,6L,1L,4L,1L,3029L,1L,2L
 
 #define SN_bf_ecb                       "BF-ECB"
 #define LN_bf_ecb                       "bf-ecb"
@@ -627,7 +632,7 @@ extern "C" {
 #define OBJ_ripemd160                   1L,3L,36L,3L,2L,1L
 
 /* The name should actually be rsaSignatureWithripemd160, but I'm going
- * to contiune using the convention I'm using with the other ciphers */
+ * to continue using the convention I'm using with the other ciphers */
 #define SN_ripemd160WithRSA             "RSA-RIPEMD160"
 #define LN_ripemd160WithRSA             "ripemd160WithRSA"
 #define NID_ripemd160WithRSA            119
@@ -661,12 +666,12 @@ extern "C" {
 #define SN_rle_compression              "RLE"
 #define LN_rle_compression              "run length compression"
 #define NID_rle_compression             124
-#define OBJ_rle_compression             1L,1L,1L,1L,666L.1L
+#define OBJ_rle_compression             1L,1L,1L,1L,666L,1L
 
 #define SN_zlib_compression             "ZLIB"
 #define LN_zlib_compression             "zlib compression"
 #define NID_zlib_compression            125
-#define OBJ_zlib_compression            1L,1L,1L,1L,666L.2L
+#define OBJ_zlib_compression            1L,1L,1L,1L,666L,2L
 
 #define SN_ext_key_usage                "extendedKeyUsage"
 #define LN_ext_key_usage                "X509v3 Extended Key Usage"
@@ -735,7 +740,7 @@ extern "C" {
 #define NID_ms_efs                      138
 #define OBJ_ms_efs                      1L,3L,6L,1L,4L,1L,311L,10L,3L,4L
 
-/* Addidional usage: Netscape */
+/* Additional usage: Netscape */
 
 #define SN_ns_sgc                       "nsSGC"
 #define LN_ns_sgc                       "Netscape Server Gated Crypto"
@@ -767,26 +772,32 @@ extern "C" {
 #define OBJ_pkcs12                      OBJ_pkcs,12L
 #define OBJ_pkcs12_pbeids               OBJ_pkcs12, 1
 
+#define SN_pbe_WithSHA1And128BitRC4     "PBE-SHA1-RC4-128"
 #define LN_pbe_WithSHA1And128BitRC4     "pbeWithSHA1And128BitRC4"
 #define NID_pbe_WithSHA1And128BitRC4    144
 #define OBJ_pbe_WithSHA1And128BitRC4    OBJ_pkcs12_pbeids, 1L
 
+#define SN_pbe_WithSHA1And40BitRC4      "PBE-SHA1-RC4-40"
 #define LN_pbe_WithSHA1And40BitRC4      "pbeWithSHA1And40BitRC4"
 #define NID_pbe_WithSHA1And40BitRC4     145
 #define OBJ_pbe_WithSHA1And40BitRC4     OBJ_pkcs12_pbeids, 2L
 
+#define SN_pbe_WithSHA1And3_Key_TripleDES_CBC   "PBE-SHA1-3DES"
 #define LN_pbe_WithSHA1And3_Key_TripleDES_CBC   "pbeWithSHA1And3-KeyTripleDES-CBC"
 #define NID_pbe_WithSHA1And3_Key_TripleDES_CBC  146
 #define OBJ_pbe_WithSHA1And3_Key_TripleDES_CBC  OBJ_pkcs12_pbeids, 3L
 
+#define SN_pbe_WithSHA1And2_Key_TripleDES_CBC   "PBE-SHA1-2DES"
 #define LN_pbe_WithSHA1And2_Key_TripleDES_CBC   "pbeWithSHA1And2-KeyTripleDES-CBC"
 #define NID_pbe_WithSHA1And2_Key_TripleDES_CBC  147
 #define OBJ_pbe_WithSHA1And2_Key_TripleDES_CBC  OBJ_pkcs12_pbeids, 4L
 
+#define SN_pbe_WithSHA1And128BitRC2_CBC         "PBE-SHA1-RC2-128"
 #define LN_pbe_WithSHA1And128BitRC2_CBC         "pbeWithSHA1And128BitRC2-CBC"
 #define NID_pbe_WithSHA1And128BitRC2_CBC        148
 #define OBJ_pbe_WithSHA1And128BitRC2_CBC        OBJ_pkcs12_pbeids, 5L
 
+#define SN_pbe_WithSHA1And40BitRC2_CBC  "PBE-SHA1-RC2-40"
 #define LN_pbe_WithSHA1And40BitRC2_CBC  "pbeWithSHA1And40BitRC2-CBC"
 #define NID_pbe_WithSHA1And40BitRC2_CBC 149
 #define OBJ_pbe_WithSHA1And40BitRC2_CBC OBJ_pkcs12_pbeids, 6L
@@ -876,20 +887,73 @@ extern "C" {
 #define SN_SMIMECapabilities            "SMIME-CAPS"
 #define LN_SMIMECapabilities            "S/MIME Capabilities"
 #define NID_SMIMECapabilities           167
-#define OBJ_SMIMECapabilities           OBJ_id_pkcs9,15L
+#define OBJ_SMIMECapabilities           OBJ_pkcs9,15L
 
+#define SN_pbeWithMD2AndRC2_CBC         "PBE-MD2-RC2-64"
 #define LN_pbeWithMD2AndRC2_CBC         "pbeWithMD2AndRC2-CBC"
 #define NID_pbeWithMD2AndRC2_CBC        168
 #define OBJ_pbeWithMD2AndRC2_CBC        OBJ_pkcs,5L,4L
 
+#define SN_pbeWithMD5AndRC2_CBC         "PBE-MD5-RC2-64"
 #define LN_pbeWithMD5AndRC2_CBC         "pbeWithMD5AndRC2-CBC"
 #define NID_pbeWithMD5AndRC2_CBC        169
 #define OBJ_pbeWithMD5AndRC2_CBC        OBJ_pkcs,5L,6L
 
+#define SN_pbeWithSHA1AndDES_CBC        "PBE-SHA1-DES"
 #define LN_pbeWithSHA1AndDES_CBC        "pbeWithSHA1AndDES-CBC"
 #define NID_pbeWithSHA1AndDES_CBC       170
 #define OBJ_pbeWithSHA1AndDES_CBC       OBJ_pkcs,5L,10L
 
+/* Extension request OIDs */
+
+#define LN_ms_ext_req                   "Microsoft Extension Request"
+#define SN_ms_ext_req                   "msExtReq"
+#define NID_ms_ext_req                  171
+#define OBJ_ms_ext_req                  1L,3L,6L,1L,4L,1L,311L,2L,1L,14L
+
+#define LN_ext_req                      "Extension Request"
+#define SN_ext_req                      "extReq"
+#define NID_ext_req                     172
+#define OBJ_ext_req                     OBJ_pkcs9,14L
+
+#define SN_name                         "name"
+#define LN_name                         "name"
+#define NID_name                        173
+#define OBJ_name                        OBJ_X509,41L
+
+#define SN_dnQualifier                  "dnQualifier"
+#define LN_dnQualifier                  "dnQualifier"
+#define NID_dnQualifier                 174
+#define OBJ_dnQualifier                 OBJ_X509,46L
+
+#define SN_id_pe                        "id-pe"
+#define NID_id_pe                       175
+#define OBJ_id_pe                       OBJ_id_pkix,1L
+
+#define SN_id_ad                        "id-ad"
+#define NID_id_ad                       176
+#define OBJ_id_ad                       OBJ_id_pkix,48L
+
+#define SN_info_access                  "authorityInfoAccess"
+#define LN_info_access                  "Authority Information Access"
+#define NID_info_access                 177
+#define OBJ_info_access                 OBJ_id_pe,1L
+
+#define SN_ad_OCSP                      "OCSP"
+#define LN_ad_OCSP                      "OCSP"
+#define NID_ad_OCSP                     178
+#define OBJ_ad_OCSP                     OBJ_id_ad,1L
+
+#define SN_ad_ca_issuers                "caIssuers"
+#define LN_ad_ca_issuers                "CA Issuers"
+#define NID_ad_ca_issuers               179
+#define OBJ_ad_ca_issuers               OBJ_id_ad,2L
+
+#define SN_OSCP_sign                    "OCSPSigning"
+#define LN_OCSP_sign                    "OCSP Signing"
+#define NID_OCSP_sign                   180
+#define OBJ_OCSP_sign                   OBJ_id_kp,9L
+
 #include <openssl/bio.h>
 #include <openssl/asn1.h>
 
diff --git a/src/lib/libssl/src/crypto/opensslconf.h.in b/src/lib/libssl/src/crypto/opensslconf.h.in
index e4a8f8ad54..1b85ae5989 100644
--- a/src/lib/libssl/src/crypto/opensslconf.h.in
+++ b/src/lib/libssl/src/crypto/opensslconf.h.in
@@ -1,5 +1,4 @@
-/* crypto/opensslconf.h */
-/* WARNING: This file is autogenerated by Configure */
+/* crypto/opensslconf.h.in */
 
 /* Generate 80386 code? */
 #undef I386_ONLY
@@ -25,11 +24,25 @@
 #define RC2_INT unsigned int
 #endif
 
-#if defined(HEADER_RC4_H) && !defined(RC4_INT)
+#if defined(HEADER_RC4_H)
+#if !defined(RC4_INT)
 /* using int types make the structure larger but make the code faster
  * on most boxes I have tested - up to %20 faster. */
+/*
+ * I don't know what does "most" mean, but declaring "int" is a must on:
+ * - Intel P6 because partial register stalls are very expensive;
+ * - elder Alpha because it lacks byte load/store instructions;
+ */
 #define RC4_INT unsigned int
 #endif
+#if !defined(RC4_CHUNK)
+/*
+ * This enables code handling data aligned at natural CPU word
+ * boundary. See crypto/rc4/rc4_enc.c for further details.
+ */
+#undef RC4_CHUNK
+#endif
+#endif
 
 #if defined(HEADER_DES_H) && !defined(DES_LONG)
 /* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
diff --git a/src/lib/libssl/src/crypto/opensslv.h b/src/lib/libssl/src/crypto/opensslv.h
index b841347f05..55d5d06cf5 100644
--- a/src/lib/libssl/src/crypto/opensslv.h
+++ b/src/lib/libssl/src/crypto/opensslv.h
@@ -7,15 +7,15 @@
  * 0.9.3-dev      0x00903000
  * 0.9.3beta1     0x00903001
  * 0.9.3beta2-dev 0x00903002
- * 0.9.3beta2     0x00903002
+ * 0.9.3beta2     0x00903002 (same as ...beta2-dev)
  * 0.9.3          0x00903100
  * 0.9.3a         0x00903101
  * 0.9.4          0x00904100
  * 1.2.3z         0x1020311a
  * (Prior to 0.9.3-dev a different scheme was used: 0.9.2b is 0x0922.)
  */
-#define OPENSSL_VERSION_NUMBER  0x00904100L
-#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.4 09 Aug 1999"
+#define OPENSSL_VERSION_NUMBER  0x00905100L
+#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.5 28 Feb 2000"
 #define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
 #endif /* HEADER_OPENSSLV_H */
diff --git a/src/lib/libssl/src/crypto/pem/pem.h b/src/lib/libssl/src/crypto/pem/pem.h
index fc333e42c8..e4bae0b4aa 100644
--- a/src/lib/libssl/src/crypto/pem/pem.h
+++ b/src/lib/libssl/src/crypto/pem/pem.h
@@ -103,13 +103,16 @@ extern "C" {
 
 #define PEM_STRING_X509_OLD     "X509 CERTIFICATE"
 #define PEM_STRING_X509         "CERTIFICATE"
+#define PEM_STRING_X509_TRUSTED "TRUSTED CERTIFICATE"
 #define PEM_STRING_X509_REQ_OLD "NEW CERTIFICATE REQUEST"
 #define PEM_STRING_X509_REQ     "CERTIFICATE REQUEST"
 #define PEM_STRING_X509_CRL     "X509 CRL"
 #define PEM_STRING_EVP_PKEY     "ANY PRIVATE KEY"
+#define PEM_STRING_PUBLIC       "PUBLIC KEY"
 #define PEM_STRING_RSA          "RSA PRIVATE KEY"
 #define PEM_STRING_RSA_PUBLIC   "RSA PUBLIC KEY"
 #define PEM_STRING_DSA          "DSA PRIVATE KEY"
+#define PEM_STRING_DSA_PUBLIC   "DSA PUBLIC KEY"
 #define PEM_STRING_PKCS7        "PKCS7"
 #define PEM_STRING_PKCS8        "ENCRYPTED PRIVATE KEY"
 #define PEM_STRING_PKCS8INF     "PRIVATE KEY"
@@ -528,7 +531,10 @@ void	PEM_dek_info(char *buf, const char *type, int len, char *str);
 
 DECLARE_PEM_rw(X509, X509)
 
+DECLARE_PEM_rw(X509_AUX, X509)
+
 DECLARE_PEM_rw(X509_REQ, X509_REQ)
+DECLARE_PEM_write(X509_REQ_NEW, X509_REQ)
 
 DECLARE_PEM_rw(X509_CRL, X509_CRL)
 
@@ -545,6 +551,7 @@ DECLARE_PEM_rw(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO)
 DECLARE_PEM_rw_cb(RSAPrivateKey, RSA)
 
 DECLARE_PEM_rw(RSAPublicKey, RSA)
+DECLARE_PEM_rw(RSA_PUBKEY, RSA)
 
 #endif
 
@@ -552,6 +559,8 @@ DECLARE_PEM_rw(RSAPublicKey, RSA)
 
 DECLARE_PEM_rw_cb(DSAPrivateKey, DSA)
 
+DECLARE_PEM_rw(DSA_PUBKEY, DSA)
+
 DECLARE_PEM_rw(DSAparams, DSA)
 
 #endif
@@ -564,10 +573,36 @@ DECLARE_PEM_rw(DHparams, DH)
 
 DECLARE_PEM_rw_cb(PrivateKey, EVP_PKEY)
 
+DECLARE_PEM_rw(PUBKEY, EVP_PKEY)
+
+int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
 int PEM_write_bio_PKCS8PrivateKey(BIO *, EVP_PKEY *, const EVP_CIPHER *,
                                   char *, int, pem_password_cb *, void *);
+int i2d_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, void *u);
+
+int i2d_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+int PEM_write_PKCS8PrivateKey_nid(FILE *fp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u);
+
+EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void *u);
+
 int PEM_write_PKCS8PrivateKey(FILE *fp,EVP_PKEY *x,const EVP_CIPHER *enc,
                               char *kstr,int klen, pem_password_cb *cd, void *u);
+
 #endif /* SSLEAY_MACROS */
 
 
@@ -579,6 +614,8 @@ int PEM_write_PKCS8PrivateKey(FILE *fp,EVP_PKEY *x,const EVP_CIPHER *enc,
 /* Error codes for the PEM functions. */
 
 /* Function codes. */
+#define PEM_F_D2I_PKCS8PRIVATEKEY_BIO                    120
+#define PEM_F_D2I_PKCS8PRIVATEKEY_FP                     121
 #define PEM_F_DEF_CALLBACK                               100
 #define PEM_F_LOAD_IV                                    101
 #define PEM_F_PEM_ASN1_READ                              102
@@ -586,6 +623,7 @@ int PEM_write_PKCS8PrivateKey(FILE *fp,EVP_PKEY *x,const EVP_CIPHER *enc,
 #define PEM_F_PEM_ASN1_WRITE                             104
 #define PEM_F_PEM_ASN1_WRITE_BIO                         105
 #define PEM_F_PEM_DO_HEADER                              106
+#define PEM_F_PEM_F_DO_PK8KEY_FP                         122
 #define PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY            118
 #define PEM_F_PEM_GET_EVP_CIPHER_INFO                    107
 #define PEM_F_PEM_READ                                   108
diff --git a/src/lib/libssl/src/crypto/pem/pem_all.c b/src/lib/libssl/src/crypto/pem/pem_all.c
index bc473f3cff..dc9c35b4b4 100644
--- a/src/lib/libssl/src/crypto/pem/pem_all.c
+++ b/src/lib/libssl/src/crypto/pem/pem_all.c
@@ -65,10 +65,21 @@
 #include <openssl/pkcs7.h>
 #include <openssl/pem.h>
 
+#ifndef NO_RSA
+static RSA *pkey_get_rsa(EVP_PKEY *key, RSA **rsa);
+#endif
+#ifndef NO_DSA
+static DSA *pkey_get_dsa(EVP_PKEY *key, DSA **dsa);
+#endif
+
 IMPLEMENT_PEM_rw(X509, X509, PEM_STRING_X509, X509)
 
+IMPLEMENT_PEM_rw(X509_AUX, X509, PEM_STRING_X509_TRUSTED, X509_AUX)
+
 IMPLEMENT_PEM_rw(X509_REQ, X509_REQ, PEM_STRING_X509_REQ, X509_REQ)
 
+IMPLEMENT_PEM_write(X509_REQ_NEW, X509_REQ, PEM_STRING_X509_REQ_OLD, X509_REQ)
+
 IMPLEMENT_PEM_rw(X509_CRL, X509_CRL, PEM_STRING_X509_CRL, X509_CRL)
 
 IMPLEMENT_PEM_rw(PKCS7, PKCS7, PEM_STRING_PKCS7, PKCS7)
@@ -82,15 +93,92 @@ IMPLEMENT_PEM_rw(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO, PEM_STRING_PKCS8INF,
 
 #ifndef NO_RSA
 
-IMPLEMENT_PEM_rw_cb(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
+/* We treat RSA or DSA private keys as a special case.
+ *
+ * For private keys we read in an EVP_PKEY structure with
+ * PEM_read_bio_PrivateKey() and extract the relevant private
+ * key: this means can handle "traditional" and PKCS#8 formats
+ * transparently.
+ */
+
+static RSA *pkey_get_rsa(EVP_PKEY *key, RSA **rsa)
+{
+        RSA *rtmp;
+        if(!key) return NULL;
+        rtmp = EVP_PKEY_get1_RSA(key);
+        EVP_PKEY_free(key);
+        if(!rtmp) return NULL;
+        if(rsa) {
+                RSA_free(*rsa);
+                *rsa = rtmp;
+        }
+        return rtmp;
+}
+
+RSA *PEM_read_bio_RSAPrivateKey(BIO *bp, RSA **rsa, pem_password_cb *cb,
+                                                                void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_bio_PrivateKey(bp, NULL, cb, u);
+        return pkey_get_rsa(pktmp, rsa);
+}
+
+#ifndef NO_FP_API
+
+RSA *PEM_read_RSAPrivateKey(FILE *fp, RSA **rsa, pem_password_cb *cb,
+                                                                void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
+        return pkey_get_rsa(pktmp, rsa);
+}
+
+#endif
 
+IMPLEMENT_PEM_write_cb(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
 IMPLEMENT_PEM_rw(RSAPublicKey, RSA, PEM_STRING_RSA_PUBLIC, RSAPublicKey)
+IMPLEMENT_PEM_rw(RSA_PUBKEY, RSA, PEM_STRING_PUBLIC, RSA_PUBKEY)
 
 #endif
 
 #ifndef NO_DSA
 
-IMPLEMENT_PEM_rw_cb(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
+static DSA *pkey_get_dsa(EVP_PKEY *key, DSA **dsa)
+{
+        DSA *dtmp;
+        if(!key) return NULL;
+        dtmp = EVP_PKEY_get1_DSA(key);
+        EVP_PKEY_free(key);
+        if(!dtmp) return NULL;
+        if(dsa) {
+                DSA_free(*dsa);
+                *dsa = dtmp;
+        }
+        return dtmp;
+}
+
+DSA *PEM_read_bio_DSAPrivateKey(BIO *bp, DSA **dsa, pem_password_cb *cb,
+                                                                void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_bio_PrivateKey(bp, NULL, cb, u);
+        return pkey_get_dsa(pktmp, dsa);
+}
+
+IMPLEMENT_PEM_write_cb(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
+IMPLEMENT_PEM_rw(DSA_PUBKEY, DSA, PEM_STRING_PUBLIC, DSA_PUBKEY)
+
+#ifndef NO_FP_API
+
+DSA *PEM_read_DSAPrivateKey(FILE *fp, DSA **dsa, pem_password_cb *cb,
+                                                                void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
+        return pkey_get_dsa(pktmp, dsa);
+}
+
+#endif
 
 IMPLEMENT_PEM_rw(DSAparams, DSA, PEM_STRING_DSAPARAMS, DSAparams)
 
@@ -111,3 +199,5 @@ IMPLEMENT_PEM_rw(DHparams, DH, PEM_STRING_DHPARAMS, DHparams)
  */
 IMPLEMENT_PEM_read(PrivateKey, EVP_PKEY, PEM_STRING_EVP_PKEY, PrivateKey)
 IMPLEMENT_PEM_write_cb(PrivateKey, EVP_PKEY, ((x->type == EVP_PKEY_DSA)?PEM_STRING_DSA:PEM_STRING_RSA), PrivateKey)
+
+IMPLEMENT_PEM_rw(PUBKEY, EVP_PKEY, PEM_STRING_PUBLIC, PUBKEY)
diff --git a/src/lib/libssl/src/crypto/pem/pem_err.c b/src/lib/libssl/src/crypto/pem/pem_err.c
index fa70f60998..642129da20 100644
--- a/src/lib/libssl/src/crypto/pem/pem_err.c
+++ b/src/lib/libssl/src/crypto/pem/pem_err.c
@@ -65,6 +65,8 @@
 #ifndef NO_ERR
 static ERR_STRING_DATA PEM_str_functs[]=
         {
+{ERR_PACK(0,PEM_F_D2I_PKCS8PRIVATEKEY_BIO,0),   "d2i_PKCS8PrivateKey_bio"},
+{ERR_PACK(0,PEM_F_D2I_PKCS8PRIVATEKEY_FP,0),    "d2i_PKCS8PrivateKey_fp"},
 {ERR_PACK(0,PEM_F_DEF_CALLBACK,0),      "DEF_CALLBACK"},
 {ERR_PACK(0,PEM_F_LOAD_IV,0),   "LOAD_IV"},
 {ERR_PACK(0,PEM_F_PEM_ASN1_READ,0),     "PEM_ASN1_read"},
@@ -72,6 +74,7 @@ static ERR_STRING_DATA PEM_str_functs[]=
 {ERR_PACK(0,PEM_F_PEM_ASN1_WRITE,0),    "PEM_ASN1_write"},
 {ERR_PACK(0,PEM_F_PEM_ASN1_WRITE_BIO,0),        "PEM_ASN1_write_bio"},
 {ERR_PACK(0,PEM_F_PEM_DO_HEADER,0),     "PEM_do_header"},
+{ERR_PACK(0,PEM_F_PEM_F_DO_PK8KEY_FP,0),        "PEM_F_DO_PK8KEY_FP"},
 {ERR_PACK(0,PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY,0),   "PEM_F_PEM_WRITE_PKCS8PRIVATEKEY"},
 {ERR_PACK(0,PEM_F_PEM_GET_EVP_CIPHER_INFO,0),   "PEM_get_EVP_CIPHER_INFO"},
 {ERR_PACK(0,PEM_F_PEM_READ,0),  "PEM_read"},
diff --git a/src/lib/libssl/src/crypto/pem/pem_info.c b/src/lib/libssl/src/crypto/pem/pem_info.c
index fec18a4c2e..b65239a920 100644
--- a/src/lib/libssl/src/crypto/pem/pem_info.c
+++ b/src/lib/libssl/src/crypto/pem/pem_info.c
@@ -132,6 +132,17 @@ start:
                                 }
                         pp=(char **)&(xi->x509);
                         }
+                else if ((strcmp(name,PEM_STRING_X509_TRUSTED) == 0))
+                        {
+                        d2i=(char *(*)())d2i_X509_AUX;
+                        if (xi->x509 != NULL)
+                                {
+                                if (!sk_X509_INFO_push(ret,xi)) goto err;
+                                if ((xi=X509_INFO_new()) == NULL) goto err;
+                                goto start;
+                                }
+                        pp=(char **)&(xi->x509);
+                        }
                 else if (strcmp(name,PEM_STRING_X509_CRL) == 0)
                         {
                         d2i=(char *(*)())d2i_X509_CRL;
diff --git a/src/lib/libssl/src/crypto/pem/pem_lib.c b/src/lib/libssl/src/crypto/pem/pem_lib.c
index 90f02011ba..072211ba0f 100644
--- a/src/lib/libssl/src/crypto/pem/pem_lib.c
+++ b/src/lib/libssl/src/crypto/pem/pem_lib.c
@@ -75,8 +75,17 @@ const char *PEM_version="PEM" OPENSSL_VERSION_PTEXT;
 
 static int def_callback(char *buf, int num, int w, void *userdata);
 static int load_iv(unsigned char **fromp,unsigned char *to, int num);
-
-static int def_callback(char *buf, int num, int w, void *userdata)
+static int check_pem(const char *nm, const char *name);
+static int do_pk8pkey(BIO *bp, EVP_PKEY *x, int isder,
+                                int nid, const EVP_CIPHER *enc,
+                                char *kstr, int klen,
+                                pem_password_cb *cb, void *u);
+static int do_pk8pkey_fp(FILE *bp, EVP_PKEY *x, int isder,
+                                int nid, const EVP_CIPHER *enc,
+                                char *kstr, int klen,
+                                pem_password_cb *cb, void *u);
+
+static int def_callback(char *buf, int num, int w, void *key)
         {
 #ifdef NO_FP_API
         /* We should not ever call the default callback routine from
@@ -86,6 +95,12 @@ static int def_callback(char *buf, int num, int w, void *userdata)
 #else
         int i,j;
         const char *prompt;
+        if(key) {
+                i=strlen(key);
+                i=(i > num)?num:i;
+                memcpy(buf,key,i);
+                return(i);
+        }
 
         prompt=EVP_get_pw_prompt();
         if (prompt == NULL)
@@ -168,6 +183,47 @@ char *PEM_ASN1_read(char *(*d2i)(), const char *name, FILE *fp, char **x,
         }
 #endif
 
+static int check_pem(const char *nm, const char *name)
+{
+        /* Normal matching nm and name */
+        if (!strcmp(nm,name)) return 1;
+
+        /* Make PEM_STRING_EVP_PKEY match any private key */
+
+        if(!strcmp(nm,PEM_STRING_PKCS8) &&
+                !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_PKCS8INF) &&
+                 !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_RSA) &&
+                !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_DSA) &&
+                 !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
+
+        /* Permit older strings */
+
+        if(!strcmp(nm,PEM_STRING_X509_OLD) &&
+                !strcmp(name,PEM_STRING_X509)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_X509_REQ_OLD) &&
+                !strcmp(name,PEM_STRING_X509_REQ)) return 1;
+
+        /* Allow normal certs to be read as trusted certs */
+        if(!strcmp(nm,PEM_STRING_X509) &&
+                !strcmp(name,PEM_STRING_X509_TRUSTED)) return 1;
+
+        if(!strcmp(nm,PEM_STRING_X509_OLD) &&
+                !strcmp(name,PEM_STRING_X509_TRUSTED)) return 1;
+
+        /* Some CAs use PKCS#7 with CERTIFICATE headers */
+        if(!strcmp(nm, PEM_STRING_X509) &&
+                !strcmp(name, PEM_STRING_PKCS7)) return 1;
+
+        return 0;
+}
+
 char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
              pem_password_cb *cb, void *u)
         {
@@ -179,22 +235,13 @@ char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
 
         for (;;)
                 {
-                if (!PEM_read_bio(bp,&nm,&header,&data,&len)) return(NULL);
-                if (    (strcmp(nm,name) == 0) ||
-                        ((strcmp(nm,PEM_STRING_RSA) == 0) &&
-                         (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_DSA) == 0) &&
-                         (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_PKCS8) == 0) &&
-                         (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_PKCS8INF) == 0) &&
-                         (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_X509_OLD) == 0) &&
-                         (strcmp(name,PEM_STRING_X509) == 0)) ||
-                        ((strcmp(nm,PEM_STRING_X509_REQ_OLD) == 0) &&
-                         (strcmp(name,PEM_STRING_X509_REQ) == 0)) 
-                        )
-                        break;
+                if (!PEM_read_bio(bp,&nm,&header,&data,&len)) {
+                        if(ERR_GET_REASON(ERR_peek_error()) ==
+                                PEM_R_NO_START_LINE)
+                                ERR_add_error_data(2, "Expecting: ", name);
+                        return(NULL);
+                }
+                if(check_pem(nm, name)) break;
                 Free(nm);
                 Free(header);
                 Free(data);
@@ -218,7 +265,7 @@ char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
                         X509_SIG *p8;
                         int klen;
                         char psbuf[PEM_BUFSIZE];
-                        p8 = d2i_X509_SIG((X509_SIG **)x, &p, len);
+                        p8 = d2i_X509_SIG(NULL, &p, len);
                         if(!p8) goto p8err;
                         if (cb) klen=cb(psbuf,PEM_BUFSIZE,0,u);
                         else klen=def_callback(psbuf,PEM_BUFSIZE,0,u);
@@ -231,6 +278,10 @@ char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
                         X509_SIG_free(p8);
                         if(!p8inf) goto p8err;
                         ret = (char *)EVP_PKCS82PKEY(p8inf);
+                        if(x) {
+                                if(*x) EVP_PKEY_free((EVP_PKEY *)*x);
+                                *x = ret;
+                        }
                         PKCS8_PRIV_KEY_INFO_free(p8inf);
                 }
         } else  ret=d2i(x,&p,len);
@@ -321,8 +372,9 @@ int PEM_ASN1_write_bio(int (*i2d)(), const char *name, BIO *bp, char *x,
 #endif
                         kstr=(unsigned char *)buf;
                         }
-                RAND_seed(data,i);/* put in the RSA key. */
-                RAND_bytes(iv,8);       /* Generate a salt */
+                RAND_add(data,i,0);/* put in the RSA key. */
+                if (RAND_bytes(iv,8) <= 0)      /* Generate a salt */
+                        goto err;
                 /* The 'iv' is used as the iv and as a salt.  It is
                  * NOT taken from the BytesToKey function */
                 EVP_BytesToKey(enc,EVP_md5(),iv,kstr,klen,1,key,NULL);
@@ -743,16 +795,44 @@ err:
         return(0);
         }
 
-/* This function writes a private key in PKCS#8 format: it is a "drop in"
- * replacement for PEM_write_bio_PrivateKey(). As usual if 'enc' is NULL then
- * it uses the unencrypted private key form. It uses PKCS#5 v2.0 password based
- * encryption algorithms.
+/* These functions write a private key in PKCS#8 format: it is a "drop in"
+ * replacement for PEM_write_bio_PrivateKey() and friends. As usual if 'enc'
+ * is NULL then it uses the unencrypted private key form. The 'nid' versions
+ * uses PKCS#5 v1.5 PBE algorithms whereas the others use PKCS#5 v2.0.
  */
 
+int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey(bp, x, 0, nid, NULL, kstr, klen, cb, u);
+}
+
 int PEM_write_bio_PKCS8PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
                                   char *kstr, int klen,
                                   pem_password_cb *cb, void *u)
 {
+        return do_pk8pkey(bp, x, 0, -1, enc, kstr, klen, cb, u);
+}
+
+int i2d_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey(bp, x, 1, -1, enc, kstr, klen, cb, u);
+}
+
+int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey(bp, x, 1, nid, NULL, kstr, klen, cb, u);
+}
+
+static int do_pk8pkey(BIO *bp, EVP_PKEY *x, int isder, int nid, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
         X509_SIG *p8;
         PKCS8_PRIV_KEY_INFO *p8inf;
         char buf[PEM_BUFSIZE];
@@ -762,7 +842,7 @@ int PEM_write_bio_PKCS8PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
                                         PEM_R_ERROR_CONVERTING_PRIVATE_KEY);
                 return 0;
         }
-        if(enc) {
+        if(enc || (nid != -1)) {
                 if(!kstr) {
                         if(!cb) klen = def_callback(buf, PEM_BUFSIZE, 1, u);
                         else klen = cb(buf, PEM_BUFSIZE, 1, u);
@@ -775,29 +855,109 @@ int PEM_write_bio_PKCS8PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
                                 
                         kstr = buf;
                 }
-                p8 = PKCS8_encrypt(-1, enc, kstr, klen, NULL, 0, 0, p8inf);
+                p8 = PKCS8_encrypt(nid, enc, kstr, klen, NULL, 0, 0, p8inf);
                 if(kstr == buf) memset(buf, 0, klen);
                 PKCS8_PRIV_KEY_INFO_free(p8inf);
-                ret = PEM_write_bio_PKCS8(bp, p8);
+                if(isder) ret = i2d_PKCS8_bio(bp, p8);
+                else ret = PEM_write_bio_PKCS8(bp, p8);
                 X509_SIG_free(p8);
                 return ret;
         } else {
-                ret = PEM_write_bio_PKCS8_PRIV_KEY_INFO(bp, p8inf);
+                if(isder) ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
+                else ret = PEM_write_bio_PKCS8_PRIV_KEY_INFO(bp, p8inf);
                 PKCS8_PRIV_KEY_INFO_free(p8inf);
                 return ret;
         }
 }
 
+/* Finally the DER version to read PKCS#8 encrypted private keys. It has to be
+ * here to access the default callback.
+ */
+
+EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, void *u)
+{
+        PKCS8_PRIV_KEY_INFO *p8inf = NULL;
+        X509_SIG *p8 = NULL;
+        int klen;
+        EVP_PKEY *ret;
+        char psbuf[PEM_BUFSIZE];
+        p8 = d2i_PKCS8_bio(bp, NULL);
+        if(!p8) return NULL;
+        if (cb) klen=cb(psbuf,PEM_BUFSIZE,0,u);
+        else klen=def_callback(psbuf,PEM_BUFSIZE,0,u);
+        if (klen <= 0) {
+                PEMerr(PEM_F_D2I_PKCS8PRIVATEKEY_BIO, PEM_R_BAD_PASSWORD_READ);
+                X509_SIG_free(p8);
+                return NULL;    
+        }
+        p8inf = M_PKCS8_decrypt(p8, psbuf, klen);
+        X509_SIG_free(p8);
+        if(!p8inf) return NULL;
+        ret = EVP_PKCS82PKEY(p8inf);
+        PKCS8_PRIV_KEY_INFO_free(p8inf);
+        if(!ret) return NULL;
+        if(x) {
+                if(*x) EVP_PKEY_free(*x);
+                *x = ret;
+        }
+        return ret;
+}
+
+#ifndef NO_FP_API
+
+int i2d_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey_fp(fp, x, 1, -1, enc, kstr, klen, cb, u);
+}
+
+int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey_fp(fp, x, 1, nid, NULL, kstr, klen, cb, u);
+}
+
+int PEM_write_PKCS8PrivateKey_nid(FILE *fp, EVP_PKEY *x, int nid,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
+        return do_pk8pkey_fp(fp, x, 0, nid, NULL, kstr, klen, cb, u);
+}
+
 int PEM_write_PKCS8PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
                               char *kstr, int klen, pem_password_cb *cb, void *u)
 {
+        return do_pk8pkey_fp(fp, x, 0, -1, enc, kstr, klen, cb, u);
+}
+
+static int do_pk8pkey_fp(FILE *fp, EVP_PKEY *x, int isder, int nid, const EVP_CIPHER *enc,
+                                  char *kstr, int klen,
+                                  pem_password_cb *cb, void *u)
+{
         BIO *bp;
         int ret;
         if(!(bp = BIO_new_fp(fp, BIO_NOCLOSE))) {
-                PEMerr(PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY,ERR_R_BUF_LIB);
+                PEMerr(PEM_F_PEM_F_DO_PK8KEY_FP,ERR_R_BUF_LIB);
                 return(0);
         }
-        ret = PEM_write_bio_PKCS8PrivateKey(bp, x, enc, kstr, klen, cb, u);
+        ret = do_pk8pkey(bp, x, isder, nid, enc, kstr, klen, cb, u);
         BIO_free(bp);
         return ret;
 }
+
+EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void *u)
+{
+        BIO *bp;
+        EVP_PKEY *ret;
+        if(!(bp = BIO_new_fp(fp, BIO_NOCLOSE))) {
+                PEMerr(PEM_F_D2I_PKCS8PRIVATEKEY_FP,ERR_R_BUF_LIB);
+                return NULL;
+        }
+        ret = d2i_PKCS8PrivateKey_bio(bp, x, cb, u);
+        BIO_free(bp);
+        return ret;
+}
+
+#endif
diff --git a/src/lib/libssl/src/crypto/pem/pem_seal.c b/src/lib/libssl/src/crypto/pem/pem_seal.c
index 23f95beb1e..126e29d375 100644
--- a/src/lib/libssl/src/crypto/pem/pem_seal.c
+++ b/src/lib/libssl/src/crypto/pem/pem_seal.c
@@ -175,4 +175,10 @@ err:
         if (s != NULL) Free(s);
         return(ret);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/crypto/perlasm/x86ms.pl b/src/lib/libssl/src/crypto/perlasm/x86ms.pl
index 51dcce067f..252a57bdb5 100644
--- a/src/lib/libssl/src/crypto/perlasm/x86ms.pl
+++ b/src/lib/libssl/src/crypto/perlasm/x86ms.pl
@@ -341,7 +341,14 @@ sub main'set_label
                 $label{$_[0]}="${label}${_[0]}";
                 $label++;
                 }
-        push(@out,"$label{$_[0]}:\n");
+        if((defined $_[1]) && ($_[1] == 1))
+                {
+                push(@out,"$label{$_[0]}::\n");
+                }
+        else
+                {
+                push(@out,"$label{$_[0]}:\n");
+                }
         }
 
 sub main'data_word
diff --git a/src/lib/libssl/src/crypto/perlasm/x86unix.pl b/src/lib/libssl/src/crypto/perlasm/x86unix.pl
index 8c456b14af..60d75f5ce4 100644
--- a/src/lib/libssl/src/crypto/perlasm/x86unix.pl
+++ b/src/lib/libssl/src/crypto/perlasm/x86unix.pl
@@ -368,10 +368,10 @@ sub main'function_end_B
 
         $func=$under.$func;
 
-        push(@out,".${func}_end:\n");
+        push(@out,".L_${func}_end:\n");
         if ($main'cpp)
-                { push(@out,"\tSIZE($func,.${func}_end-$func)\n"); }
-        else    { push(@out,"\t.size\t$func,.${func}_end-$func\n"); }
+                { push(@out,"\tSIZE($func,.L_${func}_end-$func)\n"); }
+        else    { push(@out,"\t.size\t$func,.L_${func}_end-$func\n"); }
         push(@out,".ident       \"desasm.pl\"\n");
         $stack=0;
         %label=();
diff --git a/src/lib/libssl/src/crypto/pkcs12/Makefile.ssl b/src/lib/libssl/src/crypto/pkcs12/Makefile.ssl
index 7b0c65fad9..5716f608b6 100644
--- a/src/lib/libssl/src/crypto/pkcs12/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/pkcs12/Makefile.ssl
@@ -1,5 +1,5 @@
 #
-# SSLeay/crypto/asn1/Makefile
+# SSLeay/crypto/pkcs12/Makefile
 #
 
 DIR=    pkcs12
@@ -24,10 +24,10 @@ APPS=
 LIB=$(TOP)/libcrypto.a
 LIBSRC= p12_add.c p12_attr.c p12_bags.c p12_crpt.c p12_crt.c p12_decr.c \
         p12_init.c p12_key.c p12_kiss.c p12_lib.c p12_mac.c p12_mutl.c\
-        p12_sbag.c p12_utl.c pk12err.c
+        p12_sbag.c p12_utl.c p12_npas.c pk12err.c
 LIBOBJ= p12_add.o p12_attr.o p12_bags.o p12_crpt.o p12_crt.o p12_decr.o \
         p12_init.o p12_key.o p12_kiss.o p12_lib.o p12_mac.o p12_mutl.o\
-        p12_sbag.o p12_utl.o pk12err.o
+        p12_sbag.o p12_utl.o p12_npas.o pk12err.o
 
 SRC= $(LIBSRC)
 
@@ -293,6 +293,23 @@ p12_mutl.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 p12_mutl.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 p12_mutl.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 p12_mutl.o: ../cryptlib.h
+p12_npas.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+p12_npas.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+p12_npas.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+p12_npas.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+p12_npas.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
+p12_npas.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+p12_npas.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_npas.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+p12_npas.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_npas.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h
+p12_npas.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs12.h
+p12_npas.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+p12_npas.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+p12_npas.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+p12_npas.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+p12_npas.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+p12_npas.o: ../../include/openssl/x509_vfy.h
 p12_sbag.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 p12_sbag.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 p12_sbag.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_add.c b/src/lib/libssl/src/crypto/pkcs12/p12_add.c
index ae3d9de3b4..d045cbba8d 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_add.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_add.c
@@ -133,7 +133,7 @@ PKCS7 *PKCS12_pack_p7data (STACK *sk)
                 return NULL;
         }
         p7->type = OBJ_nid2obj(NID_pkcs7_data);
-        if (!(p7->d.data = ASN1_OCTET_STRING_new())) {
+        if (!(p7->d.data = M_ASN1_OCTET_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -157,20 +157,18 @@ PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, const char *pass, int passlen,
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        p7->type = OBJ_nid2obj(NID_pkcs7_encrypted);
-        if (!(p7->d.encrypted = PKCS7_ENCRYPT_new ())) {
-                PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
+        if(!PKCS7_set_type(p7, NID_pkcs7_encrypted)) {
+                PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA,
+                                PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE);
                 return NULL;
         }
-        ASN1_INTEGER_set (p7->d.encrypted->version, 0);
-        p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
         if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm);
         p7->d.encrypted->enc_data->algorithm = pbe;
-        ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
+        M_ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
         if (!(p7->d.encrypted->enc_data->enc_data =
         PKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen,
                                  (char *)bags, 1))) {
@@ -191,24 +189,28 @@ X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
 
         if (!(p8 = X509_SIG_new())) {
                 PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE);
-                return NULL;
+                goto err;
         }
 
         if(pbe_nid == -1) pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen);
         else pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen);
         if(!pbe) {
-                PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE);
-                return NULL;
+                PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_ASN1_LIB);
+                goto err;
         }
         X509_ALGOR_free(p8->algor);
         p8->algor = pbe;
-        ASN1_OCTET_STRING_free(p8->digest);
+        M_ASN1_OCTET_STRING_free(p8->digest);
         if (!(p8->digest = 
         PKCS12_i2d_encrypt (pbe, i2d_PKCS8_PRIV_KEY_INFO, pass, passlen,
                                                  (char *)p8inf, 0))) {
                 PKCS12err(PKCS12_F_PKCS8_ENCRYPT, PKCS12_R_ENCRYPT_ERROR);
-                return NULL;
+                goto err;
         }
 
         return p8;
+
+        err:
+        X509_SIG_free(p8);
+        return NULL;
 }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_attr.c b/src/lib/libssl/src/crypto/pkcs12/p12_attr.c
index 31c9782b77..f559351d18 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_attr.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_attr.c
@@ -73,11 +73,11 @@ int PKCS12_add_localkeyid (PKCS12_SAFEBAG *bag, unsigned char *name,
                 return 0;
         }
         keyid->type = V_ASN1_OCTET_STRING;
-        if (!(oct = ASN1_OCTET_STRING_new())) {
+        if (!(oct = M_ASN1_OCTET_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!ASN1_OCTET_STRING_set(oct, name, namelen)) {
+        if (!M_ASN1_OCTET_STRING_set(oct, name, namelen)) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
@@ -115,11 +115,11 @@ int PKCS8_add_keyusage (PKCS8_PRIV_KEY_INFO *p8, int usage)
                 return 0;
         }
         keyid->type = V_ASN1_BIT_STRING;
-        if (!(bstr = ASN1_BIT_STRING_new())) {
+        if (!(bstr = M_ASN1_BIT_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!ASN1_BIT_STRING_set(bstr, &us_val, 1)) {
+        if (!M_ASN1_BIT_STRING_set(bstr, &us_val, 1)) {
                 PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
@@ -176,7 +176,7 @@ int PKCS12_add_friendlyname_uni (PKCS12_SAFEBAG *bag,
                 return 0;
         }
         fname->type = V_ASN1_BMPSTRING;
-        if (!(bmp = ASN1_BMPSTRING_new())) {
+        if (!(bmp = M_ASN1_BMPSTRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI,
                                                         ERR_R_MALLOC_FAILURE);
                 return 0;
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_bags.c b/src/lib/libssl/src/crypto/pkcs12/p12_bags.c
index d6eab92c83..c358b06735 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_bags.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_bags.c
@@ -171,15 +171,15 @@ void PKCS12_BAGS_free (PKCS12_BAGS *a)
         switch (OBJ_obj2nid(a->type)) {
 
                 case NID_x509Certificate:
-                        ASN1_OCTET_STRING_free (a->value.x509cert);
+                        M_ASN1_OCTET_STRING_free (a->value.x509cert);
                 break;
 
                 case NID_x509Crl:
-                        ASN1_OCTET_STRING_free (a->value.x509crl);
+                        M_ASN1_OCTET_STRING_free (a->value.x509crl);
                 break;
 
                 case NID_sdsiCertificate:
-                        ASN1_IA5STRING_free (a->value.sdsicert);
+                        M_ASN1_IA5STRING_free (a->value.sdsicert);
                 break;
 
                 default:
@@ -188,5 +188,5 @@ void PKCS12_BAGS_free (PKCS12_BAGS *a)
         }
 
         ASN1_OBJECT_free (a->type);
-        Free ((char *)a);
+        Free (a);
 }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c b/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c
index 6de6f8128f..7b96584f07 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c
@@ -70,10 +70,12 @@ EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC4, EVP_rc4(), EVP_sha1(),
 EVP_PBE_alg_add(NID_pbe_WithSHA1And40BitRC4, EVP_rc4_40(), EVP_sha1(),
                                                          PKCS12_PBE_keyivgen);
 #endif
+#ifndef NO_DES
 EVP_PBE_alg_add(NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
                         EVP_des_ede3_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen);
 EVP_PBE_alg_add(NID_pbe_WithSHA1And2_Key_TripleDES_CBC, 
                         EVP_des_ede_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen);
+#endif
 #ifndef NO_RC2
 EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC2_CBC, EVP_rc2_cbc(),
                                         EVP_sha1(), PKCS12_PBE_keyivgen);
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_decr.c b/src/lib/libssl/src/crypto/pkcs12/p12_decr.c
index d3d288e187..4be44eac50 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_decr.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_decr.c
@@ -155,7 +155,7 @@ ASN1_OCTET_STRING *PKCS12_i2d_encrypt (X509_ALGOR *algor, int (*i2d)(),
         ASN1_OCTET_STRING *oct;
         unsigned char *in, *p;
         int inlen;
-        if (!(oct = ASN1_OCTET_STRING_new ())) {
+        if (!(oct = M_ASN1_OCTET_STRING_new ())) {
                 PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_init.c b/src/lib/libssl/src/crypto/pkcs12/p12_init.c
index dc6ab41db8..d5d4884c82 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_init.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_init.c
@@ -69,11 +69,11 @@ PKCS12 *PKCS12_init (int mode)
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        if (!(pkcs12->version = ASN1_INTEGER_new ())) {
+        if (!(pkcs12->version = M_ASN1_INTEGER_new ())) {
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        ASN1_INTEGER_set (pkcs12->version, 3);
+        ASN1_INTEGER_set(pkcs12->version, 3);
         if (!(pkcs12->authsafes = PKCS7_new())) {
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
@@ -82,7 +82,7 @@ PKCS12 *PKCS12_init (int mode)
         switch (mode) {
                 case NID_pkcs7_data:
                         if (!(pkcs12->authsafes->d.data =
-                                 ASN1_OCTET_STRING_new())) {
+                                 M_ASN1_OCTET_STRING_new())) {
                         PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                         return NULL;
                 }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_key.c b/src/lib/libssl/src/crypto/pkcs12/p12_key.c
index 25d8cdae57..02fdd20e2f 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_key.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_key.c
@@ -64,7 +64,7 @@
 /* Uncomment out this line to get debugging info about key generation */
 /*#define DEBUG_KEYGEN*/
 #ifdef DEBUG_KEYGEN
-#include <bio.h>
+#include <openssl/bio.h>
 extern BIO *bio_err;
 void h__dump (unsigned char *p, int len);
 #endif
@@ -104,13 +104,12 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
 #ifdef  DEBUG_KEYGEN
         unsigned char *tmpout = out;
         int tmpn = n;
-        BIO_printf (bio_err, "KEYGEN DEBUG\n");
-        BIO_printf (bio_err, "ID %d, ITER %d\n", id, iter);
-        BIO_printf (bio_err, "Password (length %d):\n", passlen);
-        h__dump (pass, passlen);
-        BIO_printf (bio_err, "Salt (length %d):\n", saltlen);
-        h__dump (salt, saltlen);
-        BIO_printf (bio_err, "ID %d, ITER %d\n\n", id, iter);
+        fprintf(stderr, "KEYGEN DEBUG\n");
+        fprintf(stderr, "ID %d, ITER %d\n", id, iter);
+        fprintf(stderr, "Password (length %d):\n", passlen);
+        h__dump(pass, passlen);
+        fprintf(stderr, "Salt (length %d):\n", saltlen);
+        h__dump(salt, saltlen);
 #endif
         v = EVP_MD_block_size (md_type);
         u = EVP_MD_size (md_type);
@@ -150,8 +149,8 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
                         BN_free (Ij);
                         BN_free (Bpl1);
 #ifdef DEBUG_KEYGEN
-                        BIO_printf (bio_err, "Output KEY (length %d)\n", tmpn);
-                        h__dump (tmpout, tmpn);
+                        fprintf(stderr, "Output KEY (length %d)\n", tmpn);
+                        h__dump(tmpout, tmpn);
 #endif
                         return 1;       
                 }
@@ -176,7 +175,7 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
 #ifdef DEBUG_KEYGEN
 void h__dump (unsigned char *p, int len)
 {
-        for (; len --; p++) BIO_printf (bio_err, "%02X", *p);
-        BIO_printf (bio_err, "\n");     
+        for (; len --; p++) fprintf(stderr, "%02X", *p);
+        fprintf(stderr, "\n");  
 }
 #endif
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c b/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c
index 767e1303da..08a60556e0 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c
@@ -139,16 +139,16 @@ static int parse_pk12 (PKCS12 *p12, const char *pass, int passlen,
                         sk_pop_free (asafes, PKCS7_free);
                         return 0;
                 }
-                if (!parse_bags (bags, pass, passlen, pkey, cert, ca,
+                if (!parse_bags(bags, pass, passlen, pkey, cert, ca,
                                                          &keyid, &keymatch)) {
-                        sk_pop_free (bags, PKCS12_SAFEBAG_free);
-                        sk_pop_free (asafes, PKCS7_free);
+                        sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                        sk_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
-                sk_pop_free (bags, PKCS12_SAFEBAG_free);
+                sk_pop_free(bags, PKCS12_SAFEBAG_free);
         }
-        sk_pop_free (asafes, PKCS7_free);
-        if (keyid) ASN1_OCTET_STRING_free (keyid);
+        sk_pop_free(asafes, PKCS7_free);
+        if (keyid) M_ASN1_OCTET_STRING_free(keyid);
         return 1;
 }
 
@@ -158,8 +158,8 @@ static int parse_bags (STACK *bags, const char *pass, int passlen,
                        ASN1_OCTET_STRING **keyid, char *keymatch)
 {
         int i;
-        for (i = 0; i < sk_num (bags); i++) {
-                if (!parse_bag ((PKCS12_SAFEBAG *)sk_value (bags, i),
+        for (i = 0; i < sk_num(bags); i++) {
+                if (!parse_bag((PKCS12_SAFEBAG *)sk_value (bags, i),
                          pass, passlen, pkey, cert, ca, keyid,
                                                          keymatch)) return 0;
         }
@@ -170,7 +170,7 @@ static int parse_bags (STACK *bags, const char *pass, int passlen,
 #define MATCH_CERT 0x2
 #define MATCH_ALL  0x3
 
-static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
+static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                       EVP_PKEY **pkey, X509 **cert, STACK **ca,
                       ASN1_OCTET_STRING **keyid,
              char *keymatch)
@@ -187,9 +187,9 @@ static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
         /* Check for any local key id matching (if needed) */
         if (lkey && ((*keymatch & MATCH_ALL) != MATCH_ALL)) {
                 if (*keyid) {
-                        if (ASN1_OCTET_STRING_cmp (*keyid, lkey)) lkey = NULL;
+                        if (M_ASN1_OCTET_STRING_cmp(*keyid, lkey)) lkey = NULL;
                 } else {
-                        if (!(*keyid = ASN1_OCTET_STRING_dup (lkey))) {
+                        if (!(*keyid = M_ASN1_OCTET_STRING_dup(lkey))) {
                                 PKCS12err(PKCS12_F_PARSE_BAGS,ERR_R_MALLOC_FAILURE);
                                 return 0;
                     }
@@ -200,16 +200,16 @@ static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
         {
         case NID_keyBag:
                 if (!lkey || !pkey) return 1;   
-                if (!(*pkey = EVP_PKCS82PKEY (bag->value.keybag))) return 0;
+                if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag))) return 0;
                 *keymatch |= MATCH_KEY;
         break;
 
         case NID_pkcs8ShroudedKeyBag:
                 if (!lkey || !pkey) return 1;   
-                if (!(p8 = M_PKCS12_decrypt_skey (bag, pass, passlen)))
+                if (!(p8 = M_PKCS12_decrypt_skey(bag, pass, passlen)))
                                 return 0;
-                *pkey = EVP_PKCS82PKEY (p8);
-                PKCS8_PRIV_KEY_INFO_free (p8);
+                *pkey = EVP_PKCS82PKEY(p8);
+                PKCS8_PRIV_KEY_INFO_free(p8);
                 if (!(*pkey)) return 0;
                 *keymatch |= MATCH_KEY;
         break;
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_lib.c b/src/lib/libssl/src/crypto/pkcs12/p12_lib.c
index 00a6695d9b..7ca9c14908 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_lib.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_lib.c
@@ -104,8 +104,8 @@ PKCS12 *PKCS12_new(void)
 void PKCS12_free (PKCS12 *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free (a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS12_MAC_DATA_free (a->mac);
         PKCS7_free (a->authsafes);
-        Free ((char *)a);
+        Free (a);
 }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_mac.c b/src/lib/libssl/src/crypto/pkcs12/p12_mac.c
index f163d4cfaa..f5ab0d6464 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_mac.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_mac.c
@@ -82,9 +82,9 @@ PKCS12_MAC_DATA *PKCS12_MAC_DATA_new(void)
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PKCS12_MAC_DATA);
         ret->dinfo = X509_SIG_new();
-        ret->salt = ASN1_OCTET_STRING_new();
+        ret->salt = M_ASN1_OCTET_STRING_new();
         ret->iter = NULL;
-        return (ret);
+        return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS12_MAC_DATA_NEW);
 }
 
@@ -94,9 +94,9 @@ PKCS12_MAC_DATA *d2i_PKCS12_MAC_DATA(PKCS12_MAC_DATA **a, unsigned char **pp,
         M_ASN1_D2I_vars(a,PKCS12_MAC_DATA *,PKCS12_MAC_DATA_new);
         M_ASN1_D2I_Init();
         M_ASN1_D2I_start_sequence();
-        M_ASN1_D2I_get (ret->dinfo, d2i_X509_SIG);
-        M_ASN1_D2I_get (ret->salt, d2i_ASN1_OCTET_STRING);
-        M_ASN1_D2I_get_opt (ret->iter, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
+        M_ASN1_D2I_get(ret->dinfo, d2i_X509_SIG);
+        M_ASN1_D2I_get(ret->salt, d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_opt(ret->iter, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
         M_ASN1_D2I_Finish(a, PKCS12_MAC_DATA_free, ASN1_F_D2I_PKCS12_MAC_DATA);
 }
 
@@ -104,7 +104,7 @@ void PKCS12_MAC_DATA_free (PKCS12_MAC_DATA *a)
 {
         if (a == NULL) return;
         X509_SIG_free (a->dinfo);
-        ASN1_OCTET_STRING_free (a->salt);
-        ASN1_INTEGER_free (a->iter);
-        Free ((char *)a);
+        M_ASN1_OCTET_STRING_free(a->salt);
+        M_ASN1_INTEGER_free(a->iter);
+        Free (a);
 }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c b/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c
index bac558d6b9..f1094b3840 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c
@@ -131,7 +131,7 @@ int PKCS12_set_mac (PKCS12 *p12, const char *pass, int passlen,
                 PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_GENERATION_ERROR);
                 return 0;
         }
-        if (!(ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) {
+        if (!(M_ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) {
                 PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_STRING_SET_ERROR);
                                                 return 0;
         }
@@ -142,13 +142,13 @@ int PKCS12_set_mac (PKCS12 *p12, const char *pass, int passlen,
 int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
              EVP_MD *md_type)
 {
-        if (!(p12->mac = PKCS12_MAC_DATA_new ())) return PKCS12_ERROR;
+        if (!(p12->mac = PKCS12_MAC_DATA_new())) return PKCS12_ERROR;
         if (iter > 1) {
-                if(!(p12->mac->iter = ASN1_INTEGER_new())) {
+                if(!(p12->mac->iter = M_ASN1_INTEGER_new())) {
                         PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
                         return 0;
                 }
-                ASN1_INTEGER_set (p12->mac->iter, iter);
+                ASN1_INTEGER_set(p12->mac->iter, iter);
         }
         if (!saltlen) saltlen = PKCS12_SALT_LEN;
         p12->mac->salt->length = saltlen;
@@ -156,7 +156,10 @@ int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
                 PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!salt) RAND_bytes (p12->mac->salt->data, saltlen);
+        if (!salt) {
+                if (RAND_bytes (p12->mac->salt->data, saltlen) <= 0)
+                        return 0;
+        }
         else memcpy (p12->mac->salt->data, salt, saltlen);
         p12->mac->dinfo->algor->algorithm = OBJ_nid2obj(EVP_MD_type(md_type));
         if (!(p12->mac->dinfo->algor->parameter = ASN1_TYPE_new())) {
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_npas.c b/src/lib/libssl/src/crypto/pkcs12/p12_npas.c
new file mode 100644
index 0000000000..ee71707e2c
--- /dev/null
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_npas.c
@@ -0,0 +1,212 @@
+/* p12_npas.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <openssl/pem.h>
+#include <openssl/err.h>
+#include <openssl/pkcs12.h>
+
+/* PKCS#12 password change routine */
+
+static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass);
+static int newpass_bags(STACK *bags, char *oldpass,  char *newpass);
+static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass);
+static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen);
+
+/* 
+ * Change the password on a PKCS#12 structure.
+ */
+
+int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass)
+{
+
+/* Check for NULL PKCS12 structure */
+
+if(!p12) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
+        return 0;
+}
+
+/* Check the mac */
+
+if (!PKCS12_verify_mac(p12, oldpass, -1)) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_MAC_VERIFY_FAILURE);
+        return 0;
+}
+
+if (!newpass_p12(p12, oldpass, newpass)) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_PARSE_ERROR);
+        return 0;
+}
+
+return 1;
+
+}
+
+/* Parse the outer PKCS#12 structure */
+
+static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass)
+{
+        STACK *asafes, *newsafes, *bags;
+        int i, bagnid, pbe_nid, pbe_iter, pbe_saltlen;
+        PKCS7 *p7, *p7new;
+        ASN1_OCTET_STRING *p12_data_tmp = NULL, *macnew = NULL;
+        unsigned char mac[EVP_MAX_MD_SIZE];
+        unsigned int maclen;
+        if (!(asafes = M_PKCS12_unpack_authsafes(p12))) return 0;
+        if(!(newsafes = sk_new(NULL))) return 0;
+        for (i = 0; i < sk_num (asafes); i++) {
+                p7 = (PKCS7 *) sk_value(asafes, i);
+                bagnid = OBJ_obj2nid(p7->type);
+                if (bagnid == NID_pkcs7_data) {
+                        bags = M_PKCS12_unpack_p7data(p7);
+                } else if (bagnid == NID_pkcs7_encrypted) {
+                        bags = M_PKCS12_unpack_p7encdata(p7, oldpass, -1);
+                        alg_get(p7->d.encrypted->enc_data->algorithm,
+                                &pbe_nid, &pbe_iter, &pbe_saltlen);
+                } else continue;
+                if (!bags) {
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                if (!newpass_bags(bags, oldpass, newpass)) {
+                        sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                /* Repack bag in same form with new password */
+                if (bagnid == NID_pkcs7_data) p7new = PKCS12_pack_p7data(bags);
+                else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL,
+                                                 pbe_saltlen, pbe_iter, bags);
+                sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                if(!p7new) {
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                sk_push(newsafes, (char *)p7new);
+        }
+        sk_pop_free(asafes, PKCS7_free);
+
+        /* Repack safe: save old safe in case of error */
+
+        p12_data_tmp = p12->authsafes->d.data;
+        if(!(p12->authsafes->d.data = ASN1_OCTET_STRING_new())) goto saferr;
+        if(!M_PKCS12_pack_authsafes(p12, newsafes)) goto saferr;
+
+        if(!PKCS12_gen_mac(p12, newpass, -1, mac, &maclen)) goto saferr;
+        if(!(macnew = ASN1_OCTET_STRING_new())) goto saferr;
+        if(!ASN1_OCTET_STRING_set(macnew, mac, maclen)) goto saferr;
+        ASN1_OCTET_STRING_free(p12->mac->dinfo->digest);
+        p12->mac->dinfo->digest = macnew;
+        ASN1_OCTET_STRING_free(p12_data_tmp);
+
+        return 1;
+
+        saferr:
+        /* Restore old safe */
+        ASN1_OCTET_STRING_free(p12->authsafes->d.data);
+        ASN1_OCTET_STRING_free(macnew);
+        p12->authsafes->d.data = p12_data_tmp;
+        return 0;
+
+}
+
+
+static int newpass_bags(STACK *bags, char *oldpass,  char *newpass)
+{
+        int i;
+        for (i = 0; i < sk_num(bags); i++) {
+                if (!newpass_bag((PKCS12_SAFEBAG *)sk_value(bags, i),
+                                                 oldpass, newpass)) return 0;
+        }
+        return 1;
+}
+
+/* Change password of safebag: only needs handle shrouded keybags */
+
+static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass)
+{
+        PKCS8_PRIV_KEY_INFO *p8;
+        X509_SIG *p8new;
+        int p8_nid, p8_saltlen, p8_iter;
+
+        if(M_PKCS12_bag_type(bag) != NID_pkcs8ShroudedKeyBag) return 1;
+
+        if (!(p8 = M_PKCS12_decrypt_skey(bag, oldpass, -1))) return 0;
+        alg_get(bag->value.shkeybag->algor, &p8_nid, &p8_iter, &p8_saltlen);
+        if(!(p8new = PKCS8_encrypt(p8_nid, NULL, newpass, -1, NULL, p8_saltlen,
+                                                     p8_iter, p8))) return 0;
+        X509_SIG_free(bag->value.shkeybag);
+        bag->value.shkeybag = p8new;
+        return 1;
+}
+
+static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen)
+{
+        PBEPARAM *pbe;
+        unsigned char *p;
+        p = alg->parameter->value.sequence->data;
+        pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
+        *pnid = OBJ_obj2nid(alg->algorithm);
+        *piter = ASN1_INTEGER_get(pbe->iter);
+        *psaltlen = pbe->salt->length;
+        PBEPARAM_free(pbe);
+        return 0;
+}
diff --git a/src/lib/libssl/src/crypto/pkcs12/pk12err.c b/src/lib/libssl/src/crypto/pkcs12/pk12err.c
index 38d7be7675..9d8de10e1e 100644
--- a/src/lib/libssl/src/crypto/pkcs12/pk12err.c
+++ b/src/lib/libssl/src/crypto/pkcs12/pk12err.c
@@ -79,6 +79,7 @@ static ERR_STRING_DATA PKCS12_str_functs[]=
 {ERR_PACK(0,PKCS12_F_PKCS12_KEY_GEN_UNI,0),     "PKCS12_key_gen_uni"},
 {ERR_PACK(0,PKCS12_F_PKCS12_MAKE_KEYBAG,0),     "PKCS12_MAKE_KEYBAG"},
 {ERR_PACK(0,PKCS12_F_PKCS12_MAKE_SHKEYBAG,0),   "PKCS12_MAKE_SHKEYBAG"},
+{ERR_PACK(0,PKCS12_F_PKCS12_NEWPASS,0), "PKCS12_newpass"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_P7DATA,0),     "PKCS12_pack_p7data"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_P7ENCDATA,0),  "PKCS12_pack_p7encdata"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_SAFEBAG,0),    "PKCS12_pack_safebag"},
@@ -99,6 +100,7 @@ static ERR_STRING_DATA PKCS12_str_reasons[]=
 {PKCS12_R_DECODE_ERROR                   ,"decode error"},
 {PKCS12_R_ENCODE_ERROR                   ,"encode error"},
 {PKCS12_R_ENCRYPT_ERROR                  ,"encrypt error"},
+{PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE,"error setting encrypted data type"},
 {PKCS12_R_INVALID_NULL_ARGUMENT          ,"invalid null argument"},
 {PKCS12_R_INVALID_NULL_PKCS12_POINTER    ,"invalid null pkcs12 pointer"},
 {PKCS12_R_IV_GEN_ERROR                   ,"iv gen error"},
diff --git a/src/lib/libssl/src/crypto/pkcs12/pkcs12.h b/src/lib/libssl/src/crypto/pkcs12/pkcs12.h
index 4cfba5e6c6..254000fa12 100644
--- a/src/lib/libssl/src/crypto/pkcs12/pkcs12.h
+++ b/src/lib/libssl/src/crypto/pkcs12/pkcs12.h
@@ -273,6 +273,7 @@ int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12);
 int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12);
 PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12);
 PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
+int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -296,6 +297,7 @@ PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
 #define PKCS12_F_PKCS12_KEY_GEN_UNI                      111
 #define PKCS12_F_PKCS12_MAKE_KEYBAG                      112
 #define PKCS12_F_PKCS12_MAKE_SHKEYBAG                    113
+#define PKCS12_F_PKCS12_NEWPASS                          128
 #define PKCS12_F_PKCS12_PACK_P7DATA                      114
 #define PKCS12_F_PKCS12_PACK_P7ENCDATA                   115
 #define PKCS12_F_PKCS12_PACK_SAFEBAG                     117
@@ -313,6 +315,7 @@ PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
 #define PKCS12_R_DECODE_ERROR                            101
 #define PKCS12_R_ENCODE_ERROR                            102
 #define PKCS12_R_ENCRYPT_ERROR                           103
+#define PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE       120
 #define PKCS12_R_INVALID_NULL_ARGUMENT                   104
 #define PKCS12_R_INVALID_NULL_PKCS12_POINTER             105
 #define PKCS12_R_IV_GEN_ERROR                            106
diff --git a/src/lib/libssl/src/crypto/pkcs7/Makefile.ssl b/src/lib/libssl/src/crypto/pkcs7/Makefile.ssl
index 6c4644b2f2..0e508386e8 100644
--- a/src/lib/libssl/src/crypto/pkcs7/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/pkcs7/Makefile.ssl
@@ -1,5 +1,5 @@
 #
-# SSLeay/crypto/asn1/Makefile
+# SSLeay/crypto/pkcs7/Makefile
 #
 
 DIR=    pkcs7
@@ -15,6 +15,9 @@ MAKEDEPEND=	$(TOP)/util/domd $(TOP)
 MAKEFILE=       Makefile.ssl
 AR=             ar r
 
+PEX_LIBS=
+EX_LIBS=
+ 
 CFLAGS= $(INCLUDES) $(CFLAG)
 
 GENERAL=Makefile README
@@ -22,8 +25,8 @@ TEST=
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC= pk7_lib.c pkcs7err.c pk7_doit.c
-LIBOBJ= pk7_lib.o pkcs7err.o pk7_doit.o
+LIBSRC= pk7_lib.c pkcs7err.c pk7_doit.c pk7_smime.c pk7_attr.c pk7_mime.c
+LIBOBJ= pk7_lib.o pkcs7err.o pk7_doit.o pk7_smime.o pk7_attr.o pk7_mime.o
 
 SRC= $(LIBSRC)
 
@@ -42,16 +45,16 @@ all:	lib
 testapps: enc dec sign verify
 
 enc: enc.o lib
-        $(CC) $(CFLAGS) -o enc enc.o $(LIB)
+        $(CC) $(CFLAGS) -o enc enc.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
 
 dec: dec.o lib
-        $(CC) $(CFLAGS) -o dec dec.o $(LIB)
+        $(CC) $(CFLAGS) -o dec dec.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
 
 sign: sign.o lib
-        $(CC) $(CFLAGS) -o sign sign.o $(LIB)
+        $(CC) $(CFLAGS) -o sign sign.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
 
 verify: verify.o example.o lib
-        $(CC) $(CFLAGS) -o verify verify.o example.o $(LIB)
+        $(CC) $(CFLAGS) -o verify verify.o $(PEX_LIBS) example.o $(LIB) $(EX_LIBS)
 
 lib:    $(LIBOBJ)
         $(AR) $(LIB) $(LIBOBJ)
@@ -90,18 +93,35 @@ dclean:
         mv -f Makefile.new $(MAKEFILE)
 
 clean:
-        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff enc dec sign verify
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
+pk7_attr.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+pk7_attr.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+pk7_attr.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+pk7_attr.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+pk7_attr.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
+pk7_attr.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+pk7_attr.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+pk7_attr.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pk7_attr.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+pk7_attr.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h
+pk7_attr.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
+pk7_attr.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+pk7_attr.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+pk7_attr.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+pk7_attr.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+pk7_attr.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 pk7_doit.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk7_doit.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pk7_doit.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-pk7_doit.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-pk7_doit.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-pk7_doit.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-pk7_doit.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-pk7_doit.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+pk7_doit.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+pk7_doit.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+pk7_doit.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+pk7_doit.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+pk7_doit.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+pk7_doit.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 pk7_doit.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 pk7_doit.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 pk7_doit.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -110,7 +130,8 @@ pk7_doit.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 pk7_doit.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 pk7_doit.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 pk7_doit.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-pk7_doit.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+pk7_doit.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+pk7_doit.o: ../cryptlib.h
 pk7_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk7_lib.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pk7_lib.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -128,6 +149,42 @@ pk7_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 pk7_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 pk7_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 pk7_lib.o: ../cryptlib.h
+pk7_mime.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+pk7_mime.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+pk7_mime.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+pk7_mime.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+pk7_mime.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+pk7_mime.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+pk7_mime.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+pk7_mime.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+pk7_mime.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pk7_mime.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+pk7_mime.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+pk7_mime.o: ../../include/openssl/rand.h ../../include/openssl/rc2.h
+pk7_mime.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+pk7_mime.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+pk7_mime.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+pk7_mime.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+pk7_mime.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+pk7_smime.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+pk7_smime.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+pk7_smime.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+pk7_smime.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+pk7_smime.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+pk7_smime.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+pk7_smime.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+pk7_smime.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+pk7_smime.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+pk7_smime.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pk7_smime.o: ../../include/openssl/objects.h
+pk7_smime.o: ../../include/openssl/opensslconf.h
+pk7_smime.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+pk7_smime.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+pk7_smime.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+pk7_smime.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+pk7_smime.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+pk7_smime.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+pk7_smime.o: ../../include/openssl/x509v3.h ../cryptlib.h
 pkcs7err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pkcs7err.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pkcs7err.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
diff --git a/src/lib/libssl/src/crypto/pkcs7/bio_ber.c b/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
index 2f17723e98..4803966fd2 100644
--- a/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
+++ b/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
@@ -69,6 +69,7 @@ static int ber_read(BIO *h,char *buf,int size);
 static long ber_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int ber_new(BIO *h);
 static int ber_free(BIO *data);
+static long ber_callback_ctrl(BIO *h,int cmd,void *(*fp)());
 #define BER_BUF_SIZE    (32)
 
 /* This is used to hold the state of the BER objects being read. */
@@ -92,7 +93,7 @@ typedef struct bio_ber_struct
         /* most of the following are used when doing non-blocking IO */
         /* reading */
         long num_left;  /* number of bytes still to read/write in block */
-        int depth;      /* used with idefinite encoding. */
+        int depth;      /* used with indefinite encoding. */
         int finished;   /* No more read data */
 
         /* writting */ 
@@ -115,6 +116,7 @@ static BIO_METHOD methods_ber=
         ber_ctrl,
         ber_new,
         ber_free,
+        ber_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_ber(void)
@@ -409,6 +411,20 @@ again:
         return(ret);
         }
 
+static long ber_callback_ctrl(BIO *b, int cmd, void *(*fp)())
+        {
+        long ret=1;
+
+        if (b->next_bio == NULL) return(0);
+        switch (cmd)
+                {
+        default:
+                ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 /*
 void BIO_set_cipher_ctx(b,c)
 BIO *b;
diff --git a/src/lib/libssl/src/crypto/pkcs7/dec.c b/src/lib/libssl/src/crypto/pkcs7/dec.c
index b3661f28d3..6752ec568a 100644
--- a/src/lib/libssl/src/crypto/pkcs7/dec.c
+++ b/src/lib/libssl/src/crypto/pkcs7/dec.c
@@ -57,6 +57,7 @@
  */
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
@@ -85,7 +86,7 @@ char *argv[];
         int i,printit=0;
         STACK_OF(PKCS7_SIGNER_INFO) *sk;
 
-        SSLeay_add_all_algorithms();
+        OpenSSL_add_all_algorithms();
         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
 
         data=BIO_new(BIO_s_file());
@@ -121,9 +122,10 @@ char *argv[];
         }
 
         if ((in=BIO_new_file(keyfile,"r")) == NULL) goto err;
-        if ((x509=PEM_read_bio_X509(in,NULL,NULL)) == NULL) goto err;
+        if ((x509=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL) goto err;
         BIO_reset(in);
-        if ((pkey=PEM_read_bio_PrivateKey(in,NULL,NULL)) == NULL) goto err;
+        if ((pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL)) == NULL)
+                goto err;
         BIO_free(in);
 
         if (pp == NULL)
@@ -131,7 +133,7 @@ char *argv[];
 
 
         /* Load the PKCS7 object from a file */
-        if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL)) == NULL) goto err;
+        if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL,NULL)) == NULL) goto err;
 
 
 
@@ -148,7 +150,7 @@ char *argv[];
         /* We need to process the data */
         /* We cannot support detached encryption */
         p7bio=PKCS7_dataDecode(p7,pkey,detached,x509);
-        
+
         if (p7bio == NULL)
                 {
                 printf("problems decoding\n");
diff --git a/src/lib/libssl/src/crypto/pkcs7/enc.c b/src/lib/libssl/src/crypto/pkcs7/enc.c
index 43bfd10a23..2b56c2eff3 100644
--- a/src/lib/libssl/src/crypto/pkcs7/enc.c
+++ b/src/lib/libssl/src/crypto/pkcs7/enc.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 #include <stdio.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
@@ -76,7 +77,7 @@ char *argv[];
         const EVP_CIPHER *cipher=NULL;
         STACK_OF(X509) *recips=NULL;
 
-        SSLeay_add_all_algorithms();
+        OpenSSL_add_all_algorithms();
 
         data=BIO_new(BIO_s_file());
         while(argc > 1)
@@ -98,7 +99,8 @@ char *argv[];
                         argc-=2;
                         argv+=2;
                         if (!(in=BIO_new_file(keyfile,"r"))) goto err;
-                        if (!(x509=PEM_read_bio_X509(in,NULL,NULL))) goto err;
+                        if (!(x509=PEM_read_bio_X509(in,NULL,NULL,NULL)))
+                                goto err;
                         if(!recips) recips = sk_X509_new_null();
                         sk_X509_push(recips, x509);
                         BIO_free(in);
@@ -125,7 +127,14 @@ char *argv[];
 #else
         PKCS7_set_type(p7,NID_pkcs7_enveloped);
 #endif
-        if(!cipher) cipher = EVP_des_ede3_cbc();
+        if(!cipher)     {
+#ifndef NO_DES
+                cipher = EVP_des_ede3_cbc();
+#else
+                fprintf(stderr, "No cipher selected\n");
+                goto err;
+#endif
+        }
 
         if (!PKCS7_set_cipher(p7,cipher)) goto err;
         for(i = 0; i < sk_X509_num(recips); i++) {
diff --git a/src/lib/libssl/src/crypto/pkcs7/example.c b/src/lib/libssl/src/crypto/pkcs7/example.c
index 7354890084..f6656be28e 100644
--- a/src/lib/libssl/src/crypto/pkcs7/example.c
+++ b/src/lib/libssl/src/crypto/pkcs7/example.c
@@ -1,5 +1,6 @@
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <openssl/pkcs7.h>
 #include <openssl/asn1_mac.h>
 
@@ -36,7 +37,7 @@ void add_signed_string(PKCS7_SIGNER_INFO *si, char *str)
                 signed_string_nid=
                         OBJ_create("1.2.3.4.5","OID_example","Our example OID");
         os=ASN1_OCTET_STRING_new();
-        ASN1_OCTET_STRING_set(os,str,strlen(str));
+        ASN1_OCTET_STRING_set(os,(unsigned char*)str,strlen(str));
         /* When we add, we do not free */
         PKCS7_add_signed_attribute(si,signed_string_nid,
                 V_ASN1_OCTET_STRING,(char *)os);
@@ -68,7 +69,7 @@ int get_signed_string(PKCS7_SIGNER_INFO *si, char *buf, int len)
         return(0);
         }
 
-static signed_seq2string_nid= -1;
+static int signed_seq2string_nid= -1;
 /* ########################################### */
 int add_signed_seq2string(PKCS7_SIGNER_INFO *si, char *str1, char *str2)
         {
@@ -86,8 +87,8 @@ int add_signed_seq2string(PKCS7_SIGNER_INFO *si, char *str1, char *str2)
 
         os1=ASN1_OCTET_STRING_new();
         os2=ASN1_OCTET_STRING_new();
-        ASN1_OCTET_STRING_set(os1,str1,strlen(str1));
-        ASN1_OCTET_STRING_set(os2,str1,strlen(str1));
+        ASN1_OCTET_STRING_set(os1,(unsigned char*)str1,strlen(str1));
+        ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));
         i =i2d_ASN1_OCTET_STRING(os1,NULL);
         i+=i2d_ASN1_OCTET_STRING(os2,NULL);
         total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
@@ -197,7 +198,7 @@ X509_ATTRIBUTE *create_string(char *str)
                 signed_string_nid=
                         OBJ_create("1.2.3.4.5","OID_example","Our example OID");
         os=ASN1_OCTET_STRING_new();
-        ASN1_OCTET_STRING_set(os,str,strlen(str));
+        ASN1_OCTET_STRING_set(os,(unsigned char*)str,strlen(str));
         /* When we add, we do not free */
         ret=X509_ATTRIBUTE_create(signed_string_nid,
                 V_ASN1_OCTET_STRING,(char *)os);
@@ -250,8 +251,8 @@ X509_ATTRIBUTE *add_seq2string(PKCS7_SIGNER_INFO *si, char *str1, char *str2)
 
         os1=ASN1_OCTET_STRING_new();
         os2=ASN1_OCTET_STRING_new();
-        ASN1_OCTET_STRING_set(os1,str1,strlen(str1));
-        ASN1_OCTET_STRING_set(os2,str1,strlen(str1));
+        ASN1_OCTET_STRING_set(os1,(unsigned char*)str1,strlen(str1));
+        ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));
         i =i2d_ASN1_OCTET_STRING(os1,NULL);
         i+=i2d_ASN1_OCTET_STRING(os2,NULL);
         total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_attr.c b/src/lib/libssl/src/crypto/pkcs7/pk7_attr.c
new file mode 100644
index 0000000000..3b9c0fe3f2
--- /dev/null
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_attr.c
@@ -0,0 +1,85 @@
+/* pk7_attr.c */
+/* S/MIME code.
+ * Copyright (C) 1997-8 Dr S N Henson (shenson@bigfoot.com) 
+ * All Rights Reserved. 
+ * Redistribution of this code without the authors permission is expressly
+ * prohibited.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <openssl/bio.h>
+#include <openssl/asn1.h>
+#include <openssl/pem.h>
+#include <openssl/pkcs7.h>
+#include <openssl/err.h>
+
+int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK *cap)
+{
+        ASN1_STRING *seq;
+        unsigned char *p, *pp;
+        int len;
+        len=i2d_ASN1_SET(cap,NULL,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
+                                                V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        if(!(pp=(unsigned char *)Malloc(len))) {
+                PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        p=pp;
+        i2d_ASN1_SET(cap,&p,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
+                                                V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        if(!(seq = ASN1_STRING_new())) {
+                PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        if(!ASN1_STRING_set (seq, pp, len)) {
+                PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        Free (pp);
+        return PKCS7_add_signed_attribute(si, NID_SMIMECapabilities,
+                                                        V_ASN1_SEQUENCE, seq);
+}
+
+STACK *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si)
+{
+        ASN1_TYPE *cap;
+        unsigned char *p;
+        cap = PKCS7_get_signed_attribute(si, NID_SMIMECapabilities);
+        if (!cap) return NULL;
+        p = cap->value.sequence->data;
+        return d2i_ASN1_SET (NULL, &p, cap->value.sequence->length, 
+                (char *(*)())d2i_X509_ALGOR, X509_ALGOR_free, V_ASN1_SEQUENCE,
+                                                         V_ASN1_UNIVERSAL);
+}
+
+/* Basic smime-capabilities OID and optional integer arg */
+int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
+{
+        X509_ALGOR *alg;
+        if(!(alg = X509_ALGOR_new())) {
+                PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        ASN1_OBJECT_free(alg->algorithm);
+        alg->algorithm = OBJ_nid2obj (nid);
+        if (arg > 0) {
+                ASN1_INTEGER *nbit;
+                if(!(alg->parameter = ASN1_TYPE_new())) {
+                        PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if(!(nbit = ASN1_INTEGER_new())) {
+                        PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if(!ASN1_INTEGER_set (nbit, arg)) {
+                        PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                alg->parameter->value.integer = nbit;
+                alg->parameter->type = V_ASN1_INTEGER;
+        }
+        sk_push (sk, (char *)alg);
+        return 1;
+}
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c b/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
index dee81b547a..80ac5e34b4 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
@@ -61,6 +61,7 @@
 #include <openssl/rand.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 static int add_attribute(STACK_OF(X509_ATTRIBUTE) **sk, int nid, int atrtype,
                          void *value);
@@ -160,9 +161,10 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 BIO_get_cipher_ctx(btmp, &ctx);
                 keylen=EVP_CIPHER_key_length(evp_cipher);
                 ivlen=EVP_CIPHER_iv_length(evp_cipher);
-                RAND_bytes(key,keylen);
+                if (RAND_bytes(key,keylen) <= 0)
+                        goto err;
                 xalg->algorithm = OBJ_nid2obj(EVP_CIPHER_type(evp_cipher));
-                if (ivlen > 0) RAND_bytes(iv,ivlen);
+                if (ivlen > 0) RAND_pseudo_bytes(iv,ivlen);
                 EVP_CipherInit(ctx, evp_cipher, key, iv, 1);
 
                 if (ivlen > 0) {
@@ -204,7 +206,7 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                                 Free(tmp);
                                 goto err;
                                 }
-                        ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj);
+                        M_ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj);
                         }
                 Free(tmp);
                 memset(key, 0, keylen);
@@ -216,30 +218,23 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 btmp=NULL;
                 }
 
-        if (bio == NULL) /* ??????????? */
-                {
+        if (bio == NULL) {
                 if (p7->detached)
                         bio=BIO_new(BIO_s_null());
-                else
-                        {
-                        bio=BIO_new(BIO_s_mem());
-                        /* We need to set this so that when we have read all
-                         * the data, the encrypt BIO, if present, will read
-                         * EOF and encode the last few bytes */
-                        BIO_set_mem_eof_return(bio,0);
-
+                else {
                         if (PKCS7_type_is_signed(p7) &&
-                                PKCS7_type_is_data(p7->d.sign->contents))
-                                {
+                                PKCS7_type_is_data(p7->d.sign->contents)) {
                                 ASN1_OCTET_STRING *os;
-
                                 os=p7->d.sign->contents->d.data;
-                                if (os->length > 0)
-                                        BIO_write(bio,(char *)os->data,
-                                                os->length);
-                                }
+                                if (os->length > 0) bio = 
+                                        BIO_new_mem_buf(os->data, os->length);
+                        } 
+                        if(bio == NULL) {
+                                bio=BIO_new(BIO_s_mem());
+                                BIO_set_mem_eof_return(bio,0);
                         }
                 }
+        }
         BIO_push(out,bio);
         bio=NULL;
         if (0)
@@ -259,7 +254,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         {
         int i,j;
         BIO *out=NULL,*btmp=NULL,*etmp=NULL,*bio=NULL;
-        char *tmp=NULL;
+        unsigned char *tmp=NULL;
         X509_ALGOR *xa;
         ASN1_OCTET_STRING *data_body=NULL;
         const EVP_MD *evp_md;
@@ -270,6 +265,9 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
         X509_ALGOR *xalg=NULL;
         PKCS7_RECIP_INFO *ri=NULL;
+#ifndef NO_RC2
+        char is_rc2 = 0;
+#endif
 /*      EVP_PKEY *pkey; */
 #if 0
         X509_STORE_CTX s_ctx;
@@ -314,6 +312,16 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 goto err;
                 }
 
+        if(EVP_CIPHER_nid(evp_cipher) == NID_rc2_cbc)
+                {
+#ifndef NO_RC2          
+                is_rc2 = 1; 
+#else
+                PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
+                goto err;
+#endif
+                }
+
         /* We will be checking the signature */
         if (md_sk != NULL)
                 {
@@ -372,7 +380,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                         ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
                         if(!X509_NAME_cmp(ri->issuer_and_serial->issuer,
                                         pcert->cert_info->issuer) &&
-                             !ASN1_INTEGER_cmp(pcert->cert_info->serialNumber,
+                             !M_ASN1_INTEGER_cmp(pcert->cert_info->serialNumber,
                                         ri->issuer_and_serial->serial)) break;
                         ri=NULL;
                 }
@@ -383,17 +391,15 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 }
 
                 jj=EVP_PKEY_size(pkey);
-                tmp=Malloc(jj+10);
+                tmp=(unsigned char *)Malloc(jj+10);
                 if (tmp == NULL)
                         {
                         PKCS7err(PKCS7_F_PKCS7_DATADECODE,ERR_R_MALLOC_FAILURE);
                         goto err;
                         }
 
-                jj=EVP_PKEY_decrypt((unsigned char *)tmp,
-                        ASN1_STRING_data(ri->enc_key),
-                        ASN1_STRING_length(ri->enc_key),
-                        pkey);
+                jj=EVP_PKEY_decrypt(tmp, M_ASN1_STRING_data(ri->enc_key),
+                        M_ASN1_STRING_length(ri->enc_key), pkey);
                 if (jj <= 0)
                         {
                         PKCS7err(PKCS7_F_PKCS7_DATADECODE,ERR_R_EVP_LIB);
@@ -406,13 +412,25 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 if (EVP_CIPHER_asn1_to_param(evp_ctx,enc_alg->parameter) < 0)
                         return(NULL);
 
-                if (jj != EVP_CIPHER_CTX_key_length(evp_ctx))
-                        {
-                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,
+                if (jj != EVP_CIPHER_CTX_key_length(evp_ctx)) {
+                        /* HACK: some S/MIME clients don't use the same key
+                         * and effective key length. The key length is
+                         * determined by the size of the decrypted RSA key.
+                         * So we hack things to manually set the RC2 key
+                         * because we currently can't do this with the EVP
+                         * interface.
+                         */
+#ifndef NO_RC2          
+                        if(is_rc2) RC2_set_key(&(evp_ctx->c.rc2_ks),jj, tmp,
+                                        EVP_CIPHER_CTX_key_length(evp_ctx)*8);
+                        else
+#endif
+                                {
+                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
                                         PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH);
-                        goto err;
-                        }
-                EVP_CipherInit(evp_ctx,NULL,(unsigned char *)tmp,NULL,0);
+                                goto err;
+                                }
+                } else EVP_CipherInit(evp_ctx,NULL,tmp,NULL,0);
 
                 memset(tmp,0,jj);
 
@@ -430,6 +448,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 }
         else 
                 {
+#if 0
                 bio=BIO_new(BIO_s_mem());
                 /* We need to set this so that when we have read all
                  * the data, the encrypt BIO, if present, will read
@@ -438,6 +457,14 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
                 if (data_body->length > 0)
                         BIO_write(bio,(char *)data_body->data,data_body->length);
+#else
+                if (data_body->length > 0)
+                      bio = BIO_new_mem_buf(data_body->data,data_body->length);
+                else {
+                        bio=BIO_new(BIO_s_mem());
+                        BIO_set_mem_eof_return(bio,0);
+                }
+#endif
                 }
         BIO_push(out,bio);
         bio=NULL;
@@ -479,12 +506,12 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
         case NID_pkcs7_signedAndEnveloped:
                 /* XXXXXXXXXXXXXXXX */
                 si_sk=p7->d.signed_and_enveloped->signer_info;
-                os=ASN1_OCTET_STRING_new();
+                os=M_ASN1_OCTET_STRING_new();
                 p7->d.signed_and_enveloped->enc_data->enc_data=os;
                 break;
         case NID_pkcs7_enveloped:
                 /* XXXXXXXXXXXXXXXX */
-                os=ASN1_OCTET_STRING_new();
+                os=M_ASN1_OCTET_STRING_new();
                 p7->d.enveloped->enc_data->enc_data=os;
                 break;
         case NID_pkcs7_signed:
@@ -492,7 +519,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                 os=p7->d.sign->contents->d.data;
                 /* If detached data then the content is excluded */
                 if(p7->detached) {
-                        ASN1_OCTET_STRING_free(os);
+                        M_ASN1_OCTET_STRING_free(os);
                         p7->d.sign->contents->d.data = NULL;
                 }
                 break;
@@ -527,7 +554,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                         PKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_INTERNAL_ERROR);
                                         goto err;
                                         }
-                                if (EVP_MD_type(EVP_MD_CTX_type(mdc)) == j)
+                                if (EVP_MD_CTX_type(mdc) == j)
                                         break;
                                 else
                                         btmp=btmp->next_bio;
@@ -561,10 +588,10 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                         V_ASN1_UTCTIME,sign_time);
 
                                 /* Add digest */
-                                md_tmp=EVP_MD_CTX_type(&ctx_tmp);
+                                md_tmp=EVP_MD_CTX_md(&ctx_tmp);
                                 EVP_DigestFinal(&ctx_tmp,md_data,&md_len);
-                                digest=ASN1_OCTET_STRING_new();
-                                ASN1_OCTET_STRING_set(digest,md_data,md_len);
+                                digest=M_ASN1_OCTET_STRING_new();
+                                M_ASN1_OCTET_STRING_set(digest,md_data,md_len);
                                 PKCS7_add_signed_attribute(si,
                                         NID_pkcs9_messageDigest,
                                         V_ASN1_OCTET_STRING,digest);
@@ -611,8 +638,17 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                         goto err;
                         }
                 BIO_get_mem_ptr(btmp,&buf_mem);
-                ASN1_OCTET_STRING_set(os,
+                /* Mark the BIO read only then we can use its copy of the data
+                 * instead of making an extra copy.
+                 */
+                BIO_set_flags(btmp, BIO_FLAGS_MEM_RDONLY);
+                BIO_set_mem_eof_return(btmp, 0);
+                os->data = (unsigned char *)buf_mem->data;
+                os->length = buf_mem->length;
+#if 0
+                M_ASN1_OCTET_STRING_set(os,
                         (unsigned char *)buf_mem->data,buf_mem->length);
+#endif
                 }
         if (pp != NULL) Free(pp);
         pp=NULL;
@@ -658,6 +694,7 @@ int PKCS7_dataVerify(X509_STORE *cert_store, X509_STORE_CTX *ctx, BIO *bio,
 
         /* Lets verify */
         X509_STORE_CTX_init(ctx,cert_store,x509,cert);
+        X509_STORE_CTX_set_purpose(ctx, X509_PURPOSE_SMIME_SIGN);
         i=X509_verify_cert(ctx);
         if (i <= 0) 
                 {
@@ -709,7 +746,7 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
                                                         PKCS7_R_INTERNAL_ERROR);
                         goto err;
                         }
-                if (EVP_MD_type(EVP_MD_CTX_type(mdc)) == md_type)
+                if (EVP_MD_CTX_type(mdc) == md_type)
                         break;
                 btmp=btmp->next_bio;    
                 }
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c b/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
index 8b863d0558..45973fe850 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
@@ -123,7 +123,7 @@ int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data)
                 {
         case NID_pkcs7_signed:
                 if (p7->d.sign->contents != NULL)
-                        PKCS7_content_free(p7->d.sign->contents);
+                        PKCS7_free(p7->d.sign->contents);
                 p7->d.sign->contents=p7_data;
                 break;
         case NID_pkcs7_digest:
@@ -157,7 +157,7 @@ int PKCS7_set_type(PKCS7 *p7, int type)
                 break;
         case NID_pkcs7_data:
                 p7->type=obj;
-                if ((p7->d.data=ASN1_OCTET_STRING_new()) == NULL)
+                if ((p7->d.data=M_ASN1_OCTET_STRING_new()) == NULL)
                         goto err;
                 break;
         case NID_pkcs7_signedAndEnveloped:
@@ -165,9 +165,6 @@ int PKCS7_set_type(PKCS7 *p7, int type)
                 if ((p7->d.signed_and_enveloped=PKCS7_SIGN_ENVELOPE_new())
                         == NULL) goto err;
                 ASN1_INTEGER_set(p7->d.signed_and_enveloped->version,1);
-/*              p7->d.signed_and_enveloped->enc_data->content_type=
-                        OBJ_nid2obj(NID_pkcs7_encrypted);*/
-                        
                 break;
         case NID_pkcs7_enveloped:
                 p7->type=obj;
@@ -175,8 +172,14 @@ int PKCS7_set_type(PKCS7 *p7, int type)
                         == NULL) goto err;
                 ASN1_INTEGER_set(p7->d.enveloped->version,0);
                 break;
-        case NID_pkcs7_digest:
         case NID_pkcs7_encrypted:
+                p7->type=obj;
+                if ((p7->d.encrypted=PKCS7_ENCRYPT_new())
+                        == NULL) goto err;
+                ASN1_INTEGER_set(p7->d.encrypted->version,0);
+                break;
+
+        case NID_pkcs7_digest:
         default:
                 PKCS7err(PKCS7_F_PKCS7_SET_TYPE,PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
                 goto err;
@@ -224,8 +227,13 @@ int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)
                 }
         if (!j) /* we need to add another algorithm */
                 {
-                alg=X509_ALGOR_new();
+                if(!(alg=X509_ALGOR_new())
+                        || !(alg->parameter = ASN1_TYPE_new())) {
+                        PKCS7err(PKCS7_F_PKCS7_ADD_SIGNER,ERR_R_MALLOC_FAILURE);
+                        return(0);
+                }
                 alg->algorithm=OBJ_nid2obj(nid);
+                alg->parameter->type = V_ASN1_NULL;
                 sk_X509_ALGOR_push(md_sk,alg);
                 }
 
@@ -289,6 +297,9 @@ int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl)
 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
              EVP_MD *dgst)
         {
+        char is_dsa;
+        if (pkey->type == EVP_PKEY_DSA) is_dsa = 1;
+        else is_dsa = 0;
         /* We now need to add another PKCS7_SIGNER_INFO entry */
         ASN1_INTEGER_set(p7i->version,1);
         X509_NAME_set(&p7i->issuer_and_serial->issuer,
@@ -296,17 +307,16 @@ int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
 
         /* because ASN1_INTEGER_set is used to set a 'long' we will do
          * things the ugly way. */
-        ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
+        M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
         p7i->issuer_and_serial->serial=
-                ASN1_INTEGER_dup(X509_get_serialNumber(x509));
+                M_ASN1_INTEGER_dup(X509_get_serialNumber(x509));
 
         /* lets keep the pkey around for a while */
         CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
         p7i->pkey=pkey;
 
         /* Set the algorithms */
-        if (pkey->type == EVP_PKEY_DSA)
-                p7i->digest_alg->algorithm=OBJ_nid2obj(NID_sha1);
+        if (is_dsa) p7i->digest_alg->algorithm=OBJ_nid2obj(NID_sha1);
         else    
                 p7i->digest_alg->algorithm=OBJ_nid2obj(EVP_MD_type(dgst));
 
@@ -320,9 +330,12 @@ int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
 
         if (p7i->digest_enc_alg->parameter != NULL)
                 ASN1_TYPE_free(p7i->digest_enc_alg->parameter);
-        if ((p7i->digest_enc_alg->parameter=ASN1_TYPE_new()) == NULL)
-                goto err;
-        p7i->digest_enc_alg->parameter->type=V_ASN1_NULL;
+        if(is_dsa) p7i->digest_enc_alg->parameter = NULL;
+        else {
+                if (!(p7i->digest_enc_alg->parameter=ASN1_TYPE_new()))
+                        goto err;
+                p7i->digest_enc_alg->parameter->type=V_ASN1_NULL;
+        }
 
         return(1);
 err:
@@ -397,9 +410,9 @@ int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509)
         X509_NAME_set(&p7i->issuer_and_serial->issuer,
                 X509_get_issuer_name(x509));
 
-        ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
+        M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
         p7i->issuer_and_serial->serial=
-                ASN1_INTEGER_dup(X509_get_serialNumber(x509));
+                M_ASN1_INTEGER_dup(X509_get_serialNumber(x509));
 
         X509_ALGOR_free(p7i->key_enc_algor);
         p7i->key_enc_algor=(X509_ALGOR *)ASN1_dup(i2d_X509_ALGOR,
@@ -425,6 +438,7 @@ X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si)
 int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher)
         {
         int i;
+        ASN1_OBJECT *objtmp;
         PKCS7_ENC_CONTENT *ec;
 
         i=OBJ_obj2nid(p7->type);
@@ -441,7 +455,13 @@ int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher)
                 return(0);
                 }
 
-        /* Setup cipher OID */
+        /* Check cipher OID exists and has data in it*/
+        i = EVP_CIPHER_type(cipher);
+        if(i == NID_undef) {
+                PKCS7err(PKCS7_F_PKCS7_SET_CIPHER,PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
+                return(0);
+        }
+        objtmp = OBJ_nid2obj(i);
 
         ec->cipher = cipher;
         return 1;
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_mime.c b/src/lib/libssl/src/crypto/pkcs7/pk7_mime.c
new file mode 100644
index 0000000000..734643be28
--- /dev/null
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_mime.c
@@ -0,0 +1,673 @@
+/* pk7_mime.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/rand.h>
+#include <openssl/x509.h>
+
+/* MIME and related routines */
+
+/* MIME format structures
+ * Note that all are translated to lower case apart from
+ * parameter values. Quotes are stripped off
+ */
+
+typedef struct {
+char *name;                             /* Name of line e.g. "content-type" */
+char *value;                            /* Value of line e.g. "text/plain" */
+STACK /* MIME_PARAM */ *params;         /* Zero or more parameters */
+} MIME_HEADER;
+
+typedef struct {
+char *param_name;                       /* Param name e.g. "micalg" */
+char *param_value;                      /* Param value e.g. "sha1" */
+} MIME_PARAM;
+
+
+static int B64_write_PKCS7(BIO *bio, PKCS7 *p7);
+static PKCS7 *B64_read_PKCS7(BIO *bio);
+static char * strip_ends(char *name);
+static char * strip_start(char *name);
+static char * strip_end(char *name);
+static MIME_HEADER *mime_hdr_new(char *name, char *value);
+static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value);
+static STACK *mime_parse_hdr(BIO *bio);
+static int mime_hdr_cmp(MIME_HEADER **a, MIME_HEADER **b);
+static int mime_param_cmp(MIME_PARAM **a, MIME_PARAM **b);
+static void mime_param_free(MIME_PARAM *param);
+static int mime_bound_check(char *line, int linelen, char *bound, int blen);
+static int multi_split(BIO *bio, char *bound, STACK **ret);
+static int iscrlf(char c);
+static MIME_HEADER *mime_hdr_find(STACK *hdrs, char *name);
+static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name);
+static void mime_hdr_free(MIME_HEADER *hdr);
+
+#define MAX_SMLEN 1024
+#define mime_debug(x) /* x */
+
+
+typedef void (*stkfree)();
+
+/* Base 64 read and write of PKCS#7 structure */
+
+static int B64_write_PKCS7(BIO *bio, PKCS7 *p7)
+{
+        BIO *b64;
+        if(!(b64 = BIO_new(BIO_f_base64()))) {
+                PKCS7err(PKCS7_F_B64_WRITE_PKCS7,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        bio = BIO_push(b64, bio);
+        i2d_PKCS7_bio(bio, p7);
+        BIO_flush(bio);
+        bio = BIO_pop(bio);
+        BIO_free(b64);
+        return 1;
+}
+
+static PKCS7 *B64_read_PKCS7(BIO *bio)
+{
+        BIO *b64;
+        PKCS7 *p7;
+        if(!(b64 = BIO_new(BIO_f_base64()))) {
+                PKCS7err(PKCS7_F_B64_READ_PKCS7,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        bio = BIO_push(b64, bio);
+        if(!(p7 = d2i_PKCS7_bio(bio, NULL))) 
+                PKCS7err(PKCS7_F_B64_READ_PKCS7,PKCS7_R_DECODE_ERROR);
+        BIO_flush(bio);
+        bio = BIO_pop(bio);
+        BIO_free(b64);
+        return p7;
+}
+
+/* SMIME sender */
+
+int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
+{
+        char linebuf[MAX_SMLEN];
+        char bound[33], c;
+        int i;
+        if((flags & PKCS7_DETACHED) && data) {
+        /* We want multipart/signed */
+                /* Generate a random boundary */
+                RAND_pseudo_bytes((unsigned char *)bound, 32);
+                for(i = 0; i < 32; i++) {
+                        c = bound[i] & 0xf;
+                        if(c < 10) c += '0';
+                        else c += 'A' - 10;
+                        bound[i] = c;
+                }
+                bound[32] = 0;
+                BIO_printf(bio, "MIME-Version: 1.0\n");
+                BIO_printf(bio, "Content-Type: multipart/signed ; ");
+                BIO_printf(bio, "protocol=\"application/x-pkcs7-signature\" ; ");
+                BIO_printf(bio, "micalg=sha1 ; boundary=\"----%s\"\n\n", bound);
+                BIO_printf(bio, "This is an S/MIME signed message\n\n");
+                /* Now write out the first part */
+                BIO_printf(bio, "------%s\r\n", bound);
+                if(flags & PKCS7_TEXT) BIO_printf(bio, "Content-Type: text/plain\n\n");
+                while((i = BIO_read(data, linebuf, MAX_SMLEN)) > 0) 
+                                                BIO_write(bio, linebuf, i);
+                BIO_printf(bio, "\n------%s\n", bound);
+
+                /* Headers for signature */
+
+                BIO_printf(bio, "Content-Type: application/x-pkcs7-signature; name=\"smime.p7s\"\n");
+                BIO_printf(bio, "Content-Transfer-Encoding: base64\n");
+                BIO_printf(bio, "Content-Disposition: attachment; filename=\"smime.p7s\"\n\n");
+                B64_write_PKCS7(bio, p7);
+                BIO_printf(bio,"\n------%s--\n\n", bound);
+                return 1;
+        }
+        /* MIME headers */
+        BIO_printf(bio, "MIME-Version: 1.0\n");
+        BIO_printf(bio, "Content-Disposition: attachment; filename=\"smime.p7m\"\n");
+        BIO_printf(bio, "Content-Type: application/x-pkcs7-mime; name=\"smime.p7m\"\n");
+        BIO_printf(bio, "Content-Transfer-Encoding: base64\n\n");
+        B64_write_PKCS7(bio, p7);
+        BIO_printf(bio, "\n");
+        return 1;
+}
+
+/* SMIME reader: handle multipart/signed and opaque signing.
+ * in multipart case the content is placed in a memory BIO
+ * pointed to by "bcont". In opaque this is set to NULL
+ */
+
+PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont)
+{
+        BIO *p7in;
+        STACK *headers = NULL;
+        STACK *parts = NULL;
+        MIME_HEADER *hdr;
+        MIME_PARAM *prm;
+        PKCS7 *p7;
+        int ret;
+
+        if(bcont) *bcont = NULL;
+
+        if (!(headers = mime_parse_hdr(bio))) {
+                PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_MIME_PARSE_ERROR);
+                return NULL;
+        }
+
+        if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
+                sk_pop_free(headers, mime_hdr_free);
+                PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_CONTENT_TYPE);
+                return NULL;
+        }
+
+        /* Handle multipart/signed */
+
+        if(!strcmp(hdr->value, "multipart/signed")) {
+                /* Split into two parts */
+                prm = mime_param_find(hdr, "boundary");
+                if(!prm || !prm->param_value) {
+                        sk_pop_free(headers, mime_hdr_free);
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_MULTIPART_BOUNDARY);
+                        return NULL;
+                }
+                ret = multi_split(bio, prm->param_value, &parts);
+                sk_pop_free(headers, mime_hdr_free);
+                if(!ret || (sk_num(parts) != 2) ) {
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_MULTIPART_BODY_FAILURE);
+                        sk_pop_free(parts, (stkfree)BIO_free);
+                        return NULL;
+                }
+
+                /* Parse the signature piece */
+                p7in = (BIO *)sk_value(parts, 1);
+
+                if (!(headers = mime_parse_hdr(p7in))) {
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_MIME_SIG_PARSE_ERROR);
+                        sk_pop_free(parts, (stkfree)BIO_free);
+                        return NULL;
+                }
+
+                /* Get content type */
+
+                if(!(hdr = mime_hdr_find(headers, "content-type")) ||
+                                                                 !hdr->value) {
+                        sk_pop_free(headers, mime_hdr_free);
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_SIG_CONTENT_TYPE);
+                        return NULL;
+                }
+
+                if(strcmp(hdr->value, "application/x-pkcs7-signature") &&
+                        strcmp(hdr->value, "application/pkcs7-signature")) {
+                        sk_pop_free(headers, mime_hdr_free);
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_SIG_INVALID_MIME_TYPE);
+                        ERR_add_error_data(2, "type: ", hdr->value);
+                        sk_pop_free(parts, (stkfree)BIO_free);
+                        return NULL;
+                }
+                sk_pop_free(headers, mime_hdr_free);
+                /* Read in PKCS#7 */
+                if(!(p7 = B64_read_PKCS7(p7in))) {
+                        PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_PKCS7_SIG_PARSE_ERROR);
+                        sk_pop_free(parts, (stkfree)BIO_free);
+                        return NULL;
+                }
+
+                if(bcont) {
+                        *bcont = (BIO *)sk_value(parts, 0);
+                        BIO_free(p7in);
+                        sk_free(parts);
+                } else sk_pop_free(parts, (stkfree)BIO_free);
+                return p7;
+        }
+                
+        /* OK, if not multipart/signed try opaque signature */
+
+        if (strcmp (hdr->value, "application/x-pkcs7-mime") &&
+            strcmp (hdr->value, "application/pkcs7-mime")) {
+                PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_INVALID_MIME_TYPE);
+                ERR_add_error_data(2, "type: ", hdr->value);
+                sk_pop_free(headers, mime_hdr_free);
+                return NULL;
+        }
+
+        sk_pop_free(headers, mime_hdr_free);
+        
+        if(!(p7 = B64_read_PKCS7(bio))) {
+                PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_PKCS7_PARSE_ERROR);
+                return NULL;
+        }
+        return p7;
+
+}
+
+/* Copy text from one BIO to another making the output CRLF at EOL */
+int SMIME_crlf_copy(BIO *in, BIO *out, int flags)
+{
+        char eol;
+        int len;
+        char linebuf[MAX_SMLEN];
+        if(flags & PKCS7_BINARY) {
+                while((len = BIO_read(in, linebuf, MAX_SMLEN)) > 0)
+                                                BIO_write(out, linebuf, len);
+                return 1;
+        }
+        if(flags & PKCS7_TEXT) BIO_printf(out, "Content-Type: text/plain\r\n\r\n");
+        while ((len = BIO_gets(in, linebuf, MAX_SMLEN)) > 0) {
+                eol = 0;
+                while(iscrlf(linebuf[len - 1])) {
+                        len--;
+                        eol = 1;
+                }       
+                BIO_write(out, linebuf, len);
+                if(eol) BIO_write(out, "\r\n", 2);
+        }
+        return 1;
+}
+
+/* Strip off headers if they are text/plain */
+int SMIME_text(BIO *in, BIO *out)
+{
+        char iobuf[4096];
+        int len;
+        STACK *headers;
+        MIME_HEADER *hdr;
+        if (!(headers = mime_parse_hdr(in))) {
+                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_MIME_PARSE_ERROR);
+                return 0;
+        }
+        if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
+                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_MIME_NO_CONTENT_TYPE);
+                sk_pop_free(headers, mime_hdr_free);
+                return 0;
+        }
+        if (strcmp (hdr->value, "text/plain")) {
+                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_INVALID_MIME_TYPE);
+                ERR_add_error_data(2, "type: ", hdr->value);
+                sk_pop_free(headers, mime_hdr_free);
+                return 0;
+        }
+        sk_pop_free(headers, mime_hdr_free);
+        while ((len = BIO_read(in, iobuf, sizeof(iobuf))) > 0)
+                                                BIO_write(out, iobuf, len);
+        return 1;
+}
+
+/* Split a multipart/XXX message body into component parts: result is
+ * canonical parts in a STACK of bios
+ */
+
+static int multi_split(BIO *bio, char *bound, STACK **ret)
+{
+        char linebuf[MAX_SMLEN];
+        int len, blen;
+        BIO *bpart = NULL;
+        STACK *parts;
+        char state, part, first;
+        blen = strlen(bound);
+        part = 0;
+        state = 0;
+        first = 1;
+        parts = sk_new(NULL);
+        *ret = parts;
+        while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
+                state = mime_bound_check(linebuf, len, bound, blen);
+                if(state == 1) {
+                        first = 1;
+                        part++;
+                } else if(state == 2) {
+                        sk_push(parts, (char *)bpart);
+                        return 1;
+                } else if(part) {
+                        if(first) {
+                                first = 0;
+                                if(bpart) sk_push(parts, (char *)bpart);
+                                bpart = BIO_new(BIO_s_mem());
+                                
+                        } else BIO_write(bpart, "\r\n", 2);
+                        /* Strip CR+LF from linebuf */
+                        while(iscrlf(linebuf[len - 1])) len--;
+                        BIO_write(bpart, linebuf, len);
+                }
+        }
+        return 0;
+}
+
+static int iscrlf(char c)
+{
+        if(c == '\r' || c == '\n') return 1;
+        return 0;
+}
+
+/* This is the big one: parse MIME header lines up to message body */
+
+#define MIME_INVALID    0
+#define MIME_START      1
+#define MIME_TYPE       2
+#define MIME_NAME       3
+#define MIME_VALUE      4
+#define MIME_QUOTE      5
+#define MIME_COMMENT    6
+
+
+static STACK *mime_parse_hdr(BIO *bio)
+{
+        char *p, *q, c;
+        char *ntmp;
+        char linebuf[MAX_SMLEN];
+        MIME_HEADER *mhdr = NULL;
+        STACK *headers;
+        int len, state, save_state = 0;
+        headers = sk_new(mime_hdr_cmp);
+        while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
+        /* If whitespace at line start then continuation line */
+        if(mhdr && isspace((unsigned char)linebuf[0])) state = MIME_NAME;
+        else state = MIME_START;
+        ntmp = NULL;
+        /* Go through all characters */
+        for(p = linebuf, q = linebuf; (c = *p) && (c!='\r') && (c!='\n'); p++) {
+
+        /* State machine to handle MIME headers
+         * if this looks horrible that's because it *is*
+         */
+
+                switch(state) {
+                        case MIME_START:
+                        if(c == ':') {
+                                state = MIME_TYPE;
+                                *p = 0;
+                                ntmp = strip_ends(q);
+                                q = p + 1;
+                        }
+                        break;
+
+                        case MIME_TYPE:
+                        if(c == ';') {
+                                mime_debug("Found End Value\n");
+                                *p = 0;
+                                mhdr = mime_hdr_new(ntmp, strip_ends(q));
+                                sk_push(headers, (char *)mhdr);
+                                ntmp = NULL;
+                                q = p + 1;
+                                state = MIME_NAME;
+                        } else if(c == '(') {
+                                save_state = state;
+                                state = MIME_COMMENT;
+                        }
+                        break;
+
+                        case MIME_COMMENT:
+                        if(c == ')') {
+                                state = save_state;
+                        }
+                        break;
+
+                        case MIME_NAME:
+                        if(c == '=') {
+                                state = MIME_VALUE;
+                                *p = 0;
+                                ntmp = strip_ends(q);
+                                q = p + 1;
+                        }
+                        break ;
+
+                        case MIME_VALUE:
+                        if(c == ';') {
+                                state = MIME_NAME;
+                                *p = 0;
+                                mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
+                                ntmp = NULL;
+                                q = p + 1;
+                        } else if (c == '"') {
+                                mime_debug("Found Quote\n");
+                                state = MIME_QUOTE;
+                        } else if(c == '(') {
+                                save_state = state;
+                                state = MIME_COMMENT;
+                        }
+                        break;
+
+                        case MIME_QUOTE:
+                        if(c == '"') {
+                                mime_debug("Found Match Quote\n");
+                                state = MIME_VALUE;
+                        }
+                        break;
+                }
+        }
+
+        if(state == MIME_TYPE) {
+                mhdr = mime_hdr_new(ntmp, strip_ends(q));
+                sk_push(headers, (char *)mhdr);
+        } else if(state == MIME_VALUE)
+                         mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
+        if(p == linebuf) break; /* Blank line means end of headers */
+}
+
+return headers;
+
+}
+
+static char *strip_ends(char *name)
+{
+        return strip_end(strip_start(name));
+}
+
+/* Strip a parameter of whitespace from start of param */
+static char *strip_start(char *name)
+{
+        char *p, c;
+        /* Look for first non white space or quote */
+        for(p = name; (c = *p) ;p++) {
+                if(c == '"') {
+                        /* Next char is start of string if non null */
+                        if(p[1]) return p + 1;
+                        /* Else null string */
+                        return NULL;
+                }
+                if(!isspace((unsigned char)c)) return p;
+        }
+        return NULL;
+}
+
+/* As above but strip from end of string : maybe should handle brackets? */
+static char *strip_end(char *name)
+{
+        char *p, c;
+        if(!name) return NULL;
+        /* Look for first non white space or quote */
+        for(p = name + strlen(name) - 1; p >= name ;p--) {
+                c = *p;
+                if(c == '"') {
+                        if(p - 1 == name) return NULL;
+                        *p = 0;
+                        return name;
+                }
+                if(isspace((unsigned char)c)) *p = 0;   
+                else return name;
+        }
+        return NULL;
+}
+
+static MIME_HEADER *mime_hdr_new(char *name, char *value)
+{
+        MIME_HEADER *mhdr;
+        char *tmpname, *tmpval, *p;
+        int c;
+        if(name) {
+                if(!(tmpname = BUF_strdup(name))) return NULL;
+                for(p = tmpname ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpname = NULL;
+        if(value) {
+                if(!(tmpval = BUF_strdup(value))) return NULL;
+                for(p = tmpval ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpval = NULL;
+        mhdr = (MIME_HEADER *) Malloc(sizeof(MIME_HEADER));
+        if(!mhdr) return NULL;
+        mhdr->name = tmpname;
+        mhdr->value = tmpval;
+        if(!(mhdr->params = sk_new(mime_param_cmp))) return NULL;
+        return mhdr;
+}
+                
+static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value)
+{
+        char *tmpname, *tmpval, *p;
+        int c;
+        MIME_PARAM *mparam;
+        if(name) {
+                tmpname = BUF_strdup(name);
+                if(!tmpname) return 0;
+                for(p = tmpname ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpname = NULL;
+        if(value) {
+                tmpval = BUF_strdup(value);
+                if(!tmpval) return 0;
+        } else tmpval = NULL;
+        /* Parameter values are case sensitive so leave as is */
+        mparam = (MIME_PARAM *) Malloc(sizeof(MIME_PARAM));
+        if(!mparam) return 0;
+        mparam->param_name = tmpname;
+        mparam->param_value = tmpval;
+        sk_push(mhdr->params, (char *)mparam);
+        return 1;
+}
+
+static int mime_hdr_cmp(MIME_HEADER **a, MIME_HEADER **b)
+{
+        return(strcmp((*a)->name, (*b)->name));
+}
+
+static int mime_param_cmp(MIME_PARAM **a, MIME_PARAM **b)
+{
+        return(strcmp((*a)->param_name, (*b)->param_name));
+}
+
+/* Find a header with a given name (if possible) */
+
+static MIME_HEADER *mime_hdr_find(STACK *hdrs, char *name)
+{
+        MIME_HEADER htmp;
+        int idx;
+        htmp.name = name;
+        idx = sk_find(hdrs, (char *)&htmp);
+        if(idx < 0) return NULL;
+        return (MIME_HEADER *)sk_value(hdrs, idx);
+}
+
+static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name)
+{
+        MIME_PARAM param;
+        int idx;
+        param.param_name = name;
+        idx = sk_find(hdr->params, (char *)&param);
+        if(idx < 0) return NULL;
+        return (MIME_PARAM *)sk_value(hdr->params, idx);
+}
+
+static void mime_hdr_free(MIME_HEADER *hdr)
+{
+        if(hdr->name) Free(hdr->name);
+        if(hdr->value) Free(hdr->value);
+        if(hdr->params) sk_pop_free(hdr->params, mime_param_free);
+        Free(hdr);
+}
+
+static void mime_param_free(MIME_PARAM *param)
+{
+        if(param->param_name) Free(param->param_name);
+        if(param->param_value) Free(param->param_value);
+        Free(param);
+}
+
+/* Check for a multipart boundary. Returns:
+ * 0 : no boundary
+ * 1 : part boundary
+ * 2 : final boundary
+ */
+static int mime_bound_check(char *line, int linelen, char *bound, int blen)
+{
+        if(linelen == -1) linelen = strlen(line);
+        if(blen == -1) blen = strlen(bound);
+        /* Quickly eliminate if line length too short */
+        if(blen + 2 > linelen) return 0;
+        /* Check for part boundary */
+        if(!strncmp(line, "--", 2) && !strncmp(line + 2, bound, blen)) {
+                if(!strncmp(line + blen + 2, "--", 2)) return 2;
+                else return 1;
+        }
+        return 0;
+}
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c b/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c
new file mode 100644
index 0000000000..b41f42ed04
--- /dev/null
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c
@@ -0,0 +1,427 @@
+/* pk7_smime.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* Simple PKCS#7 processing functions */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
+                                                        BIO *data, int flags)
+{
+        PKCS7 *p7;
+        PKCS7_SIGNER_INFO *si;
+        BIO *p7bio;
+        STACK *smcap;
+        int i;
+
+        if(!X509_check_private_key(signcert, pkey)) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+                return NULL;
+        }
+
+        if(!(p7 = PKCS7_new())) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+        PKCS7_set_type(p7, NID_pkcs7_signed);
+
+        PKCS7_content_new(p7, NID_pkcs7_data);
+
+        if (!(si = PKCS7_add_signature(p7,signcert,pkey,EVP_sha1()))) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR);
+                return NULL;
+        }
+
+        if(!(flags & PKCS7_NOCERTS)) {
+                PKCS7_add_certificate(p7, signcert);
+                if(certs) for(i = 0; i < sk_X509_num(certs); i++)
+                        PKCS7_add_certificate(p7, sk_X509_value(certs, i));
+        }
+
+        if(!(p7bio = PKCS7_dataInit(p7, NULL))) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+
+        SMIME_crlf_copy(data, p7bio, flags);
+
+        if(!(flags & PKCS7_NOATTR)) {
+                PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
+                                V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data));
+                /* Add SMIMECapabilities */
+                if(!(smcap = sk_new(NULL))) {
+                        PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                }
+#ifndef NO_DES
+                PKCS7_simple_smimecap (smcap, NID_des_ede3_cbc, -1);
+#endif
+#ifndef NO_RC2
+                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 128);
+                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64);
+#endif
+#ifndef NO_DES
+                PKCS7_simple_smimecap (smcap, NID_des_cbc, -1);
+#endif
+#ifndef NO_RC2
+                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
+#endif
+                PKCS7_add_attrib_smimecap (si, smcap);
+                sk_pop_free(smcap, X509_ALGOR_free);
+        }
+
+        if(flags & PKCS7_DETACHED)PKCS7_set_detached(p7, 1);
+
+        if (!PKCS7_dataFinal(p7,p7bio)) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,PKCS7_R_PKCS7_DATASIGN);
+                return NULL;
+        }
+
+        BIO_free_all(p7bio);
+        return p7;
+}
+
+int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
+                                        BIO *indata, BIO *out, int flags)
+{
+        STACK_OF(X509) *signers;
+        X509 *signer;
+        STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
+        PKCS7_SIGNER_INFO *si;
+        X509_STORE_CTX cert_ctx;
+        char buf[4096];
+        int i, j=0;
+        BIO *p7bio;
+        BIO *tmpout;
+
+        if(!p7) {
+                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_INVALID_NULL_POINTER);
+                return 0;
+        }
+
+        if(!PKCS7_type_is_signed(p7)) {
+                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_WRONG_CONTENT_TYPE);
+                return 0;
+        }
+
+        /* Check for no data and no content: no data to verify signature */
+        if(PKCS7_get_detached(p7) && !indata) {
+                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_CONTENT);
+                return 0;
+        }
+
+        /* Check for data and content: two sets of data */
+        if(!PKCS7_get_detached(p7) && indata) {
+                                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_CONTENT_AND_DATA_PRESENT);
+                return 0;
+        }
+
+        sinfos = PKCS7_get_signer_info(p7);
+
+        if(!sinfos || !sk_PKCS7_SIGNER_INFO_num(sinfos)) {
+                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_SIGNATURES_ON_DATA);
+                return 0;
+        }
+
+
+        signers = PKCS7_get0_signers(p7, certs, flags);
+
+        if(!signers) return 0;
+
+        /* Now verify the certificates */
+
+        if (!(flags & PKCS7_NOVERIFY)) for (i = 0; i < sk_X509_num(signers); i++) {
+                signer = sk_X509_value (signers, i);
+                if (!(flags & PKCS7_NOCHAIN)) {
+                        X509_STORE_CTX_init(&cert_ctx, store, signer,
+                                                        p7->d.sign->cert);
+                        X509_STORE_CTX_set_purpose(&cert_ctx,
+                                                X509_PURPOSE_SMIME_SIGN);
+                } else X509_STORE_CTX_init (&cert_ctx, store, signer, NULL);
+                i = X509_verify_cert(&cert_ctx);
+                if (i <= 0) j = X509_STORE_CTX_get_error(&cert_ctx);
+                X509_STORE_CTX_cleanup(&cert_ctx);
+                if (i <= 0) {
+                        PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_CERTIFICATE_VERIFY_ERROR);
+                        ERR_add_error_data(2, "Verify error:",
+                                         X509_verify_cert_error_string(j));
+                        sk_X509_free(signers);
+                        return 0;
+                }
+                /* Check for revocation status here */
+        }
+
+        p7bio=PKCS7_dataInit(p7,indata);
+
+        if(flags & PKCS7_TEXT) {
+                if(!(tmpout = BIO_new(BIO_s_mem()))) {
+                        PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+        } else tmpout = out;
+
+        /* We now have to 'read' from p7bio to calculate digests etc. */
+        for (;;)
+        {
+                i=BIO_read(p7bio,buf,sizeof(buf));
+                if (i <= 0) break;
+                if (tmpout) BIO_write(tmpout, buf, i);
+        }
+
+        if(flags & PKCS7_TEXT) {
+                if(!SMIME_text(tmpout, out)) {
+                        PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_SMIME_TEXT_ERROR);
+                        BIO_free(tmpout);
+                        goto err;
+                }
+                BIO_free(tmpout);
+        }
+
+        /* Now Verify All Signatures */
+        if (!(flags & PKCS7_NOSIGS))
+            for (i=0; i<sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
+                {
+                si=sk_PKCS7_SIGNER_INFO_value(sinfos,i);
+                signer = sk_X509_value (signers, i);
+                j=PKCS7_signatureVerify(p7bio,p7,si, signer);
+                if (j <= 0) {
+                        PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_SIGNATURE_FAILURE);
+                        goto err;
+                }
+        }
+
+        sk_X509_free(signers);
+        if(indata) BIO_pop(p7bio);
+        BIO_free_all(p7bio);
+
+        return 1;
+
+        err:
+
+        sk_X509_free(signers);
+        BIO_free(p7bio);
+
+        return 0;
+}
+
+STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
+{
+        STACK_OF(X509) *signers;
+        STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
+        PKCS7_SIGNER_INFO *si;
+        PKCS7_ISSUER_AND_SERIAL *ias;
+        X509 *signer;
+        int i;
+
+        if(!p7) {
+                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_INVALID_NULL_POINTER);
+                return NULL;
+        }
+
+        if(!PKCS7_type_is_signed(p7)) {
+                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_WRONG_CONTENT_TYPE);
+                return NULL;
+        }
+        if(!(signers = sk_X509_new(NULL))) {
+                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+        /* Collect all the signers together */
+
+        sinfos = PKCS7_get_signer_info(p7);
+
+        if(sk_PKCS7_SIGNER_INFO_num(sinfos) <= 0) {
+                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_NO_SIGNERS);
+                return 0;
+        }
+
+        for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
+        {
+            si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
+            ias = si->issuer_and_serial;
+            signer = NULL;
+                /* If any certificates passed they take priority */
+            if (certs) signer = X509_find_by_issuer_and_serial (certs,
+                                                ias->issuer, ias->serial);
+            if (!signer && !(flags & PKCS7_NOINTERN)
+                        && p7->d.sign->cert) signer =
+                              X509_find_by_issuer_and_serial (p7->d.sign->cert,
+                                                ias->issuer, ias->serial);
+            if (!signer) {
+                        PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND);
+                        sk_X509_free(signers);
+                        return 0;
+            }
+
+            sk_X509_push(signers, signer);
+        }
+        return signers;
+}
+
+
+/* Build a complete PKCS#7 enveloped data */
+
+PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, EVP_CIPHER *cipher,
+                                                                int flags)
+{
+        PKCS7 *p7;
+        BIO *p7bio = NULL;
+        int i;
+        X509 *x509;
+        if(!(p7 = PKCS7_new())) {
+                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+        PKCS7_set_type(p7, NID_pkcs7_enveloped);
+        if(!PKCS7_set_cipher(p7, cipher)) {
+                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_ERROR_SETTING_CIPHER);
+                goto err;
+        }
+
+        for(i = 0; i < sk_X509_num(certs); i++) {
+                x509 = sk_X509_value(certs, i);
+                if(!PKCS7_add_recipient(p7, x509)) {
+                        PKCS7err(PKCS7_F_PKCS7_ENCRYPT,
+                                        PKCS7_R_ERROR_ADDING_RECIPIENT);
+                        goto err;
+                }
+        }
+
+        if(!(p7bio = PKCS7_dataInit(p7, NULL))) {
+                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,ERR_R_MALLOC_FAILURE);
+                goto err;
+        }
+
+        SMIME_crlf_copy(in, p7bio, flags);
+
+        BIO_flush(p7bio);
+
+        if (!PKCS7_dataFinal(p7,p7bio)) {
+                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_PKCS7_DATAFINAL_ERROR);
+                goto err;
+        }
+        BIO_free_all(p7bio);
+
+        return p7;
+
+        err:
+
+        BIO_free(p7bio);
+        PKCS7_free(p7);
+        return NULL;
+
+}
+
+int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags)
+{
+        BIO *tmpmem;
+        int ret, i;
+        char buf[4096];
+
+        if(!p7) {
+                PKCS7err(PKCS7_F_PKCS7_DECRYPT,PKCS7_R_INVALID_NULL_POINTER);
+                return 0;
+        }
+
+        if(!PKCS7_type_is_enveloped(p7)) {
+                PKCS7err(PKCS7_F_PKCS7_DECRYPT,PKCS7_R_WRONG_CONTENT_TYPE);
+                return 0;
+        }
+
+        if(!X509_check_private_key(cert, pkey)) {
+                PKCS7err(PKCS7_F_PKCS7_DECRYPT,
+                                PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+                return 0;
+        }
+
+        if(!(tmpmem = PKCS7_dataDecode(p7, pkey, NULL, cert))) {
+                PKCS7err(PKCS7_F_PKCS7_DECRYPT, PKCS7_R_DECRYPT_ERROR);
+                return 0;
+        }
+
+        if (flags & PKCS7_TEXT) {
+                BIO *tmpbuf, *bread;
+                /* Encrypt BIOs can't do BIO_gets() so add a buffer BIO */
+                if(!(tmpbuf = BIO_new(BIO_f_buffer()))) {
+                        PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if(!(bread = BIO_push(tmpbuf, tmpmem))) {
+                        PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                ret = SMIME_text(bread, data);
+                BIO_free_all(bread);
+                return ret;
+        } else {
+                for(;;) {
+                        i = BIO_read(tmpmem, buf, sizeof(buf));
+                        if(i <= 0) break;
+                        BIO_write(data, buf, i);
+                }
+                BIO_free_all(tmpmem);
+                return 1;
+        }
+}
diff --git a/src/lib/libssl/src/crypto/pkcs7/pkcs7.h b/src/lib/libssl/src/crypto/pkcs7/pkcs7.h
index c42bd6d391..3ec725d226 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pkcs7.h
+++ b/src/lib/libssl/src/crypto/pkcs7/pkcs7.h
@@ -71,8 +71,9 @@ extern "C" {
 #endif
 
 #ifdef WIN32
-/* Under Win32 this is defined in wincrypt.h */
+/* Under Win32 thes are defined in wincrypt.h */
 #undef PKCS7_ISSUER_AND_SERIAL
+#undef PKCS7_SIGNER_INFO
 #endif
 
 /*
@@ -219,6 +220,7 @@ typedef struct pkcs7_st
 #define PKCS7_get_attributes(si)        ((si)->unauth_attr)
 
 #define PKCS7_type_is_signed(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_signed)
+#define PKCS7_type_is_enveloped(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_enveloped)
 #define PKCS7_type_is_signedAndEnveloped(a) \
                 (OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped)
 #define PKCS7_type_is_data(a)   (OBJ_obj2nid((a)->type) == NID_pkcs7_data)
@@ -236,6 +238,29 @@ typedef struct pkcs7_st
 #endif
 #endif
 
+/* S/MIME related flags */
+
+#define PKCS7_TEXT      0x1
+#define PKCS7_NOCERTS   0x2
+#define PKCS7_NOSIGS    0x4
+#define PKCS7_NOCHAIN   0x8
+#define PKCS7_NOINTERN  0x10
+#define PKCS7_NOVERIFY  0x20
+#define PKCS7_DETACHED  0x40
+#define PKCS7_BINARY    0x80
+#define PKCS7_NOATTR    0x100
+
+/* Flags: for compatibility with older code */
+
+#define SMIME_TEXT      PKCS7_TEXT
+#define SMIME_NOCERTS   PKCS7_NOCERTS
+#define SMIME_NOSIGS    PKCS7_NOSIGS
+#define SMIME_NOCHAIN   PKCS7_NOCHAIN
+#define SMIME_NOINTERN  PKCS7_NOINTERN
+#define SMIME_NOVERIFY  PKCS7_NOVERIFY
+#define SMIME_DETACHED  PKCS7_DETACHED
+#define SMIME_BINARY    PKCS7_BINARY
+#define SMIME_NOATTR    PKCS7_NOATTR
 
 PKCS7_ISSUER_AND_SERIAL *PKCS7_ISSUER_AND_SERIAL_new(void );
 void                    PKCS7_ISSUER_AND_SERIAL_free(
@@ -247,7 +272,7 @@ PKCS7_ISSUER_AND_SERIAL *d2i_PKCS7_ISSUER_AND_SERIAL(
                                 unsigned char **pp, long length);
 
 #ifndef SSLEAY_MACROS
-int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,EVP_MD *type,
+int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,const EVP_MD *type,
         unsigned char *md,unsigned int *len);
 #ifndef NO_FP_API
 PKCS7 *d2i_PKCS7_fp(FILE *fp,PKCS7 **p7);
@@ -368,6 +393,23 @@ int PKCS7_set_signed_attributes(PKCS7_SIGNER_INFO *p7si,
 int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si,STACK_OF(X509_ATTRIBUTE) *sk);
 
 
+PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
+                                                        BIO *data, int flags);
+int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
+                                        BIO *indata, BIO *out, int flags);
+STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags);
+PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, EVP_CIPHER *cipher,
+                                                                int flags);
+int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags);
+
+int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK *cap);
+STACK *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si);
+int PKCS7_simple_smimecap(STACK *sk, int nid, int arg);
+
+int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags);
+PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont);
+int SMIME_crlf_copy(BIO *in, BIO *out, int flags);
+int SMIME_text(BIO *in, BIO *out);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -377,6 +419,9 @@ int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si,STACK_OF(X509_ATTRIBUTE) *sk);
 /* Error codes for the PKCS7 functions. */
 
 /* Function codes. */
+#define PKCS7_F_B64_READ_PKCS7                           120
+#define PKCS7_F_B64_WRITE_PKCS7                          121
+#define PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP                118
 #define PKCS7_F_PKCS7_ADD_CERTIFICATE                    100
 #define PKCS7_F_PKCS7_ADD_CRL                            101
 #define PKCS7_F_PKCS7_ADD_RECIPIENT_INFO                 102
@@ -386,20 +431,56 @@ int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si,STACK_OF(X509_ATTRIBUTE) *sk);
 #define PKCS7_F_PKCS7_DATAINIT                           105
 #define PKCS7_F_PKCS7_DATASIGN                           106
 #define PKCS7_F_PKCS7_DATAVERIFY                         107
+#define PKCS7_F_PKCS7_DECRYPT                            114
+#define PKCS7_F_PKCS7_ENCRYPT                            115
+#define PKCS7_F_PKCS7_GET0_SIGNERS                       124
 #define PKCS7_F_PKCS7_SET_CIPHER                         108
 #define PKCS7_F_PKCS7_SET_CONTENT                        109
 #define PKCS7_F_PKCS7_SET_TYPE                           110
+#define PKCS7_F_PKCS7_SIGN                               116
 #define PKCS7_F_PKCS7_SIGNATUREVERIFY                    113
+#define PKCS7_F_PKCS7_SIMPLE_SMIMECAP                    119
+#define PKCS7_F_PKCS7_VERIFY                             117
+#define PKCS7_F_SMIME_READ_PKCS7                         122
+#define PKCS7_F_SMIME_TEXT                               123
 
 /* Reason codes. */
+#define PKCS7_R_CERTIFICATE_VERIFY_ERROR                 117
+#define PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER          144
 #define PKCS7_R_CIPHER_NOT_INITIALIZED                   116
+#define PKCS7_R_CONTENT_AND_DATA_PRESENT                 118
+#define PKCS7_R_DECODE_ERROR                             130
 #define PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH            100
+#define PKCS7_R_DECRYPT_ERROR                            119
 #define PKCS7_R_DIGEST_FAILURE                           101
+#define PKCS7_R_ERROR_ADDING_RECIPIENT                   120
+#define PKCS7_R_ERROR_SETTING_CIPHER                     121
 #define PKCS7_R_INTERNAL_ERROR                           102
+#define PKCS7_R_INVALID_MIME_TYPE                        131
+#define PKCS7_R_INVALID_NULL_POINTER                     143
+#define PKCS7_R_MIME_NO_CONTENT_TYPE                     132
+#define PKCS7_R_MIME_PARSE_ERROR                         133
+#define PKCS7_R_MIME_SIG_PARSE_ERROR                     134
 #define PKCS7_R_MISSING_CERIPEND_INFO                    103
+#define PKCS7_R_NO_CONTENT                               122
+#define PKCS7_R_NO_CONTENT_TYPE                          135
+#define PKCS7_R_NO_MULTIPART_BODY_FAILURE                136
+#define PKCS7_R_NO_MULTIPART_BOUNDARY                    137
 #define PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE         115
+#define PKCS7_R_NO_SIGNATURES_ON_DATA                    123
+#define PKCS7_R_NO_SIGNERS                               142
+#define PKCS7_R_NO_SIG_CONTENT_TYPE                      138
 #define PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE     104
+#define PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR                124
+#define PKCS7_R_PKCS7_DATAFINAL_ERROR                    125
+#define PKCS7_R_PKCS7_DATASIGN                           126
+#define PKCS7_R_PKCS7_PARSE_ERROR                        139
+#define PKCS7_R_PKCS7_SIG_PARSE_ERROR                    140
+#define PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE   127
 #define PKCS7_R_SIGNATURE_FAILURE                        105
+#define PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND             128
+#define PKCS7_R_SIG_INVALID_MIME_TYPE                    141
+#define PKCS7_R_SMIME_TEXT_ERROR                         129
 #define PKCS7_R_UNABLE_TO_FIND_CERTIFICATE               106
 #define PKCS7_R_UNABLE_TO_FIND_MEM_BIO                   107
 #define PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST            108
diff --git a/src/lib/libssl/src/crypto/pkcs7/pkcs7err.c b/src/lib/libssl/src/crypto/pkcs7/pkcs7err.c
index 82be3c2ca1..813a8af9ed 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pkcs7err.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pkcs7err.c
@@ -65,6 +65,9 @@
 #ifndef NO_ERR
 static ERR_STRING_DATA PKCS7_str_functs[]=
         {
+{ERR_PACK(0,PKCS7_F_B64_READ_PKCS7,0),  "B64_READ_PKCS7"},
+{ERR_PACK(0,PKCS7_F_B64_WRITE_PKCS7,0), "B64_WRITE_PKCS7"},
+{ERR_PACK(0,PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,0),       "PKCS7_add_attrib_smimecap"},
 {ERR_PACK(0,PKCS7_F_PKCS7_ADD_CERTIFICATE,0),   "PKCS7_add_certificate"},
 {ERR_PACK(0,PKCS7_F_PKCS7_ADD_CRL,0),   "PKCS7_add_crl"},
 {ERR_PACK(0,PKCS7_F_PKCS7_ADD_RECIPIENT_INFO,0),        "PKCS7_add_recipient_info"},
@@ -74,23 +77,59 @@ static ERR_STRING_DATA PKCS7_str_functs[]=
 {ERR_PACK(0,PKCS7_F_PKCS7_DATAINIT,0),  "PKCS7_dataInit"},
 {ERR_PACK(0,PKCS7_F_PKCS7_DATASIGN,0),  "PKCS7_DATASIGN"},
 {ERR_PACK(0,PKCS7_F_PKCS7_DATAVERIFY,0),        "PKCS7_dataVerify"},
+{ERR_PACK(0,PKCS7_F_PKCS7_DECRYPT,0),   "PKCS7_decrypt"},
+{ERR_PACK(0,PKCS7_F_PKCS7_ENCRYPT,0),   "PKCS7_encrypt"},
+{ERR_PACK(0,PKCS7_F_PKCS7_GET0_SIGNERS,0),      "PKCS7_get0_signers"},
 {ERR_PACK(0,PKCS7_F_PKCS7_SET_CIPHER,0),        "PKCS7_set_cipher"},
 {ERR_PACK(0,PKCS7_F_PKCS7_SET_CONTENT,0),       "PKCS7_set_content"},
 {ERR_PACK(0,PKCS7_F_PKCS7_SET_TYPE,0),  "PKCS7_set_type"},
+{ERR_PACK(0,PKCS7_F_PKCS7_SIGN,0),      "PKCS7_sign"},
 {ERR_PACK(0,PKCS7_F_PKCS7_SIGNATUREVERIFY,0),   "PKCS7_signatureVerify"},
+{ERR_PACK(0,PKCS7_F_PKCS7_SIMPLE_SMIMECAP,0),   "PKCS7_simple_smimecap"},
+{ERR_PACK(0,PKCS7_F_PKCS7_VERIFY,0),    "PKCS7_verify"},
+{ERR_PACK(0,PKCS7_F_SMIME_READ_PKCS7,0),        "SMIME_read_PKCS7"},
+{ERR_PACK(0,PKCS7_F_SMIME_TEXT,0),      "SMIME_text"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA PKCS7_str_reasons[]=
         {
+{PKCS7_R_CERTIFICATE_VERIFY_ERROR        ,"certificate verify error"},
+{PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER ,"cipher has no object identifier"},
 {PKCS7_R_CIPHER_NOT_INITIALIZED          ,"cipher not initialized"},
+{PKCS7_R_CONTENT_AND_DATA_PRESENT        ,"content and data present"},
+{PKCS7_R_DECODE_ERROR                    ,"decode error"},
 {PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH   ,"decrypted key is wrong length"},
+{PKCS7_R_DECRYPT_ERROR                   ,"decrypt error"},
 {PKCS7_R_DIGEST_FAILURE                  ,"digest failure"},
+{PKCS7_R_ERROR_ADDING_RECIPIENT          ,"error adding recipient"},
+{PKCS7_R_ERROR_SETTING_CIPHER            ,"error setting cipher"},
 {PKCS7_R_INTERNAL_ERROR                  ,"internal error"},
+{PKCS7_R_INVALID_MIME_TYPE               ,"invalid mime type"},
+{PKCS7_R_INVALID_NULL_POINTER            ,"invalid null pointer"},
+{PKCS7_R_MIME_NO_CONTENT_TYPE            ,"mime no content type"},
+{PKCS7_R_MIME_PARSE_ERROR                ,"mime parse error"},
+{PKCS7_R_MIME_SIG_PARSE_ERROR            ,"mime sig parse error"},
 {PKCS7_R_MISSING_CERIPEND_INFO           ,"missing ceripend info"},
+{PKCS7_R_NO_CONTENT                      ,"no content"},
+{PKCS7_R_NO_CONTENT_TYPE                 ,"no content type"},
+{PKCS7_R_NO_MULTIPART_BODY_FAILURE       ,"no multipart body failure"},
+{PKCS7_R_NO_MULTIPART_BOUNDARY           ,"no multipart boundary"},
 {PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE,"no recipient matches certificate"},
+{PKCS7_R_NO_SIGNATURES_ON_DATA           ,"no signatures on data"},
+{PKCS7_R_NO_SIGNERS                      ,"no signers"},
+{PKCS7_R_NO_SIG_CONTENT_TYPE             ,"no sig content type"},
 {PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE,"operation not supported on this type"},
+{PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR       ,"pkcs7 add signature error"},
+{PKCS7_R_PKCS7_DATAFINAL_ERROR           ,"pkcs7 datafinal error"},
+{PKCS7_R_PKCS7_DATASIGN                  ,"pkcs7 datasign"},
+{PKCS7_R_PKCS7_PARSE_ERROR               ,"pkcs7 parse error"},
+{PKCS7_R_PKCS7_SIG_PARSE_ERROR           ,"pkcs7 sig parse error"},
+{PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE,"private key does not match certificate"},
 {PKCS7_R_SIGNATURE_FAILURE               ,"signature failure"},
+{PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND    ,"signer certificate not found"},
+{PKCS7_R_SIG_INVALID_MIME_TYPE           ,"sig invalid mime type"},
+{PKCS7_R_SMIME_TEXT_ERROR                ,"smime text error"},
 {PKCS7_R_UNABLE_TO_FIND_CERTIFICATE      ,"unable to find certificate"},
 {PKCS7_R_UNABLE_TO_FIND_MEM_BIO          ,"unable to find mem bio"},
 {PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST   ,"unable to find message digest"},
diff --git a/src/lib/libssl/src/crypto/pkcs7/sign.c b/src/lib/libssl/src/crypto/pkcs7/sign.c
index d5f1154006..22290e192c 100644
--- a/src/lib/libssl/src/crypto/pkcs7/sign.c
+++ b/src/lib/libssl/src/crypto/pkcs7/sign.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 #include <stdio.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
@@ -75,10 +76,18 @@ char *argv[];
         int i;
         int nodetach=0;
 
+#ifndef NO_MD2
         EVP_add_digest(EVP_md2());
+#endif
+#ifndef NO_MD5
         EVP_add_digest(EVP_md5());
+#endif
+#ifndef NO_SHA1
         EVP_add_digest(EVP_sha1());
+#endif
+#ifndef NO_MDC2
         EVP_add_digest(EVP_mdc2());
+#endif
 
         data=BIO_new(BIO_s_file());
 again:
@@ -97,9 +106,9 @@ again:
                 BIO_set_fp(data,stdin,BIO_NOCLOSE);
 
         if ((in=BIO_new_file("server.pem","r")) == NULL) goto err;
-        if ((x509=PEM_read_bio_X509(in,NULL,NULL)) == NULL) goto err;
+        if ((x509=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL) goto err;
         BIO_reset(in);
-        if ((pkey=PEM_read_bio_PrivateKey(in,NULL,NULL)) == NULL) goto err;
+        if ((pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL)) == NULL) goto err;
         BIO_free(in);
 
         p7=PKCS7_new();
diff --git a/src/lib/libssl/src/crypto/pkcs7/verify.c b/src/lib/libssl/src/crypto/pkcs7/verify.c
index 32d9783e45..49fc8d8bed 100644
--- a/src/lib/libssl/src/crypto/pkcs7/verify.c
+++ b/src/lib/libssl/src/crypto/pkcs7/verify.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 #include <stdio.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/asn1.h>
 #include <openssl/x509.h>
@@ -84,10 +85,18 @@ char *argv[];
 
         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
         bio_out=BIO_new_fp(stdout,BIO_NOCLOSE);
+#ifndef NO_MD2
         EVP_add_digest(EVP_md2());
+#endif
+#ifndef NO_MD5
         EVP_add_digest(EVP_md5());
+#endif
+#ifndef NO_SHA1
         EVP_add_digest(EVP_sha1());
+#endif
+#ifndef NO_MDC2
         EVP_add_digest(EVP_mdc2());
+#endif
 
         data=BIO_new(BIO_s_file());
 
@@ -121,7 +130,7 @@ char *argv[];
 
 
         /* Load the PKCS7 object from a file */
-        if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL)) == NULL) goto err;
+        if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL,NULL)) == NULL) goto err;
 
         /* This stuff is being setup for certificate verification.
          * When using SSL, it could be replaced with a 
diff --git a/src/lib/libssl/src/crypto/rand/Makefile.ssl b/src/lib/libssl/src/crypto/rand/Makefile.ssl
index 014356cb18..be8eea34a2 100644
--- a/src/lib/libssl/src/crypto/rand/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/rand/Makefile.ssl
@@ -22,8 +22,8 @@ TEST= randtest.c
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC=md_rand.c randfile.c rand_lib.c
-LIBOBJ=md_rand.o randfile.o rand_lib.o
+LIBSRC=md_rand.c randfile.c rand_lib.c rand_err.c rand_egd.c
+LIBOBJ=md_rand.o randfile.o rand_lib.o rand_err.o rand_egd.o
 
 SRC= $(LIBSRC)
 
@@ -79,9 +79,14 @@ clean:
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
 md_rand.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
-md_rand.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
-md_rand.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
+md_rand.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+md_rand.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+md_rand.o: ../../include/openssl/rand.h ../../include/openssl/safestack.h
 md_rand.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+rand_egd.o: ../../include/openssl/opensslconf.h ../../include/openssl/rand.h
+rand_err.o: ../../include/openssl/err.h ../../include/openssl/rand.h
 rand_lib.o: ../../include/openssl/rand.h
-randfile.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-randfile.o: ../../include/openssl/opensslconf.h ../../include/openssl/rand.h
+randfile.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+randfile.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+randfile.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
+randfile.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
diff --git a/src/lib/libssl/src/crypto/rand/md_rand.c b/src/lib/libssl/src/crypto/rand/md_rand.c
index c9a071bd22..6b158f0349 100644
--- a/src/lib/libssl/src/crypto/rand/md_rand.c
+++ b/src/lib/libssl/src/crypto/rand/md_rand.c
@@ -56,15 +56,23 @@
  * [including the GNU Public Licence.]
  */
 
+#define ENTROPY_NEEDED 16  /* require 128 bits = 16 bytes of randomness */
+
+#ifndef MD_RAND_DEBUG
+# ifndef NDEBUG
+#   define NDEBUG
+# endif
+#endif
+
+#include <assert.h>
 #include <stdio.h>
-#include <sys/types.h>
-#include <fcntl.h>
 #include <time.h>
 #include <string.h>
 
 #include "openssl/e_os.h"
 
 #include <openssl/crypto.h>
+#include <openssl/err.h>
 
 #if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
 #if !defined(NO_SHA) && !defined(NO_SHA1)
@@ -130,17 +138,23 @@ static int state_num=0,state_index=0;
 static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH];
 static unsigned char md[MD_DIGEST_LENGTH];
 static long md_count[2]={0,0};
+static double entropy=0;
+static int initialized=0;
 
 const char *RAND_version="RAND" OPENSSL_VERSION_PTEXT;
 
 static void ssleay_rand_cleanup(void);
 static void ssleay_rand_seed(const void *buf, int num);
-static void ssleay_rand_bytes(unsigned char *buf, int num);
+static void ssleay_rand_add(const void *buf, int num, double add_entropy);
+static int ssleay_rand_bytes(unsigned char *buf, int num);
+static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
 
 RAND_METHOD rand_ssleay_meth={
         ssleay_rand_seed,
         ssleay_rand_bytes,
         ssleay_rand_cleanup,
+        ssleay_rand_add,
+        ssleay_rand_pseudo_bytes,
         }; 
 
 RAND_METHOD *RAND_SSLeay(void)
@@ -156,22 +170,49 @@ static void ssleay_rand_cleanup(void)
         memset(md,0,MD_DIGEST_LENGTH);
         md_count[0]=0;
         md_count[1]=0;
+        entropy=0;
         }
 
-static void ssleay_rand_seed(const void *buf, int num)
+static void ssleay_rand_add(const void *buf, int num, double add)
         {
-        int i,j,k,st_idx,st_num;
+        int i,j,k,st_idx;
+        long md_c[2];
+        unsigned char local_md[MD_DIGEST_LENGTH];
         MD_CTX m;
 
 #ifdef NORAND
         return;
 #endif
 
+        /*
+         * (Based on the rand(3) manpage)
+         *
+         * The input is chopped up into units of 20 bytes (or less for
+         * the last block).  Each of these blocks is run through the hash
+         * function as follows:  The data passed to the hash function
+         * is the current 'md', the same number of bytes from the 'state'
+         * (the location determined by in incremented looping index) as
+         * the current 'block', the new key data 'block', and 'count'
+         * (which is incremented after each use).
+         * The result of this is kept in 'md' and also xored into the
+         * 'state' at the same locations that were used as input into the
+         * hash function.
+         */
+
         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
         st_idx=state_index;
-        st_num=state_num;
 
-        state_index=(state_index+num);
+        /* use our own copies of the counters so that even
+         * if a concurrent thread seeds with exactly the
+         * same data and uses the same subarray there's _some_
+         * difference */
+        md_c[0] = md_count[0];
+        md_c[1] = md_count[1];
+
+        memcpy(local_md, md, sizeof md);
+
+        /* state_index <= state_num <= STATE_SIZE */
+        state_index += num;
         if (state_index >= STATE_SIZE)
                 {
                 state_index%=STATE_SIZE;
@@ -182,6 +223,14 @@ static void ssleay_rand_seed(const void *buf, int num)
                 if (state_index > state_num)
                         state_num=state_index;
                 }
+        /* state_index <= state_num <= STATE_SIZE */
+
+        /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE]
+         * are what we will use now, but other threads may use them
+         * as well */
+
+        md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
+
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
         for (i=0; i<num; i+=MD_DIGEST_LENGTH)
@@ -190,7 +239,7 @@ static void ssleay_rand_seed(const void *buf, int num)
                 j=(j > MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j;
 
                 MD_Init(&m);
-                MD_Update(&m,md,MD_DIGEST_LENGTH);
+                MD_Update(&m,local_md,MD_DIGEST_LENGTH);
                 k=(st_idx+j)-STATE_SIZE;
                 if (k > 0)
                         {
@@ -201,33 +250,107 @@ static void ssleay_rand_seed(const void *buf, int num)
                         MD_Update(&m,&(state[st_idx]),j);
                         
                 MD_Update(&m,buf,j);
-                MD_Update(&m,(unsigned char *)&(md_count[0]),sizeof(md_count));
-                MD_Final(md,&m);
-                md_count[1]++;
+                MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
+                MD_Final(local_md,&m);
+                md_c[1]++;
 
                 buf=(const char *)buf + j;
 
                 for (k=0; k<j; k++)
                         {
-                        state[st_idx++]^=md[k];
+                        /* Parallel threads may interfere with this,
+                         * but always each byte of the new state is
+                         * the XOR of some previous value of its
+                         * and local_md (itermediate values may be lost).
+                         * Alway using locking could hurt performance more
+                         * than necessary given that conflicts occur only
+                         * when the total seeding is longer than the random
+                         * state. */
+                        state[st_idx++]^=local_md[k];
                         if (st_idx >= STATE_SIZE)
-                                {
                                 st_idx=0;
-                                st_num=STATE_SIZE;
-                                }
                         }
                 }
         memset((char *)&m,0,sizeof(m));
+
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        /* Don't just copy back local_md into md -- this could mean that
+         * other thread's seeding remains without effect (except for
+         * the incremented counter).  By XORing it we keep at least as
+         * much entropy as fits into md. */
+        for (k = 0; k < sizeof md; k++)
+                {
+                md[k] ^= local_md[k];
+                }
+        if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */
+            entropy += add;
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+        
+#ifndef THREADS 
+        assert(md_c[1] == md_count[1]);
+#endif
         }
 
-static void ssleay_rand_bytes(unsigned char *buf, int num)
+static void ssleay_rand_seed(const void *buf, int num)
+        {
+        ssleay_rand_add(buf, num, num);
+        }
+
+static void ssleay_rand_initialize(void)
         {
-        int i,j,k,st_num,st_idx;
-        MD_CTX m;
-        static int init=1;
         unsigned long l;
+#ifndef GETPID_IS_MEANINGLESS
+        pid_t curr_pid = getpid();
+#endif
 #ifdef DEVRANDOM
-        int fd;
+        FILE *fh;
+#endif
+
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+        /* put in some default random data, we need more than just this */
+#ifndef GETPID_IS_MEANINGLESS
+        l=curr_pid;
+        RAND_add(&l,sizeof(l),0);
+        l=getuid();
+        RAND_add(&l,sizeof(l),0);
+#endif
+        l=time(NULL);
+        RAND_add(&l,sizeof(l),0);
+
+#ifdef DEVRANDOM
+        /* Use a random entropy pool device. Linux, FreeBSD and OpenBSD
+         * have this. Use /dev/urandom if you can as /dev/random may block
+         * if it runs out of random entries.  */
+
+        if ((fh = fopen(DEVRANDOM, "r")) != NULL)
+                {
+                unsigned char tmpbuf[ENTROPY_NEEDED];
+                int n;
+                
+                setvbuf(fh, NULL, _IONBF, 0);
+                n=fread((unsigned char *)tmpbuf,1,ENTROPY_NEEDED,fh);
+                fclose(fh);
+                RAND_add(tmpbuf,sizeof tmpbuf,n);
+                memset(tmpbuf,0,n);
+                }
+#endif
+#ifdef PURIFY
+        memset(state,0,STATE_SIZE);
+        memset(md,0,MD_DIGEST_LENGTH);
+#endif
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        initialized=1;
+        }
+
+static int ssleay_rand_bytes(unsigned char *buf, int num)
+        {
+        int i,j,k,st_num,st_idx;
+        int ok;
+        long md_c[2];
+        unsigned char local_md[MD_DIGEST_LENGTH];
+        MD_CTX m;
+#ifndef GETPID_IS_MEANINGLESS
+        pid_t curr_pid = getpid();
 #endif
 
 #ifdef PREDICT
@@ -236,65 +359,63 @@ static void ssleay_rand_bytes(unsigned char *buf, int num)
 
         for (i=0; i<num; i++)
                 buf[i]=val++;
-        return;
+        return(1);
         }
 #endif
 
+        /*
+         * (Based on the rand(3) manpage:)
+         *
+         * For each group of 10 bytes (or less), we do the following:
+         *
+         * Input into the hash function the top 10 bytes from the
+         * local 'md' (which is initialized from the global 'md'
+         * before any bytes are generated), the bytes that are
+         * to be overwritten by the random bytes, and bytes from the
+         * 'state' (incrementing looping index).  From this digest output
+         * (which is kept in 'md'), the top (up to) 10 bytes are
+         * returned to the caller and the bottom (up to) 10 bytes are xored
+         * into the 'state'.
+         * Finally, after we have finished 'num' random bytes for the
+         * caller, 'count' (which is incremented) and the local and global 'md'
+         * are fed into the hash function and the results are kept in the
+         * global 'md'.
+         */
+
         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
 
-        if (init)
+        if (!initialized)
+                ssleay_rand_initialize();
+
+        ok = (entropy >= ENTROPY_NEEDED);
+        if (!ok)
                 {
-                CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
-                /* put in some default random data, we need more than
-                 * just this */
-                RAND_seed(&m,sizeof(m));
-#ifndef MSDOS
-                l=getpid();
-                RAND_seed(&l,sizeof(l));
-                l=getuid();
-                RAND_seed(&l,sizeof(l));
-#endif
-                l=time(NULL);
-                RAND_seed(&l,sizeof(l));
-
-/* #ifdef DEVRANDOM */
-                /* 
-                 * Use a random entropy pool device.
-                 * Linux 1.3.x, OpenBSD, and FreeBSD have
-                 * this. Use /dev/urandom if you can
-                 * as /dev/random will block if it runs out
-                 * of random entries.
+                /* If the PRNG state is not yet unpredictable, then seeing
+                 * the PRNG output may help attackers to determine the new
+                 * state; thus we have to decrease the entropy estimate.
+                 * Once we've had enough initial seeding we don't bother to
+                 * adjust the entropy count, though, because we're not ambitious
+                 * to provide *information-theoretic* randomness.
                  */
-                if ((fd = open(DEVRANDOM, O_RDONLY)) != NULL)
-                        {
-                        unsigned char tmpbuf[32];
-
-                        read(fd, tmpbuf, sizeof(tmpbuf));
-                        /* we don't care how many bytes we read,
-                         * we will just copy the 'stack' if there is
-                         * nothing else :-) */
-                        /* the above comment is EVIL.  Security software
-                         * RELIES ON THESE PRIMITIVES HAVING MORE SECURE
-                         * BEHAVIOUR! Secure entropy is required in
-                         * many cases! */
-                        RAND_seed(tmpbuf,32);
-                        memset(tmpbuf,0,32);
-                        }
-/* #endif */
-#ifdef PURIFY
-                memset(state,0,STATE_SIZE);
-                memset(md,0,MD_DIGEST_LENGTH);
-#endif
-                CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-                init=0;
+                entropy -= num;
+                if (entropy < 0)
+                        entropy = 0;
                 }
 
         st_idx=state_index;
         st_num=state_num;
+        md_c[0] = md_count[0];
+        md_c[1] = md_count[1];
+        memcpy(local_md, md, sizeof md);
+
         state_index+=num;
         if (state_index > state_num)
-                state_index=(state_index%state_num);
+                state_index %= state_num;
+
+        /* state[st_idx], ..., state[(st_idx + num - 1) % st_num]
+         * are now ours (but other threads may use them too) */
 
+        md_count[0] += 1;
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
         while (num > 0)
@@ -302,8 +423,15 @@ static void ssleay_rand_bytes(unsigned char *buf, int num)
                 j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num;
                 num-=j;
                 MD_Init(&m);
-                MD_Update(&m,&(md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2);
-                MD_Update(&m,(unsigned char *)&(md_count[0]),sizeof(md_count));
+#ifndef GETPID_IS_MEANINGLESS
+                if (curr_pid) /* just in the first iteration to save time */
+                        {
+                        MD_Update(&m,(unsigned char*)&curr_pid,sizeof curr_pid);
+                        curr_pid = 0;
+                        }
+#endif
+                MD_Update(&m,&(local_md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2);
+                MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
 #ifndef PURIFY
                 MD_Update(&m,buf,j); /* purify complains */
 #endif
@@ -315,23 +443,57 @@ static void ssleay_rand_bytes(unsigned char *buf, int num)
                         }
                 else
                         MD_Update(&m,&(state[st_idx]),j);
-                MD_Final(md,&m);
+                MD_Final(local_md,&m);
 
                 for (i=0; i<j; i++)
                         {
+                        state[st_idx++]^=local_md[i]; /* may compete with other threads */
+                        *(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
                         if (st_idx >= st_num)
                                 st_idx=0;
-                        state[st_idx++]^=md[i];
-                        *(buf++)=md[i+MD_DIGEST_LENGTH/2];
                         }
                 }
 
         MD_Init(&m);
-        MD_Update(&m,(unsigned char *)&(md_count[0]),sizeof(md_count));
-        md_count[0]++;
+        MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
+        MD_Update(&m,local_md,MD_DIGEST_LENGTH);
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
         MD_Update(&m,md,MD_DIGEST_LENGTH);
         MD_Final(md,&m);
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
         memset(&m,0,sizeof(m));
+        if (ok)
+                return(1);
+        else
+                {
+                RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
+                return(0);
+                }
+        }
+
+/* pseudo-random bytes that are guaranteed to be unique but not
+   unpredictable */
+static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) 
+        {
+        int ret, err;
+
+        ret = RAND_bytes(buf, num);
+        if (ret == 0)
+                {
+                err = ERR_peek_error();
+                if (ERR_GET_LIB(err) == ERR_LIB_RAND &&
+                    ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED)
+                        (void)ERR_get_error();
+                }
+        return (ret);
+        }
+
+int RAND_status(void)
+        {
+        if (!initialized)
+                ssleay_rand_initialize();
+        return (entropy >= ENTROPY_NEEDED);
         }
 
 #ifdef WINDOWS
@@ -358,12 +520,12 @@ static void ssleay_rand_bytes(unsigned char *buf, int num)
  */
 /*
  * I have modified the loading of bytes via RAND_seed() mechanism since
- * the origional would have been very very CPU intensive since RAND_seed()
+ * the original would have been very very CPU intensive since RAND_seed()
  * does an MD5 per 16 bytes of input.  The cost to digest 16 bytes is the same
  * as that to digest 56 bytes.  So under the old system, a screen of
- * 1024*768*256 would have been CPU cost of approximatly 49,000 56 byte MD5
+ * 1024*768*256 would have been CPU cost of approximately 49,000 56 byte MD5
  * digests or digesting 2.7 mbytes.  What I have put in place would
- * be 48 16k MD5 digests, or efectivly 48*16+48 MD5 bytes or 816 kbytes
+ * be 48 16k MD5 digests, or effectively 48*16+48 MD5 bytes or 816 kbytes
  * or about 3.5 times as much.
  * - eric 
  */
diff --git a/src/lib/libssl/src/crypto/rand/md_rand_munged.c b/src/lib/libssl/src/crypto/rand/md_rand_munged.c
new file mode 100644
index 0000000000..1611bf335b
--- /dev/null
+++ b/src/lib/libssl/src/crypto/rand/md_rand_munged.c
@@ -0,0 +1,515 @@
+/* crypto/rand/md_rand.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <sys/types.h>
+#include <fcntl.h>
+#include <time.h>
+#include <string.h>
+
+#include "openssl/e_os.h"
+
+#include <openssl/crypto.h>
+
+#if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
+#if !defined(NO_SHA) && !defined(NO_SHA1)
+#define USE_SHA1_RAND
+#elif !defined(NO_MD5)
+#define USE_MD5_RAND
+#elif !defined(NO_MDC2) && !defined(NO_DES)
+#define USE_MDC2_RAND
+#elif !defined(NO_MD2)
+#define USE_MD2_RAND
+#else
+#error No message digest algorithm available
+#endif
+#endif
+
+/* Changed how the state buffer used.  I now attempt to 'wrap' such
+ * that I don't run over the same locations the next time  go through
+ * the 1023 bytes - many thanks to
+ * Robert J. LeBlanc <rjl@renaissoft.com> for his comments
+ */
+
+#if defined(USE_MD5_RAND)
+#include <openssl/md5.h>
+#define MD_DIGEST_LENGTH        MD5_DIGEST_LENGTH
+#define MD_CTX                  MD5_CTX
+#define MD_Init(a)              MD5_Init(a)
+#define MD_Update(a,b,c)        MD5_Update(a,b,c)
+#define MD_Final(a,b)           MD5_Final(a,b)
+#define MD(a,b,c)               MD5(a,b,c)
+#elif defined(USE_SHA1_RAND)
+#include <openssl/sha.h>
+#define MD_DIGEST_LENGTH        SHA_DIGEST_LENGTH
+#define MD_CTX                  SHA_CTX
+#define MD_Init(a)              SHA1_Init(a)
+#define MD_Update(a,b,c)        SHA1_Update(a,b,c)
+#define MD_Final(a,b)           SHA1_Final(a,b)
+#define MD(a,b,c)               SHA1(a,b,c)
+#elif defined(USE_MDC2_RAND)
+#include <openssl/mdc2.h>
+#define MD_DIGEST_LENGTH        MDC2_DIGEST_LENGTH
+#define MD_CTX                  MDC2_CTX
+#define MD_Init(a)              MDC2_Init(a)
+#define MD_Update(a,b,c)        MDC2_Update(a,b,c)
+#define MD_Final(a,b)           MDC2_Final(a,b)
+#define MD(a,b,c)               MDC2(a,b,c)
+#elif defined(USE_MD2_RAND)
+#include <openssl/md2.h>
+#define MD_DIGEST_LENGTH        MD2_DIGEST_LENGTH
+#define MD_CTX                  MD2_CTX
+#define MD_Init(a)              MD2_Init(a)
+#define MD_Update(a,b,c)        MD2_Update(a,b,c)
+#define MD_Final(a,b)           MD2_Final(a,b)
+#define MD(a,b,c)               MD2(a,b,c)
+#endif
+
+#include <openssl/rand.h>
+
+/* #define NORAND       1 */
+/* #define PREDICT      1 */
+
+#define STATE_SIZE      1023
+static int state_num=0,state_index=0;
+static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH];
+static unsigned char md[MD_DIGEST_LENGTH];
+static long md_count[2]={0,0};
+static double entropy=0;
+static int initialized=0;
+
+const char *RAND_version="RAND" OPENSSL_VERSION_PTEXT;
+
+static void ssleay_rand_cleanup(void);
+static void ssleay_rand_seed(const void *buf, int num);
+static void ssleay_rand_add(const void *buf, int num, double add_entropy);
+static int ssleay_rand_bytes(unsigned char *buf, int num);
+static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
+
+RAND_METHOD rand_ssleay_meth={
+        ssleay_rand_seed,
+        ssleay_rand_bytes,
+        ssleay_rand_cleanup,
+        ssleay_rand_add,
+        ssleay_rand_pseudo_bytes,
+        }; 
+
+RAND_METHOD *RAND_SSLeay(void)
+        {
+        return(&rand_ssleay_meth);
+        }
+
+static void ssleay_rand_cleanup(void)
+        {
+        memset(state,0,sizeof(state));
+        state_num=0;
+        state_index=0;
+        memset(md,0,MD_DIGEST_LENGTH);
+        md_count[0]=0;
+        md_count[1]=0;
+        entropy=0;
+        }
+
+static void ssleay_rand_add(const void *buf, int num, double add)
+        {
+        int i,j,k,st_idx;
+        long md_c[2];
+        unsigned char local_md[MD_DIGEST_LENGTH];
+        MD_CTX m;
+
+#ifdef NORAND
+        return;
+#endif
+
+        /*
+         * (Based on the rand(3) manpage)
+         *
+         * The input is chopped up into units of 20 bytes (or less for
+         * the last block).  Each of these blocks is run through the hash
+         * function as follows:  The data passed to the hash function
+         * is the current 'md', the same number of bytes from the 'state'
+         * (the location determined by in incremented looping index) as
+         * the current 'block', the new key data 'block', and 'count'
+         * (which is incremented after each use).
+         * The result of this is kept in 'md' and also xored into the
+         * 'state' at the same locations that were used as input into the
+         * hash function.
+         */
+
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        st_idx=state_index;
+
+        /* use our own copies of the counters so that even
+         * if a concurrent thread seeds with exactly the
+         * same data and uses the same subarray there's _some_
+         * difference */
+        md_c[0] = md_count[0];
+        md_c[1] = md_count[1];
+
+        memcpy(local_md, md, sizeof md);
+
+        /* state_index <= state_num <= STATE_SIZE */
+        state_index += num;
+        if (state_index >= STATE_SIZE)
+                {
+                state_index%=STATE_SIZE;
+                state_num=STATE_SIZE;
+                }
+        else if (state_num < STATE_SIZE)        
+                {
+                if (state_index > state_num)
+                        state_num=state_index;
+                }
+        /* state_index <= state_num <= STATE_SIZE */
+
+        /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE]
+         * are what we will use now, but other threads may use them
+         * as well */
+
+        md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
+
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
+        for (i=0; i<num; i+=MD_DIGEST_LENGTH)
+                {
+                j=(num-i);
+                j=(j > MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j;
+
+                MD_Init(&m);
+                MD_Update(&m,local_md,MD_DIGEST_LENGTH);
+                k=(st_idx+j)-STATE_SIZE;
+                if (k > 0)
+                        {
+                        MD_Update(&m,&(state[st_idx]),j-k);
+                        MD_Update(&m,&(state[0]),k);
+                        }
+                else
+                        MD_Update(&m,&(state[st_idx]),j);
+                        
+                MD_Update(&m,buf,j);
+                MD_Update(&m,(unsigned char *)&(md_count[0]),sizeof(md_count));
+                MD_Final(md,&m);
+                md_count[1]++;
+
+                buf=(const char *)buf + j;
+
+                for (k=0; k<j; k++)
+                        {
+                        state[st_idx++]^=md[k];
+                        if (st_idx >= STATE_SIZE)
+                                {
+                                st_idx=0;
+                                st_num=STATE_SIZE;
+                                }
+                        }
+                }
+        memset((char *)&m,0,sizeof(m));
+        }
+
+static void ssleay_rand_bytes(unsigned char *buf, int num)
+        {
+        int i,j,k,st_num,st_idx;
+        MD_CTX m;
+        static int init=1;
+        unsigned long l;
+#ifdef DEVRANDOM
+        int fd;
+#endif
+
+#ifdef PREDICT
+        {
+        static unsigned char val=0;
+
+        for (i=0; i<num; i++)
+                buf[i]=val++;
+        return;
+        }
+#endif
+
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+
+        if (init)
+                {
+                CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+                /* put in some default random data, we need more than
+                 * just this */
+                RAND_seed(&m,sizeof(m));
+#ifndef MSDOS
+                l=getpid();
+                RAND_seed(&l,sizeof(l));
+                l=getuid();
+                RAND_seed(&l,sizeof(l));
+#endif
+                l=time(NULL);
+                RAND_seed(&l,sizeof(l));
+
+/* #ifdef DEVRANDOM */
+                /* 
+                 * Use a random entropy pool device.
+                 * Linux 1.3.x, OpenBSD, and FreeBSD have
+                 * this. Use /dev/urandom if you can
+                 * as /dev/random will block if it runs out
+                 * of random entries.
+                 */
+                if ((fd = open(DEVRANDOM, O_RDONLY)) != NULL)
+                        {
+                        unsigned char tmpbuf[32];
+
+                        read(fd, tmpbuf, sizeof(tmpbuf));
+                        /* we don't care how many bytes we read,
+                         * we will just copy the 'stack' if there is
+                         * nothing else :-) */
+                        /* the above comment is EVIL.  Security software
+                         * RELIES ON THESE PRIMITIVES HAVING MORE SECURE
+                         * BEHAVIOUR! Secure entropy is required in
+                         * many cases! */
+                        RAND_seed(tmpbuf,32);
+                        memset(tmpbuf,0,32);
+                        }
+/* #endif */
+#ifdef PURIFY
+                memset(state,0,STATE_SIZE);
+                memset(md,0,MD_DIGEST_LENGTH);
+#endif
+                CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+                init=0;
+                }
+
+        st_idx=state_index;
+        st_num=state_num;
+        state_index+=num;
+        if (state_index > state_num)
+                state_index=(state_index%state_num);
+
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
+        while (num > 0)
+                {
+                j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num;
+                num-=j;
+                MD_Init(&m);
+#ifndef GETPID_IS_MEANINGLESS
+                if (curr_pid) /* just in the first iteration to save time */
+                        {
+                        MD_Update(&m,(unsigned char*)&curr_pid,sizeof curr_pid);
+                        curr_pid = 0;
+                        }
+#endif
+                MD_Update(&m,&(local_md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2);
+                MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
+#ifndef PURIFY
+                MD_Update(&m,buf,j); /* purify complains */
+#endif
+                k=(st_idx+j)-st_num;
+                if (k > 0)
+                        {
+                        MD_Update(&m,&(state[st_idx]),j-k);
+                        MD_Update(&m,&(state[0]),k);
+                        }
+                else
+                        MD_Update(&m,&(state[st_idx]),j);
+                MD_Final(local_md,&m);
+
+                for (i=0; i<j; i++)
+                        {
+                        state[st_idx++]^=local_md[i]; /* may compete with other threads */
+                        *(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
+                        if (st_idx >= st_num)
+                                st_idx=0;
+                        }
+                }
+
+        MD_Init(&m);
+        MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
+        MD_Update(&m,local_md,MD_DIGEST_LENGTH);
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        MD_Update(&m,md,MD_DIGEST_LENGTH);
+        MD_Final(md,&m);
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
+        memset(&m,0,sizeof(m));
+        if (ok)
+                return(1);
+        else
+                {
+                RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
+                return(0);
+                }
+        }
+
+/* pseudo-random bytes that are guaranteed to be unique but not
+   unpredictable */
+static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) 
+        {
+        int ret, err;
+
+        ret = RAND_bytes(buf, num);
+        if (ret == 0)
+                {
+                err = ERR_peek_error();
+                if (ERR_GET_LIB(err) == ERR_LIB_RAND &&
+                    ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED)
+                        (void)ERR_get_error();
+                }
+        return (ret);
+        }
+
+int RAND_status(void)
+        {
+        if (!initialized)
+                ssleay_rand_initialize();
+        return (entropy >= ENTROPY_NEEDED);
+        }
+
+#ifdef WINDOWS
+#include <windows.h>
+#include <openssl/rand.h>
+
+/*****************************************************************************
+ * Initialisation function for the SSL random generator.  Takes the contents
+ * of the screen as random seed.
+ *
+ * Created 960901 by Gertjan van Oosten, gertjan@West.NL, West Consulting B.V.
+ *
+ * Code adapted from
+ * <URL:http://www.microsoft.com/kb/developr/win_dk/q97193.htm>;
+ * the original copyright message is:
+ *
+ *   (C) Copyright Microsoft Corp. 1993.  All rights reserved.
+ *
+ *   You have a royalty-free right to use, modify, reproduce and
+ *   distribute the Sample Files (and/or any modified version) in
+ *   any way you find useful, provided that you agree that
+ *   Microsoft has no warranty obligations or liability for any
+ *   Sample Application Files which are modified.
+ */
+/*
+ * I have modified the loading of bytes via RAND_seed() mechanism since
+ * the original would have been very very CPU intensive since RAND_seed()
+ * does an MD5 per 16 bytes of input.  The cost to digest 16 bytes is the same
+ * as that to digest 56 bytes.  So under the old system, a screen of
+ * 1024*768*256 would have been CPU cost of approximately 49,000 56 byte MD5
+ * digests or digesting 2.7 mbytes.  What I have put in place would
+ * be 48 16k MD5 digests, or effectively 48*16+48 MD5 bytes or 816 kbytes
+ * or about 3.5 times as much.
+ * - eric 
+ */
+void RAND_screen(void)
+{
+  HDC           hScrDC;         /* screen DC */
+  HDC           hMemDC;         /* memory DC */
+  HBITMAP       hBitmap;        /* handle for our bitmap */
+  HBITMAP       hOldBitmap;     /* handle for previous bitmap */
+  BITMAP        bm;             /* bitmap properties */
+  unsigned int  size;           /* size of bitmap */
+  char          *bmbits;        /* contents of bitmap */
+  int           w;              /* screen width */
+  int           h;              /* screen height */
+  int           y;              /* y-coordinate of screen lines to grab */
+  int           n = 16;         /* number of screen lines to grab at a time */
+
+  /* Create a screen DC and a memory DC compatible to screen DC */
+  hScrDC = CreateDC("DISPLAY", NULL, NULL, NULL);
+  hMemDC = CreateCompatibleDC(hScrDC);
+
+  /* Get screen resolution */
+  w = GetDeviceCaps(hScrDC, HORZRES);
+  h = GetDeviceCaps(hScrDC, VERTRES);
+
+  /* Create a bitmap compatible with the screen DC */
+  hBitmap = CreateCompatibleBitmap(hScrDC, w, n);
+
+  /* Select new bitmap into memory DC */
+  hOldBitmap = SelectObject(hMemDC, hBitmap);
+
+  /* Get bitmap properties */
+  GetObject(hBitmap, sizeof(BITMAP), (LPSTR)&bm);
+  size = (unsigned int)bm.bmWidthBytes * bm.bmHeight * bm.bmPlanes;
+
+  bmbits = Malloc(size);
+  if (bmbits) {
+    /* Now go through the whole screen, repeatedly grabbing n lines */
+    for (y = 0; y < h-n; y += n)
+        {
+        unsigned char md[MD_DIGEST_LENGTH];
+
+        /* Bitblt screen DC to memory DC */
+        BitBlt(hMemDC, 0, 0, w, n, hScrDC, 0, y, SRCCOPY);
+
+        /* Copy bitmap bits from memory DC to bmbits */
+        GetBitmapBits(hBitmap, size, bmbits);
+
+        /* Get the MD5 of the bitmap */
+        MD(bmbits,size,md);
+
+        /* Seed the random generator with the MD5 digest */
+        RAND_seed(md, MD_DIGEST_LENGTH);
+        }
+
+    Free(bmbits);
+  }
+
+  /* Select old bitmap back into memory DC */
+  hBitmap = SelectObject(hMemDC, hOldBitmap);
+
+  /* Clean up */
+  DeleteObject(hBitmap);
+  DeleteDC(hMemDC);
+  DeleteDC(hScrDC);
+}
+#endif
diff --git a/src/lib/libssl/src/crypto/rand/rand.h b/src/lib/libssl/src/crypto/rand/rand.h
index fd8ee38366..28f45ec052 100644
--- a/src/lib/libssl/src/crypto/rand/rand.h
+++ b/src/lib/libssl/src/crypto/rand/rand.h
@@ -66,24 +66,45 @@ extern "C" {
 typedef struct rand_meth_st
         {
         void (*seed)(const void *buf, int num);
-        void (*bytes)(unsigned char *buf, int num);
+        int (*bytes)(unsigned char *buf, int num);
         void (*cleanup)(void);
+        void (*add)(const void *buf, int num, double entropy);
+        int (*pseudorand)(unsigned char *buf, int num);
         } RAND_METHOD;
 
 void RAND_set_rand_method(RAND_METHOD *meth);
 RAND_METHOD *RAND_get_rand_method(void );
 RAND_METHOD *RAND_SSLeay(void);
 void RAND_cleanup(void );
-void RAND_bytes(unsigned char *buf,int num);
+int  RAND_bytes(unsigned char *buf,int num);
+int  RAND_pseudo_bytes(unsigned char *buf,int num);
 void RAND_seed(const void *buf,int num);
+void RAND_add(const void *buf,int num,double entropy);
 int  RAND_load_file(const char *file,long max_bytes);
 int  RAND_write_file(const char *file);
-char *RAND_file_name(char *file,int num);
+const char *RAND_file_name(char *file,int num);
+int RAND_status(void);
+int RAND_egd(const char *path);
 #ifdef WINDOWS
 void RAND_screen(void);
 #endif
+void    ERR_load_RAND_strings(void);
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+
+/* Error codes for the RAND functions. */
+
+/* Function codes. */
+#define RAND_F_SSLEAY_RAND_BYTES                         100
+
+/* Reason codes. */
+#define RAND_R_PRNG_NOT_SEEDED                           100
+
 #ifdef  __cplusplus
 }
 #endif
-
 #endif
+
diff --git a/src/lib/libssl/src/crypto/rand/rand_egd.c b/src/lib/libssl/src/crypto/rand/rand_egd.c
new file mode 100644
index 0000000000..d834408bd4
--- /dev/null
+++ b/src/lib/libssl/src/crypto/rand/rand_egd.c
@@ -0,0 +1,110 @@
+/* crypto/rand/rand_egd.c */
+/* Written by Ulf Moeller for the OpenSSL project. */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/rand.h>
+
+/* Query the EGD <URL: http://www.lothar.com/tech/crypto/>.
+ */
+
+#if defined(WIN32) || defined(VMS) || defined(__VMS)
+int RAND_egd(const char *path)
+        {
+        return(-1);
+        }
+#else
+#include <openssl/opensslconf.h>
+#include OPENSSL_UNISTD
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <string.h>
+
+#ifndef offsetof
+#  define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+#endif
+
+int RAND_egd(const char *path)
+        {
+        int ret = -1;
+        struct sockaddr_un addr;
+        int len, num;
+        int fd = -1;
+        unsigned char buf[256];
+
+        memset(&addr, 0, sizeof(addr));
+        addr.sun_family = AF_UNIX;
+        if (strlen(path) > sizeof(addr.sun_path))
+                return (-1);
+        strcpy(addr.sun_path,path);
+        len = offsetof(struct sockaddr_un, sun_path) + strlen(path);
+        fd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (fd == -1) return (-1);
+        if (connect(fd, (struct sockaddr *)&addr, len) == -1) goto err;
+        buf[0] = 1;
+        buf[1] = 255;
+        write(fd, buf, 2);
+        if (read(fd, buf, 1) != 1) goto err;
+    if (buf[0] == 0) goto err;
+        num = read(fd, buf, 255);
+        if (num < 1) goto err;
+        RAND_seed(buf, num);
+        if (RAND_status() == 1)
+                ret = num;
+ err:
+        if (fd != -1) close(fd);
+        return(ret);
+        }
+#endif
diff --git a/src/lib/libssl/src/crypto/rand/rand_err.c b/src/lib/libssl/src/crypto/rand/rand_err.c
new file mode 100644
index 0000000000..d1263edf80
--- /dev/null
+++ b/src/lib/libssl/src/crypto/rand/rand_err.c
@@ -0,0 +1,93 @@
+/* crypto/rand/rand_err.c */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+
+/* BEGIN ERROR CODES */
+#ifndef NO_ERR
+static ERR_STRING_DATA RAND_str_functs[]=
+        {
+{ERR_PACK(0,RAND_F_SSLEAY_RAND_BYTES,0),        "SSLEAY_RAND_BYTES"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA RAND_str_reasons[]=
+        {
+{RAND_R_PRNG_NOT_SEEDED                  ,"prng not seeded"},
+{0,NULL}
+        };
+
+#endif
+
+void ERR_load_RAND_strings(void)
+        {
+        static int init=1;
+
+        if (init)
+                {
+                init=0;
+#ifndef NO_ERR
+                ERR_load_strings(ERR_LIB_RAND,RAND_str_functs);
+                ERR_load_strings(ERR_LIB_RAND,RAND_str_reasons);
+#endif
+
+                }
+        }
diff --git a/src/lib/libssl/src/crypto/rand/rand_lib.c b/src/lib/libssl/src/crypto/rand/rand_lib.c
index 34c6d5b968..b09a300c46 100644
--- a/src/lib/libssl/src/crypto/rand/rand_lib.c
+++ b/src/lib/libssl/src/crypto/rand/rand_lib.c
@@ -57,7 +57,6 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
 #include <time.h>
 #include <openssl/rand.h>
 
@@ -90,9 +89,22 @@ void RAND_seed(const void *buf, int num)
                 rand_meth->seed(buf,num);
         }
 
-void RAND_bytes(unsigned char *buf, int num)
+void RAND_add(const void *buf, int num, double entropy)
         {
         if (rand_meth != NULL)
-                rand_meth->bytes(buf,num);
+                rand_meth->add(buf,num,entropy);
         }
 
+int RAND_bytes(unsigned char *buf, int num)
+        {
+        if (rand_meth != NULL)
+                return rand_meth->bytes(buf,num);
+        return(-1);
+        }
+
+int RAND_pseudo_bytes(unsigned char *buf, int num)
+        {
+        if (rand_meth != NULL)
+                return rand_meth->pseudorand(buf,num);
+        return(-1);
+        }
diff --git a/src/lib/libssl/src/crypto/rand/randfile.c b/src/lib/libssl/src/crypto/rand/randfile.c
index 6829d4ec37..658a8d6b65 100644
--- a/src/lib/libssl/src/crypto/rand/randfile.c
+++ b/src/lib/libssl/src/crypto/rand/randfile.c
@@ -60,22 +60,35 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
 #include "openssl/e_os.h"
 
+#ifdef VMS
+#include <unixio.h>
+#endif
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifdef MAC_OS_pre_X
+# include <stat.h>
+#else
+# include <sys/stat.h>
+#endif
+
+#include <openssl/crypto.h>
 #include <openssl/rand.h>
 
 #undef BUFSIZE
 #define BUFSIZE 1024
 #define RAND_DATA 1024
 
-/* #define RFILE ".rand" - defined in ../../e_os.h */
+/* #define RFILE ".rnd" - defined in ../../e_os.h */
 
 int RAND_load_file(const char *file, long bytes)
         {
+        /* If bytes >= 0, read up to 'bytes' bytes.
+         * if bytes == -1, read complete file. */
+
         MS_STATIC unsigned char buf[BUFSIZE];
         struct stat sb;
         int i,ret=0,n;
@@ -85,23 +98,28 @@ int RAND_load_file(const char *file, long bytes)
 
         i=stat(file,&sb);
         /* If the state fails, put some crap in anyway */
-        RAND_seed(&sb,sizeof(sb));
-        ret+=sizeof(sb);
+        RAND_add(&sb,sizeof(sb),0);
         if (i < 0) return(0);
-        if (bytes <= 0) return(ret);
+        if (bytes == 0) return(ret);
 
         in=fopen(file,"rb");
         if (in == NULL) goto err;
         for (;;)
                 {
-                n=(bytes < BUFSIZE)?(int)bytes:BUFSIZE;
+                if (bytes > 0)
+                        n = (bytes < BUFSIZE)?(int)bytes:BUFSIZE;
+                else
+                        n = BUFSIZE;
                 i=fread(buf,1,n,in);
                 if (i <= 0) break;
                 /* even if n != i, use the full array */
-                RAND_seed(buf,n);
+                RAND_add(buf,n,i);
                 ret+=i;
-                bytes-=n;
-                if (bytes <= 0) break;
+                if (bytes > 0)
+                        {
+                        bytes-=n;
+                        if (bytes == 0) break;
+                        }
                 }
         fclose(in);
         memset(buf,0,BUFSIZE);
@@ -112,29 +130,48 @@ err:
 int RAND_write_file(const char *file)
         {
         unsigned char buf[BUFSIZE];
-        int i,ret=0;
-        FILE *out;
+        int i,ret=0,err=0;
+        FILE *out = NULL;
         int n;
 
-        /* Under VMS, fopen(file, "wb") will craete a new version of the
+#ifdef VMS
+        /* Under VMS, fopen(file, "wb") will create a new version of the
            same file.  This is not good, so let's try updating an existing
-           one, and create file only if it doesn't already exist.  This
-           should be completely harmless on system that have no file
-           versions.                                    -- Richard Levitte */
+           one, and create file only if it doesn't already exist. */
+        /* At the same time, if we just update a file, we also need to
+           truncate it, and unfortunately, ftruncate() and truncate() do
+           not exist everywhere.  All that remains is to delete old versions
+           of the random data file (done at the end). */
+#if 0
         out=fopen(file,"rb+");
-        if (out == NULL && errno == ENOENT)
+        if (out == NULL && errno != ENOENT)
+                goto err;
+#endif
+#endif
+
+        if (out == NULL)
                 {
-                errno = 0;
+#if defined O_CREAT && defined O_EXCL
+                /* chmod(..., 0600) is too late to protect the file,
+                 * permissions should be restrictive from the start */
+                int fd = open(file, O_CREAT | O_EXCL, 0600);
+                if (fd != -1)
+                        out = fdopen(fd, "wb");
+#else           
                 out=fopen(file,"wb");
+#endif
                 }
         if (out == NULL) goto err;
+#ifndef NO_CHMOD
         chmod(file,0600);
+#endif
         n=RAND_DATA;
         for (;;)
                 {
                 i=(n > BUFSIZE)?BUFSIZE:n;
                 n-=BUFSIZE;
-                RAND_bytes(buf,i);
+                if (RAND_bytes(buf,i) <= 0)
+                        err=1;
                 i=fwrite(buf,1,i,out);
                 if (i <= 0)
                         {
@@ -144,13 +181,40 @@ int RAND_write_file(const char *file)
                 ret+=i;
                 if (n <= 0) break;
                 }
+#ifdef VMS
+        /* We may have updated an existing file using mode "rb+",
+         * now remove any old extra bytes */
+#if 0
+        if (ret > 0)
+                ftruncate(fileno(out), ret);
+#else
+        /* Try to delete older versions of the file, until there aren't
+           any */
+        {
+        char *tmpf;
+
+        tmpf = Malloc(strlen(file) + 4);  /* to add ";-1" and a nul */
+        if (tmpf)
+                {
+                strcpy(tmpf, file);
+                strcat(tmpf, ";-1");
+                while(delete(tmpf) == 0)
+                        ;
+                rename(file,";1"); /* Make sure it's version 1, or we
+                                      will reach the limit (32767) at
+                                      some point... */
+                }
+        }
+#endif
+#endif
+
         fclose(out);
         memset(buf,0,BUFSIZE);
 err:
-        return(ret);
+        return(err ? -1 : ret);
         }
 
-char *RAND_file_name(char *buf, int size)
+const char *RAND_file_name(char *buf, int size)
         {
         char *s;
         char *ret=NULL;
diff --git a/src/lib/libssl/src/crypto/rand/randtest.c b/src/lib/libssl/src/crypto/rand/randtest.c
index f0706d779a..da96e3f695 100644
--- a/src/lib/libssl/src/crypto/rand/randtest.c
+++ b/src/lib/libssl/src/crypto/rand/randtest.c
@@ -73,7 +73,7 @@ int main()
         /*double d; */
         long d;
 
-        RAND_bytes(buf,2500);
+        RAND_pseudo_bytes(buf,2500);
 
         n1=0;
         for (i=0; i<16; i++) n2[i]=0;
diff --git a/src/lib/libssl/src/crypto/rc2/rc2speed.c b/src/lib/libssl/src/crypto/rc2/rc2speed.c
index c3da63e77e..9f7f5ccfa3 100644
--- a/src/lib/libssl/src/crypto/rc2/rc2speed.c
+++ b/src/lib/libssl/src/crypto/rc2/rc2speed.c
@@ -183,7 +183,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libssl/src/crypto/rc2/rc2test.c b/src/lib/libssl/src/crypto/rc2/rc2test.c
index 6a5defa6ea..521269ded1 100644
--- a/src/lib/libssl/src/crypto/rc2/rc2test.c
+++ b/src/lib/libssl/src/crypto/rc2/rc2test.c
@@ -72,7 +72,7 @@ int main(int argc, char *argv[])
 #else
 #include <openssl/rc2.h>
 
-unsigned char RC2key[4][16]={
+static unsigned char RC2key[4][16]={
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
          0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
@@ -83,14 +83,14 @@ unsigned char RC2key[4][16]={
          0x08,0x09,0x0A,0x0B,0x0C,0x0D,0x0E,0x0F},
         };
 
-unsigned char RC2plain[4][8]={
+static unsigned char RC2plain[4][8]={
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
         {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
         };
 
-unsigned char RC2cipher[4][8]={
+static unsigned char RC2cipher[4][8]={
         {0x1C,0x19,0x8A,0x83,0x8D,0xF0,0x28,0xB7},
         {0x21,0x82,0x9C,0x78,0xA9,0xF9,0xC0,0x74},
         {0x13,0xDB,0x35,0x17,0xD3,0x21,0x86,0x9E},
diff --git a/src/lib/libssl/src/crypto/rc4/rc4.h b/src/lib/libssl/src/crypto/rc4/rc4.h
index 7418c2a9a2..8556dddab0 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4.h
+++ b/src/lib/libssl/src/crypto/rc4/rc4.h
@@ -77,8 +77,8 @@ typedef struct rc4_key_st
 
  
 const char *RC4_options(void);
-void RC4_set_key(RC4_KEY *key, int len, unsigned char *data);
-void RC4(RC4_KEY *key, unsigned long len, unsigned char *indata,
+void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
+void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
                 unsigned char *outdata);
 
 #ifdef  __cplusplus
diff --git a/src/lib/libssl/src/crypto/rc4/rc4_enc.c b/src/lib/libssl/src/crypto/rc4/rc4_enc.c
index 3256bea8cc..d5f18a3a70 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4_enc.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4_enc.c
@@ -67,7 +67,7 @@
  * Date: Wed, 14 Sep 1994 06:35:31 GMT
  */
 
-void RC4(RC4_KEY *key, unsigned long len, unsigned char *indata,
+void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
              unsigned char *outdata)
         {
         register RC4_INT *d;
@@ -78,6 +78,190 @@ void RC4(RC4_KEY *key, unsigned long len, unsigned char *indata,
         y=key->y;     
         d=key->data; 
 
+#if defined(RC4_CHUNK)
+        /*
+         * The original reason for implementing this(*) was the fact that
+         * pre-21164a Alpha CPUs don't have byte load/store instructions
+         * and e.g. a byte store has to be done with 64-bit load, shift,
+         * and, or and finally 64-bit store. Peaking data and operating
+         * at natural word size made it possible to reduce amount of
+         * instructions as well as to perform early read-ahead without
+         * suffering from RAW (read-after-write) hazard. This resulted
+         * in ~40%(**) performance improvement on 21064 box with gcc.
+         * But it's not only Alpha users who win here:-) Thanks to the
+         * early-n-wide read-ahead this implementation also exhibits
+         * >40% speed-up on SPARC and 20-30% on 64-bit MIPS (depending
+         * on sizeof(RC4_INT)).
+         *
+         * (*)  "this" means code which recognizes the case when input
+         *      and output pointers appear to be aligned at natural CPU
+         *      word boundary
+         * (**) i.e. according to 'apps/openssl speed rc4' benchmark,
+         *      crypto/rc4/rc4speed.c exhibits almost 70% speed-up...
+         *
+         * Cavets.
+         *
+         * - RC4_CHUNK="unsigned long long" should be a #1 choice for
+         *   UltraSPARC. Unfortunately gcc generates very slow code
+         *   (2.5-3 times slower than one generated by Sun's WorkShop
+         *   C) and therefore gcc (at least 2.95 and earlier) should
+         *   always be told that RC4_CHUNK="unsigned long".
+         *
+         *                                      <appro@fy.chalmers.se>
+         */
+
+# define RC4_STEP       ( \
+                        x=(x+1) &0xff,  \
+                        tx=d[x],        \
+                        y=(tx+y)&0xff,  \
+                        ty=d[y],        \
+                        d[y]=tx,        \
+                        d[x]=ty,        \
+                        (RC4_CHUNK)d[(tx+ty)&0xff]\
+                        )
+
+        if ( ( ((unsigned long)indata  & (sizeof(RC4_CHUNK)-1)) | 
+               ((unsigned long)outdata & (sizeof(RC4_CHUNK)-1)) ) == 0 )
+                {
+                RC4_CHUNK ichunk,otp;
+                const union { long one; char little; } is_endian = {1};
+
+                /*
+                 * I reckon we can afford to implement both endian
+                 * cases and to decide which way to take at run-time
+                 * because the machine code appears to be very compact
+                 * and redundant 1-2KB is perfectly tolerable (i.e.
+                 * in case the compiler fails to eliminate it:-). By
+                 * suggestion from Terrel Larson <terr@terralogic.net>
+                 * who also stands for the is_endian union:-)
+                 *
+                 * Special notes.
+                 *
+                 * - is_endian is declared automatic as doing otherwise
+                 *   (declaring static) prevents gcc from eliminating
+                 *   the redundant code;
+                 * - compilers (those I've tried) don't seem to have
+                 *   problems eliminating either the operators guarded
+                 *   by "if (sizeof(RC4_CHUNK)==8)" or the condition
+                 *   expressions themselves so I've got 'em to replace
+                 *   corresponding #ifdefs from the previous version;
+                 * - I chose to let the redundant switch cases when
+                 *   sizeof(RC4_CHUNK)!=8 be (were also #ifdefed
+                 *   before);
+                 * - in case you wonder "&(sizeof(RC4_CHUNK)*8-1)" in
+                 *   [LB]ESHFT guards against "shift is out of range"
+                 *   warnings when sizeof(RC4_CHUNK)!=8 
+                 *
+                 *                      <appro@fy.chalmers.se>
+                 */
+                if (!is_endian.little)
+                        {       /* BIG-ENDIAN CASE */
+# define BESHFT(c)      (((sizeof(RC4_CHUNK)-(c)-1)*8)&(sizeof(RC4_CHUNK)*8-1))
+                        for (;len&-sizeof(RC4_CHUNK);len-=sizeof(RC4_CHUNK))
+                                {
+                                ichunk  = *(RC4_CHUNK *)indata;
+                                otp  = RC4_STEP<<BESHFT(0);
+                                otp |= RC4_STEP<<BESHFT(1);
+                                otp |= RC4_STEP<<BESHFT(2);
+                                otp |= RC4_STEP<<BESHFT(3);
+                                if (sizeof(RC4_CHUNK)==8)
+                                        {
+                                        otp |= RC4_STEP<<BESHFT(4);
+                                        otp |= RC4_STEP<<BESHFT(5);
+                                        otp |= RC4_STEP<<BESHFT(6);
+                                        otp |= RC4_STEP<<BESHFT(7);
+                                        }
+                                *(RC4_CHUNK *)outdata = otp^ichunk;
+                                indata  += sizeof(RC4_CHUNK);
+                                outdata += sizeof(RC4_CHUNK);
+                                }
+                        if (len)
+                                {
+                                RC4_CHUNK mask=(RC4_CHUNK)-1, ochunk;
+
+                                ichunk = *(RC4_CHUNK *)indata;
+                                ochunk = *(RC4_CHUNK *)outdata;
+                                otp = 0;
+                                i = BESHFT(0);
+                                mask <<= (sizeof(RC4_CHUNK)-len)<<3;
+                                switch (len&(sizeof(RC4_CHUNK)-1))
+                                        {
+                                        case 7: otp  = RC4_STEP<<i, i-=8;
+                                        case 6: otp |= RC4_STEP<<i, i-=8;
+                                        case 5: otp |= RC4_STEP<<i, i-=8;
+                                        case 4: otp |= RC4_STEP<<i, i-=8;
+                                        case 3: otp |= RC4_STEP<<i, i-=8;
+                                        case 2: otp |= RC4_STEP<<i, i-=8;
+                                        case 1: otp |= RC4_STEP<<i, i-=8;
+                                        case 0: ; /*
+                                                   * it's never the case,
+                                                   * but it has to be here
+                                                   * for ultrix?
+                                                   */
+                                        }
+                                ochunk &= ~mask;
+                                ochunk |= (otp^ichunk) & mask;
+                                *(RC4_CHUNK *)outdata = ochunk;
+                                }
+                        key->x=x;     
+                        key->y=y;
+                        return;
+                        }
+                else
+                        {       /* LITTLE-ENDIAN CASE */
+# define LESHFT(c)      (((c)*8)&(sizeof(RC4_CHUNK)*8-1))
+                        for (;len&-sizeof(RC4_CHUNK);len-=sizeof(RC4_CHUNK))
+                                {
+                                ichunk  = *(RC4_CHUNK *)indata;
+                                otp  = RC4_STEP;
+                                otp |= RC4_STEP<<8;
+                                otp |= RC4_STEP<<16;
+                                otp |= RC4_STEP<<24;
+                                if (sizeof(RC4_CHUNK)==8)
+                                        {
+                                        otp |= RC4_STEP<<LESHFT(4);
+                                        otp |= RC4_STEP<<LESHFT(5);
+                                        otp |= RC4_STEP<<LESHFT(6);
+                                        otp |= RC4_STEP<<LESHFT(7);
+                                        }
+                                *(RC4_CHUNK *)outdata = otp^ichunk;
+                                indata  += sizeof(RC4_CHUNK);
+                                outdata += sizeof(RC4_CHUNK);
+                                }
+                        if (len)
+                                {
+                                RC4_CHUNK mask=(RC4_CHUNK)-1, ochunk;
+
+                                ichunk = *(RC4_CHUNK *)indata;
+                                ochunk = *(RC4_CHUNK *)outdata;
+                                otp = 0;
+                                i   = 0;
+                                mask >>= (sizeof(RC4_CHUNK)-len)<<3;
+                                switch (len&(sizeof(RC4_CHUNK)-1))
+                                        {
+                                        case 7: otp  = RC4_STEP,    i+=8;
+                                        case 6: otp |= RC4_STEP<<i, i+=8;
+                                        case 5: otp |= RC4_STEP<<i, i+=8;
+                                        case 4: otp |= RC4_STEP<<i, i+=8;
+                                        case 3: otp |= RC4_STEP<<i, i+=8;
+                                        case 2: otp |= RC4_STEP<<i, i+=8;
+                                        case 1: otp |= RC4_STEP<<i, i+=8;
+                                        case 0: ; /*
+                                                   * it's never the case,
+                                                   * but it has to be here
+                                                   * for ultrix?
+                                                   */
+                                        }
+                                ochunk &= ~mask;
+                                ochunk |= (otp^ichunk) & mask;
+                                *(RC4_CHUNK *)outdata = ochunk;
+                                }
+                        key->x=x;     
+                        key->y=y;
+                        return;
+                        }
+                }
+#endif
 #define LOOP(in,out) \
                 x=((x+1)&0xff); \
                 tx=d[x]; \
diff --git a/src/lib/libssl/src/crypto/rc4/rc4_skey.c b/src/lib/libssl/src/crypto/rc4/rc4_skey.c
index c67a445f1f..bb10c1ebe2 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4_skey.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4_skey.c
@@ -85,7 +85,7 @@ const char *RC4_options(void)
  * Date: Wed, 14 Sep 1994 06:35:31 GMT
  */
 
-void RC4_set_key(RC4_KEY *key, int len, register unsigned char *data)
+void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
         {
         register RC4_INT tmp;
         register int id1,id2;
diff --git a/src/lib/libssl/src/crypto/rc4/rc4speed.c b/src/lib/libssl/src/crypto/rc4/rc4speed.c
index 4fb5ebf573..b448f4a5c6 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4speed.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4speed.c
@@ -183,7 +183,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifndef TIMES
-        printf("To get the most acurate results, try to run this\n");
+        printf("To get the most accurate results, try to run this\n");
         printf("program when this computer is idle.\n");
 #endif
 
diff --git a/src/lib/libssl/src/crypto/rc4/rc4test.c b/src/lib/libssl/src/crypto/rc4/rc4test.c
index 5abf8cff30..3914eb6c38 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4test.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4test.c
@@ -69,7 +69,7 @@ int main(int argc, char *argv[])
 #else
 #include <openssl/rc4.h>
 
-unsigned char keys[7][30]={
+static unsigned char keys[7][30]={
         {8,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef},
         {8,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef},
         {8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
@@ -78,8 +78,8 @@ unsigned char keys[7][30]={
         {4,0xef,0x01,0x23,0x45},
         };
 
-unsigned char data_len[7]={8,8,8,20,28,10};
-unsigned char data[7][30]={
+static unsigned char data_len[7]={8,8,8,20,28,10};
+static unsigned char data[7][30]={
         {0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xff},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff},
         {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff},
@@ -94,7 +94,7 @@ unsigned char data[7][30]={
         {0},
         };
 
-unsigned char output[7][30]={
+static unsigned char output[7][30]={
         {0x75,0xb7,0x87,0x80,0x99,0xe0,0xc5,0x96,0x00},
         {0x74,0x94,0xc2,0xe7,0x10,0x4b,0x08,0x79,0x00},
         {0xde,0x18,0x89,0x41,0xa3,0x37,0x5d,0x3a,0x00},
diff --git a/src/lib/libssl/src/crypto/ripemd/Makefile.ssl b/src/lib/libssl/src/crypto/ripemd/Makefile.ssl
index 5b6d1d2599..c6153d4361 100644
--- a/src/lib/libssl/src/crypto/ripemd/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/ripemd/Makefile.ssl
@@ -102,6 +102,7 @@ clean:
 
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
+rmd_dgst.o: ../../include/openssl/opensslconf.h
 rmd_dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/ripemd.h
-rmd_dgst.o: rmd_locl.h rmdconst.h
-rmd_one.o: ../../include/openssl/ripemd.h rmd_locl.h rmdconst.h
+rmd_dgst.o: ../md32_common.h rmd_locl.h rmdconst.h
+rmd_one.o: ../../include/openssl/ripemd.h
diff --git a/src/lib/libssl/src/crypto/ripemd/asm/rips.cpp b/src/lib/libssl/src/crypto/ripemd/asm/rips.cpp
index 321a98443e..f7a13677a9 100644
--- a/src/lib/libssl/src/crypto/ripemd/asm/rips.cpp
+++ b/src/lib/libssl/src/crypto/ripemd/asm/rips.cpp
@@ -34,6 +34,8 @@ void GetTSC(unsigned long& tsc)
 #include <stdlib.h>
 #include <openssl/ripemd.h>
 
+#define ripemd160_block_x86 ripemd160_block_asm_host_order
+
 extern "C" {
 void ripemd160_block_x86(RIPEMD160_CTX *ctx, unsigned char *buffer,int num);
 }
@@ -55,8 +57,10 @@ void main(int argc,char *argv[])
         if (num == 0) num=16;
         if (num > 250) num=16;
         numm=num+2;
+#if 0
         num*=64;
         numm*=64;
+#endif
 
         for (j=0; j<6; j++)
                 {
@@ -71,7 +75,7 @@ void main(int argc,char *argv[])
                         GetTSC(e2);
                         ripemd160_block_x86(&ctx,buffer,num);
                         }
-                printf("ripemd160 (%d bytes) %d %d (%.2f)\n",num,
+                printf("ripemd160 (%d bytes) %d %d (%.2f)\n",num*64,
                         e1-s1,e2-s2,(double)((e1-s1)-(e2-s2))/2);
                 }
         }
diff --git a/src/lib/libssl/src/crypto/ripemd/asm/rm-win32.asm b/src/lib/libssl/src/crypto/ripemd/asm/rm-win32.asm
index bd38791c13..f07d517857 100644
--- a/src/lib/libssl/src/crypto/ripemd/asm/rm-win32.asm
+++ b/src/lib/libssl/src/crypto/ripemd/asm/rm-win32.asm
@@ -8,1965 +8,1966 @@
         .386
 .model FLAT
 _TEXT   SEGMENT
-PUBLIC  _ripemd160_block_x86
+PUBLIC  _ripemd160_block_asm_host_order
 
-_ripemd160_block_x86 PROC NEAR
+_ripemd160_block_asm_host_order PROC NEAR
+        mov     edx,            DWORD PTR 4[esp]
+        mov     eax,            DWORD PTR 8[esp]
         push    esi
-        mov     ecx,            DWORD PTR 16[esp]
+        mov     ecx,            DWORD PTR [edx]
         push    edi
-        mov     esi,            DWORD PTR 16[esp]
+        mov     esi,            DWORD PTR 4[edx]
         push    ebp
-        add     ecx,            esi
+        mov     edi,            DWORD PTR 8[edx]
         push    ebx
-        sub     ecx,            64
-        sub     esp,            88
-        mov     DWORD PTR [esp],ecx
-        mov     edi,            DWORD PTR 108[esp]
+        sub     esp,            108
 L000start:
         ; 
-        mov     eax,            DWORD PTR [esi]
-        mov     ebx,            DWORD PTR 4[esi]
-        mov     DWORD PTR 4[esp],eax
+        mov     ebx,            DWORD PTR [eax]
+        mov     ebp,            DWORD PTR 4[eax]
+        mov     DWORD PTR [esp],ebx
+        mov     DWORD PTR 4[esp],ebp
+        mov     ebx,            DWORD PTR 8[eax]
+        mov     ebp,            DWORD PTR 12[eax]
         mov     DWORD PTR 8[esp],ebx
-        mov     eax,            DWORD PTR 8[esi]
-        mov     ebx,            DWORD PTR 12[esi]
-        mov     DWORD PTR 12[esp],eax
+        mov     DWORD PTR 12[esp],ebp
+        mov     ebx,            DWORD PTR 16[eax]
+        mov     ebp,            DWORD PTR 20[eax]
         mov     DWORD PTR 16[esp],ebx
-        mov     eax,            DWORD PTR 16[esi]
-        mov     ebx,            DWORD PTR 20[esi]
-        mov     DWORD PTR 20[esp],eax
+        mov     DWORD PTR 20[esp],ebp
+        mov     ebx,            DWORD PTR 24[eax]
+        mov     ebp,            DWORD PTR 28[eax]
         mov     DWORD PTR 24[esp],ebx
-        mov     eax,            DWORD PTR 24[esi]
-        mov     ebx,            DWORD PTR 28[esi]
-        mov     DWORD PTR 28[esp],eax
+        mov     DWORD PTR 28[esp],ebp
+        mov     ebx,            DWORD PTR 32[eax]
+        mov     ebp,            DWORD PTR 36[eax]
         mov     DWORD PTR 32[esp],ebx
-        mov     eax,            DWORD PTR 32[esi]
-        mov     ebx,            DWORD PTR 36[esi]
-        mov     DWORD PTR 36[esp],eax
+        mov     DWORD PTR 36[esp],ebp
+        mov     ebx,            DWORD PTR 40[eax]
+        mov     ebp,            DWORD PTR 44[eax]
         mov     DWORD PTR 40[esp],ebx
-        mov     eax,            DWORD PTR 40[esi]
-        mov     ebx,            DWORD PTR 44[esi]
-        mov     DWORD PTR 44[esp],eax
+        mov     DWORD PTR 44[esp],ebp
+        mov     ebx,            DWORD PTR 48[eax]
+        mov     ebp,            DWORD PTR 52[eax]
         mov     DWORD PTR 48[esp],ebx
-        mov     eax,            DWORD PTR 48[esi]
-        mov     ebx,            DWORD PTR 52[esi]
-        mov     DWORD PTR 52[esp],eax
+        mov     DWORD PTR 52[esp],ebp
+        mov     ebx,            DWORD PTR 56[eax]
+        mov     ebp,            DWORD PTR 60[eax]
         mov     DWORD PTR 56[esp],ebx
-        mov     eax,            DWORD PTR 56[esi]
-        mov     ebx,            DWORD PTR 60[esi]
-        mov     DWORD PTR 60[esp],eax
-        mov     DWORD PTR 64[esp],ebx
-        add     esi,            64
-        mov     eax,            DWORD PTR [edi]
-        mov     DWORD PTR 112[esp],esi
-        mov     ebx,            DWORD PTR 4[edi]
-        mov     ecx,            DWORD PTR 8[edi]
-        mov     edx,            DWORD PTR 12[edi]
-        mov     ebp,            DWORD PTR 16[edi]
+        mov     DWORD PTR 60[esp],ebp
+        mov     eax,            edi
+        mov     ebx,            DWORD PTR 12[edx]
+        mov     ebp,            DWORD PTR 16[edx]
         ; 0
-        mov     esi,            ecx
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 4[esp]
-        xor     esi,            ebx
-        add     eax,            edi
-        rol     ecx,            10
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     eax,            11
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR [esp]
+        xor     eax,            esi
+        add     ecx,            edx
+        rol     edi,            10
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     ecx,            11
+        add     ecx,            ebp
         ; 1
-        xor     esi,            ecx
-        mov     edi,            DWORD PTR 8[esp]
-        xor     esi,            eax
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebx,            10
-        add     ebp,            edi
-        xor     esi,            ebx
-        rol     ebp,            14
+        xor     eax,            edi
+        mov     edx,            DWORD PTR 4[esp]
+        xor     eax,            ecx
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     esi,            10
         add     ebp,            edx
+        xor     eax,            esi
+        rol     ebp,            14
+        add     ebp,            ebx
         ; 2
-        mov     edi,            DWORD PTR 12[esp]
-        xor     esi,            ebp
-        add     edx,            edi
-        rol     eax,            10
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     edx,            15
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 8[esp]
+        xor     eax,            ebp
+        add     ebx,            edx
+        rol     ecx,            10
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ebx,            15
+        add     ebx,            edi
         ; 3
-        xor     esi,            eax
-        mov     edi,            DWORD PTR 16[esp]
-        xor     esi,            edx
-        add     ecx,            esi
-        mov     esi,            edx
+        xor     eax,            ecx
+        mov     edx,            DWORD PTR 12[esp]
+        xor     eax,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
         rol     ebp,            10
-        add     ecx,            edi
-        xor     esi,            ebp
-        rol     ecx,            12
-        add     ecx,            ebx
+        add     edi,            edx
+        xor     eax,            ebp
+        rol     edi,            12
+        add     edi,            esi
         ; 4
-        mov     edi,            DWORD PTR 20[esp]
-        xor     esi,            ecx
-        add     ebx,            edi
-        rol     edx,            10
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     ebx,            5
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 16[esp]
+        xor     eax,            edi
+        add     esi,            edx
+        rol     ebx,            10
+        add     esi,            eax
+        mov     eax,            edi
+        rol     esi,            5
+        add     esi,            ecx
         ; 5
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 24[esp]
-        xor     esi,            ebx
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     ecx,            10
-        add     eax,            edi
-        xor     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR 20[esp]
+        xor     eax,            esi
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     edi,            10
+        add     ecx,            edx
+        xor     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 6
-        mov     edi,            DWORD PTR 28[esp]
-        xor     esi,            eax
-        add     ebp,            edi
-        rol     ebx,            10
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebp,            7
+        mov     edx,            DWORD PTR 24[esp]
+        xor     eax,            ecx
         add     ebp,            edx
+        rol     esi,            10
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     ebp,            7
+        add     ebp,            ebx
         ; 7
-        xor     esi,            ebx
-        mov     edi,            DWORD PTR 32[esp]
-        xor     esi,            ebp
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     eax,            10
-        add     edx,            edi
-        xor     esi,            eax
-        rol     edx,            9
-        add     edx,            ecx
+        xor     eax,            esi
+        mov     edx,            DWORD PTR 28[esp]
+        xor     eax,            ebp
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ecx,            10
+        add     ebx,            edx
+        xor     eax,            ecx
+        rol     ebx,            9
+        add     ebx,            edi
         ; 8
-        mov     edi,            DWORD PTR 36[esp]
-        xor     esi,            edx
-        add     ecx,            edi
+        mov     edx,            DWORD PTR 32[esp]
+        xor     eax,            ebx
+        add     edi,            edx
         rol     ebp,            10
-        add     ecx,            esi
-        mov     esi,            edx
-        rol     ecx,            11
-        add     ecx,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
+        rol     edi,            11
+        add     edi,            esi
         ; 9
-        xor     esi,            ebp
-        mov     edi,            DWORD PTR 40[esp]
-        xor     esi,            ecx
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     edx,            10
-        add     ebx,            edi
-        xor     esi,            edx
-        rol     ebx,            13
-        add     ebx,            eax
+        xor     eax,            ebp
+        mov     edx,            DWORD PTR 36[esp]
+        xor     eax,            edi
+        add     esi,            eax
+        mov     eax,            edi
+        rol     ebx,            10
+        add     esi,            edx
+        xor     eax,            ebx
+        rol     esi,            13
+        add     esi,            ecx
         ; 10
-        mov     edi,            DWORD PTR 44[esp]
-        xor     esi,            ebx
-        add     eax,            edi
-        rol     ecx,            10
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     eax,            14
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 40[esp]
+        xor     eax,            esi
+        add     ecx,            edx
+        rol     edi,            10
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 11
-        xor     esi,            ecx
-        mov     edi,            DWORD PTR 48[esp]
-        xor     esi,            eax
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebx,            10
-        add     ebp,            edi
-        xor     esi,            ebx
-        rol     ebp,            15
+        xor     eax,            edi
+        mov     edx,            DWORD PTR 44[esp]
+        xor     eax,            ecx
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     esi,            10
         add     ebp,            edx
+        xor     eax,            esi
+        rol     ebp,            15
+        add     ebp,            ebx
         ; 12
-        mov     edi,            DWORD PTR 52[esp]
-        xor     esi,            ebp
-        add     edx,            edi
-        rol     eax,            10
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     edx,            6
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 48[esp]
+        xor     eax,            ebp
+        add     ebx,            edx
+        rol     ecx,            10
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ebx,            6
+        add     ebx,            edi
         ; 13
-        xor     esi,            eax
-        mov     edi,            DWORD PTR 56[esp]
-        xor     esi,            edx
-        add     ecx,            esi
-        mov     esi,            edx
+        xor     eax,            ecx
+        mov     edx,            DWORD PTR 52[esp]
+        xor     eax,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
         rol     ebp,            10
-        add     ecx,            edi
-        xor     esi,            ebp
-        rol     ecx,            7
-        add     ecx,            ebx
+        add     edi,            edx
+        xor     eax,            ebp
+        rol     edi,            7
+        add     edi,            esi
         ; 14
-        mov     edi,            DWORD PTR 60[esp]
-        xor     esi,            ecx
-        add     ebx,            edi
-        rol     edx,            10
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     ebx,            9
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 56[esp]
+        xor     eax,            edi
+        add     esi,            edx
+        rol     ebx,            10
+        add     esi,            eax
+        mov     eax,            edi
+        rol     esi,            9
+        add     esi,            ecx
         ; 15
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 64[esp]
-        xor     esi,            ebx
-        add     eax,            esi
-        mov     esi,            -1
-        rol     ecx,            10
-        add     eax,            edi
-        mov     edi,            DWORD PTR 32[esp]
-        rol     eax,            8
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR 60[esp]
+        xor     eax,            esi
+        add     ecx,            eax
+        mov     eax,            -1
+        rol     edi,            10
+        add     ecx,            edx
+        mov     edx,            DWORD PTR 28[esp]
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 16
-        add     ebp,            edi
-        mov     edi,            ebx
-        sub     esi,            eax
-        and     edi,            eax
-        and     esi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 20[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            -1
-        rol     ebp,            7
         add     ebp,            edx
+        mov     edx,            esi
+        sub     eax,            ecx
+        and     edx,            ecx
+        and     eax,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 16[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
+        mov     edx,            -1
+        rol     ebp,            7
+        add     ebp,            ebx
         ; 17
-        add     edx,            esi
-        mov     esi,            eax
-        sub     edi,            ebp
-        and     esi,            ebp
-        and     edi,            ebx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 56[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1518500249[esi*1+edx]
-        mov     esi,            -1
-        rol     edx,            6
-        add     edx,            ecx
+        add     ebx,            eax
+        mov     eax,            ecx
+        sub     edx,            ebp
+        and     eax,            ebp
+        and     edx,            esi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 52[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1518500249[eax*1+ebx]
+        mov     eax,            -1
+        rol     ebx,            6
+        add     ebx,            edi
         ; 18
-        add     ecx,            edi
-        mov     edi,            ebp
-        sub     esi,            edx
-        and     edi,            edx
-        and     esi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 8[esp]
+        add     edi,            edx
+        mov     edx,            ebp
+        sub     eax,            ebx
+        and     edx,            ebx
+        and     eax,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 4[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1518500249[edi*1+ecx]
-        mov     edi,            -1
-        rol     ecx,            8
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1518500249[edx*1+edi]
+        mov     edx,            -1
+        rol     edi,            8
+        add     edi,            esi
         ; 19
-        add     ebx,            esi
-        mov     esi,            edx
-        sub     edi,            ecx
-        and     esi,            ecx
-        and     edi,            ebp
-        or      esi,            edi
-        mov     edi,            DWORD PTR 44[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1518500249[esi*1+ebx]
-        mov     esi,            -1
-        rol     ebx,            13
-        add     ebx,            eax
+        add     esi,            eax
+        mov     eax,            ebx
+        sub     edx,            edi
+        and     eax,            edi
+        and     edx,            ebp
+        or      eax,            edx
+        mov     edx,            DWORD PTR 40[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1518500249[eax*1+esi]
+        mov     eax,            -1
+        rol     esi,            13
+        add     esi,            ecx
         ; 20
-        add     eax,            edi
-        mov     edi,            ecx
-        sub     esi,            ebx
-        and     edi,            ebx
-        and     esi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 28[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1518500249[edi*1+eax]
-        mov     edi,            -1
-        rol     eax,            11
-        add     eax,            ebp
+        add     ecx,            edx
+        mov     edx,            edi
+        sub     eax,            esi
+        and     edx,            esi
+        and     eax,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 24[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1518500249[edx*1+ecx]
+        mov     edx,            -1
+        rol     ecx,            11
+        add     ecx,            ebp
         ; 21
-        add     ebp,            esi
-        mov     esi,            ebx
-        sub     edi,            eax
-        and     esi,            eax
-        and     edi,            ecx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 64[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1518500249[esi*1+ebp]
-        mov     esi,            -1
+        add     ebp,            eax
+        mov     eax,            esi
+        sub     edx,            ecx
+        and     eax,            ecx
+        and     edx,            edi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 60[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1518500249[eax*1+ebp]
+        mov     eax,            -1
         rol     ebp,            9
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 22
-        add     edx,            edi
-        mov     edi,            eax
-        sub     esi,            ebp
-        and     edi,            ebp
-        and     esi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 16[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1518500249[edi*1+edx]
-        mov     edi,            -1
-        rol     edx,            7
-        add     edx,            ecx
+        add     ebx,            edx
+        mov     edx,            ecx
+        sub     eax,            ebp
+        and     edx,            ebp
+        and     eax,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 12[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1518500249[edx*1+ebx]
+        mov     edx,            -1
+        rol     ebx,            7
+        add     ebx,            edi
         ; 23
-        add     ecx,            esi
-        mov     esi,            ebp
-        sub     edi,            edx
-        and     esi,            edx
-        and     edi,            eax
-        or      esi,            edi
-        mov     edi,            DWORD PTR 52[esp]
+        add     edi,            eax
+        mov     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            ebx
+        and     edx,            ecx
+        or      eax,            edx
+        mov     edx,            DWORD PTR 48[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1518500249[esi*1+ecx]
-        mov     esi,            -1
-        rol     ecx,            15
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1518500249[eax*1+edi]
+        mov     eax,            -1
+        rol     edi,            15
+        add     edi,            esi
         ; 24
-        add     ebx,            edi
-        mov     edi,            edx
-        sub     esi,            ecx
-        and     edi,            ecx
-        and     esi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 4[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1518500249[edi*1+ebx]
-        mov     edi,            -1
-        rol     ebx,            7
-        add     ebx,            eax
+        add     esi,            edx
+        mov     edx,            ebx
+        sub     eax,            edi
+        and     edx,            edi
+        and     eax,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR [esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1518500249[edx*1+esi]
+        mov     edx,            -1
+        rol     esi,            7
+        add     esi,            ecx
         ; 25
-        add     eax,            esi
-        mov     esi,            ecx
-        sub     edi,            ebx
-        and     esi,            ebx
-        and     edi,            edx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 40[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1518500249[esi*1+eax]
-        mov     esi,            -1
-        rol     eax,            12
-        add     eax,            ebp
+        add     ecx,            eax
+        mov     eax,            edi
+        sub     edx,            esi
+        and     eax,            esi
+        and     edx,            ebx
+        or      eax,            edx
+        mov     edx,            DWORD PTR 36[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1518500249[eax*1+ecx]
+        mov     eax,            -1
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 26
-        add     ebp,            edi
-        mov     edi,            ebx
-        sub     esi,            eax
-        and     edi,            eax
-        and     esi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 24[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            -1
-        rol     ebp,            15
         add     ebp,            edx
+        mov     edx,            esi
+        sub     eax,            ecx
+        and     edx,            ecx
+        and     eax,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 20[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
+        mov     edx,            -1
+        rol     ebp,            15
+        add     ebp,            ebx
         ; 27
-        add     edx,            esi
-        mov     esi,            eax
-        sub     edi,            ebp
-        and     esi,            ebp
-        and     edi,            ebx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 12[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1518500249[esi*1+edx]
-        mov     esi,            -1
-        rol     edx,            9
-        add     edx,            ecx
+        add     ebx,            eax
+        mov     eax,            ecx
+        sub     edx,            ebp
+        and     eax,            ebp
+        and     edx,            esi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 8[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1518500249[eax*1+ebx]
+        mov     eax,            -1
+        rol     ebx,            9
+        add     ebx,            edi
         ; 28
-        add     ecx,            edi
-        mov     edi,            ebp
-        sub     esi,            edx
-        and     edi,            edx
-        and     esi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 60[esp]
+        add     edi,            edx
+        mov     edx,            ebp
+        sub     eax,            ebx
+        and     edx,            ebx
+        and     eax,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 56[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1518500249[edi*1+ecx]
-        mov     edi,            -1
-        rol     ecx,            11
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1518500249[edx*1+edi]
+        mov     edx,            -1
+        rol     edi,            11
+        add     edi,            esi
         ; 29
-        add     ebx,            esi
-        mov     esi,            edx
-        sub     edi,            ecx
-        and     esi,            ecx
-        and     edi,            ebp
-        or      esi,            edi
-        mov     edi,            DWORD PTR 48[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1518500249[esi*1+ebx]
-        mov     esi,            -1
-        rol     ebx,            7
-        add     ebx,            eax
+        add     esi,            eax
+        mov     eax,            ebx
+        sub     edx,            edi
+        and     eax,            edi
+        and     edx,            ebp
+        or      eax,            edx
+        mov     edx,            DWORD PTR 44[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1518500249[eax*1+esi]
+        mov     eax,            -1
+        rol     esi,            7
+        add     esi,            ecx
         ; 30
-        add     eax,            edi
-        mov     edi,            ecx
-        sub     esi,            ebx
-        and     edi,            ebx
-        and     esi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 36[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1518500249[edi*1+eax]
-        mov     edi,            -1
-        rol     eax,            13
-        add     eax,            ebp
+        add     ecx,            edx
+        mov     edx,            edi
+        sub     eax,            esi
+        and     edx,            esi
+        and     eax,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 32[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1518500249[edx*1+ecx]
+        mov     edx,            -1
+        rol     ecx,            13
+        add     ecx,            ebp
         ; 31
-        add     ebp,            esi
-        mov     esi,            ebx
-        sub     edi,            eax
-        and     esi,            eax
-        and     edi,            ecx
-        or      esi,            edi
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1518500249[esi*1+ebp]
-        sub     edi,            eax
+        add     ebp,            eax
+        mov     eax,            esi
+        sub     edx,            ecx
+        and     eax,            ecx
+        and     edx,            edi
+        or      eax,            edx
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1518500249[eax*1+ebp]
+        sub     edx,            ecx
         rol     ebp,            12
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 32
-        mov     esi,            DWORD PTR 16[esp]
-        or      edi,            ebp
-        add     edx,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1859775393[edi*1+edx]
-        sub     esi,            ebp
-        rol     edx,            11
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 12[esp]
+        or      edx,            ebp
+        add     ebx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1859775393[edx*1+ebx]
+        sub     eax,            ebp
+        rol     ebx,            11
+        add     ebx,            edi
         ; 33
-        mov     edi,            DWORD PTR 44[esp]
-        or      esi,            edx
-        add     ecx,            edi
-        xor     esi,            eax
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 40[esp]
+        or      eax,            ebx
+        add     edi,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1859775393[esi*1+ecx]
-        sub     edi,            edx
-        rol     ecx,            13
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1859775393[eax*1+edi]
+        sub     edx,            ebx
+        rol     edi,            13
+        add     edi,            esi
         ; 34
-        mov     esi,            DWORD PTR 60[esp]
-        or      edi,            ecx
-        add     ebx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1859775393[edi*1+ebx]
-        sub     esi,            ecx
-        rol     ebx,            6
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 56[esp]
+        or      edx,            edi
+        add     esi,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1859775393[edx*1+esi]
+        sub     eax,            edi
+        rol     esi,            6
+        add     esi,            ecx
         ; 35
-        mov     edi,            DWORD PTR 20[esp]
-        or      esi,            ebx
-        add     eax,            edi
-        xor     esi,            edx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        sub     edi,            ebx
-        rol     eax,            7
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 16[esp]
+        or      eax,            esi
+        add     ecx,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        sub     edx,            esi
+        rol     ecx,            7
+        add     ecx,            ebp
         ; 36
-        mov     esi,            DWORD PTR 40[esp]
-        or      edi,            eax
-        add     ebp,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1859775393[edi*1+ebp]
-        sub     esi,            eax
+        mov     eax,            DWORD PTR 36[esp]
+        or      edx,            ecx
+        add     ebp,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1859775393[edx*1+ebp]
+        sub     eax,            ecx
         rol     ebp,            14
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 37
-        mov     edi,            DWORD PTR 64[esp]
-        or      esi,            ebp
-        add     edx,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1859775393[esi*1+edx]
-        sub     edi,            ebp
-        rol     edx,            9
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 60[esp]
+        or      eax,            ebp
+        add     ebx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
+        sub     edx,            ebp
+        rol     ebx,            9
+        add     ebx,            edi
         ; 38
-        mov     esi,            DWORD PTR 36[esp]
-        or      edi,            edx
-        add     ecx,            esi
-        xor     edi,            eax
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 32[esp]
+        or      edx,            ebx
+        add     edi,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1859775393[edi*1+ecx]
-        sub     esi,            edx
-        rol     ecx,            13
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1859775393[edx*1+edi]
+        sub     eax,            ebx
+        rol     edi,            13
+        add     edi,            esi
         ; 39
-        mov     edi,            DWORD PTR 8[esp]
-        or      esi,            ecx
-        add     ebx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1859775393[esi*1+ebx]
-        sub     edi,            ecx
-        rol     ebx,            15
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 4[esp]
+        or      eax,            edi
+        add     esi,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1859775393[eax*1+esi]
+        sub     edx,            edi
+        rol     esi,            15
+        add     esi,            ecx
         ; 40
-        mov     esi,            DWORD PTR 12[esp]
-        or      edi,            ebx
-        add     eax,            esi
-        xor     edi,            edx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1859775393[edi*1+eax]
-        sub     esi,            ebx
-        rol     eax,            14
-        add     eax,            ebp
+        mov     eax,            DWORD PTR 8[esp]
+        or      edx,            esi
+        add     ecx,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1859775393[edx*1+ecx]
+        sub     eax,            esi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 41
-        mov     edi,            DWORD PTR 32[esp]
-        or      esi,            eax
-        add     ebp,            edi
-        xor     esi,            ecx
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1859775393[esi*1+ebp]
-        sub     edi,            eax
-        rol     ebp,            8
+        mov     edx,            DWORD PTR 28[esp]
+        or      eax,            ecx
         add     ebp,            edx
+        xor     eax,            edi
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1859775393[eax*1+ebp]
+        sub     edx,            ecx
+        rol     ebp,            8
+        add     ebp,            ebx
         ; 42
-        mov     esi,            DWORD PTR 4[esp]
-        or      edi,            ebp
-        add     edx,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1859775393[edi*1+edx]
-        sub     esi,            ebp
-        rol     edx,            13
-        add     edx,            ecx
+        mov     eax,            DWORD PTR [esp]
+        or      edx,            ebp
+        add     ebx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1859775393[edx*1+ebx]
+        sub     eax,            ebp
+        rol     ebx,            13
+        add     ebx,            edi
         ; 43
-        mov     edi,            DWORD PTR 28[esp]
-        or      esi,            edx
-        add     ecx,            edi
-        xor     esi,            eax
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 24[esp]
+        or      eax,            ebx
+        add     edi,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1859775393[esi*1+ecx]
-        sub     edi,            edx
-        rol     ecx,            6
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1859775393[eax*1+edi]
+        sub     edx,            ebx
+        rol     edi,            6
+        add     edi,            esi
         ; 44
-        mov     esi,            DWORD PTR 56[esp]
-        or      edi,            ecx
-        add     ebx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1859775393[edi*1+ebx]
-        sub     esi,            ecx
-        rol     ebx,            5
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 52[esp]
+        or      edx,            edi
+        add     esi,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1859775393[edx*1+esi]
+        sub     eax,            edi
+        rol     esi,            5
+        add     esi,            ecx
         ; 45
-        mov     edi,            DWORD PTR 48[esp]
-        or      esi,            ebx
-        add     eax,            edi
-        xor     esi,            edx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        sub     edi,            ebx
-        rol     eax,            12
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 44[esp]
+        or      eax,            esi
+        add     ecx,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        sub     edx,            esi
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 46
-        mov     esi,            DWORD PTR 24[esp]
-        or      edi,            eax
-        add     ebp,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1859775393[edi*1+ebp]
-        sub     esi,            eax
+        mov     eax,            DWORD PTR 20[esp]
+        or      edx,            ecx
+        add     ebp,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1859775393[edx*1+ebp]
+        sub     eax,            ecx
         rol     ebp,            7
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 47
-        mov     edi,            DWORD PTR 52[esp]
-        or      esi,            ebp
-        add     edx,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1859775393[esi*1+edx]
-        mov     esi,            eax
-        rol     edx,            5
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 48[esp]
+        or      eax,            ebp
+        add     ebx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
+        mov     eax,            ecx
+        rol     ebx,            5
+        add     ebx,            edi
         ; 48
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 8[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 4[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2400959708[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            11
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2400959708[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            11
+        add     edi,            esi
         ; 49
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 40[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2400959708[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            12
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 36[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2400959708[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            12
+        add     esi,            ecx
         ; 50
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 48[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2400959708[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            14
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 44[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2400959708[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 51
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 44[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2400959708[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 40[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2400959708[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            15
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 52
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 4[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2400959708[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            14
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR [esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2400959708[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            14
+        add     ebx,            edi
         ; 53
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 36[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 32[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2400959708[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            15
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2400959708[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            15
+        add     edi,            esi
         ; 54
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 52[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2400959708[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            9
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 48[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2400959708[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            9
+        add     esi,            ecx
         ; 55
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 20[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2400959708[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 16[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2400959708[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 56
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 56[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2400959708[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 52[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2400959708[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            9
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 57
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 16[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2400959708[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            14
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 12[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2400959708[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            14
+        add     ebx,            edi
         ; 58
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 32[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 28[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2400959708[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            5
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2400959708[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            5
+        add     edi,            esi
         ; 59
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 64[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2400959708[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            6
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 60[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2400959708[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            6
+        add     esi,            ecx
         ; 60
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 60[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2400959708[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 56[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2400959708[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 61
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 24[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2400959708[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 20[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2400959708[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            6
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 62
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 28[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2400959708[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            5
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 24[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2400959708[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            5
+        add     ebx,            edi
         ; 63
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 12[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 8[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2400959708[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        sub     edi,            ebp
-        rol     ecx,            12
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2400959708[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        sub     edx,            ebp
+        rol     edi,            12
+        add     edi,            esi
         ; 64
-        mov     esi,            DWORD PTR 20[esp]
-        or      edi,            edx
-        add     ebx,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2840853838[edi*1+ebx]
-        sub     esi,            edx
-        rol     ebx,            9
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 16[esp]
+        or      edx,            ebx
+        add     esi,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2840853838[edx*1+esi]
+        sub     eax,            ebx
+        rol     esi,            9
+        add     esi,            ecx
         ; 65
-        mov     edi,            DWORD PTR 4[esp]
-        or      esi,            ecx
-        add     eax,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2840853838[esi*1+eax]
-        sub     edi,            ecx
-        rol     eax,            15
-        add     eax,            ebp
+        mov     edx,            DWORD PTR [esp]
+        or      eax,            edi
+        add     ecx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2840853838[eax*1+ecx]
+        sub     edx,            edi
+        rol     ecx,            15
+        add     ecx,            ebp
         ; 66
-        mov     esi,            DWORD PTR 24[esp]
-        or      edi,            ebx
-        add     ebp,            esi
-        xor     edi,            eax
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2840853838[edi*1+ebp]
-        sub     esi,            ebx
+        mov     eax,            DWORD PTR 20[esp]
+        or      edx,            esi
+        add     ebp,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2840853838[edx*1+ebp]
+        sub     eax,            esi
         rol     ebp,            5
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 67
-        mov     edi,            DWORD PTR 40[esp]
-        or      esi,            eax
-        add     edx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2840853838[esi*1+edx]
-        sub     edi,            eax
-        rol     edx,            11
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 36[esp]
+        or      eax,            ecx
+        add     ebx,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2840853838[eax*1+ebx]
+        sub     edx,            ecx
+        rol     ebx,            11
+        add     ebx,            edi
         ; 68
-        mov     esi,            DWORD PTR 32[esp]
-        or      edi,            ebp
-        add     ecx,            esi
-        xor     edi,            edx
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 28[esp]
+        or      edx,            ebp
+        add     edi,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2840853838[edi*1+ecx]
-        sub     esi,            ebp
-        rol     ecx,            6
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2840853838[edx*1+edi]
+        sub     eax,            ebp
+        rol     edi,            6
+        add     edi,            esi
         ; 69
-        mov     edi,            DWORD PTR 52[esp]
-        or      esi,            edx
-        add     ebx,            edi
-        xor     esi,            ecx
-        mov     edi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2840853838[esi*1+ebx]
-        sub     edi,            edx
-        rol     ebx,            8
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 48[esp]
+        or      eax,            ebx
+        add     esi,            edx
+        xor     eax,            edi
+        mov     edx,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2840853838[eax*1+esi]
+        sub     edx,            ebx
+        rol     esi,            8
+        add     esi,            ecx
         ; 70
-        mov     esi,            DWORD PTR 12[esp]
-        or      edi,            ecx
-        add     eax,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2840853838[edi*1+eax]
-        sub     esi,            ecx
-        rol     eax,            13
-        add     eax,            ebp
+        mov     eax,            DWORD PTR 8[esp]
+        or      edx,            edi
+        add     ecx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2840853838[edx*1+ecx]
+        sub     eax,            edi
+        rol     ecx,            13
+        add     ecx,            ebp
         ; 71
-        mov     edi,            DWORD PTR 44[esp]
-        or      esi,            ebx
-        add     ebp,            edi
-        xor     esi,            eax
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2840853838[esi*1+ebp]
-        sub     edi,            ebx
-        rol     ebp,            12
+        mov     edx,            DWORD PTR 40[esp]
+        or      eax,            esi
         add     ebp,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2840853838[eax*1+ebp]
+        sub     edx,            esi
+        rol     ebp,            12
+        add     ebp,            ebx
         ; 72
-        mov     esi,            DWORD PTR 60[esp]
-        or      edi,            eax
-        add     edx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2840853838[edi*1+edx]
-        sub     esi,            eax
-        rol     edx,            5
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 56[esp]
+        or      edx,            ecx
+        add     ebx,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2840853838[edx*1+ebx]
+        sub     eax,            ecx
+        rol     ebx,            5
+        add     ebx,            edi
         ; 73
-        mov     edi,            DWORD PTR 8[esp]
-        or      esi,            ebp
-        add     ecx,            edi
-        xor     esi,            edx
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 4[esp]
+        or      eax,            ebp
+        add     edi,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2840853838[esi*1+ecx]
-        sub     edi,            ebp
-        rol     ecx,            12
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2840853838[eax*1+edi]
+        sub     edx,            ebp
+        rol     edi,            12
+        add     edi,            esi
         ; 74
-        mov     esi,            DWORD PTR 16[esp]
-        or      edi,            edx
-        add     ebx,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2840853838[edi*1+ebx]
-        sub     esi,            edx
-        rol     ebx,            13
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 12[esp]
+        or      edx,            ebx
+        add     esi,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2840853838[edx*1+esi]
+        sub     eax,            ebx
+        rol     esi,            13
+        add     esi,            ecx
         ; 75
-        mov     edi,            DWORD PTR 36[esp]
-        or      esi,            ecx
-        add     eax,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2840853838[esi*1+eax]
-        sub     edi,            ecx
-        rol     eax,            14
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 32[esp]
+        or      eax,            edi
+        add     ecx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2840853838[eax*1+ecx]
+        sub     edx,            edi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 76
-        mov     esi,            DWORD PTR 48[esp]
-        or      edi,            ebx
-        add     ebp,            esi
-        xor     edi,            eax
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2840853838[edi*1+ebp]
-        sub     esi,            ebx
+        mov     eax,            DWORD PTR 44[esp]
+        or      edx,            esi
+        add     ebp,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2840853838[edx*1+ebp]
+        sub     eax,            esi
         rol     ebp,            11
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 77
-        mov     edi,            DWORD PTR 28[esp]
-        or      esi,            eax
-        add     edx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2840853838[esi*1+edx]
-        sub     edi,            eax
-        rol     edx,            8
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 24[esp]
+        or      eax,            ecx
+        add     ebx,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2840853838[eax*1+ebx]
+        sub     edx,            ecx
+        rol     ebx,            8
+        add     ebx,            edi
         ; 78
-        mov     esi,            DWORD PTR 64[esp]
-        or      edi,            ebp
-        add     ecx,            esi
-        xor     edi,            edx
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 60[esp]
+        or      edx,            ebp
+        add     edi,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2840853838[edi*1+ecx]
-        sub     esi,            ebp
-        rol     ecx,            5
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2840853838[edx*1+edi]
+        sub     eax,            ebp
+        rol     edi,            5
+        add     edi,            esi
         ; 79
-        mov     edi,            DWORD PTR 56[esp]
-        or      esi,            edx
-        add     ebx,            edi
-        xor     esi,            ecx
-        mov     edi,            DWORD PTR 108[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2840853838[esi*1+ebx]
-        mov     DWORD PTR 68[esp],eax
-        rol     ebx,            6
-        add     ebx,            eax
-        mov     eax,            DWORD PTR [edi]
-        mov     DWORD PTR 72[esp],ebx
-        mov     DWORD PTR 76[esp],ecx
-        mov     ebx,            DWORD PTR 4[edi]
-        mov     DWORD PTR 80[esp],edx
-        mov     ecx,            DWORD PTR 8[edi]
-        mov     DWORD PTR 84[esp],ebp
-        mov     edx,            DWORD PTR 12[edi]
-        mov     ebp,            DWORD PTR 16[edi]
+        mov     edx,            DWORD PTR 52[esp]
+        or      eax,            ebx
+        add     esi,            edx
+        xor     eax,            edi
+        mov     edx,            DWORD PTR 128[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2840853838[eax*1+esi]
+        mov     DWORD PTR 64[esp],ecx
+        rol     esi,            6
+        add     esi,            ecx
+        mov     ecx,            DWORD PTR [edx]
+        mov     DWORD PTR 68[esp],esi
+        mov     DWORD PTR 72[esp],edi
+        mov     esi,            DWORD PTR 4[edx]
+        mov     DWORD PTR 76[esp],ebx
+        mov     edi,            DWORD PTR 8[edx]
+        mov     DWORD PTR 80[esp],ebp
+        mov     ebx,            DWORD PTR 12[edx]
+        mov     ebp,            DWORD PTR 16[edx]
         ; 80
-        mov     edi,            -1
-        sub     edi,            edx
-        mov     esi,            DWORD PTR 24[esp]
-        or      edi,            ecx
-        add     eax,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1352829926[edi*1+eax]
-        sub     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        mov     edx,            -1
+        sub     edx,            ebx
+        mov     eax,            DWORD PTR 20[esp]
+        or      edx,            edi
+        add     ecx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1352829926[edx*1+ecx]
+        sub     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 81
-        mov     edi,            DWORD PTR 60[esp]
-        or      esi,            ebx
-        add     ebp,            edi
-        xor     esi,            eax
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1352829926[esi*1+ebp]
-        sub     edi,            ebx
-        rol     ebp,            9
+        mov     edx,            DWORD PTR 56[esp]
+        or      eax,            esi
         add     ebp,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1352829926[eax*1+ebp]
+        sub     edx,            esi
+        rol     ebp,            9
+        add     ebp,            ebx
         ; 82
-        mov     esi,            DWORD PTR 32[esp]
-        or      edi,            eax
-        add     edx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1352829926[edi*1+edx]
-        sub     esi,            eax
-        rol     edx,            9
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 28[esp]
+        or      edx,            ecx
+        add     ebx,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1352829926[edx*1+ebx]
+        sub     eax,            ecx
+        rol     ebx,            9
+        add     ebx,            edi
         ; 83
-        mov     edi,            DWORD PTR 4[esp]
-        or      esi,            ebp
-        add     ecx,            edi
-        xor     esi,            edx
-        mov     edi,            -1
+        mov     edx,            DWORD PTR [esp]
+        or      eax,            ebp
+        add     edi,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1352829926[esi*1+ecx]
-        sub     edi,            ebp
-        rol     ecx,            11
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1352829926[eax*1+edi]
+        sub     edx,            ebp
+        rol     edi,            11
+        add     edi,            esi
         ; 84
-        mov     esi,            DWORD PTR 40[esp]
-        or      edi,            edx
-        add     ebx,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1352829926[edi*1+ebx]
-        sub     esi,            edx
-        rol     ebx,            13
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 36[esp]
+        or      edx,            ebx
+        add     esi,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1352829926[edx*1+esi]
+        sub     eax,            ebx
+        rol     esi,            13
+        add     esi,            ecx
         ; 85
-        mov     edi,            DWORD PTR 12[esp]
-        or      esi,            ecx
-        add     eax,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1352829926[esi*1+eax]
-        sub     edi,            ecx
-        rol     eax,            15
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 8[esp]
+        or      eax,            edi
+        add     ecx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1352829926[eax*1+ecx]
+        sub     edx,            edi
+        rol     ecx,            15
+        add     ecx,            ebp
         ; 86
-        mov     esi,            DWORD PTR 48[esp]
-        or      edi,            ebx
-        add     ebp,            esi
-        xor     edi,            eax
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1352829926[edi*1+ebp]
-        sub     esi,            ebx
+        mov     eax,            DWORD PTR 44[esp]
+        or      edx,            esi
+        add     ebp,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1352829926[edx*1+ebp]
+        sub     eax,            esi
         rol     ebp,            15
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 87
-        mov     edi,            DWORD PTR 20[esp]
-        or      esi,            eax
-        add     edx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1352829926[esi*1+edx]
-        sub     edi,            eax
-        rol     edx,            5
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 16[esp]
+        or      eax,            ecx
+        add     ebx,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1352829926[eax*1+ebx]
+        sub     edx,            ecx
+        rol     ebx,            5
+        add     ebx,            edi
         ; 88
-        mov     esi,            DWORD PTR 56[esp]
-        or      edi,            ebp
-        add     ecx,            esi
-        xor     edi,            edx
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 52[esp]
+        or      edx,            ebp
+        add     edi,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1352829926[edi*1+ecx]
-        sub     esi,            ebp
-        rol     ecx,            7
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1352829926[edx*1+edi]
+        sub     eax,            ebp
+        rol     edi,            7
+        add     edi,            esi
         ; 89
-        mov     edi,            DWORD PTR 28[esp]
-        or      esi,            edx
-        add     ebx,            edi
-        xor     esi,            ecx
-        mov     edi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1352829926[esi*1+ebx]
-        sub     edi,            edx
-        rol     ebx,            7
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 24[esp]
+        or      eax,            ebx
+        add     esi,            edx
+        xor     eax,            edi
+        mov     edx,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1352829926[eax*1+esi]
+        sub     edx,            ebx
+        rol     esi,            7
+        add     esi,            ecx
         ; 90
-        mov     esi,            DWORD PTR 64[esp]
-        or      edi,            ecx
-        add     eax,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1352829926[edi*1+eax]
-        sub     esi,            ecx
-        rol     eax,            8
-        add     eax,            ebp
+        mov     eax,            DWORD PTR 60[esp]
+        or      edx,            edi
+        add     ecx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1352829926[edx*1+ecx]
+        sub     eax,            edi
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 91
-        mov     edi,            DWORD PTR 36[esp]
-        or      esi,            ebx
-        add     ebp,            edi
-        xor     esi,            eax
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1352829926[esi*1+ebp]
-        sub     edi,            ebx
-        rol     ebp,            11
+        mov     edx,            DWORD PTR 32[esp]
+        or      eax,            esi
         add     ebp,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1352829926[eax*1+ebp]
+        sub     edx,            esi
+        rol     ebp,            11
+        add     ebp,            ebx
         ; 92
-        mov     esi,            DWORD PTR 8[esp]
-        or      edi,            eax
-        add     edx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1352829926[edi*1+edx]
-        sub     esi,            eax
-        rol     edx,            14
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 4[esp]
+        or      edx,            ecx
+        add     ebx,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1352829926[edx*1+ebx]
+        sub     eax,            ecx
+        rol     ebx,            14
+        add     ebx,            edi
         ; 93
-        mov     edi,            DWORD PTR 44[esp]
-        or      esi,            ebp
-        add     ecx,            edi
-        xor     esi,            edx
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 40[esp]
+        or      eax,            ebp
+        add     edi,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1352829926[esi*1+ecx]
-        sub     edi,            ebp
-        rol     ecx,            14
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1352829926[eax*1+edi]
+        sub     edx,            ebp
+        rol     edi,            14
+        add     edi,            esi
         ; 94
-        mov     esi,            DWORD PTR 16[esp]
-        or      edi,            edx
-        add     ebx,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1352829926[edi*1+ebx]
-        sub     esi,            edx
-        rol     ebx,            12
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 12[esp]
+        or      edx,            ebx
+        add     esi,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1352829926[edx*1+esi]
+        sub     eax,            ebx
+        rol     esi,            12
+        add     esi,            ecx
         ; 95
-        mov     edi,            DWORD PTR 52[esp]
-        or      esi,            ecx
-        add     eax,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1352829926[esi*1+eax]
-        mov     esi,            ecx
-        rol     eax,            6
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 48[esp]
+        or      eax,            edi
+        add     ecx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1352829926[eax*1+ecx]
+        mov     eax,            edi
+        rol     ecx,            6
+        add     ecx,            ebp
         ; 96
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 28[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1548603684[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 24[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1548603684[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            9
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 97
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 48[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1548603684[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            13
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 44[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1548603684[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            13
+        add     ebx,            edi
         ; 98
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 16[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 12[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1548603684[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            15
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1548603684[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            15
+        add     edi,            esi
         ; 99
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 32[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1548603684[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            7
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 28[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1548603684[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            7
+        add     esi,            ecx
         ; 100
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 4[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1548603684[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            12
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR [esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1548603684[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 101
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 56[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1548603684[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 52[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1548603684[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            8
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 102
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 24[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1548603684[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            9
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 20[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1548603684[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            9
+        add     ebx,            edi
         ; 103
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 44[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 40[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1548603684[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            11
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1548603684[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            11
+        add     edi,            esi
         ; 104
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 60[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1548603684[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            7
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 56[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1548603684[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            7
+        add     esi,            ecx
         ; 105
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 64[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1548603684[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            7
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 60[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1548603684[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            7
+        add     ecx,            ebp
         ; 106
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 36[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1548603684[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        mov     esi,            ebx
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 32[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1548603684[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        mov     eax,            esi
         rol     ebp,            12
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 107
-        sub     edi,            ebx
-        and     esi,            ebp
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 52[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1548603684[edi+edx]
-        mov     edi,            -1
-        add     edx,            esi
-        mov     esi,            eax
-        rol     edx,            7
-        add     edx,            ecx
+        sub     edx,            esi
+        and     eax,            ebp
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 48[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1548603684[edx+ebx]
+        mov     edx,            -1
+        add     ebx,            eax
+        mov     eax,            ecx
+        rol     ebx,            7
+        add     ebx,            edi
         ; 108
-        sub     edi,            eax
-        and     esi,            edx
-        and     edi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 20[esp]
+        sub     edx,            ecx
+        and     eax,            ebx
+        and     edx,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR 16[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1548603684[edi+ecx]
-        mov     edi,            -1
-        add     ecx,            esi
-        mov     esi,            ebp
-        rol     ecx,            6
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1548603684[edx+edi]
+        mov     edx,            -1
+        add     edi,            eax
+        mov     eax,            ebp
+        rol     edi,            6
+        add     edi,            esi
         ; 109
-        sub     edi,            ebp
-        and     esi,            ecx
-        and     edi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 40[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1548603684[edi+ebx]
-        mov     edi,            -1
-        add     ebx,            esi
-        mov     esi,            edx
-        rol     ebx,            15
-        add     ebx,            eax
+        sub     edx,            ebp
+        and     eax,            edi
+        and     edx,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 36[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1548603684[edx+esi]
+        mov     edx,            -1
+        add     esi,            eax
+        mov     eax,            ebx
+        rol     esi,            15
+        add     esi,            ecx
         ; 110
-        sub     edi,            edx
-        and     esi,            ebx
-        and     edi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 8[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1548603684[edi+eax]
-        mov     edi,            -1
-        add     eax,            esi
-        mov     esi,            ecx
-        rol     eax,            13
-        add     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            esi
+        and     edx,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 4[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1548603684[edx+ecx]
+        mov     edx,            -1
+        add     ecx,            eax
+        mov     eax,            edi
+        rol     ecx,            13
+        add     ecx,            ebp
         ; 111
-        sub     edi,            ecx
-        and     esi,            eax
-        and     edi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 12[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1548603684[edi+ebp]
-        mov     edi,            -1
-        add     ebp,            esi
-        sub     edi,            eax
+        sub     edx,            edi
+        and     eax,            ecx
+        and     edx,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 8[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1548603684[edx+ebp]
+        mov     edx,            -1
+        add     ebp,            eax
+        sub     edx,            ecx
         rol     ebp,            11
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 112
-        mov     esi,            DWORD PTR 64[esp]
-        or      edi,            ebp
-        add     edx,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1836072691[edi*1+edx]
-        sub     esi,            ebp
-        rol     edx,            9
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 60[esp]
+        or      edx,            ebp
+        add     ebx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1836072691[edx*1+ebx]
+        sub     eax,            ebp
+        rol     ebx,            9
+        add     ebx,            edi
         ; 113
-        mov     edi,            DWORD PTR 24[esp]
-        or      esi,            edx
-        add     ecx,            edi
-        xor     esi,            eax
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 20[esp]
+        or      eax,            ebx
+        add     edi,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1836072691[esi*1+ecx]
-        sub     edi,            edx
-        rol     ecx,            7
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1836072691[eax*1+edi]
+        sub     edx,            ebx
+        rol     edi,            7
+        add     edi,            esi
         ; 114
-        mov     esi,            DWORD PTR 8[esp]
-        or      edi,            ecx
-        add     ebx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1836072691[edi*1+ebx]
-        sub     esi,            ecx
-        rol     ebx,            15
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 4[esp]
+        or      edx,            edi
+        add     esi,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1836072691[edx*1+esi]
+        sub     eax,            edi
+        rol     esi,            15
+        add     esi,            ecx
         ; 115
-        mov     edi,            DWORD PTR 16[esp]
-        or      esi,            ebx
-        add     eax,            edi
-        xor     esi,            edx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1836072691[esi*1+eax]
-        sub     edi,            ebx
-        rol     eax,            11
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 12[esp]
+        or      eax,            esi
+        add     ecx,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1836072691[eax*1+ecx]
+        sub     edx,            esi
+        rol     ecx,            11
+        add     ecx,            ebp
         ; 116
-        mov     esi,            DWORD PTR 32[esp]
-        or      edi,            eax
-        add     ebp,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1836072691[edi*1+ebp]
-        sub     esi,            eax
+        mov     eax,            DWORD PTR 28[esp]
+        or      edx,            ecx
+        add     ebp,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1836072691[edx*1+ebp]
+        sub     eax,            ecx
         rol     ebp,            8
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 117
-        mov     edi,            DWORD PTR 60[esp]
-        or      esi,            ebp
-        add     edx,            edi
-        xor     esi,            ebx
-        mov     edi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1836072691[esi*1+edx]
-        sub     edi,            ebp
-        rol     edx,            6
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 56[esp]
+        or      eax,            ebp
+        add     ebx,            edx
+        xor     eax,            esi
+        mov     edx,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1836072691[eax*1+ebx]
+        sub     edx,            ebp
+        rol     ebx,            6
+        add     ebx,            edi
         ; 118
-        mov     esi,            DWORD PTR 28[esp]
-        or      edi,            edx
-        add     ecx,            esi
-        xor     edi,            eax
-        mov     esi,            -1
+        mov     eax,            DWORD PTR 24[esp]
+        or      edx,            ebx
+        add     edi,            eax
+        xor     edx,            ecx
+        mov     eax,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1836072691[edi*1+ecx]
-        sub     esi,            edx
-        rol     ecx,            6
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1836072691[edx*1+edi]
+        sub     eax,            ebx
+        rol     edi,            6
+        add     edi,            esi
         ; 119
-        mov     edi,            DWORD PTR 40[esp]
-        or      esi,            ecx
-        add     ebx,            edi
-        xor     esi,            ebp
-        mov     edi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1836072691[esi*1+ebx]
-        sub     edi,            ecx
-        rol     ebx,            14
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 36[esp]
+        or      eax,            edi
+        add     esi,            edx
+        xor     eax,            ebp
+        mov     edx,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1836072691[eax*1+esi]
+        sub     edx,            edi
+        rol     esi,            14
+        add     esi,            ecx
         ; 120
-        mov     esi,            DWORD PTR 48[esp]
-        or      edi,            ebx
-        add     eax,            esi
-        xor     edi,            edx
-        mov     esi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1836072691[edi*1+eax]
-        sub     esi,            ebx
-        rol     eax,            12
-        add     eax,            ebp
+        mov     eax,            DWORD PTR 44[esp]
+        or      edx,            esi
+        add     ecx,            eax
+        xor     edx,            ebx
+        mov     eax,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1836072691[edx*1+ecx]
+        sub     eax,            esi
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 121
-        mov     edi,            DWORD PTR 36[esp]
-        or      esi,            eax
-        add     ebp,            edi
-        xor     esi,            ecx
-        mov     edi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1836072691[esi*1+ebp]
-        sub     edi,            eax
-        rol     ebp,            13
+        mov     edx,            DWORD PTR 32[esp]
+        or      eax,            ecx
         add     ebp,            edx
+        xor     eax,            edi
+        mov     edx,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1836072691[eax*1+ebp]
+        sub     edx,            ecx
+        rol     ebp,            13
+        add     ebp,            ebx
         ; 122
-        mov     esi,            DWORD PTR 52[esp]
-        or      edi,            ebp
-        add     edx,            esi
-        xor     edi,            ebx
-        mov     esi,            -1
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1836072691[edi*1+edx]
-        sub     esi,            ebp
-        rol     edx,            5
-        add     edx,            ecx
+        mov     eax,            DWORD PTR 48[esp]
+        or      edx,            ebp
+        add     ebx,            eax
+        xor     edx,            esi
+        mov     eax,            -1
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1836072691[edx*1+ebx]
+        sub     eax,            ebp
+        rol     ebx,            5
+        add     ebx,            edi
         ; 123
-        mov     edi,            DWORD PTR 12[esp]
-        or      esi,            edx
-        add     ecx,            edi
-        xor     esi,            eax
-        mov     edi,            -1
+        mov     edx,            DWORD PTR 8[esp]
+        or      eax,            ebx
+        add     edi,            edx
+        xor     eax,            ecx
+        mov     edx,            -1
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 1836072691[esi*1+ecx]
-        sub     edi,            edx
-        rol     ecx,            14
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 1836072691[eax*1+edi]
+        sub     edx,            ebx
+        rol     edi,            14
+        add     edi,            esi
         ; 124
-        mov     esi,            DWORD PTR 44[esp]
-        or      edi,            ecx
-        add     ebx,            esi
-        xor     edi,            ebp
-        mov     esi,            -1
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 1836072691[edi*1+ebx]
-        sub     esi,            ecx
-        rol     ebx,            13
-        add     ebx,            eax
+        mov     eax,            DWORD PTR 40[esp]
+        or      edx,            edi
+        add     esi,            eax
+        xor     edx,            ebp
+        mov     eax,            -1
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 1836072691[edx*1+esi]
+        sub     eax,            edi
+        rol     esi,            13
+        add     esi,            ecx
         ; 125
-        mov     edi,            DWORD PTR 4[esp]
-        or      esi,            ebx
-        add     eax,            edi
-        xor     esi,            edx
-        mov     edi,            -1
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 1836072691[esi*1+eax]
-        sub     edi,            ebx
-        rol     eax,            13
-        add     eax,            ebp
+        mov     edx,            DWORD PTR [esp]
+        or      eax,            esi
+        add     ecx,            edx
+        xor     eax,            ebx
+        mov     edx,            -1
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 1836072691[eax*1+ecx]
+        sub     edx,            esi
+        rol     ecx,            13
+        add     ecx,            ebp
         ; 126
-        mov     esi,            DWORD PTR 20[esp]
-        or      edi,            eax
-        add     ebp,            esi
-        xor     edi,            ecx
-        mov     esi,            -1
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 1836072691[edi*1+ebp]
-        sub     esi,            eax
+        mov     eax,            DWORD PTR 16[esp]
+        or      edx,            ecx
+        add     ebp,            eax
+        xor     edx,            edi
+        mov     eax,            -1
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 1836072691[edx*1+ebp]
+        sub     eax,            ecx
         rol     ebp,            7
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 127
-        mov     edi,            DWORD PTR 56[esp]
-        or      esi,            ebp
-        add     edx,            edi
-        xor     esi,            ebx
-        mov     edi,            DWORD PTR 36[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 1836072691[esi*1+edx]
-        mov     esi,            -1
-        rol     edx,            5
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 52[esp]
+        or      eax,            ebp
+        add     ebx,            edx
+        xor     eax,            esi
+        mov     edx,            DWORD PTR 32[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 1836072691[eax*1+ebx]
+        mov     eax,            -1
+        rol     ebx,            5
+        add     ebx,            edi
         ; 128
-        add     ecx,            edi
-        mov     edi,            ebp
-        sub     esi,            edx
-        and     edi,            edx
-        and     esi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 28[esp]
+        add     edi,            edx
+        mov     edx,            ebp
+        sub     eax,            ebx
+        and     edx,            ebx
+        and     eax,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 24[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2053994217[edi*1+ecx]
-        mov     edi,            -1
-        rol     ecx,            15
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2053994217[edx*1+edi]
+        mov     edx,            -1
+        rol     edi,            15
+        add     edi,            esi
         ; 129
-        add     ebx,            esi
-        mov     esi,            edx
-        sub     edi,            ecx
-        and     esi,            ecx
-        and     edi,            ebp
-        or      esi,            edi
-        mov     edi,            DWORD PTR 20[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2053994217[esi*1+ebx]
-        mov     esi,            -1
-        rol     ebx,            5
-        add     ebx,            eax
+        add     esi,            eax
+        mov     eax,            ebx
+        sub     edx,            edi
+        and     eax,            edi
+        and     edx,            ebp
+        or      eax,            edx
+        mov     edx,            DWORD PTR 16[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2053994217[eax*1+esi]
+        mov     eax,            -1
+        rol     esi,            5
+        add     esi,            ecx
         ; 130
-        add     eax,            edi
-        mov     edi,            ecx
-        sub     esi,            ebx
-        and     edi,            ebx
-        and     esi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 8[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2053994217[edi*1+eax]
-        mov     edi,            -1
-        rol     eax,            8
-        add     eax,            ebp
+        add     ecx,            edx
+        mov     edx,            edi
+        sub     eax,            esi
+        and     edx,            esi
+        and     eax,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 4[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2053994217[edx*1+ecx]
+        mov     edx,            -1
+        rol     ecx,            8
+        add     ecx,            ebp
         ; 131
-        add     ebp,            esi
-        mov     esi,            ebx
-        sub     edi,            eax
-        and     esi,            eax
-        and     edi,            ecx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 16[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2053994217[esi*1+ebp]
-        mov     esi,            -1
+        add     ebp,            eax
+        mov     eax,            esi
+        sub     edx,            ecx
+        and     eax,            ecx
+        and     edx,            edi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 12[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2053994217[eax*1+ebp]
+        mov     eax,            -1
         rol     ebp,            11
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 132
-        add     edx,            edi
-        mov     edi,            eax
-        sub     esi,            ebp
-        and     edi,            ebp
-        and     esi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 48[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2053994217[edi*1+edx]
-        mov     edi,            -1
-        rol     edx,            14
-        add     edx,            ecx
+        add     ebx,            edx
+        mov     edx,            ecx
+        sub     eax,            ebp
+        and     edx,            ebp
+        and     eax,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 44[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2053994217[edx*1+ebx]
+        mov     edx,            -1
+        rol     ebx,            14
+        add     ebx,            edi
         ; 133
-        add     ecx,            esi
-        mov     esi,            ebp
-        sub     edi,            edx
-        and     esi,            edx
-        and     edi,            eax
-        or      esi,            edi
-        mov     edi,            DWORD PTR 64[esp]
+        add     edi,            eax
+        mov     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            ebx
+        and     edx,            ecx
+        or      eax,            edx
+        mov     edx,            DWORD PTR 60[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2053994217[esi*1+ecx]
-        mov     esi,            -1
-        rol     ecx,            14
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2053994217[eax*1+edi]
+        mov     eax,            -1
+        rol     edi,            14
+        add     edi,            esi
         ; 134
-        add     ebx,            edi
-        mov     edi,            edx
-        sub     esi,            ecx
-        and     edi,            ecx
-        and     esi,            ebp
-        or      edi,            esi
-        mov     esi,            DWORD PTR 4[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2053994217[edi*1+ebx]
-        mov     edi,            -1
-        rol     ebx,            6
-        add     ebx,            eax
+        add     esi,            edx
+        mov     edx,            ebx
+        sub     eax,            edi
+        and     edx,            edi
+        and     eax,            ebp
+        or      edx,            eax
+        mov     eax,            DWORD PTR [esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2053994217[edx*1+esi]
+        mov     edx,            -1
+        rol     esi,            6
+        add     esi,            ecx
         ; 135
-        add     eax,            esi
-        mov     esi,            ecx
-        sub     edi,            ebx
-        and     esi,            ebx
-        and     edi,            edx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 24[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2053994217[esi*1+eax]
-        mov     esi,            -1
-        rol     eax,            14
-        add     eax,            ebp
+        add     ecx,            eax
+        mov     eax,            edi
+        sub     edx,            esi
+        and     eax,            esi
+        and     edx,            ebx
+        or      eax,            edx
+        mov     edx,            DWORD PTR 20[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2053994217[eax*1+ecx]
+        mov     eax,            -1
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 136
-        add     ebp,            edi
-        mov     edi,            ebx
-        sub     esi,            eax
-        and     edi,            eax
-        and     esi,            ecx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 52[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2053994217[edi*1+ebp]
-        mov     edi,            -1
-        rol     ebp,            6
         add     ebp,            edx
+        mov     edx,            esi
+        sub     eax,            ecx
+        and     edx,            ecx
+        and     eax,            edi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 48[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2053994217[edx*1+ebp]
+        mov     edx,            -1
+        rol     ebp,            6
+        add     ebp,            ebx
         ; 137
-        add     edx,            esi
-        mov     esi,            eax
-        sub     edi,            ebp
-        and     esi,            ebp
-        and     edi,            ebx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 12[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2053994217[esi*1+edx]
-        mov     esi,            -1
-        rol     edx,            9
-        add     edx,            ecx
+        add     ebx,            eax
+        mov     eax,            ecx
+        sub     edx,            ebp
+        and     eax,            ebp
+        and     edx,            esi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 8[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2053994217[eax*1+ebx]
+        mov     eax,            -1
+        rol     ebx,            9
+        add     ebx,            edi
         ; 138
-        add     ecx,            edi
-        mov     edi,            ebp
-        sub     esi,            edx
-        and     edi,            edx
-        and     esi,            eax
-        or      edi,            esi
-        mov     esi,            DWORD PTR 56[esp]
+        add     edi,            edx
+        mov     edx,            ebp
+        sub     eax,            ebx
+        and     edx,            ebx
+        and     eax,            ecx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 52[esp]
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2053994217[edi*1+ecx]
-        mov     edi,            -1
-        rol     ecx,            12
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2053994217[edx*1+edi]
+        mov     edx,            -1
+        rol     edi,            12
+        add     edi,            esi
         ; 139
-        add     ebx,            esi
-        mov     esi,            edx
-        sub     edi,            ecx
-        and     esi,            ecx
-        and     edi,            ebp
-        or      esi,            edi
-        mov     edi,            DWORD PTR 40[esp]
-        rol     edx,            10
-        lea     ebx,            DWORD PTR 2053994217[esi*1+ebx]
-        mov     esi,            -1
-        rol     ebx,            9
-        add     ebx,            eax
+        add     esi,            eax
+        mov     eax,            ebx
+        sub     edx,            edi
+        and     eax,            edi
+        and     edx,            ebp
+        or      eax,            edx
+        mov     edx,            DWORD PTR 36[esp]
+        rol     ebx,            10
+        lea     esi,            DWORD PTR 2053994217[eax*1+esi]
+        mov     eax,            -1
+        rol     esi,            9
+        add     esi,            ecx
         ; 140
-        add     eax,            edi
-        mov     edi,            ecx
-        sub     esi,            ebx
-        and     edi,            ebx
-        and     esi,            edx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 32[esp]
-        rol     ecx,            10
-        lea     eax,            DWORD PTR 2053994217[edi*1+eax]
-        mov     edi,            -1
-        rol     eax,            12
-        add     eax,            ebp
+        add     ecx,            edx
+        mov     edx,            edi
+        sub     eax,            esi
+        and     edx,            esi
+        and     eax,            ebx
+        or      edx,            eax
+        mov     eax,            DWORD PTR 28[esp]
+        rol     edi,            10
+        lea     ecx,            DWORD PTR 2053994217[edx*1+ecx]
+        mov     edx,            -1
+        rol     ecx,            12
+        add     ecx,            ebp
         ; 141
-        add     ebp,            esi
-        mov     esi,            ebx
-        sub     edi,            eax
-        and     esi,            eax
-        and     edi,            ecx
-        or      esi,            edi
-        mov     edi,            DWORD PTR 44[esp]
-        rol     ebx,            10
-        lea     ebp,            DWORD PTR 2053994217[esi*1+ebp]
-        mov     esi,            -1
+        add     ebp,            eax
+        mov     eax,            esi
+        sub     edx,            ecx
+        and     eax,            ecx
+        and     edx,            edi
+        or      eax,            edx
+        mov     edx,            DWORD PTR 40[esp]
+        rol     esi,            10
+        lea     ebp,            DWORD PTR 2053994217[eax*1+ebp]
+        mov     eax,            -1
         rol     ebp,            5
-        add     ebp,            edx
+        add     ebp,            ebx
         ; 142
-        add     edx,            edi
-        mov     edi,            eax
-        sub     esi,            ebp
-        and     edi,            ebp
-        and     esi,            ebx
-        or      edi,            esi
-        mov     esi,            DWORD PTR 60[esp]
-        rol     eax,            10
-        lea     edx,            DWORD PTR 2053994217[edi*1+edx]
-        mov     edi,            -1
-        rol     edx,            15
-        add     edx,            ecx
+        add     ebx,            edx
+        mov     edx,            ecx
+        sub     eax,            ebp
+        and     edx,            ebp
+        and     eax,            esi
+        or      edx,            eax
+        mov     eax,            DWORD PTR 56[esp]
+        rol     ecx,            10
+        lea     ebx,            DWORD PTR 2053994217[edx*1+ebx]
+        mov     edx,            -1
+        rol     ebx,            15
+        add     ebx,            edi
         ; 143
-        add     ecx,            esi
-        mov     esi,            ebp
-        sub     edi,            edx
-        and     esi,            edx
-        and     edi,            eax
-        or      edi,            esi
-        mov     esi,            edx
+        add     edi,            eax
+        mov     eax,            ebp
+        sub     edx,            ebx
+        and     eax,            ebx
+        and     edx,            ecx
+        or      edx,            eax
+        mov     eax,            ebx
         rol     ebp,            10
-        lea     ecx,            DWORD PTR 2053994217[edi*1+ecx]
-        xor     esi,            ebp
-        rol     ecx,            8
-        add     ecx,            ebx
+        lea     edi,            DWORD PTR 2053994217[edx*1+edi]
+        xor     eax,            ebp
+        rol     edi,            8
+        add     edi,            esi
         ; 144
-        mov     edi,            DWORD PTR 52[esp]
-        xor     esi,            ecx
-        add     ebx,            edi
-        rol     edx,            10
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     ebx,            8
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 48[esp]
+        xor     eax,            edi
+        add     esi,            edx
+        rol     ebx,            10
+        add     esi,            eax
+        mov     eax,            edi
+        rol     esi,            8
+        add     esi,            ecx
         ; 145
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 64[esp]
-        xor     esi,            ebx
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     ecx,            10
-        add     eax,            edi
-        xor     esi,            ecx
-        rol     eax,            5
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR 60[esp]
+        xor     eax,            esi
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     edi,            10
+        add     ecx,            edx
+        xor     eax,            edi
+        rol     ecx,            5
+        add     ecx,            ebp
         ; 146
-        mov     edi,            DWORD PTR 44[esp]
-        xor     esi,            eax
-        add     ebp,            edi
-        rol     ebx,            10
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebp,            12
+        mov     edx,            DWORD PTR 40[esp]
+        xor     eax,            ecx
         add     ebp,            edx
+        rol     esi,            10
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     ebp,            12
+        add     ebp,            ebx
         ; 147
-        xor     esi,            ebx
-        mov     edi,            DWORD PTR 20[esp]
-        xor     esi,            ebp
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     eax,            10
-        add     edx,            edi
-        xor     esi,            eax
-        rol     edx,            9
-        add     edx,            ecx
+        xor     eax,            esi
+        mov     edx,            DWORD PTR 16[esp]
+        xor     eax,            ebp
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ecx,            10
+        add     ebx,            edx
+        xor     eax,            ecx
+        rol     ebx,            9
+        add     ebx,            edi
         ; 148
-        mov     edi,            DWORD PTR 8[esp]
-        xor     esi,            edx
-        add     ecx,            edi
+        mov     edx,            DWORD PTR 4[esp]
+        xor     eax,            ebx
+        add     edi,            edx
         rol     ebp,            10
-        add     ecx,            esi
-        mov     esi,            edx
-        rol     ecx,            12
-        add     ecx,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
+        rol     edi,            12
+        add     edi,            esi
         ; 149
-        xor     esi,            ebp
-        mov     edi,            DWORD PTR 24[esp]
-        xor     esi,            ecx
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     edx,            10
-        add     ebx,            edi
-        xor     esi,            edx
-        rol     ebx,            5
-        add     ebx,            eax
+        xor     eax,            ebp
+        mov     edx,            DWORD PTR 20[esp]
+        xor     eax,            edi
+        add     esi,            eax
+        mov     eax,            edi
+        rol     ebx,            10
+        add     esi,            edx
+        xor     eax,            ebx
+        rol     esi,            5
+        add     esi,            ecx
         ; 150
-        mov     edi,            DWORD PTR 36[esp]
-        xor     esi,            ebx
-        add     eax,            edi
-        rol     ecx,            10
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     eax,            14
-        add     eax,            ebp
+        mov     edx,            DWORD PTR 32[esp]
+        xor     eax,            esi
+        add     ecx,            edx
+        rol     edi,            10
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     ecx,            14
+        add     ecx,            ebp
         ; 151
-        xor     esi,            ecx
-        mov     edi,            DWORD PTR 32[esp]
-        xor     esi,            eax
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebx,            10
-        add     ebp,            edi
-        xor     esi,            ebx
-        rol     ebp,            6
+        xor     eax,            edi
+        mov     edx,            DWORD PTR 28[esp]
+        xor     eax,            ecx
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     esi,            10
         add     ebp,            edx
+        xor     eax,            esi
+        rol     ebp,            6
+        add     ebp,            ebx
         ; 152
-        mov     edi,            DWORD PTR 28[esp]
-        xor     esi,            ebp
-        add     edx,            edi
-        rol     eax,            10
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     edx,            8
-        add     edx,            ecx
+        mov     edx,            DWORD PTR 24[esp]
+        xor     eax,            ebp
+        add     ebx,            edx
+        rol     ecx,            10
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ebx,            8
+        add     ebx,            edi
         ; 153
-        xor     esi,            eax
-        mov     edi,            DWORD PTR 12[esp]
-        xor     esi,            edx
-        add     ecx,            esi
-        mov     esi,            edx
+        xor     eax,            ecx
+        mov     edx,            DWORD PTR 8[esp]
+        xor     eax,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
         rol     ebp,            10
-        add     ecx,            edi
-        xor     esi,            ebp
-        rol     ecx,            13
-        add     ecx,            ebx
+        add     edi,            edx
+        xor     eax,            ebp
+        rol     edi,            13
+        add     edi,            esi
         ; 154
-        mov     edi,            DWORD PTR 56[esp]
-        xor     esi,            ecx
-        add     ebx,            edi
-        rol     edx,            10
-        add     ebx,            esi
-        mov     esi,            ecx
-        rol     ebx,            6
-        add     ebx,            eax
+        mov     edx,            DWORD PTR 52[esp]
+        xor     eax,            edi
+        add     esi,            edx
+        rol     ebx,            10
+        add     esi,            eax
+        mov     eax,            edi
+        rol     esi,            6
+        add     esi,            ecx
         ; 155
-        xor     esi,            edx
-        mov     edi,            DWORD PTR 60[esp]
-        xor     esi,            ebx
-        add     eax,            esi
-        mov     esi,            ebx
-        rol     ecx,            10
-        add     eax,            edi
-        xor     esi,            ecx
-        rol     eax,            5
-        add     eax,            ebp
+        xor     eax,            ebx
+        mov     edx,            DWORD PTR 56[esp]
+        xor     eax,            esi
+        add     ecx,            eax
+        mov     eax,            esi
+        rol     edi,            10
+        add     ecx,            edx
+        xor     eax,            edi
+        rol     ecx,            5
+        add     ecx,            ebp
         ; 156
-        mov     edi,            DWORD PTR 4[esp]
-        xor     esi,            eax
-        add     ebp,            edi
-        rol     ebx,            10
-        add     ebp,            esi
-        mov     esi,            eax
-        rol     ebp,            15
+        mov     edx,            DWORD PTR [esp]
+        xor     eax,            ecx
         add     ebp,            edx
+        rol     esi,            10
+        add     ebp,            eax
+        mov     eax,            ecx
+        rol     ebp,            15
+        add     ebp,            ebx
         ; 157
-        xor     esi,            ebx
-        mov     edi,            DWORD PTR 16[esp]
-        xor     esi,            ebp
-        add     edx,            esi
-        mov     esi,            ebp
-        rol     eax,            10
-        add     edx,            edi
-        xor     esi,            eax
-        rol     edx,            13
-        add     edx,            ecx
+        xor     eax,            esi
+        mov     edx,            DWORD PTR 12[esp]
+        xor     eax,            ebp
+        add     ebx,            eax
+        mov     eax,            ebp
+        rol     ecx,            10
+        add     ebx,            edx
+        xor     eax,            ecx
+        rol     ebx,            13
+        add     ebx,            edi
         ; 158
-        mov     edi,            DWORD PTR 40[esp]
-        xor     esi,            edx
-        add     ecx,            edi
+        mov     edx,            DWORD PTR 36[esp]
+        xor     eax,            ebx
+        add     edi,            edx
         rol     ebp,            10
-        add     ecx,            esi
-        mov     esi,            edx
-        rol     ecx,            11
-        add     ecx,            ebx
+        add     edi,            eax
+        mov     eax,            ebx
+        rol     edi,            11
+        add     edi,            esi
         ; 159
-        xor     esi,            ebp
-        mov     edi,            DWORD PTR 48[esp]
-        xor     esi,            ecx
-        add     ebx,            esi
-        rol     edx,            10
-        add     ebx,            edi
-        mov     edi,            DWORD PTR 108[esp]
-        rol     ebx,            11
+        xor     eax,            ebp
+        mov     edx,            DWORD PTR 44[esp]
+        xor     eax,            edi
+        add     esi,            eax
+        rol     ebx,            10
+        add     esi,            edx
+        mov     edx,            DWORD PTR 128[esp]
+        rol     esi,            11
+        add     esi,            ecx
+        mov     eax,            DWORD PTR 4[edx]
         add     ebx,            eax
-        mov     esi,            DWORD PTR 4[edi]
-        add     edx,            esi
-        mov     esi,            DWORD PTR 76[esp]
-        add     edx,            esi
-        mov     esi,            DWORD PTR 8[edi]
-        add     ebp,            esi
-        mov     esi,            DWORD PTR 80[esp]
-        add     ebp,            esi
-        mov     esi,            DWORD PTR 12[edi]
-        add     eax,            esi
-        mov     esi,            DWORD PTR 84[esp]
-        add     eax,            esi
-        mov     esi,            DWORD PTR 16[edi]
-        add     ebx,            esi
-        mov     esi,            DWORD PTR 68[esp]
-        add     ebx,            esi
-        mov     esi,            DWORD PTR [edi]
-        add     ecx,            esi
-        mov     esi,            DWORD PTR 72[esp]
-        add     ecx,            esi
-        mov     DWORD PTR [edi],edx
-        mov     DWORD PTR 4[edi],ebp
-        mov     DWORD PTR 8[edi],eax
-        mov     DWORD PTR 12[edi],ebx
-        mov     DWORD PTR 16[edi],ecx
-        mov     edi,            DWORD PTR [esp]
-        mov     esi,            DWORD PTR 112[esp]
-        cmp     edi,            esi
-        mov     edi,            DWORD PTR 108[esp]
-        jge     L000start
-        add     esp,            88
+        mov     eax,            DWORD PTR 72[esp]
+        add     ebx,            eax
+        mov     eax,            DWORD PTR 8[edx]
+        add     ebp,            eax
+        mov     eax,            DWORD PTR 76[esp]
+        add     ebp,            eax
+        mov     eax,            DWORD PTR 12[edx]
+        add     ecx,            eax
+        mov     eax,            DWORD PTR 80[esp]
+        add     ecx,            eax
+        mov     eax,            DWORD PTR 16[edx]
+        add     esi,            eax
+        mov     eax,            DWORD PTR 64[esp]
+        add     esi,            eax
+        mov     eax,            DWORD PTR [edx]
+        add     edi,            eax
+        mov     eax,            DWORD PTR 68[esp]
+        add     edi,            eax
+        mov     eax,            DWORD PTR 136[esp]
+        mov     DWORD PTR [edx],ebx
+        mov     DWORD PTR 4[edx],ebp
+        mov     DWORD PTR 8[edx],ecx
+        sub     eax,            1
+        mov     DWORD PTR 12[edx],esi
+        mov     DWORD PTR 16[edx],edi
+        jle     $L001get_out
+        mov     DWORD PTR 136[esp],eax
+        mov     edi,            ecx
+        mov     eax,            DWORD PTR 132[esp]
+        mov     ecx,            ebx
+        add     eax,            64
+        mov     esi,            ebp
+        mov     DWORD PTR 132[esp],eax
+        jmp     L000start
+$L001get_out:
+        add     esp,            108
         pop     ebx
         pop     ebp
         pop     edi
         pop     esi
         ret
-_ripemd160_block_x86 ENDP
+_ripemd160_block_asm_host_order ENDP
 _TEXT   ENDS
 END
diff --git a/src/lib/libssl/src/crypto/ripemd/asm/rmd-586.pl b/src/lib/libssl/src/crypto/ripemd/asm/rmd-586.pl
index e53c5fadba..0ab6f76bff 100644
--- a/src/lib/libssl/src/crypto/ripemd/asm/rmd-586.pl
+++ b/src/lib/libssl/src/crypto/ripemd/asm/rmd-586.pl
@@ -1,9 +1,7 @@
 #!/usr/local/bin/perl
 
 # Normal is the
-# ripemd160_block_x86(MD5_CTX *c, ULONG *X);
-# version, non-normal is the
-# ripemd160_block_x86(MD5_CTX *c, ULONG *X,int blocks);
+# ripemd160_block_asm_host_order(RIPEMD160_CTX *c, ULONG *X,int blocks);
 
 $normal=0;
 
@@ -12,13 +10,13 @@ require "x86asm.pl";
 
 &asm_init($ARGV[0],$0);
 
-$A="eax";
-$B="ebx";
-$C="ecx";
-$D="edx";
+$A="ecx";
+$B="esi";
+$C="edi";
+$D="ebx";
 $E="ebp";
-$tmp1="esi";
-$tmp2="edi";
+$tmp1="eax";
+$tmp2="edx";
 
 $KL1=0x5A827999;
 $KL2=0x6ED9EBA1;
@@ -58,13 +56,13 @@ $KR3=0x7A6D76E9;
          8, 5,12, 9,12, 5,14, 6, 8,13, 6, 5,15,13,11,11,
         );
 
-&ripemd160_block("ripemd160_block_x86");
+&ripemd160_block("ripemd160_block_asm_host_order");
 &asm_finish();
 
 sub Xv
         {
         local($n)=@_;
-        return(&swtmp($n+1));
+        return(&swtmp($n));
         # tmp on stack
         }
 
@@ -82,7 +80,7 @@ sub RIP1
         &comment($p++);
         if ($p & 1)
                 {
-         &mov($tmp1,    $c) if $o == -1;
+         #&mov($tmp1,   $c) if $o == -1;
         &xor($tmp1,     $d) if $o == -1;
          &mov($tmp2,    &Xv($pos));
         &xor($tmp1,     $b);
@@ -290,7 +288,7 @@ sub RIP5
         &rotl($c,       10);
         &lea($a,        &DWP($K,$a,$tmp1,1));
          &sub($tmp2,    &Np($d)) if $o <= 0;
-         &mov(&swtmp(1+16),     $A) if $o == 1;
+         &mov(&swtmp(16),       $A) if $o == 1;
          &mov($tmp1,    &Np($d)) if $o == 2;
         &rotl($a,       $s);
         &add($a,        $e);
@@ -310,19 +308,25 @@ sub ripemd160_block
         # D     12
         # E     16
 
+        &mov($tmp2,     &wparam(0));
+         &mov($tmp1,    &wparam(1));
         &push("esi");
-         &mov($C,       &wparam(2));
+         &mov($A,       &DWP( 0,$tmp2,"",0));
         &push("edi");
-         &mov($tmp1,    &wparam(1)); # edi
+         &mov($B,       &DWP( 4,$tmp2,"",0));
         &push("ebp");
-         &add($C,       $tmp1); # offset we end at
+         &mov($C,       &DWP( 8,$tmp2,"",0));
         &push("ebx");
-         &sub($C,       64);
-        &stack_push(16+5+1);
-         # XXX
-
-        &mov(&swtmp(0), $C);
-         &mov($tmp2,    &wparam(0)); # Done at end of loop
+         &stack_push(16+5+6);
+                          # Special comment about the figure of 6.
+                          # Idea is to pad the current frame so
+                          # that the top of the stack gets fairly
+                          # aligned. Well, as you realize it would
+                          # always depend on how the frame below is
+                          # aligned. The good news are that gcc-2.95
+                          # and later does keep first argument at
+                          # least double-wise aligned.
+                          #                     <appro@fy.chalmers.se>
 
         &set_label("start") unless $normal;
         &comment("");
@@ -332,16 +336,12 @@ sub ripemd160_block
 
         for ($z=0; $z<16; $z+=2)
                 {
-                &mov($A,                &DWP( $z*4,$tmp1,"",0));
-                 &mov($B,               &DWP( ($z+1)*4,$tmp1,"",0));
-                &mov(&swtmp(1+$z),      $A);
-                 &mov(&swtmp(1+$z+1),   $B);
+                &mov($D,                &DWP( $z*4,$tmp1,"",0));
+                 &mov($E,               &DWP( ($z+1)*4,$tmp1,"",0));
+                &mov(&swtmp($z),        $D);
+                 &mov(&swtmp($z+1),     $E);
                 }
-        &add($tmp1,     64);
-         &mov($A,       &DWP( 0,$tmp2,"",0));
-        &mov(&wparam(1),$tmp1);
-         &mov($B,       &DWP( 4,$tmp2,"",0));
-        &mov($C,        &DWP( 8,$tmp2,"",0));
+        &mov($tmp1,     $C);
          &mov($D,       &DWP(12,$tmp2,"",0));
         &mov($E,        &DWP(16,$tmp2,"",0));
 
@@ -431,14 +431,14 @@ sub ripemd160_block
         &RIP5($B,$C,$D,$E,$A,$wl[79],$sl[79],$KL4,1);
 
         # &mov($tmp2,   &wparam(0)); # moved into last RIP5
-        # &mov(&swtmp(1+16),    $A);
+        # &mov(&swtmp(16),      $A);
          &mov($A,       &DWP( 0,$tmp2,"",0));
-        &mov(&swtmp(1+17),      $B);
-         &mov(&swtmp(1+18),     $C);
+        &mov(&swtmp(16+1),      $B);
+         &mov(&swtmp(16+2),     $C);
         &mov($B,        &DWP( 4,$tmp2,"",0));
-         &mov(&swtmp(1+19),     $D);
+         &mov(&swtmp(16+3),     $D);
         &mov($C,        &DWP( 8,$tmp2,"",0));
-         &mov(&swtmp(1+20),     $E);
+         &mov(&swtmp(16+4),     $E);
         &mov($D,        &DWP(12,$tmp2,"",0));
          &mov($E,       &DWP(16,$tmp2,"",0));
 
@@ -531,46 +531,54 @@ sub ripemd160_block
 
          &mov($tmp1,    &DWP( 4,$tmp2,"",0));   # ctx->B
         &add($D,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+18));          # $c
+         &mov($tmp1,    &swtmp(16+2));          # $c
         &add($D,        $tmp1);
 
          &mov($tmp1,    &DWP( 8,$tmp2,"",0));   # ctx->C
         &add($E,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+19));          # $d
+         &mov($tmp1,    &swtmp(16+3));          # $d
         &add($E,        $tmp1);
 
          &mov($tmp1,    &DWP(12,$tmp2,"",0));   # ctx->D
         &add($A,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+20));          # $e
+         &mov($tmp1,    &swtmp(16+4));          # $e
         &add($A,        $tmp1);
 
 
          &mov($tmp1,    &DWP(16,$tmp2,"",0));   # ctx->E
         &add($B,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+16));          # $a
+         &mov($tmp1,    &swtmp(16+0));          # $a
         &add($B,        $tmp1);
 
          &mov($tmp1,    &DWP( 0,$tmp2,"",0));   # ctx->A
         &add($C,        $tmp1); 
-         &mov($tmp1,    &swtmp(1+17));          # $b
+         &mov($tmp1,    &swtmp(16+1));          # $b
         &add($C,        $tmp1);
 
+         &mov($tmp1,    &wparam(2));
+
         &mov(&DWP( 0,$tmp2,"",0),       $D);
          &mov(&DWP( 4,$tmp2,"",0),      $E);
         &mov(&DWP( 8,$tmp2,"",0),       $A);
-         &mov(&DWP(12,$tmp2,"",0),      $B);
-        &mov(&DWP(16,$tmp2,"",0),       $C);
+         &sub($tmp1,1);
+        &mov(&DWP(12,$tmp2,"",0),       $B);
+         &mov(&DWP(16,$tmp2,"",0),      $C);
 
-        &mov($tmp2,             &swtmp(0));
-         &mov($tmp1,            &wparam(1));
+        &jle(&label("get_out"));
+
+        &mov(&wparam(2),$tmp1);
+         &mov($C,       $A);
+        &mov($tmp1,     &wparam(1));
+         &mov($A,       $D);
+        &add($tmp1,     64);
+         &mov($B,       $E);
+        &mov(&wparam(1),$tmp1);
 
-        &cmp($tmp2,$tmp1);
-         &mov($tmp2,    &wparam(0));
+        &jmp(&label("start"));
 
-        # XXX
-         &jge(&label("start"));
+        &set_label("get_out");
 
-        &stack_pop(16+5+1);
+        &stack_pop(16+5+6);
 
         &pop("ebx");
         &pop("ebp");
diff --git a/src/lib/libssl/src/crypto/ripemd/ripemd.h b/src/lib/libssl/src/crypto/ripemd/ripemd.h
index ab76be4c33..dd1627cf40 100644
--- a/src/lib/libssl/src/crypto/ripemd/ripemd.h
+++ b/src/lib/libssl/src/crypto/ripemd/ripemd.h
@@ -67,26 +67,33 @@ extern "C" {
 #error RIPEMD is disabled.
 #endif
 
+#if defined(WIN16) || defined(__LP32__)
+#define RIPEMD160_LONG unsigned long
+#elif defined(_CRAY) || defined(__ILP64__)
+#define RIPEMD160_LONG unsigned long
+#define RIPEMD160_LONG_LOG2 3
+#else
+#define RIPEMD160_LONG unsigned int
+#endif
+
 #define RIPEMD160_CBLOCK        64
-#define RIPEMD160_LBLOCK        16
-#define RIPEMD160_BLOCK         16
-#define RIPEMD160_LAST_BLOCK    56
-#define RIPEMD160_LENGTH_BLOCK  8
+#define RIPEMD160_LBLOCK        (RIPEMD160_CBLOCK/4)
 #define RIPEMD160_DIGEST_LENGTH 20
 
 typedef struct RIPEMD160state_st
         {
-        unsigned long A,B,C,D,E;
-        unsigned long Nl,Nh;
-        unsigned long data[RIPEMD160_LBLOCK];
+        RIPEMD160_LONG A,B,C,D,E;
+        RIPEMD160_LONG Nl,Nh;
+        RIPEMD160_LONG data[RIPEMD160_LBLOCK];
         int num;
         } RIPEMD160_CTX;
 
 void RIPEMD160_Init(RIPEMD160_CTX *c);
-void RIPEMD160_Update(RIPEMD160_CTX *c, unsigned char *data, unsigned long len);
+void RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, unsigned long len);
 void RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
-unsigned char *RIPEMD160(unsigned char *d, unsigned long n, unsigned char *md);
-void RIPEMD160_Transform(RIPEMD160_CTX *c, unsigned char *b);
+unsigned char *RIPEMD160(const unsigned char *d, unsigned long n,
+        unsigned char *md);
+void RIPEMD160_Transform(RIPEMD160_CTX *c, const unsigned char *b);
 #ifdef  __cplusplus
 }
 #endif
diff --git a/src/lib/libssl/src/crypto/ripemd/rmd_dgst.c b/src/lib/libssl/src/crypto/ripemd/rmd_dgst.c
index b590856229..bdfae270b6 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmd_dgst.c
+++ b/src/lib/libssl/src/crypto/ripemd/rmd_dgst.c
@@ -60,7 +60,7 @@
 #include "rmd_locl.h"
 #include <openssl/opensslv.h>
 
-char *RMD160_version="RIPE-MD160" OPENSSL_VERSION_PTEXT;
+const char *RMD160_version="RIPE-MD160" OPENSSL_VERSION_PTEXT;
 
 #  ifdef RMD160_ASM
      void ripemd160_block_x86(RIPEMD160_CTX *c, unsigned long *p,int num);
@@ -68,6 +68,7 @@ char *RMD160_version="RIPE-MD160" OPENSSL_VERSION_PTEXT;
 #  else
      void ripemd160_block(RIPEMD160_CTX *c, unsigned long *p,int num);
 #  endif
+
 void RIPEMD160_Init(RIPEMD160_CTX *c)
         {
         c->A=RIPEMD160_A;
@@ -80,180 +81,21 @@ void RIPEMD160_Init(RIPEMD160_CTX *c)
         c->num=0;
         }
 
-void RIPEMD160_Update(RIPEMD160_CTX *c, register unsigned char *data,
-             unsigned long len)
-        {
-        register ULONG *p;
-        int sw,sc;
-        ULONG l;
-
-        if (len == 0) return;
-
-        l=(c->Nl+(len<<3))&0xffffffffL;
-        if (l < c->Nl) /* overflow */
-                c->Nh++;
-        c->Nh+=(len>>29);
-        c->Nl=l;
-
-        if (c->num != 0)
-                {
-                p=c->data;
-                sw=c->num>>2;
-                sc=c->num&0x03;
-
-                if ((c->num+len) >= RIPEMD160_CBLOCK)
-                        {
-                        l= p[sw];
-                        p_c2l(data,l,sc);
-                        p[sw++]=l;
-                        for (; sw<RIPEMD160_LBLOCK; sw++)
-                                {
-                                c2l(data,l);
-                                p[sw]=l;
-                                }
-                        len-=(RIPEMD160_CBLOCK-c->num);
-
-                        ripemd160_block(c,p,64);
-                        c->num=0;
-                        /* drop through and do the rest */
-                        }
-                else
-                        {
-                        int ew,ec;
-
-                        c->num+=(int)len;
-                        if ((sc+len) < 4) /* ugly, add char's to a word */
-                                {
-                                l= p[sw];
-                                p_c2l_p(data,l,sc,len);
-                                p[sw]=l;
-                                }
-                        else
-                                {
-                                ew=(c->num>>2);
-                                ec=(c->num&0x03);
-                                l= p[sw];
-                                p_c2l(data,l,sc);
-                                p[sw++]=l;
-                                for (; sw < ew; sw++)
-                                        { c2l(data,l); p[sw]=l; }
-                                if (ec)
-                                        {
-                                        c2l_p(data,l,ec);
-                                        p[sw]=l;
-                                        }
-                                }
-                        return;
-                        }
-                }
-        /* we now can process the input data in blocks of RIPEMD160_CBLOCK
-         * chars and save the leftovers to c->data. */
-#ifdef L_ENDIAN
-        if ((((unsigned long)data)%sizeof(ULONG)) == 0)
-                {
-                sw=(int)len/RIPEMD160_CBLOCK;
-                if (sw > 0)
-                        {
-                        sw*=RIPEMD160_CBLOCK;
-                        ripemd160_block(c,(ULONG *)data,sw);
-                        data+=sw;
-                        len-=sw;
-                        }
-                }
-#endif
-        p=c->data;
-        while (len >= RIPEMD160_CBLOCK)
-                {
-#if defined(L_ENDIAN) || defined(B_ENDIAN)
-                if (p != (unsigned long *)data)
-                        memcpy(p,data,RIPEMD160_CBLOCK);
-                data+=RIPEMD160_CBLOCK;
-#ifdef B_ENDIAN
-                for (sw=(RIPEMD160_LBLOCK/4); sw; sw--)
-                        {
-                        Endian_Reverse32(p[0]);
-                        Endian_Reverse32(p[1]);
-                        Endian_Reverse32(p[2]);
-                        Endian_Reverse32(p[3]);
-                        p+=4;
-                        }
-#endif
-#else
-                for (sw=(RIPEMD160_LBLOCK/4); sw; sw--)
-                        {
-                        c2l(data,l); *(p++)=l;
-                        c2l(data,l); *(p++)=l;
-                        c2l(data,l); *(p++)=l;
-                        c2l(data,l); *(p++)=l; 
-                        } 
+#ifndef ripemd160_block_host_order
+#ifdef X
+#undef X
 #endif
-                p=c->data;
-                ripemd160_block(c,p,64);
-                len-=RIPEMD160_CBLOCK;
-                }
-        sc=(int)len;
-        c->num=sc;
-        if (sc)
-                {
-                sw=sc>>2;       /* words to copy */
-#ifdef L_ENDIAN
-                p[sw]=0;
-                memcpy(p,data,sc);
-#else
-                sc&=0x03;
-                for ( ; sw; sw--)
-                        { c2l(data,l); *(p++)=l; }
-                c2l_p(data,l,sc);
-                *p=l;
-#endif
-                }
-        }
-
-void RIPEMD160_Transform(RIPEMD160_CTX *c, unsigned char *b)
+#define X(i)    XX[i]
+void ripemd160_block_host_order (RIPEMD160_CTX *ctx, const void *p, int num)
         {
-        ULONG p[16];
-#if !defined(L_ENDIAN)
-        ULONG *q;
-        int i;
-#endif
+        const RIPEMD160_LONG *XX=p;
+        register unsigned long A,B,C,D,E;
+        register unsigned long a,b,c,d,e;
 
-#if defined(B_ENDIAN) || defined(L_ENDIAN)
-        memcpy(p,b,64);
-#ifdef B_ENDIAN
-        q=p;
-        for (i=(RIPEMD160_LBLOCK/4); i; i--)
-                {
-                Endian_Reverse32(q[0]);
-                Endian_Reverse32(q[1]);
-                Endian_Reverse32(q[2]);
-                Endian_Reverse32(q[3]);
-                q+=4;
-                }
-#endif
-#else
-        q=p;
-        for (i=(RIPEMD160_LBLOCK/4); i; i--)
+        for (;num--;XX+=HASH_LBLOCK)
                 {
-                ULONG l;
-                c2l(b,l); *(q++)=l;
-                c2l(b,l); *(q++)=l;
-                c2l(b,l); *(q++)=l;
-                c2l(b,l); *(q++)=l; 
-                } 
-#endif
-        ripemd160_block(c,p,64);
-        }
-
-#ifndef RMD160_ASM
-
-void ripemd160_block(RIPEMD160_CTX *ctx, register ULONG *X, int num)
-        {
-        register ULONG A,B,C,D,E;
-        ULONG a,b,c,d,e;
 
-        for (;;)
-                {
-                A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
+        A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
 
         RIP1(A,B,C,D,E,WL00,SL00);
         RIP1(E,A,B,C,D,WL01,SL01);
@@ -436,80 +278,216 @@ void ripemd160_block(RIPEMD160_CTX *ctx, register ULONG *X, int num)
         ctx->E=ctx->A+b+C;
         ctx->A=D;
 
-        X+=16;
-        num-=64;
-        if (num <= 0) break;
                 }
         }
 #endif
 
-void RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c)
+#ifndef ripemd160_block_data_order
+#ifdef X
+#undef X
+#endif
+void ripemd160_block_data_order (RIPEMD160_CTX *ctx, const void *p, int num)
         {
-        register int i,j;
-        register ULONG l;
-        register ULONG *p;
-        static unsigned char end[4]={0x80,0x00,0x00,0x00};
-        unsigned char *cp=end;
-
-        /* c->num should definitly have room for at least one more byte. */
-        p=c->data;
-        j=c->num;
-        i=j>>2;
-
-        /* purify often complains about the following line as an
-         * Uninitialized Memory Read.  While this can be true, the
-         * following p_c2l macro will reset l when that case is true.
-         * This is because j&0x03 contains the number of 'valid' bytes
-         * already in p[i].  If and only if j&0x03 == 0, the UMR will
-         * occur but this is also the only time p_c2l will do
-         * l= *(cp++) instead of l|= *(cp++)
-         * Many thanks to Alex Tang <altitude@cic.net> for pickup this
-         * 'potential bug' */
-#ifdef PURIFY
-        if ((j&0x03) == 0) p[i]=0;
+        const unsigned char *data=p;
+        register unsigned long A,B,C,D,E;
+        unsigned long a,b,c,d,e,l;
+#ifndef MD32_XARRAY
+        /* See comment in crypto/sha/sha_locl.h for details. */
+        unsigned long   XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
+                        XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
+# define X(i)   XX##i
+#else
+        RIPEMD160_LONG  XX[16];
+# define X(i)   XX[i]
 #endif
-        l=p[i];
-        p_c2l(cp,l,j&0x03);
-        p[i]=l;
-        i++;
-        /* i is the next 'undefined word' */
-        if (c->num >= RIPEMD160_LAST_BLOCK)
+
+        for (;num--;)
                 {
-                for (; i<RIPEMD160_LBLOCK; i++)
-                        p[i]=0;
-                ripemd160_block(c,p,64);
-                i=0;
-                }
-        for (; i<(RIPEMD160_LBLOCK-2); i++)
-                p[i]=0;
-        p[RIPEMD160_LBLOCK-2]=c->Nl;
-        p[RIPEMD160_LBLOCK-1]=c->Nh;
-        ripemd160_block(c,p,64);
-        cp=md;
-        l=c->A; l2c(l,cp);
-        l=c->B; l2c(l,cp);
-        l=c->C; l2c(l,cp);
-        l=c->D; l2c(l,cp);
-        l=c->E; l2c(l,cp);
-
-        /* clear stuff, ripemd160_block may be leaving some stuff on the stack
-         * but I'm not worried :-) */
-        c->num=0;
-/*      memset((char *)&c,0,sizeof(c));*/
-        }
 
-#ifdef undef
-int printit(unsigned long *l)
-        {
-        int i,ii;
+        A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
+
+        HOST_c2l(data,l); X( 0)=l;      HOST_c2l(data,l); X( 1)=l;
+        RIP1(A,B,C,D,E,WL00,SL00);      HOST_c2l(data,l); X( 2)=l;
+        RIP1(E,A,B,C,D,WL01,SL01);      HOST_c2l(data,l); X( 3)=l;
+        RIP1(D,E,A,B,C,WL02,SL02);      HOST_c2l(data,l); X( 4)=l;
+        RIP1(C,D,E,A,B,WL03,SL03);      HOST_c2l(data,l); X( 5)=l;
+        RIP1(B,C,D,E,A,WL04,SL04);      HOST_c2l(data,l); X( 6)=l;
+        RIP1(A,B,C,D,E,WL05,SL05);      HOST_c2l(data,l); X( 7)=l;
+        RIP1(E,A,B,C,D,WL06,SL06);      HOST_c2l(data,l); X( 8)=l;
+        RIP1(D,E,A,B,C,WL07,SL07);      HOST_c2l(data,l); X( 9)=l;
+        RIP1(C,D,E,A,B,WL08,SL08);      HOST_c2l(data,l); X(10)=l;
+        RIP1(B,C,D,E,A,WL09,SL09);      HOST_c2l(data,l); X(11)=l;
+        RIP1(A,B,C,D,E,WL10,SL10);      HOST_c2l(data,l); X(12)=l;
+        RIP1(E,A,B,C,D,WL11,SL11);      HOST_c2l(data,l); X(13)=l;
+        RIP1(D,E,A,B,C,WL12,SL12);      HOST_c2l(data,l); X(14)=l;
+        RIP1(C,D,E,A,B,WL13,SL13);      HOST_c2l(data,l); X(15)=l;
+        RIP1(B,C,D,E,A,WL14,SL14);
+        RIP1(A,B,C,D,E,WL15,SL15);
+
+        RIP2(E,A,B,C,D,WL16,SL16,KL1);
+        RIP2(D,E,A,B,C,WL17,SL17,KL1);
+        RIP2(C,D,E,A,B,WL18,SL18,KL1);
+        RIP2(B,C,D,E,A,WL19,SL19,KL1);
+        RIP2(A,B,C,D,E,WL20,SL20,KL1);
+        RIP2(E,A,B,C,D,WL21,SL21,KL1);
+        RIP2(D,E,A,B,C,WL22,SL22,KL1);
+        RIP2(C,D,E,A,B,WL23,SL23,KL1);
+        RIP2(B,C,D,E,A,WL24,SL24,KL1);
+        RIP2(A,B,C,D,E,WL25,SL25,KL1);
+        RIP2(E,A,B,C,D,WL26,SL26,KL1);
+        RIP2(D,E,A,B,C,WL27,SL27,KL1);
+        RIP2(C,D,E,A,B,WL28,SL28,KL1);
+        RIP2(B,C,D,E,A,WL29,SL29,KL1);
+        RIP2(A,B,C,D,E,WL30,SL30,KL1);
+        RIP2(E,A,B,C,D,WL31,SL31,KL1);
+
+        RIP3(D,E,A,B,C,WL32,SL32,KL2);
+        RIP3(C,D,E,A,B,WL33,SL33,KL2);
+        RIP3(B,C,D,E,A,WL34,SL34,KL2);
+        RIP3(A,B,C,D,E,WL35,SL35,KL2);
+        RIP3(E,A,B,C,D,WL36,SL36,KL2);
+        RIP3(D,E,A,B,C,WL37,SL37,KL2);
+        RIP3(C,D,E,A,B,WL38,SL38,KL2);
+        RIP3(B,C,D,E,A,WL39,SL39,KL2);
+        RIP3(A,B,C,D,E,WL40,SL40,KL2);
+        RIP3(E,A,B,C,D,WL41,SL41,KL2);
+        RIP3(D,E,A,B,C,WL42,SL42,KL2);
+        RIP3(C,D,E,A,B,WL43,SL43,KL2);
+        RIP3(B,C,D,E,A,WL44,SL44,KL2);
+        RIP3(A,B,C,D,E,WL45,SL45,KL2);
+        RIP3(E,A,B,C,D,WL46,SL46,KL2);
+        RIP3(D,E,A,B,C,WL47,SL47,KL2);
+
+        RIP4(C,D,E,A,B,WL48,SL48,KL3);
+        RIP4(B,C,D,E,A,WL49,SL49,KL3);
+        RIP4(A,B,C,D,E,WL50,SL50,KL3);
+        RIP4(E,A,B,C,D,WL51,SL51,KL3);
+        RIP4(D,E,A,B,C,WL52,SL52,KL3);
+        RIP4(C,D,E,A,B,WL53,SL53,KL3);
+        RIP4(B,C,D,E,A,WL54,SL54,KL3);
+        RIP4(A,B,C,D,E,WL55,SL55,KL3);
+        RIP4(E,A,B,C,D,WL56,SL56,KL3);
+        RIP4(D,E,A,B,C,WL57,SL57,KL3);
+        RIP4(C,D,E,A,B,WL58,SL58,KL3);
+        RIP4(B,C,D,E,A,WL59,SL59,KL3);
+        RIP4(A,B,C,D,E,WL60,SL60,KL3);
+        RIP4(E,A,B,C,D,WL61,SL61,KL3);
+        RIP4(D,E,A,B,C,WL62,SL62,KL3);
+        RIP4(C,D,E,A,B,WL63,SL63,KL3);
+
+        RIP5(B,C,D,E,A,WL64,SL64,KL4);
+        RIP5(A,B,C,D,E,WL65,SL65,KL4);
+        RIP5(E,A,B,C,D,WL66,SL66,KL4);
+        RIP5(D,E,A,B,C,WL67,SL67,KL4);
+        RIP5(C,D,E,A,B,WL68,SL68,KL4);
+        RIP5(B,C,D,E,A,WL69,SL69,KL4);
+        RIP5(A,B,C,D,E,WL70,SL70,KL4);
+        RIP5(E,A,B,C,D,WL71,SL71,KL4);
+        RIP5(D,E,A,B,C,WL72,SL72,KL4);
+        RIP5(C,D,E,A,B,WL73,SL73,KL4);
+        RIP5(B,C,D,E,A,WL74,SL74,KL4);
+        RIP5(A,B,C,D,E,WL75,SL75,KL4);
+        RIP5(E,A,B,C,D,WL76,SL76,KL4);
+        RIP5(D,E,A,B,C,WL77,SL77,KL4);
+        RIP5(C,D,E,A,B,WL78,SL78,KL4);
+        RIP5(B,C,D,E,A,WL79,SL79,KL4);
+
+        a=A; b=B; c=C; d=D; e=E;
+        /* Do other half */
+        A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
+
+        RIP5(A,B,C,D,E,WR00,SR00,KR0);
+        RIP5(E,A,B,C,D,WR01,SR01,KR0);
+        RIP5(D,E,A,B,C,WR02,SR02,KR0);
+        RIP5(C,D,E,A,B,WR03,SR03,KR0);
+        RIP5(B,C,D,E,A,WR04,SR04,KR0);
+        RIP5(A,B,C,D,E,WR05,SR05,KR0);
+        RIP5(E,A,B,C,D,WR06,SR06,KR0);
+        RIP5(D,E,A,B,C,WR07,SR07,KR0);
+        RIP5(C,D,E,A,B,WR08,SR08,KR0);
+        RIP5(B,C,D,E,A,WR09,SR09,KR0);
+        RIP5(A,B,C,D,E,WR10,SR10,KR0);
+        RIP5(E,A,B,C,D,WR11,SR11,KR0);
+        RIP5(D,E,A,B,C,WR12,SR12,KR0);
+        RIP5(C,D,E,A,B,WR13,SR13,KR0);
+        RIP5(B,C,D,E,A,WR14,SR14,KR0);
+        RIP5(A,B,C,D,E,WR15,SR15,KR0);
+
+        RIP4(E,A,B,C,D,WR16,SR16,KR1);
+        RIP4(D,E,A,B,C,WR17,SR17,KR1);
+        RIP4(C,D,E,A,B,WR18,SR18,KR1);
+        RIP4(B,C,D,E,A,WR19,SR19,KR1);
+        RIP4(A,B,C,D,E,WR20,SR20,KR1);
+        RIP4(E,A,B,C,D,WR21,SR21,KR1);
+        RIP4(D,E,A,B,C,WR22,SR22,KR1);
+        RIP4(C,D,E,A,B,WR23,SR23,KR1);
+        RIP4(B,C,D,E,A,WR24,SR24,KR1);
+        RIP4(A,B,C,D,E,WR25,SR25,KR1);
+        RIP4(E,A,B,C,D,WR26,SR26,KR1);
+        RIP4(D,E,A,B,C,WR27,SR27,KR1);
+        RIP4(C,D,E,A,B,WR28,SR28,KR1);
+        RIP4(B,C,D,E,A,WR29,SR29,KR1);
+        RIP4(A,B,C,D,E,WR30,SR30,KR1);
+        RIP4(E,A,B,C,D,WR31,SR31,KR1);
+
+        RIP3(D,E,A,B,C,WR32,SR32,KR2);
+        RIP3(C,D,E,A,B,WR33,SR33,KR2);
+        RIP3(B,C,D,E,A,WR34,SR34,KR2);
+        RIP3(A,B,C,D,E,WR35,SR35,KR2);
+        RIP3(E,A,B,C,D,WR36,SR36,KR2);
+        RIP3(D,E,A,B,C,WR37,SR37,KR2);
+        RIP3(C,D,E,A,B,WR38,SR38,KR2);
+        RIP3(B,C,D,E,A,WR39,SR39,KR2);
+        RIP3(A,B,C,D,E,WR40,SR40,KR2);
+        RIP3(E,A,B,C,D,WR41,SR41,KR2);
+        RIP3(D,E,A,B,C,WR42,SR42,KR2);
+        RIP3(C,D,E,A,B,WR43,SR43,KR2);
+        RIP3(B,C,D,E,A,WR44,SR44,KR2);
+        RIP3(A,B,C,D,E,WR45,SR45,KR2);
+        RIP3(E,A,B,C,D,WR46,SR46,KR2);
+        RIP3(D,E,A,B,C,WR47,SR47,KR2);
+
+        RIP2(C,D,E,A,B,WR48,SR48,KR3);
+        RIP2(B,C,D,E,A,WR49,SR49,KR3);
+        RIP2(A,B,C,D,E,WR50,SR50,KR3);
+        RIP2(E,A,B,C,D,WR51,SR51,KR3);
+        RIP2(D,E,A,B,C,WR52,SR52,KR3);
+        RIP2(C,D,E,A,B,WR53,SR53,KR3);
+        RIP2(B,C,D,E,A,WR54,SR54,KR3);
+        RIP2(A,B,C,D,E,WR55,SR55,KR3);
+        RIP2(E,A,B,C,D,WR56,SR56,KR3);
+        RIP2(D,E,A,B,C,WR57,SR57,KR3);
+        RIP2(C,D,E,A,B,WR58,SR58,KR3);
+        RIP2(B,C,D,E,A,WR59,SR59,KR3);
+        RIP2(A,B,C,D,E,WR60,SR60,KR3);
+        RIP2(E,A,B,C,D,WR61,SR61,KR3);
+        RIP2(D,E,A,B,C,WR62,SR62,KR3);
+        RIP2(C,D,E,A,B,WR63,SR63,KR3);
+
+        RIP1(B,C,D,E,A,WR64,SR64);
+        RIP1(A,B,C,D,E,WR65,SR65);
+        RIP1(E,A,B,C,D,WR66,SR66);
+        RIP1(D,E,A,B,C,WR67,SR67);
+        RIP1(C,D,E,A,B,WR68,SR68);
+        RIP1(B,C,D,E,A,WR69,SR69);
+        RIP1(A,B,C,D,E,WR70,SR70);
+        RIP1(E,A,B,C,D,WR71,SR71);
+        RIP1(D,E,A,B,C,WR72,SR72);
+        RIP1(C,D,E,A,B,WR73,SR73);
+        RIP1(B,C,D,E,A,WR74,SR74);
+        RIP1(A,B,C,D,E,WR75,SR75);
+        RIP1(E,A,B,C,D,WR76,SR76);
+        RIP1(D,E,A,B,C,WR77,SR77);
+        RIP1(C,D,E,A,B,WR78,SR78);
+        RIP1(B,C,D,E,A,WR79,SR79);
+
+        D     =ctx->B+c+D;
+        ctx->B=ctx->C+d+E;
+        ctx->C=ctx->D+e+A;
+        ctx->D=ctx->E+a+B;
+        ctx->E=ctx->A+b+C;
+        ctx->A=D;
 
-        for (i=0; i<2; i++)
-                {
-                for (ii=0; ii<8; ii++)
-                        {
-                        fprintf(stderr,"%08lx ",l[i*8+ii]);
-                        }
-                fprintf(stderr,"\n");
                 }
         }
 #endif
diff --git a/src/lib/libssl/src/crypto/ripemd/rmd_locl.h b/src/lib/libssl/src/crypto/ripemd/rmd_locl.h
index d6ba02001a..145cf316b9 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmd_locl.h
+++ b/src/lib/libssl/src/crypto/ripemd/rmd_locl.h
@@ -58,134 +58,76 @@
 
 #include <stdlib.h>
 #include <string.h>
+#include <openssl/opensslconf.h>
 #include <openssl/ripemd.h>
 
-#define ULONG   unsigned long
-#define UCHAR   unsigned char
-#define UINT    unsigned int
-
-#undef c2nl
-#define c2nl(c,l)       (l =(((unsigned long)(*((c)++)))<<24), \
-                         l|=(((unsigned long)(*((c)++)))<<16), \
-                         l|=(((unsigned long)(*((c)++)))<< 8), \
-                         l|=(((unsigned long)(*((c)++)))    ))
-
-#undef p_c2nl
-#define p_c2nl(c,l,n)   { \
-                        switch (n) { \
-                        case 0: l =((unsigned long)(*((c)++)))<<24; \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16; \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8; \
-                        case 3: l|=((unsigned long)(*((c)++))); \
-                                } \
-                        }
-
-#undef c2nl_p
-/* NOTE the pointer is not incremented at the end of this */
-#define c2nl_p(c,l,n)   { \
-                        l=0; \
-                        (c)+=n; \
-                        switch (n) { \
-                        case 3: l =((unsigned long)(*(--(c))))<< 8; \
-                        case 2: l|=((unsigned long)(*(--(c))))<<16; \
-                        case 1: l|=((unsigned long)(*(--(c))))<<24; \
-                                } \
-                        }
-
-#undef p_c2nl_p
-#define p_c2nl_p(c,l,sc,len) { \
-                        switch (sc) \
-                                { \
-                        case 0: l =((unsigned long)(*((c)++)))<<24; \
-                                if (--len == 0) break; \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16; \
-                                if (--len == 0) break; \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8; \
-                                } \
-                        }
-
-#undef nl2c
-#define nl2c(l,c)       (*((c)++)=(unsigned char)(((l)>>24)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
-                         *((c)++)=(unsigned char)(((l)    )&0xff))
-
-#undef c2l
-#define c2l(c,l)        (l =(((unsigned long)(*((c)++)))    ), \
-                         l|=(((unsigned long)(*((c)++)))<< 8), \
-                         l|=(((unsigned long)(*((c)++)))<<16), \
-                         l|=(((unsigned long)(*((c)++)))<<24))
-
-#undef p_c2l
-#define p_c2l(c,l,n)    { \
-                        switch (n) { \
-                        case 0: l =((unsigned long)(*((c)++))); \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8; \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16; \
-                        case 3: l|=((unsigned long)(*((c)++)))<<24; \
-                                } \
-                        }
-
-#undef c2l_p
-/* NOTE the pointer is not incremented at the end of this */
-#define c2l_p(c,l,n)    { \
-                        l=0; \
-                        (c)+=n; \
-                        switch (n) { \
-                        case 3: l =((unsigned long)(*(--(c))))<<16; \
-                        case 2: l|=((unsigned long)(*(--(c))))<< 8; \
-                        case 1: l|=((unsigned long)(*(--(c)))); \
-                                } \
-                        }
-
-#undef p_c2l_p
-#define p_c2l_p(c,l,sc,len) { \
-                        switch (sc) \
-                                { \
-                        case 0: l =((unsigned long)(*((c)++))); \
-                                if (--len == 0) break; \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8; \
-                                if (--len == 0) break; \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16; \
-                                } \
-                        }
-
-#undef l2c
-#define l2c(l,c)        (*((c)++)=(unsigned char)(((l)    )&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>24)&0xff))
-
-#undef ROTATE
-#if defined(WIN32)
-#define ROTATE(a,n)     _lrotl(a,n)
-#else
-#define ROTATE(a,n)     (((a)<<(n))|(((a)&0xffffffff)>>(32-(n))))
+#ifndef RIPEMD160_LONG_LOG2
+#define RIPEMD160_LONG_LOG2 2 /* default to 32 bits */
+#endif
+
+/*
+ * DO EXAMINE COMMENTS IN crypto/md5/md5_locl.h & crypto/md5/md5_dgst.c
+ * FOR EXPLANATIONS ON FOLLOWING "CODE."
+ *                                      <appro@fy.chalmers.se>
+ */
+#ifdef RMD160_ASM
+# if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
+#  define ripemd160_block_host_order ripemd160_block_asm_host_order
+# endif
+#endif
+
+void ripemd160_block_host_order (RIPEMD160_CTX *c, const void *p,int num);
+void ripemd160_block_data_order (RIPEMD160_CTX *c, const void *p,int num);
+
+#if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
+#define ripemd160_block_data_order ripemd160_block_host_order
+#endif
+
+#define DATA_ORDER_IS_LITTLE_ENDIAN
+
+#define HASH_LONG               RIPEMD160_LONG
+#define HASH_LONG_LOG2          RIPEMD160_LONG_LOG2
+#define HASH_CTX                RIPEMD160_CTX
+#define HASH_CBLOCK             RIPEMD160_CBLOCK
+#define HASH_LBLOCK             RIPEMD160_LBLOCK
+#define HASH_UPDATE             RIPEMD160_Update
+#define HASH_TRANSFORM          RIPEMD160_Transform
+#define HASH_FINAL              RIPEMD160_Final
+#define HASH_BLOCK_HOST_ORDER   ripemd160_block_host_order
+#define HASH_MAKE_STRING(c,s)   do {    \
+        unsigned long ll;               \
+        ll=(c)->A; HOST_l2c(ll,(s));    \
+        ll=(c)->B; HOST_l2c(ll,(s));    \
+        ll=(c)->C; HOST_l2c(ll,(s));    \
+        ll=(c)->D; HOST_l2c(ll,(s));    \
+        ll=(c)->E; HOST_l2c(ll,(s));    \
+        } while (0)
+#if !defined(L_ENDIAN) || defined(ripemd160_block_data_order)
+#define HASH_BLOCK_DATA_ORDER   ripemd160_block_data_order
 #endif
 
-/* A nice byte order reversal from Wei Dai <weidai@eskimo.com> */
-#if defined(WIN32)
-/* 5 instructions with rotate instruction, else 9 */
-#define Endian_Reverse32(a) \
-        { \
-        unsigned long l=(a); \
-        (a)=((ROTATE(l,8)&0x00FF00FF)|(ROTATE(l,24)&0xFF00FF00)); \
-        }
+#ifndef FLAT_INC
+#include "../md32_common.h"
 #else
-/* 6 instructions with rotate instruction, else 8 */
-#define Endian_Reverse32(a) \
-        { \
-        unsigned long l=(a); \
-        l=(((l&0xFF00FF00)>>8L)|((l&0x00FF00FF)<<8L)); \
-        (a)=ROTATE(l,16L); \
-        }
+#include "md32_common.h"
 #endif
 
+#if 0
 #define F1(x,y,z)        ((x)^(y)^(z))
 #define F2(x,y,z)       (((x)&(y))|((~x)&z))
 #define F3(x,y,z)       (((x)|(~y))^(z))
 #define F4(x,y,z)       (((x)&(z))|((y)&(~(z))))
 #define F5(x,y,z)        ((x)^((y)|(~(z))))
+#else
+/*
+ * Transformed F2 and F4 are courtesy of Wei Dai <weidai@eskimo.com>
+ */
+#define F1(x,y,z)       ((x) ^ (y) ^ (z))
+#define F2(x,y,z)       ((((y) ^ (z)) & (x)) ^ (z))
+#define F3(x,y,z)       (((~(y)) | (x)) ^ (z))
+#define F4(x,y,z)       ((((x) ^ (y)) & (z)) ^ (y))
+#define F5(x,y,z)       (((~(z)) | (y)) ^ (x))
+#endif
 
 #define RIPEMD160_A     0x67452301L
 #define RIPEMD160_B     0xEFCDAB89L
@@ -196,27 +138,27 @@
 #include "rmdconst.h"
 
 #define RIP1(a,b,c,d,e,w,s) { \
-        a+=F1(b,c,d)+X[w]; \
+        a+=F1(b,c,d)+X(w); \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
 #define RIP2(a,b,c,d,e,w,s,K) { \
-        a+=F2(b,c,d)+X[w]+K; \
+        a+=F2(b,c,d)+X(w)+K; \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
 #define RIP3(a,b,c,d,e,w,s,K) { \
-        a+=F3(b,c,d)+X[w]+K; \
+        a+=F3(b,c,d)+X(w)+K; \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
 #define RIP4(a,b,c,d,e,w,s,K) { \
-        a+=F4(b,c,d)+X[w]+K; \
+        a+=F4(b,c,d)+X(w)+K; \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
 #define RIP5(a,b,c,d,e,w,s,K) { \
-        a+=F5(b,c,d)+X[w]+K; \
+        a+=F5(b,c,d)+X(w)+K; \
         a=ROTATE(a,s)+e; \
         c=ROTATE(c,10); }
 
diff --git a/src/lib/libssl/src/crypto/ripemd/rmd_one.c b/src/lib/libssl/src/crypto/ripemd/rmd_one.c
index 5b6ff14714..efdf2dd6ef 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmd_one.c
+++ b/src/lib/libssl/src/crypto/ripemd/rmd_one.c
@@ -57,9 +57,10 @@
  */
 
 #include <stdio.h>
-#include "rmd_locl.h"
+#include <string.h>
+#include <openssl/ripemd.h>
 
-unsigned char *RIPEMD160(unsigned char *d, unsigned long n,
+unsigned char *RIPEMD160(const unsigned char *d, unsigned long n,
              unsigned char *md)
         {
         RIPEMD160_CTX c;
diff --git a/src/lib/libssl/src/crypto/ripemd/rmdtest.c b/src/lib/libssl/src/crypto/ripemd/rmdtest.c
index 5e93d4627c..5d79c99725 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmdtest.c
+++ b/src/lib/libssl/src/crypto/ripemd/rmdtest.c
@@ -73,7 +73,7 @@ int main(int argc, char *argv[])
 #include <openssl/ebcdic.h>
 #endif
 
-char *test[]={
+static char *test[]={
         "",
         "a",
         "abc",
@@ -85,7 +85,7 @@ char *test[]={
         NULL,
         };
 
-char *ret[]={
+static char *ret[]={
         "9c1185a5c5e9fc54612808977ee8f548b2258d31",
         "0bdc9d2d256b3ee9daae347be6f4dc835a467ffe",
         "8eb208f7e05d987a9b044a8e98c6b087f15a0bfc",
diff --git a/src/lib/libssl/src/crypto/rsa/Makefile.ssl b/src/lib/libssl/src/crypto/rsa/Makefile.ssl
index 3bb89701a2..7b3960e70d 100644
--- a/src/lib/libssl/src/crypto/rsa/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/rsa/Makefile.ssl
@@ -18,14 +18,14 @@ AR=		ar r
 CFLAGS= $(INCLUDES) $(CFLAG)
 
 GENERAL=Makefile
-TEST=rsa_oaep_test.c
+TEST=rsa_test.c
 APPS=
 
 LIB=$(TOP)/libcrypto.a
 LIBSRC= rsa_eay.c rsa_gen.c rsa_lib.c rsa_sign.c rsa_saos.c rsa_err.c \
-        rsa_pk1.c rsa_ssl.c rsa_none.c rsa_oaep.c rsa_chk.c
+        rsa_pk1.c rsa_ssl.c rsa_none.c rsa_oaep.c rsa_chk.c rsa_null.c
 LIBOBJ= rsa_eay.o rsa_gen.o rsa_lib.o rsa_sign.o rsa_saos.o rsa_err.o \
-        rsa_pk1.o rsa_ssl.o rsa_none.o rsa_oaep.o rsa_chk.o
+        rsa_pk1.o rsa_ssl.o rsa_none.o rsa_oaep.o rsa_chk.o rsa_null.o
 
 SRC= $(LIBSRC)
 
@@ -83,52 +83,61 @@ clean:
 rsa_chk.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
 rsa_chk.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_chk.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-rsa_chk.o: ../../include/openssl/stack.h
+rsa_chk.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 rsa_eay.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_eay.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_eay.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_eay.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_eay.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_eay.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_eay.o: ../cryptlib.h
+rsa_eay.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_eay.o: ../../include/openssl/stack.h ../cryptlib.h
 rsa_err.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
 rsa_err.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_err.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-rsa_err.o: ../../include/openssl/stack.h
+rsa_err.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 rsa_gen.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_gen.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_gen.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_gen.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_gen.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-rsa_gen.o: ../../include/openssl/stack.h ../cryptlib.h
+rsa_gen.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+rsa_gen.o: ../cryptlib.h
 rsa_lib.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_lib.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_lib.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_lib.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
 rsa_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-rsa_lib.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_lib.o: ../cryptlib.h
+rsa_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_lib.o: ../../include/openssl/stack.h ../cryptlib.h
 rsa_none.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_none.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_none.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_none.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_none.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_none.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_none.o: ../cryptlib.h
+rsa_none.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_none.o: ../../include/openssl/stack.h ../cryptlib.h
+rsa_null.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
+rsa_null.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+rsa_null.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+rsa_null.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
+rsa_null.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
+rsa_null.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_null.o: ../../include/openssl/stack.h ../cryptlib.h
 rsa_oaep.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_oaep.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_oaep.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_oaep.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_oaep.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_oaep.o: ../../include/openssl/rsa.h ../../include/openssl/sha.h
-rsa_oaep.o: ../../include/openssl/stack.h ../cryptlib.h
+rsa_oaep.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_oaep.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+rsa_oaep.o: ../cryptlib.h
 rsa_pk1.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_pk1.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_pk1.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_pk1.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_pk1.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_pk1.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_pk1.o: ../cryptlib.h
+rsa_pk1.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_pk1.o: ../../include/openssl/stack.h ../cryptlib.h
 rsa_saos.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 rsa_saos.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 rsa_saos.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -168,5 +177,5 @@ rsa_ssl.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 rsa_ssl.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 rsa_ssl.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 rsa_ssl.o: ../../include/openssl/opensslv.h ../../include/openssl/rand.h
-rsa_ssl.o: ../../include/openssl/rsa.h ../../include/openssl/stack.h
-rsa_ssl.o: ../cryptlib.h
+rsa_ssl.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_ssl.o: ../../include/openssl/stack.h ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/rsa/rsa.h b/src/lib/libssl/src/crypto/rsa/rsa.h
index 9230b2fcc9..f9f9b5cfe9 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa.h
+++ b/src/lib/libssl/src/crypto/rsa/rsa.h
@@ -91,6 +91,18 @@ typedef struct rsa_meth_st
         int (*finish)(RSA *rsa);        /* called at free */
         int flags;                      /* RSA_METHOD_FLAG_* things */
         char *app_data;                 /* may be needed! */
+/* New sign and verify functions: some libraries don't allow arbitrary data
+ * to be signed/verified: this allows them to be used. Note: for this to work
+ * the RSA_public_decrypt() and RSA_private_encrypt() should *NOT* be used
+ * RSA_sign(), RSA_verify() should be used instead. Note: for backwards
+ * compatibility this functionality is only enabled if the RSA_FLAG_SIGN_VER
+ * option is set in 'flags'.
+ */
+        int (*rsa_sign)(int type, unsigned char *m, unsigned int m_len,
+             unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+        int (*rsa_verify)(int dtype, unsigned char *m, unsigned int m_len,
+             unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+
         } RSA_METHOD;
 
 struct rsa_st
@@ -140,12 +152,16 @@ struct rsa_st
  */
 #define RSA_FLAG_EXT_PKEY               0x20
 
+/* This flag in the RSA_METHOD enables the new rsa_sign, rsa_verify functions.
+ */
+#define RSA_FLAG_SIGN_VER               0x40
+
 #define RSA_PKCS1_PADDING       1
 #define RSA_SSLV23_PADDING      2
 #define RSA_NO_PADDING          3
 #define RSA_PKCS1_OAEP_PADDING  4
 
-#define RSA_set_app_data(s,arg)         RSA_set_ex_data(s,0,(char *)arg)
+#define RSA_set_app_data(s,arg)         RSA_set_ex_data(s,0,arg)
 #define RSA_get_app_data(s)             RSA_get_ex_data(s,0)
 
 RSA *   RSA_new(void);
@@ -181,6 +197,8 @@ RSA_METHOD *RSA_PKCS1_RSAref(void);
 /* these are the actual SSLeay RSA functions */
 RSA_METHOD *RSA_PKCS1_SSLeay(void);
 
+RSA_METHOD *RSA_null_method(void);
+
 void    ERR_load_RSA_strings(void );
 
 RSA *   d2i_RSAPublicKey(RSA **a, unsigned char **pp, long length);
@@ -241,10 +259,10 @@ int RSA_padding_add_none(unsigned char *to,int tlen,
 int RSA_padding_check_none(unsigned char *to,int tlen,
         unsigned char *f,int fl,int rsa_len);
 
-int RSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
-int RSA_set_ex_data(RSA *r,int idx,char *arg);
-char *RSA_get_ex_data(RSA *r, int idx);
+int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int RSA_set_ex_data(RSA *r,int idx,void *arg);
+void *RSA_get_ex_data(RSA *r, int idx);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -262,6 +280,7 @@ char *RSA_get_ex_data(RSA *r, int idx);
 #define RSA_F_RSA_EAY_PUBLIC_ENCRYPT                     104
 #define RSA_F_RSA_GENERATE_KEY                           105
 #define RSA_F_RSA_NEW_METHOD                             106
+#define RSA_F_RSA_NULL                                   124
 #define RSA_F_RSA_PADDING_ADD_NONE                       107
 #define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP                 121
 #define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1               108
@@ -292,10 +311,11 @@ char *RSA_get_ex_data(RSA *r, int idx);
 #define RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE                110
 #define RSA_R_DATA_TOO_SMALL                             111
 #define RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE                122
-#define RSA_R_D_E_NOT_CONGRUENT_TO_1                     123
 #define RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY                 112
 #define RSA_R_DMP1_NOT_CONGRUENT_TO_D                    124
 #define RSA_R_DMQ1_NOT_CONGRUENT_TO_D                    125
+#define RSA_R_D_E_NOT_CONGRUENT_TO_1                     123
+#define RSA_R_INVALID_MESSAGE_LENGTH                     131
 #define RSA_R_IQMP_NOT_INVERSE_OF_Q                      126
 #define RSA_R_KEY_SIZE_TOO_SMALL                         120
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING                  113
@@ -304,6 +324,7 @@ char *RSA_get_ex_data(RSA *r, int idx);
 #define RSA_R_PADDING_CHECK_FAILED                       114
 #define RSA_R_P_NOT_PRIME                                128
 #define RSA_R_Q_NOT_PRIME                                129
+#define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED               130
 #define RSA_R_SSLV3_ROLLBACK_ATTACK                      115
 #define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 116
 #define RSA_R_UNKNOWN_ALGORITHM_TYPE                     117
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_eay.c b/src/lib/libssl/src/crypto/rsa/rsa_eay.c
index 776324860c..179b7da90a 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_eay.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_eay.c
@@ -72,6 +72,8 @@
 #include <openssl/rsa.h>
 #include <openssl/rand.h>
 
+#ifndef RSA_NULL
+
 static int RSA_eay_public_encrypt(int flen, unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
 static int RSA_eay_private_encrypt(int flen, unsigned char *from,
@@ -285,4 +287,4 @@ static int RSA_eay_finish(RSA *rsa)
         return(1);
         }
 
-
+#endif
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_err.c b/src/lib/libssl/src/crypto/rsa/rsa_err.c
index 9fb15e398d..5cfbea2b03 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_err.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_err.c
@@ -73,6 +73,7 @@ static ERR_STRING_DATA RSA_str_functs[]=
 {ERR_PACK(0,RSA_F_RSA_EAY_PUBLIC_ENCRYPT,0),    "RSA_EAY_PUBLIC_ENCRYPT"},
 {ERR_PACK(0,RSA_F_RSA_GENERATE_KEY,0),  "RSA_generate_key"},
 {ERR_PACK(0,RSA_F_RSA_NEW_METHOD,0),    "RSA_new_method"},
+{ERR_PACK(0,RSA_F_RSA_NULL,0),  "RSA_NULL"},
 {ERR_PACK(0,RSA_F_RSA_PADDING_ADD_NONE,0),      "RSA_padding_add_none"},
 {ERR_PACK(0,RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,0),        "RSA_padding_add_PKCS1_OAEP"},
 {ERR_PACK(0,RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1,0),      "RSA_padding_add_PKCS1_type_1"},
@@ -106,10 +107,11 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE       ,"data too large for key size"},
 {RSA_R_DATA_TOO_SMALL                    ,"data too small"},
 {RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE       ,"data too small for key size"},
-{RSA_R_D_E_NOT_CONGRUENT_TO_1            ,"d e not congruent to 1"},
 {RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY        ,"digest too big for rsa key"},
 {RSA_R_DMP1_NOT_CONGRUENT_TO_D           ,"dmp1 not congruent to d"},
 {RSA_R_DMQ1_NOT_CONGRUENT_TO_D           ,"dmq1 not congruent to d"},
+{RSA_R_D_E_NOT_CONGRUENT_TO_1            ,"d e not congruent to 1"},
+{RSA_R_INVALID_MESSAGE_LENGTH            ,"invalid message length"},
 {RSA_R_IQMP_NOT_INVERSE_OF_Q             ,"iqmp not inverse of q"},
 {RSA_R_KEY_SIZE_TOO_SMALL                ,"key size too small"},
 {RSA_R_NULL_BEFORE_BLOCK_MISSING         ,"null before block missing"},
@@ -118,6 +120,7 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {RSA_R_PADDING_CHECK_FAILED              ,"padding check failed"},
 {RSA_R_P_NOT_PRIME                       ,"p not prime"},
 {RSA_R_Q_NOT_PRIME                       ,"q not prime"},
+{RSA_R_RSA_OPERATIONS_NOT_SUPPORTED      ,"rsa operations not supported"},
 {RSA_R_SSLV3_ROLLBACK_ATTACK             ,"sslv3 rollback attack"},
 {RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD,"the asn1 object identifier is not known for this md"},
 {RSA_R_UNKNOWN_ALGORITHM_TYPE            ,"unknown algorithm type"},
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_gen.c b/src/lib/libssl/src/crypto/rsa/rsa_gen.c
index 3227dba794..b1ee5d8dce 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_gen.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_gen.c
@@ -85,6 +85,7 @@ err:
                 RSAerr(RSA_F_RSA_GENERATE_KEY,ERR_LIB_BN);
                 ok=0;
                 }
+        BN_CTX_end(ctx);
         BN_CTX_free(ctx);
         BN_CTX_free(ctx2);
         
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_lib.c b/src/lib/libssl/src/crypto/rsa/rsa_lib.c
index c0ca2923a6..074a4f5074 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_lib.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_lib.c
@@ -67,7 +67,7 @@ const char *RSA_version="RSA" OPENSSL_VERSION_PTEXT;
 
 static RSA_METHOD *default_RSA_meth=NULL;
 static int rsa_meth_num=0;
-static STACK *rsa_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *rsa_meth=NULL;
 
 RSA *RSA_new(void)
         {
@@ -105,11 +105,15 @@ RSA *RSA_new_method(RSA_METHOD *meth)
 
         if (default_RSA_meth == NULL)
                 {
+#ifdef RSA_NULL
+                default_RSA_meth=RSA_null_method();
+#else
 #ifdef RSAref
                 default_RSA_meth=RSA_PKCS1_RSAref();
 #else
                 default_RSA_meth=RSA_PKCS1_SSLeay();
 #endif
+#endif
                 }
         ret=(RSA *)Malloc(sizeof(RSA));
         if (ret == NULL)
@@ -146,7 +150,7 @@ RSA *RSA_new_method(RSA_METHOD *meth)
                 ret=NULL;
                 }
         else
-                CRYPTO_new_ex_data(rsa_meth,(char *)ret,&ret->ex_data);
+                CRYPTO_new_ex_data(rsa_meth,ret,&ret->ex_data);
         return(ret);
         }
 
@@ -169,7 +173,7 @@ void RSA_free(RSA *r)
                 }
 #endif
 
-        CRYPTO_free_ex_data(rsa_meth,(char *)r,&r->ex_data);
+        CRYPTO_free_ex_data(rsa_meth,r,&r->ex_data);
 
         if (r->meth->finish != NULL)
                 r->meth->finish(r);
@@ -187,20 +191,20 @@ void RSA_free(RSA *r)
         Free(r);
         }
 
-int RSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-             int (*dup_func)(), void (*free_func)())
+int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         rsa_meth_num++;
         return(CRYPTO_get_ex_new_index(rsa_meth_num-1,
                 &rsa_meth,argl,argp,new_func,dup_func,free_func));
         }
 
-int RSA_set_ex_data(RSA *r, int idx, char *arg)
+int RSA_set_ex_data(RSA *r, int idx, void *arg)
         {
         return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
         }
 
-char *RSA_get_ex_data(RSA *r, int idx)
+void *RSA_get_ex_data(RSA *r, int idx)
         {
         return(CRYPTO_get_ex_data(&r->ex_data,idx));
         }
@@ -265,19 +269,19 @@ int RSA_blinding_on(RSA *rsa, BN_CTX *p_ctx)
         if (rsa->blinding != NULL)
                 BN_BLINDING_free(rsa->blinding);
 
-        A= &(ctx->bn[0]);
-        ctx->tos++;
+        BN_CTX_start(ctx);
+        A = BN_CTX_get(ctx);
         if (!BN_rand(A,BN_num_bits(rsa->n)-1,1,0)) goto err;
         if ((Ai=BN_mod_inverse(NULL,A,rsa->n,ctx)) == NULL) goto err;
 
         if (!rsa->meth->bn_mod_exp(A,A,rsa->e,rsa->n,ctx,rsa->_method_mod_n))
             goto err;
         rsa->blinding=BN_BLINDING_new(A,Ai,rsa->n);
-        ctx->tos--;
         rsa->flags|=RSA_FLAG_BLINDING;
         BN_free(Ai);
         ret=1;
 err:
+        BN_CTX_end(ctx);
         if (ctx != p_ctx) BN_CTX_free(ctx);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_null.c b/src/lib/libssl/src/crypto/rsa/rsa_null.c
new file mode 100644
index 0000000000..7b58a0eca3
--- /dev/null
+++ b/src/lib/libssl/src/crypto/rsa/rsa_null.c
@@ -0,0 +1,149 @@
+/* rsa_null.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/rand.h>
+
+/* This is a dummy RSA implementation that just returns errors when called.
+ * It is designed to allow some RSA functions to work while stopping those
+ * covered by the RSA patent. That is RSA, encryption, decryption, signing
+ * and verify is not allowed but RSA key generation, key checking and other
+ * operations (like storing RSA keys) are permitted.
+ */
+
+static int RSA_null_public_encrypt(int flen, unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+static int RSA_null_private_encrypt(int flen, unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+static int RSA_null_public_decrypt(int flen, unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+static int RSA_null_private_decrypt(int flen, unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+#if 0 /* not currently used */
+static int RSA_null_mod_exp(BIGNUM *r0, BIGNUM *i, RSA *rsa);
+#endif
+static int RSA_null_init(RSA *rsa);
+static int RSA_null_finish(RSA *rsa);
+static RSA_METHOD rsa_null_meth={
+        "Null RSA",
+        RSA_null_public_encrypt,
+        RSA_null_public_decrypt,
+        RSA_null_private_encrypt,
+        RSA_null_private_decrypt,
+        NULL, NULL,
+        RSA_null_init,
+        RSA_null_finish,
+        0,
+        NULL,
+        };
+
+RSA_METHOD *RSA_null_method(void)
+        {
+        return(&rsa_null_meth);
+        }
+
+static int RSA_null_public_encrypt(int flen, unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+
+static int RSA_null_private_encrypt(int flen, unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+
+static int RSA_null_private_decrypt(int flen, unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+
+static int RSA_null_public_decrypt(int flen, unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+
+#if 0 /* not currently used */
+static int RSA_null_mod_exp(BIGNUM *r0, BIGNUM *I, RSA *rsa)
+        {
+        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        return -1;
+        }
+#endif
+
+static int RSA_null_init(RSA *rsa)
+        {
+        return(1);
+        }
+
+static int RSA_null_finish(RSA *rsa)
+        {
+        return(1);
+        }
+
+
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_oaep.c b/src/lib/libssl/src/crypto/rsa/rsa_oaep.c
index 843c40c864..1465c01f4f 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_oaep.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_oaep.c
@@ -50,7 +50,8 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
            emlen - flen - 2 * SHA_DIGEST_LENGTH - 1);
     db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;
     memcpy(db + emlen - flen - SHA_DIGEST_LENGTH, from, (unsigned int) flen);
-    RAND_bytes(seed, SHA_DIGEST_LENGTH);
+    if (RAND_bytes(seed, SHA_DIGEST_LENGTH) <= 0)
+        return (0);
 #ifdef PKCS_TESTVECT
     memcpy(seed,
            "\xaa\xfd\x12\xf6\x59\xca\xe6\x34\x89\xb4\x79\xe5\x07\x6d\xde\xc2\xf0\x6c\xb5\x8f",
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_oaep_test.c b/src/lib/libssl/src/crypto/rsa/rsa_oaep_test.c
index 0d4e39d3da..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_oaep_test.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_oaep_test.c
@@ -1,309 +0,0 @@
-/* test vectors from p1ovect1.txt */
-
-#include <stdio.h>
-#include <string.h>
-
-#include "openssl/e_os.h"
-
-#include <openssl/crypto.h>
-#include <openssl/err.h>
-#ifdef NO_RSA
-int main(int argc, char *argv[])
-{
-    printf("No RSA support\n");
-    return(0);
-}
-#else
-#include <openssl/rsa.h>
-
-#define SetKey \
-  key->n = BN_bin2bn(n, sizeof(n)-1, key->n); \
-  key->e = BN_bin2bn(e, sizeof(e)-1, key->e); \
-  key->d = BN_bin2bn(d, sizeof(d)-1, key->d); \
-  key->p = BN_bin2bn(p, sizeof(p)-1, key->p); \
-  key->q = BN_bin2bn(q, sizeof(q)-1, key->q); \
-  key->dmp1 = BN_bin2bn(dmp1, sizeof(dmp1)-1, key->dmp1); \
-  key->dmq1 = BN_bin2bn(dmq1, sizeof(dmq1)-1, key->dmq1); \
-  key->iqmp = BN_bin2bn(iqmp, sizeof(iqmp)-1, key->iqmp); \
-  memcpy(c, ctext_ex, sizeof(ctext_ex) - 1); \
-  return (sizeof(ctext_ex) - 1);
-
-static int key1(RSA *key, unsigned char *c)
-    {
-    static unsigned char n[] =
-"\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F"
-"\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5"
-"\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93"
-"\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1"
-"\xF5";
-
-    static unsigned char e[] = "\x11";
-
-    static unsigned char d[] =
-"\x0A\x03\x37\x48\x62\x64\x87\x69\x5F\x5F\x30\xBC\x38\xB9\x8B\x44"
-"\xC2\xCD\x2D\xFF\x43\x40\x98\xCD\x20\xD8\xA1\x38\xD0\x90\xBF\x64"
-"\x79\x7C\x3F\xA7\xA2\xCD\xCB\x3C\xD1\xE0\xBD\xBA\x26\x54\xB4\xF9"
-"\xDF\x8E\x8A\xE5\x9D\x73\x3D\x9F\x33\xB3\x01\x62\x4A\xFD\x1D\x51";
-
-    static unsigned char p[] =
-"\x00\xD8\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
-"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x12"
-"\x0D";
-    
-    static unsigned char q[] =
-"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
-"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
-"\x89";
-
-    static unsigned char dmp1[] =
-"\x59\x0B\x95\x72\xA2\xC2\xA9\xC4\x06\x05\x9D\xC2\xAB\x2F\x1D\xAF"
-"\xEB\x7E\x8B\x4F\x10\xA7\x54\x9E\x8E\xED\xF5\xB4\xFC\xE0\x9E\x05";
-
-    static unsigned char dmq1[] =
-"\x00\x8E\x3C\x05\x21\xFE\x15\xE0\xEA\x06\xA3\x6F\xF0\xF1\x0C\x99"
-"\x52\xC3\x5B\x7A\x75\x14\xFD\x32\x38\xB8\x0A\xAD\x52\x98\x62\x8D"
-"\x51";
-
-    static unsigned char iqmp[] =
-"\x36\x3F\xF7\x18\x9D\xA8\xE9\x0B\x1D\x34\x1F\x71\xD0\x9B\x76\xA8"
-"\xA9\x43\xE1\x1D\x10\xB2\x4D\x24\x9F\x2D\xEA\xFE\xF8\x0C\x18\x26";
-
-    static unsigned char ctext_ex[] =
-"\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89"
-"\x2b\xfb\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52"
-"\x33\x89\x5c\x74\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44"
-"\xb0\x05\xc3\x9e\xd8\x27\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";
-
-    SetKey;
-    }
-
-static int key2(RSA *key, unsigned char *c)
-    {
-    static unsigned char n[] =
-"\x00\xA3\x07\x9A\x90\xDF\x0D\xFD\x72\xAC\x09\x0C\xCC\x2A\x78\xB8"
-"\x74\x13\x13\x3E\x40\x75\x9C\x98\xFA\xF8\x20\x4F\x35\x8A\x0B\x26"
-"\x3C\x67\x70\xE7\x83\xA9\x3B\x69\x71\xB7\x37\x79\xD2\x71\x7B\xE8"
-"\x34\x77\xCF";
-
-    static unsigned char e[] = "\x3";
-
-    static unsigned char d[] =
-"\x6C\xAF\xBC\x60\x94\xB3\xFE\x4C\x72\xB0\xB3\x32\xC6\xFB\x25\xA2"
-"\xB7\x62\x29\x80\x4E\x68\x65\xFC\xA4\x5A\x74\xDF\x0F\x8F\xB8\x41"
-"\x3B\x52\xC0\xD0\xE5\x3D\x9B\x59\x0F\xF1\x9B\xE7\x9F\x49\xDD\x21"
-"\xE5\xEB";
-
-    static unsigned char p[] =
-"\x00\xCF\x20\x35\x02\x8B\x9D\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92"
-"\xEA\x0D\xA3\xB4\x32\x04\xB5\xCF\xCE\x91";
-
-    static unsigned char q[] =
-"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
-"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5F";
-    
-    static unsigned char dmp1[] =
-"\x00\x8A\x15\x78\xAC\x5D\x13\xAF\x10\x2B\x22\xB9\x99\xCD\x74\x61"
-"\xF1\x5E\x6D\x22\xCC\x03\x23\xDF\xDF\x0B";
-
-    static unsigned char dmq1[] =
-"\x00\x86\x55\x21\x4A\xC5\x4D\x8D\x4E\xCD\x61\x77\xF1\xC7\x36\x90"
-"\xCE\x2A\x48\x2C\x8B\x05\x99\xCB\xE0\x3F";
-
-    static unsigned char iqmp[] =
-"\x00\x83\xEF\xEF\xB8\xA9\xA4\x0D\x1D\xB6\xED\x98\xAD\x84\xED\x13"
-"\x35\xDC\xC1\x08\xF3\x22\xD0\x57\xCF\x8D";
-
-    static unsigned char ctext_ex[] =
-"\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a"
-"\x8b\x40\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4"
-"\x17\x53\x03\x29\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52"
-"\x62\x51";
-
-    SetKey;
-    }
-
-static int key3(RSA *key, unsigned char *c)
-    {
-    static unsigned char n[] =
-"\x00\xBB\xF8\x2F\x09\x06\x82\xCE\x9C\x23\x38\xAC\x2B\x9D\xA8\x71"
-"\xF7\x36\x8D\x07\xEE\xD4\x10\x43\xA4\x40\xD6\xB6\xF0\x74\x54\xF5"
-"\x1F\xB8\xDF\xBA\xAF\x03\x5C\x02\xAB\x61\xEA\x48\xCE\xEB\x6F\xCD"
-"\x48\x76\xED\x52\x0D\x60\xE1\xEC\x46\x19\x71\x9D\x8A\x5B\x8B\x80"
-"\x7F\xAF\xB8\xE0\xA3\xDF\xC7\x37\x72\x3E\xE6\xB4\xB7\xD9\x3A\x25"
-"\x84\xEE\x6A\x64\x9D\x06\x09\x53\x74\x88\x34\xB2\x45\x45\x98\x39"
-"\x4E\xE0\xAA\xB1\x2D\x7B\x61\xA5\x1F\x52\x7A\x9A\x41\xF6\xC1\x68"
-"\x7F\xE2\x53\x72\x98\xCA\x2A\x8F\x59\x46\xF8\xE5\xFD\x09\x1D\xBD"
-"\xCB";
-
-    static unsigned char e[] = "\x11";
-
-    static unsigned char d[] =
-"\x00\xA5\xDA\xFC\x53\x41\xFA\xF2\x89\xC4\xB9\x88\xDB\x30\xC1\xCD"
-"\xF8\x3F\x31\x25\x1E\x06\x68\xB4\x27\x84\x81\x38\x01\x57\x96\x41"
-"\xB2\x94\x10\xB3\xC7\x99\x8D\x6B\xC4\x65\x74\x5E\x5C\x39\x26\x69"
-"\xD6\x87\x0D\xA2\xC0\x82\xA9\x39\xE3\x7F\xDC\xB8\x2E\xC9\x3E\xDA"
-"\xC9\x7F\xF3\xAD\x59\x50\xAC\xCF\xBC\x11\x1C\x76\xF1\xA9\x52\x94"
-"\x44\xE5\x6A\xAF\x68\xC5\x6C\x09\x2C\xD3\x8D\xC3\xBE\xF5\xD2\x0A"
-"\x93\x99\x26\xED\x4F\x74\xA1\x3E\xDD\xFB\xE1\xA1\xCE\xCC\x48\x94"
-"\xAF\x94\x28\xC2\xB7\xB8\x88\x3F\xE4\x46\x3A\x4B\xC8\x5B\x1C\xB3"
-"\xC1";
-
-    static unsigned char p[] =
-"\x00\xEE\xCF\xAE\x81\xB1\xB9\xB3\xC9\x08\x81\x0B\x10\xA1\xB5\x60"
-"\x01\x99\xEB\x9F\x44\xAE\xF4\xFD\xA4\x93\xB8\x1A\x9E\x3D\x84\xF6"
-"\x32\x12\x4E\xF0\x23\x6E\x5D\x1E\x3B\x7E\x28\xFA\xE7\xAA\x04\x0A"
-"\x2D\x5B\x25\x21\x76\x45\x9D\x1F\x39\x75\x41\xBA\x2A\x58\xFB\x65"
-"\x99";
-
-    static unsigned char q[] =
-"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
-"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
-"\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
-"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x15"
-"\x03";
-
-    static unsigned char dmp1[] =
-"\x54\x49\x4C\xA6\x3E\xBA\x03\x37\xE4\xE2\x40\x23\xFC\xD6\x9A\x5A"
-"\xEB\x07\xDD\xDC\x01\x83\xA4\xD0\xAC\x9B\x54\xB0\x51\xF2\xB1\x3E"
-"\xD9\x49\x09\x75\xEA\xB7\x74\x14\xFF\x59\xC1\xF7\x69\x2E\x9A\x2E"
-"\x20\x2B\x38\xFC\x91\x0A\x47\x41\x74\xAD\xC9\x3C\x1F\x67\xC9\x81";
-
-    static unsigned char dmq1[] =
-"\x47\x1E\x02\x90\xFF\x0A\xF0\x75\x03\x51\xB7\xF8\x78\x86\x4C\xA9"
-"\x61\xAD\xBD\x3A\x8A\x7E\x99\x1C\x5C\x05\x56\xA9\x4C\x31\x46\xA7"
-"\xF9\x80\x3F\x8F\x6F\x8A\xE3\x42\xE9\x31\xFD\x8A\xE4\x7A\x22\x0D"
-"\x1B\x99\xA4\x95\x84\x98\x07\xFE\x39\xF9\x24\x5A\x98\x36\xDA\x3D";
-    
-    static unsigned char iqmp[] =
-"\x00\xB0\x6C\x4F\xDA\xBB\x63\x01\x19\x8D\x26\x5B\xDB\xAE\x94\x23"
-"\xB3\x80\xF2\x71\xF7\x34\x53\x88\x50\x93\x07\x7F\xCD\x39\xE2\x11"
-"\x9F\xC9\x86\x32\x15\x4F\x58\x83\xB1\x67\xA9\x67\xBF\x40\x2B\x4E"
-"\x9E\x2E\x0F\x96\x56\xE6\x98\xEA\x36\x66\xED\xFB\x25\x79\x80\x39"
-"\xF7";
-
-    static unsigned char ctext_ex[] =
-"\xb8\x24\x6b\x56\xa6\xed\x58\x81\xae\xb5\x85\xd9\xa2\x5b\x2a\xd7"
-"\x90\xc4\x17\xe0\x80\x68\x1b\xf1\xac\x2b\xc3\xde\xb6\x9d\x8b\xce"
-"\xf0\xc4\x36\x6f\xec\x40\x0a\xf0\x52\xa7\x2e\x9b\x0e\xff\xb5\xb3"
-"\xf2\xf1\x92\xdb\xea\xca\x03\xc1\x27\x40\x05\x71\x13\xbf\x1f\x06"
-"\x69\xac\x22\xe9\xf3\xa7\x85\x2e\x3c\x15\xd9\x13\xca\xb0\xb8\x86"
-"\x3a\x95\xc9\x92\x94\xce\x86\x74\x21\x49\x54\x61\x03\x46\xf4\xd4"
-"\x74\xb2\x6f\x7c\x48\xb4\x2e\xe6\x8e\x1f\x57\x2a\x1f\xc4\x02\x6a"
-"\xc4\x56\xb4\xf5\x9f\x7b\x62\x1e\xa1\xb9\xd8\x8f\x64\x20\x2f\xb1";
-
-    SetKey;
-    }
-
-static int pad_unknown(void)
-{
-    unsigned long l;
-    while ((l = ERR_get_error()) != 0)
-      if (ERR_GET_REASON(l) == RSA_R_UNKNOWN_PADDING_TYPE)
-        return(1);
-    return(0);
-}
-
-int main() 
-    {
-    int err=0;
-    int v;
-    RSA *key;
-    unsigned char ptext[256];
-    unsigned char ctext[256];
-    static unsigned char ptext_ex[] = "\x54\x85\x9b\x34\x2c\x49\xea\x2a";
-    unsigned char ctext_ex[256];
-    int plen;
-    int clen = 0;
-    int num;
-
-    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
-        
-    plen = sizeof(ptext_ex) - 1;
-
-    for (v = 0; v < 3; v++)
-        {
-        key = RSA_new();
-        switch (v) {
-    case 0:
-        clen = key1(key, ctext_ex);
-        break;
-    case 1:
-        clen = key2(key, ctext_ex);
-        break;
-    case 2:
-        clen = key3(key, ctext_ex);
-        break;
-        }
-
-        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
-                                 RSA_PKCS1_PADDING);
-        if (num != clen)
-            {
-            printf("PKCS#1 v1.5 encryption failed!\n");
-            err=1;
-            goto oaep;
-            }
-  
-        num = RSA_private_decrypt(num, ctext, ptext, key,
-                                  RSA_PKCS1_PADDING);
-        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
-            {
-            printf("PKCS#1 v1.5 decryption failed!\n");
-            err=1;
-            }
-        else
-            printf("PKCS #1 v1.5 encryption/decryption ok\n");
-
-    oaep:
-        ERR_clear_error();
-        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
-                                 RSA_PKCS1_OAEP_PADDING);
-        if (num == -1 && pad_unknown())
-            {
-            printf("No OAEP support\n");
-            goto next;
-            }
-        if (num != clen)
-            {
-            printf("OAEP encryption failed!\n");
-            err=1;
-            goto next;
-            }
-  
-        num = RSA_private_decrypt(num, ctext, ptext, key,
-                                  RSA_PKCS1_OAEP_PADDING);
-        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
-            {
-            printf("OAEP decryption (encrypted data) failed!\n");
-            err=1;
-            }
-        else if (memcmp(ctext, ctext_ex, num) == 0)
-            {
-            printf("OAEP test vector %d passed!\n", v);
-            goto next;
-            }
-    
-        /* Different ciphertexts (rsa_oaep.c without -DPKCS_TESTVECT).
-           Try decrypting ctext_ex */
-
-        num = RSA_private_decrypt(clen, ctext_ex, ptext, key,
-                                  RSA_PKCS1_OAEP_PADDING);
-
-        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
-            {
-            printf("OAEP decryption (test vector data) failed!\n");
-            err=1;
-            }
-        else
-            printf("OAEP encryption/decryption ok\n");
-    next:
-        RSA_free(key);
-        }
-
-    ERR_remove_state(0);
-
-    CRYPTO_mem_leaks_fp(stdout);
-
-    return err;
-    }
-#endif
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_pk1.c b/src/lib/libssl/src/crypto/rsa/rsa_pk1.c
index f0ae51f234..48a32bc264 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_pk1.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_pk1.c
@@ -79,7 +79,7 @@ int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
         *(p++)=0;
         *(p++)=1; /* Private Key BT (Block Type) */
 
-        /* padd out with 0xff data */
+        /* pad out with 0xff data */
         j=tlen-3-flen;
         memset(p,0xff,j);
         p+=j;
@@ -130,6 +130,11 @@ int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
                 }
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);
@@ -155,12 +160,14 @@ int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
         /* pad out with non-zero random data */
         j=tlen-3-flen;
 
-        RAND_bytes(p,j);
+        if (RAND_bytes(p,j) <= 0)
+                return(0);
         for (i=0; i<j; i++)
                 {
                 if (*p == '\0')
                         do      {
-                                RAND_bytes(p,1);
+                                if (RAND_bytes(p,1) <= 0)
+                                        return(0);
                                 } while (*p == '\0');
                 p++;
                 }
@@ -205,6 +212,11 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
                 }
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_saos.c b/src/lib/libssl/src/crypto/rsa/rsa_saos.c
index 73b8b0c7ad..61efb0b00f 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_saos.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_saos.c
@@ -136,7 +136,7 @@ int RSA_verify_ASN1_OCTET_STRING(int dtype, unsigned char *m,
         else
                 ret=1;
 err:
-        if (sig != NULL) ASN1_OCTET_STRING_free(sig);
+        if (sig != NULL) M_ASN1_OCTET_STRING_free(sig);
         memset(s,0,(unsigned int)siglen);
         Free(s);
         return(ret);
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_sign.c b/src/lib/libssl/src/crypto/rsa/rsa_sign.c
index 1740494a4c..05bb7fb74a 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_sign.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_sign.c
@@ -63,59 +63,77 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 
+/* Size of an SSL signature: MD5+SHA1 */
+#define SSL_SIG_LENGTH  36
+
 int RSA_sign(int type, unsigned char *m, unsigned int m_len,
              unsigned char *sigret, unsigned int *siglen, RSA *rsa)
         {
         X509_SIG sig;
         ASN1_TYPE parameter;
         int i,j,ret=1;
-        unsigned char *p,*s;
+        unsigned char *p,*s = NULL;
         X509_ALGOR algor;
         ASN1_OCTET_STRING digest;
-
-        sig.algor= &algor;
-        sig.algor->algorithm=OBJ_nid2obj(type);
-        if (sig.algor->algorithm == NULL)
-                {
-                RSAerr(RSA_F_RSA_SIGN,RSA_R_UNKNOWN_ALGORITHM_TYPE);
-                return(0);
-                }
-        if (sig.algor->algorithm->length == 0)
-                {
-                RSAerr(RSA_F_RSA_SIGN,RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
-                return(0);
+        if(rsa->flags & RSA_FLAG_SIGN_VER)
+              return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);
+        /* Special case: SSL signature, just check the length */
+        if(type == NID_md5_sha1) {
+                if(m_len != SSL_SIG_LENGTH) {
+                        RSAerr(RSA_F_RSA_SIGN,RSA_R_INVALID_MESSAGE_LENGTH);
+                        return(0);
                 }
-        parameter.type=V_ASN1_NULL;
-        parameter.value.ptr=NULL;
-        sig.algor->parameter= &parameter;
+                i = SSL_SIG_LENGTH;
+                s = m;
+        } else {
+                sig.algor= &algor;
+                sig.algor->algorithm=OBJ_nid2obj(type);
+                if (sig.algor->algorithm == NULL)
+                        {
+                        RSAerr(RSA_F_RSA_SIGN,RSA_R_UNKNOWN_ALGORITHM_TYPE);
+                        return(0);
+                        }
+                if (sig.algor->algorithm->length == 0)
+                        {
+                        RSAerr(RSA_F_RSA_SIGN,RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
+                        return(0);
+                        }
+                parameter.type=V_ASN1_NULL;
+                parameter.value.ptr=NULL;
+                sig.algor->parameter= &parameter;
 
-        sig.digest= &digest;
-        sig.digest->data=m;
-        sig.digest->length=m_len;
+                sig.digest= &digest;
+                sig.digest->data=m;
+                sig.digest->length=m_len;
 
-        i=i2d_X509_SIG(&sig,NULL);
+                i=i2d_X509_SIG(&sig,NULL);
+        }
         j=RSA_size(rsa);
         if ((i-RSA_PKCS1_PADDING) > j)
                 {
                 RSAerr(RSA_F_RSA_SIGN,RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);
                 return(0);
                 }
-        s=(unsigned char *)Malloc((unsigned int)j+1);
-        if (s == NULL)
-                {
-                RSAerr(RSA_F_RSA_SIGN,ERR_R_MALLOC_FAILURE);
-                return(0);
-                }
-        p=s;
-        i2d_X509_SIG(&sig,&p);
+        if(type != NID_md5_sha1) {
+                s=(unsigned char *)Malloc((unsigned int)j+1);
+                if (s == NULL)
+                        {
+                        RSAerr(RSA_F_RSA_SIGN,ERR_R_MALLOC_FAILURE);
+                        return(0);
+                        }
+                p=s;
+                i2d_X509_SIG(&sig,&p);
+        }
         i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);
         if (i <= 0)
                 ret=0;
         else
                 *siglen=i;
 
-        memset(s,0,(unsigned int)j+1);
-        Free(s);
+        if(type != NID_md5_sha1) {
+                memset(s,0,(unsigned int)j+1);
+                Free(s);
+        }
         return(ret);
         }
 
@@ -132,53 +150,68 @@ int RSA_verify(int dtype, unsigned char *m, unsigned int m_len,
                 return(0);
                 }
 
+        if(rsa->flags & RSA_FLAG_SIGN_VER)
+            return rsa->meth->rsa_verify(dtype, m, m_len, sigbuf, siglen, rsa);
+
         s=(unsigned char *)Malloc((unsigned int)siglen);
         if (s == NULL)
                 {
                 RSAerr(RSA_F_RSA_VERIFY,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
+        if((dtype == NID_md5_sha1) && (m_len != SSL_SIG_LENGTH) ) {
+                        RSAerr(RSA_F_RSA_VERIFY,RSA_R_INVALID_MESSAGE_LENGTH);
+                        return(0);
+        }
         i=RSA_public_decrypt((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING);
 
         if (i <= 0) goto err;
 
-        p=s;
-        sig=d2i_X509_SIG(NULL,&p,(long)i);
+        /* Special case: SSL signature */
+        if(dtype == NID_md5_sha1) {
+                if((i != SSL_SIG_LENGTH) || memcmp(s, m, SSL_SIG_LENGTH))
+                                RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+                else ret = 1;
+        } else {
+                p=s;
+                sig=d2i_X509_SIG(NULL,&p,(long)i);
 
-        if (sig == NULL) goto err;
-        sigtype=OBJ_obj2nid(sig->algor->algorithm);
+                if (sig == NULL) goto err;
+                sigtype=OBJ_obj2nid(sig->algor->algorithm);
 
 
-#ifdef RSA_DEBUG
-        /* put a backward compatability flag in EAY */
-        fprintf(stderr,"in(%s) expect(%s)\n",OBJ_nid2ln(sigtype),
-                OBJ_nid2ln(dtype));
-#endif
-        if (sigtype != dtype)
-                {
-                if (((dtype == NID_md5) &&
-                        (sigtype == NID_md5WithRSAEncryption)) ||
-                        ((dtype == NID_md2) &&
-                        (sigtype == NID_md2WithRSAEncryption)))
+        #ifdef RSA_DEBUG
+                /* put a backward compatibility flag in EAY */
+                fprintf(stderr,"in(%s) expect(%s)\n",OBJ_nid2ln(sigtype),
+                        OBJ_nid2ln(dtype));
+        #endif
+                if (sigtype != dtype)
                         {
-                        /* ok, we will let it through */
-#if !defined(NO_STDIO) && !defined(WIN16)
-                        fprintf(stderr,"signature has problems, re-make with post SSLeay045\n");
-#endif
+                        if (((dtype == NID_md5) &&
+                                (sigtype == NID_md5WithRSAEncryption)) ||
+                                ((dtype == NID_md2) &&
+                                (sigtype == NID_md2WithRSAEncryption)))
+                                {
+                                /* ok, we will let it through */
+        #if !defined(NO_STDIO) && !defined(WIN16)
+                                fprintf(stderr,"signature has problems, re-make with post SSLeay045\n");
+        #endif
+                                }
+                        else
+                                {
+                                RSAerr(RSA_F_RSA_VERIFY,
+                                                RSA_R_ALGORITHM_MISMATCH);
+                                goto err;
+                                }
                         }
-                else
+                if (    ((unsigned int)sig->digest->length != m_len) ||
+                        (memcmp(m,sig->digest->data,m_len) != 0))
                         {
-                        RSAerr(RSA_F_RSA_VERIFY,RSA_R_ALGORITHM_MISMATCH);
-                        goto err;
+                        RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
                         }
-                }
-        if (    ((unsigned int)sig->digest->length != m_len) ||
-                (memcmp(m,sig->digest->data,m_len) != 0))
-                {
-                RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
-                }
-        else
-                ret=1;
+                else
+                        ret=1;
+        }
 err:
         if (sig != NULL) X509_SIG_free(sig);
         memset(s,0,(unsigned int)siglen);
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_ssl.c b/src/lib/libssl/src/crypto/rsa/rsa_ssl.c
index 1050844f8d..81a857c813 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_ssl.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_ssl.c
@@ -82,12 +82,14 @@ int RSA_padding_add_SSLv23(unsigned char *to, int tlen, unsigned char *from,
         /* pad out with non-zero random data */
         j=tlen-3-8-flen;
 
-        RAND_bytes(p,j);
+        if (RAND_bytes(p,j) <= 0)
+                return(0);
         for (i=0; i<j; i++)
                 {
                 if (*p == '\0')
                         do      {
-                                RAND_bytes(p,1);
+                                if (RAND_bytes(p,1) <= 0)
+                                        return(0);
                                 } while (*p == '\0');
                 p++;
                 }
@@ -140,6 +142,11 @@ int RSA_padding_check_SSLv23(unsigned char *to, int tlen, unsigned char *from,
 
         i++; /* Skip over the '\0' */
         j-=i;
+        if (j > tlen)
+                {
+                RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,RSA_R_DATA_TOO_LARGE);
+                return(-1);
+                }
         memcpy(to,p,(unsigned int)j);
 
         return(j);
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_test.c b/src/lib/libssl/src/crypto/rsa/rsa_test.c
new file mode 100644
index 0000000000..e5ae0c1f69
--- /dev/null
+++ b/src/lib/libssl/src/crypto/rsa/rsa_test.c
@@ -0,0 +1,314 @@
+/* test vectors from p1ovect1.txt */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "openssl/e_os.h"
+
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+#ifdef NO_RSA
+int main(int argc, char *argv[])
+{
+    printf("No RSA support\n");
+    return(0);
+}
+#else
+#include <openssl/rsa.h>
+
+#define SetKey \
+  key->n = BN_bin2bn(n, sizeof(n)-1, key->n); \
+  key->e = BN_bin2bn(e, sizeof(e)-1, key->e); \
+  key->d = BN_bin2bn(d, sizeof(d)-1, key->d); \
+  key->p = BN_bin2bn(p, sizeof(p)-1, key->p); \
+  key->q = BN_bin2bn(q, sizeof(q)-1, key->q); \
+  key->dmp1 = BN_bin2bn(dmp1, sizeof(dmp1)-1, key->dmp1); \
+  key->dmq1 = BN_bin2bn(dmq1, sizeof(dmq1)-1, key->dmq1); \
+  key->iqmp = BN_bin2bn(iqmp, sizeof(iqmp)-1, key->iqmp); \
+  memcpy(c, ctext_ex, sizeof(ctext_ex) - 1); \
+  return (sizeof(ctext_ex) - 1);
+
+static int key1(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F"
+"\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5"
+"\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93"
+"\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1"
+"\xF5";
+
+    static unsigned char e[] = "\x11";
+
+    static unsigned char d[] =
+"\x0A\x03\x37\x48\x62\x64\x87\x69\x5F\x5F\x30\xBC\x38\xB9\x8B\x44"
+"\xC2\xCD\x2D\xFF\x43\x40\x98\xCD\x20\xD8\xA1\x38\xD0\x90\xBF\x64"
+"\x79\x7C\x3F\xA7\xA2\xCD\xCB\x3C\xD1\xE0\xBD\xBA\x26\x54\xB4\xF9"
+"\xDF\x8E\x8A\xE5\x9D\x73\x3D\x9F\x33\xB3\x01\x62\x4A\xFD\x1D\x51";
+
+    static unsigned char p[] =
+"\x00\xD8\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
+"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x12"
+"\x0D";
+    
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
+"\x89";
+
+    static unsigned char dmp1[] =
+"\x59\x0B\x95\x72\xA2\xC2\xA9\xC4\x06\x05\x9D\xC2\xAB\x2F\x1D\xAF"
+"\xEB\x7E\x8B\x4F\x10\xA7\x54\x9E\x8E\xED\xF5\xB4\xFC\xE0\x9E\x05";
+
+    static unsigned char dmq1[] =
+"\x00\x8E\x3C\x05\x21\xFE\x15\xE0\xEA\x06\xA3\x6F\xF0\xF1\x0C\x99"
+"\x52\xC3\x5B\x7A\x75\x14\xFD\x32\x38\xB8\x0A\xAD\x52\x98\x62\x8D"
+"\x51";
+
+    static unsigned char iqmp[] =
+"\x36\x3F\xF7\x18\x9D\xA8\xE9\x0B\x1D\x34\x1F\x71\xD0\x9B\x76\xA8"
+"\xA9\x43\xE1\x1D\x10\xB2\x4D\x24\x9F\x2D\xEA\xFE\xF8\x0C\x18\x26";
+
+    static unsigned char ctext_ex[] =
+"\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89"
+"\x2b\xfb\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52"
+"\x33\x89\x5c\x74\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44"
+"\xb0\x05\xc3\x9e\xd8\x27\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";
+
+    SetKey;
+    }
+
+static int key2(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xA3\x07\x9A\x90\xDF\x0D\xFD\x72\xAC\x09\x0C\xCC\x2A\x78\xB8"
+"\x74\x13\x13\x3E\x40\x75\x9C\x98\xFA\xF8\x20\x4F\x35\x8A\x0B\x26"
+"\x3C\x67\x70\xE7\x83\xA9\x3B\x69\x71\xB7\x37\x79\xD2\x71\x7B\xE8"
+"\x34\x77\xCF";
+
+    static unsigned char e[] = "\x3";
+
+    static unsigned char d[] =
+"\x6C\xAF\xBC\x60\x94\xB3\xFE\x4C\x72\xB0\xB3\x32\xC6\xFB\x25\xA2"
+"\xB7\x62\x29\x80\x4E\x68\x65\xFC\xA4\x5A\x74\xDF\x0F\x8F\xB8\x41"
+"\x3B\x52\xC0\xD0\xE5\x3D\x9B\x59\x0F\xF1\x9B\xE7\x9F\x49\xDD\x21"
+"\xE5\xEB";
+
+    static unsigned char p[] =
+"\x00\xCF\x20\x35\x02\x8B\x9D\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92"
+"\xEA\x0D\xA3\xB4\x32\x04\xB5\xCF\xCE\x91";
+
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5F";
+    
+    static unsigned char dmp1[] =
+"\x00\x8A\x15\x78\xAC\x5D\x13\xAF\x10\x2B\x22\xB9\x99\xCD\x74\x61"
+"\xF1\x5E\x6D\x22\xCC\x03\x23\xDF\xDF\x0B";
+
+    static unsigned char dmq1[] =
+"\x00\x86\x55\x21\x4A\xC5\x4D\x8D\x4E\xCD\x61\x77\xF1\xC7\x36\x90"
+"\xCE\x2A\x48\x2C\x8B\x05\x99\xCB\xE0\x3F";
+
+    static unsigned char iqmp[] =
+"\x00\x83\xEF\xEF\xB8\xA9\xA4\x0D\x1D\xB6\xED\x98\xAD\x84\xED\x13"
+"\x35\xDC\xC1\x08\xF3\x22\xD0\x57\xCF\x8D";
+
+    static unsigned char ctext_ex[] =
+"\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a"
+"\x8b\x40\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4"
+"\x17\x53\x03\x29\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52"
+"\x62\x51";
+
+    SetKey;
+    }
+
+static int key3(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xBB\xF8\x2F\x09\x06\x82\xCE\x9C\x23\x38\xAC\x2B\x9D\xA8\x71"
+"\xF7\x36\x8D\x07\xEE\xD4\x10\x43\xA4\x40\xD6\xB6\xF0\x74\x54\xF5"
+"\x1F\xB8\xDF\xBA\xAF\x03\x5C\x02\xAB\x61\xEA\x48\xCE\xEB\x6F\xCD"
+"\x48\x76\xED\x52\x0D\x60\xE1\xEC\x46\x19\x71\x9D\x8A\x5B\x8B\x80"
+"\x7F\xAF\xB8\xE0\xA3\xDF\xC7\x37\x72\x3E\xE6\xB4\xB7\xD9\x3A\x25"
+"\x84\xEE\x6A\x64\x9D\x06\x09\x53\x74\x88\x34\xB2\x45\x45\x98\x39"
+"\x4E\xE0\xAA\xB1\x2D\x7B\x61\xA5\x1F\x52\x7A\x9A\x41\xF6\xC1\x68"
+"\x7F\xE2\x53\x72\x98\xCA\x2A\x8F\x59\x46\xF8\xE5\xFD\x09\x1D\xBD"
+"\xCB";
+
+    static unsigned char e[] = "\x11";
+
+    static unsigned char d[] =
+"\x00\xA5\xDA\xFC\x53\x41\xFA\xF2\x89\xC4\xB9\x88\xDB\x30\xC1\xCD"
+"\xF8\x3F\x31\x25\x1E\x06\x68\xB4\x27\x84\x81\x38\x01\x57\x96\x41"
+"\xB2\x94\x10\xB3\xC7\x99\x8D\x6B\xC4\x65\x74\x5E\x5C\x39\x26\x69"
+"\xD6\x87\x0D\xA2\xC0\x82\xA9\x39\xE3\x7F\xDC\xB8\x2E\xC9\x3E\xDA"
+"\xC9\x7F\xF3\xAD\x59\x50\xAC\xCF\xBC\x11\x1C\x76\xF1\xA9\x52\x94"
+"\x44\xE5\x6A\xAF\x68\xC5\x6C\x09\x2C\xD3\x8D\xC3\xBE\xF5\xD2\x0A"
+"\x93\x99\x26\xED\x4F\x74\xA1\x3E\xDD\xFB\xE1\xA1\xCE\xCC\x48\x94"
+"\xAF\x94\x28\xC2\xB7\xB8\x88\x3F\xE4\x46\x3A\x4B\xC8\x5B\x1C\xB3"
+"\xC1";
+
+    static unsigned char p[] =
+"\x00\xEE\xCF\xAE\x81\xB1\xB9\xB3\xC9\x08\x81\x0B\x10\xA1\xB5\x60"
+"\x01\x99\xEB\x9F\x44\xAE\xF4\xFD\xA4\x93\xB8\x1A\x9E\x3D\x84\xF6"
+"\x32\x12\x4E\xF0\x23\x6E\x5D\x1E\x3B\x7E\x28\xFA\xE7\xAA\x04\x0A"
+"\x2D\x5B\x25\x21\x76\x45\x9D\x1F\x39\x75\x41\xBA\x2A\x58\xFB\x65"
+"\x99";
+
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
+"\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
+"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x15"
+"\x03";
+
+    static unsigned char dmp1[] =
+"\x54\x49\x4C\xA6\x3E\xBA\x03\x37\xE4\xE2\x40\x23\xFC\xD6\x9A\x5A"
+"\xEB\x07\xDD\xDC\x01\x83\xA4\xD0\xAC\x9B\x54\xB0\x51\xF2\xB1\x3E"
+"\xD9\x49\x09\x75\xEA\xB7\x74\x14\xFF\x59\xC1\xF7\x69\x2E\x9A\x2E"
+"\x20\x2B\x38\xFC\x91\x0A\x47\x41\x74\xAD\xC9\x3C\x1F\x67\xC9\x81";
+
+    static unsigned char dmq1[] =
+"\x47\x1E\x02\x90\xFF\x0A\xF0\x75\x03\x51\xB7\xF8\x78\x86\x4C\xA9"
+"\x61\xAD\xBD\x3A\x8A\x7E\x99\x1C\x5C\x05\x56\xA9\x4C\x31\x46\xA7"
+"\xF9\x80\x3F\x8F\x6F\x8A\xE3\x42\xE9\x31\xFD\x8A\xE4\x7A\x22\x0D"
+"\x1B\x99\xA4\x95\x84\x98\x07\xFE\x39\xF9\x24\x5A\x98\x36\xDA\x3D";
+    
+    static unsigned char iqmp[] =
+"\x00\xB0\x6C\x4F\xDA\xBB\x63\x01\x19\x8D\x26\x5B\xDB\xAE\x94\x23"
+"\xB3\x80\xF2\x71\xF7\x34\x53\x88\x50\x93\x07\x7F\xCD\x39\xE2\x11"
+"\x9F\xC9\x86\x32\x15\x4F\x58\x83\xB1\x67\xA9\x67\xBF\x40\x2B\x4E"
+"\x9E\x2E\x0F\x96\x56\xE6\x98\xEA\x36\x66\xED\xFB\x25\x79\x80\x39"
+"\xF7";
+
+    static unsigned char ctext_ex[] =
+"\xb8\x24\x6b\x56\xa6\xed\x58\x81\xae\xb5\x85\xd9\xa2\x5b\x2a\xd7"
+"\x90\xc4\x17\xe0\x80\x68\x1b\xf1\xac\x2b\xc3\xde\xb6\x9d\x8b\xce"
+"\xf0\xc4\x36\x6f\xec\x40\x0a\xf0\x52\xa7\x2e\x9b\x0e\xff\xb5\xb3"
+"\xf2\xf1\x92\xdb\xea\xca\x03\xc1\x27\x40\x05\x71\x13\xbf\x1f\x06"
+"\x69\xac\x22\xe9\xf3\xa7\x85\x2e\x3c\x15\xd9\x13\xca\xb0\xb8\x86"
+"\x3a\x95\xc9\x92\x94\xce\x86\x74\x21\x49\x54\x61\x03\x46\xf4\xd4"
+"\x74\xb2\x6f\x7c\x48\xb4\x2e\xe6\x8e\x1f\x57\x2a\x1f\xc4\x02\x6a"
+"\xc4\x56\xb4\xf5\x9f\x7b\x62\x1e\xa1\xb9\xd8\x8f\x64\x20\x2f\xb1";
+
+    SetKey;
+    }
+
+static int pad_unknown(void)
+{
+    unsigned long l;
+    while ((l = ERR_get_error()) != 0)
+      if (ERR_GET_REASON(l) == RSA_R_UNKNOWN_PADDING_TYPE)
+        return(1);
+    return(0);
+}
+
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
+int main(int argc, char *argv[])
+    {
+    int err=0;
+    int v;
+    RSA *key;
+    unsigned char ptext[256];
+    unsigned char ctext[256];
+    static unsigned char ptext_ex[] = "\x54\x85\x9b\x34\x2c\x49\xea\x2a";
+    unsigned char ctext_ex[256];
+    int plen;
+    int clen = 0;
+    int num;
+
+    RAND_seed(rnd_seed, sizeof rnd_seed); /* or OAEP may fail */
+
+    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+        
+    plen = sizeof(ptext_ex) - 1;
+
+    for (v = 0; v < 3; v++)
+        {
+        key = RSA_new();
+        switch (v) {
+    case 0:
+        clen = key1(key, ctext_ex);
+        break;
+    case 1:
+        clen = key2(key, ctext_ex);
+        break;
+    case 2:
+        clen = key3(key, ctext_ex);
+        break;
+        }
+
+        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
+                                 RSA_PKCS1_PADDING);
+        if (num != clen)
+            {
+            printf("PKCS#1 v1.5 encryption failed!\n");
+            err=1;
+            goto oaep;
+            }
+  
+        num = RSA_private_decrypt(num, ctext, ptext, key,
+                                  RSA_PKCS1_PADDING);
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("PKCS#1 v1.5 decryption failed!\n");
+            err=1;
+            }
+        else
+            printf("PKCS #1 v1.5 encryption/decryption ok\n");
+
+    oaep:
+        ERR_clear_error();
+        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
+                                 RSA_PKCS1_OAEP_PADDING);
+        if (num == -1 && pad_unknown())
+            {
+            printf("No OAEP support\n");
+            goto next;
+            }
+        if (num != clen)
+            {
+            printf("OAEP encryption failed!\n");
+            err=1;
+            goto next;
+            }
+  
+        num = RSA_private_decrypt(num, ctext, ptext, key,
+                                  RSA_PKCS1_OAEP_PADDING);
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("OAEP decryption (encrypted data) failed!\n");
+            err=1;
+            }
+        else if (memcmp(ctext, ctext_ex, num) == 0)
+            {
+            printf("OAEP test vector %d passed!\n", v);
+            goto next;
+            }
+    
+        /* Different ciphertexts (rsa_oaep.c without -DPKCS_TESTVECT).
+           Try decrypting ctext_ex */
+
+        num = RSA_private_decrypt(clen, ctext_ex, ptext, key,
+                                  RSA_PKCS1_OAEP_PADDING);
+
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("OAEP decryption (test vector data) failed!\n");
+            err=1;
+            }
+        else
+            printf("OAEP encryption/decryption ok\n");
+    next:
+        RSA_free(key);
+        }
+
+    ERR_remove_state(0);
+
+    CRYPTO_mem_leaks_fp(stdout);
+
+    return err;
+    }
+#endif
diff --git a/src/lib/libssl/src/crypto/sha/Makefile.ssl b/src/lib/libssl/src/crypto/sha/Makefile.ssl
index 6ea5b1d719..79ef43aa34 100644
--- a/src/lib/libssl/src/crypto/sha/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/sha/Makefile.ssl
@@ -104,8 +104,8 @@ clean:
 sha1_one.o: ../../include/openssl/sha.h
 sha1dgst.o: ../../include/openssl/opensslconf.h
 sha1dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/sha.h
-sha1dgst.o: sha_locl.h
+sha1dgst.o: ../md32_common.h sha_locl.h
 sha_dgst.o: ../../include/openssl/opensslconf.h
 sha_dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/sha.h
-sha_dgst.o: sha_locl.h
+sha_dgst.o: ../md32_common.h sha_locl.h
 sha_one.o: ../../include/openssl/sha.h
diff --git a/src/lib/libssl/src/crypto/sha/asm/s1-win32.asm b/src/lib/libssl/src/crypto/sha/asm/s1-win32.asm
index 61335666b9..699afdb022 100644
--- a/src/lib/libssl/src/crypto/sha/asm/s1-win32.asm
+++ b/src/lib/libssl/src/crypto/sha/asm/s1-win32.asm
@@ -8,302 +8,303 @@
         .486
 .model FLAT
 _TEXT   SEGMENT
-PUBLIC  _sha1_block_x86
+PUBLIC  _sha1_block_asm_data_order
 
-_sha1_block_x86 PROC NEAR
+_sha1_block_asm_data_order PROC NEAR
+        mov     ecx,            DWORD PTR 12[esp]
         push    esi
+        shl     ecx,            6
+        mov     esi,            DWORD PTR 12[esp]
         push    ebp
-        mov     eax,            DWORD PTR 20[esp]
-        mov     esi,            DWORD PTR 16[esp]
-        add     eax,            esi
-        mov     ebp,            DWORD PTR 12[esp]
+        add     ecx,            esi
         push    ebx
-        sub     eax,            64
+        mov     ebp,            DWORD PTR 16[esp]
         push    edi
-        mov     ebx,            DWORD PTR 4[ebp]
-        sub     esp,            72
         mov     edx,            DWORD PTR 12[ebp]
+        sub     esp,            108
         mov     edi,            DWORD PTR 16[ebp]
-        mov     ecx,            DWORD PTR 8[ebp]
-        mov     DWORD PTR 68[esp],eax
+        mov     ebx,            DWORD PTR 8[ebp]
+        mov     DWORD PTR 68[esp],ecx
         ; First we need to setup the X array
-        mov     eax,            DWORD PTR [esi]
 L000start:
         ; First, load the words onto the stack in network byte order
+        mov     eax,            DWORD PTR [esi]
+        mov     ecx,            DWORD PTR 4[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR [esp],eax
-        mov     eax,            DWORD PTR 4[esi]
-        bswap   eax
-        mov     DWORD PTR 4[esp],eax
+        mov     DWORD PTR 4[esp],ecx
         mov     eax,            DWORD PTR 8[esi]
+        mov     ecx,            DWORD PTR 12[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 8[esp],eax
-        mov     eax,            DWORD PTR 12[esi]
-        bswap   eax
-        mov     DWORD PTR 12[esp],eax
+        mov     DWORD PTR 12[esp],ecx
         mov     eax,            DWORD PTR 16[esi]
+        mov     ecx,            DWORD PTR 20[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 16[esp],eax
-        mov     eax,            DWORD PTR 20[esi]
-        bswap   eax
-        mov     DWORD PTR 20[esp],eax
+        mov     DWORD PTR 20[esp],ecx
         mov     eax,            DWORD PTR 24[esi]
+        mov     ecx,            DWORD PTR 28[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 24[esp],eax
-        mov     eax,            DWORD PTR 28[esi]
-        bswap   eax
-        mov     DWORD PTR 28[esp],eax
+        mov     DWORD PTR 28[esp],ecx
         mov     eax,            DWORD PTR 32[esi]
+        mov     ecx,            DWORD PTR 36[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 32[esp],eax
-        mov     eax,            DWORD PTR 36[esi]
-        bswap   eax
-        mov     DWORD PTR 36[esp],eax
+        mov     DWORD PTR 36[esp],ecx
         mov     eax,            DWORD PTR 40[esi]
+        mov     ecx,            DWORD PTR 44[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 40[esp],eax
-        mov     eax,            DWORD PTR 44[esi]
-        bswap   eax
-        mov     DWORD PTR 44[esp],eax
+        mov     DWORD PTR 44[esp],ecx
         mov     eax,            DWORD PTR 48[esi]
+        mov     ecx,            DWORD PTR 52[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 48[esp],eax
-        mov     eax,            DWORD PTR 52[esi]
-        bswap   eax
-        mov     DWORD PTR 52[esp],eax
+        mov     DWORD PTR 52[esp],ecx
         mov     eax,            DWORD PTR 56[esi]
+        mov     ecx,            DWORD PTR 60[esi]
         bswap   eax
+        bswap   ecx
         mov     DWORD PTR 56[esp],eax
-        mov     eax,            DWORD PTR 60[esi]
-        bswap   eax
-        mov     DWORD PTR 60[esp],eax
+        mov     DWORD PTR 60[esp],ecx
         ; We now have the X array on the stack
         ; starting at sp-4
-        mov     DWORD PTR 64[esp],esi
+        mov     DWORD PTR 132[esp],esi
+L001shortcut:
         ; 
         ; Start processing
         mov     eax,            DWORD PTR [ebp]
+        mov     ecx,            DWORD PTR 4[ebp]
         ; 00_15 0
-        mov     esi,            ecx
+        mov     esi,            ebx
         mov     ebp,            eax
         xor     esi,            edx
         rol     ebp,            5
-        and     esi,            ebx
+        and     esi,            ecx
         add     ebp,            edi
-        ror     ebx,            1
+        ror     ecx,            1
         mov     edi,            DWORD PTR [esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     esi,            edx
         lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            ebx
+        mov     edi,            ecx
         add     esi,            ebp
-        xor     edi,            ecx
+        xor     edi,            ebx
         mov     ebp,            esi
         and     edi,            eax
         rol     ebp,            5
         add     ebp,            edx
         mov     edx,            DWORD PTR 4[esp]
         ror     eax,            1
-        xor     edi,            ecx
+        xor     edi,            ebx
         ror     eax,            1
         lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
         add     edi,            ebp
         ; 00_15 2
         mov     edx,            eax
         mov     ebp,            edi
-        xor     edx,            ebx
+        xor     edx,            ecx
         rol     ebp,            5
         and     edx,            esi
-        add     ebp,            ecx
+        add     ebp,            ebx
         ror     esi,            1
-        mov     ecx,            DWORD PTR 8[esp]
+        mov     ebx,            DWORD PTR 8[esp]
         ror     esi,            1
-        xor     edx,            ebx
-        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
-        mov     ecx,            esi
+        xor     edx,            ecx
+        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
+        mov     ebx,            esi
         add     edx,            ebp
-        xor     ecx,            eax
+        xor     ebx,            eax
         mov     ebp,            edx
-        and     ecx,            edi
+        and     ebx,            edi
         rol     ebp,            5
-        add     ebp,            ebx
-        mov     ebx,            DWORD PTR 12[esp]
+        add     ebp,            ecx
+        mov     ecx,            DWORD PTR 12[esp]
         ror     edi,            1
-        xor     ecx,            eax
+        xor     ebx,            eax
         ror     edi,            1
-        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
-        add     ecx,            ebp
+        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
+        add     ebx,            ebp
         ; 00_15 4
-        mov     ebx,            edi
-        mov     ebp,            ecx
-        xor     ebx,            esi
+        mov     ecx,            edi
+        mov     ebp,            ebx
+        xor     ecx,            esi
         rol     ebp,            5
-        and     ebx,            edx
+        and     ecx,            edx
         add     ebp,            eax
         ror     edx,            1
         mov     eax,            DWORD PTR 16[esp]
         ror     edx,            1
-        xor     ebx,            esi
+        xor     ecx,            esi
         lea     ebp,            DWORD PTR 1518500249[eax*1+ebp]
         mov     eax,            edx
-        add     ebx,            ebp
+        add     ecx,            ebp
         xor     eax,            edi
-        mov     ebp,            ebx
-        and     eax,            ecx
+        mov     ebp,            ecx
+        and     eax,            ebx
         rol     ebp,            5
         add     ebp,            esi
         mov     esi,            DWORD PTR 20[esp]
-        ror     ecx,            1
+        ror     ebx,            1
         xor     eax,            edi
-        ror     ecx,            1
+        ror     ebx,            1
         lea     ebp,            DWORD PTR 1518500249[esi*1+ebp]
         add     eax,            ebp
         ; 00_15 6
-        mov     esi,            ecx
+        mov     esi,            ebx
         mov     ebp,            eax
         xor     esi,            edx
         rol     ebp,            5
-        and     esi,            ebx
+        and     esi,            ecx
         add     ebp,            edi
-        ror     ebx,            1
+        ror     ecx,            1
         mov     edi,            DWORD PTR 24[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     esi,            edx
         lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            ebx
+        mov     edi,            ecx
         add     esi,            ebp
-        xor     edi,            ecx
+        xor     edi,            ebx
         mov     ebp,            esi
         and     edi,            eax
         rol     ebp,            5
         add     ebp,            edx
         mov     edx,            DWORD PTR 28[esp]
         ror     eax,            1
-        xor     edi,            ecx
+        xor     edi,            ebx
         ror     eax,            1
         lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
         add     edi,            ebp
         ; 00_15 8
         mov     edx,            eax
         mov     ebp,            edi
-        xor     edx,            ebx
+        xor     edx,            ecx
         rol     ebp,            5
         and     edx,            esi
-        add     ebp,            ecx
+        add     ebp,            ebx
         ror     esi,            1
-        mov     ecx,            DWORD PTR 32[esp]
+        mov     ebx,            DWORD PTR 32[esp]
         ror     esi,            1
-        xor     edx,            ebx
-        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
-        mov     ecx,            esi
+        xor     edx,            ecx
+        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
+        mov     ebx,            esi
         add     edx,            ebp
-        xor     ecx,            eax
+        xor     ebx,            eax
         mov     ebp,            edx
-        and     ecx,            edi
+        and     ebx,            edi
         rol     ebp,            5
-        add     ebp,            ebx
-        mov     ebx,            DWORD PTR 36[esp]
+        add     ebp,            ecx
+        mov     ecx,            DWORD PTR 36[esp]
         ror     edi,            1
-        xor     ecx,            eax
+        xor     ebx,            eax
         ror     edi,            1
-        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
-        add     ecx,            ebp
+        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
+        add     ebx,            ebp
         ; 00_15 10
-        mov     ebx,            edi
-        mov     ebp,            ecx
-        xor     ebx,            esi
+        mov     ecx,            edi
+        mov     ebp,            ebx
+        xor     ecx,            esi
         rol     ebp,            5
-        and     ebx,            edx
+        and     ecx,            edx
         add     ebp,            eax
         ror     edx,            1
         mov     eax,            DWORD PTR 40[esp]
         ror     edx,            1
-        xor     ebx,            esi
+        xor     ecx,            esi
         lea     ebp,            DWORD PTR 1518500249[eax*1+ebp]
         mov     eax,            edx
-        add     ebx,            ebp
+        add     ecx,            ebp
         xor     eax,            edi
-        mov     ebp,            ebx
-        and     eax,            ecx
+        mov     ebp,            ecx
+        and     eax,            ebx
         rol     ebp,            5
         add     ebp,            esi
         mov     esi,            DWORD PTR 44[esp]
-        ror     ecx,            1
+        ror     ebx,            1
         xor     eax,            edi
-        ror     ecx,            1
+        ror     ebx,            1
         lea     ebp,            DWORD PTR 1518500249[esi*1+ebp]
         add     eax,            ebp
         ; 00_15 12
-        mov     esi,            ecx
+        mov     esi,            ebx
         mov     ebp,            eax
         xor     esi,            edx
         rol     ebp,            5
-        and     esi,            ebx
+        and     esi,            ecx
         add     ebp,            edi
-        ror     ebx,            1
+        ror     ecx,            1
         mov     edi,            DWORD PTR 48[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     esi,            edx
         lea     ebp,            DWORD PTR 1518500249[edi*1+ebp]
-        mov     edi,            ebx
+        mov     edi,            ecx
         add     esi,            ebp
-        xor     edi,            ecx
+        xor     edi,            ebx
         mov     ebp,            esi
         and     edi,            eax
         rol     ebp,            5
         add     ebp,            edx
         mov     edx,            DWORD PTR 52[esp]
         ror     eax,            1
-        xor     edi,            ecx
+        xor     edi,            ebx
         ror     eax,            1
         lea     ebp,            DWORD PTR 1518500249[edx*1+ebp]
         add     edi,            ebp
         ; 00_15 14
         mov     edx,            eax
         mov     ebp,            edi
-        xor     edx,            ebx
+        xor     edx,            ecx
         rol     ebp,            5
         and     edx,            esi
-        add     ebp,            ecx
+        add     ebp,            ebx
         ror     esi,            1
-        mov     ecx,            DWORD PTR 56[esp]
+        mov     ebx,            DWORD PTR 56[esp]
         ror     esi,            1
-        xor     edx,            ebx
-        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
-        mov     ecx,            esi
+        xor     edx,            ecx
+        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
+        mov     ebx,            esi
         add     edx,            ebp
-        xor     ecx,            eax
+        xor     ebx,            eax
         mov     ebp,            edx
-        and     ecx,            edi
+        and     ebx,            edi
         rol     ebp,            5
-        add     ebp,            ebx
-        mov     ebx,            DWORD PTR 60[esp]
+        add     ebp,            ecx
+        mov     ecx,            DWORD PTR 60[esp]
         ror     edi,            1
-        xor     ecx,            eax
+        xor     ebx,            eax
         ror     edi,            1
-        lea     ebp,            DWORD PTR 1518500249[ebx*1+ebp]
-        add     ecx,            ebp
+        lea     ebp,            DWORD PTR 1518500249[ecx*1+ebp]
+        add     ebx,            ebp
         ; 16_19 16
         nop
         mov     ebp,            DWORD PTR [esp]
-        mov     ebx,            DWORD PTR 8[esp]
-        xor     ebx,            ebp
+        mov     ecx,            DWORD PTR 8[esp]
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edi
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            esi
-        mov     DWORD PTR [esp],ebx
+        mov     DWORD PTR [esp],ecx
         and     ebp,            edx
-        lea     ebx,            DWORD PTR 1518500249[eax*1+ebx]
+        lea     ecx,            DWORD PTR 1518500249[eax*1+ecx]
         xor     ebp,            esi
-        mov     eax,            ecx
-        add     ebx,            ebp
+        mov     eax,            ebx
+        add     ecx,            ebp
         rol     eax,            5
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         mov     eax,            DWORD PTR 4[esp]
         mov     ebp,            DWORD PTR 12[esp]
         xor     eax,            ebp
@@ -316,14 +317,14 @@ L000start:
         mov     ebp,            edx
         xor     ebp,            edi
         mov     DWORD PTR 4[esp],eax
-        and     ebp,            ecx
+        and     ebp,            ebx
         lea     eax,            DWORD PTR 1518500249[esi*1+eax]
         xor     ebp,            edi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 16_19 18
         mov     ebp,            DWORD PTR 8[esp]
@@ -333,17 +334,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 60[esp]
         xor     esi,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     esi,            1
         xor     ebp,            edx
         mov     DWORD PTR 8[esp],esi
-        and     ebp,            ebx
+        and     ebp,            ecx
         lea     esi,            DWORD PTR 1518500249[edi*1+esi]
         xor     ebp,            edx
         mov     edi,            eax
         add     esi,            ebp
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         mov     edi,            DWORD PTR 12[esp]
         mov     ebp,            DWORD PTR 20[esp]
@@ -351,15 +352,15 @@ L000start:
         mov     ebp,            DWORD PTR 44[esp]
         xor     edi,            ebp
         mov     ebp,            DWORD PTR [esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     edi,            ebp
         rol     edi,            1
-        mov     ebp,            ebx
-        xor     ebp,            ecx
+        mov     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 12[esp],edi
         and     ebp,            eax
         lea     edi,            DWORD PTR 1518500249[edx*1+edi]
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     edx,            esi
         rol     edx,            5
         ror     eax,            1
@@ -378,54 +379,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 16[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 1859775393[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 1859775393[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 21
-        mov     ecx,            DWORD PTR 20[esp]
+        mov     ebx,            DWORD PTR 20[esp]
         mov     ebp,            DWORD PTR 28[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 8[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 20[esp],ecx
+        mov     DWORD PTR 20[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 1859775393[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 1859775393[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 22
-        mov     ebx,            DWORD PTR 24[esp]
+        mov     ecx,            DWORD PTR 24[esp]
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 24[esp],ebx
+        mov     DWORD PTR 24[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 23
         mov     eax,            DWORD PTR 28[esp]
         mov     ebp,            DWORD PTR 36[esp]
@@ -434,17 +435,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 16[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 28[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 24
         mov     esi,            DWORD PTR 32[esp]
@@ -454,17 +455,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 20[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 32[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 1859775393[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 25
         mov     edi,            DWORD PTR 36[esp]
@@ -476,9 +477,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 36[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 36[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 1859775393[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -498,54 +499,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 40[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 1859775393[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 1859775393[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 27
-        mov     ecx,            DWORD PTR 44[esp]
+        mov     ebx,            DWORD PTR 44[esp]
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 44[esp],ecx
+        mov     DWORD PTR 44[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 1859775393[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 1859775393[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 28
-        mov     ebx,            DWORD PTR 48[esp]
+        mov     ecx,            DWORD PTR 48[esp]
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 16[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 36[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 48[esp],ebx
+        mov     DWORD PTR 48[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 29
         mov     eax,            DWORD PTR 52[esp]
         mov     ebp,            DWORD PTR 60[esp]
@@ -554,17 +555,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 40[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 52[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 30
         mov     esi,            DWORD PTR 56[esp]
@@ -574,17 +575,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 44[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 56[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 1859775393[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 31
         mov     edi,            DWORD PTR 60[esp]
@@ -596,9 +597,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 60[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 60[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 1859775393[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -618,54 +619,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR [esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 1859775393[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 1859775393[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 33
-        mov     ecx,            DWORD PTR 4[esp]
+        mov     ebx,            DWORD PTR 4[esp]
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 36[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 4[esp],ecx
+        mov     DWORD PTR 4[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 1859775393[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 1859775393[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 34
-        mov     ebx,            DWORD PTR 8[esp]
+        mov     ecx,            DWORD PTR 8[esp]
         mov     ebp,            DWORD PTR 16[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 40[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 60[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 8[esp],ebx
+        mov     DWORD PTR 8[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 1859775393[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 1859775393[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 35
         mov     eax,            DWORD PTR 12[esp]
         mov     ebp,            DWORD PTR 20[esp]
@@ -674,17 +675,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR [esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 12[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 1859775393[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 36
         mov     esi,            DWORD PTR 16[esp]
@@ -694,17 +695,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 4[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 16[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 1859775393[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 37
         mov     edi,            DWORD PTR 20[esp]
@@ -716,9 +717,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 20[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 20[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 1859775393[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -738,57 +739,57 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 24[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 1859775393[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 1859775393[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 39
-        mov     ecx,            DWORD PTR 28[esp]
+        mov     ebx,            DWORD PTR 28[esp]
         mov     ebp,            DWORD PTR 36[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 60[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 16[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 28[esp],ecx
+        mov     DWORD PTR 28[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 1859775393[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 1859775393[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 40_59 40
-        mov     ebx,            DWORD PTR 32[esp]
+        mov     ecx,            DWORD PTR 32[esp]
         mov     ebp,            DWORD PTR 40[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR [esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 20[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         or      ebp,            edi
-        mov     DWORD PTR 32[esp],ebx
+        mov     DWORD PTR 32[esp],ecx
         and     ebp,            esi
-        lea     ebx,            DWORD PTR 2400959708[eax*1+ebx]
+        lea     ecx,            DWORD PTR 2400959708[eax*1+ecx]
         mov     eax,            edx
         ror     edx,            1
         and     eax,            edi
         or      ebp,            eax
-        mov     eax,            ecx
+        mov     eax,            ebx
         rol     eax,            5
         add     ebp,            eax
         mov     eax,            DWORD PTR 36[esp]
-        add     ebx,            ebp
+        add     ecx,            ebp
         mov     ebp,            DWORD PTR 44[esp]
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 4[esp]
@@ -797,19 +798,19 @@ L000start:
         ror     edx,            1
         xor     eax,            ebp
         rol     eax,            1
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         mov     DWORD PTR 36[esp],eax
         or      ebp,            edx
         lea     eax,            DWORD PTR 2400959708[esi*1+eax]
-        mov     esi,            ecx
+        mov     esi,            ebx
         and     ebp,            edi
         and     esi,            edx
         or      ebp,            esi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     ebp,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 40_59 41
         ; 40_59 42
@@ -820,15 +821,15 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 28[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        or      ebp,            ecx
+        or      ebp,            ebx
         mov     DWORD PTR 40[esp],esi
         and     ebp,            edx
         lea     esi,            DWORD PTR 2400959708[edi*1+esi]
-        mov     edi,            ebx
-        ror     ebx,            1
-        and     edi,            ecx
+        mov     edi,            ecx
+        ror     ecx,            1
+        and     edi,            ebx
         or      ebp,            edi
         mov     edi,            eax
         rol     edi,            5
@@ -840,16 +841,16 @@ L000start:
         mov     ebp,            DWORD PTR 12[esp]
         xor     edi,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     edi,            ebp
         rol     edi,            1
         mov     ebp,            eax
         mov     DWORD PTR 44[esp],edi
-        or      ebp,            ebx
+        or      ebp,            ecx
         lea     edi,            DWORD PTR 2400959708[edx*1+edi]
         mov     edx,            eax
-        and     ebp,            ecx
-        and     edx,            ebx
+        and     ebp,            ebx
+        and     edx,            ecx
         or      ebp,            edx
         mov     edx,            esi
         rol     edx,            5
@@ -870,63 +871,63 @@ L000start:
         rol     edx,            1
         or      ebp,            eax
         mov     DWORD PTR 48[esp],edx
-        and     ebp,            ebx
-        lea     edx,            DWORD PTR 2400959708[ecx*1+edx]
-        mov     ecx,            esi
+        and     ebp,            ecx
+        lea     edx,            DWORD PTR 2400959708[ebx*1+edx]
+        mov     ebx,            esi
         ror     esi,            1
-        and     ecx,            eax
-        or      ebp,            ecx
-        mov     ecx,            edi
-        rol     ecx,            5
-        add     ebp,            ecx
-        mov     ecx,            DWORD PTR 52[esp]
+        and     ebx,            eax
+        or      ebp,            ebx
+        mov     ebx,            edi
+        rol     ebx,            5
+        add     ebp,            ebx
+        mov     ebx,            DWORD PTR 52[esp]
         add     edx,            ebp
         mov     ebp,            DWORD PTR 60[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 20[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 40[esp]
         ror     esi,            1
-        xor     ecx,            ebp
-        rol     ecx,            1
+        xor     ebx,            ebp
+        rol     ebx,            1
         mov     ebp,            edi
-        mov     DWORD PTR 52[esp],ecx
+        mov     DWORD PTR 52[esp],ebx
         or      ebp,            esi
-        lea     ecx,            DWORD PTR 2400959708[ebx*1+ecx]
-        mov     ebx,            edi
+        lea     ebx,            DWORD PTR 2400959708[ecx*1+ebx]
+        mov     ecx,            edi
         and     ebp,            eax
-        and     ebx,            esi
-        or      ebp,            ebx
-        mov     ebx,            edx
-        rol     ebx,            5
+        and     ecx,            esi
+        or      ebp,            ecx
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebp,            ebx
+        add     ebp,            ecx
         ror     edi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ; 40_59 45
         ; 40_59 46
-        mov     ebx,            DWORD PTR 56[esp]
+        mov     ecx,            DWORD PTR 56[esp]
         mov     ebp,            DWORD PTR [esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 24[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 44[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         or      ebp,            edi
-        mov     DWORD PTR 56[esp],ebx
+        mov     DWORD PTR 56[esp],ecx
         and     ebp,            esi
-        lea     ebx,            DWORD PTR 2400959708[eax*1+ebx]
+        lea     ecx,            DWORD PTR 2400959708[eax*1+ecx]
         mov     eax,            edx
         ror     edx,            1
         and     eax,            edi
         or      ebp,            eax
-        mov     eax,            ecx
+        mov     eax,            ebx
         rol     eax,            5
         add     ebp,            eax
         mov     eax,            DWORD PTR 60[esp]
-        add     ebx,            ebp
+        add     ecx,            ebp
         mov     ebp,            DWORD PTR 4[esp]
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 28[esp]
@@ -935,19 +936,19 @@ L000start:
         ror     edx,            1
         xor     eax,            ebp
         rol     eax,            1
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         mov     DWORD PTR 60[esp],eax
         or      ebp,            edx
         lea     eax,            DWORD PTR 2400959708[esi*1+eax]
-        mov     esi,            ecx
+        mov     esi,            ebx
         and     ebp,            edi
         and     esi,            edx
         or      ebp,            esi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     ebp,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 40_59 47
         ; 40_59 48
@@ -958,15 +959,15 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 52[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        or      ebp,            ecx
+        or      ebp,            ebx
         mov     DWORD PTR [esp],esi
         and     ebp,            edx
         lea     esi,            DWORD PTR 2400959708[edi*1+esi]
-        mov     edi,            ebx
-        ror     ebx,            1
-        and     edi,            ecx
+        mov     edi,            ecx
+        ror     ecx,            1
+        and     edi,            ebx
         or      ebp,            edi
         mov     edi,            eax
         rol     edi,            5
@@ -978,16 +979,16 @@ L000start:
         mov     ebp,            DWORD PTR 36[esp]
         xor     edi,            ebp
         mov     ebp,            DWORD PTR 56[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     edi,            ebp
         rol     edi,            1
         mov     ebp,            eax
         mov     DWORD PTR 4[esp],edi
-        or      ebp,            ebx
+        or      ebp,            ecx
         lea     edi,            DWORD PTR 2400959708[edx*1+edi]
         mov     edx,            eax
-        and     ebp,            ecx
-        and     edx,            ebx
+        and     ebp,            ebx
+        and     edx,            ecx
         or      ebp,            edx
         mov     edx,            esi
         rol     edx,            5
@@ -1008,63 +1009,63 @@ L000start:
         rol     edx,            1
         or      ebp,            eax
         mov     DWORD PTR 8[esp],edx
-        and     ebp,            ebx
-        lea     edx,            DWORD PTR 2400959708[ecx*1+edx]
-        mov     ecx,            esi
+        and     ebp,            ecx
+        lea     edx,            DWORD PTR 2400959708[ebx*1+edx]
+        mov     ebx,            esi
         ror     esi,            1
-        and     ecx,            eax
-        or      ebp,            ecx
-        mov     ecx,            edi
-        rol     ecx,            5
-        add     ebp,            ecx
-        mov     ecx,            DWORD PTR 12[esp]
+        and     ebx,            eax
+        or      ebp,            ebx
+        mov     ebx,            edi
+        rol     ebx,            5
+        add     ebp,            ebx
+        mov     ebx,            DWORD PTR 12[esp]
         add     edx,            ebp
         mov     ebp,            DWORD PTR 20[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 44[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR [esp]
         ror     esi,            1
-        xor     ecx,            ebp
-        rol     ecx,            1
+        xor     ebx,            ebp
+        rol     ebx,            1
         mov     ebp,            edi
-        mov     DWORD PTR 12[esp],ecx
+        mov     DWORD PTR 12[esp],ebx
         or      ebp,            esi
-        lea     ecx,            DWORD PTR 2400959708[ebx*1+ecx]
-        mov     ebx,            edi
+        lea     ebx,            DWORD PTR 2400959708[ecx*1+ebx]
+        mov     ecx,            edi
         and     ebp,            eax
-        and     ebx,            esi
-        or      ebp,            ebx
-        mov     ebx,            edx
-        rol     ebx,            5
+        and     ecx,            esi
+        or      ebp,            ecx
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebp,            ebx
+        add     ebp,            ecx
         ror     edi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ; 40_59 51
         ; 40_59 52
-        mov     ebx,            DWORD PTR 16[esp]
+        mov     ecx,            DWORD PTR 16[esp]
         mov     ebp,            DWORD PTR 24[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 48[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 4[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         or      ebp,            edi
-        mov     DWORD PTR 16[esp],ebx
+        mov     DWORD PTR 16[esp],ecx
         and     ebp,            esi
-        lea     ebx,            DWORD PTR 2400959708[eax*1+ebx]
+        lea     ecx,            DWORD PTR 2400959708[eax*1+ecx]
         mov     eax,            edx
         ror     edx,            1
         and     eax,            edi
         or      ebp,            eax
-        mov     eax,            ecx
+        mov     eax,            ebx
         rol     eax,            5
         add     ebp,            eax
         mov     eax,            DWORD PTR 20[esp]
-        add     ebx,            ebp
+        add     ecx,            ebp
         mov     ebp,            DWORD PTR 28[esp]
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 52[esp]
@@ -1073,19 +1074,19 @@ L000start:
         ror     edx,            1
         xor     eax,            ebp
         rol     eax,            1
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         mov     DWORD PTR 20[esp],eax
         or      ebp,            edx
         lea     eax,            DWORD PTR 2400959708[esi*1+eax]
-        mov     esi,            ecx
+        mov     esi,            ebx
         and     ebp,            edi
         and     esi,            edx
         or      ebp,            esi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     ebp,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 40_59 53
         ; 40_59 54
@@ -1096,15 +1097,15 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 12[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        or      ebp,            ecx
+        or      ebp,            ebx
         mov     DWORD PTR 24[esp],esi
         and     ebp,            edx
         lea     esi,            DWORD PTR 2400959708[edi*1+esi]
-        mov     edi,            ebx
-        ror     ebx,            1
-        and     edi,            ecx
+        mov     edi,            ecx
+        ror     ecx,            1
+        and     edi,            ebx
         or      ebp,            edi
         mov     edi,            eax
         rol     edi,            5
@@ -1116,16 +1117,16 @@ L000start:
         mov     ebp,            DWORD PTR 60[esp]
         xor     edi,            ebp
         mov     ebp,            DWORD PTR 16[esp]
-        ror     ebx,            1
+        ror     ecx,            1
         xor     edi,            ebp
         rol     edi,            1
         mov     ebp,            eax
         mov     DWORD PTR 28[esp],edi
-        or      ebp,            ebx
+        or      ebp,            ecx
         lea     edi,            DWORD PTR 2400959708[edx*1+edi]
         mov     edx,            eax
-        and     ebp,            ecx
-        and     edx,            ebx
+        and     ebp,            ebx
+        and     edx,            ecx
         or      ebp,            edx
         mov     edx,            esi
         rol     edx,            5
@@ -1146,63 +1147,63 @@ L000start:
         rol     edx,            1
         or      ebp,            eax
         mov     DWORD PTR 32[esp],edx
-        and     ebp,            ebx
-        lea     edx,            DWORD PTR 2400959708[ecx*1+edx]
-        mov     ecx,            esi
+        and     ebp,            ecx
+        lea     edx,            DWORD PTR 2400959708[ebx*1+edx]
+        mov     ebx,            esi
         ror     esi,            1
-        and     ecx,            eax
-        or      ebp,            ecx
-        mov     ecx,            edi
-        rol     ecx,            5
-        add     ebp,            ecx
-        mov     ecx,            DWORD PTR 36[esp]
+        and     ebx,            eax
+        or      ebp,            ebx
+        mov     ebx,            edi
+        rol     ebx,            5
+        add     ebp,            ebx
+        mov     ebx,            DWORD PTR 36[esp]
         add     edx,            ebp
         mov     ebp,            DWORD PTR 44[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 4[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 24[esp]
         ror     esi,            1
-        xor     ecx,            ebp
-        rol     ecx,            1
+        xor     ebx,            ebp
+        rol     ebx,            1
         mov     ebp,            edi
-        mov     DWORD PTR 36[esp],ecx
+        mov     DWORD PTR 36[esp],ebx
         or      ebp,            esi
-        lea     ecx,            DWORD PTR 2400959708[ebx*1+ecx]
-        mov     ebx,            edi
+        lea     ebx,            DWORD PTR 2400959708[ecx*1+ebx]
+        mov     ecx,            edi
         and     ebp,            eax
-        and     ebx,            esi
-        or      ebp,            ebx
-        mov     ebx,            edx
-        rol     ebx,            5
+        and     ecx,            esi
+        or      ebp,            ecx
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebp,            ebx
+        add     ebp,            ecx
         ror     edi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ; 40_59 57
         ; 40_59 58
-        mov     ebx,            DWORD PTR 40[esp]
+        mov     ecx,            DWORD PTR 40[esp]
         mov     ebp,            DWORD PTR 48[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 8[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 28[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         or      ebp,            edi
-        mov     DWORD PTR 40[esp],ebx
+        mov     DWORD PTR 40[esp],ecx
         and     ebp,            esi
-        lea     ebx,            DWORD PTR 2400959708[eax*1+ebx]
+        lea     ecx,            DWORD PTR 2400959708[eax*1+ecx]
         mov     eax,            edx
         ror     edx,            1
         and     eax,            edi
         or      ebp,            eax
-        mov     eax,            ecx
+        mov     eax,            ebx
         rol     eax,            5
         add     ebp,            eax
         mov     eax,            DWORD PTR 44[esp]
-        add     ebx,            ebp
+        add     ecx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 12[esp]
@@ -1211,19 +1212,19 @@ L000start:
         ror     edx,            1
         xor     eax,            ebp
         rol     eax,            1
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         mov     DWORD PTR 44[esp],eax
         or      ebp,            edx
         lea     eax,            DWORD PTR 2400959708[esi*1+eax]
-        mov     esi,            ecx
+        mov     esi,            ebx
         and     ebp,            edi
         and     esi,            edx
         or      ebp,            esi
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     ebp,            esi
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            ebp
         ; 40_59 59
         ; 20_39 60
@@ -1234,17 +1235,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 36[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 48[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 3395469782[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 61
         mov     edi,            DWORD PTR 52[esp]
@@ -1256,9 +1257,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 52[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 52[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 3395469782[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -1278,54 +1279,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 56[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 3395469782[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 3395469782[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 63
-        mov     ecx,            DWORD PTR 60[esp]
+        mov     ebx,            DWORD PTR 60[esp]
         mov     ebp,            DWORD PTR 4[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 28[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 48[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 60[esp],ecx
+        mov     DWORD PTR 60[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 3395469782[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 3395469782[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 64
-        mov     ebx,            DWORD PTR [esp]
+        mov     ecx,            DWORD PTR [esp]
         mov     ebp,            DWORD PTR 8[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR [esp],ebx
+        mov     DWORD PTR [esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 3395469782[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 3395469782[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 65
         mov     eax,            DWORD PTR 4[esp]
         mov     ebp,            DWORD PTR 12[esp]
@@ -1334,17 +1335,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 56[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 4[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 3395469782[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 66
         mov     esi,            DWORD PTR 8[esp]
@@ -1354,17 +1355,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 60[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 8[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 3395469782[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 67
         mov     edi,            DWORD PTR 12[esp]
@@ -1376,9 +1377,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 12[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 12[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 3395469782[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -1398,54 +1399,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 16[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 3395469782[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 3395469782[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 69
-        mov     ecx,            DWORD PTR 20[esp]
+        mov     ebx,            DWORD PTR 20[esp]
         mov     ebp,            DWORD PTR 28[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 8[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 20[esp],ecx
+        mov     DWORD PTR 20[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 3395469782[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 3395469782[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 70
-        mov     ebx,            DWORD PTR 24[esp]
+        mov     ecx,            DWORD PTR 24[esp]
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 24[esp],ebx
+        mov     DWORD PTR 24[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 3395469782[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 3395469782[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 71
         mov     eax,            DWORD PTR 28[esp]
         mov     ebp,            DWORD PTR 36[esp]
@@ -1454,17 +1455,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 16[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 28[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 3395469782[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 72
         mov     esi,            DWORD PTR 32[esp]
@@ -1474,17 +1475,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 20[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 32[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 3395469782[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 73
         mov     edi,            DWORD PTR 36[esp]
@@ -1496,9 +1497,9 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 36[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 36[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 3395469782[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
@@ -1518,54 +1519,54 @@ L000start:
         rol     edx,            1
         xor     ebp,            eax
         mov     DWORD PTR 40[esp],edx
-        xor     ebp,            ebx
-        lea     edx,            DWORD PTR 3395469782[ecx*1+edx]
-        mov     ecx,            edi
-        rol     ecx,            5
+        xor     ebp,            ecx
+        lea     edx,            DWORD PTR 3395469782[ebx*1+edx]
+        mov     ebx,            edi
+        rol     ebx,            5
         ror     esi,            1
-        add     ecx,            ebp
+        add     ebx,            ebp
         ror     esi,            1
-        add     edx,            ecx
+        add     edx,            ebx
         ; 20_39 75
-        mov     ecx,            DWORD PTR 44[esp]
+        mov     ebx,            DWORD PTR 44[esp]
         mov     ebp,            DWORD PTR 52[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 12[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            DWORD PTR 32[esp]
-        xor     ecx,            ebp
+        xor     ebx,            ebp
         mov     ebp,            edi
-        rol     ecx,            1
+        rol     ebx,            1
         xor     ebp,            esi
-        mov     DWORD PTR 44[esp],ecx
+        mov     DWORD PTR 44[esp],ebx
         xor     ebp,            eax
-        lea     ecx,            DWORD PTR 3395469782[ebx*1+ecx]
-        mov     ebx,            edx
-        rol     ebx,            5
+        lea     ebx,            DWORD PTR 3395469782[ecx*1+ebx]
+        mov     ecx,            edx
+        rol     ecx,            5
         ror     edi,            1
-        add     ebx,            ebp
+        add     ecx,            ebp
         ror     edi,            1
-        add     ecx,            ebx
+        add     ebx,            ecx
         ; 20_39 76
-        mov     ebx,            DWORD PTR 48[esp]
+        mov     ecx,            DWORD PTR 48[esp]
         mov     ebp,            DWORD PTR 56[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 16[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            DWORD PTR 36[esp]
-        xor     ebx,            ebp
+        xor     ecx,            ebp
         mov     ebp,            edx
-        rol     ebx,            1
+        rol     ecx,            1
         xor     ebp,            edi
-        mov     DWORD PTR 48[esp],ebx
+        mov     DWORD PTR 48[esp],ecx
         xor     ebp,            esi
-        lea     ebx,            DWORD PTR 3395469782[eax*1+ebx]
-        mov     eax,            ecx
+        lea     ecx,            DWORD PTR 3395469782[eax*1+ecx]
+        mov     eax,            ebx
         rol     eax,            5
         ror     edx,            1
         add     eax,            ebp
         ror     edx,            1
-        add     ebx,            eax
+        add     ecx,            eax
         ; 20_39 77
         mov     eax,            DWORD PTR 52[esp]
         mov     ebp,            DWORD PTR 60[esp]
@@ -1574,17 +1575,17 @@ L000start:
         xor     eax,            ebp
         mov     ebp,            DWORD PTR 40[esp]
         xor     eax,            ebp
-        mov     ebp,            ecx
+        mov     ebp,            ebx
         rol     eax,            1
         xor     ebp,            edx
         mov     DWORD PTR 52[esp],eax
         xor     ebp,            edi
         lea     eax,            DWORD PTR 3395469782[esi*1+eax]
-        mov     esi,            ebx
+        mov     esi,            ecx
         rol     esi,            5
-        ror     ecx,            1
+        ror     ebx,            1
         add     esi,            ebp
-        ror     ecx,            1
+        ror     ebx,            1
         add     eax,            esi
         ; 20_39 78
         mov     esi,            DWORD PTR 56[esp]
@@ -1594,17 +1595,17 @@ L000start:
         xor     esi,            ebp
         mov     ebp,            DWORD PTR 44[esp]
         xor     esi,            ebp
-        mov     ebp,            ebx
+        mov     ebp,            ecx
         rol     esi,            1
-        xor     ebp,            ecx
+        xor     ebp,            ebx
         mov     DWORD PTR 56[esp],esi
         xor     ebp,            edx
         lea     esi,            DWORD PTR 3395469782[edi*1+esi]
         mov     edi,            eax
         rol     edi,            5
-        ror     ebx,            1
+        ror     ecx,            1
         add     edi,            ebp
-        ror     ebx,            1
+        ror     ecx,            1
         add     esi,            edi
         ; 20_39 79
         mov     edi,            DWORD PTR 60[esp]
@@ -1616,49 +1617,100 @@ L000start:
         xor     edi,            ebp
         mov     ebp,            eax
         rol     edi,            1
-        xor     ebp,            ebx
-        mov     DWORD PTR 60[esp],edi
         xor     ebp,            ecx
+        mov     DWORD PTR 60[esp],edi
+        xor     ebp,            ebx
         lea     edi,            DWORD PTR 3395469782[edx*1+edi]
         mov     edx,            esi
         rol     edx,            5
         add     edx,            ebp
-        mov     ebp,            DWORD PTR 92[esp]
+        mov     ebp,            DWORD PTR 128[esp]
         ror     eax,            1
         add     edi,            edx
         ror     eax,            1
         ; End processing
         ; 
         mov     edx,            DWORD PTR 12[ebp]
-        add     edx,            ebx
-        mov     ebx,            DWORD PTR 4[ebp]
-        add     ebx,            esi
+        add     edx,            ecx
+        mov     ecx,            DWORD PTR 4[ebp]
+        add     ecx,            esi
         mov     esi,            eax
         mov     eax,            DWORD PTR [ebp]
         mov     DWORD PTR 12[ebp],edx
         add     eax,            edi
         mov     edi,            DWORD PTR 16[ebp]
-        add     edi,            ecx
-        mov     ecx,            DWORD PTR 8[ebp]
-        add     ecx,            esi
+        add     edi,            ebx
+        mov     ebx,            DWORD PTR 8[ebp]
+        add     ebx,            esi
         mov     DWORD PTR [ebp],eax
-        mov     esi,            DWORD PTR 64[esp]
-        mov     DWORD PTR 8[ebp],ecx
+        mov     esi,            DWORD PTR 132[esp]
+        mov     DWORD PTR 8[ebp],ebx
         add     esi,            64
         mov     eax,            DWORD PTR 68[esp]
         mov     DWORD PTR 16[ebp],edi
-        cmp     eax,            esi
-        mov     DWORD PTR 4[ebp],ebx
-        jl      $L001end
-        mov     eax,            DWORD PTR [esi]
-        jmp     L000start
-$L001end:
-        add     esp,            72
+        cmp     esi,            eax
+        mov     DWORD PTR 4[ebp],ecx
+        jl      L000start
+        add     esp,            108
         pop     edi
         pop     ebx
         pop     ebp
         pop     esi
         ret
-_sha1_block_x86 ENDP
+_TEXT   SEGMENT
+PUBLIC  _sha1_block_asm_host_order
+
+_sha1_block_asm_host_order PROC NEAR
+        mov     ecx,            DWORD PTR 12[esp]
+        push    esi
+        shl     ecx,            6
+        mov     esi,            DWORD PTR 12[esp]
+        push    ebp
+        add     ecx,            esi
+        push    ebx
+        mov     ebp,            DWORD PTR 16[esp]
+        push    edi
+        mov     edx,            DWORD PTR 12[ebp]
+        sub     esp,            108
+        mov     edi,            DWORD PTR 16[ebp]
+        mov     ebx,            DWORD PTR 8[ebp]
+        mov     DWORD PTR 68[esp],ecx
+        ; First we need to setup the X array
+        mov     eax,            DWORD PTR [esi]
+        mov     ecx,            DWORD PTR 4[esi]
+        mov     DWORD PTR [esp],eax
+        mov     DWORD PTR 4[esp],ecx
+        mov     eax,            DWORD PTR 8[esi]
+        mov     ecx,            DWORD PTR 12[esi]
+        mov     DWORD PTR 8[esp],eax
+        mov     DWORD PTR 12[esp],ecx
+        mov     eax,            DWORD PTR 16[esi]
+        mov     ecx,            DWORD PTR 20[esi]
+        mov     DWORD PTR 16[esp],eax
+        mov     DWORD PTR 20[esp],ecx
+        mov     eax,            DWORD PTR 24[esi]
+        mov     ecx,            DWORD PTR 28[esi]
+        mov     DWORD PTR 24[esp],eax
+        mov     DWORD PTR 28[esp],ecx
+        mov     eax,            DWORD PTR 32[esi]
+        mov     ecx,            DWORD PTR 36[esi]
+        mov     DWORD PTR 32[esp],eax
+        mov     DWORD PTR 36[esp],ecx
+        mov     eax,            DWORD PTR 40[esi]
+        mov     ecx,            DWORD PTR 44[esi]
+        mov     DWORD PTR 40[esp],eax
+        mov     DWORD PTR 44[esp],ecx
+        mov     eax,            DWORD PTR 48[esi]
+        mov     ecx,            DWORD PTR 52[esi]
+        mov     DWORD PTR 48[esp],eax
+        mov     DWORD PTR 52[esp],ecx
+        mov     eax,            DWORD PTR 56[esi]
+        mov     ecx,            DWORD PTR 60[esi]
+        mov     DWORD PTR 56[esp],eax
+        mov     DWORD PTR 60[esp],ecx
+        jmp     L001shortcut
+_sha1_block_asm_host_order ENDP
+_TEXT   ENDS
+_sha1_block_asm_data_order ENDP
 _TEXT   ENDS
 END
diff --git a/src/lib/libssl/src/crypto/sha/asm/sha1-586.pl b/src/lib/libssl/src/crypto/sha/asm/sha1-586.pl
index 04e42ab09f..48d9192a4e 100644
--- a/src/lib/libssl/src/crypto/sha/asm/sha1-586.pl
+++ b/src/lib/libssl/src/crypto/sha/asm/sha1-586.pl
@@ -8,8 +8,8 @@ require "x86asm.pl";
 &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386");
 
 $A="eax";
-$B="ebx";
-$C="ecx";
+$B="ecx";
+$C="ebx";
 $D="edx";
 $E="edi";
 $T="esi";
@@ -19,7 +19,7 @@ $off=9*4;
 
 @K=(0x5a827999,0x6ed9eba1,0x8f1bbcdc,0xca62c1d6);
 
-&sha1_block("sha1_block_x86");
+&sha1_block_data("sha1_block_asm_data_order");
 
 &asm_finish();
 
@@ -53,11 +53,14 @@ sub X_expand
         local($in)=@_;
 
         &comment("First, load the words onto the stack in network byte order");
-        for ($i=0; $i<16; $i++)
+        for ($i=0; $i<16; $i+=2)
                 {
-                &mov("eax",&DWP(($i+0)*4,$in,"",0)) unless $i == 0;
-                &bswap("eax");
-                &mov(&swtmp($i+0),"eax");
+                &mov($A,&DWP(($i+0)*4,$in,"",0));# unless $i == 0;
+                 &mov($B,&DWP(($i+1)*4,$in,"",0));
+                &bswap($A);
+                 &bswap($B);
+                &mov(&swtmp($i+0),$A);
+                 &mov(&swtmp($i+1),$B);
                 }
 
         &comment("We now have the X array on the stack");
@@ -312,7 +315,7 @@ sub BODY_60_79
         &BODY_20_39(@_);
         }
 
-sub sha1_block
+sub sha1_block_host
         {
         local($name)=@_;
 
@@ -325,35 +328,77 @@ sub sha1_block
         # D     12
         # E     16
 
-        &push("esi");
-         &push("ebp");
-        &mov("eax",     &wparam(2));
+        &mov("ecx",     &wparam(2));
+         &push("esi");
+        &shl("ecx",6);
          &mov("esi",    &wparam(1));
-        &add("eax",     "esi"); # offset to leave on
+        &push("ebp");
+         &add("ecx","esi");     # offset to leave on
+        &push("ebx");
          &mov("ebp",    &wparam(0));
+        &push("edi");
+         &mov($D,       &DWP(12,"ebp","",0));
+        &stack_push(18+9);
+         &mov($E,       &DWP(16,"ebp","",0));
+        &mov($C,        &DWP( 8,"ebp","",0));
+         &mov(&swtmp(17),"ecx");
+
+        &comment("First we need to setup the X array");
+
+        for ($i=0; $i<16; $i+=2)
+                {
+                &mov($A,&DWP(($i+0)*4,"esi","",0));# unless $i == 0;
+                 &mov($B,&DWP(($i+1)*4,"esi","",0));
+                &mov(&swtmp($i+0),$A);
+                 &mov(&swtmp($i+1),$B);
+                }
+        &jmp(&label("shortcut"));
+        &function_end_B($name);
+        }
+
+
+sub sha1_block_data
+        {
+        local($name)=@_;
+
+        &function_begin_B($name,"");
+
+        # parameter 1 is the MD5_CTX structure.
+        # A     0
+        # B     4
+        # C     8
+        # D     12
+        # E     16
+
+        &mov("ecx",     &wparam(2));
+         &push("esi");
+        &shl("ecx",6);
+         &mov("esi",    &wparam(1));
+        &push("ebp");
+         &add("ecx","esi");     # offset to leave on
         &push("ebx");
-         &sub("eax",    64);
+         &mov("ebp",    &wparam(0));
         &push("edi");
-         &mov($B,       &DWP( 4,"ebp","",0));
-        &stack_push(18);
          &mov($D,       &DWP(12,"ebp","",0));
-        &mov($E,        &DWP(16,"ebp","",0));
-         &mov($C,       &DWP( 8,"ebp","",0));
-        &mov(&swtmp(17),"eax");
+        &stack_push(18+9);
+         &mov($E,       &DWP(16,"ebp","",0));
+        &mov($C,        &DWP( 8,"ebp","",0));
+         &mov(&swtmp(17),"ecx");
 
         &comment("First we need to setup the X array");
-         &mov("eax",&DWP(0,"esi","",0)); # pulled out of X_expand
 
         &set_label("start") unless $normal;
 
         &X_expand("esi");
-         &mov(&swtmp(16),"esi");
+         &mov(&wparam(1),"esi");
 
+        &set_label("shortcut", 1);
         &comment("");
         &comment("Start processing");
 
         # odd start
         &mov($A,        &DWP( 0,"ebp","",0));
+         &mov($B,       &DWP( 4,"ebp","",0));
         $X="esp";
         &BODY_00_15(-2,$K[0],$X, 0,$A,$B,$C,$D,$E,$T);
         &BODY_00_15( 0,$K[0],$X, 1,$T,$A,$B,$C,$D,$E);
@@ -468,24 +513,26 @@ sub sha1_block
         &add($C,$T);
 
          &mov(&DWP( 0,$tmp1,"",0),$A);
-        &mov("esi",&swtmp(16));
-         &mov(&DWP( 8,$tmp1,"",0),$C);  # This is for looping
+        &mov("esi",&wparam(1));
+         &mov(&DWP( 8,$tmp1,"",0),$C);
         &add("esi",64);
          &mov("eax",&swtmp(17));
         &mov(&DWP(16,$tmp1,"",0),$E);
-         &cmp("eax","esi");
-        &mov(&DWP( 4,$tmp1,"",0),$B);   # This is for looping
-         &jl(&label("end"));
-        &mov("eax",&DWP(0,"esi","",0)); # Pulled down from 
-         &jmp(&label("start"));
-
-        &set_label("end");
-        &stack_pop(18);
+         &cmp("esi","eax");
+        &mov(&DWP( 4,$tmp1,"",0),$B);
+         &jl(&label("start"));
+
+        &stack_pop(18+9);
          &pop("edi");
         &pop("ebx");
          &pop("ebp");
         &pop("esi");
          &ret();
+
+        # it has to reside within sha1_block_asm_host_order body
+        # because it calls &jmp(&label("shortcut"));
+        &sha1_block_host("sha1_block_asm_host_order");
+
         &function_end_B($name);
         }
 
diff --git a/src/lib/libssl/src/crypto/sha/sha.h b/src/lib/libssl/src/crypto/sha/sha.h
index cd6960ee1a..77f6d9695e 100644
--- a/src/lib/libssl/src/crypto/sha/sha.h
+++ b/src/lib/libssl/src/crypto/sha/sha.h
@@ -63,7 +63,7 @@
 extern "C" {
 #endif
 
-#ifdef NO_SHA
+#if defined(NO_SHA) || (defined(NO_SHA0) && defined(NO_SHA1))
 #error SHA is disabled.
 #endif
 
@@ -100,17 +100,17 @@ typedef struct SHAstate_st
 
 #ifndef NO_SHA0
 void SHA_Init(SHA_CTX *c);
-void SHA_Update(SHA_CTX *c, const unsigned char *data, unsigned long len);
+void SHA_Update(SHA_CTX *c, const void *data, unsigned long len);
 void SHA_Final(unsigned char *md, SHA_CTX *c);
 unsigned char *SHA(const unsigned char *d, unsigned long n,unsigned char *md);
-void SHA_Transform(SHA_CTX *c, unsigned char *data);
+void SHA_Transform(SHA_CTX *c, const unsigned char *data);
 #endif
 #ifndef NO_SHA1
 void SHA1_Init(SHA_CTX *c);
-void SHA1_Update(SHA_CTX *c, const unsigned char *data, unsigned long len);
+void SHA1_Update(SHA_CTX *c, const void *data, unsigned long len);
 void SHA1_Final(unsigned char *md, SHA_CTX *c);
 unsigned char *SHA1(const unsigned char *d, unsigned long n,unsigned char *md);
-void SHA1_Transform(SHA_CTX *c, unsigned char *data);
+void SHA1_Transform(SHA_CTX *c, const unsigned char *data);
 #endif
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/sha/sha1dgst.c b/src/lib/libssl/src/crypto/sha/sha1dgst.c
index 66e885dd76..c09edb4cd7 100644
--- a/src/lib/libssl/src/crypto/sha/sha1dgst.c
+++ b/src/lib/libssl/src/crypto/sha/sha1dgst.c
@@ -56,443 +56,18 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
-#include <string.h>
+#if !defined(NO_SHA1) && !defined(NO_SHA)
+
 #undef  SHA_0
 #define SHA_1
-#include <openssl/sha.h>
-#include "sha_locl.h"
-#include <openssl/opensslv.h>
-
-#ifndef NO_SHA1
-char *SHA1_version="SHA1" OPENSSL_VERSION_PTEXT;
-
-/* Implemented from SHA-1 document - The Secure Hash Algorithm
- */
-
-#define INIT_DATA_h0 0x67452301UL
-#define INIT_DATA_h1 0xefcdab89UL
-#define INIT_DATA_h2 0x98badcfeUL
-#define INIT_DATA_h3 0x10325476UL
-#define INIT_DATA_h4 0xc3d2e1f0UL
-
-#define K_00_19 0x5a827999UL
-#define K_20_39 0x6ed9eba1UL
-#define K_40_59 0x8f1bbcdcUL
-#define K_60_79 0xca62c1d6UL
-
-#ifdef SHA1_ASM
-   void sha1_block_x86(SHA_CTX *c, register SHA_LONG *p, int num);
-#  define sha1_block(c,p,n) sha1_block_x86((c),(p),(n)*SHA_CBLOCK)
-#else
-   static void sha1_block(SHA_CTX *c, register SHA_LONG *p, int num);
-#endif
-
-#if !defined(B_ENDIAN) && defined(SHA1_ASM)
-#  define       M_c2nl          c2l
-#  define       M_p_c2nl        p_c2l
-#  define       M_c2nl_p        c2l_p
-#  define       M_p_c2nl_p      p_c2l_p
-#  define       M_nl2c          l2c
-#else
-#  define       M_c2nl          c2nl
-#  define       M_p_c2nl        p_c2nl
-#  define       M_c2nl_p        c2nl_p
-#  define       M_p_c2nl_p      p_c2nl_p
-#  define       M_nl2c          nl2c
-#endif
-
-void SHA1_Init(SHA_CTX *c)
-        {
-        c->h0=INIT_DATA_h0;
-        c->h1=INIT_DATA_h1;
-        c->h2=INIT_DATA_h2;
-        c->h3=INIT_DATA_h3;
-        c->h4=INIT_DATA_h4;
-        c->Nl=0;
-        c->Nh=0;
-        c->num=0;
-        }
-
-void SHA1_Update(SHA_CTX *c, register const unsigned char *data,
-             unsigned long len)
-        {
-        register SHA_LONG *p;
-        int ew,ec,sw,sc;
-        SHA_LONG l;
-
-        if (len == 0) return;
-
-        l=(c->Nl+(len<<3))&0xffffffffL;
-        if (l < c->Nl) /* overflow */
-                c->Nh++;
-        c->Nh+=(len>>29);
-        c->Nl=l;
-
-        if (c->num != 0)
-                {
-                p=c->data;
-                sw=c->num>>2;
-                sc=c->num&0x03;
-
-                if ((c->num+len) >= SHA_CBLOCK)
-                        {
-                        l= p[sw];
-                        M_p_c2nl(data,l,sc);
-                        p[sw++]=l;
-                        for (; sw<SHA_LBLOCK; sw++)
-                                {
-                                M_c2nl(data,l);
-                                p[sw]=l;
-                                }
-                        len-=(SHA_CBLOCK-c->num);
-
-                        sha1_block(c,p,1);
-                        c->num=0;
-                        /* drop through and do the rest */
-                        }
-                else
-                        {
-                        c->num+=(int)len;
-                        if ((sc+len) < 4) /* ugly, add char's to a word */
-                                {
-                                l= p[sw];
-                                M_p_c2nl_p(data,l,sc,len);
-                                p[sw]=l;
-                                }
-                        else
-                                {
-                                ew=(c->num>>2);
-                                ec=(c->num&0x03);
-                                l= p[sw];
-                                M_p_c2nl(data,l,sc);
-                                p[sw++]=l;
-                                for (; sw < ew; sw++)
-                                        { M_c2nl(data,l); p[sw]=l; }
-                                if (ec)
-                                        {
-                                        M_c2nl_p(data,l,ec);
-                                        p[sw]=l;
-                                        }
-                                }
-                        return;
-                        }
-                }
-        /* We can only do the following code for assember, the reason
-         * being that the sha1_block 'C' version changes the values
-         * in the 'data' array.  The assember code avoids this and
-         * copies it to a local array.  I should be able to do this for
-         * the C version as well....
-         */
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA1_ASM)
-        if ((((unsigned long)data)%sizeof(SHA_LONG)) == 0)
-                {
-                sw=len/SHA_CBLOCK;
-                if (sw)
-                        {
-                        sha1_block(c,(SHA_LONG *)data,sw);
-                        sw*=SHA_CBLOCK;
-                        data+=sw;
-                        len-=sw;
-                        }
-                }
-#endif
-#endif
-        /* we now can process the input data in blocks of SHA_CBLOCK
-         * chars and save the leftovers to c->data. */
-        p=c->data;
-        while (len >= SHA_CBLOCK)
-                {
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA1_ASM)
-#define SHA_NO_TAIL_CODE
-                /*
-                 * Basically we get here only when data happens
-                 * to be unaligned.
-                 */
-                if (p != (SHA_LONG *)data)
-                        memcpy(p,data,SHA_CBLOCK);
-                data+=SHA_CBLOCK;
-                sha1_block(c,p=c->data,1);
-                len-=SHA_CBLOCK;
-#elif defined(L_ENDIAN)
-#define BE_COPY(dst,src,i)      {                               \
-                                l = ((SHA_LONG *)src)[i];       \
-                                Endian_Reverse32(l);            \
-                                dst[i] = l;                     \
-                                }
-                if ((((unsigned long)data)%sizeof(SHA_LONG)) == 0)
-                        {
-                        for (sw=(SHA_LBLOCK/4); sw; sw--)
-                                {
-                                BE_COPY(p,data,0);
-                                BE_COPY(p,data,1);
-                                BE_COPY(p,data,2);
-                                BE_COPY(p,data,3);
-                                p+=4;
-                                data += 4*sizeof(SHA_LONG);
-                                }
-                        sha1_block(c,p=c->data,1);
-                        len-=SHA_CBLOCK;
-                        continue;
-                        }
-#endif
-#endif
-#ifndef SHA_NO_TAIL_CODE
-                /*
-                 * In addition to "sizeof(SHA_LONG)!= 4" case the
-                 * following code covers unaligned access cases on
-                 * little-endian machines.
-                 *                      <appro@fy.chalmers.se>
-                 */
-                p=c->data;
-                for (sw=(SHA_LBLOCK/4); sw; sw--)
-                        {
-                        M_c2nl(data,l); p[0]=l;
-                        M_c2nl(data,l); p[1]=l;
-                        M_c2nl(data,l); p[2]=l;
-                        M_c2nl(data,l); p[3]=l;
-                        p+=4;
-                        }
-                p=c->data;
-                sha1_block(c,p,1);
-                len-=SHA_CBLOCK;
-#endif
-                }
-        ec=(int)len;
-        c->num=ec;
-        ew=(ec>>2);
-        ec&=0x03;
-
-        for (sw=0; sw < ew; sw++)
-                { M_c2nl(data,l); p[sw]=l; }
-        M_c2nl_p(data,l,ec);
-        p[sw]=l;
-        }
-
-void SHA1_Transform(SHA_CTX *c, unsigned char *b)
-        {
-        SHA_LONG p[SHA_LBLOCK];
-
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA1_ASM)
-        memcpy(p,b,SHA_CBLOCK);
-        sha1_block(c,p,1);
-        return;
-#elif defined(L_ENDIAN)
-        if (((unsigned long)b%sizeof(SHA_LONG)) == 0)
-                {
-                SHA_LONG *q;
-                int i;
-
-                q=p;
-                for (i=(SHA_LBLOCK/4); i; i--)
-                        {
-                        unsigned long l;
-                        BE_COPY(q,b,0); /* BE_COPY was defined above */
-                        BE_COPY(q,b,1);
-                        BE_COPY(q,b,2);
-                        BE_COPY(q,b,3);
-                        q+=4;
-                        b+=4*sizeof(SHA_LONG);
-                        }
-                sha1_block(c,p,1);
-                return;
-                }
-#endif
-#endif
-#ifndef SHA_NO_TAIL_CODE /* defined above, see comment */
-                {
-                SHA_LONG *q;
-                int i;
-        
-                q=p;
-                for (i=(SHA_LBLOCK/4); i; i--)
-                        {
-                        SHA_LONG l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l; 
-                        } 
-                sha1_block(c,p,1);
-                }
-#endif
-        }
-
-#ifndef SHA1_ASM
-static void sha1_block(SHA_CTX *c, register SHA_LONG *W, int num)
-        {
-        register SHA_LONG A,B,C,D,E,T;
-        SHA_LONG X[SHA_LBLOCK];
-
-        A=c->h0;
-        B=c->h1;
-        C=c->h2;
-        D=c->h3;
-        E=c->h4;
 
-        for (;;)
-                {
-        BODY_00_15( 0,A,B,C,D,E,T,W);
-        BODY_00_15( 1,T,A,B,C,D,E,W);
-        BODY_00_15( 2,E,T,A,B,C,D,W);
-        BODY_00_15( 3,D,E,T,A,B,C,W);
-        BODY_00_15( 4,C,D,E,T,A,B,W);
-        BODY_00_15( 5,B,C,D,E,T,A,W);
-        BODY_00_15( 6,A,B,C,D,E,T,W);
-        BODY_00_15( 7,T,A,B,C,D,E,W);
-        BODY_00_15( 8,E,T,A,B,C,D,W);
-        BODY_00_15( 9,D,E,T,A,B,C,W);
-        BODY_00_15(10,C,D,E,T,A,B,W);
-        BODY_00_15(11,B,C,D,E,T,A,W);
-        BODY_00_15(12,A,B,C,D,E,T,W);
-        BODY_00_15(13,T,A,B,C,D,E,W);
-        BODY_00_15(14,E,T,A,B,C,D,W);
-        BODY_00_15(15,D,E,T,A,B,C,W);
-        BODY_16_19(16,C,D,E,T,A,B,W,W,W,W);
-        BODY_16_19(17,B,C,D,E,T,A,W,W,W,W);
-        BODY_16_19(18,A,B,C,D,E,T,W,W,W,W);
-        BODY_16_19(19,T,A,B,C,D,E,W,W,W,X);
-
-        BODY_20_31(20,E,T,A,B,C,D,W,W,W,X);
-        BODY_20_31(21,D,E,T,A,B,C,W,W,W,X);
-        BODY_20_31(22,C,D,E,T,A,B,W,W,W,X);
-        BODY_20_31(23,B,C,D,E,T,A,W,W,W,X);
-        BODY_20_31(24,A,B,C,D,E,T,W,W,X,X);
-        BODY_20_31(25,T,A,B,C,D,E,W,W,X,X);
-        BODY_20_31(26,E,T,A,B,C,D,W,W,X,X);
-        BODY_20_31(27,D,E,T,A,B,C,W,W,X,X);
-        BODY_20_31(28,C,D,E,T,A,B,W,W,X,X);
-        BODY_20_31(29,B,C,D,E,T,A,W,W,X,X);
-        BODY_20_31(30,A,B,C,D,E,T,W,X,X,X);
-        BODY_20_31(31,T,A,B,C,D,E,W,X,X,X);
-        BODY_32_39(32,E,T,A,B,C,D,X);
-        BODY_32_39(33,D,E,T,A,B,C,X);
-        BODY_32_39(34,C,D,E,T,A,B,X);
-        BODY_32_39(35,B,C,D,E,T,A,X);
-        BODY_32_39(36,A,B,C,D,E,T,X);
-        BODY_32_39(37,T,A,B,C,D,E,X);
-        BODY_32_39(38,E,T,A,B,C,D,X);
-        BODY_32_39(39,D,E,T,A,B,C,X);
-
-        BODY_40_59(40,C,D,E,T,A,B,X);
-        BODY_40_59(41,B,C,D,E,T,A,X);
-        BODY_40_59(42,A,B,C,D,E,T,X);
-        BODY_40_59(43,T,A,B,C,D,E,X);
-        BODY_40_59(44,E,T,A,B,C,D,X);
-        BODY_40_59(45,D,E,T,A,B,C,X);
-        BODY_40_59(46,C,D,E,T,A,B,X);
-        BODY_40_59(47,B,C,D,E,T,A,X);
-        BODY_40_59(48,A,B,C,D,E,T,X);
-        BODY_40_59(49,T,A,B,C,D,E,X);
-        BODY_40_59(50,E,T,A,B,C,D,X);
-        BODY_40_59(51,D,E,T,A,B,C,X);
-        BODY_40_59(52,C,D,E,T,A,B,X);
-        BODY_40_59(53,B,C,D,E,T,A,X);
-        BODY_40_59(54,A,B,C,D,E,T,X);
-        BODY_40_59(55,T,A,B,C,D,E,X);
-        BODY_40_59(56,E,T,A,B,C,D,X);
-        BODY_40_59(57,D,E,T,A,B,C,X);
-        BODY_40_59(58,C,D,E,T,A,B,X);
-        BODY_40_59(59,B,C,D,E,T,A,X);
-
-        BODY_60_79(60,A,B,C,D,E,T,X);
-        BODY_60_79(61,T,A,B,C,D,E,X);
-        BODY_60_79(62,E,T,A,B,C,D,X);
-        BODY_60_79(63,D,E,T,A,B,C,X);
-        BODY_60_79(64,C,D,E,T,A,B,X);
-        BODY_60_79(65,B,C,D,E,T,A,X);
-        BODY_60_79(66,A,B,C,D,E,T,X);
-        BODY_60_79(67,T,A,B,C,D,E,X);
-        BODY_60_79(68,E,T,A,B,C,D,X);
-        BODY_60_79(69,D,E,T,A,B,C,X);
-        BODY_60_79(70,C,D,E,T,A,B,X);
-        BODY_60_79(71,B,C,D,E,T,A,X);
-        BODY_60_79(72,A,B,C,D,E,T,X);
-        BODY_60_79(73,T,A,B,C,D,E,X);
-        BODY_60_79(74,E,T,A,B,C,D,X);
-        BODY_60_79(75,D,E,T,A,B,C,X);
-        BODY_60_79(76,C,D,E,T,A,B,X);
-        BODY_60_79(77,B,C,D,E,T,A,X);
-        BODY_60_79(78,A,B,C,D,E,T,X);
-        BODY_60_79(79,T,A,B,C,D,E,X);
-        
-        c->h0=(c->h0+E)&0xffffffffL; 
-        c->h1=(c->h1+T)&0xffffffffL;
-        c->h2=(c->h2+A)&0xffffffffL;
-        c->h3=(c->h3+B)&0xffffffffL;
-        c->h4=(c->h4+C)&0xffffffffL;
-
-        if (--num <= 0) break;
+#include <openssl/opensslv.h>
 
-        A=c->h0;
-        B=c->h1;
-        C=c->h2;
-        D=c->h3;
-        E=c->h4;
+const char *SHA1_version="SHA1" OPENSSL_VERSION_PTEXT;
 
-        W+=SHA_LBLOCK;  /* Note! This can happen only when sizeof(SHA_LONG)
-                         * is 4. Whenever it's not the actual case this
-                         * function is never called with num larger than 1
-                         * and we never advance down here.
-                         *                      <appro@fy.chalmers.se>
-                         */
-                }
-        }
-#endif
+/* The implementation is in ../md32_common.h */
 
-void SHA1_Final(unsigned char *md, SHA_CTX *c)
-        {
-        register int i,j;
-        register SHA_LONG l;
-        register SHA_LONG *p;
-        static unsigned char end[4]={0x80,0x00,0x00,0x00};
-        unsigned char *cp=end;
-
-        /* c->num should definitly have room for at least one more byte. */
-        p=c->data;
-        j=c->num;
-        i=j>>2;
-#ifdef PURIFY
-        if ((j&0x03) == 0) p[i]=0;
-#endif
-        l=p[i];
-        M_p_c2nl(cp,l,j&0x03);
-        p[i]=l;
-        i++;
-        /* i is the next 'undefined word' */
-        if (c->num >= SHA_LAST_BLOCK)
-                {
-                for (; i<SHA_LBLOCK; i++)
-                        p[i]=0;
-                sha1_block(c,p,1);
-                i=0;
-                }
-        for (; i<(SHA_LBLOCK-2); i++)
-                p[i]=0;
-        p[SHA_LBLOCK-2]=c->Nh;
-        p[SHA_LBLOCK-1]=c->Nl;
-#if SHA_LONG_LOG2==2
-#if !defined(B_ENDIAN) && defined(SHA1_ASM)
-        Endian_Reverse32(p[SHA_LBLOCK-2]);
-        Endian_Reverse32(p[SHA_LBLOCK-1]);
-#endif
-#endif
-        sha1_block(c,p,1);
-        cp=md;
-        l=c->h0; nl2c(l,cp);
-        l=c->h1; nl2c(l,cp);
-        l=c->h2; nl2c(l,cp);
-        l=c->h3; nl2c(l,cp);
-        l=c->h4; nl2c(l,cp);
+#include "sha_locl.h"
 
-        c->num=0;
-        /* sha_block may be leaving some stuff on the stack
-         * but I'm not worried :-)
-        memset((void *)c,0,sizeof(SHA_CTX));
-         */
-        }
 #endif
 
diff --git a/src/lib/libssl/src/crypto/sha/sha1s.cpp b/src/lib/libssl/src/crypto/sha/sha1s.cpp
index 3103e1871b..af23d1e0f2 100644
--- a/src/lib/libssl/src/crypto/sha/sha1s.cpp
+++ b/src/lib/libssl/src/crypto/sha/sha1s.cpp
@@ -34,6 +34,7 @@ void GetTSC(unsigned long& tsc)
 #include <stdlib.h>
 #include <openssl/sha.h>
 
+#define sha1_block_x86 sha1_block_asm_data_order
 extern "C" {
 void sha1_block_x86(SHA_CTX *ctx, unsigned char *buffer,int num);
 }
@@ -55,8 +56,10 @@ void main(int argc,char *argv[])
         if (num == 0) num=16;
         if (num > 250) num=16;
         numm=num+2;
+#if 0
         num*=64;
         numm*=64;
+#endif
 
         for (j=0; j<6; j++)
                 {
@@ -72,7 +75,7 @@ void main(int argc,char *argv[])
                         sha1_block_x86(&ctx,buffer,num);
                         }
 
-                printf("sha1 (%d bytes) %d %d (%.2f)\n",num,
+                printf("sha1 (%d bytes) %d %d (%.2f)\n",num*64,
                         e1-s1,e2-s2,(double)((e1-s1)-(e2-s2))/2);
                 }
         }
diff --git a/src/lib/libssl/src/crypto/sha/sha1test.c b/src/lib/libssl/src/crypto/sha/sha1test.c
index 9400ad2a61..688d06c637 100644
--- a/src/lib/libssl/src/crypto/sha/sha1test.c
+++ b/src/lib/libssl/src/crypto/sha/sha1test.c
@@ -76,26 +76,26 @@ int main(int argc, char *argv[])
 #undef SHA_0 /* FIPS 180 */
 #define  SHA_1 /* FIPS 180-1 */
 
-char *test[]={
+static char *test[]={
         "abc",
         "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
         NULL,
         };
 
 #ifdef SHA_0
-char *ret[]={
+static char *ret[]={
         "0164b8a914cd2a5e74c4f7ff082c4d97f1edf880",
         "d2516ee1acfa5baf33dfc1c471e438449ef134c8",
         };
-char *bigret=
+static char *bigret=
         "3232affa48628a26653b5aaa44541fd90d690603";
 #endif
 #ifdef SHA_1
-char *ret[]={
+static char *ret[]={
         "a9993e364706816aba3e25717850c26c9cd0d89d",
         "84983e441c3bd26ebaae4aa1f95129e5e54670f1",
         };
-char *bigret=
+static char *bigret=
         "34aa973cd4c4daa4f61eeb2bdbad27316534016f";
 #endif
 
diff --git a/src/lib/libssl/src/crypto/sha/sha_dgst.c b/src/lib/libssl/src/crypto/sha/sha_dgst.c
index 4df535360f..894a96274a 100644
--- a/src/lib/libssl/src/crypto/sha/sha_dgst.c
+++ b/src/lib/libssl/src/crypto/sha/sha_dgst.c
@@ -1,4 +1,4 @@
-/* crypto/sha/sha_dgst.c */
+/* crypto/sha/sha1dgst.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -56,437 +56,18 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
-#include <string.h>
-#define  SHA_0
-#undef SHA_1
-#include <openssl/sha.h>
-#include "sha_locl.h"
-#include <openssl/opensslv.h>
-
-#ifndef NO_SHA0
-char *SHA_version="SHA" OPENSSL_VERSION_PTEXT;
-
-/* Implemented from SHA-0 document - The Secure Hash Algorithm
- */
-
-#define INIT_DATA_h0 0x67452301UL
-#define INIT_DATA_h1 0xefcdab89UL
-#define INIT_DATA_h2 0x98badcfeUL
-#define INIT_DATA_h3 0x10325476UL
-#define INIT_DATA_h4 0xc3d2e1f0UL
-
-#define K_00_19 0x5a827999UL
-#define K_20_39 0x6ed9eba1UL
-#define K_40_59 0x8f1bbcdcUL
-#define K_60_79 0xca62c1d6UL
-
-static void sha_block(SHA_CTX *c, register SHA_LONG *p, int num);
-
-#if !defined(B_ENDIAN) && defined(SHA_ASM)
-#  define       M_c2nl          c2l
-#  define       M_p_c2nl        p_c2l
-#  define       M_c2nl_p        c2l_p
-#  define       M_p_c2nl_p      p_c2l_p
-#  define       M_nl2c          l2c
-#else
-#  define       M_c2nl          c2nl
-#  define       M_p_c2nl        p_c2nl
-#  define       M_c2nl_p        c2nl_p
-#  define       M_p_c2nl_p      p_c2nl_p
-#  define       M_nl2c          nl2c
-#endif
-
-void SHA_Init(SHA_CTX *c)
-        {
-        c->h0=INIT_DATA_h0;
-        c->h1=INIT_DATA_h1;
-        c->h2=INIT_DATA_h2;
-        c->h3=INIT_DATA_h3;
-        c->h4=INIT_DATA_h4;
-        c->Nl=0;
-        c->Nh=0;
-        c->num=0;
-        }
+#if !defined(NO_SHA0) && !defined(NO_SHA)
 
-void SHA_Update(SHA_CTX *c, register const unsigned char *data,
-                unsigned long len)
-        {
-        register SHA_LONG *p;
-        int ew,ec,sw,sc;
-        SHA_LONG l;
-
-        if (len == 0) return;
-
-        l=(c->Nl+(len<<3))&0xffffffffL;
-        if (l < c->Nl) /* overflow */
-                c->Nh++;
-        c->Nh+=(len>>29);
-        c->Nl=l;
-
-        if (c->num != 0)
-                {
-                p=c->data;
-                sw=c->num>>2;
-                sc=c->num&0x03;
-
-                if ((c->num+len) >= SHA_CBLOCK)
-                        {
-                        l= p[sw];
-                        M_p_c2nl(data,l,sc);
-                        p[sw++]=l;
-                        for (; sw<SHA_LBLOCK; sw++)
-                                {
-                                M_c2nl(data,l);
-                                p[sw]=l;
-                                }
-                        len-=(SHA_CBLOCK-c->num);
-
-                        sha_block(c,p,1);
-                        c->num=0;
-                        /* drop through and do the rest */
-                        }
-                else
-                        {
-                        c->num+=(int)len;
-                        if ((sc+len) < 4) /* ugly, add char's to a word */
-                                {
-                                l= p[sw];
-                                M_p_c2nl_p(data,l,sc,len);
-                                p[sw]=l;
-                                }
-                        else
-                                {
-                                ew=(c->num>>2);
-                                ec=(c->num&0x03);
-                                l= p[sw];
-                                M_p_c2nl(data,l,sc);
-                                p[sw++]=l;
-                                for (; sw < ew; sw++)
-                                        { M_c2nl(data,l); p[sw]=l; }
-                                if (ec)
-                                        {
-                                        M_c2nl_p(data,l,ec);
-                                        p[sw]=l;
-                                        }
-                                }
-                        return;
-                        }
-                }
-        /* We can only do the following code for assember, the reason
-         * being that the sha_block 'C' version changes the values
-         * in the 'data' array.  The assember code avoids this and
-         * copies it to a local array.  I should be able to do this for
-         * the C version as well....
-         */
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA_ASM)
-        if ((((unsigned long)data)%sizeof(SHA_LONG)) == 0)
-                {
-                sw=len/SHA_CBLOCK;
-                if (sw)
-                        {
-                        sha_block(c,(SHA_LONG *)data,sw);
-                        sw*=SHA_CBLOCK;
-                        data+=sw;
-                        len-=sw;
-                        }
-                }
-#endif
-#endif
-        /* we now can process the input data in blocks of SHA_CBLOCK
-         * chars and save the leftovers to c->data. */
-        p=c->data;
-        while (len >= SHA_CBLOCK)
-                {
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA_ASM)
-#define SHA_NO_TAIL_CODE
-                /*
-                 * Basically we get here only when data happens
-                 * to be unaligned.
-                 */
-                if (p != (SHA_LONG *)data)
-                        memcpy(p,data,SHA_CBLOCK);
-                data+=SHA_CBLOCK;
-                sha_block(c,p=c->data,1);
-                len-=SHA_CBLOCK;
-#elif defined(L_ENDIAN)
-#define BE_COPY(dst,src,i)      {                               \
-                                l = ((SHA_LONG *)src)[i];       \
-                                Endian_Reverse32(l);            \
-                                dst[i] = l;                     \
-                                }
-                if ((((unsigned long)data)%sizeof(SHA_LONG)) == 0)
-                        {
-                        for (sw=(SHA_LBLOCK/4); sw; sw--)
-                                {
-                                BE_COPY(p,data,0);
-                                BE_COPY(p,data,1);
-                                BE_COPY(p,data,2);
-                                BE_COPY(p,data,3);
-                                p+=4;
-                                data += 4*sizeof(SHA_LONG);
-                                }
-                        sha_block(c,p=c->data,1);
-                        len-=SHA_CBLOCK;
-                        continue;
-                        }
-#endif
-#endif
-#ifndef SHA_NO_TAIL_CODE
-                /*
-                 * In addition to "sizeof(SHA_LONG)!= 4" case the
-                 * following code covers unaligned access cases on
-                 * little-endian machines.
-                 *                      <appro@fy.chalmers.se>
-                 */
-                p=c->data;
-                for (sw=(SHA_LBLOCK/4); sw; sw--)
-                        {
-                        M_c2nl(data,l); p[0]=l;
-                        M_c2nl(data,l); p[1]=l;
-                        M_c2nl(data,l); p[2]=l;
-                        M_c2nl(data,l); p[3]=l;
-                        p+=4;
-                        }
-                p=c->data;
-                sha_block(c,p,1);
-                len-=SHA_CBLOCK;
-#endif
-                }
-        ec=(int)len;
-        c->num=ec;
-        ew=(ec>>2);
-        ec&=0x03;
+#undef  SHA_1
+#define SHA_0
 
-        for (sw=0; sw < ew; sw++)
-                { M_c2nl(data,l); p[sw]=l; }
-        M_c2nl_p(data,l,ec);
-        p[sw]=l;
-        }
-
-void SHA_Transform(SHA_CTX *c, unsigned char *b)
-        {
-        SHA_LONG p[SHA_LBLOCK];
-
-#if SHA_LONG_LOG2==2
-#if defined(B_ENDIAN) || defined(SHA_ASM)
-        memcpy(p,b,SHA_CBLOCK);
-        sha_block(c,p,1);
-        return;
-#elif defined(L_ENDIAN)
-        if (((unsigned long)b%sizeof(SHA_LONG)) == 0)
-                {
-                SHA_LONG *q;
-                int i;
-
-                q=p;
-                for (i=(SHA_LBLOCK/4); i; i--)
-                        {
-                        unsigned long l;
-                        BE_COPY(q,b,0); /* BE_COPY was defined above */
-                        BE_COPY(q,b,1);
-                        BE_COPY(q,b,2);
-                        BE_COPY(q,b,3);
-                        q+=4;
-                        b+=4*sizeof(SHA_LONG);
-                        }
-                sha_block(c,p,1);
-                return;
-                }
-#endif
-#endif
-#ifndef SHA_NO_TAIL_CODE /* defined above, see comment */
-                {
-                SHA_LONG *q;
-                int i;
-
-                q=p;
-                for (i=(SHA_LBLOCK/4); i; i--)
-                        {
-                        SHA_LONG l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l;
-                        c2nl(b,l); *(q++)=l; 
-                        } 
-                sha_block(c,p,1);
-                }
-#endif
-        }
-
-#ifndef SHA_ASM
-static void sha_block(SHA_CTX *c, register SHA_LONG *W, int num)
-        {
-        register SHA_LONG A,B,C,D,E,T;
-        SHA_LONG X[SHA_LBLOCK];
-
-        A=c->h0;
-        B=c->h1;
-        C=c->h2;
-        D=c->h3;
-        E=c->h4;
-
-        for (;;)
-                {
-        BODY_00_15( 0,A,B,C,D,E,T,W);
-        BODY_00_15( 1,T,A,B,C,D,E,W);
-        BODY_00_15( 2,E,T,A,B,C,D,W);
-        BODY_00_15( 3,D,E,T,A,B,C,W);
-        BODY_00_15( 4,C,D,E,T,A,B,W);
-        BODY_00_15( 5,B,C,D,E,T,A,W);
-        BODY_00_15( 6,A,B,C,D,E,T,W);
-        BODY_00_15( 7,T,A,B,C,D,E,W);
-        BODY_00_15( 8,E,T,A,B,C,D,W);
-        BODY_00_15( 9,D,E,T,A,B,C,W);
-        BODY_00_15(10,C,D,E,T,A,B,W);
-        BODY_00_15(11,B,C,D,E,T,A,W);
-        BODY_00_15(12,A,B,C,D,E,T,W);
-        BODY_00_15(13,T,A,B,C,D,E,W);
-        BODY_00_15(14,E,T,A,B,C,D,W);
-        BODY_00_15(15,D,E,T,A,B,C,W);
-        BODY_16_19(16,C,D,E,T,A,B,W,W,W,W);
-        BODY_16_19(17,B,C,D,E,T,A,W,W,W,W);
-        BODY_16_19(18,A,B,C,D,E,T,W,W,W,W);
-        BODY_16_19(19,T,A,B,C,D,E,W,W,W,X);
-
-        BODY_20_31(20,E,T,A,B,C,D,W,W,W,X);
-        BODY_20_31(21,D,E,T,A,B,C,W,W,W,X);
-        BODY_20_31(22,C,D,E,T,A,B,W,W,W,X);
-        BODY_20_31(23,B,C,D,E,T,A,W,W,W,X);
-        BODY_20_31(24,A,B,C,D,E,T,W,W,X,X);
-        BODY_20_31(25,T,A,B,C,D,E,W,W,X,X);
-        BODY_20_31(26,E,T,A,B,C,D,W,W,X,X);
-        BODY_20_31(27,D,E,T,A,B,C,W,W,X,X);
-        BODY_20_31(28,C,D,E,T,A,B,W,W,X,X);
-        BODY_20_31(29,B,C,D,E,T,A,W,W,X,X);
-        BODY_20_31(30,A,B,C,D,E,T,W,X,X,X);
-        BODY_20_31(31,T,A,B,C,D,E,W,X,X,X);
-        BODY_32_39(32,E,T,A,B,C,D,X);
-        BODY_32_39(33,D,E,T,A,B,C,X);
-        BODY_32_39(34,C,D,E,T,A,B,X);
-        BODY_32_39(35,B,C,D,E,T,A,X);
-        BODY_32_39(36,A,B,C,D,E,T,X);
-        BODY_32_39(37,T,A,B,C,D,E,X);
-        BODY_32_39(38,E,T,A,B,C,D,X);
-        BODY_32_39(39,D,E,T,A,B,C,X);
-
-        BODY_40_59(40,C,D,E,T,A,B,X);
-        BODY_40_59(41,B,C,D,E,T,A,X);
-        BODY_40_59(42,A,B,C,D,E,T,X);
-        BODY_40_59(43,T,A,B,C,D,E,X);
-        BODY_40_59(44,E,T,A,B,C,D,X);
-        BODY_40_59(45,D,E,T,A,B,C,X);
-        BODY_40_59(46,C,D,E,T,A,B,X);
-        BODY_40_59(47,B,C,D,E,T,A,X);
-        BODY_40_59(48,A,B,C,D,E,T,X);
-        BODY_40_59(49,T,A,B,C,D,E,X);
-        BODY_40_59(50,E,T,A,B,C,D,X);
-        BODY_40_59(51,D,E,T,A,B,C,X);
-        BODY_40_59(52,C,D,E,T,A,B,X);
-        BODY_40_59(53,B,C,D,E,T,A,X);
-        BODY_40_59(54,A,B,C,D,E,T,X);
-        BODY_40_59(55,T,A,B,C,D,E,X);
-        BODY_40_59(56,E,T,A,B,C,D,X);
-        BODY_40_59(57,D,E,T,A,B,C,X);
-        BODY_40_59(58,C,D,E,T,A,B,X);
-        BODY_40_59(59,B,C,D,E,T,A,X);
-
-        BODY_60_79(60,A,B,C,D,E,T,X);
-        BODY_60_79(61,T,A,B,C,D,E,X);
-        BODY_60_79(62,E,T,A,B,C,D,X);
-        BODY_60_79(63,D,E,T,A,B,C,X);
-        BODY_60_79(64,C,D,E,T,A,B,X);
-        BODY_60_79(65,B,C,D,E,T,A,X);
-        BODY_60_79(66,A,B,C,D,E,T,X);
-        BODY_60_79(67,T,A,B,C,D,E,X);
-        BODY_60_79(68,E,T,A,B,C,D,X);
-        BODY_60_79(69,D,E,T,A,B,C,X);
-        BODY_60_79(70,C,D,E,T,A,B,X);
-        BODY_60_79(71,B,C,D,E,T,A,X);
-        BODY_60_79(72,A,B,C,D,E,T,X);
-        BODY_60_79(73,T,A,B,C,D,E,X);
-        BODY_60_79(74,E,T,A,B,C,D,X);
-        BODY_60_79(75,D,E,T,A,B,C,X);
-        BODY_60_79(76,C,D,E,T,A,B,X);
-        BODY_60_79(77,B,C,D,E,T,A,X);
-        BODY_60_79(78,A,B,C,D,E,T,X);
-        BODY_60_79(79,T,A,B,C,D,E,X);
-        
-        c->h0=(c->h0+E)&0xffffffffL; 
-        c->h1=(c->h1+T)&0xffffffffL;
-        c->h2=(c->h2+A)&0xffffffffL;
-        c->h3=(c->h3+B)&0xffffffffL;
-        c->h4=(c->h4+C)&0xffffffffL;
-
-        if (--num <= 0) break;
+#include <openssl/opensslv.h>
 
-        A=c->h0;
-        B=c->h1;
-        C=c->h2;
-        D=c->h3;
-        E=c->h4;
+const char *SHA_version="SHA" OPENSSL_VERSION_PTEXT;
 
-        W+=SHA_LBLOCK;  /* Note! This can happen only when sizeof(SHA_LONG)
-                         * is 4. Whenever it's not the actual case this
-                         * function is never called with num larger than 1
-                         * and we never advance down here.
-                         *                      <appro@fy.chalmers.se>
-                         */
-                }
-        }
-#endif
+/* The implementation is in ../md32_common.h */
 
-void SHA_Final(unsigned char *md, SHA_CTX *c)
-        {
-        register int i,j;
-        register SHA_LONG l;
-        register SHA_LONG *p;
-        static unsigned char end[4]={0x80,0x00,0x00,0x00};
-        unsigned char *cp=end;
+#include "sha_locl.h"
 
-        /* c->num should definitly have room for at least one more byte. */
-        p=c->data;
-        j=c->num;
-        i=j>>2;
-#ifdef PURIFY
-        if ((j&0x03) == 0) p[i]=0;
-#endif
-        l=p[i];
-        M_p_c2nl(cp,l,j&0x03);
-        p[i]=l;
-        i++;
-        /* i is the next 'undefined word' */
-        if (c->num >= SHA_LAST_BLOCK)
-                {
-                for (; i<SHA_LBLOCK; i++)
-                        p[i]=0;
-                sha_block(c,p,1);
-                i=0;
-                }
-        for (; i<(SHA_LBLOCK-2); i++)
-                p[i]=0;
-        p[SHA_LBLOCK-2]=c->Nh;
-        p[SHA_LBLOCK-1]=c->Nl;
-#if SHA_LONG_LOG2==2
-#if !defined(B_ENDIAN) && defined(SHA_ASM)
-        Endian_Reverse32(p[SHA_LBLOCK-2]);
-        Endian_Reverse32(p[SHA_LBLOCK-1]);
 #endif
-#endif
-        sha_block(c,p,1);
-        cp=md;
-        l=c->h0; nl2c(l,cp);
-        l=c->h1; nl2c(l,cp);
-        l=c->h2; nl2c(l,cp);
-        l=c->h3; nl2c(l,cp);
-        l=c->h4; nl2c(l,cp);
 
-        c->num=0;
-        /* sha_block may be leaving some stuff on the stack
-         * but I'm not worried :-)
-        memset((void *)c,0,sizeof(SHA_CTX));
-         */
-        }
-#endif
diff --git a/src/lib/libssl/src/crypto/sha/sha_locl.h b/src/lib/libssl/src/crypto/sha/sha_locl.h
index 6646a8915b..3e6f489b87 100644
--- a/src/lib/libssl/src/crypto/sha/sha_locl.h
+++ b/src/lib/libssl/src/crypto/sha/sha_locl.h
@@ -60,180 +60,105 @@
 #include <string.h>
 
 #include <openssl/opensslconf.h>
-
-#ifdef undef
-/* one or the other needs to be defined */
-#ifndef SHA_1 /* FIPE 180-1 */
-#define SHA_0 /* FIPS 180   */
-#endif
-#endif
-
-#undef c2nl
-#define c2nl(c,l)       (l =(((unsigned long)(*((c)++)))<<24), \
-                         l|=(((unsigned long)(*((c)++)))<<16), \
-                         l|=(((unsigned long)(*((c)++)))<< 8), \
-                         l|=(((unsigned long)(*((c)++)))    ))
-
-#undef p_c2nl
-#define p_c2nl(c,l,n)   { \
-                        switch (n) { \
-                        case 0: l =((unsigned long)(*((c)++)))<<24; \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16; \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8; \
-                        case 3: l|=((unsigned long)(*((c)++))); \
-                                } \
-                        }
-
-#undef c2nl_p
-/* NOTE the pointer is not incremented at the end of this */
-#define c2nl_p(c,l,n)   { \
-                        l=0; \
-                        (c)+=n; \
-                        switch (n) { \
-                        case 3: l =((unsigned long)(*(--(c))))<< 8; \
-                        case 2: l|=((unsigned long)(*(--(c))))<<16; \
-                        case 1: l|=((unsigned long)(*(--(c))))<<24; \
-                                } \
-                        }
-
-#undef p_c2nl_p
-#define p_c2nl_p(c,l,sc,len) { \
-                        switch (sc) \
-                                { \
-                        case 0: l =((unsigned long)(*((c)++)))<<24; \
-                                if (--len == 0) break; \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16; \
-                                if (--len == 0) break; \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8; \
-                                } \
-                        }
-
-#undef nl2c
-#define nl2c(l,c)       (*((c)++)=(unsigned char)(((l)>>24)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
-                         *((c)++)=(unsigned char)(((l)    )&0xff))
-
-#undef c2l
-#define c2l(c,l)        (l =(((unsigned long)(*((c)++)))    ), \
-                         l|=(((unsigned long)(*((c)++)))<< 8), \
-                         l|=(((unsigned long)(*((c)++)))<<16), \
-                         l|=(((unsigned long)(*((c)++)))<<24))
-
-#undef p_c2l
-#define p_c2l(c,l,n)    { \
-                        switch (n) { \
-                        case 0: l =((unsigned long)(*((c)++))); \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8; \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16; \
-                        case 3: l|=((unsigned long)(*((c)++)))<<24; \
-                                } \
-                        }
-
-#undef c2l_p
-/* NOTE the pointer is not incremented at the end of this */
-#define c2l_p(c,l,n)    { \
-                        l=0; \
-                        (c)+=n; \
-                        switch (n) { \
-                        case 3: l =((unsigned long)(*(--(c))))<<16; \
-                        case 2: l|=((unsigned long)(*(--(c))))<< 8; \
-                        case 1: l|=((unsigned long)(*(--(c)))); \
-                                } \
-                        }
-
-#undef p_c2l_p
-#define p_c2l_p(c,l,sc,len) { \
-                        switch (sc) \
-                                { \
-                        case 0: l =((unsigned long)(*((c)++))); \
-                                if (--len == 0) break; \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8; \
-                                if (--len == 0) break; \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16; \
-                                } \
-                        }
-
-#undef l2c
-#define l2c(l,c)        (*((c)++)=(unsigned char)(((l)    )&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>24)&0xff))
+#include <openssl/sha.h>
 
 #ifndef SHA_LONG_LOG2
 #define SHA_LONG_LOG2   2       /* default to 32 bits */
 #endif
 
-#undef ROTATE
-#undef Endian_Reverse32
-#if defined(WIN32)
-#define ROTATE(a,n)     _lrotl(a,n)
-#elif defined(__GNUC__) && !defined(PEDANTIC)
-/* some inline assembler templates by <appro@fy.chalmers.se> */
-#if defined(__i386) && !defined(NO_ASM)
-#define ROTATE(a,n)     ({ register unsigned int ret;   \
-                                asm ("roll %1,%0"       \
-                                : "=r"(ret)             \
-                                : "I"(n), "0"(a)        \
-                                : "cc");                \
-                           ret;                         \
-                        })
-#ifndef I386_ONLY
-#define Endian_Reverse32(a) \
-                        { register unsigned int ltmp=(a);       \
-                                asm ("bswapl %0"        \
-                                : "=r"(ltmp) : "0"(ltmp));      \
-                          (a)=ltmp;                     \
-                        }
-#endif
-#elif defined(__powerpc)
-#define ROTATE(a,n)     ({ register unsigned int ret;           \
-                                asm ("rlwinm %0,%1,%2,0,31"     \
-                                : "=r"(ret)                     \
-                                : "r"(a), "I"(n));              \
-                           ret;                                 \
-                        })
-/* Endian_Reverse32 is not needed for PowerPC */
-#endif
-#endif
+#define DATA_ORDER_IS_BIG_ENDIAN
+
+#define HASH_LONG               SHA_LONG
+#define HASH_LONG_LOG2          SHA_LONG_LOG2
+#define HASH_CTX                SHA_CTX
+#define HASH_CBLOCK             SHA_CBLOCK
+#define HASH_LBLOCK             SHA_LBLOCK
+#define HASH_MAKE_STRING(c,s)   do {    \
+        unsigned long ll;               \
+        ll=(c)->h0; HOST_l2c(ll,(s));   \
+        ll=(c)->h1; HOST_l2c(ll,(s));   \
+        ll=(c)->h2; HOST_l2c(ll,(s));   \
+        ll=(c)->h3; HOST_l2c(ll,(s));   \
+        ll=(c)->h4; HOST_l2c(ll,(s));   \
+        } while (0)
+
+#if defined(SHA_0)
+
+# define HASH_UPDATE                    SHA_Update
+# define HASH_TRANSFORM                 SHA_Transform
+# define HASH_FINAL                     SHA_Final
+# define HASH_INIT                      SHA_Init
+# define HASH_BLOCK_HOST_ORDER          sha_block_host_order
+# define HASH_BLOCK_DATA_ORDER          sha_block_data_order
+# define Xupdate(a,ix,ia,ib,ic,id)      (ix=(a)=(ia^ib^ic^id))
+
+  void sha_block_host_order (SHA_CTX *c, const void *p,int num);
+  void sha_block_data_order (SHA_CTX *c, const void *p,int num);
+
+#elif defined(SHA_1)
+
+# define HASH_UPDATE                    SHA1_Update
+# define HASH_TRANSFORM                 SHA1_Transform
+# define HASH_FINAL                     SHA1_Final
+# define HASH_INIT                      SHA1_Init
+# define HASH_BLOCK_HOST_ORDER          sha1_block_host_order
+# define HASH_BLOCK_DATA_ORDER          sha1_block_data_order
+# if defined(__MWERKS__) && defined(__MC68K__)
+   /* Metrowerks for Motorola fails otherwise:-( <appro@fy.chalmers.se> */
+#  define Xupdate(a,ix,ia,ib,ic,id)     do { (a)=(ia^ib^ic^id);         \
+                                             ix=(a)=ROTATE((a),1);      \
+                                        } while (0)
+# else
+#  define Xupdate(a,ix,ia,ib,ic,id)     ( (a)=(ia^ib^ic^id),    \
+                                          ix=(a)=ROTATE((a),1)  \
+                                        )
+# endif
+
+# ifdef SHA1_ASM
+#  if defined(__i386) || defined(_M_IX86) || defined(__INTEL__)
+#   define sha1_block_host_order                sha1_block_asm_host_order
+#   define DONT_IMPLEMENT_BLOCK_HOST_ORDER
+#   define sha1_block_data_order                sha1_block_asm_data_order
+#   define DONT_IMPLEMENT_BLOCK_DATA_ORDER
+#   define HASH_BLOCK_DATA_ORDER_ALIGNED        sha1_block_asm_data_order
+#  endif
+# endif
+  void sha1_block_host_order (SHA_CTX *c, const void *p,int num);
+  void sha1_block_data_order (SHA_CTX *c, const void *p,int num);
 
-/* A nice byte order reversal from Wei Dai <weidai@eskimo.com> */
-#ifdef ROTATE
-#ifndef Endian_Reverse32
-/* 5 instructions with rotate instruction, else 9 */
-#define Endian_Reverse32(a) \
-        { \
-        unsigned long t=(a); \
-        (a)=((ROTATE(t,8)&0x00FF00FF)|(ROTATE((t&0x00FF00FF),24))); \
-        }
-#endif
 #else
-#define ROTATE(a,n)     (((a)<<(n))|(((a)&0xffffffff)>>(32-(n))))
-#ifndef Endian_Reverse32
-/* 6 instructions with rotate instruction, else 8 */
-#define Endian_Reverse32(a) \
-        { \
-        unsigned long t=(a); \
-        t=(((t>>8)&0x00FF00FF)|((t&0x00FF00FF)<<8)); \
-        (a)=ROTATE(t,16); \
-        }
+# error "Either SHA_0 or SHA_1 must be defined."
 #endif
-/*
- * Originally the middle line started with l=(((l&0xFF00FF00)>>8)|...
- * It's rewritten as above for two reasons:
- *      - RISCs aren't good at long constants and have to explicitely
- *        compose 'em with several (well, usually 2) instructions in a
- *        register before performing the actual operation and (as you
- *        already realized:-) having same constant should inspire the
- *        compiler to permanently allocate the only register for it;
- *      - most modern CPUs have two ALUs, but usually only one has
- *        circuitry for shifts:-( this minor tweak inspires compiler
- *        to schedule shift instructions in a better way...
- *
- *                              <appro@fy.chalmers.se>
- */
+
+#ifndef FLAT_INC
+#include "../md32_common.h"
+#else
+#include "md32_common.h"
 #endif
 
+#define INIT_DATA_h0 0x67452301UL
+#define INIT_DATA_h1 0xefcdab89UL
+#define INIT_DATA_h2 0x98badcfeUL
+#define INIT_DATA_h3 0x10325476UL
+#define INIT_DATA_h4 0xc3d2e1f0UL
+
+void HASH_INIT (SHA_CTX *c)
+        {
+        c->h0=INIT_DATA_h0;
+        c->h1=INIT_DATA_h1;
+        c->h2=INIT_DATA_h2;
+        c->h3=INIT_DATA_h3;
+        c->h4=INIT_DATA_h4;
+        c->Nl=0;
+        c->Nh=0;
+        c->num=0;
+        }
+
+#define K_00_19 0x5a827999UL
+#define K_20_39 0x6ed9eba1UL
+#define K_40_59 0x8f1bbcdcUL
+#define K_60_79 0xca62c1d6UL
+
 /* As  pointed out by Wei Dai <weidai@eskimo.com>, F() below can be
  * simplified to the code in F_00_19.  Wei attributes these optimisations
  * to Peter Gutmann's SHS code, and he attributes it to Rich Schroeppel.
@@ -246,43 +171,305 @@
 #define F_40_59(b,c,d)  (((b) & (c)) | (((b)|(c)) & (d))) 
 #define F_60_79(b,c,d)  F_20_39(b,c,d)
 
-#undef Xupdate
-#ifdef SHA_0
-#define Xupdate(a,i,ia,ib,ic,id) X[(i)&0x0f]=(a)=\
-        (ia[(i)&0x0f]^ib[((i)+2)&0x0f]^ic[((i)+8)&0x0f]^id[((i)+13)&0x0f]);
-#endif
-#ifdef SHA_1
-#define Xupdate(a,i,ia,ib,ic,id) (a)=\
-        (ia[(i)&0x0f]^ib[((i)+2)&0x0f]^ic[((i)+8)&0x0f]^id[((i)+13)&0x0f]);\
-        X[(i)&0x0f]=(a)=ROTATE((a),1);
-#endif
-
-#define BODY_00_15(i,a,b,c,d,e,f,xa) \
-        (f)=xa[i]+(e)+K_00_19+ROTATE((a),5)+F_00_19((b),(c),(d)); \
+#define BODY_00_15(i,a,b,c,d,e,f,xi) \
+        (f)=xi+(e)+K_00_19+ROTATE((a),5)+F_00_19((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_16_19(i,a,b,c,d,e,f,xa,xb,xc,xd) \
-        Xupdate(f,i,xa,xb,xc,xd); \
+#define BODY_16_19(i,a,b,c,d,e,f,xi,xa,xb,xc,xd) \
+        Xupdate(f,xi,xa,xb,xc,xd); \
         (f)+=(e)+K_00_19+ROTATE((a),5)+F_00_19((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_20_31(i,a,b,c,d,e,f,xa,xb,xc,xd) \
-        Xupdate(f,i,xa,xb,xc,xd); \
+#define BODY_20_31(i,a,b,c,d,e,f,xi,xa,xb,xc,xd) \
+        Xupdate(f,xi,xa,xb,xc,xd); \
         (f)+=(e)+K_20_39+ROTATE((a),5)+F_20_39((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_32_39(i,a,b,c,d,e,f,xa) \
-        Xupdate(f,i,xa,xa,xa,xa); \
+#define BODY_32_39(i,a,b,c,d,e,f,xa,xb,xc,xd) \
+        Xupdate(f,xa,xa,xb,xc,xd); \
         (f)+=(e)+K_20_39+ROTATE((a),5)+F_20_39((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_40_59(i,a,b,c,d,e,f,xa) \
-        Xupdate(f,i,xa,xa,xa,xa); \
+#define BODY_40_59(i,a,b,c,d,e,f,xa,xb,xc,xd) \
+        Xupdate(f,xa,xa,xb,xc,xd); \
         (f)+=(e)+K_40_59+ROTATE((a),5)+F_40_59((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
-#define BODY_60_79(i,a,b,c,d,e,f,xa) \
-        Xupdate(f,i,xa,xa,xa,xa); \
-        (f)=X[(i)&0x0f]+(e)+K_60_79+ROTATE((a),5)+F_60_79((b),(c),(d)); \
+#define BODY_60_79(i,a,b,c,d,e,f,xa,xb,xc,xd) \
+        Xupdate(f,xa,xa,xb,xc,xd); \
+        (f)=xa+(e)+K_60_79+ROTATE((a),5)+F_60_79((b),(c),(d)); \
         (b)=ROTATE((b),30);
 
+#ifdef X
+#undef X
+#endif
+#ifndef MD32_XARRAY
+  /*
+   * Originally X was an array. As it's automatic it's natural
+   * to expect RISC compiler to accomodate at least part of it in
+   * the register bank, isn't it? Unfortunately not all compilers
+   * "find" this expectation reasonable:-( On order to make such
+   * compilers generate better code I replace X[] with a bunch of
+   * X0, X1, etc. See the function body below...
+   *                                    <appro@fy.chalmers.se>
+   */
+# define X(i)   XX##i
+#else
+  /*
+   * However! Some compilers (most notably HP C) get overwhelmed by
+   * that many local variables so that we have to have the way to
+   * fall down to the original behavior.
+   */
+# define X(i)   XX[i]
+#endif
+
+#ifndef DONT_IMPLEMENT_BLOCK_HOST_ORDER
+void HASH_BLOCK_HOST_ORDER (SHA_CTX *c, const void *d, int num)
+        {
+        const SHA_LONG *W=d;
+        register unsigned long A,B,C,D,E,T;
+#ifndef MD32_XARRAY
+        unsigned long   XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
+                        XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
+#else
+        SHA_LONG        XX[16];
+#endif
+
+        A=c->h0;
+        B=c->h1;
+        C=c->h2;
+        D=c->h3;
+        E=c->h4;
+
+        for (;;)
+                {
+        BODY_00_15( 0,A,B,C,D,E,T,W[ 0]);
+        BODY_00_15( 1,T,A,B,C,D,E,W[ 1]);
+        BODY_00_15( 2,E,T,A,B,C,D,W[ 2]);
+        BODY_00_15( 3,D,E,T,A,B,C,W[ 3]);
+        BODY_00_15( 4,C,D,E,T,A,B,W[ 4]);
+        BODY_00_15( 5,B,C,D,E,T,A,W[ 5]);
+        BODY_00_15( 6,A,B,C,D,E,T,W[ 6]);
+        BODY_00_15( 7,T,A,B,C,D,E,W[ 7]);
+        BODY_00_15( 8,E,T,A,B,C,D,W[ 8]);
+        BODY_00_15( 9,D,E,T,A,B,C,W[ 9]);
+        BODY_00_15(10,C,D,E,T,A,B,W[10]);
+        BODY_00_15(11,B,C,D,E,T,A,W[11]);
+        BODY_00_15(12,A,B,C,D,E,T,W[12]);
+        BODY_00_15(13,T,A,B,C,D,E,W[13]);
+        BODY_00_15(14,E,T,A,B,C,D,W[14]);
+        BODY_00_15(15,D,E,T,A,B,C,W[15]);
+
+        BODY_16_19(16,C,D,E,T,A,B,X( 0),W[ 0],W[ 2],W[ 8],W[13]);
+        BODY_16_19(17,B,C,D,E,T,A,X( 1),W[ 1],W[ 3],W[ 9],W[14]);
+        BODY_16_19(18,A,B,C,D,E,T,X( 2),W[ 2],W[ 4],W[10],W[15]);
+        BODY_16_19(19,T,A,B,C,D,E,X( 3),W[ 3],W[ 5],W[11],X( 0));
+
+        BODY_20_31(20,E,T,A,B,C,D,X( 4),W[ 4],W[ 6],W[12],X( 1));
+        BODY_20_31(21,D,E,T,A,B,C,X( 5),W[ 5],W[ 7],W[13],X( 2));
+        BODY_20_31(22,C,D,E,T,A,B,X( 6),W[ 6],W[ 8],W[14],X( 3));
+        BODY_20_31(23,B,C,D,E,T,A,X( 7),W[ 7],W[ 9],W[15],X( 4));
+        BODY_20_31(24,A,B,C,D,E,T,X( 8),W[ 8],W[10],X( 0),X( 5));
+        BODY_20_31(25,T,A,B,C,D,E,X( 9),W[ 9],W[11],X( 1),X( 6));
+        BODY_20_31(26,E,T,A,B,C,D,X(10),W[10],W[12],X( 2),X( 7));
+        BODY_20_31(27,D,E,T,A,B,C,X(11),W[11],W[13],X( 3),X( 8));
+        BODY_20_31(28,C,D,E,T,A,B,X(12),W[12],W[14],X( 4),X( 9));
+        BODY_20_31(29,B,C,D,E,T,A,X(13),W[13],W[15],X( 5),X(10));
+        BODY_20_31(30,A,B,C,D,E,T,X(14),W[14],X( 0),X( 6),X(11));
+        BODY_20_31(31,T,A,B,C,D,E,X(15),W[15],X( 1),X( 7),X(12));
+
+        BODY_32_39(32,E,T,A,B,C,D,X( 0),X( 2),X( 8),X(13));
+        BODY_32_39(33,D,E,T,A,B,C,X( 1),X( 3),X( 9),X(14));
+        BODY_32_39(34,C,D,E,T,A,B,X( 2),X( 4),X(10),X(15));
+        BODY_32_39(35,B,C,D,E,T,A,X( 3),X( 5),X(11),X( 0));
+        BODY_32_39(36,A,B,C,D,E,T,X( 4),X( 6),X(12),X( 1));
+        BODY_32_39(37,T,A,B,C,D,E,X( 5),X( 7),X(13),X( 2));
+        BODY_32_39(38,E,T,A,B,C,D,X( 6),X( 8),X(14),X( 3));
+        BODY_32_39(39,D,E,T,A,B,C,X( 7),X( 9),X(15),X( 4));
+
+        BODY_40_59(40,C,D,E,T,A,B,X( 8),X(10),X( 0),X( 5));
+        BODY_40_59(41,B,C,D,E,T,A,X( 9),X(11),X( 1),X( 6));
+        BODY_40_59(42,A,B,C,D,E,T,X(10),X(12),X( 2),X( 7));
+        BODY_40_59(43,T,A,B,C,D,E,X(11),X(13),X( 3),X( 8));
+        BODY_40_59(44,E,T,A,B,C,D,X(12),X(14),X( 4),X( 9));
+        BODY_40_59(45,D,E,T,A,B,C,X(13),X(15),X( 5),X(10));
+        BODY_40_59(46,C,D,E,T,A,B,X(14),X( 0),X( 6),X(11));
+        BODY_40_59(47,B,C,D,E,T,A,X(15),X( 1),X( 7),X(12));
+        BODY_40_59(48,A,B,C,D,E,T,X( 0),X( 2),X( 8),X(13));
+        BODY_40_59(49,T,A,B,C,D,E,X( 1),X( 3),X( 9),X(14));
+        BODY_40_59(50,E,T,A,B,C,D,X( 2),X( 4),X(10),X(15));
+        BODY_40_59(51,D,E,T,A,B,C,X( 3),X( 5),X(11),X( 0));
+        BODY_40_59(52,C,D,E,T,A,B,X( 4),X( 6),X(12),X( 1));
+        BODY_40_59(53,B,C,D,E,T,A,X( 5),X( 7),X(13),X( 2));
+        BODY_40_59(54,A,B,C,D,E,T,X( 6),X( 8),X(14),X( 3));
+        BODY_40_59(55,T,A,B,C,D,E,X( 7),X( 9),X(15),X( 4));
+        BODY_40_59(56,E,T,A,B,C,D,X( 8),X(10),X( 0),X( 5));
+        BODY_40_59(57,D,E,T,A,B,C,X( 9),X(11),X( 1),X( 6));
+        BODY_40_59(58,C,D,E,T,A,B,X(10),X(12),X( 2),X( 7));
+        BODY_40_59(59,B,C,D,E,T,A,X(11),X(13),X( 3),X( 8));
+
+        BODY_60_79(60,A,B,C,D,E,T,X(12),X(14),X( 4),X( 9));
+        BODY_60_79(61,T,A,B,C,D,E,X(13),X(15),X( 5),X(10));
+        BODY_60_79(62,E,T,A,B,C,D,X(14),X( 0),X( 6),X(11));
+        BODY_60_79(63,D,E,T,A,B,C,X(15),X( 1),X( 7),X(12));
+        BODY_60_79(64,C,D,E,T,A,B,X( 0),X( 2),X( 8),X(13));
+        BODY_60_79(65,B,C,D,E,T,A,X( 1),X( 3),X( 9),X(14));
+        BODY_60_79(66,A,B,C,D,E,T,X( 2),X( 4),X(10),X(15));
+        BODY_60_79(67,T,A,B,C,D,E,X( 3),X( 5),X(11),X( 0));
+        BODY_60_79(68,E,T,A,B,C,D,X( 4),X( 6),X(12),X( 1));
+        BODY_60_79(69,D,E,T,A,B,C,X( 5),X( 7),X(13),X( 2));
+        BODY_60_79(70,C,D,E,T,A,B,X( 6),X( 8),X(14),X( 3));
+        BODY_60_79(71,B,C,D,E,T,A,X( 7),X( 9),X(15),X( 4));
+        BODY_60_79(72,A,B,C,D,E,T,X( 8),X(10),X( 0),X( 5));
+        BODY_60_79(73,T,A,B,C,D,E,X( 9),X(11),X( 1),X( 6));
+        BODY_60_79(74,E,T,A,B,C,D,X(10),X(12),X( 2),X( 7));
+        BODY_60_79(75,D,E,T,A,B,C,X(11),X(13),X( 3),X( 8));
+        BODY_60_79(76,C,D,E,T,A,B,X(12),X(14),X( 4),X( 9));
+        BODY_60_79(77,B,C,D,E,T,A,X(13),X(15),X( 5),X(10));
+        BODY_60_79(78,A,B,C,D,E,T,X(14),X( 0),X( 6),X(11));
+        BODY_60_79(79,T,A,B,C,D,E,X(15),X( 1),X( 7),X(12));
+        
+        c->h0=(c->h0+E)&0xffffffffL; 
+        c->h1=(c->h1+T)&0xffffffffL;
+        c->h2=(c->h2+A)&0xffffffffL;
+        c->h3=(c->h3+B)&0xffffffffL;
+        c->h4=(c->h4+C)&0xffffffffL;
+
+        if (--num <= 0) break;
+
+        A=c->h0;
+        B=c->h1;
+        C=c->h2;
+        D=c->h3;
+        E=c->h4;
+
+        W+=SHA_LBLOCK;
+                }
+        }
+#endif
+
+#ifndef DONT_IMPLEMENT_BLOCK_DATA_ORDER
+void HASH_BLOCK_DATA_ORDER (SHA_CTX *c, const void *p, int num)
+        {
+        const unsigned char *data=p;
+        register unsigned long A,B,C,D,E,T,l;
+#ifndef MD32_XARRAY
+        unsigned long   XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
+                        XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
+#else
+        SHA_LONG        XX[16];
+#endif
+
+        A=c->h0;
+        B=c->h1;
+        C=c->h2;
+        D=c->h3;
+        E=c->h4;
+
+        for (;;)
+                {
+
+        HOST_c2l(data,l); X( 0)=l;              HOST_c2l(data,l); X( 1)=l;
+        BODY_00_15( 0,A,B,C,D,E,T,X( 0));       HOST_c2l(data,l); X( 2)=l;
+        BODY_00_15( 1,T,A,B,C,D,E,X( 1));       HOST_c2l(data,l); X( 3)=l;
+        BODY_00_15( 2,E,T,A,B,C,D,X( 2));       HOST_c2l(data,l); X( 4)=l;
+        BODY_00_15( 3,D,E,T,A,B,C,X( 3));       HOST_c2l(data,l); X( 5)=l;
+        BODY_00_15( 4,C,D,E,T,A,B,X( 4));       HOST_c2l(data,l); X( 6)=l;
+        BODY_00_15( 5,B,C,D,E,T,A,X( 5));       HOST_c2l(data,l); X( 7)=l;
+        BODY_00_15( 6,A,B,C,D,E,T,X( 6));       HOST_c2l(data,l); X( 8)=l;
+        BODY_00_15( 7,T,A,B,C,D,E,X( 7));       HOST_c2l(data,l); X( 9)=l;
+        BODY_00_15( 8,E,T,A,B,C,D,X( 8));       HOST_c2l(data,l); X(10)=l;
+        BODY_00_15( 9,D,E,T,A,B,C,X( 9));       HOST_c2l(data,l); X(11)=l;
+        BODY_00_15(10,C,D,E,T,A,B,X(10));       HOST_c2l(data,l); X(12)=l;
+        BODY_00_15(11,B,C,D,E,T,A,X(11));       HOST_c2l(data,l); X(13)=l;
+        BODY_00_15(12,A,B,C,D,E,T,X(12));       HOST_c2l(data,l); X(14)=l;
+        BODY_00_15(13,T,A,B,C,D,E,X(13));       HOST_c2l(data,l); X(15)=l;
+        BODY_00_15(14,E,T,A,B,C,D,X(14));
+        BODY_00_15(15,D,E,T,A,B,C,X(15));
+
+        BODY_16_19(16,C,D,E,T,A,B,X( 0),X( 0),X( 2),X( 8),X(13));
+        BODY_16_19(17,B,C,D,E,T,A,X( 1),X( 1),X( 3),X( 9),X(14));
+        BODY_16_19(18,A,B,C,D,E,T,X( 2),X( 2),X( 4),X(10),X(15));
+        BODY_16_19(19,T,A,B,C,D,E,X( 3),X( 3),X( 5),X(11),X( 0));
+
+        BODY_20_31(20,E,T,A,B,C,D,X( 4),X( 4),X( 6),X(12),X( 1));
+        BODY_20_31(21,D,E,T,A,B,C,X( 5),X( 5),X( 7),X(13),X( 2));
+        BODY_20_31(22,C,D,E,T,A,B,X( 6),X( 6),X( 8),X(14),X( 3));
+        BODY_20_31(23,B,C,D,E,T,A,X( 7),X( 7),X( 9),X(15),X( 4));
+        BODY_20_31(24,A,B,C,D,E,T,X( 8),X( 8),X(10),X( 0),X( 5));
+        BODY_20_31(25,T,A,B,C,D,E,X( 9),X( 9),X(11),X( 1),X( 6));
+        BODY_20_31(26,E,T,A,B,C,D,X(10),X(10),X(12),X( 2),X( 7));
+        BODY_20_31(27,D,E,T,A,B,C,X(11),X(11),X(13),X( 3),X( 8));
+        BODY_20_31(28,C,D,E,T,A,B,X(12),X(12),X(14),X( 4),X( 9));
+        BODY_20_31(29,B,C,D,E,T,A,X(13),X(13),X(15),X( 5),X(10));
+        BODY_20_31(30,A,B,C,D,E,T,X(14),X(14),X( 0),X( 6),X(11));
+        BODY_20_31(31,T,A,B,C,D,E,X(15),X(15),X( 1),X( 7),X(12));
+
+        BODY_32_39(32,E,T,A,B,C,D,X( 0),X( 2),X( 8),X(13));
+        BODY_32_39(33,D,E,T,A,B,C,X( 1),X( 3),X( 9),X(14));
+        BODY_32_39(34,C,D,E,T,A,B,X( 2),X( 4),X(10),X(15));
+        BODY_32_39(35,B,C,D,E,T,A,X( 3),X( 5),X(11),X( 0));
+        BODY_32_39(36,A,B,C,D,E,T,X( 4),X( 6),X(12),X( 1));
+        BODY_32_39(37,T,A,B,C,D,E,X( 5),X( 7),X(13),X( 2));
+        BODY_32_39(38,E,T,A,B,C,D,X( 6),X( 8),X(14),X( 3));
+        BODY_32_39(39,D,E,T,A,B,C,X( 7),X( 9),X(15),X( 4));
+
+        BODY_40_59(40,C,D,E,T,A,B,X( 8),X(10),X( 0),X( 5));
+        BODY_40_59(41,B,C,D,E,T,A,X( 9),X(11),X( 1),X( 6));
+        BODY_40_59(42,A,B,C,D,E,T,X(10),X(12),X( 2),X( 7));
+        BODY_40_59(43,T,A,B,C,D,E,X(11),X(13),X( 3),X( 8));
+        BODY_40_59(44,E,T,A,B,C,D,X(12),X(14),X( 4),X( 9));
+        BODY_40_59(45,D,E,T,A,B,C,X(13),X(15),X( 5),X(10));
+        BODY_40_59(46,C,D,E,T,A,B,X(14),X( 0),X( 6),X(11));
+        BODY_40_59(47,B,C,D,E,T,A,X(15),X( 1),X( 7),X(12));
+        BODY_40_59(48,A,B,C,D,E,T,X( 0),X( 2),X( 8),X(13));
+        BODY_40_59(49,T,A,B,C,D,E,X( 1),X( 3),X( 9),X(14));
+        BODY_40_59(50,E,T,A,B,C,D,X( 2),X( 4),X(10),X(15));
+        BODY_40_59(51,D,E,T,A,B,C,X( 3),X( 5),X(11),X( 0));
+        BODY_40_59(52,C,D,E,T,A,B,X( 4),X( 6),X(12),X( 1));
+        BODY_40_59(53,B,C,D,E,T,A,X( 5),X( 7),X(13),X( 2));
+        BODY_40_59(54,A,B,C,D,E,T,X( 6),X( 8),X(14),X( 3));
+        BODY_40_59(55,T,A,B,C,D,E,X( 7),X( 9),X(15),X( 4));
+        BODY_40_59(56,E,T,A,B,C,D,X( 8),X(10),X( 0),X( 5));
+        BODY_40_59(57,D,E,T,A,B,C,X( 9),X(11),X( 1),X( 6));
+        BODY_40_59(58,C,D,E,T,A,B,X(10),X(12),X( 2),X( 7));
+        BODY_40_59(59,B,C,D,E,T,A,X(11),X(13),X( 3),X( 8));
+
+        BODY_60_79(60,A,B,C,D,E,T,X(12),X(14),X( 4),X( 9));
+        BODY_60_79(61,T,A,B,C,D,E,X(13),X(15),X( 5),X(10));
+        BODY_60_79(62,E,T,A,B,C,D,X(14),X( 0),X( 6),X(11));
+        BODY_60_79(63,D,E,T,A,B,C,X(15),X( 1),X( 7),X(12));
+        BODY_60_79(64,C,D,E,T,A,B,X( 0),X( 2),X( 8),X(13));
+        BODY_60_79(65,B,C,D,E,T,A,X( 1),X( 3),X( 9),X(14));
+        BODY_60_79(66,A,B,C,D,E,T,X( 2),X( 4),X(10),X(15));
+        BODY_60_79(67,T,A,B,C,D,E,X( 3),X( 5),X(11),X( 0));
+        BODY_60_79(68,E,T,A,B,C,D,X( 4),X( 6),X(12),X( 1));
+        BODY_60_79(69,D,E,T,A,B,C,X( 5),X( 7),X(13),X( 2));
+        BODY_60_79(70,C,D,E,T,A,B,X( 6),X( 8),X(14),X( 3));
+        BODY_60_79(71,B,C,D,E,T,A,X( 7),X( 9),X(15),X( 4));
+        BODY_60_79(72,A,B,C,D,E,T,X( 8),X(10),X( 0),X( 5));
+        BODY_60_79(73,T,A,B,C,D,E,X( 9),X(11),X( 1),X( 6));
+        BODY_60_79(74,E,T,A,B,C,D,X(10),X(12),X( 2),X( 7));
+        BODY_60_79(75,D,E,T,A,B,C,X(11),X(13),X( 3),X( 8));
+        BODY_60_79(76,C,D,E,T,A,B,X(12),X(14),X( 4),X( 9));
+        BODY_60_79(77,B,C,D,E,T,A,X(13),X(15),X( 5),X(10));
+        BODY_60_79(78,A,B,C,D,E,T,X(14),X( 0),X( 6),X(11));
+        BODY_60_79(79,T,A,B,C,D,E,X(15),X( 1),X( 7),X(12));
+        
+        c->h0=(c->h0+E)&0xffffffffL; 
+        c->h1=(c->h1+T)&0xffffffffL;
+        c->h2=(c->h2+A)&0xffffffffL;
+        c->h3=(c->h3+B)&0xffffffffL;
+        c->h4=(c->h4+C)&0xffffffffL;
+
+        if (--num <= 0) break;
+
+        A=c->h0;
+        B=c->h1;
+        C=c->h2;
+        D=c->h3;
+        E=c->h4;
+
+                }
+        }
+#endif
diff --git a/src/lib/libssl/src/crypto/sha/shatest.c b/src/lib/libssl/src/crypto/sha/shatest.c
index 2b0744d937..a5786bbf76 100644
--- a/src/lib/libssl/src/crypto/sha/shatest.c
+++ b/src/lib/libssl/src/crypto/sha/shatest.c
@@ -76,26 +76,26 @@ int main(int argc, char *argv[])
 #define SHA_0 /* FIPS 180 */
 #undef  SHA_1 /* FIPS 180-1 */
 
-char *test[]={
+static char *test[]={
         "abc",
         "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
         NULL,
         };
 
 #ifdef SHA_0
-char *ret[]={
+static char *ret[]={
         "0164b8a914cd2a5e74c4f7ff082c4d97f1edf880",
         "d2516ee1acfa5baf33dfc1c471e438449ef134c8",
         };
-char *bigret=
+static char *bigret=
         "3232affa48628a26653b5aaa44541fd90d690603";
 #endif
 #ifdef SHA_1
-char *ret[]={
+static char *ret[]={
         "a9993e364706816aba3e25717850c26c9cd0d89d",
         "84983e441c3bd26ebaae4aa1f95129e5e54670f1",
         };
-char *bigret=
+static char *bigret=
         "34aa973cd4c4daa4f61eeb2bdbad27316534016f";
 #endif
 
diff --git a/src/lib/libssl/src/crypto/stack/Makefile.ssl b/src/lib/libssl/src/crypto/stack/Makefile.ssl
index faed4d0364..64a93b33ac 100644
--- a/src/lib/libssl/src/crypto/stack/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/stack/Makefile.ssl
@@ -82,4 +82,5 @@ stack.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 stack.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 stack.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 stack.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-stack.o: ../../include/openssl/stack.h ../cryptlib.h
+stack.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+stack.o: ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/stack/stack.c b/src/lib/libssl/src/crypto/stack/stack.c
index 8b96713884..58e9126339 100644
--- a/src/lib/libssl/src/crypto/stack/stack.c
+++ b/src/lib/libssl/src/crypto/stack/stack.c
@@ -59,7 +59,7 @@
 /* Code for stacks
  * Author - Eric Young v 1.0
  * 1.2 eay 12-Mar-97 -  Modified sk_find so that it _DOES_ return the
- *                      lowest index for the seached item.
+ *                      lowest index for the searched item.
  *
  * 1.1 eay - Take from netdb and added to SSLeay
  *
@@ -126,7 +126,7 @@ STACK *sk_new(int (*c)())
         ret->sorted=0;
         return(ret);
 err1:
-        Free((char *)ret);
+        Free(ret);
 err0:
         return(NULL);
         }
@@ -276,8 +276,8 @@ void sk_pop_free(STACK *st, void (*func)())
 void sk_free(STACK *st)
         {
         if (st == NULL) return;
-        if (st->data != NULL) Free((char *)st->data);
-        Free((char *)st);
+        if (st->data != NULL) Free(st->data);
+        Free(st);
         }
 
 int sk_num(STACK *st)
diff --git a/src/lib/libssl/src/crypto/stack/stack.h b/src/lib/libssl/src/crypto/stack/stack.h
index 0f825cc0c4..a615d9b4c9 100644
--- a/src/lib/libssl/src/crypto/stack/stack.h
+++ b/src/lib/libssl/src/crypto/stack/stack.h
@@ -76,8 +76,8 @@ typedef struct stack_st
 
 #define sk_new_null()   sk_new(NULL)
 
-#define M_sk_num(sk)            ((sk)->num)
-#define M_sk_value(sk,n)        ((sk)->data[n])
+#define M_sk_num(sk)            ((sk) ? (sk)->num:-1)
+#define M_sk_value(sk,n)        ((sk) ? (sk)->data[n] : NULL)
 
 int sk_num(STACK *);
 char *sk_value(STACK *, int);
diff --git a/src/lib/libssl/src/crypto/threads/README b/src/lib/libssl/src/crypto/threads/README
new file mode 100644
index 0000000000..df6b26e146
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/README
@@ -0,0 +1,14 @@
+Mutithreading testing area.
+
+Since this stuff is very very platorm specific, this is not part of the
+normal build.  Have a read of doc/threads.doc.
+
+mttest will do some testing and will currently build under Windows NT/95,
+Solaris and Linux.  The IRIX stuff is not finished.
+
+I have tested this program on a 12 CPU ultra sparc box (solaris 2.5.1)
+and things seem to work ok.
+
+The Linux pthreads package can be retrieved from 
+http://www.mit.edu:8001/people/proven/pthreads.html
+
diff --git a/src/lib/libssl/src/crypto/threads/mttest.c b/src/lib/libssl/src/crypto/threads/mttest.c
index 142623edda..24713a3157 100644
--- a/src/lib/libssl/src/crypto/threads/mttest.c
+++ b/src/lib/libssl/src/crypto/threads/mttest.c
@@ -74,26 +74,29 @@
 #include <ulocks.h>
 #include <sys/prctl.h>
 #endif
+#ifdef PTHREADS
+#include <pthread.h>
+#endif
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
-#include "../e_os.h"
+#include "../../e_os.h"
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <openssl/rand.h>
 
 #ifdef NO_FP_API
 #define APPS_WIN16
-#include "../crypto/buffer/bss_file.c"
+#include "../buffer/bss_file.c"
 #endif
 
-#define TEST_SERVER_CERT "../apps/server.pem"
-#define TEST_CLIENT_CERT "../apps/client.pem"
+#define TEST_SERVER_CERT "../../apps/server.pem"
+#define TEST_CLIENT_CERT "../../apps/client.pem"
 
 #define MAX_THREAD_NUMBER       100
 
-int MS_CALLBACK verify_callback(int ok, X509 *xs, X509 *xi, int depth,
-        int error,char *arg);
+int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *xs);
 void thread_setup(void);
 void thread_cleanup(void);
 void do_threads(SSL_CTX *s_ctx,SSL_CTX *c_ctx);
@@ -121,6 +124,8 @@ int number_of_loops=10;
 int reconnect=0;
 int cache_stats=0;
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
 int doit(char *ctx[4]);
 static void print_stats(FILE *fp, SSL_CTX *ctx)
 {
@@ -170,6 +175,8 @@ int main(int argc, char *argv[])
         char *ccert=TEST_CLIENT_CERT;
         SSL_METHOD *ssl_method=SSLv23_method();
 
+        RAND_seed(rnd_seed, sizeof rnd_seed);
+
         if (bio_err == NULL)
                 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
         if (bio_stdout == NULL)
@@ -244,7 +251,7 @@ bad:
         if (cipher == NULL) cipher=getenv("SSL_CIPHER");
 
         SSL_load_error_strings();
-        SSLeay_add_ssl_algorithms();
+        OpenSSL_add_ssl_algorithms();
 
         c_ctx=SSL_CTX_new(ssl_method);
         s_ctx=SSL_CTX_new(ssl_method);
@@ -259,8 +266,15 @@ bad:
         SSL_CTX_set_session_cache_mode(c_ctx,
                 SSL_SESS_CACHE_NO_AUTO_CLEAR|SSL_SESS_CACHE_SERVER);
 
-        SSL_CTX_use_certificate_file(s_ctx,scert,SSL_FILETYPE_PEM);
-        SSL_CTX_use_RSAPrivateKey_file(s_ctx,scert,SSL_FILETYPE_PEM);
+        if (!SSL_CTX_use_certificate_file(s_ctx,scert,SSL_FILETYPE_PEM))
+                {
+                ERR_print_errors(bio_err);
+                }
+        else if (!SSL_CTX_use_RSAPrivateKey_file(s_ctx,scert,SSL_FILETYPE_PEM))
+                {
+                ERR_print_errors(bio_err);
+                goto end;
+                }
 
         if (client_auth)
                 {
@@ -489,6 +503,7 @@ int doit(char *ctx[4])
                                         else
                                                 {
                                                 fprintf(stderr,"ERROR in CLIENT\n");
+                                                ERR_print_errors_fp(stderr);
                                                 return(1);
                                                 }
                                         }
@@ -520,6 +535,7 @@ int doit(char *ctx[4])
                                         else
                                                 {
                                                 fprintf(stderr,"ERROR in CLIENT\n");
+                                                ERR_print_errors_fp(stderr);
                                                 return(1);
                                                 }
                                         }
@@ -652,18 +668,23 @@ err:
         return(0);
         }
 
-int MS_CALLBACK verify_callback(int ok, X509 *xs, X509 *xi, int depth,
-             int error, char *arg)
+int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
         {
-        char buf[256];
+        char *s, buf[256];
 
         if (verbose)
                 {
-                X509_NAME_oneline(X509_get_subject_name(xs),buf,256);
-                if (ok)
-                        fprintf(stderr,"depth=%d %s\n",depth,buf);
-                else
-                        fprintf(stderr,"depth=%d error=%d %s\n",depth,error,buf);
+                s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),
+                                    buf,256);
+                if (s != NULL)
+                        {
+                        if (ok)
+                                fprintf(stderr,"depth=%d %s\n",
+                                        ctx->error_depth,buf);
+                        else
+                                fprintf(stderr,"depth=%d error=%d %s\n",
+                                        ctx->error_depth,ctx->error,buf);
+                        }
                 }
         return(ok);
         }
@@ -672,13 +693,14 @@ int MS_CALLBACK verify_callback(int ok, X509 *xs, X509 *xi, int depth,
 
 #ifdef WIN32
 
-static HANDLE lock_cs[CRYPTO_NUM_LOCKS];
+static HANDLE *lock_cs;
 
 void thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(HANDLE));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_cs[i]=CreateMutex(NULL,FALSE,NULL);
                 }
@@ -692,8 +714,9 @@ void thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 CloseHandle(lock_cs[i]);
+        Free(lock_cs);
         }
 
 void win32_locking_callback(int mode, int type, char *file, int line)
@@ -763,15 +786,17 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
 
 #ifdef SOLARIS
 
-static mutex_t lock_cs[CRYPTO_NUM_LOCKS];
-/*static rwlock_t lock_cs[CRYPTO_NUM_LOCKS]; */
-static long lock_count[CRYPTO_NUM_LOCKS];
+static mutex_t *lock_cs;
+/*static rwlock_t *lock_cs; */
+static long *lock_count;
 
 void thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(mutex_t));
+        lock_count=Malloc(CRYPTO_num_locks() * sizeof(long));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_count[i]=0;
                 /* rwlock_init(&(lock_cs[i]),USYNC_THREAD,NULL); */
@@ -787,31 +812,37 @@ void thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-fprintf(stderr,"cleanup\n");
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+
+        fprintf(stderr,"cleanup\n");
+
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 /* rwlock_destroy(&(lock_cs[i])); */
                 mutex_destroy(&(lock_cs[i]));
                 fprintf(stderr,"%8ld:%s\n",lock_count[i],CRYPTO_get_lock_name(i));
                 }
-fprintf(stderr,"done cleanup\n");
+        Free(lock_cs);
+        Free(lock_count);
+
+        fprintf(stderr,"done cleanup\n");
+
         }
 
 void solaris_locking_callback(int mode, int type, char *file, int line)
         {
 #ifdef undef
-fprintf(stderr,"thread=%4d mode=%s lock=%s %s:%d\n",
-        CRYPTO_thread_id(),
-        (mode&CRYPTO_LOCK)?"l":"u",
-        (type&CRYPTO_READ)?"r":"w",file,line);
+        fprintf(stderr,"thread=%4d mode=%s lock=%s %s:%d\n",
+                CRYPTO_thread_id(),
+                (mode&CRYPTO_LOCK)?"l":"u",
+                (type&CRYPTO_READ)?"r":"w",file,line);
 #endif
 
-/*
-if (CRYPTO_LOCK_SSL_CERT == type)
+        /*
+        if (CRYPTO_LOCK_SSL_CERT == type)
         fprintf(stderr,"(t,m,f,l) %ld %d %s %d\n",
                 CRYPTO_thread_id(),
                 mode,file,line);
-*/
+        */
         if (mode & CRYPTO_LOCK)
                 {
         /*      if (mode & CRYPTO_READ)
@@ -871,7 +902,7 @@ unsigned long solaris_thread_id(void)
 
 
 static usptr_t *arena;
-static usema_t *lock_cs[CRYPTO_NUM_LOCKS];
+static usema_t **lock_cs;
 
 void thread_setup(void)
         {
@@ -888,7 +919,8 @@ void thread_setup(void)
         arena=usinit(filename);
         unlink(filename);
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(usema_t *));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_cs[i]=usnewsema(arena,1);
                 }
@@ -902,7 +934,7 @@ void thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 char buf[10];
 
@@ -910,6 +942,7 @@ void thread_cleanup(void)
                 usdumpsema(lock_cs[i],stdout,buf);
                 usfreesema(lock_cs[i],arena);
                 }
+        Free(lock_cs);
         }
 
 void irix_locking_callback(int mode, int type, char *file, int line)
@@ -962,14 +995,16 @@ unsigned long irix_thread_id(void)
 
 #ifdef PTHREADS
 
-static pthread_mutex_t lock_cs[CRYPTO_NUM_LOCKS];
-static long lock_count[CRYPTO_NUM_LOCKS];
+static pthread_mutex_t *lock_cs;
+static long *lock_count;
 
 void thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
+        lock_count=Malloc(CRYPTO_num_locks() * sizeof(long));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_count[i]=0;
                 pthread_mutex_init(&(lock_cs[i]),NULL);
@@ -985,12 +1020,15 @@ void thread_cleanup(void)
 
         CRYPTO_set_locking_callback(NULL);
         fprintf(stderr,"cleanup\n");
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 pthread_mutex_destroy(&(lock_cs[i]));
                 fprintf(stderr,"%8ld:%s\n",lock_count[i],
                         CRYPTO_get_lock_name(i));
                 }
+        Free(lock_cs);
+        Free(lock_count);
+
         fprintf(stderr,"done cleanup\n");
         }
 
@@ -1045,7 +1083,7 @@ void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
                 }
 
         printf("pthreads threads done (%d,%d)\n",
-        s_ctx->references,c_ctx->references);
+                s_ctx->references,c_ctx->references);
         }
 
 unsigned long pthreads_thread_id(void)
diff --git a/src/lib/libssl/src/crypto/threads/profile.sh b/src/lib/libssl/src/crypto/threads/profile.sh
new file mode 100644
index 0000000000..6e3e342fc0
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/profile.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+/bin/rm -f mttest
+cc -p -DSOLARIS -I../../include -g mttest.c -o mttest -L/usr/lib/libc -ldl -L../.. -lthread  -lssl -lcrypto -lnsl -lsocket
+
diff --git a/src/lib/libssl/src/crypto/threads/ptest.bat b/src/lib/libssl/src/crypto/threads/ptest.bat
new file mode 100644
index 0000000000..4071b5ffea
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/ptest.bat
@@ -0,0 +1,4 @@
+del mttest.exe
+
+purify cl /O2 -DWIN32 /MD -I..\..\out mttest.c /Femttest ..\..\out\ssl32.lib ..\..\out\crypt32.lib
+
diff --git a/src/lib/libssl/src/crypto/threads/pthread.sh b/src/lib/libssl/src/crypto/threads/pthread.sh
new file mode 100644
index 0000000000..f1c49821d2
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/pthread.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+#
+# build using pthreads
+#
+# http://www.mit.edu:8001/people/proven/pthreads.html
+#
+/bin/rm -f mttest
+pgcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto 
+
diff --git a/src/lib/libssl/src/crypto/threads/pthread2.sh b/src/lib/libssl/src/crypto/threads/pthread2.sh
new file mode 100644
index 0000000000..41264c6a50
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/pthread2.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+#
+# build using pthreads where it's already built into the system
+#
+/bin/rm -f mttest
+gcc -DPTHREADS -I../../include -g mttest.c -o mttest -L../.. -lssl -lcrypto -lpthread
+
diff --git a/src/lib/libssl/src/crypto/threads/pthreads-vms.com b/src/lib/libssl/src/crypto/threads/pthreads-vms.com
new file mode 100644
index 0000000000..63f5b8cc2e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/pthreads-vms.com
@@ -0,0 +1,9 @@
+$! To compile mttest on VMS.
+$!
+$! WARNING: only tested with DEC C so far.
+$
+$ arch := vax
+$ if f$getsyi("CPU") .ge. 128 then arch := axp
+$ define/user openssl [--.include.openssl]
+$ cc/def=PTHREADS mttest.c
+$ link mttest,[--.'arch'.exe.ssl]libssl/lib,[--.'arch'.exe.crypto]libcrypto/lib
diff --git a/src/lib/libssl/src/crypto/threads/purify.sh b/src/lib/libssl/src/crypto/threads/purify.sh
new file mode 100644
index 0000000000..6d44fe26b7
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/purify.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+/bin/rm -f mttest
+purify cc -DSOLARIS -I../../include -g mttest.c -o mttest -L../.. -lthread  -lssl -lcrypto -lnsl -lsocket
+
diff --git a/src/lib/libssl/src/crypto/threads/solaris.sh b/src/lib/libssl/src/crypto/threads/solaris.sh
new file mode 100644
index 0000000000..bc93094a27
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/solaris.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+/bin/rm -f mttest
+cc -DSOLARIS -I../../include -g mttest.c -o mttest -L../.. -lthread  -lssl -lcrypto -lnsl -lsocket
+
diff --git a/src/lib/libssl/src/crypto/threads/th-lock.c b/src/lib/libssl/src/crypto/threads/th-lock.c
index afb4f4caf2..3ee978060c 100644
--- a/src/lib/libssl/src/crypto/threads/th-lock.c
+++ b/src/lib/libssl/src/crypto/threads/th-lock.c
@@ -74,6 +74,9 @@
 #include <ulocks.h>
 #include <sys/prctl.h>
 #endif
+#ifdef PTHREADS
+#include <pthread.h>
+#endif
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
@@ -82,7 +85,7 @@
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 
-int CRYPTO_thread_setup(void);
+void CRYPTO_thread_setup(void);
 void CRYPTO_thread_cleanup(void);
 
 static void irix_locking_callback(int mode,int type,char *file,int line);
@@ -96,7 +99,7 @@ static unsigned long pthreads_thread_id(void );
 
 /* usage:
  * CRYPTO_thread_setup();
- * applicaion code
+ * application code
  * CRYPTO_thread_cleanup();
  */
 
@@ -104,13 +107,14 @@ static unsigned long pthreads_thread_id(void );
 
 #ifdef WIN32
 
-static HANDLE lock_cs[CRYPTO_NUM_LOCKS];
+static HANDLE *lock_cs;
 
-int CRYPTO_thread_setup(void)
+void CRYPTO_thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(HANDLE));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_cs[i]=CreateMutex(NULL,FALSE,NULL);
                 }
@@ -125,8 +129,9 @@ static void CRYPTO_thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 CloseHandle(lock_cs[i]);
+        Free(lock_cs);
         }
 
 void win32_locking_callback(int mode, int type, char *file, int line)
@@ -147,18 +152,24 @@ void win32_locking_callback(int mode, int type, char *file, int line)
 
 #define USE_MUTEX
 
-static mutex_t lock_cs[CRYPTO_NUM_LOCKS];
 #ifdef USE_MUTEX
-static long lock_count[CRYPTO_NUM_LOCKS];
+static mutex_t *lock_cs;
 #else
-static rwlock_t lock_cs[CRYPTO_NUM_LOCKS];
+static rwlock_t *lock_cs;
 #endif
+static long *lock_count;
 
 void CRYPTO_thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+#ifdef USE_MUTEX
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(mutex_t));
+#else
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(rwlock_t));
+#endif
+        lock_count=Malloc(CRYPTO_num_locks() * sizeof(long));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_count[i]=0;
 #ifdef USE_MUTEX
@@ -177,7 +188,7 @@ void CRYPTO_thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
 #ifdef USE_MUTEX
                 mutex_destroy(&(lock_cs[i]));
@@ -185,6 +196,8 @@ void CRYPTO_thread_cleanup(void)
                 rwlock_destroy(&(lock_cs[i]));
 #endif
                 }
+        Free(lock_cs);
+        Free(lock_count);
         }
 
 void solaris_locking_callback(int mode, int type, char *file, int line)
@@ -237,7 +250,7 @@ unsigned long solaris_thread_id(void)
 /* I don't think this works..... */
 
 static usptr_t *arena;
-static usema_t *lock_cs[CRYPTO_NUM_LOCKS];
+static usema_t **lock_cs;
 
 void CRYPTO_thread_setup(void)
         {
@@ -254,7 +267,8 @@ void CRYPTO_thread_setup(void)
         arena=usinit(filename);
         unlink(filename);
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(usema_t *));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_cs[i]=usnewsema(arena,1);
                 }
@@ -268,7 +282,7 @@ void CRYPTO_thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 char buf[10];
 
@@ -276,6 +290,7 @@ void CRYPTO_thread_cleanup(void)
                 usdumpsema(lock_cs[i],stdout,buf);
                 usfreesema(lock_cs[i],arena);
                 }
+        Free(lock_cs);
         }
 
 void irix_locking_callback(int mode, int type, char *file, int line)
@@ -302,14 +317,16 @@ unsigned long irix_thread_id(void)
 /* Linux and a few others */
 #ifdef PTHREADS
 
-static pthread_mutex_t lock_cs[CRYPTO_NUM_LOCKS];
-static long lock_count[CRYPTO_NUM_LOCKS];
+static pthread_mutex_t *lock_cs;
+static long *lock_count;
 
 void CRYPTO_thread_setup(void)
         {
         int i;
 
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        lock_cs=Malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
+        lock_count=Malloc(CRYPTO_num_locks() * sizeof(long));
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 lock_count[i]=0;
                 pthread_mutex_init(&(lock_cs[i]),NULL);
@@ -324,10 +341,12 @@ void thread_cleanup(void)
         int i;
 
         CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
+        for (i=0; i<CRYPTO_num_locks(); i++)
                 {
                 pthread_mutex_destroy(&(lock_cs[i]));
                 }
+        Free(lock_cs);
+        Free(lock_count);
         }
 
 void pthreads_locking_callback(int mode, int type, char *file,
diff --git a/src/lib/libssl/src/crypto/threads/win32.bat b/src/lib/libssl/src/crypto/threads/win32.bat
new file mode 100644
index 0000000000..ee6da80a07
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/win32.bat
@@ -0,0 +1,4 @@
+del mttest.exe
+
+cl /O2 -DWIN32 /MD -I..\..\out mttest.c /Femttest ..\..\out\ssleay32.lib ..\..\out\libeay32.lib
+
diff --git a/src/lib/libssl/src/crypto/txt_db/Makefile.ssl b/src/lib/libssl/src/crypto/txt_db/Makefile.ssl
index 02b863bf89..a631dce6f2 100644
--- a/src/lib/libssl/src/crypto/txt_db/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/txt_db/Makefile.ssl
@@ -82,5 +82,6 @@ txt_db.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 txt_db.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
 txt_db.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 txt_db.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
-txt_db.o: ../../include/openssl/opensslv.h ../../include/openssl/stack.h
-txt_db.o: ../../include/openssl/txt_db.h ../cryptlib.h
+txt_db.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+txt_db.o: ../../include/openssl/stack.h ../../include/openssl/txt_db.h
+txt_db.o: ../cryptlib.h
diff --git a/src/lib/libssl/src/crypto/txt_db/txt_db.c b/src/lib/libssl/src/crypto/txt_db/txt_db.c
index 9a9fa5ce55..33acc81f3f 100644
--- a/src/lib/libssl/src/crypto/txt_db/txt_db.c
+++ b/src/lib/libssl/src/crypto/txt_db/txt_db.c
@@ -181,7 +181,7 @@ err:
 #endif
                 if (ret->data != NULL) sk_free(ret->data);
                 if (ret->index != NULL) Free(ret->index);
-                if (ret->qual != NULL) Free((char *)ret->qual);
+                if (ret->qual != NULL) Free(ret->qual);
                 if (ret != NULL) Free(ret);
                 return(NULL);
                 }
@@ -205,7 +205,7 @@ char **TXT_DB_get_by_index(TXT_DB *db, int idx, char **value)
                 db->error=DB_ERROR_NO_INDEX;
                 return(NULL);
                 }
-        ret=(char **)lh_retrieve(lh,(char *)value);
+        ret=(char **)lh_retrieve(lh,value);
         db->error=DB_ERROR_OK;
         return(ret);
         }
@@ -306,7 +306,7 @@ int TXT_DB_insert(TXT_DB *db, char **row)
                         {
                         if ((db->qual[i] != NULL) &&
                                 (db->qual[i](row) == 0)) continue;
-                        r=(char **)lh_retrieve(db->index[i],(char *)row);
+                        r=(char **)lh_retrieve(db->index[i],row);
                         if (r != NULL)
                                 {
                                 db->error=DB_ERROR_INDEX_CLASH;
@@ -329,7 +329,7 @@ int TXT_DB_insert(TXT_DB *db, char **row)
                         {
                         if ((db->qual[i] != NULL) &&
                                 (db->qual[i](row) == 0)) continue;
-                        lh_insert(db->index[i],(char *)row);
+                        lh_insert(db->index[i],row);
                         }
                 }
         return(1);
diff --git a/src/lib/libssl/src/crypto/x509/Makefile.ssl b/src/lib/libssl/src/crypto/x509/Makefile.ssl
index c7ac35f6cc..48937b43af 100644
--- a/src/lib/libssl/src/crypto/x509/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/x509/Makefile.ssl
@@ -23,17 +23,17 @@ APPS=
 
 LIB=$(TOP)/libcrypto.a
 LIBSRC= x509_def.c x509_d2.c x509_r2x.c x509_cmp.c \
-        x509_obj.c x509_req.c x509_vfy.c \
+        x509_obj.c x509_req.c x509spki.c x509_vfy.c \
         x509_set.c x509rset.c x509_err.c \
-        x509name.c x509_v3.c x509_ext.c \
+        x509name.c x509_v3.c x509_ext.c x509_att.c \
         x509type.c x509_lu.c x_all.c x509_txt.c \
-        by_file.c by_dir.c 
+        x509_trs.c by_file.c by_dir.c 
 LIBOBJ= x509_def.o x509_d2.o x509_r2x.o x509_cmp.o \
-        x509_obj.o x509_req.o x509_vfy.o \
+        x509_obj.o x509_req.o x509spki.o x509_vfy.o \
         x509_set.o x509rset.o x509_err.o \
-        x509name.o x509_v3.o x509_ext.o \
+        x509name.o x509_v3.o x509_ext.o x509_att.o \
         x509type.o x509_lu.o x_all.o x509_txt.o \
-        by_file.o by_dir.o
+        x509_trs.o by_file.o by_dir.o
 
 SRC= $(LIBSRC)
 
@@ -123,14 +123,33 @@ by_file.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 by_file.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 by_file.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
 by_file.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+x509_att.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+x509_att.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+x509_att.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+x509_att.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_att.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_att.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_att.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_att.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_att.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+x509_att.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+x509_att.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+x509_att.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+x509_att.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+x509_att.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+x509_att.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+x509_att.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+x509_att.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+x509_att.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_cmp.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_cmp.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_cmp.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-x509_cmp.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-x509_cmp.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-x509_cmp.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-x509_cmp.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-x509_cmp.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+x509_cmp.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_cmp.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_cmp.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_cmp.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_cmp.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_cmp.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 x509_cmp.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 x509_cmp.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 x509_cmp.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -139,7 +158,7 @@ x509_cmp.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 x509_cmp.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_cmp.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_cmp.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-x509_cmp.o: ../cryptlib.h
+x509_cmp.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_d2.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_d2.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_d2.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -192,11 +211,12 @@ x509_err.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 x509_ext.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_ext.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_ext.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-x509_ext.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-x509_ext.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-x509_ext.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-x509_ext.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-x509_ext.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+x509_ext.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_ext.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_ext.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_ext.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_ext.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_ext.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 x509_ext.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 x509_ext.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 x509_ext.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -205,7 +225,7 @@ x509_ext.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 x509_ext.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_ext.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_ext.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-x509_ext.o: ../cryptlib.h
+x509_ext.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_lu.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_lu.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_lu.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -293,6 +313,24 @@ x509_set.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_set.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_set.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 x509_set.o: ../cryptlib.h
+x509_trs.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+x509_trs.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+x509_trs.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+x509_trs.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_trs.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_trs.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_trs.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_trs.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_trs.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+x509_trs.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+x509_trs.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+x509_trs.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+x509_trs.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+x509_trs.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+x509_trs.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+x509_trs.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+x509_trs.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+x509_trs.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_txt.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_txt.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_txt.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -314,11 +352,12 @@ x509_txt.o: ../cryptlib.h
 x509_v3.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_v3.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_v3.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-x509_v3.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-x509_v3.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-x509_v3.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-x509_v3.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-x509_v3.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+x509_v3.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_v3.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_v3.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_v3.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_v3.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_v3.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 x509_v3.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 x509_v3.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 x509_v3.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -327,25 +366,25 @@ x509_v3.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 x509_v3.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_v3.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_v3.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-x509_v3.o: ../cryptlib.h
+x509_v3.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509_vfy.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509_vfy.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509_vfy.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-x509_vfy.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
-x509_vfy.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-x509_vfy.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
-x509_vfy.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-x509_vfy.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
-x509_vfy.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
-x509_vfy.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
-x509_vfy.o: ../../include/openssl/opensslconf.h
+x509_vfy.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+x509_vfy.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509_vfy.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509_vfy.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509_vfy.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509_vfy.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+x509_vfy.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+x509_vfy.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 x509_vfy.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
 x509_vfy.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
 x509_vfy.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 x509_vfy.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509_vfy.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509_vfy.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-x509_vfy.o: ../cryptlib.h
+x509_vfy.o: ../../include/openssl/x509v3.h ../cryptlib.h
 x509name.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509name.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509name.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -380,6 +419,24 @@ x509rset.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 x509rset.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 x509rset.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 x509rset.o: ../cryptlib.h
+x509spki.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+x509spki.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+x509spki.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+x509spki.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+x509spki.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x509spki.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x509spki.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x509spki.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x509spki.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+x509spki.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+x509spki.o: ../../include/openssl/opensslconf.h
+x509spki.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+x509spki.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+x509spki.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+x509spki.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+x509spki.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+x509spki.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+x509spki.o: ../cryptlib.h
 x509type.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 x509type.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 x509type.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
diff --git a/src/lib/libssl/src/crypto/x509/by_dir.c b/src/lib/libssl/src/crypto/x509/by_dir.c
index 734e39ac77..14d12c56bd 100644
--- a/src/lib/libssl/src/crypto/x509/by_dir.c
+++ b/src/lib/libssl/src/crypto/x509/by_dir.c
@@ -59,10 +59,18 @@
 #include <stdio.h>
 #include <time.h>
 #include <errno.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifdef MAC_OS_pre_X
+# include <stat.h>
+#else
+# include <sys/stat.h>
+#endif
+
 #include <openssl/lhash.h>
 #include <openssl/x509.h>
 
@@ -210,9 +218,9 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
                                 memcpy(ip,ctx->dirs_type,(ctx->num_dirs_alloced-10)*
                                         sizeof(int));
                                 if (ctx->dirs != NULL)
-                                        Free((char *)ctx->dirs);
+                                        Free(ctx->dirs);
                                 if (ctx->dirs_type != NULL)
-                                        Free((char *)ctx->dirs_type);
+                                        Free(ctx->dirs_type);
                                 ctx->dirs=pp;
                                 ctx->dirs_type=ip;
                                 }
@@ -318,8 +326,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                 /* we have added it to the cache so now pull
                  * it out again */
                 CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
-                tmp=(X509_OBJECT *)lh_retrieve(xl->store_ctx->certs,
-                        (char *)&stmp);
+                tmp=(X509_OBJECT *)lh_retrieve(xl->store_ctx->certs,&stmp);
                 CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
 
                 if (tmp != NULL)
diff --git a/src/lib/libssl/src/crypto/x509/by_file.c b/src/lib/libssl/src/crypto/x509/by_file.c
index 00ee5e8bbc..78e9240a8d 100644
--- a/src/lib/libssl/src/crypto/x509/by_file.c
+++ b/src/lib/libssl/src/crypto/x509/by_file.c
@@ -59,8 +59,6 @@
 #include <stdio.h>
 #include <time.h>
 #include <errno.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
 #include "cryptlib.h"
 #include <openssl/lhash.h>
@@ -94,7 +92,7 @@ X509_LOOKUP_METHOD *X509_LOOKUP_file(void)
 static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
              char **ret)
         {
-        int ok=0,ok2=0;
+        int ok=0;
         char *file;
 
         switch (cmd)
@@ -102,31 +100,30 @@ static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
         case X509_L_FILE_LOAD:
                 if (argl == X509_FILETYPE_DEFAULT)
                         {
-                        ok=X509_load_cert_file(ctx,X509_get_default_cert_file(),
-                                X509_FILETYPE_PEM);
-                        ok2=X509_load_crl_file(ctx,X509_get_default_cert_file(),
-                                X509_FILETYPE_PEM);
-                        if (!ok || !ok2)
+                        ok = (X509_load_cert_crl_file(ctx,X509_get_default_cert_file(),
+                                X509_FILETYPE_PEM) != 0);
+                        if (!ok)
                                 {
                                 X509err(X509_F_BY_FILE_CTRL,X509_R_LOADING_DEFAULTS);
                                 }
                         else
                                 {
                                 file=(char *)Getenv(X509_get_default_cert_file_env());
-                                ok=X509_load_cert_file(ctx,file,
-                                        X509_FILETYPE_PEM);
-                                ok2=X509_load_crl_file(ctx,file,
-                                        X509_FILETYPE_PEM);
+                                ok = (X509_load_cert_crl_file(ctx,file,
+                                        X509_FILETYPE_PEM) != 0);
                                 }
                         }
                 else
                         {
-                        ok=X509_load_cert_file(ctx,argp,(int)argl);
-                        ok2=X509_load_crl_file(ctx,argp,(int)argl);
+                        if(argl == X509_FILETYPE_PEM)
+                                ok = (X509_load_cert_crl_file(ctx,argp,
+                                        X509_FILETYPE_PEM) != 0);
+                        else
+                                ok = (X509_load_cert_file(ctx,argp,(int)argl) != 0);
                         }
                 break;
                 }
-        return((ok && ok2)?ok:0);
+        return(ok);
         }
 
 int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type)
@@ -149,7 +146,7 @@ int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type)
                 {
                 for (;;)
                         {
-                        x=PEM_read_bio_X509(in,NULL,NULL,NULL);
+                        x=PEM_read_bio_X509_AUX(in,NULL,NULL,NULL);
                         if (x == NULL)
                                 {
                                 if ((ERR_GET_REASON(ERR_peek_error()) ==
@@ -263,5 +260,39 @@ err:
         return(ret);
         }
 
+int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type)
+{
+        STACK_OF(X509_INFO) *inf;
+        X509_INFO *itmp;
+        BIO *in;
+        int i, count = 0;
+        if(type != X509_FILETYPE_PEM)
+                return X509_load_cert_file(ctx, file, type);
+        in = BIO_new_file(file, "r");
+        if(!in) {
+                X509err(X509_F_X509_LOAD_CERT_CRL_FILE,ERR_R_SYS_LIB);
+                return 0;
+        }
+        inf = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
+        BIO_free(in);
+        if(!inf) {
+                X509err(X509_F_X509_LOAD_CERT_CRL_FILE,ERR_R_PEM_LIB);
+                return 0;
+        }
+        for(i = 0; i < sk_X509_INFO_num(inf); i++) {
+                itmp = sk_X509_INFO_value(inf, i);
+                if(itmp->x509) {
+                        X509_STORE_add_cert(ctx->store_ctx, itmp->x509);
+                        count++;
+                } else if(itmp->crl) {
+                        X509_STORE_add_crl(ctx->store_ctx, itmp->crl);
+                        count++;
+                }
+        }
+        sk_X509_INFO_pop_free(inf, X509_INFO_free);
+        return count;
+}
+
+
 #endif /* NO_STDIO */
 
diff --git a/src/lib/libssl/src/crypto/x509/x509.h b/src/lib/libssl/src/crypto/x509/x509.h
index 35f9484f8b..d3336d9ceb 100644
--- a/src/lib/libssl/src/crypto/x509/x509.h
+++ b/src/lib/libssl/src/crypto/x509/x509.h
@@ -176,9 +176,8 @@ typedef struct X509_extension_st
         short critical;
         short netscape_hack;
         ASN1_OCTET_STRING *value;
-        long argl;                      /* used when decoding */
-        char *argp;                     /* used when decoding */
-        void (*ex_free)();              /* clear argp stuff */
+        struct v3_ext_method *method;   /* V3 method to use */
+        void *ext_val;                  /* extension value */
         } X509_EXTENSION;
 
 DECLARE_STACK_OF(X509_EXTENSION)
@@ -231,6 +230,21 @@ typedef struct x509_cinf_st
         STACK_OF(X509_EXTENSION) *extensions;   /* [ 3 ] optional in v3 */
         } X509_CINF;
 
+/* This stuff is certificate "auxiliary info"
+ * it contains details which are useful in certificate
+ * stores and databases. When used this is tagged onto
+ * the end of the certificate itself
+ */
+
+typedef struct x509_cert_aux_st
+        {
+        STACK_OF(ASN1_OBJECT) *trust;           /* trusted uses */
+        STACK_OF(ASN1_OBJECT) *reject;          /* rejected uses */
+        ASN1_UTF8STRING *alias;                 /* "friendly name" */
+        ASN1_OCTET_STRING *keyid;               /* key id of private key */
+        STACK_OF(X509_ALGOR) *other;            /* other unspecified info */
+        } X509_CERT_AUX;
+
 typedef struct x509_st
         {
         X509_CINF *cert_info;
@@ -239,11 +253,58 @@ typedef struct x509_st
         int valid;
         int references;
         char *name;
+        CRYPTO_EX_DATA ex_data;
+        /* These contain copies of various extension values */
+        long ex_pathlen;
+        unsigned long ex_flags;
+        unsigned long ex_kusage;
+        unsigned long ex_xkusage;
+        unsigned long ex_nscert;
+#ifndef NO_SHA
+        unsigned char sha1_hash[SHA_DIGEST_LENGTH];
+#endif
+        X509_CERT_AUX *aux;
         } X509;
 
 DECLARE_STACK_OF(X509)
 DECLARE_ASN1_SET_OF(X509)
 
+/* This is used for a table of trust checking functions */
+
+typedef struct x509_trust_st {
+        int trust;
+        int flags;
+        int (*check_trust)(struct x509_trust_st *, X509 *, int);
+        char *name;
+        int arg1;
+        void *arg2;
+} X509_TRUST;
+
+DECLARE_STACK_OF(X509_TRUST)
+
+/* standard trust ids */
+
+#define X509_TRUST_ANY          1
+#define X509_TRUST_SSL_CLIENT   2
+#define X509_TRUST_SSL_SERVER   3
+#define X509_TRUST_EMAIL        4
+#define X509_TRUST_OBJECT_SIGN  5
+
+/* Keep these up to date! */
+#define X509_TRUST_MIN          1
+#define X509_TRUST_MAX          5
+
+
+/* trust_flags values */
+#define X509_TRUST_DYNAMIC      1
+#define X509_TRUST_DYNAMIC_NAME 2
+
+/* check_trust return codes */
+
+#define X509_TRUST_TRUSTED      1
+#define X509_TRUST_REJECTED     2
+#define X509_TRUST_UNTRUSTED    3
+
 typedef struct X509_revoked_st
         {
         ASN1_INTEGER *serialNumber;
@@ -318,7 +379,7 @@ DECLARE_STACK_OF(X509_INFO)
 
 /* The next 2 structures and their 8 routines were sent to me by
  * Pat Richard <patr@x509.com> and are used to manipulate
- * Netscapes spki strucutres - usefull if you are writing a CA web page
+ * Netscapes spki structures - useful if you are writing a CA web page
  */
 typedef struct Netscape_spkac_st
         {
@@ -372,8 +433,10 @@ X509_ALGOR *prf;
 typedef struct pkcs8_priv_key_info_st
         {
         int broken;     /* Flag for various broken formats */
-#define PKCS8_OK        0
-#define PKCS8_NO_OCTET  1
+#define PKCS8_OK                0
+#define PKCS8_NO_OCTET          1
+#define PKCS8_EMBEDDED_PARAM    2
+#define PKCS8_NS_DB             3
         ASN1_INTEGER *version;
         X509_ALGOR *pkeyalg;
         ASN1_TYPE *pkey; /* Should be OCTET STRING but some are broken */
@@ -552,13 +615,20 @@ int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r);
 int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r);
 int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r);
 
+NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(const char *str, int len);
+char * NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *x);
+EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x);
+int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey);
+
+int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki);
+
 int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
 int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
 int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md);
 
-int X509_digest(X509 *data,EVP_MD *type,unsigned char *md,unsigned int *len);
-int X509_NAME_digest(X509_NAME *data,EVP_MD *type,
+int X509_digest(X509 *data,const EVP_MD *type,unsigned char *md,unsigned int *len);
+int X509_NAME_digest(X509_NAME *data,const EVP_MD *type,
         unsigned char *md,unsigned int *len);
 #endif
 
@@ -574,16 +644,23 @@ RSA *d2i_RSAPrivateKey_fp(FILE *fp,RSA **rsa);
 int i2d_RSAPrivateKey_fp(FILE *fp,RSA *rsa);
 RSA *d2i_RSAPublicKey_fp(FILE *fp,RSA **rsa);
 int i2d_RSAPublicKey_fp(FILE *fp,RSA *rsa);
+RSA *d2i_RSA_PUBKEY_fp(FILE *fp,RSA **rsa);
+int i2d_RSA_PUBKEY_fp(FILE *fp,RSA *rsa);
 #endif
 #ifndef NO_DSA
+DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa);
+int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa);
 DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa);
 int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa);
+#endif
 X509_SIG *d2i_PKCS8_fp(FILE *fp,X509_SIG **p8);
 int i2d_PKCS8_fp(FILE *fp,X509_SIG *p8);
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,
                                                 PKCS8_PRIV_KEY_INFO **p8inf);
 int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,PKCS8_PRIV_KEY_INFO *p8inf);
-#endif
+int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key);
+int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey);
+EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a);
 #endif
 
 #ifdef HEADER_BIO_H
@@ -598,8 +675,12 @@ RSA *d2i_RSAPrivateKey_bio(BIO *bp,RSA **rsa);
 int i2d_RSAPrivateKey_bio(BIO *bp,RSA *rsa);
 RSA *d2i_RSAPublicKey_bio(BIO *bp,RSA **rsa);
 int i2d_RSAPublicKey_bio(BIO *bp,RSA *rsa);
+RSA *d2i_RSA_PUBKEY_bio(BIO *bp,RSA **rsa);
+int i2d_RSA_PUBKEY_bio(BIO *bp,RSA *rsa);
 #endif
 #ifndef NO_DSA
+DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa);
+int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa);
 DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa);
 int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa);
 #endif
@@ -608,6 +689,9 @@ int i2d_PKCS8_bio(BIO *bp,X509_SIG *p8);
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
                                                 PKCS8_PRIV_KEY_INFO **p8inf);
 int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,PKCS8_PRIV_KEY_INFO *p8inf);
+int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key);
+int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey);
+EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a);
 #endif
 
 X509 *X509_dup(X509 *x509);
@@ -635,7 +719,7 @@ const char *	X509_get_default_cert_dir_env(void );
 const char *    X509_get_default_cert_file_env(void );
 const char *    X509_get_default_private_dir(void );
 
-X509_REQ *      X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md);
+X509_REQ *      X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
 X509 *          X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey);
 void ERR_load_X509_strings(void );
 
@@ -660,7 +744,19 @@ int		X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey);
 EVP_PKEY *      X509_PUBKEY_get(X509_PUBKEY *key);
 int             X509_get_pubkey_parameters(EVP_PKEY *pkey,
                                            STACK_OF(X509) *chain);
-
+int             i2d_PUBKEY(EVP_PKEY *a,unsigned char **pp);
+EVP_PKEY *      d2i_PUBKEY(EVP_PKEY **a,unsigned char **pp,
+                        long length);
+#ifndef NO_RSA
+int             i2d_RSA_PUBKEY(RSA *a,unsigned char **pp);
+RSA *           d2i_RSA_PUBKEY(RSA **a,unsigned char **pp,
+                        long length);
+#endif
+#ifndef NO_DSA
+int             i2d_DSA_PUBKEY(DSA *a,unsigned char **pp);
+DSA *           d2i_DSA_PUBKEY(DSA **a,unsigned char **pp,
+                        long length);
+#endif
 
 X509_SIG *      X509_SIG_new(void );
 void            X509_SIG_free(X509_SIG *a);
@@ -714,6 +810,25 @@ X509 *		X509_new(void);
 void            X509_free(X509 *a);
 int             i2d_X509(X509 *a,unsigned char **pp);
 X509 *          d2i_X509(X509 **a,unsigned char **pp,long length);
+int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int X509_set_ex_data(X509 *r, int idx, void *arg);
+void *X509_get_ex_data(X509 *r, int idx);
+int             i2d_X509_AUX(X509 *a,unsigned char **pp);
+X509 *          d2i_X509_AUX(X509 **a,unsigned char **pp,long length);
+
+X509_CERT_AUX * X509_CERT_AUX_new(void);
+void            X509_CERT_AUX_free(X509_CERT_AUX *a);
+int             i2d_X509_CERT_AUX(X509_CERT_AUX *a,unsigned char **pp);
+X509_CERT_AUX * d2i_X509_CERT_AUX(X509_CERT_AUX **a,unsigned char **pp,
+                                                                long length);
+int X509_alias_set1(X509 *x, unsigned char *name, int len);
+unsigned char * X509_alias_get0(X509 *x, int *len);
+int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int);
+int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj);
+int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj);
+void X509_trust_clear(X509 *x);
+void X509_reject_clear(X509 *x);
 
 X509_REVOKED *  X509_REVOKED_new(void);
 void            X509_REVOKED_free(X509_REVOKED *a);
@@ -762,7 +877,7 @@ char *		X509_NAME_oneline(X509_NAME *a,char *buf,int size);
 int ASN1_verify(int (*i2d)(), X509_ALGOR *algor1,
         ASN1_BIT_STRING *signature,char *data,EVP_PKEY *pkey);
 
-int ASN1_digest(int (*i2d)(),EVP_MD *type,char *data,
+int ASN1_digest(int (*i2d)(),const EVP_MD *type,char *data,
         unsigned char *md,unsigned int *len);
 
 int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
@@ -787,6 +902,30 @@ int		X509_REQ_set_version(X509_REQ *x,long version);
 int             X509_REQ_set_subject_name(X509_REQ *req,X509_NAME *name);
 int             X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey);
 EVP_PKEY *      X509_REQ_get_pubkey(X509_REQ *req);
+int             X509_REQ_extension_nid(int nid);
+int *           X509_REQ_get_extension_nids(void);
+void            X509_REQ_set_extension_nids(int *nids);
+STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req);
+int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
+                                int nid);
+int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts);
+int X509_REQ_get_attr_count(const X509_REQ *req);
+int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
+                          int lastpos);
+int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,
+                          int lastpos);
+X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc);
+X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc);
+int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr);
+int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len);
+int X509_REQ_add1_attr_by_NID(X509_REQ *req,
+                        int nid, int type,
+                        unsigned char *bytes, int len);
+int X509_REQ_add1_attr_by_txt(X509_REQ *req,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len);
 
 int             X509_check_private_key(X509 *x509,EVP_PKEY *pkey);
 
@@ -799,6 +938,7 @@ unsigned long	X509_issuer_name_hash(X509 *a);
 int             X509_subject_name_cmp(X509 *a,X509 *b);
 unsigned long   X509_subject_name_hash(X509 *x);
 
+int             X509_cmp (X509 *a, X509 *b);
 int             X509_NAME_cmp (X509_NAME *a, X509_NAME *b);
 unsigned long   X509_NAME_hash(X509_NAME *x);
 
@@ -812,6 +952,7 @@ int		X509_REQ_print_fp(FILE *bp,X509_REQ *req);
 #ifdef HEADER_BIO_H
 int             X509_NAME_print(BIO *bp, X509_NAME *name, int obase);
 int             X509_print(BIO *bp,X509 *x);
+int             X509_CERT_AUX_print(BIO *bp,X509_CERT_AUX *x, int indent);
 int             X509_CRL_print(BIO *bp,X509_CRL *x);
 int             X509_REQ_print(BIO *bp,X509_REQ *req);
 #endif
@@ -823,7 +964,7 @@ int		X509_NAME_get_text_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj,
                         char *buf,int len);
 
 /* NOTE: you should be passsing -1, not 0 as lastpos.  The functions that use
- * lastpos, seach after that position on. */
+ * lastpos, search after that position on. */
 int             X509_NAME_get_index_by_NID(X509_NAME *name,int nid,int lastpos);
 int             X509_NAME_get_index_by_OBJ(X509_NAME *name,ASN1_OBJECT *obj,
                         int lastpos);
@@ -831,8 +972,16 @@ X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc);
 X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc);
 int             X509_NAME_add_entry(X509_NAME *name,X509_NAME_ENTRY *ne,
                         int loc, int set);
+int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len, int loc, int set);
+int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
+                        unsigned char *bytes, int len, int loc, int set);
+X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
+                char *field, int type, unsigned char *bytes, int len);
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
                         int type,unsigned char *bytes, int len);
+int X509_NAME_add_entry_by_txt(X509_NAME *name, char *field, int type,
+                        unsigned char *bytes, int len, int loc, int set);
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
                         ASN1_OBJECT *obj, int type,unsigned char *bytes,
                         int len);
@@ -862,6 +1011,7 @@ int		X509_get_ext_by_critical(X509 *x, int crit, int lastpos);
 X509_EXTENSION *X509_get_ext(X509 *x, int loc);
 X509_EXTENSION *X509_delete_ext(X509 *x, int loc);
 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
+void    *       X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx);
 
 int             X509_CRL_get_ext_count(X509_CRL *x);
 int             X509_CRL_get_ext_by_NID(X509_CRL *x, int nid, int lastpos);
@@ -870,6 +1020,7 @@ int		X509_CRL_get_ext_by_critical(X509_CRL *x, int crit, int lastpos);
 X509_EXTENSION *X509_CRL_get_ext(X509_CRL *x, int loc);
 X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc);
 int             X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc);
+void    *       X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx);
 
 int             X509_REVOKED_get_ext_count(X509_REVOKED *x);
 int             X509_REVOKED_get_ext_by_NID(X509_REVOKED *x, int nid, int lastpos);
@@ -878,6 +1029,7 @@ int		X509_REVOKED_get_ext_by_critical(X509_REVOKED *x, int crit, int lastpos);
 X509_EXTENSION *X509_REVOKED_get_ext(X509_REVOKED *x, int loc);
 X509_EXTENSION *X509_REVOKED_delete_ext(X509_REVOKED *x, int loc);
 int             X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc);
+void    *       X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx);
 
 X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
                         int nid, int crit, ASN1_OCTET_STRING *data);
@@ -891,6 +1043,38 @@ ASN1_OBJECT *	X509_EXTENSION_get_object(X509_EXTENSION *ex);
 ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ne);
 int             X509_EXTENSION_get_critical(X509_EXTENSION *ex);
 
+int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x);
+int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
+                          int lastpos);
+int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,
+                          int lastpos);
+X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc);
+X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc);
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
+                                         X509_ATTRIBUTE *attr);
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_OBJ(STACK_OF(X509_ATTRIBUTE) **x,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len);
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x,
+                        int nid, int type,
+                        unsigned char *bytes, int len);
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len);
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
+             int atrtype, void *data, int len);
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr,
+             ASN1_OBJECT *obj, int atrtype, void *data, int len);
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr,
+                char *atrname, int type, unsigned char *bytes, int len);
+int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, ASN1_OBJECT *obj);
+int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, void *data, int len);
+void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx,
+                                        int atrtype, void *data);
+int X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr);
+ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr);
+ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx);
+
 int             X509_verify_cert(X509_STORE_CTX *ctx);
 
 /* lookup a cert from a X509 STACK */
@@ -926,8 +1110,20 @@ void PKCS8_PRIV_KEY_INFO_free(PKCS8_PRIV_KEY_INFO *a);
 
 EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8);
 PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey);
+PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken);
 PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 
+int X509_check_trust(X509 *x, int id, int flags);
+int X509_TRUST_get_count(void);
+X509_TRUST * X509_TRUST_get0(int idx);
+int X509_TRUST_get_by_id(int id);
+int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
+                                        char *name, int arg1, void *arg2);
+void X509_TRUST_cleanup(void);
+int X509_TRUST_get_flags(X509_TRUST *xp);
+char *X509_TRUST_get0_name(X509_TRUST *xp);
+int X509_TRUST_get_trust(X509_TRUST *xp);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -940,15 +1136,25 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 #define X509_F_BY_FILE_CTRL                              101
 #define X509_F_DIR_CTRL                                  102
 #define X509_F_GET_CERT_BY_SUBJECT                       103
+#define X509_F_NETSCAPE_SPKI_B64_DECODE                  129
+#define X509_F_NETSCAPE_SPKI_B64_ENCODE                  130
 #define X509_F_X509V3_ADD_EXT                            104
+#define X509_F_X509_ADD_ATTR                             135
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_NID              136
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ              137
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_TXT              140
+#define X509_F_X509_ATTRIBUTE_GET0_DATA                  139
+#define X509_F_X509_ATTRIBUTE_SET1_DATA                  138
 #define X509_F_X509_CHECK_PRIVATE_KEY                    128
 #define X509_F_X509_EXTENSION_CREATE_BY_NID              108
 #define X509_F_X509_EXTENSION_CREATE_BY_OBJ              109
 #define X509_F_X509_GET_PUBKEY_PARAMETERS                110
+#define X509_F_X509_LOAD_CERT_CRL_FILE                   132
 #define X509_F_X509_LOAD_CERT_FILE                       111
 #define X509_F_X509_LOAD_CRL_FILE                        112
 #define X509_F_X509_NAME_ADD_ENTRY                       113
 #define X509_F_X509_NAME_ENTRY_CREATE_BY_NID             114
+#define X509_F_X509_NAME_ENTRY_CREATE_BY_TXT             131
 #define X509_F_X509_NAME_ENTRY_SET_OBJECT                115
 #define X509_F_X509_NAME_ONELINE                         116
 #define X509_F_X509_NAME_PRINT                           117
@@ -960,15 +1166,19 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 #define X509_F_X509_REQ_TO_X509                          123
 #define X509_F_X509_STORE_ADD_CERT                       124
 #define X509_F_X509_STORE_ADD_CRL                        125
+#define X509_F_X509_STORE_CTX_PURPOSE_INHERIT            134
 #define X509_F_X509_TO_X509_REQ                          126
+#define X509_F_X509_TRUST_ADD                            133
 #define X509_F_X509_VERIFY_CERT                          127
 
 /* Reason codes. */
 #define X509_R_BAD_X509_FILETYPE                         100
+#define X509_R_BASE64_DECODE_ERROR                       118
 #define X509_R_CANT_CHECK_DH_KEY                         114
 #define X509_R_CERT_ALREADY_IN_HASH_TABLE                101
 #define X509_R_ERR_ASN1_LIB                              102
 #define X509_R_INVALID_DIRECTORY                         113
+#define X509_R_INVALID_FIELD_NAME                        119
 #define X509_R_KEY_TYPE_MISMATCH                         115
 #define X509_R_KEY_VALUES_MISMATCH                       116
 #define X509_R_LOADING_CERT_DIR                          103
@@ -979,8 +1189,11 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 #define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY            108
 #define X509_R_UNKNOWN_KEY_TYPE                          117
 #define X509_R_UNKNOWN_NID                               109
+#define X509_R_UNKNOWN_PURPOSE_ID                        121
+#define X509_R_UNKNOWN_TRUST_ID                          120
 #define X509_R_UNSUPPORTED_ALGORITHM                     111
 #define X509_R_WRONG_LOOKUP_TYPE                         112
+#define X509_R_WRONG_TYPE                                122
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/x509/x509_att.c b/src/lib/libssl/src/crypto/x509/x509_att.c
new file mode 100644
index 0000000000..caafde658f
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509/x509_att.c
@@ -0,0 +1,326 @@
+/* crypto/x509/x509_att.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <openssl/stack.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x)
+{
+        if (!x) return 0;
+        return(sk_X509_ATTRIBUTE_num(x));
+}
+
+int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
+                          int lastpos)
+{
+        ASN1_OBJECT *obj;
+
+        obj=OBJ_nid2obj(nid);
+        if (obj == NULL) return(-2);
+        return(X509at_get_attr_by_OBJ(x,obj,lastpos));
+}
+
+int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,
+                          int lastpos)
+{
+        int n;
+        X509_ATTRIBUTE *ex;
+
+        if (sk == NULL) return(-1);
+        lastpos++;
+        if (lastpos < 0)
+                lastpos=0;
+        n=sk_X509_ATTRIBUTE_num(sk);
+        for ( ; lastpos < n; lastpos++)
+                {
+                ex=sk_X509_ATTRIBUTE_value(sk,lastpos);
+                if (OBJ_cmp(ex->object,obj) == 0)
+                        return(lastpos);
+                }
+        return(-1);
+}
+
+X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
+{
+        if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
+                return NULL;
+        else
+                return sk_X509_ATTRIBUTE_value(x,loc);
+}
+
+X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc)
+{
+        X509_ATTRIBUTE *ret;
+
+        if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
+                return(NULL);
+        ret=sk_X509_ATTRIBUTE_delete(x,loc);
+        return(ret);
+}
+
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
+                                         X509_ATTRIBUTE *attr)
+{
+        X509_ATTRIBUTE *new_attr=NULL;
+        STACK_OF(X509_ATTRIBUTE) *sk=NULL;
+
+        if ((x != NULL) && (*x == NULL))
+                {
+                if ((sk=sk_X509_ATTRIBUTE_new_null()) == NULL)
+                        goto err;
+                }
+        else
+                sk= *x;
+
+        if ((new_attr=X509_ATTRIBUTE_dup(attr)) == NULL)
+                goto err2;
+        if (!sk_X509_ATTRIBUTE_push(sk,new_attr))
+                goto err;
+        if ((x != NULL) && (*x == NULL))
+                *x=sk;
+        return(sk);
+err:
+        X509err(X509_F_X509_ADD_ATTR,ERR_R_MALLOC_FAILURE);
+err2:
+        if (new_attr != NULL) X509_ATTRIBUTE_free(new_attr);
+        if (sk != NULL) sk_X509_ATTRIBUTE_free(sk);
+        return(NULL);
+}
+
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_OBJ(STACK_OF(X509_ATTRIBUTE) **x,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *ret;
+        attr = X509_ATTRIBUTE_create_by_OBJ(NULL, obj, type, bytes, len);
+        if(!attr) return 0;
+        ret = X509at_add1_attr(x, attr);
+        X509_ATTRIBUTE_free(attr);
+        return ret;
+}
+
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x,
+                        int nid, int type,
+                        unsigned char *bytes, int len)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *ret;
+        attr = X509_ATTRIBUTE_create_by_NID(NULL, nid, type, bytes, len);
+        if(!attr) return 0;
+        ret = X509at_add1_attr(x, attr);
+        X509_ATTRIBUTE_free(attr);
+        return ret;
+}
+
+STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *ret;
+        attr = X509_ATTRIBUTE_create_by_txt(NULL, attrname, type, bytes, len);
+        if(!attr) return 0;
+        ret = X509at_add1_attr(x, attr);
+        X509_ATTRIBUTE_free(attr);
+        return ret;
+}
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
+             int atrtype, void *data, int len)
+{
+        ASN1_OBJECT *obj;
+        X509_ATTRIBUTE *ret;
+
+        obj=OBJ_nid2obj(nid);
+        if (obj == NULL)
+                {
+                X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_NID,X509_R_UNKNOWN_NID);
+                return(NULL);
+                }
+        ret=X509_ATTRIBUTE_create_by_OBJ(attr,obj,atrtype,data,len);
+        if (ret == NULL) ASN1_OBJECT_free(obj);
+        return(ret);
+}
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr,
+             ASN1_OBJECT *obj, int atrtype, void *data, int len)
+{
+        X509_ATTRIBUTE *ret;
+
+        if ((attr == NULL) || (*attr == NULL))
+                {
+                if ((ret=X509_ATTRIBUTE_new()) == NULL)
+                        {
+                        X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ,ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                }
+        else
+                ret= *attr;
+
+        if (!X509_ATTRIBUTE_set1_object(ret,obj))
+                goto err;
+        if (!X509_ATTRIBUTE_set1_data(ret,atrtype,data,len))
+                goto err;
+        
+        if ((attr != NULL) && (*attr == NULL)) *attr=ret;
+        return(ret);
+err:
+        if ((attr == NULL) || (ret != *attr))
+                X509_ATTRIBUTE_free(ret);
+        return(NULL);
+}
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr,
+                char *atrname, int type, unsigned char *bytes, int len)
+        {
+        ASN1_OBJECT *obj;
+        X509_ATTRIBUTE *nattr;
+
+        obj=OBJ_txt2obj(atrname, 0);
+        if (obj == NULL)
+                {
+                X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT,
+                                                X509_R_INVALID_FIELD_NAME);
+                ERR_add_error_data(2, "name=", atrname);
+                return(NULL);
+                }
+        nattr = X509_ATTRIBUTE_create_by_OBJ(attr,obj,type,bytes,len);
+        ASN1_OBJECT_free(obj);
+        return nattr;
+        }
+
+int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, ASN1_OBJECT *obj)
+{
+        if ((attr == NULL) || (obj == NULL))
+                return(0);
+        ASN1_OBJECT_free(attr->object);
+        attr->object=OBJ_dup(obj);
+        return(1);
+}
+
+int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, void *data, int len)
+{
+        ASN1_TYPE *ttmp;
+        ASN1_STRING *stmp;
+        int atype;
+        if (!attr) return 0;
+        if(attrtype & MBSTRING_FLAG) {
+                stmp = ASN1_STRING_set_by_NID(NULL, data, len, attrtype,
+                                                OBJ_obj2nid(attr->object));
+                if(!stmp) {
+                        X509err(X509_F_X509_ATTRIBUTE_SET1_DATA, ERR_R_ASN1_LIB);
+                        return 0;
+                }
+                atype = stmp->type;
+        } else {
+                if(!(stmp = ASN1_STRING_type_new(attrtype))) goto err;
+                if(!ASN1_STRING_set(stmp, data, len)) goto err;
+                atype = attrtype;
+        }
+        if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err;
+        if(!(ttmp = ASN1_TYPE_new())) goto err;
+        if(!sk_ASN1_TYPE_push(attr->value.set, ttmp)) goto err;
+        attr->set = 1;
+        ASN1_TYPE_set(ttmp, atype, stmp);
+        return 1;
+        err:
+        X509err(X509_F_X509_ATTRIBUTE_SET1_DATA, ERR_R_MALLOC_FAILURE);
+        return 0;
+}
+
+int X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr)
+{
+        if(attr->set) return sk_ASN1_TYPE_num(attr->value.set);
+        if(attr->value.single) return 1;
+        return 0;
+}
+
+ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr)
+{
+        if (attr == NULL) return(NULL);
+        return(attr->object);
+}
+
+void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx,
+                                        int atrtype, void *data)
+{
+        ASN1_TYPE *ttmp;
+        ttmp = X509_ATTRIBUTE_get0_type(attr, idx);
+        if(!ttmp) return NULL;
+        if(atrtype != ASN1_TYPE_get(ttmp)){
+                X509err(X509_F_X509_ATTRIBUTE_GET0_DATA, X509_R_WRONG_TYPE);
+                return NULL;
+        }
+        return ttmp->value.ptr;
+}
+
+ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx)
+{
+        if (attr == NULL) return(NULL);
+        if(idx >= X509_ATTRIBUTE_count(attr)) return NULL;
+        if(attr->set) return sk_ASN1_TYPE_value(attr->value.set, idx);
+        else return attr->value.single;
+}
diff --git a/src/lib/libssl/src/crypto/x509/x509_cmp.c b/src/lib/libssl/src/crypto/x509/x509_cmp.c
index 9a93bae3ff..a8a5ca8b03 100644
--- a/src/lib/libssl/src/crypto/x509/x509_cmp.c
+++ b/src/lib/libssl/src/crypto/x509/x509_cmp.c
@@ -57,12 +57,11 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 int X509_issuer_and_serial_cmp(X509 *a, X509 *b)
         {
@@ -71,7 +70,7 @@ int X509_issuer_and_serial_cmp(X509 *a, X509 *b)
 
         ai=a->cert_info;
         bi=b->cert_info;
-        i=ASN1_INTEGER_cmp(ai->serialNumber,bi->serialNumber);
+        i=M_ASN1_INTEGER_cmp(ai->serialNumber,bi->serialNumber);
         if (i) return(i);
         return(X509_NAME_cmp(ai->issuer,bi->issuer));
         }
@@ -138,6 +137,20 @@ unsigned long X509_subject_name_hash(X509 *x)
         return(X509_NAME_hash(x->cert_info->subject));
         }
 
+#ifndef NO_SHA
+/* Compare two certificates: they must be identical for
+ * this to work.
+ */
+int X509_cmp(X509 *a, X509 *b)
+{
+        /* ensure hash is valid */
+        X509_check_purpose(a, -1, 0);
+        X509_check_purpose(b, -1, 0);
+
+        return memcmp(a->sha1_hash, b->sha1_hash, SHA_DIGEST_LENGTH);
+}
+#endif
+
 int X509_NAME_cmp(X509_NAME *a, X509_NAME *b)
         {
         int i,j;
@@ -175,7 +188,7 @@ int X509_NAME_cmp(X509_NAME *a, X509_NAME *b)
 
 #ifndef NO_MD5
 /* I now DER encode the name and hash it.  Since I cache the DER encoding,
- * this is reasonably effiecent. */
+ * this is reasonably efficient. */
 unsigned long X509_NAME_hash(X509_NAME *x)
         {
         unsigned long ret=0;
@@ -209,6 +222,8 @@ X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk, X509_NAME *name,
         X509_CINF cinf;
         X509 x,*x509=NULL;
 
+        if(!sk) return NULL;
+
         x.cert_info= &cinf;
         cinf.serialNumber=serial;
         cinf.issuer=name;
diff --git a/src/lib/libssl/src/crypto/x509/x509_d2.c b/src/lib/libssl/src/crypto/x509/x509_d2.c
index 3e7ec5b432..753d53eb43 100644
--- a/src/lib/libssl/src/crypto/x509/x509_d2.c
+++ b/src/lib/libssl/src/crypto/x509/x509_d2.c
@@ -57,8 +57,6 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
@@ -91,13 +89,15 @@ int X509_STORE_load_locations(X509_STORE *ctx, const char *file,
                 {
                 lookup=X509_STORE_add_lookup(ctx,X509_LOOKUP_file());
                 if (lookup == NULL) return(0);
-                X509_LOOKUP_load_file(lookup,file,X509_FILETYPE_PEM);
+                if (X509_LOOKUP_load_file(lookup,file,X509_FILETYPE_PEM) != 1)
+                    return(0);
                 }
         if (path != NULL)
                 {
                 lookup=X509_STORE_add_lookup(ctx,X509_LOOKUP_hash_dir());
                 if (lookup == NULL) return(0);
-                X509_LOOKUP_add_dir(lookup,path,X509_FILETYPE_PEM);
+                if (X509_LOOKUP_add_dir(lookup,path,X509_FILETYPE_PEM) != 1)
+                    return(0);
                 }
         if ((path == NULL) && (file == NULL))
                 return(0);
diff --git a/src/lib/libssl/src/crypto/x509/x509_def.c b/src/lib/libssl/src/crypto/x509/x509_def.c
index c4bee71569..e0ac151a76 100644
--- a/src/lib/libssl/src/crypto/x509/x509_def.c
+++ b/src/lib/libssl/src/crypto/x509/x509_def.c
@@ -57,8 +57,6 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
diff --git a/src/lib/libssl/src/crypto/x509/x509_err.c b/src/lib/libssl/src/crypto/x509/x509_err.c
index 9afd4ccde5..fdedbdac34 100644
--- a/src/lib/libssl/src/crypto/x509/x509_err.c
+++ b/src/lib/libssl/src/crypto/x509/x509_err.c
@@ -69,15 +69,25 @@ static ERR_STRING_DATA X509_str_functs[]=
 {ERR_PACK(0,X509_F_BY_FILE_CTRL,0),     "BY_FILE_CTRL"},
 {ERR_PACK(0,X509_F_DIR_CTRL,0), "DIR_CTRL"},
 {ERR_PACK(0,X509_F_GET_CERT_BY_SUBJECT,0),      "GET_CERT_BY_SUBJECT"},
+{ERR_PACK(0,X509_F_NETSCAPE_SPKI_B64_DECODE,0), "NETSCAPE_SPKI_b64_decode"},
+{ERR_PACK(0,X509_F_NETSCAPE_SPKI_B64_ENCODE,0), "NETSCAPE_SPKI_b64_encode"},
 {ERR_PACK(0,X509_F_X509V3_ADD_EXT,0),   "X509v3_add_ext"},
+{ERR_PACK(0,X509_F_X509_ADD_ATTR,0),    "X509_ADD_ATTR"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_CREATE_BY_NID,0),     "X509_ATTRIBUTE_create_by_NID"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ,0),     "X509_ATTRIBUTE_create_by_OBJ"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_CREATE_BY_TXT,0),     "X509_ATTRIBUTE_create_by_txt"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_GET0_DATA,0), "X509_ATTRIBUTE_get0_data"},
+{ERR_PACK(0,X509_F_X509_ATTRIBUTE_SET1_DATA,0), "X509_ATTRIBUTE_set1_data"},
 {ERR_PACK(0,X509_F_X509_CHECK_PRIVATE_KEY,0),   "X509_check_private_key"},
 {ERR_PACK(0,X509_F_X509_EXTENSION_CREATE_BY_NID,0),     "X509_EXTENSION_create_by_NID"},
 {ERR_PACK(0,X509_F_X509_EXTENSION_CREATE_BY_OBJ,0),     "X509_EXTENSION_create_by_OBJ"},
 {ERR_PACK(0,X509_F_X509_GET_PUBKEY_PARAMETERS,0),       "X509_get_pubkey_parameters"},
+{ERR_PACK(0,X509_F_X509_LOAD_CERT_CRL_FILE,0),  "X509_load_cert_crl_file"},
 {ERR_PACK(0,X509_F_X509_LOAD_CERT_FILE,0),      "X509_load_cert_file"},
 {ERR_PACK(0,X509_F_X509_LOAD_CRL_FILE,0),       "X509_load_crl_file"},
 {ERR_PACK(0,X509_F_X509_NAME_ADD_ENTRY,0),      "X509_NAME_add_entry"},
 {ERR_PACK(0,X509_F_X509_NAME_ENTRY_CREATE_BY_NID,0),    "X509_NAME_ENTRY_create_by_NID"},
+{ERR_PACK(0,X509_F_X509_NAME_ENTRY_CREATE_BY_TXT,0),    "X509_NAME_ENTRY_create_by_txt"},
 {ERR_PACK(0,X509_F_X509_NAME_ENTRY_SET_OBJECT,0),       "X509_NAME_ENTRY_set_object"},
 {ERR_PACK(0,X509_F_X509_NAME_ONELINE,0),        "X509_NAME_oneline"},
 {ERR_PACK(0,X509_F_X509_NAME_PRINT,0),  "X509_NAME_print"},
@@ -89,7 +99,9 @@ static ERR_STRING_DATA X509_str_functs[]=
 {ERR_PACK(0,X509_F_X509_REQ_TO_X509,0), "X509_REQ_to_X509"},
 {ERR_PACK(0,X509_F_X509_STORE_ADD_CERT,0),      "X509_STORE_add_cert"},
 {ERR_PACK(0,X509_F_X509_STORE_ADD_CRL,0),       "X509_STORE_add_crl"},
+{ERR_PACK(0,X509_F_X509_STORE_CTX_PURPOSE_INHERIT,0),   "X509_STORE_CTX_purpose_inherit"},
 {ERR_PACK(0,X509_F_X509_TO_X509_REQ,0), "X509_to_X509_REQ"},
+{ERR_PACK(0,X509_F_X509_TRUST_ADD,0),   "X509_TRUST_add"},
 {ERR_PACK(0,X509_F_X509_VERIFY_CERT,0), "X509_verify_cert"},
 {0,NULL}
         };
@@ -97,10 +109,12 @@ static ERR_STRING_DATA X509_str_functs[]=
 static ERR_STRING_DATA X509_str_reasons[]=
         {
 {X509_R_BAD_X509_FILETYPE                ,"bad x509 filetype"},
+{X509_R_BASE64_DECODE_ERROR              ,"base64 decode error"},
 {X509_R_CANT_CHECK_DH_KEY                ,"cant check dh key"},
 {X509_R_CERT_ALREADY_IN_HASH_TABLE       ,"cert already in hash table"},
 {X509_R_ERR_ASN1_LIB                     ,"err asn1 lib"},
 {X509_R_INVALID_DIRECTORY                ,"invalid directory"},
+{X509_R_INVALID_FIELD_NAME               ,"invalid field name"},
 {X509_R_KEY_TYPE_MISMATCH                ,"key type mismatch"},
 {X509_R_KEY_VALUES_MISMATCH              ,"key values mismatch"},
 {X509_R_LOADING_CERT_DIR                 ,"loading cert dir"},
@@ -111,8 +125,11 @@ static ERR_STRING_DATA X509_str_reasons[]=
 {X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY   ,"unable to get certs public key"},
 {X509_R_UNKNOWN_KEY_TYPE                 ,"unknown key type"},
 {X509_R_UNKNOWN_NID                      ,"unknown nid"},
+{X509_R_UNKNOWN_PURPOSE_ID               ,"unknown purpose id"},
+{X509_R_UNKNOWN_TRUST_ID                 ,"unknown trust id"},
 {X509_R_UNSUPPORTED_ALGORITHM            ,"unsupported algorithm"},
 {X509_R_WRONG_LOOKUP_TYPE                ,"wrong lookup type"},
+{X509_R_WRONG_TYPE                       ,"wrong type"},
 {0,NULL}
         };
 
diff --git a/src/lib/libssl/src/crypto/x509/x509_ext.c b/src/lib/libssl/src/crypto/x509/x509_ext.c
index f8565a60b2..2955989807 100644
--- a/src/lib/libssl/src/crypto/x509/x509_ext.c
+++ b/src/lib/libssl/src/crypto/x509/x509_ext.c
@@ -63,6 +63,8 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
 
 int X509_CRL_get_ext_count(X509_CRL *x)
         {
@@ -94,6 +96,11 @@ X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc)
         return(X509v3_delete_ext(x->crl->extensions,loc));
         }
 
+void *X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx)
+{
+        return X509V3_get_d2i(x->crl->extensions, nid, crit, idx);
+}
+
 int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc)
         {
         return(X509v3_add_ext(&(x->crl->extensions),ex,loc) != NULL);
@@ -134,6 +141,11 @@ int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc)
         return(X509v3_add_ext(&(x->cert_info->extensions),ex,loc) != NULL);
         }
 
+void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
+{
+        return X509V3_get_d2i(x->cert_info->extensions, nid, crit, idx);
+}
+
 int X509_REVOKED_get_ext_count(X509_REVOKED *x)
         {
         return(X509v3_get_ext_count(x->extensions));
@@ -170,5 +182,10 @@ int X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc)
         return(X509v3_add_ext(&(x->extensions),ex,loc) != NULL);
         }
 
+void *X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx)
+{
+        return X509V3_get_d2i(x->extensions, nid, crit, idx);
+}
+
 IMPLEMENT_STACK_OF(X509_EXTENSION)
 IMPLEMENT_ASN1_SET_OF(X509_EXTENSION)
diff --git a/src/lib/libssl/src/crypto/x509/x509_lu.c b/src/lib/libssl/src/crypto/x509/x509_lu.c
index 18bfecb11e..a20006d67e 100644
--- a/src/lib/libssl/src/crypto/x509/x509_lu.c
+++ b/src/lib/libssl/src/crypto/x509/x509_lu.c
@@ -61,8 +61,8 @@
 #include <openssl/lhash.h>
 #include <openssl/x509.h>
 
-static STACK *x509_store_meth=NULL;
-static STACK *x509_store_ctx_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_store_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_store_ctx_meth=NULL;
 
 X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method)
         {
@@ -244,7 +244,7 @@ void X509_STORE_free(X509_STORE *vfy)
                 }
         sk_X509_LOOKUP_free(sk);
 
-        CRYPTO_free_ex_data(x509_store_meth,(char *)vfy,&vfy->ex_data);
+        CRYPTO_free_ex_data(x509_store_meth,vfy,&vfy->ex_data);
         lh_doall(vfy->certs,cleanup);
         lh_free(vfy->certs);
         Free(vfy);
@@ -377,10 +377,24 @@ X509_OBJECT *X509_OBJECT_retrieve_by_subject(LHASH *h, int type,
                 abort();
                 }
 
-        tmp=(X509_OBJECT *)lh_retrieve(h,(char *)&stmp);
+        tmp=(X509_OBJECT *)lh_retrieve(h,&stmp);
         return(tmp);
         }
 
+X509_STORE_CTX *X509_STORE_CTX_new(void)
+{
+        X509_STORE_CTX *ctx;
+        ctx = (X509_STORE_CTX *)Malloc(sizeof(X509_STORE_CTX));
+        if(ctx) memset(ctx, 0, sizeof(X509_STORE_CTX));
+        return ctx;
+}
+
+void X509_STORE_CTX_free(X509_STORE_CTX *ctx)
+{
+        X509_STORE_CTX_cleanup(ctx);
+        Free(ctx);
+}
+
 void X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
              STACK_OF(X509) *chain)
         {
@@ -389,6 +403,8 @@ void X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
         ctx->cert=x509;
         ctx->untrusted=chain;
         ctx->last_untrusted=0;
+        ctx->purpose=0;
+        ctx->trust=0;
         ctx->valid=0;
         ctx->chain=NULL;
         ctx->depth=9;
@@ -404,7 +420,7 @@ void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
                 sk_X509_pop_free(ctx->chain,X509_free);
                 ctx->chain=NULL;
                 }
-        CRYPTO_free_ex_data(x509_store_ctx_meth,(char *)ctx,&(ctx->ex_data));
+        CRYPTO_free_ex_data(x509_store_ctx_meth,ctx,&(ctx->ex_data));
         memset(&ctx->ex_data,0,sizeof(CRYPTO_EX_DATA));
         }
 
diff --git a/src/lib/libssl/src/crypto/x509/x509_r2x.c b/src/lib/libssl/src/crypto/x509/x509_r2x.c
index bb4697ae60..db051033d9 100644
--- a/src/lib/libssl/src/crypto/x509/x509_r2x.c
+++ b/src/lib/libssl/src/crypto/x509/x509_r2x.c
@@ -82,7 +82,7 @@ X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
 
         if (sk_X509_ATTRIBUTE_num(r->req_info->attributes) != 0)
                 {
-                if ((xi->version=ASN1_INTEGER_new()) == NULL) goto err;
+                if ((xi->version=M_ASN1_INTEGER_new()) == NULL) goto err;
                 if (!ASN1_INTEGER_set(xi->version,2)) goto err;
 /*              xi->extensions=ri->attributes; <- bad, should not ever be done
                 ri->attributes=NULL; */
diff --git a/src/lib/libssl/src/crypto/x509/x509_req.c b/src/lib/libssl/src/crypto/x509/x509_req.c
index 2ef94decd1..baef8790eb 100644
--- a/src/lib/libssl/src/crypto/x509/x509_req.c
+++ b/src/lib/libssl/src/crypto/x509/x509_req.c
@@ -66,7 +66,7 @@
 #include <openssl/buffer.h>
 #include <openssl/pem.h>
 
-X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md)
+X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
         {
         X509_REQ *ret;
         X509_REQ_INFO *ri;
@@ -113,3 +113,166 @@ EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
         return(X509_PUBKEY_get(req->req_info->pubkey));
         }
 
+/* It seems several organisations had the same idea of including a list of
+ * extensions in a certificate request. There are at least two OIDs that are
+ * used and there may be more: so the list is configurable.
+ */
+
+static int ext_nid_list[] = { NID_ms_ext_req, NID_ext_req, NID_undef};
+
+static int *ext_nids = ext_nid_list;
+
+int X509_REQ_extension_nid(int req_nid)
+{
+        int i, nid;
+        for(i = 0; ; i++) {
+                nid = ext_nids[i];
+                if(nid == NID_undef) return 0;
+                else if (req_nid == nid) return 1;
+        }
+}
+
+int *X509_REQ_get_extension_nids(void)
+{
+        return ext_nids;
+}
+        
+void X509_REQ_set_extension_nids(int *nids)
+{
+        ext_nids = nids;
+}
+
+STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *sk;
+        ASN1_TYPE *ext = NULL;
+        int i;
+        unsigned char *p;
+        if ((req == NULL) || (req->req_info == NULL))
+                return(NULL);
+        sk=req->req_info->attributes;
+        if (!sk) return NULL;
+        for(i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) {
+                attr = sk_X509_ATTRIBUTE_value(sk, i);
+                if(X509_REQ_extension_nid(OBJ_obj2nid(attr->object))) {
+                        if(attr->set && sk_ASN1_TYPE_num(attr->value.set))
+                                ext = sk_ASN1_TYPE_value(attr->value.set, 0);
+                        else ext = attr->value.single;
+                        break;
+                }
+        }
+        if(!ext || (ext->type != V_ASN1_SEQUENCE)) return NULL;
+        p = ext->value.sequence->data;
+        return d2i_ASN1_SET_OF_X509_EXTENSION(NULL, &p,
+                        ext->value.sequence->length,
+                        d2i_X509_EXTENSION, X509_EXTENSION_free,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+}
+
+/* Add a STACK_OF extensions to a certificate request: allow alternative OIDs
+ * in case we want to create a non standard one.
+ */
+
+int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
+                                int nid)
+{
+        unsigned char *p = NULL, *q;
+        long len;
+        ASN1_TYPE *at = NULL;
+        X509_ATTRIBUTE *attr = NULL;
+        if(!(at = ASN1_TYPE_new()) ||
+                !(at->value.sequence = ASN1_STRING_new())) goto err;
+
+        at->type = V_ASN1_SEQUENCE;
+        /* Generate encoding of extensions */
+        len = i2d_ASN1_SET_OF_X509_EXTENSION(exts, NULL, i2d_X509_EXTENSION,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        if(!(p = Malloc(len))) goto err;
+        q = p;
+        i2d_ASN1_SET_OF_X509_EXTENSION(exts, &q, i2d_X509_EXTENSION,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        at->value.sequence->data = p;
+        p = NULL;
+        at->value.sequence->length = len;
+        if(!(attr = X509_ATTRIBUTE_new())) goto err;
+        if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err;
+        if(!sk_ASN1_TYPE_push(attr->value.set, at)) goto err;
+        at = NULL;
+        attr->set = 1;
+        attr->object = OBJ_nid2obj(nid);
+        if(!sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr)) goto err;
+        return 1;
+        err:
+        if(p) Free(p);
+        X509_ATTRIBUTE_free(attr);
+        ASN1_TYPE_free(at);
+        return 0;
+}
+/* This is the normal usage: use the "official" OID */
+int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts)
+{
+        return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
+}
+
+/* Request attribute functions */
+
+int X509_REQ_get_attr_count(const X509_REQ *req)
+{
+        return X509at_get_attr_count(req->req_info->attributes);
+}
+
+int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
+                          int lastpos)
+{
+        return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
+}
+
+int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,
+                          int lastpos)
+{
+        return X509at_get_attr_by_OBJ(req->req_info->attributes, obj, lastpos);
+}
+
+X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
+{
+        return X509at_get_attr(req->req_info->attributes, loc);
+}
+
+X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)
+{
+        return X509at_delete_attr(req->req_info->attributes, loc);
+}
+
+int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
+{
+        if(X509at_add1_attr(&req->req_info->attributes, attr)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_OBJ(&req->req_info->attributes, obj,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_NID(X509_REQ *req,
+                        int nid, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_NID(&req->req_info->attributes, nid,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_txt(X509_REQ *req,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_txt(&req->req_info->attributes, attrname,
+                                type, bytes, len)) return 1;
+        return 0;
+}
diff --git a/src/lib/libssl/src/crypto/x509/x509_set.c b/src/lib/libssl/src/crypto/x509/x509_set.c
index 5a6f7b414f..add842d17a 100644
--- a/src/lib/libssl/src/crypto/x509/x509_set.c
+++ b/src/lib/libssl/src/crypto/x509/x509_set.c
@@ -68,7 +68,7 @@ int X509_set_version(X509 *x, long version)
         if (x == NULL) return(0);
         if (x->cert_info->version == NULL)
                 {
-                if ((x->cert_info->version=ASN1_INTEGER_new()) == NULL)
+                if ((x->cert_info->version=M_ASN1_INTEGER_new()) == NULL)
                         return(0);
                 }
         return(ASN1_INTEGER_set(x->cert_info->version,version));
@@ -82,10 +82,10 @@ int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial)
         in=x->cert_info->serialNumber;
         if (in != serial)
                 {
-                in=ASN1_INTEGER_dup(serial);
+                in=M_ASN1_INTEGER_dup(serial);
                 if (in != NULL)
                         {
-                        ASN1_INTEGER_free(x->cert_info->serialNumber);
+                        M_ASN1_INTEGER_free(x->cert_info->serialNumber);
                         x->cert_info->serialNumber=in;
                         }
                 }
@@ -112,10 +112,10 @@ int X509_set_notBefore(X509 *x, ASN1_UTCTIME *tm)
         in=x->cert_info->validity->notBefore;
         if (in != tm)
                 {
-                in=ASN1_UTCTIME_dup(tm);
+                in=M_ASN1_UTCTIME_dup(tm);
                 if (in != NULL)
                         {
-                        ASN1_UTCTIME_free(x->cert_info->validity->notBefore);
+                        M_ASN1_UTCTIME_free(x->cert_info->validity->notBefore);
                         x->cert_info->validity->notBefore=in;
                         }
                 }
@@ -130,10 +130,10 @@ int X509_set_notAfter(X509 *x, ASN1_UTCTIME *tm)
         in=x->cert_info->validity->notAfter;
         if (in != tm)
                 {
-                in=ASN1_UTCTIME_dup(tm);
+                in=M_ASN1_UTCTIME_dup(tm);
                 if (in != NULL)
                         {
-                        ASN1_UTCTIME_free(x->cert_info->validity->notAfter);
+                        M_ASN1_UTCTIME_free(x->cert_info->validity->notAfter);
                         x->cert_info->validity->notAfter=in;
                         }
                 }
diff --git a/src/lib/libssl/src/crypto/x509/x509_trs.c b/src/lib/libssl/src/crypto/x509/x509_trs.c
new file mode 100644
index 0000000000..9f7d67952d
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509/x509_trs.c
@@ -0,0 +1,263 @@
+/* x509_trs.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509v3.h>
+
+
+static int tr_cmp(X509_TRUST **a, X509_TRUST **b);
+static void trtable_free(X509_TRUST *p);
+
+static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
+static int trust_any(X509_TRUST *trust, X509 *x, int flags);
+
+static int obj_trust(int id, X509 *x, int flags);
+static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;
+
+/* WARNING: the following table should be kept in order of trust
+ * and without any gaps so we can just subtract the minimum trust
+ * value to get an index into the table
+ */
+
+static X509_TRUST trstandard[] = {
+{X509_TRUST_ANY, 0, trust_any, "Any", 0, NULL},
+{X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
+{X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Client", NID_server_auth, NULL},
+{X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
+};
+
+#define X509_TRUST_COUNT        (sizeof(trstandard)/sizeof(X509_TRUST))
+
+IMPLEMENT_STACK_OF(X509_TRUST)
+
+static STACK_OF(X509_TRUST) *trtable = NULL;
+
+static int tr_cmp(X509_TRUST **a, X509_TRUST **b)
+{
+        return (*a)->trust - (*b)->trust;
+}
+
+int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
+{
+int (*oldtrust)(int , X509 *, int);
+oldtrust = default_trust;
+default_trust = trust;
+return oldtrust;
+}
+
+
+int X509_check_trust(X509 *x, int id, int flags)
+{
+        X509_TRUST *pt;
+        int idx;
+        if(id == -1) return 1;
+        if(!(idx = X509_TRUST_get_by_id(id)))
+                        return default_trust(id, x, flags);
+        pt = X509_TRUST_get0(idx);
+        return pt->check_trust(pt, x, flags);
+}
+
+int X509_TRUST_get_count(void)
+{
+        if(!trtable) return X509_TRUST_COUNT;
+        return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
+}
+
+X509_TRUST * X509_TRUST_get0(int idx)
+{
+        if(idx < 0) return NULL;
+        if(idx < X509_TRUST_COUNT) return trstandard + idx;
+        return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
+}
+
+int X509_TRUST_get_by_id(int id)
+{
+        X509_TRUST tmp;
+        int idx;
+        if((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
+                                 return id - X509_TRUST_MIN;
+        tmp.trust = id;
+        if(!trtable) return -1;
+        idx = sk_X509_TRUST_find(trtable, &tmp);
+        if(idx == -1) return -1;
+        return idx + X509_TRUST_COUNT;
+}
+
+int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
+                                        char *name, int arg1, void *arg2)
+{
+        int idx;
+        X509_TRUST *trtmp;
+        /* This is set according to what we change: application can't set it */
+        flags &= ~X509_TRUST_DYNAMIC;
+        /* This will always be set for application modified trust entries */
+        flags |= X509_TRUST_DYNAMIC_NAME;
+        /* Get existing entry if any */
+        idx = X509_TRUST_get_by_id(id);
+        /* Need a new entry */
+        if(idx == -1) {
+                if(!(trtmp = Malloc(sizeof(X509_TRUST)))) {
+                        X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                trtmp->flags = X509_TRUST_DYNAMIC;
+        } else trtmp = X509_TRUST_get0(idx);
+
+        /* Free existing name if dynamic */
+        if(trtmp->flags & X509_TRUST_DYNAMIC_NAME) Free(trtmp->name);
+        /* dup supplied name */
+        if(!(trtmp->name = BUF_strdup(name))) {
+                X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        /* Keep the dynamic flag of existing entry */
+        trtmp->flags &= X509_TRUST_DYNAMIC;
+        /* Set all other flags */
+        trtmp->flags |= flags;
+
+        trtmp->trust = id;
+        trtmp->check_trust = ck;
+        trtmp->arg1 = arg1;
+        trtmp->arg2 = arg2;
+
+        /* If its a new entry manage the dynamic table */
+        if(idx == -1) {
+                if(!trtable && !(trtable = sk_X509_TRUST_new(tr_cmp))) {
+                        X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if (!sk_X509_TRUST_push(trtable, trtmp)) {
+                        X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+static void trtable_free(X509_TRUST *p)
+        {
+        if(!p) return;
+        if (p->flags & X509_TRUST_DYNAMIC) 
+                {
+                if (p->flags & X509_TRUST_DYNAMIC_NAME)
+                        Free(p->name);
+                Free(p);
+                }
+        }
+
+void X509_TRUST_cleanup(void)
+{
+        int i;
+        for(i = 0; i < X509_TRUST_COUNT; i++) trtable_free(trstandard + i);
+        sk_X509_TRUST_pop_free(trtable, trtable_free);
+        trtable = NULL;
+}
+
+int X509_TRUST_get_flags(X509_TRUST *xp)
+{
+        return xp->flags;
+}
+
+char *X509_TRUST_get0_name(X509_TRUST *xp)
+{
+        return xp->name;
+}
+
+int X509_TRUST_get_trust(X509_TRUST *xp)
+{
+        return xp->trust;
+}
+
+static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
+{
+        if(x->aux) return obj_trust(trust->arg1, x, flags);
+        /* we don't have any trust settings: for compatibility
+         * we return trusted if it is self signed
+         */
+        X509_check_purpose(x, -1, 0);
+        if(x->ex_flags & EXFLAG_SS) return X509_TRUST_TRUSTED;
+        else return X509_TRUST_UNTRUSTED;
+}
+
+static int obj_trust(int id, X509 *x, int flags)
+{
+        ASN1_OBJECT *obj;
+        int i;
+        X509_CERT_AUX *ax;
+        ax = x->aux;
+        if(!ax) return X509_TRUST_UNTRUSTED;
+        if(ax->reject) {
+                for(i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
+                        obj = sk_ASN1_OBJECT_value(ax->reject, i);
+                        if(OBJ_obj2nid(obj) == id) return X509_TRUST_REJECTED;
+                }
+        }       
+        if(ax->trust) {
+                for(i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
+                        obj = sk_ASN1_OBJECT_value(ax->trust, i);
+                        if(OBJ_obj2nid(obj) == id) return X509_TRUST_TRUSTED;
+                }
+        }
+        return X509_TRUST_UNTRUSTED;
+}
+
+static int trust_any(X509_TRUST *trust, X509 *x, int flags)
+{
+        return X509_TRUST_TRUSTED;
+}
diff --git a/src/lib/libssl/src/crypto/x509/x509_txt.c b/src/lib/libssl/src/crypto/x509/x509_txt.c
index 11a3d2012f..209cf53191 100644
--- a/src/lib/libssl/src/crypto/x509/x509_txt.c
+++ b/src/lib/libssl/src/crypto/x509/x509_txt.c
@@ -59,7 +59,6 @@
 #include <stdio.h>
 #include <time.h>
 #include <errno.h>
-#include <sys/types.h>
 
 #include "cryptlib.h"
 #include <openssl/lhash.h>
@@ -121,6 +120,16 @@ const char *X509_verify_cert_error_string(long n)
                 return("certificate chain too long");
         case X509_V_ERR_CERT_REVOKED:
                 return("certificate revoked");
+        case X509_V_ERR_INVALID_CA:
+                return ("invalid CA certificate");
+        case X509_V_ERR_PATH_LENGTH_EXCEEDED:
+                return ("path length constraint exceeded");
+        case X509_V_ERR_INVALID_PURPOSE:
+                return ("unsupported certificate purpose");
+        case X509_V_ERR_CERT_UNTRUSTED:
+                return ("certificate not trusted");
+        case X509_V_ERR_CERT_REJECTED:
+                return ("certificate rejected");
         case X509_V_ERR_APPLICATION_VERIFICATION:
                 return("application verification failure");
         default:
diff --git a/src/lib/libssl/src/crypto/x509/x509_v3.c b/src/lib/libssl/src/crypto/x509/x509_v3.c
index dd2f9f1b17..52887986fe 100644
--- a/src/lib/libssl/src/crypto/x509/x509_v3.c
+++ b/src/lib/libssl/src/crypto/x509/x509_v3.c
@@ -63,6 +63,7 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 int X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x)
         {
@@ -242,7 +243,7 @@ int X509_EXTENSION_set_data(X509_EXTENSION *ex, ASN1_OCTET_STRING *data)
         int i;
 
         if (ex == NULL) return(0);
-        i=ASN1_OCTET_STRING_set(ex->value,data->data,data->length);
+        i=M_ASN1_OCTET_STRING_set(ex->value,data->data,data->length);
         if (!i) return(0);
         return(1);
         }
diff --git a/src/lib/libssl/src/crypto/x509/x509_vfy.c b/src/lib/libssl/src/crypto/x509/x509_vfy.c
index c72ee4a385..4fdff54124 100644
--- a/src/lib/libssl/src/crypto/x509/x509_vfy.c
+++ b/src/lib/libssl/src/crypto/x509/x509_vfy.c
@@ -59,23 +59,24 @@
 #include <stdio.h>
 #include <time.h>
 #include <errno.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 
-#include <openssl/crypto.h>
 #include "cryptlib.h"
+#include <openssl/crypto.h>
 #include <openssl/lhash.h>
 #include <openssl/buffer.h>
 #include <openssl/evp.h>
 #include <openssl/asn1.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 #include <openssl/objects.h>
 
 static int null_callback(int ok,X509_STORE_CTX *e);
+static int check_chain_purpose(X509_STORE_CTX *ctx);
+static int check_trust(X509_STORE_CTX *ctx);
 static int internal_verify(X509_STORE_CTX *ctx);
 const char *X509_version="X.509" OPENSSL_VERSION_PTEXT;
 
-static STACK *x509_store_ctx_method=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_store_ctx_method=NULL;
 static int x509_store_ctx_num=0;
 #if 0
 static int x509_store_num=1;
@@ -127,7 +128,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                 ctx->last_untrusted=1;
                 }
 
-        /* We use a temporary so we can chop and hack at it */
+        /* We use a temporary STACK so we can chop and hack at it */
         if (ctx->untrusted != NULL
             && (sktmp=sk_X509_dup(ctx->untrusted)) == NULL)
                 {
@@ -184,17 +185,37 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
 
         i=sk_X509_num(ctx->chain);
         x=sk_X509_value(ctx->chain,i-1);
-        if (X509_NAME_cmp(X509_get_subject_name(x),X509_get_issuer_name(x))
+        xn = X509_get_subject_name(x);
+        if (X509_NAME_cmp(xn,X509_get_issuer_name(x))
                 == 0)
                 {
                 /* we have a self signed certificate */
                 if (sk_X509_num(ctx->chain) == 1)
                         {
-                        ctx->error=X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
-                        ctx->current_cert=x;
-                        ctx->error_depth=i-1;
-                        ok=cb(0,ctx);
-                        if (!ok) goto end;
+                        /* We have a single self signed certificate: see if
+                         * we can find it in the store. We must have an exact
+                         * match to avoid possible impersonation.
+                         */
+                        ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
+                        if ((ok != X509_LU_X509) || X509_cmp(x, obj.data.x509)) 
+                                {
+                                ctx->error=X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
+                                ctx->current_cert=x;
+                                ctx->error_depth=i-1;
+                                if(ok == X509_LU_X509) X509_OBJECT_free_contents(&obj);
+                                ok=cb(0,ctx);
+                                if (!ok) goto end;
+                                }
+                        else 
+                                {
+                                /* We have a match: replace certificate with store version
+                                 * so we get any trust settings.
+                                 */
+                                X509_free(x);
+                                x = obj.data.x509;
+                                sk_X509_set(ctx->chain, i - 1, x);
+                                ctx->last_untrusted=0;
+                                }
                         }
                 else
                         {
@@ -272,6 +293,17 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                 if (!ok) goto end;
                 }
 
+        /* We have the chain complete: now we need to check its purpose */
+        if(ctx->purpose > 0) ok = check_chain_purpose(ctx);
+
+        if(!ok) goto end;
+
+        /* The chain extensions are OK: check trust */
+
+        if(ctx->trust > 0) ok = check_trust(ctx);
+
+        if(!ok) goto end;
+
         /* We may as well copy down any DSA parameters that are required */
         X509_get_pubkey_parameters(NULL,ctx->chain);
 
@@ -290,6 +322,71 @@ end:
         return(ok);
         }
 
+/* Check a certificate chains extensions for consistency
+ * with the supplied purpose
+ */
+
+static int check_chain_purpose(X509_STORE_CTX *ctx)
+{
+#ifdef NO_CHAIN_VERIFY
+        return 1;
+#else
+        int i, ok=0;
+        X509 *x;
+        int (*cb)();
+        cb=ctx->ctx->verify_cb;
+        if (cb == NULL) cb=null_callback;
+        /* Check all untrusted certificates */
+        for(i = 0; i < ctx->last_untrusted; i++) {
+                x = sk_X509_value(ctx->chain, i);
+                if(!X509_check_purpose(x, ctx->purpose, i)) {
+                        if(i) ctx->error = X509_V_ERR_INVALID_CA;
+                        else ctx->error = X509_V_ERR_INVALID_PURPOSE;
+                        ctx->error_depth = i;
+                        ctx->current_cert = x;
+                        ok=cb(0,ctx);
+                        if(!ok) goto end;
+                }
+                /* Check pathlen */
+                if((i > 1) && (x->ex_pathlen != -1)
+                                        && (i > (x->ex_pathlen + 1))) {
+                        ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
+                        ctx->error_depth = i;
+                        ctx->current_cert = x;
+                        ok=cb(0,ctx);
+                        if(!ok) goto end;
+                }
+        }
+        ok = 1;
+        end:
+        return(ok);
+#endif
+}
+
+static int check_trust(X509_STORE_CTX *ctx)
+{
+#ifdef NO_CHAIN_VERIFY
+        return 1;
+#else
+        int i, ok;
+        X509 *x;
+        int (*cb)();
+        cb=ctx->ctx->verify_cb;
+        if (cb == NULL) cb=null_callback;
+/* For now just check the last certificate in the chain */
+        i = sk_X509_num(ctx->chain) - 1;
+        x = sk_X509_value(ctx->chain, i);
+        ok = X509_check_trust(x, ctx->trust, 0);
+        if(ok == X509_TRUST_TRUSTED) return 1;
+        ctx->error_depth = sk_X509_num(ctx->chain) - 1;
+        ctx->current_cert = x;
+        if(ok == X509_TRUST_REJECTED) ctx->error = X509_V_ERR_CERT_REJECTED;
+        else ctx->error = X509_V_ERR_CERT_UNTRUSTED;
+        ok = cb(0, ctx);
+        return(ok);
+#endif
+}
+
 static int internal_verify(X509_STORE_CTX *ctx)
         {
         int i,ok=0,n;
@@ -439,7 +536,7 @@ int X509_cmp_current_time(ASN1_UTCTIME *ctm)
         atm.length=sizeof(buff2);
         atm.data=(unsigned char *)buff2;
 
-        X509_gmtime_adj(&atm,-offset);
+        X509_gmtime_adj(&atm,-offset*60);
 
         i=(buff1[0]-'0')*10+(buff1[1]-'0');
         if (i < 50) i+=100; /* cf. RFC 2459 */
@@ -525,13 +622,13 @@ int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
 
         X509_OBJECT_up_ref_count(obj);
 
-        r=(X509_OBJECT *)lh_insert(ctx->certs,(char *)obj);
+        r=(X509_OBJECT *)lh_insert(ctx->certs,obj);
         if (r != NULL)
                 { /* oops, put it back */
-                lh_delete(ctx->certs,(char *)obj);
+                lh_delete(ctx->certs,obj);
                 X509_OBJECT_free_contents(obj);
                 Free(obj);
-                lh_insert(ctx->certs,(char *)r);
+                lh_insert(ctx->certs,r);
                 X509err(X509_F_X509_STORE_ADD_CERT,X509_R_CERT_ALREADY_IN_HASH_TABLE);
                 ret=0;
                 }
@@ -560,13 +657,13 @@ int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
 
         X509_OBJECT_up_ref_count(obj);
 
-        r=(X509_OBJECT *)lh_insert(ctx->certs,(char *)obj);
+        r=(X509_OBJECT *)lh_insert(ctx->certs,obj);
         if (r != NULL)
                 { /* oops, put it back */
-                lh_delete(ctx->certs,(char *)obj);
+                lh_delete(ctx->certs,obj);
                 X509_OBJECT_free_contents(obj);
                 Free(obj);
-                lh_insert(ctx->certs,(char *)r);
+                lh_insert(ctx->certs,r);
                 X509err(X509_F_X509_STORE_ADD_CRL,X509_R_CERT_ALREADY_IN_HASH_TABLE);
                 ret=0;
                 }
@@ -576,8 +673,8 @@ int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
         return(ret);    
         }
 
-int X509_STORE_CTX_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-             int (*dup_func)(), void (*free_func)())
+int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         x509_store_ctx_num++;
         return(CRYPTO_get_ex_new_index(x509_store_ctx_num-1,
@@ -620,6 +717,19 @@ STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx)
         return(ctx->chain);
         }
 
+STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx)
+        {
+        int i;
+        X509 *x;
+        STACK_OF(X509) *chain;
+        if(!ctx->chain || !(chain = sk_X509_dup(ctx->chain))) return NULL;
+        for(i = 0; i < sk_X509_num(chain); i++) {
+                x = sk_X509_value(chain, i);
+                CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
+        }
+        return(chain);
+        }
+
 void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x)
         {
         ctx->cert=x;
@@ -630,6 +740,62 @@ void X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
         ctx->untrusted=sk;
         }
 
+int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose)
+        {
+        return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0);
+        }
+
+int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust)
+        {
+        return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust);
+        }
+
+/* This function is used to set the X509_STORE_CTX purpose and trust
+ * values. This is intended to be used when another structure has its
+ * own trust and purpose values which (if set) will be inherited by
+ * the ctx. If they aren't set then we will usually have a default
+ * purpose in mind which should then be used to set the trust value.
+ * An example of this is SSL use: an SSL structure will have its own
+ * purpose and trust settings which the application can set: if they
+ * aren't set then we use the default of SSL client/server.
+ */
+
+int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
+                                int purpose, int trust)
+{
+        int idx;
+        /* If purpose not set use default */
+        if(!purpose) purpose = def_purpose;
+        /* If we have a purpose then check it is valid */
+        if(purpose) {
+                idx = X509_PURPOSE_get_by_id(purpose);
+                if(idx == -1) {
+                        X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
+                                                X509_R_UNKNOWN_PURPOSE_ID);
+                        return 0;
+                }
+                /* If trust not set then get from purpose default */
+                if(!trust) {
+                        X509_PURPOSE *ptmp;
+                        ptmp = X509_PURPOSE_get0(idx);
+                        trust = ptmp->trust;
+                }
+        }
+        if(trust) {
+                idx = X509_TRUST_get_by_id(trust);
+                if(idx == -1) {
+                        X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
+                                                X509_R_UNKNOWN_TRUST_ID);
+                        return 0;
+                }
+        }
+
+        if(purpose) ctx->purpose = purpose;
+        if(trust) ctx->trust = trust;
+        return 1;
+}
+
+
 IMPLEMENT_STACK_OF(X509)
 IMPLEMENT_ASN1_SET_OF(X509)
 
diff --git a/src/lib/libssl/src/crypto/x509/x509_vfy.h b/src/lib/libssl/src/crypto/x509/x509_vfy.h
index ecfd4cf9ed..4637aecedf 100644
--- a/src/lib/libssl/src/crypto/x509/x509_vfy.h
+++ b/src/lib/libssl/src/crypto/x509/x509_vfy.h
@@ -202,6 +202,8 @@ struct x509_store_state_st      /* X509_STORE_CTX */
         /* The following are set by the caller */
         X509 *cert;             /* The cert to check */
         STACK_OF(X509) *untrusted;      /* chain of X509s - untrusted - passed in */
+        int purpose;            /* purpose to check untrusted certificates */
+        int trust;              /* trust setting to check */
 
         /* The following is built up */
         int depth;              /* how far to go looking up certs */
@@ -234,6 +236,7 @@ struct x509_store_state_st      /* X509_STORE_CTX */
                 X509_LOOKUP_ctrl((x),X509_L_ADD_DIR,(name),(long)(type),NULL)
 
 #define         X509_V_OK                                       0
+/* illegal error (for uninitialized values, to avoid X509_V_OK): 1 */
 
 #define         X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT            2
 #define         X509_V_ERR_UNABLE_TO_GET_CRL                    3
@@ -257,6 +260,11 @@ struct x509_store_state_st      /* X509_STORE_CTX */
 #define         X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE      21
 #define         X509_V_ERR_CERT_CHAIN_TOO_LONG                  22
 #define         X509_V_ERR_CERT_REVOKED                         23
+#define         X509_V_ERR_INVALID_CA                           24
+#define         X509_V_ERR_PATH_LENGTH_EXCEEDED                 25
+#define         X509_V_ERR_INVALID_PURPOSE                      26
+#define         X509_V_ERR_CERT_UNTRUSTED                       27
+#define         X509_V_ERR_CERT_REJECTED                        28
 
 /* The application is not happy */
 #define         X509_V_ERR_APPLICATION_VERIFICATION             50
@@ -284,6 +292,8 @@ void X509_OBJECT_free_contents(X509_OBJECT *a);
 X509_STORE *X509_STORE_new(void );
 void X509_STORE_free(X509_STORE *v);
 
+X509_STORE_CTX *X509_STORE_CTX_new(void);
+void X509_STORE_CTX_free(X509_STORE_CTX *ctx);
 void X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store,
                          X509 *x509, STACK_OF(X509) *chain);
 void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
@@ -305,6 +315,7 @@ int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
 #ifndef NO_STDIO
 int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type);
 int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type);
+int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type);
 #endif
 
 
@@ -327,8 +338,8 @@ int	X509_STORE_load_locations (X509_STORE *ctx,
 int     X509_STORE_set_default_paths(X509_STORE *ctx);
 #endif
 
-int X509_STORE_CTX_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 int     X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx,int idx,void *data);
 void *  X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx,int idx);
 int     X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
@@ -336,8 +347,13 @@ void	X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s);
 int     X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
 X509 *  X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
 STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);
+STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
 void    X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x);
 void    X509_STORE_CTX_set_chain(X509_STORE_CTX *c,STACK_OF(X509) *sk);
+int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose);
+int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);
+int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
+                                int purpose, int trust);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/x509/x509name.c b/src/lib/libssl/src/crypto/x509/x509name.c
index 2a422be350..cf2382d42c 100644
--- a/src/lib/libssl/src/crypto/x509/x509name.c
+++ b/src/lib/libssl/src/crypto/x509/x509name.c
@@ -171,6 +171,42 @@ X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc)
         return(ret);
         }
 
+int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len, int loc, int set)
+{
+        X509_NAME_ENTRY *ne;
+        int ret;
+        ne = X509_NAME_ENTRY_create_by_OBJ(NULL, obj, type, bytes, len);
+        if(!ne) return 0;
+        ret = X509_NAME_add_entry(name, ne, loc, set);
+        X509_NAME_ENTRY_free(ne);
+        return ret;
+}
+
+int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
+                        unsigned char *bytes, int len, int loc, int set)
+{
+        X509_NAME_ENTRY *ne;
+        int ret;
+        ne = X509_NAME_ENTRY_create_by_NID(NULL, nid, type, bytes, len);
+        if(!ne) return 0;
+        ret = X509_NAME_add_entry(name, ne, loc, set);
+        X509_NAME_ENTRY_free(ne);
+        return ret;
+}
+
+int X509_NAME_add_entry_by_txt(X509_NAME *name, char *field, int type,
+                        unsigned char *bytes, int len, int loc, int set)
+{
+        X509_NAME_ENTRY *ne;
+        int ret;
+        ne = X509_NAME_ENTRY_create_by_txt(NULL, field, type, bytes, len);
+        if(!ne) return 0;
+        ret = X509_NAME_add_entry(name, ne, loc, set);
+        X509_NAME_ENTRY_free(ne);
+        return ret;
+}
+
 /* if set is -1, append to previous set, 0 'a new one', and 1,
  * prepend to the guy we are about to stomp on. */
 int X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, int loc,
@@ -236,10 +272,30 @@ err:
         return(0);
         }
 
+X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
+                char *field, int type, unsigned char *bytes, int len)
+        {
+        ASN1_OBJECT *obj;
+        X509_NAME_ENTRY *nentry;
+
+        obj=OBJ_txt2obj(field, 0);
+        if (obj == NULL)
+                {
+                X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_TXT,
+                                                X509_R_INVALID_FIELD_NAME);
+                ERR_add_error_data(2, "name=", field);
+                return(NULL);
+                }
+        nentry = X509_NAME_ENTRY_create_by_OBJ(ne,obj,type,bytes,len);
+        ASN1_OBJECT_free(obj);
+        return nentry;
+        }
+
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
              int type, unsigned char *bytes, int len)
         {
         ASN1_OBJECT *obj;
+        X509_NAME_ENTRY *nentry;
 
         obj=OBJ_nid2obj(nid);
         if (obj == NULL)
@@ -247,7 +303,9 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
                 X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_NID,X509_R_UNKNOWN_NID);
                 return(NULL);
                 }
-        return(X509_NAME_ENTRY_create_by_OBJ(ne,obj,type,bytes,len));
+        nentry = X509_NAME_ENTRY_create_by_OBJ(ne,obj,type,bytes,len);
+        ASN1_OBJECT_free(obj);
+        return nentry;
         }
 
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
@@ -267,7 +325,7 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
                 goto err;
         if (!X509_NAME_ENTRY_set_data(ret,type,bytes,len))
                 goto err;
-        
+
         if ((ne != NULL) && (*ne == NULL)) *ne=ret;
         return(ret);
 err:
@@ -294,6 +352,10 @@ int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
         int i;
 
         if ((ne == NULL) || ((bytes == NULL) && (len != 0))) return(0);
+        if(type & MBSTRING_FLAG) 
+                return ASN1_STRING_set_by_NID(&ne->value, bytes,
+                                                len, type,
+                                        OBJ_obj2nid(ne->object)) ? 1 : 0;
         if (len < 0) len=strlen((char *)bytes);
         i=ASN1_STRING_set(ne->value,bytes,len);
         if (!i) return(0);
diff --git a/src/lib/libssl/src/crypto/x509/x509spki.c b/src/lib/libssl/src/crypto/x509/x509spki.c
new file mode 100644
index 0000000000..b35c3f92e7
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509/x509spki.c
@@ -0,0 +1,121 @@
+/* x509spki.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/asn1_mac.h>
+
+int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey)
+{
+        if ((x == NULL) || (x->spkac == NULL)) return(0);
+        return(X509_PUBKEY_set(&(x->spkac->pubkey),pkey));
+}
+
+EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x)
+{
+        if ((x == NULL) || (x->spkac == NULL))
+                return(NULL);
+        return(X509_PUBKEY_get(x->spkac->pubkey));
+}
+
+/* Load a Netscape SPKI from a base64 encoded string */
+
+NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(const char *str, int len)
+{
+        unsigned char *spki_der, *p;
+        int spki_len;
+        NETSCAPE_SPKI *spki;
+        if(len <= 0) len = strlen(str);
+        if (!(spki_der = Malloc(len + 1))) {
+                X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+        spki_len = EVP_DecodeBlock(spki_der, (const unsigned char *)str, len);
+        if(spki_len < 0) {
+                X509err(X509_F_NETSCAPE_SPKI_B64_DECODE,
+                                                X509_R_BASE64_DECODE_ERROR);
+                Free(spki_der);
+                return NULL;
+        }
+        p = spki_der;
+        spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
+        Free(spki_der);
+        return spki;
+}
+
+/* Generate a base64 encoded string from an SPKI */
+
+char * NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *spki)
+{
+        unsigned char *der_spki, *p;
+        char *b64_str;
+        int der_len;
+        der_len = i2d_NETSCAPE_SPKI(spki, NULL);
+        der_spki = Malloc(der_len);
+        b64_str = Malloc(der_len * 2);
+        if(!der_spki || !b64_str) {
+                X509err(X509_F_NETSCAPE_SPKI_B64_ENCODE, ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+        p = der_spki;
+        i2d_NETSCAPE_SPKI(spki, &p);
+        EVP_EncodeBlock((unsigned char *)b64_str, der_spki, der_len);
+        Free(der_spki);
+        return b64_str;
+}
diff --git a/src/lib/libssl/src/crypto/x509/x_all.c b/src/lib/libssl/src/crypto/x509/x_all.c
index f2af895df0..d2bf3c8e1c 100644
--- a/src/lib/libssl/src/crypto/x509/x_all.c
+++ b/src/lib/libssl/src/crypto/x509/x_all.c
@@ -285,10 +285,22 @@ RSA *d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa)
                 (unsigned char **)(rsa)));
         }
 
+RSA *d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa)
+        {
+        return((RSA *)ASN1_d2i_fp((char *(*)())
+                RSA_new,(char *(*)())d2i_RSA_PUBKEY, (fp),
+                (unsigned char **)(rsa)));
+        }
+
 int i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa)
         {
         return(ASN1_i2d_fp(i2d_RSAPublicKey,fp,(unsigned char *)rsa));
         }
+
+int i2d_RSA_PUBKEY_fp(FILE *fp, RSA *rsa)
+        {
+        return(ASN1_i2d_fp(i2d_RSA_PUBKEY,fp,(unsigned char *)rsa));
+        }
 #endif
 
 RSA *d2i_RSAPrivateKey_bio(BIO *bp, RSA **rsa)
@@ -310,10 +322,22 @@ RSA *d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa)
                 (unsigned char **)(rsa)));
         }
 
+RSA *d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa)
+        {
+        return((RSA *)ASN1_d2i_bio((char *(*)())
+                RSA_new,(char *(*)())d2i_RSA_PUBKEY, (bp),
+                (unsigned char **)(rsa)));
+        }
+
 int i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa)
         {
         return(ASN1_i2d_bio(i2d_RSAPublicKey,bp,(unsigned char *)rsa));
         }
+
+int i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa)
+        {
+        return(ASN1_i2d_bio(i2d_RSA_PUBKEY,bp,(unsigned char *)rsa));
+        }
 #endif
 
 #ifndef NO_DSA
@@ -329,6 +353,18 @@ int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa)
         {
         return(ASN1_i2d_fp(i2d_DSAPrivateKey,fp,(unsigned char *)dsa));
         }
+
+DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa)
+        {
+        return((DSA *)ASN1_d2i_fp((char *(*)())
+                DSA_new,(char *(*)())d2i_DSA_PUBKEY, (fp),
+                (unsigned char **)(dsa)));
+        }
+
+int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa)
+        {
+        return(ASN1_i2d_fp(i2d_DSA_PUBKEY,fp,(unsigned char *)dsa));
+        }
 #endif
 
 DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa)
@@ -342,6 +378,19 @@ int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa)
         {
         return(ASN1_i2d_bio(i2d_DSAPrivateKey,bp,(unsigned char *)dsa));
         }
+
+DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa)
+        {
+        return((DSA *)ASN1_d2i_bio((char *(*)())
+                DSA_new,(char *(*)())d2i_DSA_PUBKEY, (bp),
+                (unsigned char **)(dsa)));
+        }
+
+int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa)
+        {
+        return(ASN1_i2d_bio(i2d_DSA_PUBKEY,bp,(unsigned char *)dsa));
+        }
+
 #endif
 
 X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn)
@@ -362,19 +411,19 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne)
                 (char *(*)())d2i_X509_NAME_ENTRY,(char *)ne));
         }
 
-int X509_digest(X509 *data, EVP_MD *type, unsigned char *md,
+int X509_digest(X509 *data, const EVP_MD *type, unsigned char *md,
              unsigned int *len)
         {
         return(ASN1_digest((int (*)())i2d_X509,type,(char *)data,md,len));
         }
 
-int X509_NAME_digest(X509_NAME *data, EVP_MD *type, unsigned char *md,
+int X509_NAME_digest(X509_NAME *data, const EVP_MD *type, unsigned char *md,
              unsigned int *len)
         {
         return(ASN1_digest((int (*)())i2d_X509_NAME,type,(char *)data,md,len));
         }
 
-int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, EVP_MD *type,
+int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, const EVP_MD *type,
              unsigned char *md, unsigned int *len)
         {
         return(ASN1_digest((int (*)())i2d_PKCS7_ISSUER_AND_SERIAL,type,
@@ -420,6 +469,29 @@ int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, PKCS8_PRIV_KEY_INFO *p8inf)
         {
         return(ASN1_i2d_fp(i2d_PKCS8_PRIV_KEY_INFO,fp,(unsigned char *)p8inf));
         }
+
+int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key)
+        {
+        PKCS8_PRIV_KEY_INFO *p8inf;
+        int ret;
+        p8inf = EVP_PKEY2PKCS8(key);
+        if(!p8inf) return 0;
+        ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf);
+        PKCS8_PRIV_KEY_INFO_free(p8inf);
+        return ret;
+        }
+
+int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey)
+        {
+        return(ASN1_i2d_fp(i2d_PrivateKey,fp,(unsigned char *)pkey));
+        }
+
+EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a)
+{
+        return((EVP_PKEY *)ASN1_d2i_fp((char *(*)())EVP_PKEY_new,
+                (char *(*)())d2i_AutoPrivateKey, (fp),(unsigned char **)(a)));
+}
+
 #endif
 
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
@@ -435,3 +507,25 @@ int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, PKCS8_PRIV_KEY_INFO *p8inf)
         {
         return(ASN1_i2d_bio(i2d_PKCS8_PRIV_KEY_INFO,bp,(unsigned char *)p8inf));
         }
+
+int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key)
+        {
+        PKCS8_PRIV_KEY_INFO *p8inf;
+        int ret;
+        p8inf = EVP_PKEY2PKCS8(key);
+        if(!p8inf) return 0;
+        ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
+        PKCS8_PRIV_KEY_INFO_free(p8inf);
+        return ret;
+        }
+
+int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey)
+        {
+        return(ASN1_i2d_bio(i2d_PrivateKey,bp,(unsigned char *)pkey));
+        }
+
+EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a)
+        {
+        return((EVP_PKEY *)ASN1_d2i_bio((char *(*)())EVP_PKEY_new,
+                (char *(*)())d2i_AutoPrivateKey, (bp),(unsigned char **)(a)));
+        }
diff --git a/src/lib/libssl/src/crypto/x509v3/Makefile.ssl b/src/lib/libssl/src/crypto/x509v3/Makefile.ssl
index 72871edbc1..1bb746d52d 100644
--- a/src/lib/libssl/src/crypto/x509v3/Makefile.ssl
+++ b/src/lib/libssl/src/crypto/x509v3/Makefile.ssl
@@ -24,10 +24,10 @@ APPS=
 LIB=$(TOP)/libcrypto.a
 LIBSRC= v3_bcons.c v3_bitst.c v3_conf.c v3_extku.c v3_ia5.c \
 v3_lib.c v3_prn.c v3_utl.c v3err.c v3_genn.c v3_alt.c v3_skey.c v3_akey.c \
-v3_pku.c v3_int.c v3_enum.c v3_sxnet.c v3_cpols.c v3_crld.c
+v3_pku.c v3_int.c v3_enum.c v3_sxnet.c v3_cpols.c v3_crld.c v3_purp.c v3_info.c
 LIBOBJ= v3_bcons.o v3_bitst.o v3_conf.o v3_extku.o v3_ia5.o v3_lib.o \
 v3_prn.o v3_utl.o v3err.o v3_genn.o v3_alt.o v3_skey.o v3_akey.o v3_pku.o \
-v3_int.o v3_enum.o v3_sxnet.o v3_cpols.o v3_crld.o
+v3_int.o v3_enum.o v3_sxnet.o v3_cpols.o v3_crld.o v3_purp.o v3_info.o
 
 SRC= $(LIBSRC)
 
@@ -285,6 +285,25 @@ v3_ia5.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 v3_ia5.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 v3_ia5.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 v3_ia5.o: ../../include/openssl/x509v3.h ../cryptlib.h
+v3_info.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+v3_info.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+v3_info.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+v3_info.o: ../../include/openssl/cast.h ../../include/openssl/conf.h
+v3_info.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+v3_info.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+v3_info.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+v3_info.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+v3_info.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+v3_info.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+v3_info.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+v3_info.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+v3_info.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+v3_info.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+v3_info.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+v3_info.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+v3_info.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+v3_info.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+v3_info.o: ../cryptlib.h
 v3_int.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 v3_int.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 v3_int.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -320,7 +339,7 @@ v3_lib.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 v3_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 v3_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 v3_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-v3_lib.o: ../../include/openssl/x509v3.h ../cryptlib.h
+v3_lib.o: ../../include/openssl/x509v3.h ../cryptlib.h ext_dat.h
 v3_pku.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 v3_pku.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 v3_pku.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
@@ -358,6 +377,24 @@ v3_prn.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 v3_prn.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 v3_prn.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 v3_prn.o: ../../include/openssl/x509v3.h ../cryptlib.h
+v3_purp.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+v3_purp.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+v3_purp.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+v3_purp.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+v3_purp.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+v3_purp.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+v3_purp.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+v3_purp.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+v3_purp.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+v3_purp.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+v3_purp.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+v3_purp.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+v3_purp.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+v3_purp.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+v3_purp.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+v3_purp.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+v3_purp.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+v3_purp.o: ../../include/openssl/x509v3.h ../cryptlib.h
 v3_skey.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 v3_skey.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 v3_skey.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
diff --git a/src/lib/libssl/src/crypto/x509v3/README b/src/lib/libssl/src/crypto/x509v3/README
index 3b2cc047be..e69de29bb2 100644
--- a/src/lib/libssl/src/crypto/x509v3/README
+++ b/src/lib/libssl/src/crypto/x509v3/README
@@ -1,4 +0,0 @@
-WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
-
-This is ***VERY*** new experimental code and is likely to change
-considerably or vanish altogether.
diff --git a/src/lib/libssl/src/crypto/x509v3/ext_dat.h b/src/lib/libssl/src/crypto/x509v3/ext_dat.h
new file mode 100644
index 0000000000..801a585a52
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/ext_dat.h
@@ -0,0 +1,97 @@
+/* ext_dat.h */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* This file contains a table of "standard" extensions */
+
+extern X509V3_EXT_METHOD v3_bcons, v3_nscert, v3_key_usage, v3_ext_ku;
+extern X509V3_EXT_METHOD v3_pkey_usage_period, v3_sxnet, v3_info;
+extern X509V3_EXT_METHOD v3_ns_ia5_list[], v3_alt[], v3_skey_id, v3_akey_id;
+extern X509V3_EXT_METHOD v3_crl_num, v3_crl_reason, v3_cpols, v3_crld;
+
+/* This table will be searched using OBJ_bsearch so it *must* kept in
+ * order of the ext_nid values.
+ */
+
+static X509V3_EXT_METHOD *standard_exts[] = {
+&v3_nscert,
+&v3_ns_ia5_list[0],
+&v3_ns_ia5_list[1],
+&v3_ns_ia5_list[2],
+&v3_ns_ia5_list[3],
+&v3_ns_ia5_list[4],
+&v3_ns_ia5_list[5],
+&v3_ns_ia5_list[6],
+&v3_skey_id,
+&v3_key_usage,
+&v3_pkey_usage_period,
+&v3_alt[0],
+&v3_alt[1],
+&v3_bcons,
+&v3_crl_num,
+&v3_cpols,
+&v3_akey_id,
+&v3_crld,
+&v3_ext_ku,
+&v3_crl_reason,
+&v3_sxnet,
+&v3_info,
+};
+
+/* Number of standard extensions */
+
+#define STANDARD_EXTENSION_COUNT (sizeof(standard_exts)/sizeof(X509V3_EXT_METHOD *))
+
diff --git a/src/lib/libssl/src/crypto/x509v3/tabtest.c b/src/lib/libssl/src/crypto/x509v3/tabtest.c
new file mode 100644
index 0000000000..dad0d38dd5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/tabtest.c
@@ -0,0 +1,88 @@
+/* tabtest.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* Simple program to check the ext_dat.h is correct and print out
+ * problems if it is not.
+ */
+
+#include <stdio.h>
+
+#include <openssl/x509v3.h>
+
+#include "ext_dat.h"
+
+main()
+{
+        int i, prev = -1, bad = 0;
+        X509V3_EXT_METHOD **tmp;
+        i = sizeof(standard_exts) / sizeof(X509V3_EXT_METHOD *);
+        if(i != STANDARD_EXTENSION_COUNT)
+                fprintf(stderr, "Extension number invalid expecting %d\n", i);
+        tmp = standard_exts;
+        for(i = 0; i < STANDARD_EXTENSION_COUNT; i++, tmp++) {
+                if((*tmp)->ext_nid < prev) bad = 1;
+                prev = (*tmp)->ext_nid;
+                
+        }
+        if(bad) {
+                tmp = standard_exts;
+                fprintf(stderr, "Extensions out of order!\n");
+                for(i = 0; i < STANDARD_EXTENSION_COUNT; i++, tmp++)
+                printf("%d : %s\n", (*tmp)->ext_nid, OBJ_nid2sn((*tmp)->ext_nid));
+        } else fprintf(stderr, "Order OK\n");
+}
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_akey.c b/src/lib/libssl/src/crypto/x509v3/v3_akey.c
index 4099e6019e..96c04fe4f5 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_akey.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_akey.c
@@ -129,10 +129,10 @@ AUTHORITY_KEYID *d2i_AUTHORITY_KEYID(AUTHORITY_KEYID **a, unsigned char **pp,
 void AUTHORITY_KEYID_free(AUTHORITY_KEYID *a)
 {
         if (a == NULL) return;
-        ASN1_OCTET_STRING_free(a->keyid);
+        M_ASN1_OCTET_STRING_free(a->keyid);
         sk_GENERAL_NAME_pop_free(a->issuer, GENERAL_NAME_free);
-        ASN1_INTEGER_free (a->serial);
-        Free ((char *)a);
+        M_ASN1_INTEGER_free (a->serial);
+        Free (a);
 }
 
 static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
@@ -214,7 +214,7 @@ if(keyid) {
 
 if((issuer && !ikeyid) || (issuer == 2)) {
         isname = X509_NAME_dup(X509_get_issuer_name(cert));
-        serial = ASN1_INTEGER_dup(X509_get_serialNumber(cert));
+        serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(cert));
         if(!isname || !serial) {
                 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS);
                 goto err;
@@ -241,8 +241,8 @@ return akeyid;
 
 err:
 X509_NAME_free(isname);
-ASN1_INTEGER_free(serial);
-ASN1_OCTET_STRING_free(ikeyid);
+M_ASN1_INTEGER_free(serial);
+M_ASN1_OCTET_STRING_free(ikeyid);
 return NULL;
 
 }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_alt.c b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
index b5e1f8af96..5ccd1e0e3d 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_alt.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
@@ -84,7 +84,6 @@ NULL, NULL,
 (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
 (X509V3_EXT_V2I)v2i_issuer_alt,
 NULL, NULL, NULL},
-EXT_END
 };
 
 STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method,
@@ -273,7 +272,7 @@ static int copy_email(X509V3_CTX *ctx, STACK_OF(GENERAL_NAME) *gens)
         while((i = X509_NAME_get_index_by_NID(nm,
                                          NID_pkcs9_emailAddress, i)) > 0) {
                 ne = X509_NAME_get_entry(nm, i);
-                email = ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
+                email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
                 if(!email || !(gen = GENERAL_NAME_new())) {
                         X509V3err(X509V3_F_COPY_EMAIL,ERR_R_MALLOC_FAILURE);
                         goto err;
@@ -293,7 +292,7 @@ static int copy_email(X509V3_CTX *ctx, STACK_OF(GENERAL_NAME) *gens)
                 
         err:
         GENERAL_NAME_free(gen);
-        ASN1_IA5STRING_free(email);
+        M_ASN1_IA5STRING_free(email);
         return 0;
         
 }
@@ -371,7 +370,7 @@ if(!name_cmp(name, "email")) {
                 goto err;
         }
         ip[0] = i1; ip[1] = i2 ; ip[2] = i3 ; ip[3] = i4;
-        if(!(gen->d.ip = ASN1_OCTET_STRING_new()) ||
+        if(!(gen->d.ip = M_ASN1_OCTET_STRING_new()) ||
                 !ASN1_STRING_set(gen->d.ip, ip, 4)) {
                         X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
                         goto err;
@@ -384,7 +383,7 @@ if(!name_cmp(name, "email")) {
 }
 
 if(is_string) {
-        if(!(gen->d.ia5 = ASN1_IA5STRING_new()) ||
+        if(!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
                       !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value,
                                        strlen(value))) {
                 X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_bcons.c b/src/lib/libssl/src/crypto/x509v3/v3_bcons.c
index de2f855c35..1e3edc205f 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_bcons.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_bcons.c
@@ -122,8 +122,8 @@ BASIC_CONSTRAINTS *d2i_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS **a,
 void BASIC_CONSTRAINTS_free(BASIC_CONSTRAINTS *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free (a->pathlen);
-        Free ((char *)a);
+        M_ASN1_INTEGER_free (a->pathlen);
+        Free (a);
 }
 
 static STACK_OF(CONF_VALUE) *i2v_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method,
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_bitst.c b/src/lib/libssl/src/crypto/x509v3/v3_bitst.c
index 9828ba15b3..0e1167d05c 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_bitst.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_bitst.c
@@ -61,7 +61,6 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
-static ASN1_BIT_STRING *asn1_bit_string_new(void);
 static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
 static STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
@@ -97,11 +96,6 @@ static BIT_STRING_BITNAME key_usage_type_table[] = {
 X509V3_EXT_METHOD v3_nscert = EXT_BITSTRING(NID_netscape_cert_type, ns_cert_type_table);
 X509V3_EXT_METHOD v3_key_usage = EXT_BITSTRING(NID_key_usage, key_usage_type_table);
 
-static ASN1_BIT_STRING *asn1_bit_string_new(void)
-{
-        return ASN1_BIT_STRING_new();
-}
-
 static STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
              ASN1_BIT_STRING *bits, STACK_OF(CONF_VALUE) *ret)
 {
@@ -120,7 +114,7 @@ static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
         ASN1_BIT_STRING *bs;
         int i;
         BIT_STRING_BITNAME *bnam;
-        if(!(bs = ASN1_BIT_STRING_new())) {
+        if(!(bs = M_ASN1_BIT_STRING_new())) {
                 X509V3err(X509V3_F_V2I_ASN1_BIT_STRING,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -137,7 +131,7 @@ static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
                         X509V3err(X509V3_F_V2I_ASN1_BIT_STRING,
                                         X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT);
                         X509V3_conf_err(val);
-                        ASN1_BIT_STRING_free(bs);
+                        M_ASN1_BIT_STRING_free(bs);
                         return NULL;
                 }
         }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_conf.c b/src/lib/libssl/src/crypto/x509v3/v3_conf.c
index f19bb3ad84..b2f03010cc 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_conf.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_conf.c
@@ -170,13 +170,13 @@ static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid,
         if(!(ext_der = Malloc(ext_len))) goto merr;
         p = ext_der;
         method->i2d(ext_struc, &p);
-        if(!(ext_oct = ASN1_OCTET_STRING_new())) goto merr;
+        if(!(ext_oct = M_ASN1_OCTET_STRING_new())) goto merr;
         ext_oct->data = ext_der;
         ext_oct->length = ext_len;
         
         ext = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);
         if(!ext) goto merr;
-        ASN1_OCTET_STRING_free(ext_oct);
+        M_ASN1_OCTET_STRING_free(ext_oct);
 
         return ext;
 
@@ -220,7 +220,7 @@ static int v3_check_generic(char **value)
         return 1;
 }
 
-/* Create a generic extension: for now just handle RAW type */
+/* Create a generic extension: for now just handle DER type */
 static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
              int crit, int type)
 {
@@ -241,7 +241,7 @@ if(!(ext_der = string_to_hex(value, &ext_len))) {
         goto err;
 }
 
-if(!(oct = ASN1_OCTET_STRING_new())) {
+if(!(oct = M_ASN1_OCTET_STRING_new())) {
         X509V3err(X509V3_F_V3_GENERIC_EXTENSION,ERR_R_MALLOC_FAILURE);
         goto err;
 }
@@ -254,7 +254,7 @@ extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);
 
 err:
 ASN1_OBJECT_free(obj);
-ASN1_OCTET_STRING_free(oct);
+M_ASN1_OCTET_STRING_free(oct);
 if(ext_der) Free(ext_der);
 return extension;
 }
@@ -302,6 +302,30 @@ int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
         return 1;
 }
 
+/* Add extensions to certificate request */
+
+int X509V3_EXT_REQ_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
+             X509_REQ *req)
+{
+        X509_EXTENSION *ext;
+        STACK_OF(X509_EXTENSION) *extlist = NULL;
+        STACK_OF(CONF_VALUE) *nval;
+        CONF_VALUE *val;        
+        int i;
+        if(!(nval = CONF_get_section(conf, section))) return 0;
+        for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
+                val = sk_CONF_VALUE_value(nval, i);
+                if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))
+                                                                return 0;
+                if(!extlist) extlist = sk_X509_EXTENSION_new_null();
+                sk_X509_EXTENSION_push(extlist, ext);
+        }
+        if(req) i = X509_REQ_add_extensions(req, extlist);
+        else i = 1;
+        sk_X509_EXTENSION_pop_free(extlist, X509_EXTENSION_free);
+        return i;
+}
+
 /* Config database functions */
 
 char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section)
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_cpols.c b/src/lib/libssl/src/crypto/x509v3/v3_cpols.c
index b4d4883545..466713b50d 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_cpols.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_cpols.c
@@ -169,7 +169,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx,
                         if(!sk_POLICYQUALINFO_push(pol->qualifiers, qual))
                                                                  goto merr;
                         qual->pqualid = OBJ_nid2obj(NID_id_qt_cps);
-                        qual->d.cpsuri = ASN1_IA5STRING_new();
+                        qual->d.cpsuri = M_ASN1_IA5STRING_new();
                         if(!ASN1_STRING_set(qual->d.cpsuri, cnf->value,
                                                  strlen(cnf->value))) goto merr;
                 } else if(!name_cmp(cnf->name, "userNotice")) {
@@ -229,7 +229,7 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
         for(i = 0; i < sk_CONF_VALUE_num(unot); i++) {
                 cnf = sk_CONF_VALUE_value(unot, i);
                 if(!strcmp(cnf->name, "explicitText")) {
-                        not->exptext = ASN1_VISIBLESTRING_new();
+                        not->exptext = M_ASN1_VISIBLESTRING_new();
                         if(!ASN1_STRING_set(not->exptext, cnf->value,
                                                  strlen(cnf->value))) goto merr;
                 } else if(!strcmp(cnf->name, "organization")) {
@@ -238,8 +238,8 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
                                 if(!(nref = NOTICEREF_new())) goto merr;
                                 not->noticeref = nref;
                         } else nref = not->noticeref;
-                        if(ia5org) nref->organization = ASN1_IA5STRING_new();
-                        else nref->organization = ASN1_VISIBLESTRING_new();
+                        if(ia5org) nref->organization = M_ASN1_IA5STRING_new();
+                        else nref->organization = M_ASN1_VISIBLESTRING_new();
                         if(!ASN1_STRING_set(nref->organization, cnf->value,
                                                  strlen(cnf->value))) goto merr;
                 } else if(!strcmp(cnf->name, "noticeNumbers")) {
@@ -538,7 +538,7 @@ void POLICYQUALINFO_free(POLICYQUALINFO *a)
         if (a == NULL) return;
         switch(OBJ_obj2nid(a->pqualid)) {
                 case NID_id_qt_cps:
-                ASN1_IA5STRING_free(a->d.cpsuri);
+                M_ASN1_IA5STRING_free(a->d.cpsuri);
                 break;
 
                 case NID_id_qt_unotice:
@@ -596,7 +596,7 @@ void USERNOTICE_free(USERNOTICE *a)
 {
         if (a == NULL) return;
         NOTICEREF_free(a->noticeref);
-        DISPLAYTEXT_free(a->exptext);
+        M_DISPLAYTEXT_free(a->exptext);
         Free (a);
 }
 
@@ -646,7 +646,7 @@ NOTICEREF *d2i_NOTICEREF(NOTICEREF **a, unsigned char **pp,long length)
 void NOTICEREF_free(NOTICEREF *a)
 {
         if (a == NULL) return;
-        DISPLAYTEXT_free(a->organization);
+        M_DISPLAYTEXT_free(a->organization);
         sk_pop_free(a->noticenos, ASN1_STRING_free);
         Free (a);
 }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_crld.c b/src/lib/libssl/src/crypto/x509v3/v3_crld.c
index 897ffb63e4..e459d2595a 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_crld.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_crld.c
@@ -211,20 +211,20 @@ void DIST_POINT_free(DIST_POINT *a)
 {
         if (a == NULL) return;
         DIST_POINT_NAME_free(a->distpoint);
-        ASN1_BIT_STRING_free(a->reasons);
+        M_ASN1_BIT_STRING_free(a->reasons);
         sk_GENERAL_NAME_pop_free(a->CRLissuer, GENERAL_NAME_free);
-        Free ((char *)a);
+        Free (a);
 }
 
 int i2d_DIST_POINT_NAME(DIST_POINT_NAME *a, unsigned char **pp)
 {
-        int v = 0;
         M_ASN1_I2D_vars(a);
 
         if(a->fullname) {
                 M_ASN1_I2D_len_IMP_opt (a->fullname, i2d_GENERAL_NAMES);
         } else {
-                M_ASN1_I2D_len_EXP_opt (a->relativename, i2d_X509_NAME, 1, v);
+                M_ASN1_I2D_len_IMP_SET_opt_type(X509_NAME_ENTRY,
+                                a->relativename, i2d_X509_NAME_ENTRY, 1);
         }
 
         /* Don't want a SEQUENCE so... */
@@ -234,7 +234,8 @@ int i2d_DIST_POINT_NAME(DIST_POINT_NAME *a, unsigned char **pp)
         if(a->fullname) {
                 M_ASN1_I2D_put_IMP_opt (a->fullname, i2d_GENERAL_NAMES, 0);
         } else {
-                M_ASN1_I2D_put_EXP_opt (a->relativename, i2d_X509_NAME, 1, v);
+                M_ASN1_I2D_put_IMP_SET_opt_type(X509_NAME_ENTRY,
+                                a->relativename, i2d_X509_NAME_ENTRY, 1);
         }
         M_ASN1_I2D_finish();
 }
@@ -253,9 +254,9 @@ DIST_POINT_NAME *DIST_POINT_NAME_new(void)
 void DIST_POINT_NAME_free(DIST_POINT_NAME *a)
 {
         if (a == NULL) return;
-        X509_NAME_free(a->relativename);
+        sk_X509_NAME_ENTRY_pop_free(a->relativename, X509_NAME_ENTRY_free);
         sk_GENERAL_NAME_pop_free(a->fullname, GENERAL_NAME_free);
-        Free ((char *)a);
+        Free (a);
 }
 
 DIST_POINT_NAME *d2i_DIST_POINT_NAME(DIST_POINT_NAME **a, unsigned char **pp,
@@ -273,7 +274,8 @@ DIST_POINT_NAME *d2i_DIST_POINT_NAME(DIST_POINT_NAME **a, unsigned char **pp,
                 M_ASN1_D2I_get_imp(ret->fullname, d2i_GENERAL_NAMES,
                                                         V_ASN1_SEQUENCE);
         } else if (tag == (1|V_ASN1_CONTEXT_SPECIFIC)) {
-                M_ASN1_D2I_get_EXP_opt (ret->relativename, d2i_X509_NAME, 1);
+                M_ASN1_D2I_get_IMP_set_opt_type (X509_NAME_ENTRY,
+                        ret->relativename, d2i_X509_NAME_ENTRY, X509_NAME_ENTRY_free, 1);
         } else {
                 c.error = ASN1_R_BAD_TAG;
                 goto err;
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_enum.c b/src/lib/libssl/src/crypto/x509v3/v3_enum.c
index db423548ff..aecfdc87f8 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_enum.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_enum.c
@@ -60,8 +60,6 @@
 #include "cryptlib.h"
 #include <openssl/x509v3.h>
 
-static ASN1_ENUMERATED *asn1_enumerated_new(void);
-
 static ENUMERATED_NAMES crl_reasons[] = {
 {0, "Unspecified", "unspecified"},
 {1, "Key Compromise", "keyCompromise"},
@@ -76,20 +74,15 @@ static ENUMERATED_NAMES crl_reasons[] = {
 
 X509V3_EXT_METHOD v3_crl_reason = { 
 NID_crl_reason, 0,
-(X509V3_EXT_NEW)asn1_enumerated_new,
-(X509V3_EXT_FREE)ASN1_STRING_free,
+(X509V3_EXT_NEW)ASN1_ENUMERATED_new,
+(X509V3_EXT_FREE)ASN1_ENUMERATED_free,
 (X509V3_EXT_D2I)d2i_ASN1_ENUMERATED,
 (X509V3_EXT_I2D)i2d_ASN1_ENUMERATED,
 (X509V3_EXT_I2S)i2s_ASN1_ENUMERATED_TABLE,
-(X509V3_EXT_S2I)NULL,
+(X509V3_EXT_S2I)0,
 NULL, NULL, NULL, NULL, crl_reasons};
 
 
-static ASN1_ENUMERATED *asn1_enumerated_new(void)
-{
-        return ASN1_ENUMERATED_new();
-}
-
 char *i2s_ASN1_ENUMERATED_TABLE(X509V3_EXT_METHOD *method,
              ASN1_ENUMERATED *e)
 {
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_genn.c b/src/lib/libssl/src/crypto/x509v3/v3_genn.c
index af716232f8..894afa7e03 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_genn.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_genn.c
@@ -88,12 +88,15 @@ int i2d_GENERAL_NAME(GENERAL_NAME *a, unsigned char **pp)
 
         switch(a->type) {
 
-                case GEN_OTHERNAME:
                 case GEN_X400:
                 case GEN_EDIPARTY:
                 ret = i2d_ASN1_TYPE(a->d.other, pp);
                 break;
 
+                case GEN_OTHERNAME:
+                ret = i2d_OTHERNAME(a->d.otherName, pp);
+                break;
+
                 case GEN_EMAIL:
                 case GEN_DNS:
                 case GEN_URI:
@@ -137,12 +140,15 @@ GENERAL_NAME *d2i_GENERAL_NAME(GENERAL_NAME **a, unsigned char **pp,
 
         switch(ret->type) {
                 /* Just put these in a "blob" for now */
-                case GEN_OTHERNAME:
                 case GEN_X400:
                 case GEN_EDIPARTY:
                 M_ASN1_D2I_get_imp(ret->d.other, d2i_ASN1_TYPE,V_ASN1_SEQUENCE);
                 break;
 
+                case GEN_OTHERNAME:
+                M_ASN1_D2I_get_imp(ret->d.otherName, d2i_OTHERNAME,V_ASN1_SEQUENCE);
+                break;
+
                 case GEN_EMAIL:
                 case GEN_DNS:
                 case GEN_URI:
@@ -176,17 +182,20 @@ void GENERAL_NAME_free(GENERAL_NAME *a)
 {
         if (a == NULL) return;
         switch(a->type) {
-                case GEN_OTHERNAME:
                 case GEN_X400:
                 case GEN_EDIPARTY:
                 ASN1_TYPE_free(a->d.other);
                 break;
 
+                case GEN_OTHERNAME:
+                OTHERNAME_free(a->d.otherName);
+                break;
+
                 case GEN_EMAIL:
                 case GEN_DNS:
                 case GEN_URI:
 
-                ASN1_IA5STRING_free(a->d.ia5);
+                M_ASN1_IA5STRING_free(a->d.ia5);
                 break;
 
                 case GEN_DIRNAME:
@@ -194,7 +203,7 @@ void GENERAL_NAME_free(GENERAL_NAME *a)
                 break;
 
                 case GEN_IPADD:
-                ASN1_OCTET_STRING_free(a->d.ip);
+                M_ASN1_OCTET_STRING_free(a->d.ip);
                 break;
         
                 case GEN_RID:
@@ -202,11 +211,11 @@ void GENERAL_NAME_free(GENERAL_NAME *a)
                 break;
 
         }
-        Free ((char *)a);
+        Free (a);
 }
 
-/* Now the GeneralNames versions: a SEQUENCE OF GeneralName These are needed as
- * an explicit functions.
+/* Now the GeneralNames versions: a SEQUENCE OF GeneralName. These are needed as
+ * explicit functions.
  */
 
 STACK_OF(GENERAL_NAME) *GENERAL_NAMES_new()
@@ -235,3 +244,48 @@ return i2d_ASN1_SET_OF_GENERAL_NAME(a, pp, i2d_GENERAL_NAME, V_ASN1_SEQUENCE,
 IMPLEMENT_STACK_OF(GENERAL_NAME)
 IMPLEMENT_ASN1_SET_OF(GENERAL_NAME)
 
+int i2d_OTHERNAME(OTHERNAME *a, unsigned char **pp)
+{
+        int v = 0;
+        M_ASN1_I2D_vars(a);
+
+        M_ASN1_I2D_len(a->type_id, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_len_EXP_opt(a->value, i2d_ASN1_TYPE, 0, v);
+
+        M_ASN1_I2D_seq_total();
+
+        M_ASN1_I2D_put(a->type_id, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_put_EXP_opt(a->value, i2d_ASN1_TYPE, 0, v);
+
+        M_ASN1_I2D_finish();
+}
+
+OTHERNAME *OTHERNAME_new(void)
+{
+        OTHERNAME *ret=NULL;
+        ASN1_CTX c;
+        M_ASN1_New_Malloc(ret, OTHERNAME);
+        ret->type_id = OBJ_nid2obj(NID_undef);
+        M_ASN1_New(ret->value, ASN1_TYPE_new);
+        return (ret);
+        M_ASN1_New_Error(ASN1_F_OTHERNAME_NEW);
+}
+
+OTHERNAME *d2i_OTHERNAME(OTHERNAME **a, unsigned char **pp, long length)
+{
+        M_ASN1_D2I_vars(a,OTHERNAME *,OTHERNAME_new);
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+        M_ASN1_D2I_get(ret->type_id, d2i_ASN1_OBJECT);
+        M_ASN1_D2I_get_EXP_opt(ret->value, d2i_ASN1_TYPE, 0);
+        M_ASN1_D2I_Finish(a, OTHERNAME_free, ASN1_F_D2I_OTHERNAME);
+}
+
+void OTHERNAME_free(OTHERNAME *a)
+{
+        if (a == NULL) return;
+        ASN1_OBJECT_free(a->type_id);
+        ASN1_TYPE_free(a->value);
+        Free (a);
+}
+
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_ia5.c b/src/lib/libssl/src/crypto/x509v3/v3_ia5.c
index 3446c5cd6a..af3525f33e 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_ia5.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_ia5.c
@@ -63,7 +63,6 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
-static ASN1_IA5STRING *ia5string_new(void);
 static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method, ASN1_IA5STRING *ia5);
 static ASN1_IA5STRING *s2i_ASN1_IA5STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
 X509V3_EXT_METHOD v3_ns_ia5_list[] = { 
@@ -78,11 +77,6 @@ EXT_END
 };
 
 
-static ASN1_IA5STRING *ia5string_new(void)
-{
-        return ASN1_IA5STRING_new();
-}
-
 static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method,
              ASN1_IA5STRING *ia5)
 {
@@ -102,12 +96,15 @@ static ASN1_IA5STRING *s2i_ASN1_IA5STRING(X509V3_EXT_METHOD *method,
                 X509V3err(X509V3_F_S2I_ASN1_IA5STRING,X509V3_R_INVALID_NULL_ARGUMENT);
                 return NULL;
         }
-        if(!(ia5 = ASN1_IA5STRING_new())) goto err;
+        if(!(ia5 = M_ASN1_IA5STRING_new())) goto err;
         if(!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char*)str,
                             strlen(str))) {
-                ASN1_IA5STRING_free(ia5);
+                M_ASN1_IA5STRING_free(ia5);
                 goto err;
         }
+#ifdef CHARSET_EBCDIC
+        ebcdic2ascii(ia5->data, ia5->data, ia5->length);
+#endif /*CHARSET_EBCDIC*/
         return ia5;
         err:
         X509V3err(X509V3_F_S2I_ASN1_IA5STRING,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_info.c b/src/lib/libssl/src/crypto/x509v3/v3_info.c
new file mode 100644
index 0000000000..78d2135046
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/v3_info.c
@@ -0,0 +1,236 @@
+/* v3_info.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/conf.h>
+#include <openssl/asn1.h>
+#include <openssl/asn1_mac.h>
+#include <openssl/x509v3.h>
+
+static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
+                                STACK_OF(ACCESS_DESCRIPTION) *ainfo,
+                                                STACK_OF(CONF_VALUE) *ret);
+static STACK_OF(ACCESS_DESCRIPTION) *v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
+                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
+
+X509V3_EXT_METHOD v3_info =
+{ NID_info_access, X509V3_EXT_MULTILINE,
+(X509V3_EXT_NEW)AUTHORITY_INFO_ACCESS_new,
+(X509V3_EXT_FREE)AUTHORITY_INFO_ACCESS_free,
+(X509V3_EXT_D2I)d2i_AUTHORITY_INFO_ACCESS,
+(X509V3_EXT_I2D)i2d_AUTHORITY_INFO_ACCESS,
+NULL, NULL,
+(X509V3_EXT_I2V)i2v_AUTHORITY_INFO_ACCESS,
+(X509V3_EXT_V2I)v2i_AUTHORITY_INFO_ACCESS,
+NULL, NULL, NULL};
+
+static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
+                                STACK_OF(ACCESS_DESCRIPTION) *ainfo,
+                                                STACK_OF(CONF_VALUE) *ret)
+{
+        ACCESS_DESCRIPTION *desc;
+        int i;
+        char objtmp[80], *ntmp;
+        CONF_VALUE *vtmp;
+        for(i = 0; i < sk_ACCESS_DESCRIPTION_num(ainfo); i++) {
+                desc = sk_ACCESS_DESCRIPTION_value(ainfo, i);
+                ret = i2v_GENERAL_NAME(method, desc->location, ret);
+                if(!ret) break;
+                vtmp = sk_CONF_VALUE_value(ret, i);
+                i2t_ASN1_OBJECT(objtmp, 80, desc->method);
+                ntmp = Malloc(strlen(objtmp) + strlen(vtmp->name) + 5);
+                if(!ntmp) {
+                        X509V3err(X509V3_F_I2V_AUTHORITY_INFO_ACCESS,
+                                        ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                }
+                strcpy(ntmp, objtmp);
+                strcat(ntmp, " - ");
+                strcat(ntmp, vtmp->name);
+                Free(vtmp->name);
+                vtmp->name = ntmp;
+                
+        }
+        if(!ret) return sk_CONF_VALUE_new_null();
+        return ret;
+}
+
+static STACK_OF(ACCESS_DESCRIPTION) *v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
+                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
+{
+        STACK_OF(ACCESS_DESCRIPTION) *ainfo = NULL;
+        CONF_VALUE *cnf, ctmp;
+        ACCESS_DESCRIPTION *acc;
+        int i, objlen;
+        char *objtmp, *ptmp;
+        if(!(ainfo = sk_ACCESS_DESCRIPTION_new(NULL))) {
+                X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+        for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
+                cnf = sk_CONF_VALUE_value(nval, i);
+                if(!(acc = ACCESS_DESCRIPTION_new())
+                        || !sk_ACCESS_DESCRIPTION_push(ainfo, acc)) {
+                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+                ptmp = strchr(cnf->name, ';');
+                if(!ptmp) {
+                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,X509V3_R_INVALID_SYNTAX);
+                        goto err;
+                }
+                objlen = ptmp - cnf->name;
+                ctmp.name = ptmp + 1;
+                ctmp.value = cnf->value;
+                if(!(acc->location = v2i_GENERAL_NAME(method, ctx, &ctmp)))
+                                                                 goto err; 
+                if(!(objtmp = Malloc(objlen + 1))) {
+                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+                strncpy(objtmp, cnf->name, objlen);
+                objtmp[objlen] = 0;
+                acc->method = OBJ_txt2obj(objtmp, 0);
+                if(!acc->method) {
+                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,X509V3_R_BAD_OBJECT);
+                        ERR_add_error_data(2, "value=", objtmp);
+                        Free(objtmp);
+                        goto err;
+                }
+                Free(objtmp);
+
+        }
+        return ainfo;
+        err:
+        sk_ACCESS_DESCRIPTION_pop_free(ainfo, ACCESS_DESCRIPTION_free);
+        return NULL;
+}
+
+int i2d_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION *a, unsigned char **pp)
+{
+        M_ASN1_I2D_vars(a);
+
+        M_ASN1_I2D_len(a->method, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_len(a->location, i2d_GENERAL_NAME);
+
+        M_ASN1_I2D_seq_total();
+
+        M_ASN1_I2D_put(a->method, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_put(a->location, i2d_GENERAL_NAME);
+
+        M_ASN1_I2D_finish();
+}
+
+ACCESS_DESCRIPTION *ACCESS_DESCRIPTION_new(void)
+{
+        ACCESS_DESCRIPTION *ret=NULL;
+        ASN1_CTX c;
+        M_ASN1_New_Malloc(ret, ACCESS_DESCRIPTION);
+        ret->method = OBJ_nid2obj(NID_undef);
+        ret->location = NULL;
+        return (ret);
+        M_ASN1_New_Error(ASN1_F_ACCESS_DESCRIPTION_NEW);
+}
+
+ACCESS_DESCRIPTION *d2i_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION **a, unsigned char **pp,
+             long length)
+{
+        M_ASN1_D2I_vars(a,ACCESS_DESCRIPTION *,ACCESS_DESCRIPTION_new);
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+        M_ASN1_D2I_get(ret->method, d2i_ASN1_OBJECT);
+        M_ASN1_D2I_get(ret->location, d2i_GENERAL_NAME);
+        M_ASN1_D2I_Finish(a, ACCESS_DESCRIPTION_free, ASN1_F_D2I_ACCESS_DESCRIPTION);
+}
+
+void ACCESS_DESCRIPTION_free(ACCESS_DESCRIPTION *a)
+{
+        if (a == NULL) return;
+        ASN1_OBJECT_free(a->method);
+        GENERAL_NAME_free(a->location);
+        Free (a);
+}
+
+STACK_OF(ACCESS_DESCRIPTION) *AUTHORITY_INFO_ACCESS_new(void)
+{
+        return sk_ACCESS_DESCRIPTION_new(NULL);
+}
+
+void AUTHORITY_INFO_ACCESS_free(STACK_OF(ACCESS_DESCRIPTION) *a)
+{
+        sk_ACCESS_DESCRIPTION_pop_free(a, ACCESS_DESCRIPTION_free);
+}
+
+STACK_OF(ACCESS_DESCRIPTION) *d2i_AUTHORITY_INFO_ACCESS(STACK_OF(ACCESS_DESCRIPTION) **a,
+                                         unsigned char **pp, long length)
+{
+return d2i_ASN1_SET_OF_ACCESS_DESCRIPTION(a, pp, length, d2i_ACCESS_DESCRIPTION,
+                         ACCESS_DESCRIPTION_free, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+}
+
+int i2d_AUTHORITY_INFO_ACCESS(STACK_OF(ACCESS_DESCRIPTION) *a, unsigned char **pp)
+{
+return i2d_ASN1_SET_OF_ACCESS_DESCRIPTION(a, pp, i2d_ACCESS_DESCRIPTION, V_ASN1_SEQUENCE,
+                                                 V_ASN1_UNIVERSAL, IS_SEQUENCE);
+}
+
+IMPLEMENT_STACK_OF(ACCESS_DESCRIPTION)
+IMPLEMENT_ASN1_SET_OF(ACCESS_DESCRIPTION)
+
+
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_int.c b/src/lib/libssl/src/crypto/x509v3/v3_int.c
index 637dd5e128..63c201e5f4 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_int.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_int.c
@@ -60,20 +60,13 @@
 #include "cryptlib.h"
 #include <openssl/x509v3.h>
 
-static ASN1_INTEGER *asn1_integer_new(void);
-
 X509V3_EXT_METHOD v3_crl_num = { 
 NID_crl_number, 0,
-(X509V3_EXT_NEW)asn1_integer_new,
-(X509V3_EXT_FREE)ASN1_STRING_free,
+(X509V3_EXT_NEW)ASN1_INTEGER_new,
+(X509V3_EXT_FREE)ASN1_INTEGER_free,
 (X509V3_EXT_D2I)d2i_ASN1_INTEGER,
 (X509V3_EXT_I2D)i2d_ASN1_INTEGER,
 (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
-(X509V3_EXT_S2I)NULL,
+(X509V3_EXT_S2I)0,
 NULL, NULL, NULL, NULL, NULL};
 
-
-static ASN1_INTEGER *asn1_integer_new(void)
-{
-        return ASN1_INTEGER_new();
-}
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_lib.c b/src/lib/libssl/src/crypto/x509v3/v3_lib.c
index a0aa5de794..4242d130a2 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_lib.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_lib.c
@@ -62,6 +62,8 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
+#include "ext_dat.h"
+
 static STACK *ext_list = NULL;
 
 static int ext_cmp(X509V3_EXT_METHOD **a, X509V3_EXT_METHOD **b);
@@ -87,10 +89,15 @@ static int ext_cmp(X509V3_EXT_METHOD **a, X509V3_EXT_METHOD **b)
 
 X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
 {
-        X509V3_EXT_METHOD tmp;
+        X509V3_EXT_METHOD tmp, *t = &tmp, **ret;
         int idx;
+        if(nid < 0) return NULL;
         tmp.ext_nid = nid;
-        if(!ext_list || (tmp.ext_nid < 0) ) return NULL;
+        ret = (X509V3_EXT_METHOD **) OBJ_bsearch((char *)&t,
+                        (char *)standard_exts, STANDARD_EXTENSION_COUNT,
+                        sizeof(X509V3_EXT_METHOD *), (int (*)())ext_cmp);
+        if(ret) return *ret;
+        if(!ext_list) return NULL;
         idx = sk_find(ext_list, (char *)&tmp);
         if(idx == -1) return NULL;
         return (X509V3_EXT_METHOD *)sk_value(ext_list, idx);
@@ -125,7 +132,7 @@ int X509V3_EXT_add_alias(int nid_to, int nid_from)
         *tmpext = *ext;
         tmpext->ext_nid = nid_to;
         tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
-        return 1;
+        return X509V3_EXT_add(tmpext);
 }
 
 void X509V3_EXT_cleanup(void)
@@ -139,28 +146,12 @@ static void ext_list_free(X509V3_EXT_METHOD *ext)
         if(ext->ext_flags & X509V3_EXT_DYNAMIC) Free(ext);
 }
 
-extern X509V3_EXT_METHOD v3_bcons, v3_nscert, v3_key_usage, v3_ext_ku;
-extern X509V3_EXT_METHOD v3_pkey_usage_period, v3_sxnet;
-extern X509V3_EXT_METHOD v3_ns_ia5_list[], v3_alt[], v3_skey_id, v3_akey_id;
-
-extern X509V3_EXT_METHOD v3_crl_num, v3_crl_reason, v3_cpols, v3_crld;
+/* Legacy function: we don't need to add standard extensions
+ * any more because they are now kept in ext_dat.h.
+ */
 
 int X509V3_add_standard_extensions(void)
 {
-        X509V3_EXT_add_list(v3_ns_ia5_list);
-        X509V3_EXT_add_list(v3_alt);
-        X509V3_EXT_add(&v3_bcons);
-        X509V3_EXT_add(&v3_nscert);
-        X509V3_EXT_add(&v3_key_usage);
-        X509V3_EXT_add(&v3_ext_ku);
-        X509V3_EXT_add(&v3_skey_id);
-        X509V3_EXT_add(&v3_akey_id);
-        X509V3_EXT_add(&v3_pkey_usage_period);
-        X509V3_EXT_add(&v3_crl_num);
-        X509V3_EXT_add(&v3_sxnet);
-        X509V3_EXT_add(&v3_crl_reason);
-        X509V3_EXT_add(&v3_cpols);
-        X509V3_EXT_add(&v3_crld);
         return 1;
 }
 
@@ -175,3 +166,56 @@ void *X509V3_EXT_d2i(X509_EXTENSION *ext)
         return method->d2i(NULL, &p, ext->value->length);
 }
 
+/* Get critical flag and decoded version of extension from a NID.
+ * The "idx" variable returns the last found extension and can
+ * be used to retrieve multiple extensions of the same NID.
+ * However multiple extensions with the same NID is usually
+ * due to a badly encoded certificate so if idx is NULL we
+ * choke if multiple extensions exist.
+ * The "crit" variable is set to the critical value.
+ * The return value is the decoded extension or NULL on
+ * error. The actual error can have several different causes,
+ * the value of *crit reflects the cause:
+ * >= 0, extension found but not decoded (reflects critical value).
+ * -1 extension not found.
+ * -2 extension occurs more than once.
+ */
+
+void *X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx)
+{
+        int lastpos, i;
+        X509_EXTENSION *ex, *found_ex = NULL;
+        if(!x) {
+                if(idx) *idx = -1;
+                if(crit) *crit = -1;
+                return NULL;
+        }
+        if(idx) lastpos = *idx + 1;
+        else lastpos = 0;
+        if(lastpos < 0) lastpos = 0;
+        for(i = lastpos; i < sk_X509_EXTENSION_num(x); i++)
+        {
+                ex = sk_X509_EXTENSION_value(x, i);
+                if(OBJ_obj2nid(ex->object) == nid) {
+                        if(idx) {
+                                *idx = i;
+                                break;
+                        } else if(found_ex) {
+                                /* Found more than one */
+                                if(crit) *crit = -2;
+                                return NULL;
+                        }
+                        found_ex = ex;
+                }
+        }
+        if(found_ex) {
+                /* Found it */
+                if(crit) *crit = found_ex->critical;
+                return X509V3_EXT_d2i(found_ex);
+        }
+        
+        /* Extension not found */
+        if(idx) *idx = -1;
+        if(crit) *crit = -1;
+        return NULL;
+}
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_pku.c b/src/lib/libssl/src/crypto/x509v3/v3_pku.c
index c13e7d8f45..30a62c6090 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_pku.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_pku.c
@@ -119,9 +119,9 @@ PKEY_USAGE_PERIOD *d2i_PKEY_USAGE_PERIOD(PKEY_USAGE_PERIOD **a,
 void PKEY_USAGE_PERIOD_free(PKEY_USAGE_PERIOD *a)
 {
         if (a == NULL) return;
-        ASN1_GENERALIZEDTIME_free(a->notBefore);
-        ASN1_GENERALIZEDTIME_free(a->notAfter);
-        Free ((char *)a);
+        M_ASN1_GENERALIZEDTIME_free(a->notBefore);
+        M_ASN1_GENERALIZEDTIME_free(a->notAfter);
+        Free (a);
 }
 
 static int i2r_PKEY_USAGE_PERIOD(X509V3_EXT_METHOD *method,
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_prn.c b/src/lib/libssl/src/crypto/x509v3/v3_prn.c
index dc20c6bdba..bee624c6be 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_prn.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_prn.c
@@ -81,7 +81,15 @@ void X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent, int ml)
                 nval = sk_CONF_VALUE_value(val, i);
                 if(!nval->name) BIO_puts(out, nval->value);
                 else if(!nval->value) BIO_puts(out, nval->name);
+#ifndef CHARSET_EBCDIC
                 else BIO_printf(out, "%s:%s", nval->name, nval->value);
+#else
+                else {
+                        char tmp[10240]; /* 10k is BIO_printf's limit anyway */
+                        ascii2ebcdic(tmp, nval->value, strlen(nval->value)+1);
+                        BIO_printf(out, "%s:%s", nval->name, tmp);
+                }
+#endif
                 if(ml) BIO_puts(out, "\n");
         }
 }
@@ -103,7 +111,15 @@ int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, int flag, int indent)
                         ok = 0;
                         goto err;
                 }
+#ifndef CHARSET_EBCDIC
                 BIO_printf(out, "%*s%s", indent, "", value);
+#else
+                {
+                        char tmp[10240]; /* 10k is BIO_printf's limit anyway */
+                        ascii2ebcdic(tmp, value, strlen(value)+1);
+                        BIO_printf(out, "%*s%s", indent, "", tmp);
+                }
+#endif
         } else if(method->i2v) {
                 if(!(nval = method->i2v(method, ext_str, NULL))) {
                         ok = 0;
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_purp.c b/src/lib/libssl/src/crypto/x509v3/v3_purp.c
new file mode 100644
index 0000000000..b7494ebcd5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/v3_purp.c
@@ -0,0 +1,456 @@
+/* v3_purp.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509v3.h>
+
+
+static void x509v3_cache_extensions(X509 *x);
+
+static int ca_check(X509 *x);
+static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca);
+static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
+static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
+static int purpose_smime(X509 *x, int ca);
+static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca);
+static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca);
+static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca);
+
+static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b);
+static void xptable_free(X509_PURPOSE *p);
+
+static X509_PURPOSE xstandard[] = {
+        {X509_PURPOSE_SSL_CLIENT, X509_TRUST_SSL_CLIENT, 0, check_purpose_ssl_client, "SSL client", "sslclient", NULL},
+        {X509_PURPOSE_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ssl_server, "SSL server", "sslserver", NULL},
+        {X509_PURPOSE_NS_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ns_ssl_server, "Netscape SSL server", "nssslserver", NULL},
+        {X509_PURPOSE_SMIME_SIGN, X509_TRUST_EMAIL, 0, check_purpose_smime_sign, "S/MIME signing", "smimesign", NULL},
+        {X509_PURPOSE_SMIME_ENCRYPT, X509_TRUST_EMAIL, 0, check_purpose_smime_encrypt, "S/MIME encryption", "smimeencrypt", NULL},
+        {X509_PURPOSE_CRL_SIGN, X509_TRUST_ANY, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
+};
+
+#define X509_PURPOSE_COUNT (sizeof(xstandard)/sizeof(X509_PURPOSE))
+
+IMPLEMENT_STACK_OF(X509_PURPOSE)
+
+static STACK_OF(X509_PURPOSE) *xptable = NULL;
+
+static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b)
+{
+        return (*a)->purpose - (*b)->purpose;
+}
+
+int X509_check_purpose(X509 *x, int id, int ca)
+{
+        int idx;
+        X509_PURPOSE *pt;
+        if(!(x->ex_flags & EXFLAG_SET)) {
+                CRYPTO_w_lock(CRYPTO_LOCK_X509);
+                x509v3_cache_extensions(x);
+                CRYPTO_w_unlock(CRYPTO_LOCK_X509);
+        }
+        if(id == -1) return 1;
+        idx = X509_PURPOSE_get_by_id(id);
+        if(idx == -1) return -1;
+        pt = X509_PURPOSE_get0(idx);
+        return pt->check_purpose(pt, x, ca);
+}
+
+int X509_PURPOSE_get_count(void)
+{
+        if(!xptable) return X509_PURPOSE_COUNT;
+        return sk_X509_PURPOSE_num(xptable) + X509_PURPOSE_COUNT;
+}
+
+X509_PURPOSE * X509_PURPOSE_get0(int idx)
+{
+        if(idx < 0) return NULL;
+        if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
+        return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
+}
+
+int X509_PURPOSE_get_by_sname(char *sname)
+{
+        int i;
+        X509_PURPOSE *xptmp;
+        for(i = 0; i < X509_PURPOSE_get_count(); i++) {
+                xptmp = X509_PURPOSE_get0(i);
+                if(!strcmp(xptmp->sname, sname)) return i;
+        }
+        return -1;
+}
+
+
+int X509_PURPOSE_get_by_id(int purpose)
+{
+        X509_PURPOSE tmp;
+        int idx;
+        if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
+                return purpose - X509_PURPOSE_MIN;
+        tmp.purpose = purpose;
+        if(!xptable) return -1;
+        idx = sk_X509_PURPOSE_find(xptable, &tmp);
+        if(idx == -1) return -1;
+        return idx + X509_PURPOSE_COUNT;
+}
+
+int X509_PURPOSE_add(int id, int trust, int flags,
+                        int (*ck)(X509_PURPOSE *, X509 *, int),
+                                        char *name, char *sname, void *arg)
+{
+        int idx;
+        X509_PURPOSE *ptmp;
+        /* This is set according to what we change: application can't set it */
+        flags &= ~X509_PURPOSE_DYNAMIC;
+        /* This will always be set for application modified trust entries */
+        flags |= X509_PURPOSE_DYNAMIC_NAME;
+        /* Get existing entry if any */
+        idx = X509_PURPOSE_get_by_id(id);
+        /* Need a new entry */
+        if(idx == -1) {
+                if(!(ptmp = Malloc(sizeof(X509_PURPOSE)))) {
+                        X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                ptmp->flags = X509_PURPOSE_DYNAMIC;
+        } else ptmp = X509_PURPOSE_get0(idx);
+
+        /* Free existing name if dynamic */
+        if(ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
+                Free(ptmp->name);
+                Free(ptmp->sname);
+        }
+        /* dup supplied name */
+        ptmp->name = BUF_strdup(name);
+        ptmp->sname = BUF_strdup(sname);
+        if(!ptmp->name || !ptmp->sname) {
+                X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        /* Keep the dynamic flag of existing entry */
+        ptmp->flags &= X509_PURPOSE_DYNAMIC;
+        /* Set all other flags */
+        ptmp->flags |= flags;
+
+        ptmp->purpose = id;
+        ptmp->trust = trust;
+        ptmp->check_purpose = ck;
+        ptmp->usr_data = arg;
+
+        /* If its a new entry manage the dynamic table */
+        if(idx == -1) {
+                if(!xptable && !(xptable = sk_X509_PURPOSE_new(xp_cmp))) {
+                        X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                if (!sk_X509_PURPOSE_push(xptable, ptmp)) {
+                        X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+static void xptable_free(X509_PURPOSE *p)
+        {
+        if(!p) return;
+        if (p->flags & X509_PURPOSE_DYNAMIC) 
+                {
+                if (p->flags & X509_PURPOSE_DYNAMIC_NAME) {
+                        Free(p->name);
+                        Free(p->sname);
+                }
+                Free(p);
+                }
+        }
+
+void X509_PURPOSE_cleanup(void)
+{
+        int i;
+        sk_X509_PURPOSE_pop_free(xptable, xptable_free);
+        for(i = 0; i < X509_PURPOSE_COUNT; i++) xptable_free(xstandard + i);
+        xptable = NULL;
+}
+
+int X509_PURPOSE_get_id(X509_PURPOSE *xp)
+{
+        return xp->purpose;
+}
+
+char *X509_PURPOSE_get0_name(X509_PURPOSE *xp)
+{
+        return xp->name;
+}
+
+char *X509_PURPOSE_get0_sname(X509_PURPOSE *xp)
+{
+        return xp->sname;
+}
+
+int X509_PURPOSE_get_trust(X509_PURPOSE *xp)
+{
+        return xp->trust;
+}
+
+#ifndef NO_SHA
+static void x509v3_cache_extensions(X509 *x)
+{
+        BASIC_CONSTRAINTS *bs;
+        ASN1_BIT_STRING *usage;
+        ASN1_BIT_STRING *ns;
+        STACK_OF(ASN1_OBJECT) *extusage;
+        int i;
+        if(x->ex_flags & EXFLAG_SET) return;
+        X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
+        /* Does subject name match issuer ? */
+        if(!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
+                         x->ex_flags |= EXFLAG_SS;
+        /* V1 should mean no extensions ... */
+        if(!X509_get_version(x)) x->ex_flags |= EXFLAG_V1;
+        /* Handle basic constraints */
+        if((bs=X509_get_ext_d2i(x, NID_basic_constraints, NULL, NULL))) {
+                if(bs->ca) x->ex_flags |= EXFLAG_CA;
+                if(bs->pathlen) {
+                        if((bs->pathlen->type == V_ASN1_NEG_INTEGER)
+                                                || !bs->ca) {
+                                x->ex_flags |= EXFLAG_INVALID;
+                                x->ex_pathlen = 0;
+                        } else x->ex_pathlen = ASN1_INTEGER_get(bs->pathlen);
+                } else x->ex_pathlen = -1;
+                BASIC_CONSTRAINTS_free(bs);
+                x->ex_flags |= EXFLAG_BCONS;
+        }
+        /* Handle key usage */
+        if((usage=X509_get_ext_d2i(x, NID_key_usage, NULL, NULL))) {
+                if(usage->length > 0) {
+                        x->ex_kusage = usage->data[0];
+                        if(usage->length > 1) 
+                                x->ex_kusage |= usage->data[1] << 8;
+                } else x->ex_kusage = 0;
+                x->ex_flags |= EXFLAG_KUSAGE;
+                ASN1_BIT_STRING_free(usage);
+        }
+        x->ex_xkusage = 0;
+        if((extusage=X509_get_ext_d2i(x, NID_ext_key_usage, NULL, NULL))) {
+                x->ex_flags |= EXFLAG_XKUSAGE;
+                for(i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
+                        switch(OBJ_obj2nid(sk_ASN1_OBJECT_value(extusage,i))) {
+                                case NID_server_auth:
+                                x->ex_xkusage |= XKU_SSL_SERVER;
+                                break;
+
+                                case NID_client_auth:
+                                x->ex_xkusage |= XKU_SSL_CLIENT;
+                                break;
+
+                                case NID_email_protect:
+                                x->ex_xkusage |= XKU_SMIME;
+                                break;
+
+                                case NID_code_sign:
+                                x->ex_xkusage |= XKU_CODE_SIGN;
+                                break;
+
+                                case NID_ms_sgc:
+                                case NID_ns_sgc:
+                                x->ex_xkusage |= XKU_SGC;
+                        }
+                }
+                sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
+        }
+
+        if((ns=X509_get_ext_d2i(x, NID_netscape_cert_type, NULL, NULL))) {
+                if(ns->length > 0) x->ex_nscert = ns->data[0];
+                else x->ex_nscert = 0;
+                x->ex_flags |= EXFLAG_NSCERT;
+                ASN1_BIT_STRING_free(ns);
+        }
+        x->ex_flags |= EXFLAG_SET;
+}
+#endif
+
+/* CA checks common to all purposes
+ * return codes:
+ * 0 not a CA
+ * 1 is a CA
+ * 2 basicConstraints absent so "maybe" a CA
+ * 3 basicConstraints absent but self signed V1.
+ */
+
+#define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
+#define ku_reject(x, usage) \
+        (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
+#define xku_reject(x, usage) \
+        (((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
+#define ns_reject(x, usage) \
+        (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
+
+static int ca_check(X509 *x)
+{
+        /* keyUsage if present should allow cert signing */
+        if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;
+        if(x->ex_flags & EXFLAG_BCONS) {
+                if(x->ex_flags & EXFLAG_CA) return 1;
+                /* If basicConstraints says not a CA then say so */
+                else return 0;
+        } else {
+                if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;
+                else return 2;
+        }
+}
+
+
+static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
+        if(ca) {
+                int ca_ret;
+                ca_ret = ca_check(x);
+                if(!ca_ret) return 0;
+                /* check nsCertType if present */
+                if(x->ex_flags & EXFLAG_NSCERT) {
+                        if(x->ex_nscert & NS_SSL_CA) return ca_ret;
+                        return 0;
+                }
+                if(ca_ret != 2) return ca_ret;
+                else return 0;
+        }
+        /* We need to do digital signatures with it */
+        if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0;
+        /* nsCertType if present should allow SSL client use */ 
+        if(ns_reject(x, NS_SSL_CLIENT)) return 0;
+        return 1;
+}
+
+static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        if(xku_reject(x,XKU_SSL_SERVER|XKU_SGC)) return 0;
+        /* Otherwise same as SSL client for a CA */
+        if(ca) return check_purpose_ssl_client(xp, x, 1);
+
+        if(ns_reject(x, NS_SSL_SERVER)) return 0;
+        /* Now as for keyUsage: we'll at least need to sign OR encipher */
+        if(ku_reject(x, KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT)) return 0;
+        
+        return 1;
+
+}
+
+static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        int ret;
+        ret = check_purpose_ssl_server(xp, x, ca);
+        if(!ret || ca) return ret;
+        /* We need to encipher or Netscape complains */
+        if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
+        return ret;
+}
+
+/* common S/MIME checks */
+static int purpose_smime(X509 *x, int ca)
+{
+        if(xku_reject(x,XKU_SMIME)) return 0;
+        if(ca) {
+                int ca_ret;
+                ca_ret = ca_check(x);
+                if(!ca_ret) return 0;
+                /* check nsCertType if present */
+                if(x->ex_flags & EXFLAG_NSCERT) {
+                        if(x->ex_nscert & NS_SMIME_CA) return ca_ret;
+                        return 0;
+                }
+                if(ca_ret != 2) return ca_ret;
+                else return 0;
+        }
+        if(x->ex_flags & EXFLAG_NSCERT) {
+                if(x->ex_nscert & NS_SMIME) return 1;
+                /* Workaround for some buggy certificates */
+                if(x->ex_nscert & NS_SSL_CLIENT) return 2;
+                return 0;
+        }
+        return 1;
+}
+
+static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        int ret;
+        ret = purpose_smime(x, ca);
+        if(!ret || ca) return ret;
+        if(ku_reject(x, KU_DIGITAL_SIGNATURE)) return 0;
+        return ret;
+}
+
+static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        int ret;
+        ret = purpose_smime(x, ca);
+        if(!ret || ca) return ret;
+        if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
+        return ret;
+}
+
+static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca)
+{
+        if(ca) {
+                int ca_ret;
+                if((ca_ret = ca_check(x)) != 2) return ca_ret;
+                else return 0;
+        }
+        if(ku_reject(x, KU_CRL_SIGN)) return 0;
+        return 1;
+}
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_skey.c b/src/lib/libssl/src/crypto/x509v3/v3_skey.c
index fb3e36014d..939845fa8f 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_skey.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_skey.c
@@ -61,24 +61,17 @@
 #include "cryptlib.h"
 #include <openssl/x509v3.h>
 
-static ASN1_OCTET_STRING *octet_string_new(void);
 static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
 X509V3_EXT_METHOD v3_skey_id = { 
 NID_subject_key_identifier, 0,
-(X509V3_EXT_NEW)octet_string_new,
-(X509V3_EXT_FREE)ASN1_STRING_free,
+(X509V3_EXT_NEW)ASN1_OCTET_STRING_new,
+(X509V3_EXT_FREE)ASN1_OCTET_STRING_free,
 (X509V3_EXT_D2I)d2i_ASN1_OCTET_STRING,
 (X509V3_EXT_I2D)i2d_ASN1_OCTET_STRING,
 (X509V3_EXT_I2S)i2s_ASN1_OCTET_STRING,
 (X509V3_EXT_S2I)s2i_skey_id,
 NULL, NULL, NULL, NULL, NULL};
 
-
-static ASN1_OCTET_STRING *octet_string_new(void)
-{
-        return ASN1_OCTET_STRING_new();
-}
-
 char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method,
              ASN1_OCTET_STRING *oct)
 {
@@ -91,13 +84,13 @@ ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method,
         ASN1_OCTET_STRING *oct;
         long length;
 
-        if(!(oct = ASN1_OCTET_STRING_new())) {
+        if(!(oct = M_ASN1_OCTET_STRING_new())) {
                 X509V3err(X509V3_F_S2I_ASN1_OCTET_STRING,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
 
         if(!(oct->data = string_to_hex(str, &length))) {
-                ASN1_OCTET_STRING_free(oct);
+                M_ASN1_OCTET_STRING_free(oct);
                 return NULL;
         }
 
@@ -118,7 +111,7 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
 
         if(strcmp(str, "hash")) return s2i_ASN1_OCTET_STRING(method, ctx, str);
 
-        if(!(oct = ASN1_OCTET_STRING_new())) {
+        if(!(oct = M_ASN1_OCTET_STRING_new())) {
                 X509V3err(X509V3_F_S2I_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -143,7 +136,7 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
         EVP_DigestUpdate(&md, pk->data, pk->length);
         EVP_DigestFinal(&md, pkey_dig, &diglen);
 
-        if(!ASN1_OCTET_STRING_set(oct, pkey_dig, diglen)) {
+        if(!M_ASN1_OCTET_STRING_set(oct, pkey_dig, diglen)) {
                 X509V3err(X509V3_F_S2I_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
@@ -151,6 +144,6 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
         return oct;
         
         err:
-        ASN1_OCTET_STRING_free(oct);
+        M_ASN1_OCTET_STRING_free(oct);
         return NULL;
 }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_sxnet.c b/src/lib/libssl/src/crypto/x509v3/v3_sxnet.c
index 0687bb4e3d..20ba8ac8d6 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_sxnet.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_sxnet.c
@@ -111,7 +111,7 @@ SXNET *SXNET_new(void)
         SXNET *ret=NULL;
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, SXNET);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
         M_ASN1_New(ret->ids,sk_SXNETID_new_null);
         return (ret);
         M_ASN1_New_Error(ASN1_F_SXNET_NEW);
@@ -130,7 +130,7 @@ SXNET *d2i_SXNET(SXNET **a, unsigned char **pp, long length)
 void SXNET_free(SXNET *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
         sk_SXNETID_pop_free(a->ids, SXNETID_free);
         Free (a);
 }
@@ -156,7 +156,7 @@ SXNETID *SXNETID_new(void)
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, SXNETID);
         ret->zone = NULL;
-        M_ASN1_New(ret->user,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->user,M_ASN1_OCTET_STRING_new);
         return (ret);
         M_ASN1_New_Error(ASN1_F_SXNETID_NEW);
 }
@@ -174,8 +174,8 @@ SXNETID *d2i_SXNETID(SXNETID **a, unsigned char **pp, long length)
 void SXNETID_free(SXNETID *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free(a->zone);
-        ASN1_OCTET_STRING_free(a->user);
+        M_ASN1_INTEGER_free(a->zone);
+        M_ASN1_OCTET_STRING_free(a->user);
         Free (a);
 }
 
@@ -193,7 +193,7 @@ static int sxnet_i2r(X509V3_EXT_METHOD *method, SXNET *sx, BIO *out,
                 tmp = i2s_ASN1_INTEGER(NULL, id->zone);
                 BIO_printf(out, "\n%*sZone: %s, User: ", indent, "", tmp);
                 Free(tmp);
-                ASN1_OCTET_STRING_print(out, id->user);
+                M_ASN1_OCTET_STRING_print(out, id->user);
         }
         return 1;
 }
@@ -244,9 +244,9 @@ int SXNET_add_id_ulong(SXNET **psx, unsigned long lzone, char *user,
              int userlen)
 {
         ASN1_INTEGER *izone = NULL;
-        if(!(izone = ASN1_INTEGER_new()) || !ASN1_INTEGER_set(izone, lzone)) {
+        if(!(izone = M_ASN1_INTEGER_new()) || !ASN1_INTEGER_set(izone, lzone)) {
                 X509V3err(X509V3_F_SXNET_ADD_ID_ULONG,ERR_R_MALLOC_FAILURE);
-                ASN1_INTEGER_free(izone);
+                M_ASN1_INTEGER_free(izone);
                 return 0;
         }
         return SXNET_add_id_INTEGER(psx, izone, user, userlen);
@@ -285,7 +285,7 @@ int SXNET_add_id_INTEGER(SXNET **psx, ASN1_INTEGER *zone, char *user,
         if(!(id = SXNETID_new())) goto err;
         if(userlen == -1) userlen = strlen(user);
                 
-        if(!ASN1_OCTET_STRING_set(id->user, user, userlen)) goto err;
+        if(!M_ASN1_OCTET_STRING_set(id->user, user, userlen)) goto err;
         if(!sk_SXNETID_push(sx->ids, id)) goto err;
         id->zone = zone;
         return 1;
@@ -307,7 +307,7 @@ ASN1_OCTET_STRING *SXNET_get_id_asc(SXNET *sx, char *zone)
                 return NULL;
         }
         oct = SXNET_get_id_INTEGER(sx, izone);
-        ASN1_INTEGER_free(izone);
+        M_ASN1_INTEGER_free(izone);
         return oct;
 }
 
@@ -315,13 +315,13 @@ ASN1_OCTET_STRING *SXNET_get_id_ulong(SXNET *sx, unsigned long lzone)
 {
         ASN1_INTEGER *izone = NULL;
         ASN1_OCTET_STRING *oct;
-        if(!(izone = ASN1_INTEGER_new()) || !ASN1_INTEGER_set(izone, lzone)) {
+        if(!(izone = M_ASN1_INTEGER_new()) || !ASN1_INTEGER_set(izone, lzone)) {
                 X509V3err(X509V3_F_SXNET_GET_ID_ULONG,ERR_R_MALLOC_FAILURE);
-                ASN1_INTEGER_free(izone);
+                M_ASN1_INTEGER_free(izone);
                 return NULL;
         }
         oct = SXNET_get_id_INTEGER(sx, izone);
-        ASN1_INTEGER_free(izone);
+        M_ASN1_INTEGER_free(izone);
         return oct;
 }
 
@@ -331,7 +331,7 @@ ASN1_OCTET_STRING *SXNET_get_id_INTEGER(SXNET *sx, ASN1_INTEGER *zone)
         int i;
         for(i = 0; i < sk_SXNETID_num(sx->ids); i++) {
                 id = sk_SXNETID_value(sx->ids, i);
-                if(!ASN1_INTEGER_cmp(id->zone, zone)) return id->user;
+                if(!M_ASN1_INTEGER_cmp(id->zone, zone)) return id->user;
         }
         return NULL;
 }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_utl.c b/src/lib/libssl/src/crypto/x509v3/v3_utl.c
index 40f71c71b4..4c2c4a9483 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_utl.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_utl.c
@@ -104,7 +104,7 @@ void X509V3_conf_free(CONF_VALUE *conf)
         if(conf->name) Free(conf->name);
         if(conf->value) Free(conf->value);
         if(conf->section) Free(conf->section);
-        Free((char *)conf);
+        Free(conf);
 }
 
 int X509V3_add_value_bool(const char *name, int asn1_bool,
diff --git a/src/lib/libssl/src/crypto/x509v3/v3err.c b/src/lib/libssl/src/crypto/x509v3/v3err.c
index 50efa8d99d..b7d4e350c4 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3err.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3err.c
@@ -72,6 +72,7 @@ static ERR_STRING_DATA X509V3_str_functs[]=
 {ERR_PACK(0,X509V3_F_HEX_TO_STRING,0),  "hex_to_string"},
 {ERR_PACK(0,X509V3_F_I2S_ASN1_ENUMERATED,0),    "i2s_ASN1_ENUMERATED"},
 {ERR_PACK(0,X509V3_F_I2S_ASN1_INTEGER,0),       "i2s_ASN1_INTEGER"},
+{ERR_PACK(0,X509V3_F_I2V_AUTHORITY_INFO_ACCESS,0),      "I2V_AUTHORITY_INFO_ACCESS"},
 {ERR_PACK(0,X509V3_F_NOTICE_SECTION,0), "NOTICE_SECTION"},
 {ERR_PACK(0,X509V3_F_NREF_NOS,0),       "NREF_NOS"},
 {ERR_PACK(0,X509V3_F_POLICY_SECTION,0), "POLICY_SECTION"},
@@ -87,6 +88,7 @@ static ERR_STRING_DATA X509V3_str_functs[]=
 {ERR_PACK(0,X509V3_F_SXNET_ADD_ID_ULONG,0),     "SXNET_add_id_ulong"},
 {ERR_PACK(0,X509V3_F_SXNET_GET_ID_ASC,0),       "SXNET_get_id_asc"},
 {ERR_PACK(0,X509V3_F_SXNET_GET_ID_ULONG,0),     "SXNET_get_id_ulong"},
+{ERR_PACK(0,X509V3_F_V2I_ACCESS_DESCRIPTION,0), "V2I_ACCESS_DESCRIPTION"},
 {ERR_PACK(0,X509V3_F_V2I_ASN1_BIT_STRING,0),    "V2I_ASN1_BIT_STRING"},
 {ERR_PACK(0,X509V3_F_V2I_AUTHORITY_KEYID,0),    "V2I_AUTHORITY_KEYID"},
 {ERR_PACK(0,X509V3_F_V2I_BASIC_CONSTRAINTS,0),  "V2I_BASIC_CONSTRAINTS"},
@@ -102,6 +104,7 @@ static ERR_STRING_DATA X509V3_str_functs[]=
 {ERR_PACK(0,X509V3_F_X509V3_EXT_I2D,0), "X509V3_EXT_i2d"},
 {ERR_PACK(0,X509V3_F_X509V3_GET_VALUE_BOOL,0),  "X509V3_get_value_bool"},
 {ERR_PACK(0,X509V3_F_X509V3_PARSE_LIST,0),      "X509V3_parse_list"},
+{ERR_PACK(0,X509V3_F_X509_PURPOSE_ADD,0),       "X509_PURPOSE_add"},
 {0,NULL}
         };
 
@@ -132,6 +135,7 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {X509V3_R_INVALID_OPTION                 ,"invalid option"},
 {X509V3_R_INVALID_POLICY_IDENTIFIER      ,"invalid policy identifier"},
 {X509V3_R_INVALID_SECTION                ,"invalid section"},
+{X509V3_R_INVALID_SYNTAX                 ,"invalid syntax"},
 {X509V3_R_ISSUER_DECODE_ERROR            ,"issuer decode error"},
 {X509V3_R_MISSING_VALUE                  ,"missing value"},
 {X509V3_R_NEED_ORGANIZATION_AND_NUMBERS  ,"need organization and numbers"},
diff --git a/src/lib/libssl/src/crypto/x509v3/x509v3.h b/src/lib/libssl/src/crypto/x509v3/x509v3.h
index 4eb04a5a89..fe01755797 100644
--- a/src/lib/libssl/src/crypto/x509v3/x509v3.h
+++ b/src/lib/libssl/src/crypto/x509v3/x509v3.h
@@ -136,12 +136,6 @@ typedef struct v3_ext_ctx X509V3_CTX;
 #define X509V3_EXT_CTX_DEP      0x2
 #define X509V3_EXT_MULTILINE    0x4
 
-typedef struct BIT_STRING_BITNAME_st {
-int bitnum;
-const char *lname;
-const char *sname;
-} BIT_STRING_BITNAME;
-
 typedef BIT_STRING_BITNAME ENUMERATED_NAMES;
 
 typedef struct BASIC_CONSTRAINTS_st {
@@ -155,6 +149,11 @@ ASN1_GENERALIZEDTIME *notBefore;
 ASN1_GENERALIZEDTIME *notAfter;
 } PKEY_USAGE_PERIOD;
 
+typedef struct otherName_st {
+ASN1_OBJECT *type_id;
+ASN1_TYPE *value;
+} OTHERNAME;
+
 typedef struct GENERAL_NAME_st {
 
 #define GEN_OTHERNAME   (0|V_ASN1_CONTEXT_SPECIFIC)
@@ -174,17 +173,26 @@ union {
         ASN1_OCTET_STRING *ip; /* iPAddress */
         X509_NAME *dirn;                /* dirn */
         ASN1_OBJECT *rid; /* registeredID */
-        ASN1_TYPE *other; /* otherName, ediPartyName, x400Address */
+        OTHERNAME *otherName; /* otherName */
+        ASN1_TYPE *other; /* ediPartyName, x400Address */
 } d;
 } GENERAL_NAME;
 
+typedef struct ACCESS_DESCRIPTION_st {
+ASN1_OBJECT *method;
+GENERAL_NAME *location;
+} ACCESS_DESCRIPTION;
+
 DECLARE_STACK_OF(GENERAL_NAME)
 DECLARE_ASN1_SET_OF(GENERAL_NAME)
 
+DECLARE_STACK_OF(ACCESS_DESCRIPTION)
+DECLARE_ASN1_SET_OF(ACCESS_DESCRIPTION)
+
 typedef struct DIST_POINT_NAME_st {
 /* NB: this is a CHOICE type and only one of these should be set */
 STACK_OF(GENERAL_NAME) *fullname;
-X509_NAME *relativename;
+STACK_OF(X509_NAME_ENTRY) *relativename;
 } DIST_POINT_NAME;
 
 typedef struct DIST_POINT_st {
@@ -255,8 +263,8 @@ DECLARE_ASN1_SET_OF(POLICYINFO)
 #define X509V3_set_ctx_nodb(ctx) ctx->db = NULL;
 
 #define EXT_BITSTRING(nid, table) { nid, 0, \
-                        (X509V3_EXT_NEW)asn1_bit_string_new, \
-                        (X509V3_EXT_FREE)ASN1_STRING_free, \
+                        (X509V3_EXT_NEW)ASN1_BIT_STRING_new, \
+                        (X509V3_EXT_FREE)ASN1_BIT_STRING_free, \
                         (X509V3_EXT_D2I)d2i_ASN1_BIT_STRING, \
                         (X509V3_EXT_I2D)i2d_ASN1_BIT_STRING, \
                         NULL, NULL, \
@@ -266,8 +274,8 @@ DECLARE_ASN1_SET_OF(POLICYINFO)
                         (char *)table}
 
 #define EXT_IA5STRING(nid) { nid, 0, \
-                        (X509V3_EXT_NEW)ia5string_new, \
-                        (X509V3_EXT_FREE)ASN1_STRING_free, \
+                        (X509V3_EXT_NEW)ASN1_IA5STRING_new, \
+                        (X509V3_EXT_FREE)ASN1_IA5STRING_free, \
                         (X509V3_EXT_D2I)d2i_ASN1_IA5STRING, \
                         (X509V3_EXT_I2D)i2d_ASN1_IA5STRING, \
                         (X509V3_EXT_I2S)i2s_ASN1_IA5STRING, \
@@ -279,6 +287,69 @@ DECLARE_ASN1_SET_OF(POLICYINFO)
                          NULL, NULL, NULL, NULL, \
                          NULL}
 
+
+/* X509_PURPOSE stuff */
+
+#define EXFLAG_BCONS            0x1
+#define EXFLAG_KUSAGE           0x2
+#define EXFLAG_XKUSAGE          0x4
+#define EXFLAG_NSCERT           0x8
+
+#define EXFLAG_CA               0x10
+#define EXFLAG_SS               0x20
+#define EXFLAG_V1               0x40
+#define EXFLAG_INVALID          0x80
+#define EXFLAG_SET              0x100
+
+#define KU_DIGITAL_SIGNATURE    0x0080
+#define KU_NON_REPUDIATION      0x0040
+#define KU_KEY_ENCIPHERMENT     0x0020
+#define KU_DATA_ENCIPHERMENT    0x0010
+#define KU_KEY_AGREEMENT        0x0008
+#define KU_KEY_CERT_SIGN        0x0004
+#define KU_CRL_SIGN             0x0002
+#define KU_ENCIPHER_ONLY        0x0001
+#define KU_DECIPHER_ONLY        0x8000
+
+#define NS_SSL_CLIENT           0x80
+#define NS_SSL_SERVER           0x40
+#define NS_SMIME                0x20
+#define NS_OBJSIGN              0x10
+#define NS_SSL_CA               0x04
+#define NS_SMIME_CA             0x02
+#define NS_OBJSIGN_CA           0x01
+
+#define XKU_SSL_SERVER          0x1     
+#define XKU_SSL_CLIENT          0x2
+#define XKU_SMIME               0x4
+#define XKU_CODE_SIGN           0x8
+#define XKU_SGC                 0x10
+
+#define X509_PURPOSE_DYNAMIC    0x1
+#define X509_PURPOSE_DYNAMIC_NAME       0x2
+
+typedef struct x509_purpose_st {
+        int purpose;
+        int trust;              /* Default trust ID */
+        int flags;
+        int (*check_purpose)(struct x509_purpose_st *, X509 *, int);
+        char *name;
+        char *sname;
+        void *usr_data;
+} X509_PURPOSE;
+
+#define X509_PURPOSE_SSL_CLIENT         1
+#define X509_PURPOSE_SSL_SERVER         2
+#define X509_PURPOSE_NS_SSL_SERVER      3
+#define X509_PURPOSE_SMIME_SIGN         4
+#define X509_PURPOSE_SMIME_ENCRYPT      5
+#define X509_PURPOSE_CRL_SIGN           6
+
+#define X509_PURPOSE_MIN                1
+#define X509_PURPOSE_MAX                6
+
+DECLARE_STACK_OF(X509_PURPOSE)
+
 void ERR_load_X509V3_strings(void);
 int i2d_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS *a, unsigned char **pp);
 BASIC_CONSTRAINTS *d2i_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS **a, unsigned char **pp, long length);
@@ -328,6 +399,11 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method,
 STACK_OF(GENERAL_NAME) *v2i_GENERAL_NAMES(X509V3_EXT_METHOD *method,
                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
 
+int i2d_OTHERNAME(OTHERNAME *a, unsigned char **pp);
+OTHERNAME *OTHERNAME_new(void);
+OTHERNAME *d2i_OTHERNAME(OTHERNAME **a, unsigned char **pp, long length);
+void OTHERNAME_free(OTHERNAME *a);
+
 char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *ia5);
 ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
 
@@ -380,12 +456,27 @@ void DIST_POINT_NAME_free(DIST_POINT_NAME *a);
 DIST_POINT_NAME *d2i_DIST_POINT_NAME(DIST_POINT_NAME **a, unsigned char **pp,
              long length);
 
+int i2d_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION *a, unsigned char **pp);
+ACCESS_DESCRIPTION *ACCESS_DESCRIPTION_new(void);
+void ACCESS_DESCRIPTION_free(ACCESS_DESCRIPTION *a);
+ACCESS_DESCRIPTION *d2i_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION **a, unsigned char **pp,
+             long length);
+
+STACK_OF(ACCESS_DESCRIPTION) *AUTHORITY_INFO_ACCESS_new(void);
+void AUTHORITY_INFO_ACCESS_free(STACK_OF(ACCESS_DESCRIPTION) *a);
+STACK_OF(ACCESS_DESCRIPTION) *d2i_AUTHORITY_INFO_ACCESS(STACK_OF(ACCESS_DESCRIPTION) **a,
+                                         unsigned char **pp, long length);
+int i2d_AUTHORITY_INFO_ACCESS(STACK_OF(ACCESS_DESCRIPTION) *a, unsigned char **pp);
+
+
+
 #ifdef HEADER_CONF_H
 GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, CONF_VALUE *cnf);
 void X509V3_conf_free(CONF_VALUE *val);
 X509_EXTENSION *X509V3_EXT_conf_nid(LHASH *conf, X509V3_CTX *ctx, int ext_nid, char *value);
 X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name, char *value);
 int X509V3_EXT_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509 *cert);
+int X509V3_EXT_REQ_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509_REQ *req);
 int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509_CRL *crl);
 int X509V3_add_value_bool_nf(char *name, int asn1_bool,
                                                 STACK_OF(CONF_VALUE) **extlist);
@@ -423,6 +514,8 @@ X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid);
 int X509V3_add_standard_extensions(void);
 STACK_OF(CONF_VALUE) *X509V3_parse_list(char *line);
 void *X509V3_EXT_d2i(X509_EXTENSION *ext);
+void *X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx);
+
 X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc);
 
 char *hex_to_string(unsigned char *buffer, long len);
@@ -434,6 +527,20 @@ void X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent,
 int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, int flag, int indent);
 int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 
+int X509_check_purpose(X509 *x, int id, int ca);
+int X509_PURPOSE_get_count(void);
+X509_PURPOSE * X509_PURPOSE_get0(int idx);
+int X509_PURPOSE_get_by_sname(char *sname);
+int X509_PURPOSE_get_by_id(int id);
+int X509_PURPOSE_add(int id, int trust, int flags,
+                        int (*ck)(X509_PURPOSE *, X509 *, int),
+                                char *name, char *sname, void *arg);
+char *X509_PURPOSE_get0_name(X509_PURPOSE *xp);
+char *X509_PURPOSE_get0_sname(X509_PURPOSE *xp);
+int X509_PURPOSE_get_trust(X509_PURPOSE *xp);
+void X509_PURPOSE_cleanup(void);
+int X509_PURPOSE_get_id(X509_PURPOSE *);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -449,6 +556,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 #define X509V3_F_HEX_TO_STRING                           111
 #define X509V3_F_I2S_ASN1_ENUMERATED                     121
 #define X509V3_F_I2S_ASN1_INTEGER                        120
+#define X509V3_F_I2V_AUTHORITY_INFO_ACCESS               138
 #define X509V3_F_NOTICE_SECTION                          132
 #define X509V3_F_NREF_NOS                                133
 #define X509V3_F_POLICY_SECTION                          131
@@ -464,6 +572,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 #define X509V3_F_SXNET_ADD_ID_ULONG                      127
 #define X509V3_F_SXNET_GET_ID_ASC                        128
 #define X509V3_F_SXNET_GET_ID_ULONG                      129
+#define X509V3_F_V2I_ACCESS_DESCRIPTION                  139
 #define X509V3_F_V2I_ASN1_BIT_STRING                     101
 #define X509V3_F_V2I_AUTHORITY_KEYID                     119
 #define X509V3_F_V2I_BASIC_CONSTRAINTS                   102
@@ -479,6 +588,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 #define X509V3_F_X509V3_EXT_I2D                          136
 #define X509V3_F_X509V3_GET_VALUE_BOOL                   110
 #define X509V3_F_X509V3_PARSE_LIST                       109
+#define X509V3_F_X509_PURPOSE_ADD                        137
 
 /* Reason codes. */
 #define X509V3_R_BAD_IP_ADDRESS                          118
@@ -506,6 +616,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 #define X509V3_R_INVALID_OPTION                          138
 #define X509V3_R_INVALID_POLICY_IDENTIFIER               134
 #define X509V3_R_INVALID_SECTION                         135
+#define X509V3_R_INVALID_SYNTAX                          143
 #define X509V3_R_ISSUER_DECODE_ERROR                     126
 #define X509V3_R_MISSING_VALUE                           124
 #define X509V3_R_NEED_ORGANIZATION_AND_NUMBERS           142
diff --git a/src/lib/libssl/src/demos/bio/saccept.c b/src/lib/libssl/src/demos/bio/saccept.c
index 2f2dc985fe..933d6699ee 100644
--- a/src/lib/libssl/src/demos/bio/saccept.c
+++ b/src/lib/libssl/src/demos/bio/saccept.c
@@ -46,7 +46,7 @@ char *argv[];
         SSL_load_error_strings();
 
         /* Add ciphers and message digests */
-        SSLeay_add_ssl_algorithms();
+        OpenSSL_add_ssl_algorithms();
 
         ctx=SSL_CTX_new(SSLv23_server_method());
         if (!SSL_CTX_use_certificate_file(ctx,CERT_FILE,SSL_FILETYPE_PEM))
diff --git a/src/lib/libssl/src/demos/bio/sconnect.c b/src/lib/libssl/src/demos/bio/sconnect.c
index 59fab1985e..87b380b258 100644
--- a/src/lib/libssl/src/demos/bio/sconnect.c
+++ b/src/lib/libssl/src/demos/bio/sconnect.c
@@ -36,7 +36,7 @@ char *argv[];
         SSL_load_error_strings();
 
         /* Setup all the global SSL stuff */
-        SSLeay_add_ssl_algorithms();
+        OpenSSL_add_ssl_algorithms();
         ssl_ctx=SSL_CTX_new(SSLv23_client_method());
 
         /* Lets make a SSL structure */
diff --git a/src/lib/libssl/src/demos/selfsign.c b/src/lib/libssl/src/demos/selfsign.c
index f4a8369352..68904c611e 100644
--- a/src/lib/libssl/src/demos/selfsign.c
+++ b/src/lib/libssl/src/demos/selfsign.c
@@ -18,26 +18,27 @@ int main()
 
         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 
-        X509V3_add_standard_extensions();
-
-        if ((bio_err=BIO_new(BIO_s_file())) != NULL)
-                BIO_set_fp(bio_err,stderr,BIO_NOCLOSE);
+        bio_err=BIO_new_fp(stderr, BIO_NOCLOSE);
 
         mkit(&x509,&pkey,512,0,365);
 
         RSA_print_fp(stdout,pkey->pkey.rsa,0);
         X509_print_fp(stdout,x509);
 
-        PEM_write_RSAPrivateKey(stdout,pkey->pkey.rsa,NULL,NULL,0,NULL);
+        PEM_write_PrivateKey(stdout,pkey,NULL,NULL,0,NULL, NULL);
         PEM_write_X509(stdout,x509);
 
         X509_free(x509);
         EVP_PKEY_free(pkey);
-        BIO_free(bio_err);
 
+#ifdef CUSTOM_EXT
+        /* Only needed if we add objects or custom extensions */
         X509V3_EXT_cleanup();
+        OBJ_cleanup();
+#endif
 
         CRYPTO_mem_leaks(bio_err);
+        BIO_free(bio_err);
         return(0);
         }
 
@@ -111,25 +112,19 @@ int days;
         X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days);
         X509_set_pubkey(x,pk);
 
-        name=X509_NAME_new();
-
-        ne=X509_NAME_ENTRY_create_by_NID(NULL,NID_countryName,
-                V_ASN1_APP_CHOOSE,"AU",-1);
-        X509_NAME_add_entry(name,ne,0,0);
-
-        X509_NAME_ENTRY_create_by_NID(&ne,NID_commonName,
-                V_ASN1_APP_CHOOSE,"Eric Young",-1);
-        X509_NAME_add_entry(name,ne,1,0);
+        name=X509_get_subject_name(x);
 
-        /* finished with structure */
-        X509_NAME_ENTRY_free(ne);
+        /* This function creates and adds the entry, working out the
+         * correct string type and performing checks on its length.
+         * Normally we'd check the return value for errors...
+         */
+        X509_NAME_add_entry_by_txt(name,"C",
+                                MBSTRING_ASC, "UK", -1, -1, 0);
+        X509_NAME_add_entry_by_txt(name,"CN",
+                                MBSTRING_ASC, "OpenSSL Group", -1, -1, 0);
 
-        X509_set_subject_name(x,name);
         X509_set_issuer_name(x,name);
 
-        /* finished with structure */
-        X509_NAME_free(name);
-
         /* Add extension using V3 code: we can set the config file as NULL
          * because we wont reference any other sections. We can also set
          * the context to NULL because none of these extensions below will need
@@ -138,15 +133,18 @@ int days;
 
         ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_cert_type, "server");
         X509_add_ext(x,ex,-1);
+        X509_EXTENSION_free(ex);
 
         ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_comment,
                                                 "example comment extension");
         X509_add_ext(x,ex,-1);
+        X509_EXTENSION_free(ex);
 
         ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_ssl_server_name,
                                                         "www.openssl.org");
 
         X509_add_ext(x,ex,-1);
+        X509_EXTENSION_free(ex);
 
 #if 0
         /* might want something like this too.... */
@@ -155,6 +153,20 @@ int days;
 
 
         X509_add_ext(x,ex,-1);
+        X509_EXTENSION_free(ex);
+#endif
+
+#ifdef CUSTOM_EXT
+        /* Maybe even add our own extension based on existing */
+        {
+                int nid;
+                nid = OBJ_create("1.2.3.4", "MyAlias", "My Test Alias Extension");
+                X509V3_EXT_add_alias(nid, NID_netscape_comment);
+                ex = X509V3_EXT_conf_nid(NULL, NULL, nid,
+                                                "example comment alias");
+                X509_add_ext(x,ex,-1);
+                X509_EXTENSION_free(ex);
+        }
 #endif
         
         if (!X509_sign(x,pk,EVP_md5()))
diff --git a/src/lib/libssl/src/demos/ssl/cli.cpp b/src/lib/libssl/src/demos/ssl/cli.cpp
index b3d726961f..daea2bd9c7 100644
--- a/src/lib/libssl/src/demos/ssl/cli.cpp
+++ b/src/lib/libssl/src/demos/ssl/cli.cpp
@@ -14,7 +14,6 @@
 #include <arpa/inet.h>
 #include <netdb.h>
 
-#include "rsa.h"       /* SSLeay stuff */
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
diff --git a/src/lib/libssl/src/dep/crypto.txt b/src/lib/libssl/src/dep/crypto.txt
index 9e5144fec6..e69de29bb2 100644
--- a/src/lib/libssl/src/dep/crypto.txt
+++ b/src/lib/libssl/src/dep/crypto.txt
@@ -1,1043 +0,0 @@
-ASN1_BIT_STRING_asn1_meth
-ASN1_BIT_STRING_get_bit
-ASN1_BIT_STRING_set_bit
-ASN1_HEADER_free
-ASN1_HEADER_new
-ASN1_IA5STRING_asn1_meth
-ASN1_INTEGER_get
-ASN1_INTEGER_set
-ASN1_INTEGER_to_BN
-ASN1_OBJECT_create
-ASN1_OBJECT_free
-ASN1_OBJECT_new
-ASN1_PRINTABLE_type
-ASN1_STRING_cmp
-ASN1_STRING_dup
-ASN1_STRING_free
-ASN1_STRING_new
-ASN1_STRING_print
-ASN1_STRING_set
-ASN1_STRING_type_new
-ASN1_TYPE_free
-ASN1_TYPE_get
-ASN1_TYPE_new
-ASN1_TYPE_set
-ASN1_UNIVERSALSTRING_to_string
-ASN1_UTCTIME_check
-ASN1_UTCTIME_print
-ASN1_UTCTIME_set
-ASN1_check_infinite_end
-ASN1_d2i_bio
-ASN1_d2i_fp
-ASN1_digest
-ASN1_dup
-ASN1_get_object
-ASN1_i2d_bio
-ASN1_i2d_fp
-ASN1_object_size
-ASN1_parse
-ASN1_put_object
-ASN1_sign
-ASN1_verify
-BF_cbc_encrypt
-BF_cfb64_encrypt
-BF_decrypt
-BF_ecb_encrypt
-BF_encrypt
-BF_ofb64_encrypt
-BF_options
-BF_set_key
-BIO_ACCEPT_free
-BIO_ACCEPT_new
-BIO_CONNECT_free
-BIO_CONNECT_new
-BIO_accept
-BIO_copy_next_retry
-BIO_ctrl
-BIO_ctrl_int
-BIO_debug_callback
-BIO_dump
-BIO_dup_chain
-BIO_f_base64
-BIO_f_buffer
-BIO_f_cipher
-BIO_f_md
-BIO_f_nbio_test
-BIO_f_null
-BIO_f_proxy_server
-BIO_fd_non_fatal_error
-BIO_fd_should_retry
-BIO_find_type
-BIO_free
-BIO_free_all
-BIO_get_accept_socket
-BIO_get_ex_data
-BIO_get_ex_new_index
-BIO_get_filter_bio
-BIO_get_host_ip
-BIO_get_port
-BIO_get_retry_BIO
-BIO_get_retry_reason
-BIO_gethostbyname
-BIO_gets
-BIO_ghbn_ctrl
-BIO_new
-BIO_new_accept
-BIO_new_connect
-BIO_new_fd
-BIO_new_file
-BIO_new_fp
-BIO_new_socket
-BIO_pop
-BIO_printf
-BIO_ptr_ctrl
-BIO_push
-BIO_puts
-BIO_read
-BIO_s_accept
-BIO_s_connect
-BIO_s_fd
-BIO_s_file
-BIO_s_mem
-BIO_s_null
-BIO_s_proxy_client
-BIO_s_socket
-BIO_set
-BIO_set_cipher
-BIO_set_ex_data
-BIO_set_tcp_ndelay
-BIO_sock_cleanup
-BIO_sock_error
-BIO_sock_init
-BIO_sock_non_fatal_error
-BIO_sock_should_retry
-BIO_socket_ioctl
-BIO_write
-BN_BLINDING_convert
-BN_BLINDING_free
-BN_BLINDING_invert
-BN_BLINDING_new
-BN_BLINDING_update
-BN_CTX_free
-BN_CTX_new
-BN_MONT_CTX_free
-BN_MONT_CTX_new
-BN_MONT_CTX_set
-BN_add
-BN_add_word
-BN_bin2bn
-BN_bn2bin
-BN_bn2dec
-BN_bn2hex
-BN_bn2mpi
-BN_clear
-BN_clear_bit
-BN_clear_free
-BN_cmp
-BN_copy
-BN_dec2bn
-BN_div
-BN_div_word
-BN_dup
-BN_exp
-BN_free
-BN_from_montgomery
-BN_gcd
-BN_generate_prime
-BN_get_word
-BN_hex2bn
-BN_is_bit_set
-BN_is_prime
-BN_lshift
-BN_lshift1
-BN_mask_bits
-BN_mod
-BN_mod_exp
-BN_mod_exp_mont
-BN_mod_exp_recp
-BN_mod_exp_simple
-BN_mod_inverse
-BN_mod_mul
-BN_mod_mul_montgomery
-BN_mod_mul_reciprocal
-BN_mod_word
-BN_mpi2bn
-BN_mul
-BN_mul_word
-BN_new
-BN_num_bits
-BN_num_bits_word
-BN_options
-BN_print
-BN_print_fp
-BN_rand
-BN_reciprocal
-BN_rshift
-BN_rshift1
-BN_set_bit
-BN_set_word
-BN_sqr
-BN_sub
-BN_sub_word
-BN_to_ASN1_INTEGER
-BN_ucmp
-BN_value_one
-BUF_MEM_free
-BUF_MEM_grow
-BUF_MEM_new
-BUF_strdup
-CAST_cbc_encrypt
-CAST_cfb64_encrypt
-CAST_decrypt
-CAST_ecb_encrypt
-CAST_encrypt
-CAST_ofb64_encrypt
-CAST_set_key
-CONF_free
-CONF_get_number
-CONF_get_section
-CONF_get_string
-CONF_load
-CRYPTO_add_lock
-CRYPTO_dbg_free
-CRYPTO_dbg_malloc
-CRYPTO_dbg_realloc
-CRYPTO_dbg_remalloc
-CRYPTO_dup_ex_data
-CRYPTO_free
-CRYPTO_free_ex_data
-CRYPTO_get_add_lock_callback
-CRYPTO_get_ex_data
-CRYPTO_get_ex_new_index
-CRYPTO_get_id_callback
-CRYPTO_get_lock_name
-CRYPTO_get_locking_callback
-CRYPTO_get_mem_functions
-CRYPTO_get_new_lockid
-CRYPTO_lock
-CRYPTO_malloc
-CRYPTO_mem_ctrl
-CRYPTO_mem_leaks
-CRYPTO_mem_leaks_cb
-CRYPTO_mem_leaks_fp
-CRYPTO_new_ex_data
-CRYPTO_realloc
-CRYPTO_remalloc
-CRYPTO_set_add_lock_callback
-CRYPTO_set_ex_data
-CRYPTO_set_id_callback
-CRYPTO_set_locking_callback
-CRYPTO_set_mem_functions
-CRYPTO_thread_id
-DH_check
-DH_compute_key
-DH_free
-DH_generate_key
-DH_generate_parameters
-DH_new
-DH_size
-DHparams_print
-DHparams_print_fp
-DSA_free
-DSA_generate_key
-DSA_generate_parameters
-DSA_is_prime
-DSA_new
-DSA_print
-DSA_print_fp
-DSA_sign
-DSA_sign_setup
-DSA_size
-DSA_verify
-DSAparams_print
-DSAparams_print_fp
-ERR_clear_error
-ERR_error_string
-ERR_free_strings
-ERR_func_error_string
-ERR_get_err_state_table
-ERR_get_error
-ERR_get_error_line
-ERR_get_next_error_library
-ERR_get_state
-ERR_get_string_table
-ERR_lib_error_string
-ERR_load_ASN1_strings
-ERR_load_BIO_strings
-ERR_load_BN_strings
-ERR_load_BUF_strings
-ERR_load_CONF_strings
-ERR_load_CRYPTO_strings
-ERR_load_DH_strings
-ERR_load_DSA_strings
-ERR_load_ERR_strings
-ERR_load_EVP_strings
-ERR_load_OBJ_strings
-ERR_load_PEM_strings
-ERR_load_PKCS7_strings
-ERR_load_PROXY_strings
-ERR_load_RSA_strings
-ERR_load_X509_strings
-ERR_load_crypto_strings
-ERR_load_strings
-ERR_peek_error
-ERR_peek_error_line
-ERR_print_errors
-ERR_print_errors_fp
-ERR_put_error
-ERR_reason_error_string
-ERR_remove_state
-EVP_BytesToKey
-EVP_CIPHER_CTX_cleanup
-EVP_CIPHER_CTX_init
-EVP_CipherFinal
-EVP_CipherInit
-EVP_CipherUpdate
-EVP_DecodeBlock
-EVP_DecodeFinal
-EVP_DecodeInit
-EVP_DecodeUpdate
-EVP_DecryptFinal
-EVP_DecryptInit
-EVP_DecryptUpdate
-EVP_DigestFinal
-EVP_DigestInit
-EVP_DigestUpdate
-EVP_EncodeBlock
-EVP_EncodeFinal
-EVP_EncodeInit
-EVP_EncodeUpdate
-EVP_EncryptFinal
-EVP_EncryptInit
-EVP_EncryptUpdate
-EVP_OpenFinal
-EVP_OpenInit
-EVP_PKEY_assign
-EVP_PKEY_bits
-EVP_PKEY_cmp_parameters
-EVP_PKEY_copy_parameters
-EVP_PKEY_free
-EVP_PKEY_missing_parameters
-EVP_PKEY_new
-EVP_PKEY_save_parameters
-EVP_PKEY_size
-EVP_PKEY_type
-EVP_SealFinal
-EVP_SealInit
-EVP_SignFinal
-EVP_VerifyFinal
-EVP_add_alias
-EVP_add_cipher
-EVP_add_digest
-EVP_bf_cbc
-EVP_bf_cfb
-EVP_bf_ecb
-EVP_bf_ofb
-EVP_cast5_cbc
-EVP_cast5_cfb
-EVP_cast5_ecb
-EVP_cast5_ofb
-EVP_cleanup
-EVP_delete_alias
-EVP_des_cbc
-EVP_des_cfb
-EVP_des_ecb
-EVP_des_ede
-EVP_des_ede3
-EVP_des_ede3_cbc
-EVP_des_ede3_cfb
-EVP_des_ede3_ofb
-EVP_des_ede_cbc
-EVP_des_ede_cfb
-EVP_des_ede_ofb
-EVP_des_ofb
-EVP_desx_cbc
-EVP_dss
-EVP_dss1
-EVP_enc_null
-EVP_get_cipherbyname
-EVP_get_digestbyname
-EVP_get_pw_prompt
-EVP_idea_cbc
-EVP_idea_cfb
-EVP_idea_ecb
-EVP_idea_ofb
-EVP_md2
-EVP_md5
-EVP_md_null
-EVP_mdc2
-EVP_rc2_40_cbc
-EVP_rc2_cbc
-EVP_rc2_cfb
-EVP_rc2_ecb
-EVP_rc2_ofb
-EVP_rc4
-EVP_rc4_40
-EVP_read_pw_string
-EVP_set_pw_prompt
-EVP_sha
-EVP_sha1
-HMAC
-HMAC_Final
-HMAC_Init
-HMAC_Update
-HMAC_cleanup
-MD2
-MD2_Final
-MD2_Init
-MD2_Update
-MD2_options
-MD5
-MD5_Final
-MD5_Init
-MD5_Transform
-MD5_Update
-MDC2
-MDC2_Final
-MDC2_Init
-MDC2_Update
-NETSCAPE_SPKAC_free
-NETSCAPE_SPKAC_new
-NETSCAPE_SPKI_free
-NETSCAPE_SPKI_new
-NETSCAPE_SPKI_sign
-NETSCAPE_SPKI_verify
-OBJ_add_object
-OBJ_bsearch
-OBJ_cleanup
-OBJ_cmp
-OBJ_create
-OBJ_create_objects
-OBJ_dup
-OBJ_ln2nid
-OBJ_new_nid
-OBJ_nid2ln
-OBJ_nid2obj
-OBJ_nid2sn
-OBJ_obj2nid
-OBJ_sn2nid
-OBJ_txt2nid
-PEM_ASN1_read
-PEM_ASN1_read_bio
-PEM_ASN1_write
-PEM_ASN1_write_bio
-PEM_SealFinal
-PEM_SealInit
-PEM_SealUpdate
-PEM_SignFinal
-PEM_SignInit
-PEM_SignUpdate
-PEM_X509_INFO_read
-PEM_X509_INFO_read_bio
-PEM_X509_INFO_write_bio
-PEM_dek_info
-PEM_do_header
-PEM_get_EVP_CIPHER_INFO
-PEM_proc_type
-PEM_read
-PEM_read_DHparams
-PEM_read_DSAPrivateKey
-PEM_read_DSAparams
-PEM_read_PKCS7
-PEM_read_PrivateKey
-PEM_read_RSAPrivateKey
-PEM_read_RSAPublicKey
-PEM_read_X509
-PEM_read_X509_CRL
-PEM_read_X509_REQ
-PEM_read_bio
-PEM_read_bio_DHparams
-PEM_read_bio_DSAPrivateKey
-PEM_read_bio_DSAparams
-PEM_read_bio_PKCS7
-PEM_read_bio_PrivateKey
-PEM_read_bio_RSAPrivateKey
-PEM_read_bio_RSAPublicKey
-PEM_read_bio_X509
-PEM_read_bio_X509_CRL
-PEM_read_bio_X509_REQ
-PEM_write
-PEM_write_DHparams
-PEM_write_DSAPrivateKey
-PEM_write_DSAparams
-PEM_write_PKCS7
-PEM_write_PrivateKey
-PEM_write_RSAPrivateKey
-PEM_write_RSAPublicKey
-PEM_write_X509
-PEM_write_X509_CRL
-PEM_write_X509_REQ
-PEM_write_bio
-PEM_write_bio_DHparams
-PEM_write_bio_DSAPrivateKey
-PEM_write_bio_DSAparams
-PEM_write_bio_PKCS7
-PEM_write_bio_PrivateKey
-PEM_write_bio_RSAPrivateKey
-PEM_write_bio_RSAPublicKey
-PEM_write_bio_X509
-PEM_write_bio_X509_CRL
-PEM_write_bio_X509_REQ
-PKCS7_DIGEST_free
-PKCS7_DIGEST_new
-PKCS7_ENCRYPT_free
-PKCS7_ENCRYPT_new
-PKCS7_ENC_CONTENT_free
-PKCS7_ENC_CONTENT_new
-PKCS7_ENVELOPE_free
-PKCS7_ENVELOPE_new
-PKCS7_ISSUER_AND_SERIAL_digest
-PKCS7_ISSUER_AND_SERIAL_free
-PKCS7_ISSUER_AND_SERIAL_new
-PKCS7_RECIP_INFO_free
-PKCS7_RECIP_INFO_new
-PKCS7_SIGNED_free
-PKCS7_SIGNED_new
-PKCS7_SIGNER_INFO_free
-PKCS7_SIGNER_INFO_new
-PKCS7_SIGNER_INFO_set
-PKCS7_SIGN_ENVELOPE_free
-PKCS7_SIGN_ENVELOPE_new
-PKCS7_add_certificate
-PKCS7_add_crl
-PKCS7_add_signature
-PKCS7_add_signer
-PKCS7_cert_from_signer_info
-PKCS7_content_free
-PKCS7_content_new
-PKCS7_ctrl
-PKCS7_dataInit
-PKCS7_dataSign
-PKCS7_dataVerify
-PKCS7_dup
-PKCS7_free
-PKCS7_get_signer_info
-PKCS7_new
-PKCS7_set_content
-PKCS7_set_type
-PROXY_ENTRY_add_noproxy
-PROXY_ENTRY_clear_noproxy
-PROXY_ENTRY_free
-PROXY_ENTRY_get_noproxy
-PROXY_ENTRY_new
-PROXY_ENTRY_set_server
-PROXY_add_noproxy
-PROXY_add_server
-PROXY_check_by_host
-PROXY_check_url
-PROXY_clear_noproxy
-PROXY_free
-PROXY_get_noproxy
-PROXY_get_proxies
-PROXY_get_proxy_entry
-PROXY_load_conf
-PROXY_new
-PROXY_print
-RAND_bytes
-RAND_cleanup
-RAND_file_name
-RAND_load_file
-RAND_seed
-RAND_write_file
-RC2_cbc_encrypt
-RC2_cfb64_encrypt
-RC2_decrypt
-RC2_ecb_encrypt
-RC2_encrypt
-RC2_ofb64_encrypt
-RC2_set_key
-RC4
-RC4_options
-RC4_set_key
-RC5_32_cbc_encrypt
-RC5_32_cfb64_encrypt
-RC5_32_decrypt
-RC5_32_ecb_encrypt
-RC5_32_encrypt
-RC5_32_ofb64_encrypt
-RC5_32_set_key
-RIPEMD160
-RIPEMD160_Final
-RIPEMD160_Init
-RIPEMD160_Transform
-RIPEMD160_Update
-RSAPrivateKey_asn1_meth
-RSAPrivateKey_dup
-RSAPublicKey_dup
-RSA_PKCS1_SSLeay
-RSA_blinding_off
-RSA_blinding_on
-RSA_flags
-RSA_free
-RSA_generate_key
-RSA_get_ex_data
-RSA_get_ex_new_index
-RSA_new
-RSA_new_method
-RSA_padding_add_PKCS1_type_1
-RSA_padding_add_PKCS1_type_2
-RSA_padding_add_SSLv23
-RSA_padding_add_none
-RSA_padding_check_PKCS1_type_1
-RSA_padding_check_PKCS1_type_2
-RSA_padding_check_SSLv23
-RSA_padding_check_none
-RSA_print
-RSA_print_fp
-RSA_private_decrypt
-RSA_private_encrypt
-RSA_public_decrypt
-RSA_public_encrypt
-RSA_set_default_method
-RSA_set_ex_data
-RSA_sign
-RSA_sign_ASN1_OCTET_STRING
-RSA_size
-RSA_verify
-RSA_verify_ASN1_OCTET_STRING
-SHA
-SHA1
-SHA1_Final
-SHA1_Init
-SHA1_Transform
-SHA1_Update
-SHA_Final
-SHA_Init
-SHA_Transform
-SHA_Update
-SSLeay
-SSLeay_add_all_algorithms
-SSLeay_add_all_ciphers
-SSLeay_add_all_digests
-SSLeay_version
-TXT_DB_create_index
-TXT_DB_free
-TXT_DB_get_by_index
-TXT_DB_insert
-TXT_DB_read
-TXT_DB_write
-X509_ALGOR_free
-X509_ALGOR_new
-X509_ATTRIBUTE_free
-X509_ATTRIBUTE_new
-X509_CINF_free
-X509_CINF_new
-X509_CRL_INFO_free
-X509_CRL_INFO_new
-X509_CRL_add_ext
-X509_CRL_cmp
-X509_CRL_delete_ext
-X509_CRL_dup
-X509_CRL_free
-X509_CRL_get_ext
-X509_CRL_get_ext_by_NID
-X509_CRL_get_ext_by_OBJ
-X509_CRL_get_ext_by_critical
-X509_CRL_get_ext_count
-X509_CRL_new
-X509_CRL_sign
-X509_CRL_verify
-X509_EXTENSION_create_by_NID
-X509_EXTENSION_create_by_OBJ
-X509_EXTENSION_dup
-X509_EXTENSION_free
-X509_EXTENSION_get_critical
-X509_EXTENSION_get_data
-X509_EXTENSION_get_object
-X509_EXTENSION_new
-X509_EXTENSION_set_critical
-X509_EXTENSION_set_data
-X509_EXTENSION_set_object
-X509_INFO_free
-X509_INFO_new
-X509_LOOKUP_by_alias
-X509_LOOKUP_by_fingerprint
-X509_LOOKUP_by_issuer_serial
-X509_LOOKUP_by_subject
-X509_LOOKUP_ctrl
-X509_LOOKUP_file
-X509_LOOKUP_free
-X509_LOOKUP_hash_dir
-X509_LOOKUP_init
-X509_LOOKUP_new
-X509_LOOKUP_shutdown
-X509_NAME_ENTRY_create_by_NID
-X509_NAME_ENTRY_create_by_OBJ
-X509_NAME_ENTRY_dup
-X509_NAME_ENTRY_free
-X509_NAME_ENTRY_get_data
-X509_NAME_ENTRY_get_object
-X509_NAME_ENTRY_new
-X509_NAME_ENTRY_set_data
-X509_NAME_ENTRY_set_object
-X509_NAME_add_entry
-X509_NAME_cmp
-X509_NAME_delete_entry
-X509_NAME_digest
-X509_NAME_dup
-X509_NAME_entry_count
-X509_NAME_free
-X509_NAME_get_entry
-X509_NAME_get_index_by_NID
-X509_NAME_get_index_by_OBJ
-X509_NAME_get_text_by_NID
-X509_NAME_get_text_by_OBJ
-X509_NAME_hash
-X509_NAME_new
-X509_NAME_oneline
-X509_NAME_print
-X509_NAME_set
-X509_OBJECT_free_contents
-X509_OBJECT_retrive_by_subject
-X509_OBJECT_up_ref_count
-X509_PKEY_free
-X509_PKEY_new
-X509_PUBKEY_free
-X509_PUBKEY_get
-X509_PUBKEY_new
-X509_PUBKEY_set
-X509_REQ_INFO_free
-X509_REQ_INFO_new
-X509_REQ_dup
-X509_REQ_free
-X509_REQ_get_pubkey
-X509_REQ_new
-X509_REQ_print
-X509_REQ_print_fp
-X509_REQ_set_pubkey
-X509_REQ_set_subject_name
-X509_REQ_set_version
-X509_REQ_sign
-X509_REQ_to_X509
-X509_REQ_verify
-X509_REVOKED_add_ext
-X509_REVOKED_delete_ext
-X509_REVOKED_free
-X509_REVOKED_get_ext
-X509_REVOKED_get_ext_by_NID
-X509_REVOKED_get_ext_by_OBJ
-X509_REVOKED_get_ext_by_critical
-X509_REVOKED_get_ext_count
-X509_REVOKED_new
-X509_SIG_free
-X509_SIG_new
-X509_STORE_CTX_cleanup
-X509_STORE_CTX_get_chain
-X509_STORE_CTX_get_current_cert
-X509_STORE_CTX_get_error
-X509_STORE_CTX_get_error_depth
-X509_STORE_CTX_get_ex_data
-X509_STORE_CTX_get_ex_new_index
-X509_STORE_CTX_init
-X509_STORE_CTX_set_cert
-X509_STORE_CTX_set_chain
-X509_STORE_CTX_set_error
-X509_STORE_CTX_set_ex_data
-X509_STORE_add_cert
-X509_STORE_add_crl
-X509_STORE_add_lookup
-X509_STORE_free
-X509_STORE_get_by_subject
-X509_STORE_load_locations
-X509_STORE_new
-X509_STORE_set_default_paths
-X509_VAL_free
-X509_VAL_new
-X509_add_ext
-X509_asn1_meth
-X509_certificate_type
-X509_check_private_key
-X509_cmp_current_time
-X509_delete_ext
-X509_digest
-X509_dup
-X509_find_by_issuer_and_serial
-X509_find_by_subject
-X509_free
-X509_get_default_cert_area
-X509_get_default_cert_dir
-X509_get_default_cert_dir_env
-X509_get_default_cert_file
-X509_get_default_cert_file_env
-X509_get_default_private_dir
-X509_get_ext
-X509_get_ext_by_NID
-X509_get_ext_by_OBJ
-X509_get_ext_by_critical
-X509_get_ext_count
-X509_get_issuer_name
-X509_get_pubkey
-X509_get_pubkey_parameters
-X509_get_serialNumber
-X509_get_subject_name
-X509_gmtime_adj
-X509_issuer_and_serial_cmp
-X509_issuer_and_serial_hash
-X509_issuer_name_cmp
-X509_issuer_name_hash
-X509_load_cert_file
-X509_load_crl_file
-X509_new
-X509_print
-X509_print_fp
-X509_set_issuer_name
-X509_set_notAfter
-X509_set_notBefore
-X509_set_pubkey
-X509_set_serialNumber
-X509_set_subject_name
-X509_set_version
-X509_sign
-X509_subject_name_cmp
-X509_subject_name_hash
-X509_to_X509_REQ
-X509_verify
-X509_verify_cert
-X509_verify_cert_error_string
-X509v3_add_ext
-X509v3_add_extension
-X509v3_add_netscape_extensions
-X509v3_add_standard_extensions
-X509v3_cleanup_extensions
-X509v3_data_type_by_NID
-X509v3_data_type_by_OBJ
-X509v3_delete_ext
-X509v3_get_ext
-X509v3_get_ext_by_NID
-X509v3_get_ext_by_OBJ
-X509v3_get_ext_by_critical
-X509v3_get_ext_count
-X509v3_get_key_usage
-X509v3_pack_string
-X509v3_pack_type_by_NID
-X509v3_pack_type_by_OBJ
-X509v3_set_key_usage
-X509v3_unpack_string
-_des_crypt
-a2d_ASN1_OBJECT
-a2i_ASN1_INTEGER
-a2i_ASN1_STRING
-a2i_X509v3_key_usage
-asn1_Finish
-asn1_GetSequence
-bn_add_words
-bn_div64
-bn_expand2
-bn_mul_add_words
-bn_mul_words
-bn_qadd
-bn_qsub
-bn_sqr_words
-crypt
-d2i_ASN1_BIT_STRING
-d2i_ASN1_BOOLEAN
-d2i_ASN1_HEADER
-d2i_ASN1_IA5STRING
-d2i_ASN1_INTEGER
-d2i_ASN1_OBJECT
-d2i_ASN1_OCTET_STRING
-d2i_ASN1_PRINTABLE
-d2i_ASN1_PRINTABLESTRING
-d2i_ASN1_SET
-d2i_ASN1_T61STRING
-d2i_ASN1_TYPE
-d2i_ASN1_UTCTIME
-d2i_ASN1_bytes
-d2i_ASN1_type_bytes
-d2i_DHparams
-d2i_DSAPrivateKey
-d2i_DSAPrivateKey_bio
-d2i_DSAPrivateKey_fp
-d2i_DSAPublicKey
-d2i_DSAparams
-d2i_NETSCAPE_SPKAC
-d2i_NETSCAPE_SPKI
-d2i_Netscape_RSA
-d2i_Netscape_RSA_2
-d2i_PKCS7
-d2i_PKCS7_DIGEST
-d2i_PKCS7_ENCRYPT
-d2i_PKCS7_ENC_CONTENT
-d2i_PKCS7_ENVELOPE
-d2i_PKCS7_ISSUER_AND_SERIAL
-d2i_PKCS7_RECIP_INFO
-d2i_PKCS7_SIGNED
-d2i_PKCS7_SIGNER_INFO
-d2i_PKCS7_SIGN_ENVELOPE
-d2i_PKCS7_bio
-d2i_PKCS7_fp
-d2i_PrivateKey
-d2i_PublicKey
-d2i_RSAPrivateKey
-d2i_RSAPrivateKey_bio
-d2i_RSAPrivateKey_fp
-d2i_RSAPublicKey
-d2i_RSAPublicKey_bio
-d2i_RSAPublicKey_fp
-d2i_X509
-d2i_X509_ALGOR
-d2i_X509_ATTRIBUTE
-d2i_X509_CINF
-d2i_X509_CRL
-d2i_X509_CRL_INFO
-d2i_X509_CRL_bio
-d2i_X509_CRL_fp
-d2i_X509_EXTENSION
-d2i_X509_NAME
-d2i_X509_NAME_ENTRY
-d2i_X509_PKEY
-d2i_X509_PUBKEY
-d2i_X509_REQ
-d2i_X509_REQ_INFO
-d2i_X509_REQ_bio
-d2i_X509_REQ_fp
-d2i_X509_REVOKED
-d2i_X509_SIG
-d2i_X509_VAL
-d2i_X509_bio
-d2i_X509_fp
-des_cbc_cksum
-des_cbc_encrypt
-des_cblock_print_file
-des_cfb64_encrypt
-des_cfb_encrypt
-des_decrypt3
-des_ecb3_encrypt
-des_ecb_encrypt
-des_ede3_cbc_encrypt
-des_ede3_cfb64_encrypt
-des_ede3_ofb64_encrypt
-des_enc_read
-des_enc_write
-des_encrypt
-des_encrypt2
-des_encrypt3
-des_fcrypt
-des_is_weak_key
-des_key_sched
-des_ncbc_encrypt
-des_ofb64_encrypt
-des_ofb_encrypt
-des_options
-des_pcbc_encrypt
-des_quad_cksum
-des_random_key
-des_random_seed
-des_read_2passwords
-des_read_password
-des_read_pw
-des_read_pw_string
-des_set_key
-des_set_odd_parity
-des_string_to_2keys
-des_string_to_key
-des_xcbc_encrypt
-des_xwhite_in2out
-fcrypt_body
-i2a_ASN1_INTEGER
-i2a_ASN1_OBJECT
-i2a_ASN1_STRING
-i2a_X509v3_key_usage
-i2d_ASN1_BIT_STRING
-i2d_ASN1_BOOLEAN
-i2d_ASN1_HEADER
-i2d_ASN1_IA5STRING
-i2d_ASN1_INTEGER
-i2d_ASN1_OBJECT
-i2d_ASN1_OCTET_STRING
-i2d_ASN1_PRINTABLE
-i2d_ASN1_SET
-i2d_ASN1_TYPE
-i2d_ASN1_UTCTIME
-i2d_ASN1_bytes
-i2d_DHparams
-i2d_DSAPrivateKey
-i2d_DSAPrivateKey_bio
-i2d_DSAPrivateKey_fp
-i2d_DSAPublicKey
-i2d_DSAparams
-i2d_NETSCAPE_SPKAC
-i2d_NETSCAPE_SPKI
-i2d_Netscape_RSA
-i2d_PKCS7
-i2d_PKCS7_DIGEST
-i2d_PKCS7_ENCRYPT
-i2d_PKCS7_ENC_CONTENT
-i2d_PKCS7_ENVELOPE
-i2d_PKCS7_ISSUER_AND_SERIAL
-i2d_PKCS7_RECIP_INFO
-i2d_PKCS7_SIGNED
-i2d_PKCS7_SIGNER_INFO
-i2d_PKCS7_SIGN_ENVELOPE
-i2d_PKCS7_bio
-i2d_PKCS7_fp
-i2d_PrivateKey
-i2d_PublicKey
-i2d_RSAPrivateKey
-i2d_RSAPrivateKey_bio
-i2d_RSAPrivateKey_fp
-i2d_RSAPublicKey
-i2d_RSAPublicKey_bio
-i2d_RSAPublicKey_fp
-i2d_X509
-i2d_X509_ALGOR
-i2d_X509_ATTRIBUTE
-i2d_X509_CINF
-i2d_X509_CRL
-i2d_X509_CRL_INFO
-i2d_X509_CRL_bio
-i2d_X509_CRL_fp
-i2d_X509_EXTENSION
-i2d_X509_NAME
-i2d_X509_NAME_ENTRY
-i2d_X509_PKEY
-i2d_X509_PUBKEY
-i2d_X509_REQ
-i2d_X509_REQ_INFO
-i2d_X509_REQ_bio
-i2d_X509_REQ_fp
-i2d_X509_REVOKED
-i2d_X509_SIG
-i2d_X509_VAL
-i2d_X509_bio
-i2d_X509_fp
-i2t_ASN1_OBJECT
-idea_cbc_encrypt
-idea_cfb64_encrypt
-idea_ecb_encrypt
-idea_encrypt
-idea_ofb64_encrypt
-idea_options
-idea_set_decrypt_key
-idea_set_encrypt_key
-lh_delete
-lh_doall
-lh_doall_arg
-lh_free
-lh_insert
-lh_new
-lh_node_stats
-lh_node_stats_bio
-lh_node_usage_stats
-lh_node_usage_stats_bio
-lh_retrieve
-lh_stats
-lh_stats_bio
-lh_strhash
-ripemd160_block
-sha1_block
-sha_block
-sk_delete
-sk_delete_ptr
-sk_dup
-sk_find
-sk_free
-sk_insert
-sk_new
-sk_pop
-sk_pop_free
-sk_push
-sk_set_cmp_func
-sk_shift
-sk_unshift
-sk_zero
diff --git a/src/lib/libssl/src/dep/files b/src/lib/libssl/src/dep/files
index 85cd7a3ff9..e69de29bb2 100644
--- a/src/lib/libssl/src/dep/files
+++ b/src/lib/libssl/src/dep/files
@@ -1,566 +0,0 @@
-./e_os.h
-
-./crypto/cryptall.h             CRYPTO
-./crypto/cryptlib.h             CRYPTO
-./crypto/crypto.c               CRYPTO
-./crypto/cversion.c             CRYPTO
-./crypto/date.h                 CRYPTO
-./crypto/mem.c                  CRYPTO
-./crypto/cpt_err.c              CRYPTO
-./crypto/ex_data.c              CRYPTO
-./crypto/crypto.h               CRYPTO
-./crypto/cryptlib.c             CRYPTO
-./crypto/tmdiff.c               CRYPTO
-
-./crypto/asn1/asn1.h            ASN1
-./crypto/asn1/asn1_mac.h        ASN1
-./crypto/asn1/asn1_err.c        ASN1
-./crypto/asn1/asn1_lib.c        ASN1
-./crypto/asn1/asn1_par.c        ASN1
-./crypto/asn1/a_bitstr.c        ASN1
-./crypto/asn1/a_bmp.c           ASN1
-./crypto/asn1/a_bool.c          ASN1
-./crypto/asn1/a_bytes.c         ASN1
-./crypto/asn1/a_d2i_fp.c        ASN1
-./crypto/asn1/a_digest.c        ASN1
-./crypto/asn1/a_dup.c           ASN1
-./crypto/asn1/a_hdr.c           ASN1
-./crypto/asn1/a_i2d_fp.c        ASN1
-./crypto/asn1/a_int.c           ASN1
-./crypto/asn1/a_meth.c          ASN1
-./crypto/asn1/a_object.c        ASN1
-./crypto/asn1/a_octet.c         ASN1
-./crypto/asn1/a_print.c         ASN1
-./crypto/asn1/a_set.c           ASN1
-./crypto/asn1/a_sign.c          ASN1
-./crypto/asn1/a_type.c          ASN1
-./crypto/asn1/a_utctm.c         ASN1
-./crypto/asn1/a_verify.c        ASN1
-./crypto/asn1/d2i_dhp.c         ASN1
-./crypto/asn1/d2i_dsap.c        ASN1
-./crypto/asn1/d2i_pr.c          ASN1
-./crypto/asn1/d2i_pu.c          ASN1
-./crypto/asn1/d2i_r_pr.c        ASN1
-./crypto/asn1/d2i_r_pu.c        ASN1
-./crypto/asn1/d2i_s_pr.c        ASN1
-./crypto/asn1/d2i_s_pu.c        ASN1
-./crypto/asn1/f_int.c           ASN1
-./crypto/asn1/f_string.c        ASN1
-./crypto/asn1/i2d_dhp.c         ASN1
-./crypto/asn1/i2d_dsap.c        ASN1
-./crypto/asn1/i2d_pr.c          ASN1
-./crypto/asn1/i2d_pu.c          ASN1
-./crypto/asn1/i2d_r_pr.c        ASN1
-./crypto/asn1/i2d_r_pu.c        ASN1
-./crypto/asn1/i2d_s_pr.c        ASN1
-./crypto/asn1/i2d_s_pu.c        ASN1
-./crypto/asn1/n_pkey.c          ASN1
-./crypto/asn1/p7_dgst.c         ASN1
-./crypto/asn1/p7_enc.c          ASN1
-./crypto/asn1/p7_enc_c.c        ASN1
-./crypto/asn1/p7_evp.c          ASN1
-./crypto/asn1/p7_i_s.c          ASN1
-./crypto/asn1/p7_lib.c          ASN1
-./crypto/asn1/p7_recip.c        ASN1
-./crypto/asn1/p7_signd.c        ASN1
-./crypto/asn1/p7_signi.c        ASN1
-./crypto/asn1/p7_s_e.c          ASN1
-./crypto/asn1/pk.c              ASN1
-./crypto/asn1/pkcs8.c           ASN1
-./crypto/asn1/t_pkey.c          ASN1
-./crypto/asn1/t_req.c           ASN1
-./crypto/asn1/t_x509.c          ASN1
-./crypto/asn1/x_algor.c         ASN1
-./crypto/asn1/x_attrib.c        ASN1
-./crypto/asn1/x_cinf.c          ASN1
-./crypto/asn1/x_crl.c           ASN1
-./crypto/asn1/x_exten.c         ASN1
-./crypto/asn1/x_info.c          ASN1
-./crypto/asn1/x_name.c          ASN1
-./crypto/asn1/x_pkey.c          ASN1
-./crypto/asn1/x_pubkey.c        ASN1
-./crypto/asn1/x_req.c           ASN1
-./crypto/asn1/x_sig.c           ASN1
-./crypto/asn1/x_spki.c          ASN1
-./crypto/asn1/x_val.c           ASN1
-./crypto/asn1/x_x509.c          ASN1
-
-./crypto/bf/blowfish.h          BF
-./crypto/bf/bf_pi.h             BF
-./crypto/bf/bf_locl.h           BF
-./crypto/bf/bfspeed.c           BF
-./crypto/bf/bftest.c            BF
-./crypto/bf/bf_cbc.c            BF
-./crypto/bf/bf_cfb64.c          BF
-./crypto/bf/bf_ecb.c            BF
-./crypto/bf/bf_enc.c            BF
-./crypto/bf/bf_ofb64.c          BF
-./crypto/bf/bf_opts.c           BF
-./crypto/bf/bf_skey.c           BF
-
-./crypto/bio/bio.h              BIO
-./crypto/bio/bf_buff.c          BIO
-./crypto/bio/bf_nbio.c          BIO
-./crypto/bio/bf_null.c          BIO
-./crypto/bio/bio_cb.c           BIO
-./crypto/bio/bio_err.c          BIO
-./crypto/bio/bio_lib.c          BIO
-./crypto/bio/bss_acpt.c         BIO
-./crypto/bio/bss_conn.c         BIO
-./crypto/bio/bss_fd.c           BIO
-./crypto/bio/bss_file.c         BIO
-./crypto/bio/bss_mem.c          BIO
-./crypto/bio/bss_null.c         BIO
-./crypto/bio/bss_rtcp.c         BIO
-./crypto/bio/bss_sock.c         BIO
-./crypto/bio/b_dump.c           BIO
-./crypto/bio/b_print.c          BIO
-./crypto/bio/b_sock.c           BIO
-
-./crypto/bn/bn.h                BN
-./crypto/bn/bn_lcl.h            BN
-./crypto/bn/bn_prime.h          BN
-./crypto/bn/bnspeed.c           BN
-./crypto/bn/bntest.c            BN
-./crypto/bn/bn_add.c            BN
-./crypto/bn/bn_bld.c            BN
-./crypto/bn/bn_blind.c          BN
-./crypto/bn/bn_div.c            BN
-./crypto/bn/bn_err.c            BN
-./crypto/bn/bn_exp.c            BN
-./crypto/bn/bn_gcd.c            BN
-./crypto/bn/bn_lib.c            BN
-./crypto/bn/bn_mod.c            BN
-./crypto/bn/bn_mont.c           BN
-./crypto/bn/bn_mul.c            BN
-./crypto/bn/bn_mulw.c           BN
-./crypto/bn/bn_prime.c          BN
-./crypto/bn/bn_print.c          BN
-./crypto/bn/bn_rand.c           BN
-./crypto/bn/bn_recp.c           BN
-./crypto/bn/bn_shift.c          BN
-./crypto/bn/bn_sqr.c            BN
-./crypto/bn/bn_sub.c            BN
-./crypto/bn/bn_word.c           BN
-./crypto/bn/bn_m.c              BN
-./crypto/bn/m.c                 BN
-./crypto/bn/expspeed.c          BN
-./crypto/bn/bn_mpi.c            BN
-./crypto/bn/exptest.c           BN
-
-./crypto/buffer/buffer.c        BUFF
-./crypto/buffer/buffer.h        BUFF
-./crypto/buffer/buf_err.c       BUFF
-
-./crypto/cast/cast.h            CAST
-./crypto/cast/castopts.c        CAST
-./crypto/cast/casttest.c        CAST
-./crypto/cast/cast_lcl.h        CAST
-./crypto/cast/cast_s.h          CAST
-./crypto/cast/cast_spd.c        CAST
-./crypto/cast/c_cfb64.c         CAST
-./crypto/cast/c_ecb.c           CAST
-./crypto/cast/c_enc.c           CAST
-./crypto/cast/c_ofb64.c         CAST
-./crypto/cast/c_skey.c          CAST
-
-./crypto/conf/conf_lcl.h        CONF
-./crypto/conf/cnf_save.c        CONF
-./crypto/conf/conf.c            CONF
-./crypto/conf/conf.h            CONF
-./crypto/conf/conf_err.c        CONF
-
-./crypto/des/des.h              DES
-./crypto/des/des_locl.h         DES
-./crypto/des/spr.h              DES
-./crypto/des/podd.h             DES
-./crypto/des/sk.h               DES
-./crypto/des/cbc3_enc.c         DES
-./crypto/des/cbc_cksm.c         DES
-./crypto/des/cbc_enc.c          DES
-./crypto/des/cfb64ede.c         DES
-./crypto/des/cfb64enc.c         DES
-./crypto/des/cfb_enc.c          DES
-./crypto/des/des.c              DES
-./crypto/des/destest.c          DES
-./crypto/des/des_enc.c          DES
-./crypto/des/des_opts.c         DES
-./crypto/des/des_ver.h          DES
-./crypto/des/ecb3_enc.c         DES
-./crypto/des/ecb_enc.c          DES
-./crypto/des/ede_enc.c          DES
-./crypto/des/enc_read.c         DES
-./crypto/des/enc_writ.c         DES
-./crypto/des/fcrypt.c           DES
-./crypto/des/fcrypt_b.c         DES
-./crypto/des/ncbc_enc.c         DES
-./crypto/des/ofb64ede.c         DES
-./crypto/des/ofb64enc.c         DES
-./crypto/des/ofb_enc.c          DES
-./crypto/des/pcbc_enc.c         DES
-./crypto/des/qud_cksm.c         DES
-./crypto/des/rand_key.c         DES
-./crypto/des/read2pwd.c         DES
-./crypto/des/read_pwd.c         DES
-./crypto/des/rpc_des.h          DES
-./crypto/des/rpc_enc.c          DES
-./crypto/des/rpw.c              DES
-./crypto/des/set_key.c          DES
-./crypto/des/str2key.c          DES
-./crypto/des/supp.c             DES
-./crypto/des/xcbc_enc.c         DES
-
-./crypto/dh/dh.h                DH
-./crypto/dh/dh_check.c          DH
-./crypto/dh/dh_err.c            DH
-./crypto/dh/dh_gen.c            DH
-./crypto/dh/dh_key.c            DH
-./crypto/dh/dh_lib.c            DH
-./crypto/dh/p1024.c             DH
-./crypto/dh/p192.c              DH
-./crypto/dh/p512.c              DH
-./crypto/dh/dhtest.c            DH
-
-./crypto/dsa/dsa.h              DSA
-./crypto/dsa/dsagen.c           DSA
-./crypto/dsa/dsa_err.c          DSA
-./crypto/dsa/dsa_gen.c          DSA
-./crypto/dsa/dsa_key.c          DSA
-./crypto/dsa/dsa_lib.c          DSA
-./crypto/dsa/dsa_sign.c         DSA
-./crypto/dsa/dsa_vrf.c          DSA
-./crypto/dsa/dsatest.c          DSA
-
-./crypto/err/err.c              ERR
-./crypto/err/err.h              ERR
-./crypto/err/err_all.c          ERR
-./crypto/err/err_prn.c          ERR
-
-./crypto/evp/evp.h              EVP
-./crypto/evp/bio_b64.c          EVP
-./crypto/evp/bio_enc.c          EVP
-./crypto/evp/bio_md.c           EVP
-./crypto/evp/c_all.c            EVP
-./crypto/evp/digest.c           EVP
-./crypto/evp/encode.c           EVP
-./crypto/evp/evp_enc.c          EVP
-./crypto/evp/evp_err.c          EVP
-./crypto/evp/evp_key.c          EVP
-./crypto/evp/e_cbc_3d.c         EVP
-./crypto/evp/e_cbc_bf.c         EVP
-./crypto/evp/e_cbc_c.c          EVP
-./crypto/evp/e_cbc_d.c          EVP
-./crypto/evp/e_cbc_i.c          EVP
-./crypto/evp/e_cbc_r2.c         EVP
-./crypto/evp/e_cfb_3d.c         EVP
-./crypto/evp/e_cfb_bf.c         EVP
-./crypto/evp/e_cfb_c.c          EVP
-./crypto/evp/e_cfb_d.c          EVP
-./crypto/evp/e_cfb_i.c          EVP
-./crypto/evp/e_cfb_r2.c         EVP
-./crypto/evp/e_dsa.c            EVP
-./crypto/evp/e_ecb_3d.c         EVP
-./crypto/evp/e_ecb_bf.c         EVP
-./crypto/evp/e_ecb_c.c          EVP
-./crypto/evp/e_ecb_d.c          EVP
-./crypto/evp/e_ecb_i.c          EVP
-./crypto/evp/e_ecb_r2.c         EVP
-./crypto/evp/e_null.c           EVP
-./crypto/evp/e_ofb_3d.c         EVP
-./crypto/evp/e_ofb_bf.c         EVP
-./crypto/evp/e_ofb_c.c          EVP
-./crypto/evp/e_ofb_d.c          EVP
-./crypto/evp/e_ofb_i.c          EVP
-./crypto/evp/e_ofb_r2.c         EVP
-./crypto/evp/e_rc4.c            EVP
-./crypto/evp/e_xcbc_d.c         EVP
-./crypto/evp/m_dss.c            EVP
-./crypto/evp/m_dss1.c           EVP
-./crypto/evp/m_md2.c            EVP
-./crypto/evp/m_md5.c            EVP
-./crypto/evp/m_mdc2.c           EVP
-./crypto/evp/m_null.c           EVP
-./crypto/evp/m_sha.c            EVP
-./crypto/evp/m_sha1.c           EVP
-./crypto/evp/names.c            EVP
-./crypto/evp/p_lib.c            EVP
-./crypto/evp/p_open.c           EVP
-./crypto/evp/p_seal.c           EVP
-./crypto/evp/p_sign.c           EVP
-./crypto/evp/p_verify.c         EVP
-
-./crypto/hmac/hmac.c            HMAC
-./crypto/hmac/hmac.h            HMAC
-./crypto/hmac/hmactest.c        HMAC
-
-./crypto/idea/ideatest.c        IDEA
-./crypto/idea/idea_lcl.h        IDEA
-./crypto/idea/idea_spd.c        IDEA
-./crypto/idea/i_cbc.c           IDEA
-./crypto/idea/i_cfb64.c         IDEA
-./crypto/idea/i_ecb.c           IDEA
-./crypto/idea/i_ofb64.c         IDEA
-./crypto/idea/i_skey.c          IDEA
-./crypto/idea/idea.h            IDEA
-
-./crypto/lhash/lhash.c          LHASH
-./crypto/lhash/lhash.h          LHASH
-./crypto/lhash/lh_stats.c       LHASH
-./crypto/lhash/lh_test.c        LHASH
-
-./crypto/md2/md2.c              MD2
-./crypto/md2/md2test.c          MD2
-./crypto/md2/md2_dgst.c         MD2
-./crypto/md2/md2_one.c          MD2
-./crypto/md2/md2.h              MD2
-
-./crypto/md5/md5.c              MD5
-./crypto/md5/md5.h              MD5
-./crypto/md5/md5test.c          MD5
-./crypto/md5/md5_dgst.c         MD5
-./crypto/md5/md5_locl.h         MD5
-./crypto/md5/md5_one.c          MD5
-
-./crypto/mdc2/mdc2.h            MDC2
-./crypto/mdc2/mdc2dgst.c        MDC2
-./crypto/mdc2/mdc2test.c        MDC2
-./crypto/mdc2/mdc2_one.c        MDC2
-
-./crypto/objects/objects.h      OBJ
-./crypto/objects/obj_dat.c      OBJ
-./crypto/objects/obj_dat.h      OBJ
-./crypto/objects/obj_err.c      OBJ
-./crypto/objects/obj_lib.c      OBJ
-
-./crypto/pem/ctx_size.c         PEM
-./crypto/pem/pem.h              PEM
-./crypto/pem/pem_all.c          PEM
-./crypto/pem/pem_err.c          PEM
-./crypto/pem/pem_info.c         PEM
-./crypto/pem/pem_lib.c          PEM
-./crypto/pem/pem_seal.c         PEM
-./crypto/pem/pem_sign.c         PEM
-
-./crypto/pkcs7/pk7_dgst.c       PKCS7
-./crypto/pkcs7/pk7_doit.c       PKCS7
-./crypto/pkcs7/pk7_enc.c        PKCS7
-./crypto/pkcs7/pk7_lib.c        PKCS7
-./crypto/pkcs7/pkcs7.h          PKCS7
-./crypto/pkcs7/pkcs7err.c       PKCS7
-./crypto/pkcs7/sign.c           PKCS7
-
-./crypto/proxy/bf_proxy.c       PROXY
-./crypto/proxy/p2test.c         PROXY
-./crypto/proxy/p3test.c         PROXY
-./crypto/proxy/paccept.c        PROXY
-./crypto/proxy/proxy.c          PROXY
-./crypto/proxy/proxy.h          PROXY
-./crypto/proxy/ptest.c          PROXY
-./crypto/proxy/pxy_conf.c       PROXY
-./crypto/proxy/pxy_err.c        PROXY
-./crypto/proxy/pxy_txt.c        PROXY
-
-./crypto/rand/md_rand.c         RAND
-./crypto/rand/rand.h            RAND
-./crypto/rand/randfile.c        RAND
-./crypto/rand/randtest.c        RAND
-
-./crypto/rc2/rc2cfb64.c         RC2
-./crypto/rc2/rc2ofb64.c         RC2
-./crypto/rc2/rc2speed.c         RC2
-./crypto/rc2/rc2test.c          RC2
-./crypto/rc2/rc2_cbc.c          RC2
-./crypto/rc2/rc2_ecb.c          RC2
-./crypto/rc2/rc2_locl.h         RC2
-./crypto/rc2/rc2_skey.c         RC2
-./crypto/rc2/rc2.h              RC2
-
-./crypto/rc4/rc4.c              RC4
-./crypto/rc4/rc4speed.c         RC4
-./crypto/rc4/rc4test.c          RC4
-./crypto/rc4/rc4_enc.c          RC4
-./crypto/rc4/rc4_skey.c         RC4
-./crypto/rc4/rc4.h              RC4
-./crypto/rc4/rc4_locl.h         RC4
-
-./crypto/rsa/rsa.h              RSA
-./crypto/rsa/rsa_eay.c          RSA
-./crypto/rsa/rsa_err.c          RSA
-./crypto/rsa/rsa_gen.c          RSA
-./crypto/rsa/rsa_lib.c          RSA
-./crypto/rsa/rsa_saos.c         RSA
-./crypto/rsa/rsa_sign.c         RSA
-./crypto/rsa/rsa_ssl.c          RSA
-./crypto/rsa/rsa_pk1.c          RSA
-./crypto/rsa/rsa_none.c         RSA
-
-./crypto/sha/sha.h              SHA
-./crypto/sha/sha_locl.h         SHA
-./crypto/sha/sha.c              SHA0
-./crypto/sha/sha_dgst.c         SHA0
-./crypto/sha/sha_one.c          SHA0
-./crypto/sha/sha_sgst.c         SHA0
-./crypto/sha/shatest.c          SHA0
-./crypto/sha/sha1.c             SHA1
-./crypto/sha/sha1dgst.c         SHA1
-./crypto/sha/sha1_one.c         SHA1
-./crypto/sha/sha1test.c         SHA1
-
-./crypto/stack/stack.c          STACK
-./crypto/stack/stack.h          STACK
-
-./crypto/txt_db/txt_db.c        TXTDB
-./crypto/txt_db/txt_db.h        TXTDB
-
-./crypto/x509/by_dir.c          X509
-./crypto/x509/by_file.c         X509
-./crypto/x509/v3_net.c          X509
-./crypto/x509/v3_x509.c         X509
-./crypto/x509/x509.h            X509
-./crypto/x509/x509name.c        X509
-./crypto/x509/x509pack.c        X509
-./crypto/x509/x509rset.c        X509
-./crypto/x509/x509type.c        X509
-./crypto/x509/x509_cmp.c        X509
-./crypto/x509/x509_d2.c         X509
-./crypto/x509/x509_def.c        X509
-./crypto/x509/x509_err.c        X509
-./crypto/x509/x509_ext.c        X509
-./crypto/x509/x509_lu.c         X509
-./crypto/x509/x509_obj.c        X509
-./crypto/x509/x509_r2x.c        X509
-./crypto/x509/x509_req.c        X509
-./crypto/x509/x509_set.c        X509
-./crypto/x509/x509_txt.c        X509
-./crypto/x509/x509_v3.c         X509
-./crypto/x509/x509_vfy.c        X509
-./crypto/x509/x_all.c           X509
-./crypto/x509/x509_vfy.h        X509
-./crypto/x509v3/v3_ku.c         X509
-./crypto/x509v3/x509v3.h        X509
-
-./crypto/threads/mttest.c       THREADS
-./crypto/threads/th-lock.c      THREADS
-
-./crypto/ripemd/rmdtest.c       RMD160
-./crypto/ripemd/ripemd.h        RMD160
-./crypto/ripemd/rmdconst.h      RMD160
-./crypto/ripemd/rmd_locl.h      RMD160
-./crypto/ripemd/rmd_one.c       RMD160
-./crypto/ripemd/rmd160.c        RMD160
-./crypto/ripemd/rmd_dgst.c      RMD160
-
-./crypto/rc5/rc5_ecb.c          RC5
-./crypto/rc5/rc5cfb64.c         RC5
-./crypto/rc5/rc5ofb64.c         RC5
-./crypto/rc5/rc5speed.c         RC5
-./crypto/rc5/rc5test.c          RC5
-./crypto/rc5/rc5_enc.c          RC5
-./crypto/rc5/rc5.h              RC5
-./crypto/rc5/rc5_locl.h         RC5
-./crypto/rc5/rc5_skey.c         RC5
-
-./ssl/bio_ssl.c                 SSL
-./ssl/pxy_ssl.c                 SSL
-./ssl/s23_clnt.c                SSL
-./ssl/s23_lib.c                 SSL
-./ssl/s23_meth.c                SSL
-./ssl/s23_pkt.c                 SSL
-./ssl/s23_srvr.c                SSL
-./ssl/s2_clnt.c                 SSL
-./ssl/s2_enc.c                  SSL
-./ssl/s2_lib.c                  SSL
-./ssl/s2_meth.c                 SSL
-./ssl/s2_pkt.c                  SSL
-./ssl/s2_srvr.c                 SSL
-./ssl/s3_both.c                 SSL
-./ssl/s3_clnt.c                 SSL
-./ssl/s3_enc.c                  SSL
-./ssl/s3_lib.c                  SSL
-./ssl/s3_meth.c                 SSL
-./ssl/s3_pkt.c                  SSL
-./ssl/s3_srvr.c                 SSL
-./ssl/ssl.c                     SSL
-./ssl/ssl2.h                    SSL
-./ssl/ssl23.h                   SSL
-./ssl/ssl3.h                    SSL
-./ssl/ssl_algs.c                SSL
-./ssl/ssl_asn1.c                SSL
-./ssl/ssl_cert.c                SSL
-./ssl/ssl_ciph.c                SSL
-./ssl/ssl_err.c                 SSL
-./ssl/ssl_err2.c                SSL
-./ssl/ssl_lib.c                 SSL
-./ssl/ssl_locl.h                SSL
-./ssl/ssl_rsa.c                 SSL
-./ssl/ssl_sess.c                SSL
-./ssl/ssl_stat.c                SSL
-./ssl/ssl_task.c                SSL
-./ssl/ssl_txt.c                 SSL
-./ssl/tls1.h                    SSL
-./ssl/t1_lib.c                  SSL
-./ssl/t1_enc.c                  SSL
-./ssl/t1_meth.c                 SSL
-./ssl/t1_srvr.c                 SSL
-./ssl/t1_clnt.c                 SSL
-./ssl/ssl.h                     SSL
-./ssl/ssltest.c                 SSL
-
-./rsaref/rsaref.c               RSAREF
-./rsaref/rsaref.h               RSAREF
-./rsaref/rsar_err.c             RSAREF
-
-./apps/apps.c                   APPS
-./apps/apps.h                   APPS
-./apps/asn1pars.c               APPS
-./apps/bf_perm.c                APPS
-./apps/bf_perm.h                APPS
-./apps/ca.c                     APPS
-./apps/ciphers.c                APPS
-./apps/crl.c                    APPS
-./apps/crl2p7.c                 APPS
-./apps/dgst.c                   APPS
-./apps/dh.c                     APPS
-./apps/dsa.c                    APPS
-./apps/dsaparam.c               APPS
-./apps/eay.c                    APPS
-./apps/enc.c                    APPS
-./apps/errstr.c                 APPS
-./apps/speed.c                  APPS
-./apps/gendh.c                  APPS
-./apps/gendsa.c                 APPS
-./apps/genrsa.c                 APPS
-./apps/mybio_cb.c               APPS
-./apps/pem_mail.c               APPS
-./apps/pkcs7.c                  APPS
-./apps/progs.h                  APPS
-./apps/req.c                    APPS
-./apps/rsa.c                    APPS
-./apps/sess_id.c                APPS
-./apps/s_apps.h                 APPS
-./apps/s_cb.c                   APPS
-./apps/s_client.c               APPS
-./apps/s_server.c               APPS
-./apps/s_socket.c               APPS
-./apps/s_time.c                 APPS
-./apps/testdsa.h                APPS
-./apps/testrsa.h                APPS
-./apps/verify.c                 APPS
-./apps/version.c                APPS
-./apps/x509.c                   APPS
-./apps/ssleay.c                 APPS
-./apps/sp.c                     APPS
-
-./demos/b64.c                   DEMO
-./demos/bio/saccept.c           DEMO
-./demos/bio/sconnect.c          DEMO
-./demos/maurice/example1.c      DEMO
-./demos/maurice/example2.c      DEMO
-./demos/maurice/example3.c      DEMO
-./demos/maurice/example4.c      DEMO
-./demos/maurice/loadkeys.c      DEMO
-./demos/maurice/loadkeys.h      DEMO
-./demos/prime/prime.c           DEMO
-./demos/selfsign.c              DEMO
-./demos/spkigen.c               DEMO
-
diff --git a/src/lib/libssl/src/dep/gen.pl b/src/lib/libssl/src/dep/gen.pl
index 8ab6db5c53..e69de29bb2 100644
--- a/src/lib/libssl/src/dep/gen.pl
+++ b/src/lib/libssl/src/dep/gen.pl
@@ -1,113 +0,0 @@
-#!/usr/local/bin/perl
-
-require 'getopts.pl';
-
-$files="files";
-%have=();
-%missing=();
-%name=();
-%func=();
-
-&Getopts('Ff:');
-
-&load_file("files");
-foreach $file (@ARGV)
-        { &do_nm($file); }
-
-if (defined($opt_f))
-        {
-        %a=();
-        $r=&list_files($opt_f,"",*a);
-        if ($opt_F)
-                {
-                foreach (sort split(/\n/,$r))
-                        { print "$_\n"; }
-                }
-        else
-                { print $r; }
-        }
-else
-        {
-        for (sort keys %have)
-                {
-                print "$_:$have{$_}\n";
-                }
-        }
-
-sub list_files
-        {
-        local($f,$o,*done)=@_;
-        local($a,$_,$ff,$ret);
-
-        return if $f =~ /^\s*$/;
-
-        $done{$f}=1;
-        $ret.=$f."\n" if $opt_F;
-        foreach (split(/ /,$have{$f}))
-                {
-                $ret.="$o$f:$_\n" unless $opt_F;
-                }
-
-        foreach (split(/ /,$missing{$f}))
-                {
-                $ff=$func{$_};
-                next if defined($done{$ff});
-                $ret.=&list_files($ff,$o."      ");
-                }
-        $ret;
-        }
-
-sub do_nm
-        {
-        local($file)=@_;
-        local($fname)="";
-
-        open(IN,"nm $file|") || die "unable to run 'nm $file|':$!\n";
-        while (<IN>)
-                {
-                chop;
-                next if /^\s*$/;
-                if (/^(.*)\.o:\s*$/)
-                        {
-                        $fname="$1.c";
-                        next;
-                        }
-                ($type,$name)=/^.{8} (.) (.+)/;
-#               print "$fname $type $name\n";
-
-                if ($type eq "T")
-                        {
-                        $have{$fname}.="$name ";
-                        $func{$name}=$fname;
-                        }
-                elsif ($type eq "U")
-                        {
-                        $missing{$fname}.="$name ";
-                        }
-                }
-        close(IN);
-        }
-
-sub load_file
-        {
-        local($file)=@_;
-
-        open(IN,"<$files") || die "unable to open $files:$!\n";
-
-        while (<IN>)
-                {
-                chop;
-                next if /^\s*$/;
-                ($n)=/\/([^\/\s]+)\s+/;
-                ($fn)=/^(\S+)\s/;
-#               print "$n - $fn\n";
-                if (defined($name{$n}))
-                        { print "$n already exists\n"; }
-                else
-                        { $name{$n}=$fn; }
-                }
-        close(IN);
-        @name=%name;
-        }
-
-
diff --git a/src/lib/libssl/src/dep/ssl.txt b/src/lib/libssl/src/dep/ssl.txt
index 7cd125a0d1..e69de29bb2 100644
--- a/src/lib/libssl/src/dep/ssl.txt
+++ b/src/lib/libssl/src/dep/ssl.txt
@@ -1,156 +0,0 @@
-BIO_f_ssl
-BIO_new_buffer_ssl_connect
-BIO_new_ssl
-BIO_new_ssl_connect
-BIO_proxy_ssl_copy_session_id
-BIO_ssl_copy_session_id
-BIO_ssl_shutdown
-ERR_load_SSL_strings
-SSL_CIPHER_description
-SSL_CIPHER_get_bits
-SSL_CIPHER_get_name
-SSL_CIPHER_get_version
-SSL_CTX_add_client_CA
-SSL_CTX_add_session
-SSL_CTX_check_private_key
-SSL_CTX_ctrl
-SSL_CTX_flush_sessions
-SSL_CTX_free
-SSL_CTX_get_client_CA_list
-SSL_CTX_get_ex_data
-SSL_CTX_get_ex_new_index
-SSL_CTX_get_quiet_shutdown
-SSL_CTX_get_verify_callback
-SSL_CTX_get_verify_mode
-SSL_CTX_load_verify_locations
-SSL_CTX_new
-SSL_CTX_remove_session
-SSL_CTX_set_cert_verify_cb
-SSL_CTX_set_cipher_list
-SSL_CTX_set_client_CA_list
-SSL_CTX_set_default_passwd_cb
-SSL_CTX_set_default_verify_paths
-SSL_CTX_set_ex_data
-SSL_CTX_set_quiet_shutdown
-SSL_CTX_set_ssl_version
-SSL_CTX_set_verify
-SSL_CTX_use_PrivateKey
-SSL_CTX_use_PrivateKey_ASN1
-SSL_CTX_use_PrivateKey_file
-SSL_CTX_use_RSAPrivateKey
-SSL_CTX_use_RSAPrivateKey_ASN1
-SSL_CTX_use_RSAPrivateKey_file
-SSL_CTX_use_certificate
-SSL_CTX_use_certificate_ASN1
-SSL_CTX_use_certificate_file
-SSL_SESSION_cmp
-SSL_SESSION_free
-SSL_SESSION_get_ex_data
-SSL_SESSION_get_ex_new_index
-SSL_SESSION_get_time
-SSL_SESSION_get_timeout
-SSL_SESSION_hash
-SSL_SESSION_new
-SSL_SESSION_print
-SSL_SESSION_print_fp
-SSL_SESSION_set_ex_data
-SSL_SESSION_set_time
-SSL_SESSION_set_timeout
-SSL_accept
-SSL_add_client_CA
-SSL_alert_desc_string
-SSL_alert_desc_string_long
-SSL_alert_type_string
-SSL_alert_type_string_long
-SSL_check_private_key
-SSL_clear
-SSL_connect
-SSL_copy_session_id
-SSL_ctrl
-SSL_do_handshake
-SSL_dup
-SSL_dup_CA_list
-SSL_free
-SSL_get_SSL_CTX
-SSL_get_certificate
-SSL_get_cipher_list
-SSL_get_ciphers
-SSL_get_client_CA_list
-SSL_get_current_cipher
-SSL_get_default_timeout
-SSL_get_error
-SSL_get_ex_data
-SSL_get_ex_new_index
-SSL_get_fd
-SSL_get_info_callback
-SSL_get_peer_cert_chain
-SSL_get_peer_certificate
-SSL_get_privatekey
-SSL_get_quiet_shutdown
-SSL_get_rbio
-SSL_get_read_ahead
-SSL_get_session
-SSL_get_shared_ciphers
-SSL_get_shutdown
-SSL_get_ssl_method
-SSL_get_verify_callback
-SSL_get_verify_mode
-SSL_get_verify_result
-SSL_get_version
-SSL_get_wbio
-SSL_load_client_CA_file
-SSL_load_error_strings
-SSL_new
-SSL_peek
-SSL_pending
-SSL_read
-SSL_renegotiate
-SSL_rstate_string
-SSL_rstate_string_long
-SSL_set_accept_state
-SSL_set_bio
-SSL_set_cipher_list
-SSL_set_client_CA_list
-SSL_set_connect_state
-SSL_set_ex_data
-SSL_set_fd
-SSL_set_info_callback
-SSL_set_quiet_shutdown
-SSL_set_read_ahead
-SSL_set_rfd
-SSL_set_session
-SSL_set_shutdown
-SSL_set_ssl_method
-SSL_set_verify
-SSL_set_verify_result
-SSL_set_wfd
-SSL_shutdown
-SSL_state
-SSL_state_string
-SSL_state_string_long
-SSL_use_PrivateKey
-SSL_use_PrivateKey_ASN1
-SSL_use_PrivateKey_file
-SSL_use_RSAPrivateKey
-SSL_use_RSAPrivateKey_ASN1
-SSL_use_RSAPrivateKey_file
-SSL_use_certificate
-SSL_use_certificate_ASN1
-SSL_use_certificate_file
-SSL_version
-SSL_write
-SSLeay_add_ssl_algorithms
-SSLv23_client_method
-SSLv23_method
-SSLv23_server_method
-SSLv2_client_method
-SSLv2_method
-SSLv2_server_method
-SSLv3_client_method
-SSLv3_method
-SSLv3_server_method
-TLSv1_client_method
-TLSv1_method
-TLSv1_server_method
-d2i_SSL_SESSION
-i2d_SSL_SESSION
diff --git a/src/lib/libssl/src/doc/README b/src/lib/libssl/src/doc/README
index a9a588262a..14469a82e3 100644
--- a/src/lib/libssl/src/doc/README
+++ b/src/lib/libssl/src/doc/README
@@ -1,9 +1,9 @@
 
- openssl.pod ..... Documentation of OpenSSL `openssl' command
- crypto.pod ...... Documentation of OpenSSL crypto.h+libcrypto.a
- ssl.pod ......... Documentation of OpenSSL ssl.h+libssl.a
- ssleay.txt ...... Assembled documentation files of ancestor SSLeay [obsolete]
- openssl.txt ..... Assembled documentation files for OpenSSL [not final]
+ apps/openssl.pod .... Documentation of OpenSSL `openssl' command
+ crypto/crypto.pod ... Documentation of OpenSSL crypto.h+libcrypto.a
+ ssl/ssl.pod ......... Documentation of OpenSSL ssl.h+libssl.a
+ openssl.txt ......... Assembled documentation files for OpenSSL [not final]
+ ssleay.txt .......... Assembled documentation of ancestor SSLeay [obsolete]
 
  An archive of HTML documents for the SSLeay library is available from
  http://www.columbia.edu/~ariel/ssleay/
diff --git a/src/lib/libssl/src/doc/apps/CA.pl.pod b/src/lib/libssl/src/doc/apps/CA.pl.pod
new file mode 100644
index 0000000000..83e4c0af81
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/CA.pl.pod
@@ -0,0 +1,138 @@
+
+=pod
+
+=head1 NAME
+
+CA.pl - friendlier interface for OpenSSL certificate programs
+
+=head1 SYNOPSIS
+
+B<CA.pl>
+[B<-?>]
+[B<-h>]
+[B<-help>]
+[B<-newcert>]
+[B<-newreq>]
+[B<-newca>]
+[B<-xsign>]
+[B<-sign>]
+[B<-signreq>]
+[B<-signcert>]
+[B<-verify>]
+[B<files>]
+
+=head1 DESCRIPTION
+
+The B<CA.pl> script is a perl script that supplies the relevant command line
+arguments to the B<openssl> command for some common certificate operations.
+It is intended to simplify the process of certificate creation and management
+by the use of some simple options.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<?>, B<-h>, B<-help>
+
+prints a usage message.
+
+=item B<-newcert>
+
+creates a new self signed certificate. The private key and certificate are
+written to the file "newreq.pem".
+
+=item B<-newreq>
+
+creates a new certificate request. The private key and request are
+written to the file "newreq.pem".
+
+=item B<-newca>
+
+creates a new CA hierarchy for use with the B<ca> program (or the B<-signcert>
+and B<-xsign> options). The user is prompted to enter the filename of the CA
+certificates (which should also contain the private key) or by hitting ENTER
+details of the CA will be prompted for. The relevant files and directories
+are created in a directory called "demoCA" in the current directory.
+
+=item B<-pkcs12>
+
+create a PKCS#12 file containing the user certificate, private key and CA
+certificate. It expects the user certificate and private key to be in the
+file "newcert.pem" and the CA certificate to be in the file demoCA/cacert.pem,
+it creates a file "newcert.p12". This command can thus be called after the
+B<-sign> option. The PKCS#12 file can be imported directly into a browser.
+If there is an additional argument on the command line it will be used as the
+"friendly name" for the certificate (which is typically displayed in the browser
+list box), otherwise the name "My Certificate" is used.
+
+=item B<-sign>, B<-signreq>, B<-xsign>
+
+calls the B<ca> program to sign a certificate request. It expects the request
+to be in the file "newreq.pem". The new certificate is written to the file
+"newcert.pem" except in the case of the B<-xcert> option when it is written
+to standard output.
+
+=item B<-signcert>
+
+this option is the same as B<-sign> except it expects a self signed certificate
+to be present in the file "newreq.pem".
+
+=item B<-verify>
+
+verifies certificates against the CA certificate for "demoCA". If no certificates
+are specified on the command line it tries to verify the file "newcert.pem". 
+
+=item B<files>
+
+one or more optional certificate file names for use with the B<-verify> command.
+
+=back
+
+=head1 EXAMPLES
+
+Create a CA hierarchy:
+
+ CA.pl -newca
+
+Complete certificate creation example: create a CA, create a request, sign
+the request and finally create a PKCS#12 file containing it.
+
+ CA.pl -newca
+ CA.pl -newreq
+ CA.pl -signreq
+ CA.pl -pkcs12 "My Test Certificate"
+
+=head1 NOTES
+
+Most of the filenames mentioned can be modified by editing the B<CA.pl> script.
+
+If the demoCA directory already exists then the B<-newca> command will not
+overwrite it and will do nothing. This can happen if a previous call using
+the B<-newca> option terminated abnormally. To get the correct behaviour
+delete the demoCA directory if it already exists.
+
+Under some environments it may not be possible to run the B<CA.pl> script
+directly (for example Win32) and the default configuration file location may
+be wrong. In this case the command:
+
+ perl -S CA.pl
+
+can be used and the B<OPENSSL_CONF> environment variable changed to point to 
+the correct path of the configuration file "openssl.cnf".
+
+The script is intended as a simple front end for the B<openssl> program for use
+by a beginner. Its behaviour isn't always what is wanted. For more control over the
+behaviour of the certificate commands call the B<openssl> command directly.
+
+=head1 ENVIRONMENT VARIABLES
+
+The variable B<OPENSSL_CONF> if defined allows an alternative configuration
+file location to be specified, it should contain the full path to the
+configuration file, not just its directory.
+
+=head1 SEE ALSO
+
+L<x509(1)|x509(1)>, L<ca(1)|ca(1)>, L<req(1)|req(1)>, L<pkcs12(1)|pkcs12(1)>,
+L<config(5)|config(5)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/asn1parse.pod b/src/lib/libssl/src/doc/apps/asn1parse.pod
new file mode 100644
index 0000000000..e76e9813ab
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/asn1parse.pod
@@ -0,0 +1,129 @@
+=pod
+
+=head1 NAME
+
+asn1parse - ASN.1 parsing tool
+
+=head1 SYNOPSIS
+
+B<openssl> B<asn1parse>
+[B<-inform PEM|DER>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-noout>]
+[B<-offset number>]
+[B<-length number>]
+[B<-i>]
+[B<-oid filename>]
+[B<-strparse offset>]
+
+=head1 DESCRIPTION
+
+The B<asn1parse> command is a diagnostic utility that can parse ASN.1
+structures. It can also be used to extract data from ASN.1 formatted data.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-inform> B<DER|PEM>
+
+the input format. B<DER> is binary format and B<PEM> (the default) is base64
+encoded.
+
+=item B<-in filename>
+
+the input file, default is standard input
+
+=item B<-out filename>
+
+output file to place the DER encoded data into. If this
+option is not present then no data will be output. This is most useful when
+combined with the B<-strparse> option.
+
+=item B<-noout>
+
+don't output the parsed version of the input file.
+
+=item B<-offset number>
+
+starting offset to begin parsing, default is start of file.
+
+=item B<-length number>
+
+number of bytes to parse, default is until end of file.
+
+=item B<-i>
+
+indents the output according to the "depth" of the structures.
+
+=item B<-oid filename>
+
+a file containing additional OBJECT IDENTIFIERs (OIDs). The format of this
+file is described in the NOTES section below.
+
+=item B<-strparse offset>
+
+parse the contents octets of the ASN.1 object starting at B<offset>. This
+option can be used multiple times to "drill down" into a nested structure.
+
+
+=back
+
+=head2 OUTPUT
+
+The output will typically contain lines like this:
+
+  0:d=0  hl=4 l= 681 cons: SEQUENCE          
+
+.....
+
+  229:d=3  hl=3 l= 141 prim: BIT STRING        
+  373:d=2  hl=3 l= 162 cons: cont [ 3 ]        
+  376:d=3  hl=3 l= 159 cons: SEQUENCE          
+  379:d=4  hl=2 l=  29 cons: SEQUENCE          
+  381:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Subject Key Identifier
+  386:d=5  hl=2 l=  22 prim: OCTET STRING      
+  410:d=4  hl=2 l= 112 cons: SEQUENCE          
+  412:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Authority Key Identifier
+  417:d=5  hl=2 l= 105 prim: OCTET STRING      
+  524:d=4  hl=2 l=  12 cons: SEQUENCE          
+
+.....
+
+This example is part of a self signed certificate. Each line starts with the
+offset in decimal. B<d=XX> specifies the current depth. The depth is increased
+within the scope of any SET or SEQUENCE. B<hl=XX> gives the header length
+(tag and length octets) of the current type. B<l=XX> gives the length of
+the contents octets.
+
+The B<-i> option can be used to make the output more readable.
+
+Some knowledge of the ASN.1 structure is needed to interpret the output. 
+
+In this example the BIT STRING at offset 229 is the certificate public key.
+The contents octets of this will contain the public key information. This can
+be examined using the option B<-strparse 229> to yield:
+
+    0:d=0  hl=3 l= 137 cons: SEQUENCE          
+    3:d=1  hl=3 l= 129 prim: INTEGER           :E5D21E1F5C8D208EA7A2166C7FAF9F6BDF2059669C60876DDB70840F1A5AAFA59699FE471F379F1DD6A487E7D5409AB6A88D4A9746E24B91D8CF55DB3521015460C8EDE44EE8A4189F7A7BE77D6CD3A9AF2696F486855CF58BF0EDF2B4068058C7A947F52548DDF7E15E96B385F86422BEA9064A3EE9E1158A56E4A6F47E5897
+  135:d=1  hl=2 l=   3 prim: INTEGER           :010001
+
+=head1 NOTES
+
+If an OID is not part of OpenSSL's internal table it will be represented in
+numerical form (for example 1.2.3.4). The file passed to the B<-oid> option 
+allows additional OIDs to be included. Each line consists of three columns,
+the first column is the OID in numerical format and should be followed by white
+space. The second column is the "short name" which is a single word followed
+by white space. The final column is the rest of the line and is the
+"long name". B<asn1parse> displays the long name. Example:
+
+C<1.2.3.4       shortName       A long name>
+
+=head1 BUGS
+
+There should be options to change the format of input lines. The output of some
+ASN.1 types is not well handled (if at all).
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/ca.pod b/src/lib/libssl/src/doc/apps/ca.pod
new file mode 100644
index 0000000000..03209aa6b1
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/ca.pod
@@ -0,0 +1,479 @@
+
+=pod
+
+=head1 NAME
+
+ca - sample minimal CA application
+
+=head1 SYNOPSIS
+
+B<openssl> B<ca>
+[B<-verbose>]
+[B<-config filename>]
+[B<-name section>]
+[B<-gencrl>]
+[B<-revoke file>]
+[B<-crldays days>]
+[B<-crlhours hours>]
+[B<-crlexts section>]
+[B<-startdate date>]
+[B<-enddate date>]
+[B<-days arg>]
+[B<-md arg>]
+[B<-policy arg>]
+[B<-keyfile arg>]
+[B<-key arg>]
+[B<-cert file>]
+[B<-in file>]
+[B<-out file>]
+[B<-notext>]
+[B<-outdir dir>]
+[B<-infiles>]
+[B<-spkac file>]
+[B<-ss_cert file>]
+[B<-preserveDN>]
+[B<-batch>]
+[B<-msie_hack>]
+[B<-extensions section>]
+
+=head1 DESCRIPTION
+
+The B<ca> command is a minimal CA application. It can be used
+to sign certificate requests in a variety of forms and generate
+CRLs it also maintains a text database of issued certificates
+and their status.
+
+The options descriptions will be divided into each purpose.
+
+=head1 CA OPTIONS
+
+=over 4
+
+=item B<-config filename>
+
+specifies the configuration file to use.
+
+=item B<-in filename>
+
+an input filename containing a single certificate request to be
+signed by the CA.
+
+=item B<-ss_cert filename>
+
+a single self signed certificate to be signed by the CA.
+
+=item B<-spkac filename>
+
+a file containing a single Netscape signed public key and challenge
+and additional field values to be signed by the CA. See the B<NOTES>
+section for information on the required format.
+
+=item B<-infiles>
+
+if present this should be the last option, all subsequent arguments
+are assumed to the the names of files containing certificate requests. 
+
+=item B<-out filename>
+
+the output file to output certificates to. The default is standard
+output. The certificate details will also be printed out to this
+file.
+
+=item B<-outdir directory>
+
+the directory to output certificates to. The certificate will be
+written to a filename consisting of the serial number in hex with
+".pem" appended.
+
+=item B<-cert>
+
+the CA certificate file.
+
+=item B<-keyfile filename>
+
+the private key to sign requests with.
+
+=item B<-key password>
+
+the password used to encrypt the private key. Since on some
+systems the command line arguments are visible (e.g. Unix with
+the 'ps' utility) this option should be used with caution.
+
+=item B<-verbose>
+
+this prints extra details about the operations being performed.
+
+=item B<-notext>
+
+don't output the text form of a certificate to the output file.
+
+=item B<-startdate date>
+
+this allows the start date to be explicitly set. The format of the
+date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure).
+
+=item B<-enddate date>
+
+this allows the expiry date to be explicitly set. The format of the
+date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure).
+
+=item B<-days arg>
+
+the number of days to certify the certificate for.
+
+=item B<-md alg>
+
+the message digest to use. Possible values include md5, sha1 and mdc2.
+This option also applies to CRLs.
+
+=item B<-policy arg>
+
+this option defines the CA "policy" to use. This is a section in
+the configuration file which decides which fields should be mandatory
+or match the CA certificate. Check out the B<POLICY FORMAT> section
+for more information.
+
+=item B<-msie_hack>
+
+this is a legacy option to make B<ca> work with very old versions of
+the IE certificate enrollment control "certenr3". It used UniversalStrings
+for almost everything. Since the old control has various security bugs
+its use is strongly discouraged. The newer control "Xenroll" does not
+need this option.
+
+=item B<-preserveDN>
+
+Normally the DN order of a certificate is the same as the order of the
+fields in the relevant policy section. When this option is set the order 
+is the same as the request. This is largely for compatibility with the
+older IE enrollment control which would only accept certificates if their
+DNs match the order of the request. This is not needed for Xenroll.
+
+=item B<-batch>
+
+this sets the batch mode. In this mode no questions will be asked
+and all certificates will be certified automatically.
+
+=item B<-extensions section>
+
+the section of the configuration file containing certificate extensions
+to be added when a certificate is issued. If no extension section is
+present then a V1 certificate is created. If the extension section
+is present (even if it is empty) then a V3 certificate is created.
+
+=back
+
+=head1 CRL OPTIONS
+
+=over 4
+
+=item B<-gencrl>
+
+this option generates a CRL based on information in the index file.
+
+=item B<-crldays num>
+
+the number of days before the next CRL is due. That is the days from
+now to place in the CRL nextUpdate field.
+
+=item B<-crlhours num>
+
+the number of hours before the next CRL is due.
+
+=item B<-revoke filename>
+
+a filename containing a certificate to revoke.
+
+=item B<-crlexts section>
+
+the section of the configuration file containing CRL extensions to
+include. If no CRL extension section is present then a V1 CRL is
+created, if the CRL extension section is present (even if it is
+empty) then a V2 CRL is created. The CRL extensions specified are
+CRL extensions and B<not> CRL entry extensions.  It should be noted
+that some software (for example Netscape) can't handle V2 CRLs. 
+
+=back
+
+=head1 CONFIGURATION FILE OPTIONS
+
+The options for B<ca> are contained in the B<ca> section of the
+configuration file. Many of these are identical to command line
+options. Where the option is present in the configuration file
+and the command line the command line value is used. Where an
+option is described as mandatory then it must be present in
+the configuration file or the command line equivalent (if
+any) used.
+
+=over 4
+
+=item B<oid_file>
+
+This specifies a file containing additional B<OBJECT IDENTIFIERS>.
+Each line of the file should consist of the numerical form of the
+object identifier followed by white space then the short name followed
+by white space and finally the long name. 
+
+=item B<oid_section>
+
+This specifies a section in the configuration file containing extra
+object identifiers. Each line should consist of the short name of the
+object identifier followed by B<=> and the numerical form. The short
+and long names are the same when this option is used.
+
+=item B<new_certs_dir>
+
+the same as the B<-outdir> command line option. It specifies
+the directory where new certificates will be placed. Mandatory.
+
+=item B<certificate>
+
+the same as B<-cert>. It gives the file containing the CA
+certificate. Mandatory.
+
+=item B<private_key>
+
+same as the B<-keyfile> option. The file containing the
+CA private key. Mandatory.
+
+=item B<RANDFILE>
+
+a file used to read and write random number seed information, or
+an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+
+=item B<default_days>
+
+the same as the B<-days> option. The number of days to certify
+a certificate for. 
+
+=item B<default_startdate>
+
+the same as the B<-startdate> option. The start date to certify
+a certificate for. If not set the current time is used.
+
+=item B<default_enddate>
+
+the same as the B<-enddate> option. Either this option or
+B<default_days> (or the command line equivalents) must be
+present.
+
+=item B<default_crl_hours default_crl_days>
+
+the same as the B<-crlhours> and the B<-crldays> options. These
+will only be used if neither command line option is present. At
+least one of these must be present to generate a CRL.
+
+=item B<default_md>
+
+the same as the B<-md> option. The message digest to use. Mandatory.
+
+=item B<database>
+
+the text database file to use. Mandatory. This file must be present
+though initially it will be empty.
+
+=item B<serialfile>
+
+a text file containing the next serial number to use in hex. Mandatory.
+This file must be present and contain a valid serial number.
+
+=item B<x509_extensions>
+
+the same as B<-extensions>.
+
+=item B<crl_extensions>
+
+the same as B<-crlexts>.
+
+=item B<preserve>
+
+the same as B<-preserveDN>
+
+=item B<msie_hack>
+
+the same as B<-msie_hack>
+
+=item B<policy>
+
+the same as B<-policy>. Mandatory. See the B<POLICY FORMAT> section
+for more information.
+
+=back
+
+=head1 POLICY FORMAT
+
+The policy section consists of a set of variables corresponding to
+certificate DN fields. If the value is "match" then the field value
+must match the same field in the CA certificate. If the value is
+"supplied" then it must be present. If the value is "optional" then
+it may be present. Any fields not mentioned in the policy section
+are silently deleted, unless the B<-preserveDN> option is set but
+this can be regarded more of a quirk than intended behaviour.
+
+=head1 SPKAC FORMAT
+
+The input to the B<-spkac> command line option is a Netscape
+signed public key and challenge. This will usually come from
+the B<KEYGEN> tag in an HTML form to create a new private key. 
+It is however possible to create SPKACs using the B<spkac> utility.
+
+The file should contain the variable SPKAC set to the value of
+the SPKAC and also the required DN components as name value pairs.
+If you need to include the same component twice then it can be
+preceded by a number and a '.'.
+
+=head1 EXAMPLES
+
+Note: these examples assume that the B<ca> directory structure is
+already set up and the relevant files already exist. This usually
+involves creating a CA certificate and private key with B<req>, a
+serial number file and an empty index file and placing them in
+the relevant directories.
+
+To use the sample configuration file below the directories demoCA,
+demoCA/private and demoCA/newcerts would be created. The CA
+certificate would be copied to demoCA/cacert.pem and its private
+key to demoCA/private/cakey.pem. A file demoCA/serial would be
+created containing for example "01" and the empty index file
+demoCA/index.txt.
+
+
+Sign a certificate request:
+
+ openssl ca -in req.pem -out newcert.pem
+
+Generate a CRL
+
+ openssl ca -gencrl -out crl.pem
+
+Sign several requests:
+
+ openssl ca -infiles req1.pem req2.pem req3.pem
+
+Certify a Netscape SPKAC:
+
+ openssl ca -spkac spkac.txt
+
+A sample SPKAC file (the SPKAC line has been truncated for clarity):
+
+ SPKAC=MIG0MGAwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAn7PDhCeV/xIxUg8V70YRxK2A5
+ CN=Steve Test
+ emailAddress=steve@openssl.org
+ 0.OU=OpenSSL Group
+ 1.OU=Another Group
+
+A sample configuration file with the relevant sections for B<ca>:
+
+ [ ca ]
+ default_ca      = CA_default            # The default ca section
+ 
+ [ CA_default ]
+
+ dir            = ./demoCA              # top dir
+ database       = $dir/index.txt        # index file.
+ new_certs_dir  = $dir/newcerts         # new certs dir
+ 
+ certificate    = $dir/cacert.pem       # The CA cert
+ serial         = $dir/serial           # serial no file
+ private_key    = $dir/private/cakey.pem# CA private key
+ RANDFILE       = $dir/private/.rand    # random number file
+ 
+ default_days   = 365                   # how long to certify for
+ default_crl_days= 30                   # how long before next CRL
+ default_md     = md5                   # md to use
+
+ policy         = policy_any            # default policy
+
+ [ policy_any ]
+ countryName            = supplied
+ stateOrProvinceName    = optional
+ organizationName       = optional
+ organizationalUnitName = optional
+ commonName             = supplied
+ emailAddress           = optional
+
+=head1 WARNINGS
+
+The B<ca> command is quirky and at times downright unfriendly.
+
+The B<ca> utility was originally meant as an example of how to do things
+in a CA. It was not supposed be be used as a full blown CA itself:
+nevertheless some people are using it for this purpose.
+
+The B<ca> command is effectively a single user command: no locking is
+done on the various files and attempts to run more than one B<ca> command
+on the same database can have unpredictable results.
+
+=head1 FILES
+
+Note: the location of all files can change either by compile time options,
+configuration file entries, environment variables or command line options.
+The values below reflect the default values.
+
+ /usr/local/ssl/lib/openssl.cnf - master configuration file
+ ./demoCA                       - main CA directory
+ ./demoCA/cacert.pem            - CA certificate
+ ./demoCA/private/cakey.pem     - CA private key
+ ./demoCA/serial                - CA serial number file
+ ./demoCA/serial.old            - CA serial number backup file
+ ./demoCA/index.txt             - CA text database file
+ ./demoCA/index.txt.old         - CA text database backup file
+ ./demoCA/certs                 - certificate output file
+ ./demoCA/.rnd                  - CA random seed information
+
+=head1 ENVIRONMENT VARIABLES
+
+B<OPENSSL_CONF> reflects the location of master configuration file it can
+be overridden by the B<-config> command line option.
+
+=head1 RESTRICTIONS
+
+The text database index file is a critical part of the process and 
+if corrupted it can be difficult to fix. It is theoretically possible
+to rebuild the index file from all the issued certificates and a current
+CRL: however there is no option to do this.
+
+CRL entry extensions cannot currently be created: only CRL extensions
+can be added.
+
+V2 CRL features like delta CRL support and CRL numbers are not currently
+supported.
+
+Although several requests can be input and handled at once it is only
+possible to include one SPKAC or self signed certificate.
+
+=head1 BUGS
+
+The use of an in memory text database can cause problems when large
+numbers of certificates are present because, as the name implies
+the database has to be kept in memory.
+
+Certificate request extensions are ignored: some kind of "policy" should
+be included to use certain static extensions and certain extensions
+from the request.
+
+It is not possible to certify two certificates with the same DN: this
+is a side effect of how the text database is indexed and it cannot easily
+be fixed without introducing other problems. Some S/MIME clients can use
+two certificates with the same DN for separate signing and encryption
+keys.
+
+The B<ca> command really needs rewriting or the required functionality
+exposed at either a command or interface level so a more friendly utility
+(perl script or GUI) can handle things properly. The scripts B<CA.sh> and
+B<CA.pl> help a little but not very much.
+
+Any fields in a request that are not present in a policy are silently
+deleted. This does not happen if the B<-preserveDN> option is used but
+the extra fields are not displayed when the user is asked to certify
+a request. The behaviour should be more friendly and configurable.
+
+Cancelling some commands by refusing to certify a certificate can
+create an empty file.
+
+=head1 SEE ALSO
+
+L<req(1)|req(1)>, L<spkac(1)|spkac(1)>, L<x509(1)|x509(1)>, L<CA.pl(1)|CA.pl(1)>,
+L<config(5)|config(5)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/ciphers.pod b/src/lib/libssl/src/doc/apps/ciphers.pod
new file mode 100644
index 0000000000..2301e28251
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/ciphers.pod
@@ -0,0 +1,342 @@
+=pod
+
+=head1 NAME
+
+ciphers - SSL cipher display and cipher list tool.
+
+=head1 SYNOPSIS
+
+B<openssl> B<ciphers>
+[B<-v>]
+[B<-ssl2>]
+[B<-ssl3>]
+[B<-tls1>]
+[B<cipherlist>]
+
+=head1 DESCRIPTION
+
+The B<cipherlist> command converts OpenSSL cipher lists into ordered
+SSL cipher preference lists. It can be used as a test tool to determine
+the appropriate cipherlist.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-v>
+
+verbose option. List ciphers with a complete description of the authentication,
+key exchange, encryption and mac algorithms used along with any key size
+restrictions and whether the algorithm is classed as an "export" cipher.
+
+=item B<-ssl3>
+
+only include SSL v3 ciphers.
+
+=item B<-ssl2>
+
+only include SSL v2 ciphers.
+
+=item B<-tls1>
+
+only include TLS v1 ciphers.
+
+=item B<-h>, B<-?>
+
+print a brief usage message.
+
+=item B<cipherlist>
+
+a cipher list to convert to a cipher preference list. If it is not included
+then the default cipher list will be used. The format is described below.
+
+=back
+
+=head1 CIPHER LIST FORMAT
+
+The cipher list consists of one or more I<cipher strings> separated by colons.
+Commas or spaces are also acceptable separators but colons are normally used.
+
+The actual cipher string can take several different forms.
+
+It can consist of a single cipher suite such as B<RC4-SHA>.
+
+It can represent a list of cipher suites containing a certain algorithm, or
+cipher suites of a certain type. For example B<SHA1> represents all ciphers
+suites using the digest algorithm SHA1 and B<SSLv3> represents all SSL v3
+algorithms.
+
+Lists of cipher suites can be combined in a single cipher string using the
+B<+> character. This is used as a logical B<and> operation. For example
+B<SHA1+DES> represents all cipher suites containing the SHA1 B<and> the DES
+algorithms.
+
+Each cipher string can be optionally preceded by the characters B<!>,
+B<-> or B<+>.
+
+If B<!> is used then the ciphers are permanently deleted from the list.
+The ciphers deleted can never reappear in the list even if they are
+explicitly stated.
+
+If B<-> is used then the ciphers are deleted from the list, but some or
+all of the ciphers can be added again by later options.
+
+If B<+> is used then the ciphers are moved to the end of the list. This
+option doesn't add any new ciphers it just moves matching existing ones.
+
+If none of these characters is present then the string is just interpreted
+as a list of ciphers to be appended to the current preference list. If the
+list includes any ciphers already present they will be ignored: that is they
+will not moved to the end of the list.
+
+Additionally the cipher string B<@STRENGTH> can be used at any point to sort
+the current cipher list in order of encryption algorithm key length.
+
+=head1 CIPHER STRINGS
+
+The following is a list of all permitted cipher strings and their meanings.
+
+=over 4
+
+=item B<DEFAULT>
+
+the default cipher list. This is determined at compile time and is normally
+B<ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH>. This must be the first cipher string
+specified.
+
+=item B<ALL>
+
+all ciphers suites except the B<eNULL> ciphers which must be explicitly enabled.
+
+=item B<HIGH>
+
+"high" encryption cipher suites. This currently means those with key lengths larger
+than 128 bits.
+
+=item B<MEDIUM>
+
+"medium" encryption cipher suites, currently those using 128 bit encryption.
+
+=item B<LOW>
+
+"low" encryption cipher suites, currently those using 64 or 56 bit encryption algorithms
+but excluding export cipher suites.
+
+=item B<EXP>, B<EXPORT>
+
+export encryption algorithms. Including 40 and 56 bits algorithms.
+
+=item B<EXPORT40>
+
+40 bit export encryption algorithms
+
+=item B<EXPORT56>
+
+56 bit export encryption algorithms.
+
+=item B<eNULL>, B<NULL>
+
+the "NULL" ciphers that is those offering no encryption. Because these offer no
+encryption at all and are a security risk they are disabled unless explicitly
+included.
+
+=item B<aNULL>
+
+the cipher suites offering no authentication. This is currently the anonymous
+DH algorithms. These cipher suites are vulnerable to a "man in the middle"
+attack and so their use is normally discouraged.
+
+=item B<kRSA>, B<RSA>
+
+cipher suites using RSA key exchange.
+
+=item B<kEDH>
+
+cipher suites using ephemeral DH key agreement.
+
+=item B<kDHr>, B<kDHd>
+
+cipher suites using DH key agreement and DH certificates signed by CAs with RSA
+and DSS keys respectively. Not implemented.
+
+=item B<aRSA>
+
+cipher suites using RSA authentication, i.e. the certificates carry RSA keys.
+
+=item B<aDSS>, B<DSS>
+
+cipher suites using DSS authentication, i.e. the certificates carry DSS keys.
+
+=item B<aDH>
+
+cipher suites effectively using DH authentication, i.e. the certificates carry
+DH keys.  Not implemented.
+
+=item B<kFZA>, B<aFZA>, B<eFZA>, B<FZA>
+
+ciphers suites using FORTEZZA key exchange, authentication, encryption or all
+FORTEZZA algorithms. Not implemented.
+
+=item B<TLSv1>, B<SSLv3>, B<SSLv2>
+
+TLS v1.0, SSL v3.0 or SSL v2.0 cipher suites respectively.
+
+=item B<DH>
+
+cipher suites using DH, including anonymous DH.
+
+=item B<ADH>
+
+anonymous DH cipher suites.
+
+=item B<3DES>
+
+cipher suites using triple DES.
+
+=item B<DES>
+
+cipher suites using DES (not triple DES).
+
+=item B<RC4>
+
+cipher suites using RC4.
+
+=item B<RC2>
+
+cipher suites using RC2.
+
+=item B<IDEA>
+
+cipher suites using IDEA.
+
+=item B<MD5>
+
+cipher suites using MD5.
+
+=item B<SHA1>, B<SHA>
+
+cipher suites using SHA1.
+
+=back
+
+=head1 CIPHER SUITE NAMES
+
+The following lists give the SSL or TLS cipher suites names from the
+relevant specification and their OpenSSL equivalents.
+
+=head2 SSL v3.0 cipher suites.
+
+ SSL_RSA_WITH_NULL_MD5                   NULL-MD5
+ SSL_RSA_WITH_NULL_SHA                   NULL-SHA
+ SSL_RSA_EXPORT_WITH_RC4_40_MD5          EXP-RC4-MD5
+ SSL_RSA_WITH_RC4_128_MD5                RC4-MD5
+ SSL_RSA_WITH_RC4_128_SHA                RC4-SHA
+ SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5      EXP-RC2-CBC-MD5
+ SSL_RSA_WITH_IDEA_CBC_SHA               IDEA-CBC-SHA
+ SSL_RSA_EXPORT_WITH_DES40_CBC_SHA       EXP-DES-CBC-SHA
+ SSL_RSA_WITH_DES_CBC_SHA                DES-CBC-SHA
+ SSL_RSA_WITH_3DES_EDE_CBC_SHA           DES-CBC3-SHA
+
+ SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA    Not implemented.
+ SSL_DH_DSS_WITH_DES_CBC_SHA             Not implemented.
+ SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA        Not implemented.
+ SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA    Not implemented.
+ SSL_DH_RSA_WITH_DES_CBC_SHA             Not implemented.
+ SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA        Not implemented.
+ SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA   EXP-EDH-DSS-DES-CBC-SHA
+ SSL_DHE_DSS_WITH_DES_CBC_SHA            EDH-DSS-CBC-SHA
+ SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA       EDH-DSS-DES-CBC3-SHA
+ SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA   EXP-EDH-RSA-DES-CBC-SHA
+ SSL_DHE_RSA_WITH_DES_CBC_SHA            EDH-RSA-DES-CBC-SHA
+ SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA       EDH-RSA-DES-CBC3-SHA
+
+ SSL_DH_anon_EXPORT_WITH_RC4_40_MD5      EXP-ADH-RC4-MD5
+ SSL_DH_anon_WITH_RC4_128_MD5            ADH-RC4-MD5
+ SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA   EXP-ADH-DES-CBC-SHA
+ SSL_DH_anon_WITH_DES_CBC_SHA            ADH-DES-CBC-SHA
+ SSL_DH_anon_WITH_3DES_EDE_CBC_SHA       ADH-DES-CBC3-SHA
+
+ SSL_FORTEZZA_KEA_WITH_NULL_SHA          Not implemented.
+ SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA  Not implemented.
+ SSL_FORTEZZA_KEA_WITH_RC4_128_SHA       Not implemented.
+
+=head2 TLS v1.0 cipher suites.
+
+ TLS_RSA_WITH_NULL_MD5                   NULL-MD5
+ TLS_RSA_WITH_NULL_SHA                   NULL-SHA
+ TLS_RSA_EXPORT_WITH_RC4_40_MD5          EXP-RC4-MD5
+ TLS_RSA_WITH_RC4_128_MD5                RC4-MD5
+ TLS_RSA_WITH_RC4_128_SHA                RC4-SHA
+ TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5      EXP-RC2-CBC-MD5
+ TLS_RSA_WITH_IDEA_CBC_SHA               IDEA-CBC-SHA
+ TLS_RSA_EXPORT_WITH_DES40_CBC_SHA       EXP-DES-CBC-SHA
+ TLS_RSA_WITH_DES_CBC_SHA                DES-CBC-SHA
+ TLS_RSA_WITH_3DES_EDE_CBC_SHA           DES-CBC3-SHA
+
+ TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA    Not implemented.
+ TLS_DH_DSS_WITH_DES_CBC_SHA             Not implemented.
+ TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA        Not implemented.
+ TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA    Not implemented.
+ TLS_DH_RSA_WITH_DES_CBC_SHA             Not implemented.
+ TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA        Not implemented.
+ TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA   EXP-EDH-DSS-DES-CBC-SHA
+ TLS_DHE_DSS_WITH_DES_CBC_SHA            EDH-DSS-CBC-SHA
+ TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA       EDH-DSS-DES-CBC3-SHA
+ TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA   EXP-EDH-RSA-DES-CBC-SHA
+ TLS_DHE_RSA_WITH_DES_CBC_SHA            EDH-RSA-DES-CBC-SHA
+ TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA       EDH-RSA-DES-CBC3-SHA
+
+ TLS_DH_anon_EXPORT_WITH_RC4_40_MD5      EXP-ADH-RC4-MD5
+ TLS_DH_anon_WITH_RC4_128_MD5            ADH-RC4-MD5
+ TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA   EXP-ADH-DES-CBC-SHA
+ TLS_DH_anon_WITH_DES_CBC_SHA            ADH-DES-CBC-SHA
+ TLS_DH_anon_WITH_3DES_EDE_CBC_SHA       ADH-DES-CBC3-SHA
+
+=head2 Additional Export 1024 and other cipher suites
+
+Note: these ciphers can also be used in SSL v3.
+
+ TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA     EXP1024-DES-CBC-SHA
+ TLS_RSA_EXPORT1024_WITH_RC4_56_SHA      EXP1024-RC4-SHA
+ TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA EXP1024-DHE-DSS-DES-CBC-SHA
+ TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA  EXP1024-DHE-DSS-RC4-SHA
+ TLS_DHE_DSS_WITH_RC4_128_SHA            DHE-DSS-RC4-SHA
+
+=head2 SSL v2.0 cipher suites.
+
+ SSL_CK_RC4_128_WITH_MD5                 RC4-MD5
+ SSL_CK_RC4_128_EXPORT40_WITH_MD5        EXP-RC4-MD5
+ SSL_CK_RC2_128_CBC_WITH_MD5             RC2-MD5
+ SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5    EXP-RC2-MD5
+ SSL_CK_IDEA_128_CBC_WITH_MD5            IDEA-CBC-MD5
+ SSL_CK_DES_64_CBC_WITH_MD5              DES-CBC-MD5
+ SSL_CK_DES_192_EDE3_CBC_WITH_MD5        DES-CBC3-MD5
+
+=head1 NOTES
+
+The non-ephemeral DH modes are currently unimplemented in OpenSSL
+because there is no support for DH certificates.
+
+Some compiled versions of OpenSSL may not include all the ciphers
+listed here because some ciphers were excluded at compile time.
+
+=head1 EXAMPLES
+
+Verbose listing of all OpenSSL ciphers including NULL ciphers:
+
+ openssl ciphers -v 'ALL:eNULL'
+
+Include all ciphers except NULL and anonymous DH then sort by
+strength:
+
+ openssl ciphers -v 'ALL:!ADH:@STRENGTH'
+
+Include only 3DES ciphers and then place RSA ciphers last:
+
+ openssl ciphers -v '3DES:+RSA'
+
+=head1 SEE ALSO
+
+L<s_client(1)|s_client(1)>, L<s_server(1)|s_server(1)>, L<ssl(3)|ssl(3)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/config.pod b/src/lib/libssl/src/doc/apps/config.pod
new file mode 100644
index 0000000000..ce874a42ce
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/config.pod
@@ -0,0 +1,138 @@
+
+=pod
+
+=head1 NAME
+
+config - OpenSSL CONF library configuration files
+
+=head1 DESCRIPTION
+
+The OpenSSL CONF library can be used to read configuration files.
+It is used for the OpenSSL master configuration file B<openssl.cnf>
+and in a few other places like B<SPKAC> files and certificate extension
+files for the B<x509> utility.
+
+A configuration file is divided into a number of sections. Each section
+starts with a line B<[ section_name ]> and ends when a new section is
+started or end of file is reached. A section name can consist of
+alphanumeric characters and underscores.
+
+The first section of a configuration file is special and is referred
+to as the B<default> section this is usually unnamed and is from the
+start of file until the first named section. When a name is being looked up
+it is first looked up in a named section (if any) and then the
+default section.
+
+The environment is mapped onto a section called B<ENV>.
+
+Comments can be included by preceding them with the B<#> character
+
+Each section in a configuration file consists of a number of name and
+value pairs of the form B<name=value>
+
+The B<name> string can contain any alphanumeric characters as well as
+a few punctuation symbols such as B<.> B<,> B<;> and B<_>.
+
+The B<value> string consists of the string following the B<=> character
+until end of line with any leading and trailing white space removed.
+
+The value string undergoes variable expansion. This can be done by
+including the form B<$var> or B<${var}>: this will substitute the value
+of the named variable in the current section. It is also possible to
+substitute a value from another section using the syntax B<$section::name>
+or B<${section::name}>. By using the form B<$ENV::name> environment
+variables can be substituted. It is also possible to assign values to
+environment variables by using the name B<ENV::name>, this will work
+if the program looks up environment variables using the B<CONF> library
+instead of calling B<getenv()> directly.
+
+It is possible to escape certain characters by using any kind of quote
+or the B<\> character. By making the last character of a line a B<\>
+a B<value> string can be spread across multiple lines. In addition
+the sequences B<\n>, B<\r>, B<\b> and B<\t> are recognized.
+
+=head1 NOTES
+
+If a configuration file attempts to expand a variable that doesn't exist
+then an error is flagged and the file will not load. This can happen
+if an attempt is made to expand an environment variable that doesn't
+exist. For example the default OpenSSL master configuration file used
+the value of B<HOME> which may not be defined on non Unix systems.
+
+This can be worked around by including a B<default> section to provide
+a default value: then if the environment lookup fails the default value
+will be used instead. For this to work properly the default value must
+be defined earlier in the configuration file than the expansion. See
+the B<EXAMPLES> section for an example of how to do this.
+
+If the same variable exists in the same section then all but the last
+value will be silently ignored. In certain circumstances such as with
+DNs the same field may occur multiple times. This is usually worked
+around by ignoring any characters before an initial B<.> e.g.
+
+ 1.OU="My first OU"
+ 2.OU="My Second OU"
+
+=head1 EXAMPLES
+
+Here is a sample configuration file using some of the features
+mentioned above.
+
+ # This is the default section.
+ 
+ HOME=/temp
+ RANDFILE= ${ENV::HOME}/.rnd
+ configdir=$ENV::HOME/config
+
+ [ section_one ]
+
+ # We are now in section one.
+
+ # Quotes permit leading and trailing whitespace
+ any = " any variable name "
+
+ other = A string that can \
+ cover several lines \
+ by including \\ characters
+
+ message = Hello World\n
+
+ [ section_two ]
+
+ greeting = $section_one::message
+
+This next example shows how to expand environment variables safely.
+
+Suppose you want a variable called B<tmpfile> to refer to a
+temporary filename. The directory it is placed in can determined by
+the the B<TEMP> or B<TMP> environment variables but they may not be
+set to any value at all. If you just include the environment variable
+names and the variable doesn't exist then this will cause an error when
+an attempt is made to load the configuration file. By making use of the
+default section both values can be looked up with B<TEMP> taking 
+priority and B</tmp> used if neither is defined:
+
+ TMP=/tmp
+ # The above value is used if TMP isn't in the environment
+ TEMP=$ENV::TMP
+ # The above value is used if TEMP isn't in the environment
+ tmpfile=${ENV::TEMP}/tmp.filename
+
+=head1 BUGS
+
+Currently there is no way to include characters using the octal B<\nnn>
+form. Strings are all null terminated so nulls cannot form part of
+the value.
+
+The escaping isn't quite right: if you want to use sequences like B<\n>
+you can't use any quote escaping on the same line.
+
+Files are loaded in a single pass. This means that an variable expansion
+will only work if the variables referenced are defined earlier in the
+file.
+
+=head1 SEE ALSO
+
+L<x509(1)|x509(1)>, L<req(1)|req(1)>, L<ca(1)|ca(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/crl.pod b/src/lib/libssl/src/doc/apps/crl.pod
new file mode 100644
index 0000000000..a40c873b95
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/crl.pod
@@ -0,0 +1,117 @@
+=pod
+
+=head1 NAME
+
+crl - CRL utility
+
+=head1 SYNOPSIS
+
+B<openssl> B<crl>
+[B<-inform PEM|DER>]
+[B<-outform PEM|DER>]
+[B<-text>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-noout>]
+[B<-hash>]
+[B<-issuer>]
+[B<-lastupdate>]
+[B<-nextupdate>]
+[B<-CAfile file>]
+[B<-CApath dir>]
+
+=head1 DESCRIPTION
+
+The B<crl> command processes CRL files in DER or PEM format.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. B<DER> format is DER encoded CRL
+structure. B<PEM> (the default) is a base64 encoded version of
+the DER form with header and footer lines.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read from or standard input if this
+option is not specified.
+
+=item B<-out filename>
+
+specifies the output filename to write to or standard output by
+default.
+
+=item B<-text>
+
+print out the CRL in text form.
+
+=item B<-noout>
+
+don't output the encoded version of the CRL.
+
+=item B<-hash>
+
+output a hash of the issuer name. This can be use to lookup CRLs in
+a directory by issuer name.
+
+=item B<-issuer>
+
+output the issuer name.
+
+=item B<-lastupdate>
+
+output the lastUpdate field.
+
+=item B<-nextupdate>
+
+output the nextUpdate field.
+
+=item B<-CAfile file>
+
+verify the signature on a CRL by looking up the issuing certificate in
+B<file>
+
+=item B<-CApath dir>
+
+verify the signature on a CRL by looking up the issuing certificate in
+B<dir>. This directory must be a standard certificate directory: that
+is a hash of each subject name (using B<x509 -hash>) should be linked
+to each certificate.
+
+=back
+
+=head1 NOTES
+
+The PEM CRL format uses the header and footer lines:
+
+ -----BEGIN X509 CRL-----
+ -----END X509 CRL-----
+
+=head1 EXAMPLES
+
+Convert a CRL file from PEM to DER:
+
+ openssl crl -in crl.pem -outform DER -out crl.der
+
+Output the text form of a DER encoded certificate:
+
+ openssl crl -in crl.der -text -noout
+
+=head1 BUGS
+
+Ideally it should be possible to create a CRL using appropriate options
+and files too.
+
+=head1 SEE ALSO
+
+L<crl2pkcs7(1)|crl2pkcs7(1)>, L<ca(1)|ca(1)>, L<x509(1)|x509(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/crl2pkcs7.pod b/src/lib/libssl/src/doc/apps/crl2pkcs7.pod
new file mode 100644
index 0000000000..da199b044a
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/crl2pkcs7.pod
@@ -0,0 +1,90 @@
+=pod
+
+=head1 NAME
+
+crl2pkcs7 - Create a PKCS#7 structure from a CRL and certificates.
+
+=head1 SYNOPSIS
+
+B<openssl> B<pkcs7>
+[B<-inform PEM|DER>]
+[B<-outform PEM|DER>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-print_certs>]
+
+=head1 DESCRIPTION
+
+The B<crl2pkcs7> command takes an optional CRL and one or more
+certificates and converts them into a PKCS#7 degenerate "certificates
+only" structure.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the CRL input format. B<DER> format is DER encoded CRL
+structure.B<PEM> (the default) is a base64 encoded version of
+the DER form with header and footer lines.
+
+=item B<-outform DER|PEM>
+
+This specifies the PKCS#7 structure output format. B<DER> format is DER
+encoded PKCS#7 structure.B<PEM> (the default) is a base64 encoded version of
+the DER form with header and footer lines.
+
+=item B<-in filename>
+
+This specifies the input filename to read a CRL from or standard input if this
+option is not specified.
+
+=item B<-out filename>
+
+specifies the output filename to write the PKCS#7 structure to or standard
+output by default.
+
+=item B<-certfile filename>
+
+specifies a filename containing one or more certificates in B<PEM> format.
+All certificates in the file will be added to the PKCS#7 structure. This
+option can be used more than once to read certificates form multiple
+files.
+
+=item B<-nocrl>
+
+normally a CRL is included in the output file. With this option no CRL is
+included in the output file and a CRL is not read from the input file.
+
+=back
+
+=head1 EXAMPLES
+
+Create a PKCS#7 structure from a certificate and CRL:
+
+ openssl crl2pkcs7 -in crl.pem -certfile cert.pem -out p7.pem
+
+Creates a PKCS#7 structure in DER format with no CRL from several
+different certificates:
+
+ openssl crl2pkcs7 -nocrl -certfile newcert.pem 
+        -certfile demoCA/cacert.pem -outform DER -out p7.der
+
+=head1 NOTES
+
+The output file is a PKCS#7 signed data structure containing no signers and
+just certificates and an optional CRL.
+
+This utility can be used to send certificates and CAs to Netscape as part of
+the certificate enrollment process. This involves sending the DER encoded output
+as MIME type application/x-x509-user-cert.
+
+The B<PEM> encoded form with the header and footer lines removed can be used to
+install user certificates and CAs in MSIE using the Xenroll control.
+
+=head1 SEE ALSO
+
+L<pkcs7(1)|pkcs7(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/dgst.pod b/src/lib/libssl/src/doc/apps/dgst.pod
new file mode 100644
index 0000000000..cbf2cc529a
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/dgst.pod
@@ -0,0 +1,49 @@
+=pod
+
+=head1 NAME
+
+dgst, md5, md2, sha1, sha, mdc2, ripemd160 - message digests
+
+=head1 SYNOPSIS
+
+[B<dgst>]
+[B<-md5|-md2|-sha1|-sha|mdc2|-ripemd160>]
+[B<-c>]
+[B<-d>]
+[B<file...>]
+
+[B<md5|md2|sha1|sha|mdc2|ripemd160>]
+[B<-c>]
+[B<-d>]
+[B<file...>]
+
+=head1 DESCRIPTION
+
+The digest functions print out the message digest of a supplied file or files
+in hexadecimal form.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-c>
+
+print out the digest in two digit groups separated by colons.
+
+=item B<-d>
+
+print out BIO debugging information.
+
+=item B<file...>
+
+file or files to digest. If no files are specified then standard input is
+used.
+
+=back
+
+=head1 NOTES
+
+The digest of choice for all new applications is SHA1. Other digests are
+however still widely used.
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/dhparam.pod b/src/lib/libssl/src/doc/apps/dhparam.pod
new file mode 100644
index 0000000000..6b237ec05a
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/dhparam.pod
@@ -0,0 +1,115 @@
+=pod
+
+=head1 NAME
+
+dhparam - DH parameter manipulation and generation
+
+=head1 SYNOPSIS
+
+B<openssl dh>
+[B<-inform DER|PEM>]
+[B<-outform DER|PEM>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-noout>]
+[B<-text>]
+[B<-C>]
+[B<-2>]
+[B<-5>]
+[B<-rand file(s)>]
+[numbits]
+
+=head1 DESCRIPTION
+
+This command is used to manipulate DH parameter files.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. The B<DER> option uses an ASN1 DER encoded
+form compatible with the PKCS#3 DHparameter structure. The PEM form is the
+default format: it consists of the B<DER> format base64 encoded with
+additional header and footer lines.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read parameters from or standard input if
+this option is not specified.
+
+=item B<-out filename>
+
+This specifies the output filename parameters to. Standard output is used
+if this option is not present. The output filename should B<not> be the same
+as the input filename.
+
+=item B<-2>, B<-5>
+
+The generator to use, either 2 or 5. 2 is the default. If present then the
+input file is ignored and parameters are generated instead.
+
+=item B<-rand file(s)>
+
+a file or files containing random data used to seed the random number
+generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+Multiple files can be specified separated by a OS-dependent character.
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
+all others.
+
+=item B<numbits>
+
+this option specifies that a parameter set should be generated of size
+B<numbits>. It must be the last option. If not present then a value of 512
+is used. If this option is present then the input file is ignored and 
+parameters are generated instead.
+
+=item B<-noout>
+
+this option inhibits the output of the encoded version of the parameters.
+
+=item B<-text>
+
+this option prints out the DH parameters in human readable form.
+
+=item B<-C>
+
+this option converts the parameters into C code. The parameters can then
+be loaded by calling the B<get_dhXXX()> function.
+
+=back
+
+=head1 WARNINGS
+
+The program B<dhparam> combines the functionality of the programs B<dh> and
+B<gendh> in previous versions of OpenSSL and SSLeay. The B<dh> and B<gendh>
+programs are retained for now but may have different purposes in future 
+versions of OpenSSL.
+
+=head1 NOTES
+
+PEM format DH parameters use the header and footer lines:
+
+ -----BEGIN DH PARAMETERS-----
+ -----END DH PARAMETERS-----
+
+OpenSSL currently only supports the older PKCS#3 DH, not the newer X9.42
+DH.
+
+This program manipulates DH parameters not keys.
+
+=head1 BUGS
+
+There should be a way to generate and manipulate DH keys.
+
+=head1 SEE ALSO
+
+L<dsaparam(1)|dsaparam(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/dsa.pod b/src/lib/libssl/src/doc/apps/dsa.pod
new file mode 100644
index 0000000000..28e534bb95
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/dsa.pod
@@ -0,0 +1,150 @@
+=pod
+
+=head1 NAME
+
+dsa - DSA key processing
+
+=head1 SYNOPSIS
+
+B<openssl> B<dsa>
+[B<-inform PEM|DER>]
+[B<-outform PEM|DER>]
+[B<-in filename>]
+[B<-passin arg>]
+[B<-out filename>]
+[B<-passout arg>]
+[B<-des>]
+[B<-des3>]
+[B<-idea>]
+[B<-text>]
+[B<-noout>]
+[B<-modulus>]
+[B<-pubin>]
+[B<-pubout>]
+
+=head1 DESCRIPTION
+
+The B<dsa> command processes DSA keys. They can be converted between various
+forms and their components printed out. B<Note> This command uses the
+traditional SSLeay compatible format for private key encryption: newer
+applications should use the more secure PKCS#8 format using the B<pkcs8>
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. The B<DER> option with a private key uses
+an ASN1 DER encoded form of an ASN.1 SEQUENCE consisting of the values of
+version (currently zero), p, q, g, the public and private key components
+respectively as ASN.1 INTEGERs. When used with a public key it uses a
+SubjectPublicKeyInfo structure: it is an error if the key is not DSA.
+
+The B<PEM> form is the default format: it consists of the B<DER> format base64
+encoded with additional header and footer lines. In the case of a private key
+PKCS#8 format is also accepted.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read a key from or standard input if this
+option is not specified. If the key is encrypted a pass phrase will be
+prompted for.
+
+=item B<-passin arg>
+
+the input file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-out filename>
+
+This specifies the output filename to write a key to or standard output by
+is not specified. If any encryption options are set then a pass phrase will be
+prompted for. The output filename should B<not> be the same as the input
+filename.
+
+=item B<-passout arg>
+
+the output file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-des|-des3|-idea>
+
+These options encrypt the private key with the DES, triple DES, or the 
+IDEA ciphers respectively before outputting it. A pass phrase is prompted for.
+If none of these options is specified the key is written in plain text. This
+means that using the B<dsa> utility to read in an encrypted key with no
+encryption option can be used to remove the pass phrase from a key, or by
+setting the encryption options it can be use to add or change the pass phrase.
+These options can only be used with PEM format output files.
+
+=item B<-text>
+
+prints out the public, private key components and parameters.
+
+=item B<-noout>
+
+this option prevents output of the encoded version of the key.
+
+=item B<-modulus>
+
+this option prints out the value of the public key component of the key.
+
+=item B<-pubin>
+
+by default a private key is read from the input file: with this option a
+public key is read instead.
+
+=item B<-pubout>
+
+by default a private key is output. With this option a public
+key will be output instead. This option is automatically set if the input is
+a public key.
+
+=back
+
+=head1 NOTES
+
+The PEM private key format uses the header and footer lines:
+
+ -----BEGIN DSA PRIVATE KEY-----
+ -----END DSA PRIVATE KEY-----
+
+The PEM public key format uses the header and footer lines:
+
+ -----BEGIN PUBLIC KEY-----
+ -----END PUBLIC KEY-----
+
+=head1 EXAMPLES
+
+To remove the pass phrase on a DSA private key:
+
+ openssl dsa -in key.pem -out keyout.pem
+
+To encrypt a private key using triple DES:
+
+ openssl dsa -in key.pem -des3 -out keyout.pem
+
+To convert a private key from PEM to DER format: 
+
+ openssl dsa -in key.pem -outform DER -out keyout.der
+
+To print out the components of a private key to standard output:
+
+ openssl dsa -in key.pem -text -noout
+
+To just output the public part of a private key:
+
+ openssl dsa -in key.pem -pubout -out pubkey.pem
+
+=head1 SEE ALSO
+
+L<dsaparam(1)|dsaparam(1)>, L<gendsa(1)|gendsa(1)>, L<rsa(1)|rsa(1)>,
+L<genrsa(1)|genrsa(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/dsaparam.pod b/src/lib/libssl/src/doc/apps/dsaparam.pod
new file mode 100644
index 0000000000..8647f34698
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/dsaparam.pod
@@ -0,0 +1,102 @@
+=pod
+
+=head1 NAME
+
+dsaparam - DSA parameter manipulation and generation
+
+=head1 SYNOPSIS
+
+B<openssl dsaparam>
+[B<-inform DER|PEM>]
+[B<-outform DER|PEM>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-noout>]
+[B<-text>]
+[B<-C>]
+[B<-rand file(s)>]
+[B<-genkey>]
+[B<numbits>]
+
+=head1 DESCRIPTION
+
+This command is used to manipulate or generate DSA parameter files.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. The B<DER> option uses an ASN1 DER encoded
+form compatible with RFC2459 (PKIX) DSS-Parms that is a SEQUENCE consisting
+of p, q and g respectively. The PEM form is the default format: it consists
+of the B<DER> format base64 encoded with additional header and footer lines.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read parameters from or standard input if
+this option is not specified. If the B<numbits> parameter is included then
+this option will be ignored.
+
+=item B<-out filename>
+
+This specifies the output filename parameters to. Standard output is used
+if this option is not present. The output filename should B<not> be the same
+as the input filename.
+
+=item B<-noout>
+
+this option inhibits the output of the encoded version of the parameters.
+
+=item B<-text>
+
+this option prints out the DSA parameters in human readable form.
+
+=item B<-C>
+
+this option converts the parameters into C code. The parameters can then
+be loaded by calling the B<get_dsaXXX()> function.
+
+=item B<-genkey>
+
+this option will generate a DSA either using the specified or generated
+parameters.
+
+=item B<-rand file(s)>
+
+a file or files containing random data used to seed the random number
+generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+Multiple files can be specified separated by a OS-dependent character.
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
+all others.
+
+=item B<numbits>
+
+this option specifies that a parameter set should be generated of size
+B<numbits>. It must be the last option. If this option is included then
+the input file (if any) is ignored.
+
+=back
+
+=head1 NOTES
+
+PEM format DSA parameters use the header and footer lines:
+
+ -----BEGIN DSA PARAMETERS-----
+ -----END DSA PARAMETERS-----
+
+DSA parameter generation is a slow process and as a result the same set of
+DSA parameters is often used to generate several distinct keys.
+
+=head1 SEE ALSO
+
+L<gendsa(1)|gendsa(1)>, L<dsa(1)|dsa(1)>, L<genrsa(1)|genrsa(1)>,
+L<rsa(1)|rsa(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/enc.pod b/src/lib/libssl/src/doc/apps/enc.pod
new file mode 100644
index 0000000000..e436ccc37e
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/enc.pod
@@ -0,0 +1,257 @@
+=pod
+
+=head1 NAME
+
+enc - symmetric cipher routines
+
+=head1 SYNOPSIS
+
+B<openssl enc -ciphername>
+[B<-in filename>]
+[B<-out filename>]
+[B<-pass arg>]
+[B<-e>]
+[B<-d>]
+[B<-a>]
+[B<-A>]
+[B<-k password>]
+[B<-kfile filename>]
+[B<-K key>]
+[B<-iv IV>]
+[B<-p>]
+[B<-P>]
+[B<-bufsize number>]
+[B<-debug>]
+
+=head1 DESCRIPTION
+
+The symmetric cipher commands allow data to be encrypted or decrypted
+using various block and stream ciphers using keys based on passwords
+or explicitly provided. Base64 encoding or decoding can also be performed
+either by itself or in addition to the encryption or decryption.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-in filename>
+
+the input filename, standard input by default.
+
+=item B<-out filename>
+
+the output filename, standard output by default.
+
+=item B<-pass arg>
+
+the password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-salt>
+
+use a salt in the key derivation routines. This option should B<ALWAYS>
+be used unless compatibility with previous versions of OpenSSL or SSLeay
+is required. This option is only present on OpenSSL versions 0.9.5 or
+above.
+
+=item B<-nosalt>
+
+don't use a salt in the key derivation routines. This is the default for
+compatibility with previous versions of OpenSSL and SSLeay.
+
+=item B<-e>
+
+encrypt the input data: this is the default.
+
+=item B<-d>
+
+decrypt the input data.
+
+=item B<-a>
+
+base64 process the data. This means that if encryption is taking place
+the data is base64 encoded after encryption. If decryption is set then
+the input data is base64 decoded before being decrypted.
+
+=item B<-A>
+
+if the B<-a> option is set then base64 process the data on one line.
+
+=item B<-k password>
+
+the password to derive the key from. This is for compatibility with previous
+versions of OpenSSL. Superseded by the B<-pass> argument.
+
+=item B<-kfile filename>
+
+read the password to derive the key from the first line of B<filename>.
+This is for computability with previous versions of OpenSSL. Superseded by
+the B<-pass> argument.
+
+=item B<-S salt>
+
+the actual salt to use: this must be represented as a string comprised only
+of hex digits.
+
+=item B<-K key>
+
+the actual key to use: this must be represented as a string comprised only
+of hex digits.
+
+=item B<-iv IV>
+
+the actual IV to use: this must be represented as a string comprised only
+of hex digits.
+
+=item B<-p>
+
+print out the key and IV used.
+
+=item B<-P>
+
+print out the key and IV used then immediately exit: don't do any encryption
+or decryption.
+
+=item B<-bufsize number>
+
+set the buffer size for I/O
+
+=item B<-debug>
+
+debug the BIOs used for I/O.
+
+=back
+
+=head1 NOTES
+
+The program can be called either as B<openssl ciphername> or
+B<openssl enc -ciphername>.
+
+A password will be prompted for to derive the key and IV if necessary.
+
+The B<-salt> option should B<ALWAYS> be used if the key is being derived
+from a password unless you want compatibility with previous versions of
+OpenSSL and SSLeay.
+
+Without the B<-salt> option it is possible to perform efficient dictionary
+attacks on the password and to attack stream cipher encrypted data. The reason
+for this is that without the salt the same password always generates the same
+encryption key. When the salt is being used the first eight bytes of the
+encrypted data are reserved for the salt: it is generated at random when
+encrypting a file and read from the encrypted file when it is decrypted.
+
+Some of the ciphers do not have large keys and others have security
+implications if not used correctly. A beginner is advised to just use
+a strong block cipher in CBC mode such as bf or des3.
+
+All the block ciphers use PKCS#5 padding also known as standard block
+padding: this allows a rudimentary integrity or password check to be
+performed. However since the chance of random data passing the test is
+better than 1 in 256 it isn't a very good test.
+
+All RC2 ciphers have the same key and effective key length.
+
+Blowfish and RC5 algorithms use a 128 bit key.
+
+=head1 SUPPORTED CIPHERS
+
+ base64             Base 64
+
+ bf-cbc             Blowfish in CBC mode
+ bf                 Alias for bf-cbc
+ bf-cfb             Blowfish in CFB mode
+ bf-ecb             Blowfish in ECB mode
+ bf-ofb             Blowfish in OFB mode
+
+ cast-cbc           CAST in CBC mode
+ cast               Alias for cast-cbc
+ cast5-cbc          CAST5 in CBC mode
+ cast5-cfb          CAST5 in CFB mode
+ cast5-ecb          CAST5 in ECB mode
+ cast5-ofb          CAST5 in OFB mode
+
+ des-cbc            DES in CBC mode
+ des                Alias for des-cbc
+ des-cfb            DES in CBC mode
+ des-ofb            DES in OFB mode
+ des-ecb            DES in ECB mode
+
+ des-ede-cbc        Two key triple DES EDE in CBC mode
+ des-ede            Alias for des-ede
+ des-ede-cfb        Two key triple DES EDE in CFB mode
+ des-ede-ofb        Two key triple DES EDE in OFB mode
+
+ des-ede3-cbc       Three key triple DES EDE in CBC mode
+ des-ede3           Alias for des-ede3-cbc
+ des3               Alias for des-ede3-cbc
+ des-ede3-cfb       Three key triple DES EDE CFB mode
+ des-ede3-ofb       Three key triple DES EDE in OFB mode
+
+ desx               DESX algorithm.
+
+ idea-cbc           IDEA algorithm in CBC mode
+ idea               same as idea-cbc
+ idea-cfb           IDEA in CFB mode
+ idea-ecb           IDEA in ECB mode
+ idea-ofb           IDEA in OFB mode
+
+ rc2-cbc            128 bit RC2 in CBC mode
+ rc2                Alias for rc2-cbc
+ rc2-cfb            128 bit RC2 in CBC mode
+ rc2-ecb            128 bit RC2 in CBC mode
+ rc2-ofb            128 bit RC2 in CBC mode
+ rc2-64-cbc         64 bit RC2 in CBC mode
+ rc2-40-cbc         40 bit RC2 in CBC mode
+
+ rc4                128 bit RC4
+ rc4-64             64 bit RC4
+ rc4-40             40 bit RC4
+
+ rc5-cbc            RC5 cipher in CBC mode
+ rc5                Alias for rc5-cbc
+ rc5-cfb            RC5 cipher in CBC mode
+ rc5-ecb            RC5 cipher in CBC mode
+ rc5-ofb            RC5 cipher in CBC mode
+
+=head1 EXAMPLES
+
+Just base64 encode a binary file:
+
+ openssl base64 -in file.bin -out file.b64
+
+Decode the same file
+
+ openssl base64 -d -in file.b64 -out file.bin 
+
+Encrypt a file using triple DES in CBC mode using a prompted password:
+
+ openssl des3 -salt -in file.txt -out file.des3 
+
+Decrypt a file using a supplied password:
+
+ openssl des3 -d -salt -in file.des3 -out file.txt -k mypassword
+
+Encrypt a file then base64 encode it (so it can be sent via mail for example)
+using Blowfish in CBC mode:
+
+ openssl bf -a -salt -in file.txt -out file.bf
+
+Base64 decode a file then decrypt it:
+
+ openssl bf -d -salt -a -in file.bf -out file.txt
+
+Decrypt some data using a supplied 40 bit RC4 key:
+
+ openssl rc4-40 -in file.rc4 -out file.txt -K 0102030405
+
+=head1 BUGS
+
+The B<-A> option when used with large files doesn't work properly.
+
+There should be an option to allow an iteration count to be included.
+
+Like the EVP library the B<enc> program only supports a fixed number of
+algorithms with certain parameters. So if, for example, you want to use RC2
+with a 76 bit key or RC4 with an 84 bit key you can't use this program.
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/gendsa.pod b/src/lib/libssl/src/doc/apps/gendsa.pod
new file mode 100644
index 0000000000..3314ace517
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/gendsa.pod
@@ -0,0 +1,58 @@
+=pod
+
+=head1 NAME
+
+gendsa - generate a DSA private key from a set of parameters
+
+=head1 SYNOPSIS
+
+B<openssl> B<gendsa>
+[B<-out filename>]
+[B<-des>]
+[B<-des3>]
+[B<-idea>]
+[B<-rand file(s)>]
+[B<paramfile>]
+
+=head1 DESCRIPTION
+
+The B<gendsa> command generates a DSA private key from a DSA parameter file
+(which will be typically generated by the B<openssl dsaparam> command).
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-des|-des3|-idea>
+
+These options encrypt the private key with the DES, triple DES, or the 
+IDEA ciphers respectively before outputting it. A pass phrase is prompted for.
+If none of these options is specified no encryption is used.
+
+=item B<-rand file(s)>
+
+a file or files containing random data used to seed the random number
+generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+Multiple files can be specified separated by a OS-dependent character.
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
+all others.
+
+=item B<paramfile>
+
+This option specifies the DSA parameter file to use. The parameters in this
+file determine the size of the private key. DSA parameters can be generated
+and examined using the B<openssl dsaparam> command.
+
+=back
+
+=head1 NOTES
+
+DSA key generation is little more than random number generation so it is
+much quicker that RSA key generation for example.
+
+=head1 SEE ALSO
+
+L<dsaparam(1)|dsaparam(1)>, L<dsa(1)|dsa(1)>, L<genrsa(1)|genrsa(1)>,
+L<rsa(1)|rsa(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/genrsa.pod b/src/lib/libssl/src/doc/apps/genrsa.pod
new file mode 100644
index 0000000000..a2d878410b
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/genrsa.pod
@@ -0,0 +1,85 @@
+=pod
+
+=head1 NAME
+
+genrsa - generate an RSA private key
+
+=head1 SYNOPSIS
+
+B<openssl> B<genrsa>
+[B<-out filename>]
+[B<-passout arg>]
+[B<-des>]
+[B<-des3>]
+[B<-idea>]
+[B<-f4>]
+[B<-3>]
+[B<-rand file(s)>]
+[B<numbits>]
+
+=head1 DESCRIPTION
+
+The B<genrsa> command generates an RSA private key.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-out filename>
+
+the output filename. If this argument is not specified then standard output is
+used.  
+
+=item B<-passout arg>
+
+the output file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-des|-des3|-idea>
+
+These options encrypt the private key with the DES, triple DES, or the 
+IDEA ciphers respectively before outputting it. If none of these options is
+specified no encryption is used. If encryption is used a pass phrase is prompted
+for if it is not supplied via the B<-passout> argument.
+
+=item B<-F4|-3>
+
+the public exponent to use, either 65537 or 3. The default is 65537.
+
+=item B<-rand file(s)>
+
+a file or files containing random data used to seed the random number
+generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+Multiple files can be specified separated by a OS-dependent character.
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
+all others.
+
+=item B<numbits>
+
+the size of the private key to generate in bits. This must be the last option
+specified. The default is 512.
+
+=back
+
+=head1 NOTES
+
+RSA private key generation essentially involves the generation of two prime
+numbers. When generating a private key various symbols will be output to
+indicate the progress of the generation. A B<.> represents each number which
+has passed an initial sieve test, B<+> means a number has passed a single
+round of the Miller-Rabin primality test. A newline means that the number has
+passed all the prime tests (the actual number depends on the key size).
+
+Because key generation is a random process the time taken to generate a key
+may vary somewhat.
+
+=head1 BUGS
+
+A quirk of the prime generation algorithm is that it cannot generate small
+primes. Therefore the number of bits should not be less that 64. For typical
+private keys this will not matter because for security reasons they will
+be much larger (typically 1024 bits).
+
+=head1 SEE ALSO
+
+L<gendsa(1)|gendsa(1)>
diff --git a/src/lib/libssl/src/doc/apps/nseq.pod b/src/lib/libssl/src/doc/apps/nseq.pod
new file mode 100644
index 0000000000..989c3108fb
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/nseq.pod
@@ -0,0 +1,70 @@
+=pod
+
+=head1 NAME
+
+nseq - create or examine a netscape certificate sequence
+
+=head1 SYNOPSIS
+
+B<openssl> B<nseq>
+[B<-in filename>]
+[B<-out filename>]
+[B<-toseq>]
+
+=head1 DESCRIPTION
+
+The B<nseq> command takes a file containing a Netscape certificate
+sequence and prints out the certificates contained in it or takes a
+file of certificates and converts it into a Netscape certificate
+sequence.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-in filename>
+
+This specifies the input filename to read or standard input if this
+option is not specified.
+
+=item B<-out filename>
+
+specifies the output filename or standard output by default.
+
+=item B<-toseq>
+
+normally a Netscape certificate sequence will be input and the output
+is the certificates contained in it. With the B<-toseq> option the
+situation is reversed: a Netscape certificate sequence is created from
+a file of certificates.
+
+=back
+
+=head1 EXAMPLES
+
+Output the certificates in a Netscape certificate sequence
+
+ openssl nseq -in nseq.pem -out certs.pem
+
+Create a Netscape certificate sequence
+
+ openssl nseq -in certs.pem -toseq -out nseq.pem
+
+=head1 NOTES
+
+The B<PEM> encoded form uses the same headers and footers as a certificate:
+
+ -----BEGIN CERTIFICATE-----
+ -----END CERTIFICATE-----
+
+A Netscape certificate sequence is a Netscape specific form that can be sent
+to browsers as an alternative to the standard PKCS#7 format when several
+certificates are sent to the browser: for example during certificate enrollment.
+It is used by Netscape certificate server for example.
+
+=head1 BUGS
+
+This program needs a few more options: like allowing DER or PEM input and
+output files and allowing multiple certificate files to be used.
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/openssl.pod b/src/lib/libssl/src/doc/apps/openssl.pod
new file mode 100644
index 0000000000..9b1320606b
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/openssl.pod
@@ -0,0 +1,298 @@
+
+=pod
+
+=head1 NAME
+
+openssl - OpenSSL command line tool
+
+=head1 SYNOPSIS
+
+B<openssl>
+I<command>
+[ I<command_opts> ]
+[ I<command_args> ]
+
+=head1 DESCRIPTION
+
+OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL
+v2/v3) and Transport Layer Security (TLS v1) network protocols and related
+cryptography standards required by them.
+
+The B<openssl> program is a command line tool for using the various
+cryptography functions of OpenSSL's B<crypto> library from the shell. 
+It can be used for 
+
+ o  Creation of RSA, DH and DSA key parameters
+ o  Creation of X.509 certificates, CSRs and CRLs 
+ o  Calculation of Message Digests
+ o  Encryption and Decryption with Ciphers
+ o  SSL/TLS Client and Server Tests
+ o  Handling of S/MIME signed or encrypted mail
+
+=head1 COMMAND SUMMARY
+
+The B<openssl> program provides a rich variety of commands (I<command> in the
+SYNOPSIS above), each of which often has a wealth of options and arguments
+(I<command_opts> and I<command_args> in the SYNOPSIS).
+
+=head2 STANDARD COMMANDS
+
+=over 10
+
+=item L<B<asn1parse>|asn1parse(1)>
+
+Parse an ASN.1 sequence.
+
+=item L<B<ca>|ca(1)>
+
+Certificate Authority (CA) Management.  
+
+=item L<B<ciphers>|ciphers(1)>
+
+Cipher Suite Description Determination.
+
+=item L<B<crl>|crl(1)>
+
+Certificate Revocation List (CRL) Management.
+
+=item L<B<crl2pkcs7>|crl2pkcs7(1)>
+
+CRL to PKCS#7 Conversion.
+
+=item L<B<dgst>|dgst(1)>
+
+Message Digest Calculation.
+
+=item L<B<dh>|dh(1)>
+
+Diffie-Hellman Data Management.
+
+=item L<B<dsa>|dsa(1)>
+
+DSA Data Management.
+
+=item L<B<dsaparam>|dsaparam(1)>
+
+DSA Parameter Generation.
+
+=item L<B<enc>|enc(1)>
+
+Encoding with Ciphers.
+
+=item L<B<errstr>|errstr(1)>
+
+Error Number to Error String Conversion.
+
+=item L<B<gendh>|gendh(1)>
+
+Generation of Diffie-Hellman Parameters.
+
+=item L<B<gendsa>|gendsa(1)>
+
+Generation of DSA Parameters.
+
+=item L<B<genrsa>|genrsa(1)>
+
+Generation of RSA Parameters.
+
+=item L<B<passwd>|passwd(1)>
+
+Generation of hashed passwords.
+
+=item L<B<pkcs7>|pkcs7(1)>
+
+PKCS#7 Data Management.
+
+=item L<B<req>|req(1)>
+
+X.509 Certificate Signing Request (CSR) Management.
+
+=item L<B<rsa>|rsa(1)>
+
+RSA Data Management.
+
+=item L<B<s_client>|s_client(1)>
+
+This implements a generic SSL/TLS client which can establish a transparent
+connection to a remote server speaking SSL/TLS. It's intended for testing
+purposes only and provides only rudimentary interface functionality but
+internally uses mostly all functionality of the OpenSSL B<ssl> library.
+
+=item L<B<s_server>|s_server(1)>
+
+This implements a generic SSL/TLS server which accepts connections from remote
+clients speaking SSL/TLS. It's intended for testing purposes only and provides
+only rudimentary interface functionality but internally uses mostly all
+functionality of the OpenSSL B<ssl> library.  It provides both an own command
+line oriented protocol for testing SSL functions and a simple HTTP response
+facility to emulate an SSL/TLS-aware webserver.
+
+=item L<B<s_time>|s_time(1)>
+
+SSL Connection Timer.
+
+=item L<B<sess_id>|sess_id(1)>
+
+SSL Session Data Management.
+
+=item L<B<smime>|smime(1)>
+
+S/MIME mail processing.
+
+=item L<B<speed>|speed(1)>
+
+Algorithm Speed Measurement.
+
+=item L<B<verify>|verify(1)>
+
+X.509 Certificate Verification.
+
+=item L<B<version>|version(1)>
+
+OpenSSL Version Information.
+
+=item L<B<x509>|x509(1)>
+
+X.509 Certificate Data Management.
+
+=back
+
+=head2 MESSAGE DIGEST COMMANDS
+
+=over 10
+
+=item B<md2>
+
+MD2 Digest
+
+=item B<md5>
+
+MD5 Digest
+
+=item B<mdc2>
+
+MDC2 Digest
+
+=item B<rmd160>
+
+RMD-160 Digest
+
+=item B<sha>            
+
+SHA Digest
+
+=item B<sha1>           
+
+SHA-1 Digest
+
+=back
+
+=head2 ENCODING AND CIPHER COMMANDS
+
+=over 10
+
+=item B<base64>
+
+Base64 Encoding
+
+=item B<bf bf-cbc bf-cfb bf-ecb bf-ofb>
+
+Blowfish Cipher
+
+=item B<cast cast-cbc>
+
+CAST Cipher
+
+=item B<cast5-cbc cast5-cfb cast5-ecb cast5-ofb>
+
+CAST5 Cipher
+
+=item B<des des-cbc des-cfb des-ecb des-ede des-ede-cbc des-ede-cfb des-ede-ofb des-ofb>
+
+DES Cipher
+
+=item B<des3 desx des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb>
+
+Triple-DES Cipher
+
+=item B<idea idea-cbc idea-cfb idea-ecb idea-ofb>
+
+IDEA Cipher
+
+=item B<rc2 rc2-cbc rc2-cfb rc2-ecb rc2-ofb>
+
+RC2 Cipher
+
+=item B<rc4>
+
+RC4 Cipher
+
+=item B<rc5 rc5-cbc rc5-cfb rc5-ecb rc5-ofb>
+
+RC5 Cipher
+
+=back
+
+=head1 PASS PHRASE ARGUMENTS
+
+Several commands accept password arguments, typically using B<-passin>
+and B<-passout> for input and output passwords respectively. These allow
+the password to be obtained from a variety of sources. Both of these
+options take a single argument whose format is described below. If no
+password argument is given and a password is required then the user is
+prompted to enter one: this will typically be read from the current
+terminal with echoing turned off.
+
+=over 10
+
+=item B<pass:password>
+
+the actual password is B<password>. Since the password is visible
+to utilities (like 'ps' under Unix) this form should only be used
+where security is not important.
+
+=item B<env:var>
+
+obtain the password from the environment variable B<var>. Since
+the environment of other processes is visible on certain platforms
+(e.g. ps under certain Unix OSes) this option should be used with caution.
+
+=item B<file:pathname>
+
+the first line of B<pathname> is the password. If the same B<pathname>
+argument is supplied to B<-passin> and B<-passout> arguments then the first
+line will be used for the input password and the next line for the output
+password. B<pathname> need not refer to a regular file: it could for example
+refer to a device or named pipe.
+
+=item B<fd:number>
+
+read the password from the file descriptor B<number>. This can be used to
+send the data via a pipe for example.
+
+=item B<stdin>
+
+read the password from standard input.
+
+=back
+
+=head1 SEE ALSO
+
+L<asn1parse(1)|asn1parse(1)>, L<ca(1)|ca(1)>, L<config(5)|config(5)>,
+L<crl(1)|crl(1)>, L<crl2pkcs7(1)|crl2pkcs7(1)>, L<dgst(1)|dgst(1)>,
+L<dhparam(1)|dhparam(1)>, L<dsa(1)|dsa(1)>, L<dsaparam(1)|dsaparam(1)>,
+L<enc(1)|enc(1)>, L<gendsa(1)|gendsa(1)>,
+L<genrsa(1)|genrsa(1)>, L<nseq(1)|nseq(1)>, L<openssl(1)|openssl(1)>,
+L<passwd(1)|passwd(1)>,
+L<pkcs12(1)|pkcs12(1)>, L<pkcs7(1)|pkcs7(1)>, L<pkcs8(1)|pkcs8(1)>,
+L<req(1)|req(1)>, L<rsa(1)|rsa(1)>, L<s_client(1)|s_client(1)>,
+L<s_server(1)|s_server(1)>, L<smime(1)|smime(1)>, L<spkac(1)|spkac(1)>,
+L<verify(1)|verify(1)>, L<version(1)|version(1)>, L<x509(1)|x509(1)>,
+L<crypto(3)|crypto(3)>, L<ssl(3)|ssl(3)> 
+
+=head1 HISTORY
+
+The openssl(1) document appeared in OpenSSL 0.9.2
+
+=cut
+
diff --git a/src/lib/libssl/src/doc/apps/passwd.pod b/src/lib/libssl/src/doc/apps/passwd.pod
new file mode 100644
index 0000000000..cee6a2f172
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/passwd.pod
@@ -0,0 +1,69 @@
+=pod
+
+=head1 NAME
+
+passwd - compute password hashes
+
+=head1 SYNOPSIS
+
+B<openssl passwd>
+[B<-crypt>]
+[B<-apr1>]
+[B<-salt> I<string>]
+[B<-in> I<file>]
+[B<-stdin>]
+[B<-quiet>]
+[B<-table>]
+{I<password>}
+
+=head1 DESCRIPTION
+
+The B<passwd> command computes the hash of a password typed at
+run-time or the hash of each password in a list.  The password list is
+taken from the named file for option B<-in file>, from stdin for
+option B<-stdin>, and from the command line otherwise.
+The Unix standard algorithm B<crypt> and the MD5-based B<apr1> algorithm
+are available.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-crypt>
+
+Use the B<crypt> algorithm (default).
+
+=item B<-apr1>
+
+Use the B<apr1> algorithm.
+
+=item B<-salt> I<string>
+
+Use the specified salt.
+
+=item B<-in> I<file>
+
+Read passwords from I<file>.
+
+=item B<-stdin>
+
+Read passwords from B<stdin>.
+
+=item B<-quiet>
+
+Don't output warnings when passwords given at the command line are truncated.
+
+=item B<-table>
+
+In the output list, prepend the cleartext password and a TAB character
+to each password hash.
+
+=back
+
+=head1 EXAMPLES
+
+B<openssl passwd -crypt -salt xx password> prints B<xxj31ZMTZzkVA>.
+
+B<openssl passwd -apr1 -salt xxxxxxxx password> prints B<$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0>.
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/pkcs12.pod b/src/lib/libssl/src/doc/apps/pkcs12.pod
new file mode 100644
index 0000000000..241f9c4a8b
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/pkcs12.pod
@@ -0,0 +1,310 @@
+
+=pod
+
+=head1 NAME
+
+pkcs12 - PKCS#12 file utility
+
+=head1 SYNOPSIS
+
+B<openssl> B<pkcs12>
+[B<-export>]
+[B<-chain>]
+[B<-inkey filename>]
+[B<-certfile filename>]
+[B<-name name>]
+[B<-caname name>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-noout>]
+[B<-nomacver>]
+[B<-nocerts>]
+[B<-clcerts>]
+[B<-cacerts>]
+[B<-nokeys>]
+[B<-info>]
+[B<-des>]
+[B<-des3>]
+[B<-idea>]
+[B<-nodes>]
+[B<-noiter>]
+[B<-maciter>]
+[B<-twopass>]
+[B<-descert>]
+[B<-certpbe>]
+[B<-keypbe>]
+[B<-keyex>]
+[B<-keysig>]
+[B<-password arg>]
+[B<-passin arg>]
+[B<-passout arg>]
+[B<-rand file(s)>]
+
+=head1 DESCRIPTION
+
+The B<pkcs12> command allows PKCS#12 files (sometimes referred to as
+PFX files) to be created and parsed. PKCS#12 files are used by several
+programs including Netscape, MSIE and MS Outlook.
+
+=head1 COMMAND OPTIONS
+
+There are a lot of options the meaning of some depends of whether a PKCS#12 file
+is being created or parsed. By default a PKCS#12 file is parsed a PKCS#12
+file can be created by using the B<-export> option (see below).
+
+=head1 PARSING OPTIONS
+
+=over 4
+
+=item B<-in filename>
+
+This specifies filename of the PKCS#12 file to be parsed. Standard input is used
+by default.
+
+=item B<-out filename>
+
+The filename to write certificates and private keys to, standard output by default.
+They are all written in PEM format.
+
+=item B<-pass arg>, B<-passin arg>
+
+the PKCS#12 file (i.e. input file) password source. For more information about the
+format of B<arg> see the B<PASS PHRASE ARGUMENTS> section in
+L<openssl(1)|openssl(1)>.
+
+=item B<-passout arg>
+
+pass phrase source to encrypt any outputed private keys with. For more information
+about the format of B<arg> see the B<PASS PHRASE ARGUMENTS> section in
+L<openssl(1)|openssl(1)>.
+
+=item B<-noout>
+
+this option inhibits output of the keys and certificates to the output file version
+of the PKCS#12 file.
+
+=item B<-clcerts>
+
+only output client certificates (not CA certificates).
+
+=item B<-cacerts>
+
+only output CA certificates (not client certificates).
+
+=item B<-nocerts>
+
+no certificates at all will be output.
+
+=item B<-nokeys>
+
+no private keys will be output.
+
+=item B<-info>
+
+output additional information about the PKCS#12 file structure, algorithms used and
+iteration counts.
+
+=item B<-des>
+
+use DES to encrypt private keys before outputting.
+
+=item B<-des3>
+
+use triple DES to encrypt private keys before outputting, this is the default.
+
+=item B<-idea>
+
+use IDEA to encrypt private keys before outputting.
+
+=item B<-nodes>
+
+don't encrypt the private keys at all.
+
+=item B<-nomacver>
+
+don't attempt to verify the integrity MAC before reading the file.
+
+=item B<-twopass>
+
+prompt for separate integrity and encryption passwords: most software
+always assumes these are the same so this option will render such
+PKCS#12 files unreadable.
+
+=back
+
+=head1 FILE CREATION OPTIONS
+
+=over 4
+
+=item B<-export>
+
+This option specifies that a PKCS#12 file will be created rather than
+parsed.
+
+=item B<-out filename>
+
+This specifies filename to write the PKCS#12 file to. Standard output is used
+by default.
+
+=item B<-in filename>
+
+The filename to read certificates and private keys from, standard input by default.
+They must all be in PEM format. The order doesn't matter but one private key and
+its corresponding certificate should be present. If additional certificates are
+present they will also be included in the PKCS#12 file.
+
+=item B<-inkey filename>
+
+file to read private key from. If not present then a private key must be present
+in the input file.
+
+=item B<-name friendlyname>
+
+This specifies the "friendly name" for the certificate and private key. This name
+is typically displayed in list boxes by software importing the file.
+
+=item B<-certfile filename>
+
+A filename to read additional certificates from.
+
+=item B<-caname friendlyname>
+
+This specifies the "friendly name" for other certificates. This option may be
+used multiple times to specify names for all certificates in the order they
+appear. Netscape ignores friendly names on other certificates whereas MSIE
+displays them.
+
+=item B<-pass arg>, B<-passout arg>
+
+the PKCS#12 file (i.e. output file) password source. For more information about
+the format of B<arg> see the B<PASS PHRASE ARGUMENTS> section in
+L<openssl(1)|openssl(1)>.
+
+=item B<-passin password>
+
+pass phrase source to decrypt any input private keys with. For more information
+about the format of B<arg> see the B<PASS PHRASE ARGUMENTS> section in
+L<openssl(1)|openssl(1)>.
+
+=item B<-chain>
+
+if this option is present then an attempt is made to include the entire
+certificate chain of the user certificate. The standard CA store is used
+for this search. If the search fails it is considered a fatal error.
+
+=item B<-descert>
+
+encrypt the certificate using triple DES, this may render the PKCS#12
+file unreadable by some "export grade" software. By default the private
+key is encrypted using triple DES and the certificate using 40 bit RC2.
+
+=item B<-keypbe alg>, B<-certpbe alg>
+
+these options allow the algorithm used to encrypt the private key and
+certificates to be selected. Although any PKCS#5 v1.5 or PKCS#12 algorithms
+can be selected it is advisable only to use PKCS#12 algorithms. See the list
+in the B<NOTES> section for more information.
+
+=item B<-keyex|-keysig>
+
+specifies that the private key is to be used for key exchange or just signing.
+This option is only interpreted by MSIE and similar MS software. Normally
+"export grade" software will only allow 512 bit RSA keys to be used for
+encryption purposes but arbitrary length keys for signing. The B<-keysig>
+option marks the key for signing only. Signing only keys can be used for
+S/MIME signing, authenticode (ActiveX control signing)  and SSL client
+authentication, however due to a bug only MSIE 5.0 and later support
+the use of signing only keys for SSL client authentication.
+
+=item B<-nomaciter>, B<-noiter>
+
+these options affect the iteration counts on the MAC and key algorithms.
+Unless you wish to produce files compatible with MSIE 4.0 you should leave
+these options alone.
+
+To discourage attacks by using large dictionaries of common passwords the
+algorithm that derives keys from passwords can have an iteration count applied
+to it: this causes a certain part of the algorithm to be repeated and slows it
+down. The MAC is used to check the file integrity but since it will normally
+have the same password as the keys and certificates it could also be attacked.
+By default both MAC and encryption iteration counts are set to 2048, using
+these options the MAC and encryption iteration counts can be set to 1, since
+this reduces the file security you should not use these options unless you
+really have to. Most software supports both MAC and key iteration counts.
+MSIE 4.0 doesn't support MAC iteration counts so it needs the B<-nomaciter>
+option.
+
+=item B<-maciter>
+
+This option is included for compatibility with previous versions, it used
+to be needed to use MAC iterations counts but they are now used by default.
+
+=item B<-rand file(s)>
+
+a file or files containing random data used to seed the random number
+generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+Multiple files can be specified separated by a OS-dependent character.
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
+all others.
+
+=back
+
+=head1 NOTES
+
+Although there are a large number of options most of them are very rarely
+used. For PKCS#12 file parsing only B<-in> and B<-out> need to be used
+for PKCS#12 file creation B<-export> and B<-name> are also used.
+
+If none of the B<-clcerts>, B<-cacerts> or B<-nocerts> options are present
+then all certificates will be output in the order they appear in the input
+PKCS#12 files. There is no guarantee that the first certificate present is
+the one corresponding to the private key. Certain software which requires
+a private key and certificate and assumes the first certificate in the
+file is the one corresponding to the private key: this may not always
+be the case. Using the B<-clcerts> option will solve this problem by only
+outputing the certificate corresponding to the private key. If the CA
+certificates are required then they can be output to a separate file using
+the B<-nokeys -cacerts> options to just output CA certificates.
+
+The B<-keypbe> and B<-certpbe> algorithms allow the precise encryption
+algorithms for private keys and certificates to be specified. Normally
+the defaults are fine but occasionally software can't handle triple DES
+encrypted private keys, then the option B<-keypbe PBE-SHA1-RC2-40> can
+be used to reduce the private key encryption to 40 bit RC2. A complete
+description of all algorithms is contained in the B<pkcs8> manual page.
+
+=head1 EXAMPLES
+
+Parse a PKCS#12 file and output it to a file:
+
+ openssl pkcs12 -in file.p12 -out file.pem
+
+Output only client certificates to a file:
+
+ openssl pkcs12 -in file.p12 -clcerts -out file.pem
+
+Don't encrypt the private key:
+ 
+ openssl pkcs12 -in file.p12 -out file.pem -nodes
+
+Print some info about a PKCS#12 file:
+
+ openssl pkcs12 -in file.p12 -info -noout
+
+Create a PKCS#12 file:
+
+ openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate"
+
+Include some extra certificates:
+
+ openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate" \
+  -certfile othercerts.pem
+
+=head1 BUGS
+
+Some would argue that the PKCS#12 standard is one big bug :-)
+
+=head1 SEE ALSO
+
+L<pkcs8(1)|pkcs8(1)>
+
diff --git a/src/lib/libssl/src/doc/apps/pkcs7.pod b/src/lib/libssl/src/doc/apps/pkcs7.pod
new file mode 100644
index 0000000000..4e9bd6e46b
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/pkcs7.pod
@@ -0,0 +1,97 @@
+=pod
+
+=head1 NAME
+
+pkcs7 - PKCS#7 utility
+
+=head1 SYNOPSIS
+
+B<openssl> B<pkcs7>
+[B<-inform PEM|DER>]
+[B<-outform PEM|DER>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-print_certs>]
+[B<-text>]
+[B<-noout>]
+
+=head1 DESCRIPTION
+
+The B<pkcs7> command processes PKCS#7 files in DER or PEM format.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. B<DER> format is DER encoded PKCS#7
+v1.5 structure.B<PEM> (the default) is a base64 encoded version of
+the DER form with header and footer lines.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read from or standard input if this
+option is not specified.
+
+=item B<-out filename>
+
+specifies the output filename to write to or standard output by
+default.
+
+=item B<-print_certs>
+
+prints out any certificates or CRLs contained in the file. They are
+preceded by their subject and issuer names in one line format.
+
+=item B<-text>
+
+prints out certificates details in full rather than just subject and
+issuer names.
+
+=item B<-noout>
+
+don't output the encoded version of the PKCS#7 structure (or certificates
+is B<-print_certs> is set).
+
+=back
+
+=head1 EXAMPLES
+
+Convert a PKCS#7 file from PEM to DER:
+
+ openssl pkcs7 -in file.pem -outform DER -out file.der
+
+Output all certificates in a file:
+
+ openssl pkcs7 -in file.pem -print_certs -out certs.pem
+
+=head1 NOTES
+
+The PEM PKCS#7 format uses the header and footer lines:
+
+ -----BEGIN PKCS7-----
+ -----END PKCS7-----
+
+For compatability with some CAs it will also accept:
+
+ -----BEGIN CERTIFICATE-----
+ -----END CERTIFICATE-----
+
+=head1 RESTRICTIONS
+
+There is no option to print out all the fields of a PKCS#7 file.
+
+This PKCS#7 routines only understand PKCS#7 v 1.5 as specified in RFC2315 they 
+cannot currently parse, for example, the new CMS as described in RFC2630.
+
+=head1 SEE ALSO
+
+L<crl2pkcs7(1)|crl2pkcs7(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/pkcs8.pod b/src/lib/libssl/src/doc/apps/pkcs8.pod
new file mode 100644
index 0000000000..a56b2dd002
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/pkcs8.pod
@@ -0,0 +1,235 @@
+=pod
+
+=head1 NAME
+
+pkcs8 - PKCS#8 format private key conversion tool
+
+=head1 SYNOPSIS
+
+B<openssl> B<pkcs8>
+[B<-topk8>]
+[B<-inform PEM|DER>]
+[B<-outform PEM|DER>]
+[B<-in filename>]
+[B<-passin arg>]
+[B<-out filename>]
+[B<-passout arg>]
+[B<-noiter>]
+[B<-nocrypt>]
+[B<-nooct>]
+[B<-embed>]
+[B<-nsdb>]
+[B<-v2 alg>]
+[B<-v1 alg>]
+
+=head1 DESCRIPTION
+
+The B<pkcs8> command processes private keys in PKCS#8 format. It can handle
+both unencrypted PKCS#8 PrivateKeyInfo format and EncryptedPrivateKeyInfo
+format with a variety of PKCS#5 (v1.5 and v2.0) and PKCS#12 algorithms.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-topk8>
+
+Normally a PKCS#8 private key is expected on input and a traditional format
+private key will be written. With the B<-topk8> option the situation is
+reversed: it reads a traditional format private key and writes a PKCS#8
+format key.
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. If a PKCS#8 format key is expected on input
+then either a B<DER> or B<PEM> encoded version of a PKCS#8 key will be
+expected. Otherwise the B<DER> or B<PEM> format of the traditional format
+private key is used.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read a key from or standard input if this
+option is not specified. If the key is encrypted a pass phrase will be
+prompted for.
+
+=item B<-passin arg>
+
+the input file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-out filename>
+
+This specifies the output filename to write a key to or standard output by
+default. If any encryption options are set then a pass phrase will be
+prompted for. The output filename should B<not> be the same as the input
+filename.
+
+=item B<-passout arg>
+
+the output file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-nocrypt>
+
+PKCS#8 keys generated or input are normally PKCS#8 EncryptedPrivateKeyInfo
+structures using an appropriate password based encryption algorithm. With
+this option an unencrypted PrivateKeyInfo structure is expected or output.
+This option does not encrypt private keys at all and should only be used
+when absolutely necessary. Certain software such as some versions of Java
+code signing software used unencrypted private keys.
+
+=item B<-nooct>
+
+This option generates RSA private keys in a broken format that some software
+uses. Specifically the private key should be enclosed in a OCTET STRING
+but some software just includes the structure itself without the
+surrounding OCTET STRING.
+
+=item B<-embed>
+
+This option generates DSA keys in a broken format. The DSA parameters are
+embedded inside the PrivateKey structure. In this form the OCTET STRING
+contains an ASN1 SEQUENCE consisting of two structures: a SEQUENCE containing
+the parameters and an ASN1 INTEGER containing the private key.
+
+=item B<-nsdb>
+
+This option generates DSA keys in a broken format compatible with Netscape
+private key databases. The PrivateKey contains a SEQUENCE consisting of
+the public and private keys respectively.
+
+=item B<-v2 alg>
+
+This option enables the use of PKCS#5 v2.0 algorithms. Normally PKCS#8
+private keys are encrypted with the password based encryption algorithm
+called B<pbeWithMD5AndDES-CBC> this uses 56 bit DES encryption but it
+was the strongest encryption algorithm supported in PKCS#5 v1.5. Using 
+the B<-v2> option PKCS#5 v2.0 algorithms are used which can use any
+encryption algorithm such as 168 bit triple DES or 128 bit RC2 however
+not many implementations support PKCS#5 v2.0 yet. If you are just using
+private keys with OpenSSL then this doesn't matter.
+
+The B<alg> argument is the encryption algorithm to use, valid values include
+B<des>, B<des3> and B<rc2>. It is recommended that B<des3> is used.
+
+=item B<-v1 alg>
+
+This option specifies a PKCS#5 v1.5 or PKCS#12 algorithm to use. A complete
+list of possible algorithms is included below.
+
+=back
+
+=head1 NOTES
+
+The encrypted form of a PEM encode PKCS#8 files uses the following
+headers and footers:
+
+ -----BEGIN ENCRYPTED PRIVATE KEY-----
+ -----END ENCRYPTED PRIVATE KEY-----
+
+The unencrypted form uses:
+
+ -----BEGIN PRIVATE KEY-----
+ -----END PRIVATE KEY-----
+
+Private keys encrypted using PKCS#5 v2.0 algorithms and high iteration
+counts are more secure that those encrypted using the traditional
+SSLeay compatible formats. So if additional security is considered
+important the keys should be converted.
+
+The default encryption is only 56 bits because this is the encryption
+that most current implementations of PKCS#8 will support.
+
+Some software may use PKCS#12 password based encryption algorithms
+with PKCS#8 format private keys: these are handled automatically
+but there is no option to produce them.
+
+It is possible to write out DER encoded encrypted private keys in
+PKCS#8 format because the encryption details are included at an ASN1
+level whereas the traditional format includes them at a PEM level.
+
+=head1 PKCS#5 v1.5 and PKCS#12 algorithms.
+
+Various algorithms can be used with the B<-v1> command line option,
+including PKCS#5 v1.5 and PKCS#12. These are described in more detail
+below.
+
+=over 4
+
+=item B<PBE-MD2-DES PBE-MD5-DES>
+
+These algorithms were included in the original PKCS#5 v1.5 specification.
+They only offer 56 bits of protection since they both use DES.
+
+=item B<PBE-SHA1-RC2-64 PBE-MD2-RC2-64 PBE-MD5-RC2-64 PBE-SHA1-DES>
+
+These algorithms are not mentioned in the original PKCS#5 v1.5 specification
+but they use the same key derivation algorithm and are supported by some
+software. They are mentioned in PKCS#5 v2.0. They use either 64 bit RC2 or
+56 bit DES.
+
+=item B<PBE-SHA1-RC4-128 PBE-SHA1-RC4-40 PBE-SHA1-3DES PBE-SHA1-2DES PBE-SHA1-RC2-128 PBE-SHA1-RC2-40>
+
+These algorithms use the PKCS#12 password based encryption algorithm and
+allow strong encryption algorithms like triple DES or 128 bit RC2 to be used.
+
+=back
+
+=head1 EXAMPLES
+
+Convert a private from traditional to PKCS#5 v2.0 format using triple
+DES:
+
+ openssl pkcs8 -in key.pem -topk8 -v2 des3 -out enckey.pem
+
+Convert a private key to PKCS#8 using a PKCS#5 1.5 compatible algorithm
+(DES):
+
+ openssl pkcs8 -in key.pem -topk8 -out enckey.pem
+
+Convert a private key to PKCS#8 using a PKCS#12 compatible algorithm
+(3DES):
+
+ openssl pkcs8 -in key.pem -topk8 -out enckey.pem -v1 PBE-SHA1-3DES
+
+Read a DER unencrypted PKCS#8 format private key:
+
+ openssl pkcs8 -inform DER -nocrypt -in key.der -out key.pem
+
+Convert a private key from any PKCS#8 format to traditional format:
+
+ openssl pkcs8 -in pk8.pem -out key.pem
+
+=head1 STANDARDS
+
+Test vectors from this PKCS#5 v2.0 implementation were posted to the
+pkcs-tng mailing list using triple DES, DES and RC2 with high iteration
+counts, several people confirmed that they could decrypt the private
+keys produced and Therefore it can be assumed that the PKCS#5 v2.0
+implementation is reasonably accurate at least as far as these
+algorithms are concerned.
+
+The format of PKCS#8 DSA (and other) private keys is not well documented:
+it is hidden away in PKCS#11 v2.01, section 11.9. OpenSSL's default DSA
+PKCS#8 private key format complies with this standard.
+
+=head1 BUGS
+
+There should be an option that prints out the encryption algorithm
+in use and other details such as the iteration count.
+
+PKCS#8 using triple DES and PKCS#5 v2.0 should be the default private
+key format for OpenSSL: for compatibility several of the utilities use
+the old format at present.
+
+=head1 SEE ALSO
+
+L<dsa(1)|dsa(1)>, L<rsa(1)|rsa(1)>, L<genrsa(1)|genrsa(1)>,
+L<gendsa(1)|gendsa(1)> 
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/req.pod b/src/lib/libssl/src/doc/apps/req.pod
new file mode 100644
index 0000000000..fde6ff2e9f
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/req.pod
@@ -0,0 +1,528 @@
+
+=pod
+
+=head1 NAME
+
+req - PKCS#10 certificate and certificate generating utility.
+
+=head1 SYNOPSIS
+
+B<openssl> B<req>
+[B<-inform PEM|DER>]
+[B<-outform PEM|DER>]
+[B<-in filename>]
+[B<-passin arg>]
+[B<-out filename>]
+[B<-passout arg>]
+[B<-text>]
+[B<-noout>]
+[B<-verify>]
+[B<-modulus>]
+[B<-new>]
+[B<-newkey rsa:bits>]
+[B<-newkey dsa:file>]
+[B<-nodes>]
+[B<-key filename>]
+[B<-keyform PEM|DER>]
+[B<-keyout filename>]
+[B<-[md5|sha1|md2|mdc2]>]
+[B<-config filename>]
+[B<-x509>]
+[B<-days n>]
+[B<-asn1-kludge>]
+[B<-newhdr>]
+[B<-extensions section>]
+[B<-reqexts section>]
+
+=head1 DESCRIPTION
+
+The B<req> command primarily creates and processes certificate requests
+in PKCS#10 format. It can additionally create self signed certificates
+for use as root CAs for example.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. The B<DER> option uses an ASN1 DER encoded
+form compatible with the PKCS#10. The B<PEM> form is the default format: it
+consists of the B<DER> format base64 encoded with additional header and
+footer lines.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read a request from or standard input
+if this option is not specified. A request is only read if the creation
+options (B<-new> and B<-newkey>) are not specified.
+
+=item B<-passin arg>
+
+the input file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-out filename>
+
+This specifies the output filename to write to or standard output by
+default.
+
+=item B<-passout arg>
+
+the output file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-text>
+
+prints out the certificate request in text form.
+
+=item B<-noout>
+
+this option prevents output of the encoded version of the request.
+
+=item B<-modulus>
+
+this option prints out the value of the modulus of the public key
+contained in the request.
+
+=item B<-verify>
+
+verifies the signature on the request.
+
+=item B<-new>
+
+this option generates a new certificate request. It will prompt
+the user for the relevant field values. The actual fields
+prompted for and their maximum and minimum sizes are specified
+in the configuration file and any requested extensions.
+
+If the B<-key> option is not used it will generate a new RSA private
+key using information specified in the configuration file.
+
+=item B<-newkey arg>
+
+this option creates a new certificate request and a new private
+key. The argument takes one of two forms. B<rsa:nbits>, where
+B<nbits> is the number of bits, generates an RSA key B<nbits>
+in size. B<dsa:filename> generates a DSA key using the parameters
+in the file B<filename>.
+
+=item B<-key filename>
+
+This specifies the file to read the private key from. It also
+accepts PKCS#8 format private keys for PEM format files.
+
+=item B<-keyform PEM|DER>
+
+the format of the private key file specified in the B<-key>
+argument. PEM is the default.
+
+=item B<-keyout filename>
+
+this gives the filename to write the newly created private key to.
+If this option is not specified then the filename present in the
+configuration file is used.
+
+=item B<-nodes>
+
+if this option is specified then if a private key is created it
+will not be encrypted.
+
+=item B<-[md5|sha1|md2|mdc2]>
+
+this specifies the message digest to sign the request with. This
+overrides the digest algorithm specified in the configuration file.
+This option is ignored for DSA requests: they always use SHA1.
+
+=item B<-config filename>
+
+this allows an alternative configuration file to be specified,
+this overrides the compile time filename or any specified in
+the B<OPENSSL_CONF> environment variable.
+
+=item B<-x509>
+
+this option outputs a self signed certificate instead of a certificate
+request. This is typically used to generate a test certificate or
+a self signed root CA. The extensions added to the certificate
+(if any) are specified in the configuration file.
+
+=item B<-days n>
+
+when the B<-x509> option is being used this specifies the number of
+days to certify the certificate for. The default is 30 days.
+
+=item B<-extensions section>
+=item B<-reqexts section>
+
+these options specify alternative sections to include certificate
+extensions (if the B<-x509> option is present) or certificate
+request extensions. This allows several different sections to
+be used in the same configuration file to specify requests for
+a variety of purposes.
+
+=item B<-asn1-kludge>
+
+by default the B<req> command outputs certificate requests containing
+no attributes in the correct PKCS#10 format. However certain CAs will only
+accept requests containing no attributes in an invalid form: this
+option produces this invalid format.
+
+More precisely the B<Attributes> in a PKCS#10 certificate request
+are defined as a B<SET OF Attribute>. They are B<not OPTIONAL> so
+if no attributes are present then they should be encoded as an
+empty B<SET OF>. The invalid form does not include the empty
+B<SET OF> whereas the correct form does.
+
+It should be noted that very few CAs still require the use of this option.
+
+=item B<-newhdr>
+
+Adds the word B<NEW> to the PEM file header and footer lines on the outputed
+request. Some software (Netscape certificate server) and some CAs need this.
+
+=back
+
+=head1 CONFIGURATION FILE FORMAT
+
+The configuration options are specified in the B<req> section of
+the configuration file. As with all configuration files if no
+value is specified in the specific section (i.e. B<req>) then
+the initial unnamed or B<default> section is searched too.
+
+The options available are described in detail below.
+
+=over 4
+
+=item B<input_password output_password>
+
+The passwords for the input private key file (if present) and
+the output private key file (if one will be created). The
+command line options B<passin> and B<passout> override the
+configuration file values.
+
+=item B<default_bits>
+
+This specifies the default key size in bits. If not specified then
+512 is used. It is used if the B<-new> option is used. It can be
+overridden by using the B<-newkey> option.
+
+=item B<default_keyfile>
+
+This is the default filename to write a private key to. If not
+specified the key is written to standard output. This can be
+overridden by the B<-keyout> option.
+
+=item B<oid_file>
+
+This specifies a file containing additional B<OBJECT IDENTIFIERS>.
+Each line of the file should consist of the numerical form of the
+object identifier followed by white space then the short name followed
+by white space and finally the long name. 
+
+=item B<oid_section>
+
+This specifies a section in the configuration file containing extra
+object identifiers. Each line should consist of the short name of the
+object identifier followed by B<=> and the numerical form. The short
+and long names are the same when this option is used.
+
+=item B<RANDFILE>
+
+This specifies a filename in which random number seed information is
+placed and read from, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+It is used for private key generation.
+
+=item B<encrypt_key>
+
+If this is set to B<no> then if a private key is generated it is
+B<not> encrypted. This is equivalent to the B<-nodes> command line
+option. For compatibility B<encrypt_rsa_key> is an equivalent option.
+
+=item B<default_md>
+
+This option specifies the digest algorithm to use. Possible values
+include B<md5 sha1 mdc2>. If not present then MD5 is used. This
+option can be overridden on the command line.
+
+=item B<string_mask>
+
+This option masks out the use of certain string types in certain
+fields. Most users will not need to change this option.
+
+It can be set to several values B<default> which is also the default
+option uses PrintableStrings, T61Strings and BMPStrings if the 
+B<pkix> value is used then only PrintableStrings and BMPStrings will
+be used. This follows the PKIX recommendation in RFC2459. If the
+B<utf8only> option is used then only UTF8Strings will be used: this
+is the PKIX recommendation in RFC2459 after 2003. Finally the B<nombstr>
+option just uses PrintableStrings and T61Strings: certain software has
+problems with BMPStrings and UTF8Strings: in particular Netscape.
+
+=item B<req_extensions>
+
+this specifies the configuration file section containing a list of
+extensions to add to the certificate request. It can be overridden
+by the B<-reqexts> command line switch.
+
+=item B<x509_extensions>
+
+this specifies the configuration file section containing a list of
+extensions to add to certificate generated when the B<-x509> switch
+is used. It can be overridden by the B<-extensions> command line switch.
+
+=item B<prompt>
+
+if set to the value B<no> this disables prompting of certificate fields
+and just takes values from the config file directly. It also changes the
+expected format of the B<distinguished_name> and B<attributes> sections.
+
+=item B<attributes>
+
+this specifies the section containing any request attributes: its format
+is the same as B<distinguished_name>. Typically these may contain the
+challengePassword or unstructuredName types. They are currently ignored
+by OpenSSL's request signing utilities but some CAs might want them.
+
+=item B<distinguished_name>
+
+This specifies the section containing the distinguished name fields to
+prompt for when generating a certificate or certificate request. The format
+is described in the next section.
+
+=back
+
+=head1 DISTINGUISHED NAME AND ATTRIBUTE SECTION FORMAT
+
+There are two separate formats for the distinguished name and attribute
+sections. If the B<prompt> option is set to B<no> then these sections
+just consist of field names and values: for example,
+
+ CN=My Name
+ OU=My Organization
+ emailAddress=someone@somewhere.org
+
+This allows external programs (e.g. GUI based) to generate a template file
+with all the field names and values and just pass it to B<req>. An example
+of this kind of configuration file is contained in the B<EXAMPLES> section.
+
+Alternatively if the B<prompt> option is absent or not set to B<no> then the
+file contains field prompting information. It consists of lines of the form:
+
+ fieldName="prompt"
+ fieldName_default="default field value"
+ fieldName_min= 2
+ fieldName_max= 4
+
+"fieldName" is the field name being used, for example commonName (or CN).
+The "prompt" string is used to ask the user to enter the relevant
+details. If the user enters nothing then the default value is used if no
+default value is present then the field is omitted. A field can
+still be omitted if a default value is present if the user just
+enters the '.' character.
+
+The number of characters entered must be between the fieldName_min and
+fieldName_max limits: there may be additional restrictions based
+on the field being used (for example countryName can only ever be
+two characters long and must fit in a PrintableString).
+
+Some fields (such as organizationName) can be used more than once
+in a DN. This presents a problem because configuration files will
+not recognize the same name occurring twice. To avoid this problem
+if the fieldName contains some characters followed by a full stop
+they will be ignored. So for example a second organizationName can
+be input by calling it "1.organizationName".
+
+The actual permitted field names are any object identifier short or
+long names. These are compiled into OpenSSL and include the usual
+values such as commonName, countryName, localityName, organizationName,
+organizationUnitName, stateOrPrivinceName. Additionally emailAddress
+is include as well as name, surname, givenName initials and dnQualifier.
+
+Additional object identifiers can be defined with the B<oid_file> or
+B<oid_section> options in the configuration file. Any additional fields
+will be treated as though they were a DirectoryString.
+
+
+=head1 EXAMPLES
+
+Examine and verify certificate request:
+
+ openssl req -in req.pem -text -verify -noout
+
+Create a private key and then generate a certificate request from it:
+
+ openssl genrsa -out key.pem 1024
+ openssl req -new -key key.pem -out req.pem
+
+The same but just using req:
+
+ openssl req -newkey rsa:1024 -keyout key.pem -out req.pem
+
+Generate a self signed root certificate:
+
+ openssl req -x509 -newkey rsa:1024 -keyout key.pem -out req.pem
+
+Example of a file pointed to by the B<oid_file> option:
+
+ 1.2.3.4        shortName       A longer Name
+ 1.2.3.6        otherName       Other longer Name
+
+Example of a section pointed to by B<oid_section> making use of variable
+expansion:
+
+ testoid1=1.2.3.5
+ testoid2=${testoid1}.6
+
+Sample configuration file prompting for field values:
+
+ [ req ]
+ default_bits           = 1024
+ default_keyfile        = privkey.pem
+ distinguished_name     = req_distinguished_name
+ attributes             = req_attributes
+ x509_extensions        = v3_ca
+
+ dirstring_type = nobmp
+
+ [ req_distinguished_name ]
+ countryName                    = Country Name (2 letter code)
+ countryName_default            = AU
+ countryName_min                = 2
+ countryName_max                = 2
+
+ localityName                   = Locality Name (eg, city)
+
+ organizationalUnitName         = Organizational Unit Name (eg, section)
+
+ commonName                     = Common Name (eg, YOUR name)
+ commonName_max                 = 64
+
+ emailAddress                   = Email Address
+ emailAddress_max               = 40
+
+ [ req_attributes ]
+ challengePassword              = A challenge password
+ challengePassword_min          = 4
+ challengePassword_max          = 20
+
+ [ v3_ca ]
+
+ subjectKeyIdentifier=hash
+ authorityKeyIdentifier=keyid:always,issuer:always
+ basicConstraints = CA:true
+
+Sample configuration containing all field values:
+
+
+ RANDFILE               = $ENV::HOME/.rnd
+
+ [ req ]
+ default_bits           = 1024
+ default_keyfile        = keyfile.pem
+ distinguished_name     = req_distinguished_name
+ attributes             = req_attributes
+ prompt                 = no
+ output_password        = mypass
+
+ [ req_distinguished_name ]
+ C                      = GB
+ ST                     = Test State or Province
+ L                      = Test Locality
+ O                      = Organization Name
+ OU                     = Organizational Unit Name
+ CN                     = Common Name
+ emailAddress           = test@email.address
+
+ [ req_attributes ]
+ challengePassword              = A challenge password
+
+
+=head1 NOTES
+
+The header and footer lines in the B<PEM> format are normally:
+
+ -----BEGIN CERTIFICATE REQUEST----
+ -----END CERTIFICATE REQUEST----
+
+some software (some versions of Netscape certificate server) instead needs:
+
+ -----BEGIN NEW CERTIFICATE REQUEST----
+ -----END NEW CERTIFICATE REQUEST----
+
+which is produced with the B<-newhdr> option but is otherwise compatible.
+Either form is accepted transparently on input.
+
+The certificate requests generated by B<Xenroll> with MSIE have extensions
+added. It includes the B<keyUsage> extension which determines the type of
+key (signature only or general purpose) and any additional OIDs entered
+by the script in an extendedKeyUsage extension.
+
+=head1 DIAGNOSTICS
+
+The following messages are frequently asked about:
+
+        Using configuration from /some/path/openssl.cnf
+        Unable to load config info
+
+This is followed some time later by...
+
+        unable to find 'distinguished_name' in config
+        problems making Certificate Request
+
+The first error message is the clue: it can't find the configuration
+file! Certain operations (like examining a certificate request) don't
+need a configuration file so its use isn't enforced. Generation of
+certificates or requests however does need a configuration file. This
+could be regarded as a bug.
+
+Another puzzling message is this:
+
+        Attributes:
+            a0:00
+
+this is displayed when no attributes are present and the request includes
+the correct empty B<SET OF> structure (the DER encoding of which is 0xa0
+0x00). If you just see:
+
+        Attributes:
+
+then the B<SET OF> is missing and the encoding is technically invalid (but
+it is tolerated). See the description of the command line option B<-asn1-kludge>
+for more information.
+
+=head1 ENVIRONMENT VARIABLES
+
+The variable B<OPENSSL_CONF> if defined allows an alternative configuration
+file location to be specified, it will be overridden by the B<-config> command
+line switch if it is present. For compatibility reasons the B<SSLEAY_CONF>
+environment variable serves the same purpose but its use is discouraged.
+
+=head1 BUGS
+
+OpenSSL's handling of T61Strings (aka TeletexStrings) is broken: it effectively
+treats them as ISO-8859-1 (Latin 1), Netscape and MSIE have similar behaviour.
+This can cause problems if you need characters that aren't available in
+PrintableStrings and you don't want to or can't use BMPStrings.
+
+As a consequence of the T61String handling the only correct way to represent
+accented characters in OpenSSL is to use a BMPString: unfortunately Netscape
+currently chokes on these. If you have to use accented characters with Netscape
+and MSIE then you currently need to use the invalid T61String form.
+
+The current prompting is not very friendly. It doesn't allow you to confirm what
+you've just entered. Other things like extensions in certificate requests are
+statically defined in the configuration file. Some of these: like an email
+address in subjectAltName should be input by the user.
+
+=head1 SEE ALSO
+
+L<x509(1)|x509(1)>, L<ca(1)|ca(1)>, L<genrsa(1)|genrsa(1)>,
+L<gendsa(1)|gendsa(1)>, L<config(5)|config(5)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/rsa.pod b/src/lib/libssl/src/doc/apps/rsa.pod
new file mode 100644
index 0000000000..62ad62e23d
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/rsa.pod
@@ -0,0 +1,156 @@
+
+=pod
+
+=head1 NAME
+
+rsa - RSA key processing tool
+
+=head1 SYNOPSIS
+
+B<openssl> B<rsa>
+[B<-inform PEM|NET|DER>]
+[B<-outform PEM|NET|DER>]
+[B<-in filename>]
+[B<-passin arg>]
+[B<-out filename>]
+[B<-passout arg>]
+[B<-des>]
+[B<-des3>]
+[B<-idea>]
+[B<-text>]
+[B<-noout>]
+[B<-modulus>]
+[B<-check>]
+[B<-pubin>]
+[B<-pubout>]
+
+=head1 DESCRIPTION
+
+The B<rsa> command processes RSA keys. They can be converted between various
+forms and their components printed out. B<Note> this command uses the
+traditional SSLeay compatible format for private key encryption: newer
+applications should use the more secure PKCS#8 format using the B<pkcs8>
+utility.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-inform DER|NET|PEM>
+
+This specifies the input format. The B<DER> option uses an ASN1 DER encoded
+form compatible with the PKCS#1 RSAPrivateKey or SubjectPublicKeyInfo format.
+The B<PEM> form is the default format: it consists of the B<DER> format base64
+encoded with additional header and footer lines. On input PKCS#8 format private
+keys are also accepted. The B<NET> form is a format compatible with older Netscape
+servers and MS IIS, this uses unsalted RC4 for its encryption. It is not very
+secure and so should only be used when necessary.
+
+=item B<-outform DER|NET|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read a key from or standard input if this
+option is not specified. If the key is encrypted a pass phrase will be
+prompted for.
+
+=item B<-passin arg>
+
+the input file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-out filename>
+
+This specifies the output filename to write a key to or standard output if this
+option is not specified. If any encryption options are set then a pass phrase
+will be prompted for. The output filename should B<not> be the same as the input
+filename.
+
+=item B<-passout password>
+
+the output file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-des|-des3|-idea>
+
+These options encrypt the private key with the DES, triple DES, or the 
+IDEA ciphers respectively before outputting it. A pass phrase is prompted for.
+If none of these options is specified the key is written in plain text. This
+means that using the B<rsa> utility to read in an encrypted key with no
+encryption option can be used to remove the pass phrase from a key, or by
+setting the encryption options it can be use to add or change the pass phrase.
+These options can only be used with PEM format output files.
+
+=item B<-text>
+
+prints out the various public or private key components in
+plain text in addition to the encoded version. 
+
+=item B<-noout>
+
+this option prevents output of the encoded version of the key.
+
+=item B<-modulus>
+
+this option prints out the value of the modulus of the key.
+
+=item B<-check>
+
+this option checks the consistency of an RSA private key.
+
+=item B<-pubin>
+
+by default a private key is read from the input file: with this
+option a public key is read instead.
+
+=item B<-pubout>
+
+by default a private key is output: with this option a public
+key will be output instead. This option is automatically set if
+the input is a public key.
+
+=back
+
+=head1 NOTES
+
+The PEM private key format uses the header and footer lines:
+
+ -----BEGIN RSA PRIVATE KEY-----
+ -----END RSA PRIVATE KEY-----
+
+The PEM public key format uses the header and footer lines:
+
+ -----BEGIN PUBLIC KEY-----
+ -----END PUBLIC KEY-----
+
+=head1 EXAMPLES
+
+To remove the pass phrase on an RSA private key:
+
+ openssl rsa -in key.pem -out keyout.pem
+
+To encrypt a private key using triple DES:
+
+ openssl rsa -in key.pem -des3 -out keyout.pem
+
+To convert a private key from PEM to DER format: 
+
+ openssl rsa -in key.pem -outform DER -out keyout.der
+
+To print out the components of a private key to standard output:
+
+ openssl rsa -in key.pem -text -noout
+
+To just output the public part of a private key:
+
+ openssl rsa -in key.pem -pubout -out pubkey.pem
+
+=head1 SEE ALSO
+
+L<pkcs8(1)|pkcs8(1)>, L<dsa(1)|dsa(1)>, L<genrsa(1)|genrsa(1)>,
+L<gendsa(1)|gendsa(1)> 
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/s_client.pod b/src/lib/libssl/src/doc/apps/s_client.pod
new file mode 100644
index 0000000000..3ede134164
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/s_client.pod
@@ -0,0 +1,213 @@
+
+=pod
+
+=head1 NAME
+
+s_client - SSL/TLS client program
+
+=head1 SYNOPSIS
+
+B<openssl> B<s_client>
+[B<-connect> host:port>]
+[B<-verify depth>]
+[B<-cert filename>]
+[B<-key filename>]
+[B<-CApath directory>]
+[B<-CAfile filename>]
+[B<-reconnect>]
+[B<-pause>]
+[B<-showcerts>]
+[B<-debug>]
+[B<-nbio_test>]
+[B<-state>]
+[B<-nbio>]
+[B<-crlf>]
+[B<-quiet>]
+[B<-ssl2>]
+[B<-ssl3>]
+[B<-tls1>]
+[B<-no_ssl2>]
+[B<-no_ssl3>]
+[B<-no_tls1>]
+[B<-bugs>]
+[B<-cipher cipherlist>]
+
+=head1 DESCRIPTION
+
+The B<s_client> command implements a generic SSL/TLS client which connects
+to a remote host using SSL/TLS. It is a I<very> useful diagnostic tool for
+SSL servers.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-connect host:port>
+
+This specifies the host and optional port to connect to. If not specified
+then an attempt is made to connect to the local host on port 4433.
+
+=item B<-cert certname>
+
+The certificate to use, if one is requested by the server. The default is
+not to use a certificate.
+
+=item B<-key keyfile>
+
+The private key to use. If not specified then the certificate file will
+be used.
+
+=item B<-verify depth>
+
+The verify depth to use. This specifies the maximum length of the
+server certificate chain and turns on server certificate verification.
+Currently the verify operation continues after errors so all the problems
+with a certificate chain can be seen. As a side effect the connection
+will never fail due to a server certificate verify failure.
+
+=item B<-CApath directory>
+
+The directory to use for server certificate verification. This directory
+must be in "hash format", see B<verify> for more information. These are
+also used when building the client certificate chain.
+
+=item B<-CAfile file>
+
+A file containing trusted certificates to use during server authentication
+and to use when attempting to build the client certificate chain.
+
+=item B<-reconnect>
+
+reconnects to the same server 5 times using the same session ID, this can
+be used as a test that session caching is working.
+
+=item B<-pause>
+
+pauses 1 second between each read and write call.
+
+=item B<-showcerts>
+
+display the whole server certificate chain: normally only the server
+certificate itself is displayed.
+
+=item B<-prexit>
+
+print session information when the program exits. This will always attempt
+to print out information even if the connection fails. Normally information
+will only be printed out once if the connection succeeds. This option is useful
+because the cipher in use may be renegotiated or the connection may fail
+because a client certificate is required or is requested only after an
+attempt is made to access a certain URL. Note: the output produced by this
+option is not always accurate because a connection might never have been
+established.
+
+=item B<-state>
+
+prints out the SSL session states.
+
+=item B<-debug>
+
+print extensive debugging information including a hex dump of all traffic.
+
+=item B<-nbio_test>
+
+tests non-blocking I/O
+
+=item B<-nbio>
+
+turns on non-blocking I/O
+
+=item B<-crlf>
+
+this option translated a line feed from the terminal into CR+LF as required
+by some servers.
+
+=item B<-quiet>
+
+inhibit printing of session and certificate information.
+
+=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>
+
+these options disable the use of certain SSL or TLS protocols. By default
+the initial handshake uses a method which should be compatible with all
+servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.
+
+Unfortunately there are a lot of ancient and broken servers in use which
+cannot handle this technique and will fail to connect. Some servers only
+work if TLS is turned off with the B<-no_tls> option others will only
+support SSL v2 and may need the B<-ssl2> option.
+
+=item B<-bugs>
+
+there are several known bug in SSL and TLS implementations. Adding this
+option enables various workarounds.
+
+=item B<-cipher cipherlist>
+
+this allows the cipher list sent by the client to be modified. Although
+the server determines which cipher suite is used it should take the first
+supported cipher in the list sent by the client. See the B<ciphers>
+command for more information.
+
+=back
+
+=head1 CONNECTED COMMANDS
+
+If a connection is established with an SSL server then any data received
+from the server is displayed and any key presses will be sent to the
+server. If the line begins with an B<R> then the session will be
+renegotiated. If the line begins with a B<Q> the connection will be closed
+down.
+
+=head1 NOTES
+
+B<s_client> can be used to debug SSL servers. To connect to an SSL HTTP
+server the command:
+
+ openssl s_client -connect servername:443
+
+would typically be used (https uses port 443). If the connection succeeds
+then an HTTP command can be given such as "GET /" to retrieve a web page.
+
+If the handshake fails then there are several possible causes, if it is
+nothing obvious like no client certificate then the B<-bugs>, B<-ssl2>,
+B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1> can be tried
+in case it is a buggy server. In particular you should play with these
+options B<before> submitting a bug report to an OpenSSL mailing list.
+
+A frequent problem when attempting to get client certificates working
+is that a web client complains it has no certificates or gives an empty
+list to choose from. This is normally because the server is not sending
+the clients certificate authority in its "acceptable CA list" when it
+requests a certificate. By using B<s_client> the CA list can be viewed
+and checked. However some servers only request client authentication
+after a specific URL is requested. To obtain the list in this case it
+is necessary to use the B<-prexit> command and send an HTTP request
+for an appropriate page.
+
+If a certificate is specified on the command line using the B<-cert>
+option it will not be used unless the server specifically requests
+a client certificate. Therefor merely including a client certificate
+on the command line is no guarantee that the certificate works.
+
+If there are problems verifying a server certificate then the
+B<-showcerts> option can be used to show the whole chain.
+
+=head1 BUGS
+
+Because this program has a lot of options and also because some of
+the techniques used are rather old, the C source of s_client is rather
+hard to read and not a model of how things should be done. A typical
+SSL client program would be much simpler.
+
+The B<-verify> option should really exit if the server verification
+fails.
+
+The B<-prexit> option is a bit of a hack. We should really report
+information whenever a session is renegotiated.
+
+=head1 SEE ALSO
+
+L<sess_id(1)|sess_id(1)>, L<s_server(1)|s_server(1)>, L<ciphers(1)|ciphers(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/s_server.pod b/src/lib/libssl/src/doc/apps/s_server.pod
new file mode 100644
index 0000000000..0f29c361d9
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/s_server.pod
@@ -0,0 +1,265 @@
+
+=pod
+
+=head1 NAME
+
+s_server - SSL/TLS server program
+
+=head1 SYNOPSIS
+
+B<openssl> B<s_client>
+[B<-accept port>]
+[B<-context id>]
+[B<-verify depth>]
+[B<-Verify depth>]
+[B<-cert filename>]
+[B<-key keyfile>]
+[B<-dcert filename>]
+[B<-dkey keyfile>]
+[B<-dhparam filename>]
+[B<-nbio>]
+[B<-nbio_test>]
+[B<-crlf>]
+[B<-debug>]
+[B<-state>]
+[B<-CApath directory>]
+[B<-CAfile filename>]
+[B<-nocert>]
+[B<-cipher cipherlist>]
+[B<-quiet>]
+[B<-no_tmp_rsa>]
+[B<-ssl2>]
+[B<-ssl3>]
+[B<-tls1>]
+[B<-no_ssl2>]
+[B<-no_ssl3>]
+[B<-no_tls1>]
+[B<-no_dhe>]
+[B<-bugs>]
+[B<-hack>]
+[B<-www>]
+[B<-WWW>]
+
+=head1 DESCRIPTION
+
+The B<s_server> command implements a generic SSL/TLS server which listens
+for connections on a given port using SSL/TLS.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-accept port>
+
+the TCP port to listen on for connections. If not specified 4433 is used.
+
+=item B<-context id>
+
+sets the SSL context id. It can be given any string value. If this option
+is not present a default value will be used.
+
+=item B<-cert certname>
+
+The certificate to use, most servers cipher suites require the use of a
+certificate and some require a certificate with a certain public key type:
+for example the DSS cipher suites require a certificate containing a DSS
+(DSA) key. If not specified then the filename "server.pem" will be used.
+
+=item B<-key keyfile>
+
+The private key to use. If not specified then the certificate file will
+be used.
+
+=item B<-dcert filename>, B<-dkey keyname>
+
+specify an additional certificate and private key, these behave in the
+same manner as the B<-cert> and B<-key> options except there is no default
+if they are not specified (no additional certificate and key is used). As
+noted above some cipher suites require a certificate containing a key of
+a certain type. Some cipher suites need a certificate carrying an RSA key
+and some a DSS (DSA) key. By using RSA and DSS certificates and keys
+a server can support clients which only support RSA or DSS cipher suites
+by using an appropriate certificate.
+
+=item B<-nocert>
+
+if this option is set then no certificate is used. This restricts the
+cipher suites available to the anonymous ones (currently just anonymous
+DH).
+
+=item B<-dhparam filename>
+
+the DH parameter file to use. The ephemeral DH cipher suites generate keys
+using a set of DH parameters. If not specified then an attempt is made to
+load the parameters from the server certificate file. If this fails then
+a static set of parameters hard coded into the s_server program will be used.
+
+=item B<-nodhe>
+
+if this option is set then no DH parameters will be loaded effectively
+disabling the ephemeral DH cipher suites.
+
+=item B<-no_tmp_rsa>
+
+certain export cipher suites sometimes use a temporary RSA key, this option
+disables temporary RSA key generation.
+
+=item B<-verify depth>, B<-Verify depth>
+
+The verify depth to use. This specifies the maximum length of the
+client certificate chain and makes the server request a certificate from
+the client. With the B<-verify> option a certificate is requested but the
+client does not have to send one, with the B<-Verify> option the client
+must supply a certificate or an error occurs.
+
+=item B<-CApath directory>
+
+The directory to use for client certificate verification. This directory
+must be in "hash format", see B<verify> for more information. These are
+also used when building the server certificate chain.
+
+=item B<-CAfile file>
+
+A file containing trusted certificates to use during client authentication
+and to use when attempting to build the server certificate chain. The list
+is also used in the list of acceptable client CAs passed to the client when
+a certificate is requested.
+
+=item B<-state>
+
+prints out the SSL session states.
+
+=item B<-debug>
+
+print extensive debugging information including a hex dump of all traffic.
+
+=item B<-nbio_test>
+
+tests non blocking I/O
+
+=item B<-nbio>
+
+turns on non blocking I/O
+
+=item B<-crlf>
+
+this option translated a line feed from the terminal into CR+LF.
+
+=item B<-quiet>
+
+inhibit printing of session and certificate information.
+
+=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>
+
+these options disable the use of certain SSL or TLS protocols. By default
+the initial handshake uses a method which should be compatible with all
+servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.
+
+=item B<-bugs>
+
+there are several known bug in SSL and TLS implementations. Adding this
+option enables various workarounds.
+
+=item B<-hack>
+
+this option enables a further workaround for some some early Netscape
+SSL code (?).
+
+=item B<-cipher cipherlist>
+
+this allows the cipher list used by the server to be modified.  When
+the client sends a list of supported ciphers the first client cipher
+also included in the server list is used. Because the client specifies
+the preference order, the order of the server cipherlist irrelevant. See
+the B<ciphers> command for more information.
+
+=item B<-www>
+
+sends a status message back to the client when it connects. This includes
+lots of information about the ciphers used and various session parameters.
+The output is in HTML format so this option will normally be used with a
+web browser.
+
+=item B<-WWW>
+
+emulates a simple web server. Pages will be resolved relative to the
+current directory, for example if the URL https://myhost/page.html is
+requested the file ./page.html will be loaded.
+
+=back
+
+=head1 CONNECTED COMMANDS
+
+If a connection request is established with an SSL client and neither the
+B<-www> nor the B<-WWW> option has been used then normally any data received
+from the client is displayed and any key presses will be sent to the client. 
+
+Certain single letter commands are also recognized which perform special
+operations: these are listed below.
+
+=over 4
+
+=item B<q>
+
+end the current SSL connection but still accept new connections.
+
+=item B<Q>
+
+end the current SSL connection and exit.
+
+=item B<r>
+
+renegotiate the SSL session.
+
+=item B<R>
+
+renegotiate the SSL session and request a client certificate.
+
+=item B<P>
+
+send some plain text down the underlying TCP connection: this should
+cause the client to disconnect due to a protocol violation.
+
+=item B<S>
+
+print out some session cache status information.
+
+=back
+
+=head1 NOTES
+
+B<s_server> can be used to debug SSL clients. To accept connections from
+a web browser the command:
+
+ openssl s_server -accept 443 -www
+
+can be used for example.
+
+Most web browsers (in particular Netscape and MSIE) only support RSA cipher
+suites, so they cannot connect to servers which don't use a certificate
+carrying an RSA key or a version of OpenSSL with RSA disabled.
+
+Although specifying an empty list of CAs when requesting a client certificate
+is strictly speaking a protocol violation, some SSL clients interpret this to
+mean any CA is acceptable. This is useful for debugging purposes.
+
+The session parameters can printed out using the B<sess_id> program.
+
+=head1 BUGS
+
+Because this program has a lot of options and also because some of
+the techniques used are rather old, the C source of s_server is rather
+hard to read and not a model of how things should be done. A typical
+SSL server program would be much simpler.
+
+The output of common ciphers is wrong: it just gives the list of ciphers that
+OpenSSL recognizes and the client supports.
+
+There should be a way for the B<s_server> program to print out details of any
+unknown cipher suites a client says it supports.
+
+=head1 SEE ALSO
+
+L<sess_id(1)|sess_id(1)>, L<s_client(1)|s_client(1)>, L<ciphers(1)|ciphers(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/sess_id.pod b/src/lib/libssl/src/doc/apps/sess_id.pod
new file mode 100644
index 0000000000..9988d2cd3d
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/sess_id.pod
@@ -0,0 +1,151 @@
+
+=pod
+
+=head1 NAME
+
+sess_id - SSL/TLS session handling utility
+
+=head1 SYNOPSIS
+
+B<openssl> B<sess_id>
+[B<-inform PEM|DER>]
+[B<-outform PEM|DER>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-text>]
+[B<-noout>]
+[B<-context ID>]
+
+=head1 DESCRIPTION
+
+The B<sess_id> process the encoded version of the SSL session structure
+and optionally prints out SSL session details (for example the SSL session
+master key) in human readable format. Since this is a diagnostic tool that
+needs some knowledge of the SSL protocol to use properly, most users will
+not need to use it.
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. The B<DER> option uses an ASN1 DER encoded
+format containing session details. The precise format can vary from one version
+to the next.  The B<PEM> form is the default format: it consists of the B<DER>
+format base64 encoded with additional header and footer lines.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read session information from or standard
+input by default.
+
+=item B<-out filename>
+
+This specifies the output filename to write session information to or standard
+output if this option is not specified.
+
+=item B<-text>
+
+prints out the various public or private key components in
+plain text in addition to the encoded version. 
+
+=item B<-cert>
+
+if a certificate is present in the session it will be output using this option,
+if the B<-text> option is also present then it will be printed out in text form.
+
+=item B<-noout>
+
+this option prevents output of the encoded version of the session.
+
+=item B<-context ID>
+
+this option can set the session id so the output session information uses the
+supplied ID. The ID can be any string of characters. This option wont normally
+be used.
+
+=back
+
+=head1 OUTPUT
+
+Typical output:
+
+ SSL-Session:
+     Protocol  : TLSv1
+     Cipher    : 0016
+     Session-ID: 871E62626C554CE95488823752CBD5F3673A3EF3DCE9C67BD916C809914B40ED
+     Session-ID-ctx: 01000000
+     Master-Key: A7CEFC571974BE02CAC305269DC59F76EA9F0B180CB6642697A68251F2D2BB57E51DBBB4C7885573192AE9AEE220FACD
+     Key-Arg   : None
+     Start Time: 948459261
+     Timeout   : 300 (sec)
+     Verify return code 0 (ok)
+
+Theses are described below in more detail.
+
+=over 4
+
+=item B<Protocol>
+
+this is the protocol in use TLSv1, SSLv3 or SSLv2.
+
+=item B<Cipher>
+
+the cipher used this is the actual raw SSL or TLS cipher code, see the SSL
+or TLS specifications for more information.
+
+=item B<Session-ID>
+
+the SSL session ID in hex format.
+
+=item B<Session-ID-ctx>
+
+the session ID context in hex format.
+
+=item B<Master-Key>
+
+this is the SSL session master key.
+
+=item B<Key-Arg>
+
+the key argument, this is only used in SSL v2.
+
+=item B<Start Time>
+
+this is the session start time represented as an integer in standard Unix format.
+
+=item B<Timeout>
+
+the timeout in seconds.
+
+=item B<Verify return code>
+
+this is the return code when an SSL client certificate is verified.
+
+=back
+
+=head1 NOTES
+
+The PEM encoded session format uses the header and footer lines:
+
+ -----BEGIN SSL SESSION PARAMETERS-----
+ -----END SSL SESSION PARAMETERS-----
+
+Since the SSL session output contains the master key it is possible to read the contents
+of an encrypted session using this information. Therefore appropriate security precautions
+should be taken if the information is being output by a "real" application. This is
+however strongly discouraged and should only be used for debugging purposes.
+
+=head1 BUGS
+
+The cipher and start time should be printed out in human readable form.
+
+=head1 SEE ALSO
+
+L<ciphers(1)|ciphers(1)>, L<s_server(1)|s_server(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/smime.pod b/src/lib/libssl/src/doc/apps/smime.pod
new file mode 100644
index 0000000000..631ecdc241
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/smime.pod
@@ -0,0 +1,325 @@
+=pod
+
+=head1 NAME
+
+smime - S/MIME utility
+
+=head1 SYNOPSIS
+
+B<openssl> B<smime>
+[B<-encrypt>]
+[B<-decrypt>]
+[B<-sign>]
+[B<-verify>]
+[B<-pk7out>]
+[B<-des>]
+[B<-des3>]
+[B<-rc2-40>]
+[B<-rc2-64>]
+[B<-rc2-128>]
+[B<-in file>]
+[B<-certfile file>]
+[B<-signer file>]
+[B<-recip  file>]
+[B<-in file>]
+[B<-inkey file>]
+[B<-out file>]
+[B<-to addr>]
+[B<-from ad>]
+[B<-subject s>]
+[B<-text>]
+[B<-rand file(s)>]
+[cert.pem]...
+
+=head1 DESCRIPTION
+
+The B<smime> command handles S/MIME mail. It can encrypt, decrypt, sign and
+verify S/MIME messages.
+
+=head1 COMMAND OPTIONS
+
+There are five operation options that set the type of operation to be performed.
+The meaning of the other options varies according to the operation type.
+
+=over 4
+
+=item B<-encrypt>
+
+encrypt mail for the given recipient certificates. Input file is the message
+to be encrypted. The output file is the encrypted mail in MIME format.
+
+=item B<-decrypt>
+
+decrypt mail using the supplied certificate and private key. Expects an
+encrypted mail message in MIME format for the input file. The decrypted mail
+is written to the output file.
+
+=item B<-sign>
+
+sign mail using the supplied certificate and private key. Input file is
+the message to be signed. The signed message in MIME format is written
+to the output file.
+
+=item B<-verify>
+
+verify signed mail. Expects a signed mail message on input and outputs
+the signed data. Both clear text and opaque signing is supported.
+
+=item B<-pk7out>
+
+takes an input message and writes out a PEM encoded PKCS#7 structure.
+
+=item B<-in filename>
+
+the input message to be encrypted or signed or the MIME message to
+be decrypted or verified.
+
+=item B<-out filename>
+
+the message text that has been decrypted or verified or the output MIME
+format message that has been signed or verified.
+
+=item B<-text>
+
+this option adds plain text (text/plain) MIME headers to the supplied
+message if encrypting or signing. If decrypting or verifying it strips
+off text headers: if the decrypted or verified message is not of MIME 
+type text/plain then an error occurs.
+
+=item B<-CAfile file>
+
+a file containing trusted CA certificates, only used with B<-verify>.
+
+=item B<-CApath dir>
+
+a directory containing trusted CA certificates, only used with
+B<-verify>. This directory must be a standard certificate directory: that
+is a hash of each subject name (using B<x509 -hash>) should be linked
+to each certificate.
+
+=item B<-des -des3 -rc2-40 -rc2-64 -rc2-128>
+
+the encryption algorithm to use. DES (56 bits), triple DES (168 bits)
+or 40, 64 or 128 bit RC2 respectively if not specified 40 bit RC2 is
+used. Only used with B<-encrypt>.
+
+=item B<-nointern>
+
+when verifying a message normally certificates (if any) included in
+the message are searched for the signing certificate. With this option
+only the certificates specified in the B<-certfile> option are used.
+The supplied certificates can still be used as untrusted CAs however.
+
+=item B<-noverify>
+
+do not verify the signers certificate of a signed message.
+
+=item B<-nochain>
+
+do not do chain verification of signers certificates: that is don't
+use the certificates in the signed message as untrusted CAs.
+
+=item B<-nosigs>
+
+don't try to verify the signatures on the message.
+
+=item B<-nocerts>
+
+when signing a message the signer's certificate is normally included
+with this option it is excluded. This will reduce the size of the
+signed message but the verifier must have a copy of the signers certificate
+available locally (passed using the B<-certfile> option for example).
+
+=item B<-noattr>
+
+normally when a message is signed a set of attributes are included which
+include the signing time and supported symmetric algorithms. With this
+option they are not included.
+
+=item B<-binary>
+
+normally the input message is converted to "canonical" format which is
+effectively using CR and LF as end of line: as required by the S/MIME
+specification. When this option is present no translation occurs. This
+is useful when handling binary data which may not be in MIME format.
+
+=item B<-nodetach>
+
+when signing a message use opaque signing: this form is more resistant
+to translation by mail relays but it cannot be read by mail agents that
+do not support S/MIME.  Without this option cleartext signing with
+the MIME type multipart/signed is used.
+
+=item B<-certfile file>
+
+allows additional certificates to be specified. When signing these will
+be included with the message. When verifying these will be searched for
+the signers certificates. The certificates should be in PEM format.
+
+=item B<-signer file>
+
+the signers certificate when signing a message. If a message is
+being verified then the signers certificates will be written to this
+file if the verification was successful.
+
+=item B<-recip file>
+
+the recipients certificate when decrypting a message. This certificate
+must match one of the recipients of the message or an error occurs.
+
+=item B<-inkey file>
+
+the private key to use when signing or decrypting. This must match the
+corresponding certificate. If this option is not specified then the
+private key must be included in the certificate file specified with
+the B<-recip> or B<-signer> file.
+
+=item B<-rand file(s)>
+
+a file or files containing random data used to seed the random number
+generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+Multiple files can be specified separated by a OS-dependent character.
+The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for
+all others.
+
+=item B<cert.pem...>
+
+one or more certificates of message recipients: used when encrypting
+a message. 
+
+=item B<-to, -from, -subject>
+
+the relevant mail headers. These are included outside the signed
+portion of a message so they may be included manually. If signing
+then many S/MIME mail clients check the signers certificate's email
+address matches that specified in the From: address.
+
+=back
+
+=head1 NOTES
+
+The MIME message must be sent without any blank lines between the
+headers and the output. Some mail programs will automatically add
+a blank line. Piping the mail directly to sendmail is one way to
+achieve the correct format.
+
+The supplied message to be signed or encrypted must include the
+necessary MIME headers: or many S/MIME clients wont display it
+properly (if at all). You can use the B<-text> option to automatically
+add plain text headers.
+
+A "signed and encrypted" message is one where a signed message is
+then encrypted. This can be produced by encrypting an already signed
+message: see the examples section.
+
+This version of the program only allows one signer per message but it
+will verify multiple signers on received messages. Some S/MIME clients
+choke if a message contains multiple signers. It is possible to sign
+messages "in parallel" by signing an already signed message.
+
+The options B<-encrypt> and B<-decrypt> reflect common usage in S/MIME
+clients. Strictly speaking these process PKCS#7 enveloped data: PKCS#7
+encrypted data is used for other purposes.
+
+=head1 EXIT CODES
+
+=over 4
+
+=item 0
+
+the operation was completely successfully.
+
+=item 1 
+
+an error occurred parsing the command options.
+
+=item 2
+
+one of the input files could not be read.
+
+=item 3
+
+an error occurred creating the PKCS#7 file or when reading the MIME
+message.
+
+=item 4
+
+an error occurred decrypting or verifying the message.
+
+=item 5
+
+the message was verified correctly but an error occurred writing out
+the signers certificates.
+
+=back
+
+=head1 EXAMPLES
+
+Create a cleartext signed message:
+
+ openssl smime -sign -in message.txt -text -out mail.msg \
+        -signer mycert.pem
+
+Create and opaque signed message
+
+ openssl smime -sign -in message.txt -text -out mail.msg -nodetach \
+        -signer mycert.pem
+
+Create a signed message, include some additional certificates and
+read the private key from another file:
+
+ openssl smime -sign -in in.txt -text -out mail.msg \
+        -signer mycert.pem -inkey mykey.pem -certfile mycerts.pem
+
+Send a signed message under Unix directly to sendmail, including headers:
+
+ openssl smime -sign -in in.txt -text -signer mycert.pem \
+        -from steve@openssl.org -to someone@somewhere \
+        -subject "Signed message" | sendmail someone@somewhere
+
+Verify a message and extract the signer's certificate if successful:
+
+ openssl smime -verify -in mail.msg -signer user.pem -out signedtext.txt
+
+Send encrypted mail using triple DES:
+
+ openssl smime -encrypt -in in.txt -from steve@openssl.org \
+        -to someone@somewhere -subject "Encrypted message" \
+        -des3 user.pem -out mail.msg
+
+Sign and encrypt mail:
+
+ openssl smime -sign -in ml.txt -signer my.pem -text \
+        | openssl -encrypt -out mail.msg \
+        -from steve@openssl.org -to someone@somewhere \
+        -subject "Signed and Encrypted message" -des3 user.pem
+
+Note: the encryption command does not include the B<-text> option because the message
+being encrypted already has MIME headers.
+
+Decrypt mail:
+
+ openssl smime -decrypt -in mail.msg -recip mycert.pem -inkey key.pem
+
+=head1 BUGS
+
+The MIME parser isn't very clever: it seems to handle most messages that I've thrown
+at it but it may choke on others.
+
+The code currently will only write out the signer's certificate to a file: if the
+signer has a separate encryption certificate this must be manually extracted. There
+should be some heuristic that determines the correct encryption certificate.
+
+Ideally a database should be maintained of a certificates for each email address.
+
+The code doesn't currently take note of the permitted symmetric encryption
+algorithms as supplied in the SMIMECapabilities signed attribute. this means the
+user has to manually include the correct encryption algorithm. It should store
+the list of permitted ciphers in a database and only use those.
+
+No revocation checking is done on the signer's certificate.
+
+The current code can only handle S/MIME v2 messages, the more complex S/MIME v3
+structures may cause parsing errors.
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/speed.pod b/src/lib/libssl/src/doc/apps/speed.pod
new file mode 100644
index 0000000000..fecd9a994d
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/speed.pod
@@ -0,0 +1,45 @@
+=pod
+
+=head1 NAME
+
+speed - test library performance
+
+=head1 SYNOPSIS
+
+B<openssl speed>
+[B<md2>]
+[B<mdc2>]
+[B<md5>]
+[B<hmac>]
+[B<sha1>]
+[B<rmd160>]
+[B<idea-cbc>]
+[B<rc2-cbc>]
+[B<rc5-cbc>]
+[B<bf-cbc>]
+[B<des-cbc>]
+[B<des-ede3>]
+[B<rc4>]
+[B<rsa512>]
+[B<rsa1024>]
+[B<rsa2048>]
+[B<rsa4096>]
+[B<dsa512>]
+[B<dsa1024>]
+[B<dsa2048>]
+[B<idea>]
+[B<rc2>]
+[B<des>]
+[B<rsa>]
+[B<blowfish>]
+
+=head1 DESCRIPTION
+
+This command is used to test the performance of cryptographic algorithms.
+
+=head1 OPTIONS
+
+If an option is given, B<speed> test that algorithm, otherwise all of
+the above are tested.
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/spkac.pod b/src/lib/libssl/src/doc/apps/spkac.pod
new file mode 100644
index 0000000000..bb84dfbe33
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/spkac.pod
@@ -0,0 +1,127 @@
+=pod
+
+=head1 NAME
+
+spkac - SPKAC printing and generating utility
+
+=head1 SYNOPSIS
+
+B<openssl> B<spkac>
+[B<-in filename>]
+[B<-out filename>]
+[B<-key keyfile>]
+[B<-passin arg>]
+[B<-challenge string>]
+[B<-pubkey>]
+[B<-spkac spkacname>]
+[B<-spksect section>]
+[B<-noout>]
+[B<-verify>]
+
+
+=head1 DESCRIPTION
+
+The B<spkac> command processes Netscape signed public key and challenge
+(SPKAC) files. It can print out their contents, verify the signature and
+produce its own SPKACs from a supplied private key.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-in filename>
+
+This specifies the input filename to read from or standard input if this
+option is not specified. Ignored if the B<-key> option is used.
+
+=item B<-out filename>
+
+specifies the output filename to write to or standard output by
+default.
+
+=item B<-key keyfile>
+
+create an SPKAC file using the private key in B<keyfile>. The
+B<-in>, B<-noout>, B<-spksect> and B<-verify> options are ignored if
+present.
+
+=item B<-passin password>
+
+the input file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-challenge string>
+
+specifies the challenge string if an SPKAC is being created.
+
+=item B<-spkac spkacname>
+
+allows an alternative name form the variable containing the
+SPKAC. The default is "SPKAC". This option affects both
+generated and input SPKAC files.
+
+=item B<-spksect section>
+
+allows an alternative name form the section containing the
+SPKAC. The default is the default section.
+
+=item B<-noout>
+
+don't output the text version of the SPKAC (not used if an
+SPKAC is being created).
+
+=item B<-pubkey>
+
+output the public key of an SPKAC (not used if an SPKAC is
+being created).
+
+=item B<-verify>
+
+verifies the digital signature on the supplied SPKAC.
+
+
+=back
+
+=head1 EXAMPLES
+
+Print out the contents of an SPKAC:
+
+ openssl spkac -in spkac.cnf
+
+Verify the signature of an SPKAC:
+
+ openssl spkac -in spkac.cnf -noout -verify
+
+Create an SPKAC using the challenge string "hello":
+
+ openssl spkac -key key.pem -challenge hello -out spkac.cnf
+
+Example of an SPKAC, (long lines split up for clarity):
+
+ SPKAC=MIG5MGUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA1cCoq2Wa3Ixs47uI7F\
+ PVwHVIPDx5yso105Y6zpozam135a8R0CpoRvkkigIyXfcCjiVi5oWk+6FfPaD03u\
+ PFoQIDAQABFgVoZWxsbzANBgkqhkiG9w0BAQQFAANBAFpQtY/FojdwkJh1bEIYuc\
+ 2EeM2KHTWPEepWYeawvHD0gQ3DngSC75YCWnnDdq+NQ3F+X4deMx9AaEglZtULwV\
+ 4=
+
+=head1 NOTES
+
+A created SPKAC with suitable DN components appended can be fed into
+the B<ca> utility.
+
+SPKACs are typically generated by Netscape when a form is submitted
+containing the B<KEYGEN> tag as part of the certificate enrollment
+process.
+
+The challenge string permits a primitive form of proof of possession
+of private key. By checking the SPKAC signature and a random challenge
+string some guarantee is given that the user knows the private key
+corresponding to the public key being certified. This is important in
+some applications. Without this it is possible for a previous SPKAC
+to be used in a "replay attack".
+
+=head1 SEE ALSO
+
+L<ca(1)|ca(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/verify.pod b/src/lib/libssl/src/doc/apps/verify.pod
new file mode 100644
index 0000000000..4a6572d3b8
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/verify.pod
@@ -0,0 +1,273 @@
+=pod
+
+=head1 NAME
+
+pkcs7 - PKCS#7 utility
+
+=head1 SYNOPSIS
+
+B<openssl> B<verify>
+[B<-CApath directory>]
+[B<-CAfile file>]
+[B<-purpose purpose>]
+[B<-untrusted file>]
+[B<-help>]
+[B<-verbose>]
+[B<->]
+[certificates]
+
+
+=head1 DESCRIPTION
+
+The B<verify> command verifies certificate chains.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-CApath directory>
+
+A directory of trusted certificates. The certificates should have names
+of the form: hash.0 or have symbolic links to them of this
+form ("hash" is the hashed certificate subject name: see the B<-hash> option
+of the B<x509> utility). Under Unix the B<c_rehash> script will automatically
+create symbolic links to a directory of certificates.
+
+=item B<-CAfile file>
+
+A file of trusted certificates. The file should contain multiple certificates
+in PEM format concatenated together.
+
+=item B<-untrusted file>
+
+A file of untrusted certificates. The file should contain multiple certificates
+
+=item B<-purpose purpose>
+
+the intended use for the certificate. Without this option no chain verification
+will be done. Currently accepted uses are B<sslclient>, B<sslserver>,
+B<nssslserver>, B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION>
+section for more information.
+
+=item B<-help>
+
+prints out a usage message.
+
+=item B<-verbose>
+
+print extra information about the operations being performed.
+
+=item B<->
+
+marks the last option. All arguments following this are assumed to be
+certificate files. This is useful if the first certificate filename begins
+with a B<->.
+
+=item B<certificates>
+
+one or more certificates to verify. If no certificate filenames are included
+then an attempt is made to read a certificate from standard input. They should
+all be in PEM format.
+
+
+=back
+
+=head1 VERIFY OPERATION
+
+The B<verify> program uses the same functions as the internal SSL and S/MIME
+verification, therefore this description applies to these verify operations
+too.
+
+There is one crucial difference between the verify operations performed
+by the B<verify> program: wherever possible an attempt is made to continue
+after an error whereas normally the verify operation would halt on the
+first error. This allows all the problems with a certificate chain to be
+determined.
+
+The verify operation consists of a number of separate steps.
+
+Firstly a certificate chain is built up starting from the supplied certificate
+and ending in the root CA. It is an error if the whole chain cannot be built
+up. The chain is built up by looking up a certificate whose subject name
+matches the issuer name of the current certificate. If a certificate is found
+whose subject and issuer names are identical it is assumed to be the root CA.
+The lookup first looks in the list of untrusted certificates and if no match
+is found the remaining lookups are from the trusted certificates. The root CA
+is always looked up in the trusted certificate list: if the certificate to
+verify is a root certificate then an exact match must be found in the trusted
+list.
+
+The second operation is to check every untrusted certificate's extensions for
+consistency with the supplied purpose. If the B<-purpose> option is not included
+then no checks are done. The supplied or "leaf" certificate must have extensions
+compatible with the supplied purpose and all other certificates must also be valid
+CA certificates. The precise extensions required are described in more detail in
+the B<CERTIFICATE EXTENSIONS> section of the B<x509> utility.
+
+The third operation is to check the trust settings on the root CA. The root
+CA should be trusted for the supplied purpose. For compatibility with previous
+versions of SSLeay and OpenSSL a certificate with no trust settings is considered
+to be valid for all purposes. 
+
+The final operation is to check the validity of the certificate chain. The validity
+period is checked against the current system time and the notBefore and notAfter
+dates in the certificate. The certificate signatures are also checked at this
+point.
+
+If all operations complete successfully then certificate is considered valid. If
+any operation fails then the certificate is not valid.
+
+=head1 DIAGNOSTICS
+
+When a verify operation fails the output messages can be somewhat cryptic. The
+general form of the error message is:
+
+ server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit)
+ error 24 at 1 depth lookup:invalid CA certificate
+
+The first line contains the name of the certificate being verified followed by
+the subject name of the certificate. The second line contains the error number
+and the depth. The depth is number of the certificate being verified when a
+problem was detected starting with zero for the certificate being verified itself
+then 1 for the CA that signed the certificate and so on. Finally a text version
+of the error number is presented.
+
+An exhaustive list of the error codes and messages is shown below, this also
+includes the name of the error code as defined in the header file x509_vfy.h
+Some of the error codes are defined but never returned: these are described
+as "unused".
+
+=over 4
+
+=item B<0 X509_V_OK: ok>
+
+the operation was successful.
+
+=item B<2 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: unable to get issuer certificate>
+
+the issuer certificate could not be found: this occurs if the issuer certificate
+of an untrusted certificate cannot be found.
+
+=item B<3 X509_V_ERR_UNABLE_TO_GET_CRL unable to get certificate CRL>
+
+the CRL of a certificate could not be found. Unused.
+
+=item B<4 X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: unable to decrypt certificate's signature>
+
+the certificate signature could not be decrypted. This means that the actual signature value
+could not be determined rather than it not matching the expected value, this is only
+meaningful for RSA keys.
+
+=item B<5 X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: unable to decrypt CRL's signature>
+
+the CRL signature could not be decrypted: this means that the actual signature value
+could not be determined rather than it not matching the expected value. Unused.
+
+=item B<6 X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: unable to decode issuer public key>
+
+the public key in the certificate SubjectPublicKeyInfo could not be read.
+
+=item B<7 X509_V_ERR_CERT_SIGNATURE_FAILURE: certificate signature failure>
+
+the signature of the certificate is invalid.
+
+=item B<8 X509_V_ERR_CRL_SIGNATURE_FAILURE: CRL signature failure>
+
+the signature of the certificate is invalid. Unused.
+
+=item B<9 X509_V_ERR_CERT_NOT_YET_VALID: certificate is not yet valid>
+
+the certificate is not yet valid: the notBefore date is after the current time.
+
+=item B<10 X509_V_ERR_CRL_NOT_YET_VALID: CRL is not yet valid>
+
+the CRL is not yet valid. Unused.
+
+=item B<11 X509_V_ERR_CERT_HAS_EXPIRED: Certificate has expired>
+
+the certificate has expired: that is the notAfter date is before the current time.
+
+=item B<12 X509_V_ERR_CRL_HAS_EXPIRED: CRL has expired>
+
+the CRL has expired. Unused.
+
+=item B<13 X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: format error in certificate's notBefore field>
+
+the certificate notBefore field contains an invalid time.
+
+=item B<14 X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: format error in certificate's notAfter field>
+
+the certificate notAfter field contains an invalid time.
+
+=item B<15 X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: format error in CRL's lastUpdate field>
+
+the CRL lastUpdate field contains an invalid time. Unused.
+
+=item B<16 X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: format error in CRL's nextUpdate field>
+
+the CRL nextUpdate field contains an invalid time. Unused.
+
+=item B<17 X509_V_ERR_OUT_OF_MEM: out of memory>
+
+an error occurred trying to allocate memory. This should never happen.
+
+=item B<18 X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: self signed certificate>
+
+the passed certificate is self signed and the same certificate cannot be found in the list of
+trusted certificates.
+
+=item B<19 X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in certificate chain>
+
+the certificate chain could be built up using the untrusted certificates but the root could not
+be found locally.
+
+=item B<20 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: unable to get local issuer certificate>
+
+the issuer certificate of a locally looked up certificate could not be found. This normally means
+the list of trusted certificates is not complete.
+
+=item B<21 X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: unable to verify the first certificate>
+
+no signatures could be verified because the chain contains only one certificate and it is not
+self signed.
+
+=item B<22 X509_V_ERR_CERT_CHAIN_TOO_LONG: certificate chain too long>
+
+the certificate chain length is greater than the supplied maximum depth. Unused.
+
+=item B<23 X509_V_ERR_CERT_REVOKED: certificate revoked>
+
+the certificate has been revoked. Unused.
+
+=item B<24 X509_V_ERR_INVALID_CA: invalid CA certificate>
+
+a CA certificate is invalid. Either it is not a CA or its extensions are not consistent
+with the supplied purpose.
+
+=item B<25 X509_V_ERR_PATH_LENGTH_EXCEEDED: path length constraint exceeded>
+
+the basicConstraints pathlength parameter has been exceeded.
+
+=item B<26 X509_V_ERR_INVALID_PURPOSE: unsupported certificate purpose>
+
+the supplied certificate cannot be used for the specified purpose.
+
+=item B<27 X509_V_ERR_CERT_UNTRUSTED: certificate not trusted>
+
+the root CA is not marked as trusted for the specified purpose.
+
+=item B<28 X509_V_ERR_CERT_REJECTED: certificate rejected>
+
+the root CA is marked to reject the specified purpose.
+
+=item B<50 X509_V_ERR_APPLICATION_VERIFICATION: application verification failure>
+
+an application specific error. Unused.
+
+=back
+
+=head1 SEE ALSO
+
+L<x509(1)|x509(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/version.pod b/src/lib/libssl/src/doc/apps/version.pod
new file mode 100644
index 0000000000..5d261a6405
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/version.pod
@@ -0,0 +1,56 @@
+=pod
+
+=head1 NAME
+
+version - print OpenSSL version information
+
+=head1 SYNOPSIS
+
+B<openssl version>
+[B<-a>]
+[B<-v>]
+[B<-b>]
+[B<-o>]
+[B<-f>]
+[B<-p>]
+
+=head1 DESCRIPTION
+
+This command is used to print out version information about OpenSSL.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-a>
+
+all information, this is the same as setting all the other flags.
+
+=item B<-v>
+
+the current OpenSSL version.
+
+=item B<-b>
+
+the date the current version of OpenSSL was built.
+
+=item B<-o>
+
+option information: various options set when the library was built.
+
+=item B<-c>
+
+compilation flags.
+
+=item B<-p>
+
+platform setting.
+
+=back
+
+=head1 NOTES
+
+The output of B<openssl version -a> would typically be used when sending
+in a bug report.
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/x509.pod b/src/lib/libssl/src/doc/apps/x509.pod
new file mode 100644
index 0000000000..b127182bbb
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/x509.pod
@@ -0,0 +1,543 @@
+
+=pod
+
+=head1 NAME
+
+x509 - Certificate display and signing utility
+
+=head1 SYNOPSIS
+
+B<openssl> B<x509>
+[B<-inform DER|PEM|NET>]
+[B<-outform DER|PEM|NET>]
+[B<-keyform DER|PEM>]
+[B<-CAform DER|PEM>]
+[B<-CAkeyform DER|PEM>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-serial>]
+[B<-hash>]
+[B<-subject>]
+[B<-issuer>]
+[B<-startdate>]
+[B<-enddate>]
+[B<-purpose>]
+[B<-dates>]
+[B<-modulus>]
+[B<-fingerprint>]
+[B<-alias>]
+[B<-noout>]
+[B<-trustout>]
+[B<-clrtrust>]
+[B<-clrreject>]
+[B<-addtrust arg>]
+[B<-addreject arg>]
+[B<-setalias arg>]
+[B<-days arg>]
+[B<-signkey filename>]
+[B<-x509toreq>]
+[B<-req>]
+[B<-CA filename>]
+[B<-CAkey filename>]
+[B<-CAcreateserial>]
+[B<-CAserial filename>]
+[B<-text>]
+[B<-C>]
+[B<-md2|-md5|-sha1|-mdc2>]
+[B<-clrext>]
+[B<-extfile filename>]
+[B<-extensions section>]
+
+=head1 DESCRIPTION
+
+The B<x509> command is a multi purpose certificate utility. It can be
+used to display certificate information, convert certificates to
+various forms, sign certificate requests like a "mini CA" or edit
+certificate trust settings.
+
+Since there are a large number of options they will split up into
+various sections.
+
+
+=head1 INPUT, OUTPUT AND GENERAL PURPOSE OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM|NET>
+
+This specifies the input format normally the command will expect an X509
+certificate but this can change if other options such as B<-req> are
+present. The DER format is the DER encoding of the certificate and PEM
+is the base64 encoding of the DER encoding with header and footer lines
+added. The NET option is an obscure Netscape server format that is now
+obsolete.
+
+=item B<-outform DER|PEM|NET>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read a certificate from or standard input
+if this option is not specified.
+
+=item B<-out filename>
+
+This specifies the output filename to write to or standard output by
+default.
+
+=item B<-md2|-md5|-sha1|-mdc2>
+
+the digest to use. This affects any signing or display option that uses a message
+digest, such as the B<-fingerprint>, B<-signkey> and B<-CA> options. If not
+specified then MD5 is used. If the key being used to sign with is a DSA key then
+this option has no effect: SHA1 is always used with DSA keys.
+
+
+=back
+
+=head1 DISPLAY OPTIONS
+
+Note: the B<-alias> and B<-purpose> options are also display options
+but are described in the B<TRUST OPTIONS> section.
+
+=over 4
+
+=item B<-text>
+
+prints out the certificate in text form. Full details are output including the
+public key, signature algorithms, issuer and subject names, serial number
+any extensions present and any trust settings.
+
+=item B<-noout>
+
+this option prevents output of the encoded version of the request.
+
+=item B<-modulus>
+
+this option prints out the value of the modulus of the public key
+contained in the certificate.
+
+=item B<-serial>
+
+outputs the certificate serial number.
+
+=item B<-hash>
+
+outputs the "hash" of the certificate subject name. This is used in OpenSSL to
+form an index to allow certificates in a directory to be looked up by subject
+name.
+
+=item B<-subject>
+
+outputs the subject name.
+
+=item B<-issuer>
+
+outputs the issuer name.
+
+=item B<-startdate>
+
+prints out the start date of the certificate, that is the notBefore date.
+
+=item B<-enddate>
+
+prints out the expiry date of the certificate, that is the notAfter date.
+
+=item B<-dates>
+
+prints out the start and expiry dates of a certificate.
+
+=item B<-fingerprint>
+
+prints out the digest of the DER encoded version of the whole certificate.
+
+=item B<-C>
+
+this outputs the certificate in the form of a C source file.
+
+=back
+
+=head1 TRUST SETTINGS
+
+Please note these options are currently experimental and may well change.
+
+A B<trusted certificate> is an ordinary certificate which has several
+additional pieces of information attached to it such as the permitted
+and prohibited uses of the certificate and an "alias".
+
+Normally when a certificate is being verified at least one certificate
+must be "trusted". By default a trusted certificate must be stored
+locally and must be a root CA: any certificate chain ending in this CA
+is then usable for any purpose.
+
+Trust settings currently are only used with a root CA. They allow a finer
+control over the purposes the root CA can be used for. For example a CA
+may be trusted for SSL client but not SSL server use.
+
+See the description of the B<verify> utility for more information on the
+meaning of trust settings.
+
+Future versions of OpenSSL will recognize trust settings on any
+certificate: not just root CAs.
+
+
+=over 4
+
+=item B<-trustout>
+
+this causes B<x509> to output a B<trusted> certificate. An ordinary
+or trusted certificate can be input but by default an ordinary
+certificate is output and any trust settings are discarded. With the
+B<-trustout> option a trusted certificate is output. A trusted
+certificate is automatically output if any trust settings are modified.
+
+=item B<-setalias arg>
+
+sets the alias of the certificate. This will allow the certificate
+to be referred to using a nickname for example "Steve's Certificate".
+
+=item B<-alias>
+
+outputs the certificate alias, if any.
+
+=item B<-clrtrust>
+
+clears all the permitted or trusted uses of the certificate.
+
+=item B<-clrreject>
+
+clears all the prohibited or rejected uses of the certificate.
+
+=item B<-addtrust arg>
+
+adds a trusted certificate use. Currently acceptable values
+are B<all> (any purpose), B<sslclient> (SSL client use), B<sslserver>
+(SSL server use) B<email> (S/MIME email) and B<objsign> (Object signing).
+
+=item B<-addreject arg>
+
+adds a prohibited use. It accepts the same values as the B<-addtrust>
+option.
+
+=item B<-purpose>
+
+this option performs tests on the certificate extensions and outputs
+the results. For a more complete description see the B<CERTIFICATE
+EXTENSIONS> section.
+
+=back
+
+=head1 SIGNING OPTIONS
+
+The B<x509> utility can be used to sign certificates and requests: it
+can thus behave like a "mini CA".
+
+=over 4
+
+=item B<-signkey filename>
+
+this option causes the input file to be self signed using the supplied
+private key. 
+
+If the input file is a certificate it sets the issuer name to the
+subject name (i.e.  makes it self signed) changes the public key to the
+supplied value and changes the start and end dates. The start date is
+set to the current time and the end date is set to a value determined
+by the B<-days> option. Any certificate extensions are retained unless
+the B<-clrext> option is supplied.
+
+If the input is a certificate request then a self signed certificate
+is created using the supplied private key using the subject name in
+the request.
+
+=item B<-clrext>
+
+delete any extensions from a certificate. This option is used when a
+certificate is being created from another certificate (for example with
+the B<-signkey> or the B<-CA> options). Normally all extensions are
+retained.
+
+=item B<-keyform PEM|DER>
+
+specifies the format (DER or PEM) of the private key file used in the
+B<-signkey> option.
+
+=item B<-days arg>
+
+specifies the number of days to make a certificate valid for. The default
+is 30 days.
+
+=item B<-x509toreq>
+
+converts a certificate into a certificate request. The B<-signkey> option
+is used to pass the required private key.
+
+=item B<-req>
+
+by default a certificate is expected on input. With this option a
+certificate request is expected instead.
+
+=item B<-CA filename>
+
+specifies the CA certificate to be used for signing. When this option is
+present B<x509> behaves like a "mini CA". The input file is signed by this
+CA using this option: that is its issuer name is set to the subject name
+of the CA and it is digitally signed using the CAs private key.
+
+This option is normally combined with the B<-req> option. Without the
+B<-req> option the input is a certificate which must be self signed.
+
+=item B<-CAkey filename>
+
+sets the CA private key to sign a certificate with. If this option is
+not specified then it is assumed that the CA private key is present in
+the CA certificate file.
+
+=item B<-CAserial filename>
+
+sets the CA serial number file to use.
+
+When the B<-CA> option is used to sign a certificate it uses a serial
+number specified in a file. This file consist of one line containing
+an even number of hex digits with the serial number to use. After each
+use the serial number is incremented and written out to the file again.
+
+The default filename consists of the CA certificate file base name with
+".srl" appended. For example if the CA certificate file is called 
+"mycacert.pem" it expects to find a serial number file called "mycacert.srl".
+
+=item B<-CAcreateserial filename>
+
+with this option the CA serial number file is created if it does not exist:
+it will contain the serial number "02" and the certificate being signed will
+have the 1 as its serial number. Normally if the B<-CA> option is specified
+and the serial number file does not exist it is an error.
+
+=item B<-extfile filename>
+
+file containing certificate extensions to use. If not specified then
+no extensions are added to the certificate.
+
+=item B<-extensions section>
+
+the section to add certificate extensions from. If this option is not
+specified then the extensions should either be contained in the unnamed
+(default) section or the default section should contain a variable called
+"extensions" which contains the section to use.
+
+=back
+
+=head1 EXAMPLES
+
+Note: in these examples the '\' means the example should be all on one
+line.
+
+Display the contents of a certificate:
+
+ openssl x509 -in cert.pem -noout -text
+
+Display the certificate serial number:
+
+ openssl x509 -in cert.pem -noout -serial
+
+Display the certificate MD5 fingerprint:
+
+ openssl x509 -in cert.pem -noout -fingerprint
+
+Display the certificate SHA1 fingerprint:
+
+ openssl x509 -sha1 -in cert.pem -noout -fingerprint
+
+Convert a certificate from PEM to DER format:
+
+ openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
+
+Convert a certificate to a certificate request:
+
+ openssl x509 -x509toreq -in cert.pem -out req.pem -signkey key.pem
+
+Convert a certificate request into a self signed certificate using
+extensions for a CA:
+
+ openssl x509 -req -in careq.pem -config openssl.cnf -extensions v3_ca \
+        -signkey key.pem -out cacert.pem
+
+Sign a certificate request using the CA certificate above and add user
+certificate extensions:
+
+ openssl x509 -req -in req.pem -config openssl.cnf -extensions v3_usr \
+        -CA cacert.pem -CAkey key.pem -CAcreateserial
+
+
+Set a certificate to be trusted for SSL client use and change set its alias to
+"Steve's Class 1 CA"
+
+ openssl x509 -in cert.pem -addtrust sslclient \
+        -alias "Steve's Class 1 CA" -out trust.pem
+
+=head1 NOTES
+
+The PEM format uses the header and footer lines:
+
+ -----BEGIN CERTIFICATE----
+ -----END CERTIFICATE----
+
+it will also handle files containing:
+
+ -----BEGIN X509 CERTIFICATE----
+ -----END X509 CERTIFICATE----
+
+Trusted certificates have the lines
+
+ -----BEGIN TRUSTED CERTIFICATE----
+ -----END TRUSTED CERTIFICATE----
+
+The B<-fingerprint> option takes the digest of the DER encoded certificate.
+This is commonly called a "fingerprint". Because of the nature of message
+digests the fingerprint of a certificate is unique to that certificate and
+two certificates with the same fingerprint can be considered to be the same.
+
+The Netscape fingerprint uses MD5 whereas MSIE uses SHA1.
+
+=head1 CERTIFICATE EXTENSIONS
+
+The B<-purpose> option checks the certificate extensions and determines
+what the certificate can be used for. The actual checks done are rather
+complex and include various hacks and workarounds to handle broken
+certificates and software.
+
+The same code is used when verifying untrusted certificates in chains
+so this section is useful if a chain is rejected by the verify code.
+
+The basicConstraints extension CA flag is used to determine whether the
+certificate can be used as a CA. If the CA flag is true then it is a CA,
+if the CA flag is false then it is not a CA. B<All> CAs should have the
+CA flag set to true.
+
+If the basicConstraints extension is absent then the certificate is
+considered to be a "possible CA" other extensions are checked according
+to the intended use of the certificate. A warning is given in this case
+because the certificate should really not be regarded as a CA: however
+it is allowed to be a CA to work around some broken software.
+
+If the certificate is a V1 certificate (and thus has no extensions) and
+it is self signed it is also assumed to be a CA but a warning is again
+given: this is to work around the problem of Verisign roots which are V1
+self signed certificates.
+
+If the keyUsage extension is present then additional restraints are
+made on the uses of the certificate. A CA certificate B<must> have the
+keyCertSign bit set if the keyUsage extension is present.
+
+The extended key usage extension places additional restrictions on the
+certificate uses. If this extension is present (whether critical or not)
+the key can only be used for the purposes specified.
+
+A complete description of each test is given below. The comments about
+basicConstraints and keyUsage and V1 certificates above apply to B<all>
+CA certificates.
+
+
+=over 4
+
+=item B<SSL Client>
+
+The extended key usage extension must be absent or include the "web client
+authentication" OID.  keyUsage must be absent or it must have the
+digitalSignature bit set. Netscape certificate type must be absent or it must
+have the SSL client bit set.
+
+=item B<SSL Client CA>
+
+The extended key usage extension must be absent or include the "web client
+authentication" OID. Netscape certificate type must be absent or it must have
+the SSL CA bit set: this is used as a work around if the basicConstraints
+extension is absent.
+
+=item B<SSL Server>
+
+The extended key usage extension must be absent or include the "web server
+authentication" and/or one of the SGC OIDs.  keyUsage must be absent or it
+must have the digitalSignature, the keyEncipherment set or both bits set.
+Netscape certificate type must be absent or have the SSL server bit set.
+
+=item B<SSL Server CA>
+
+The extended key usage extension must be absent or include the "web server
+authentication" and/or one of the SGC OIDs.  Netscape certificate type must
+be absent or the SSL CA bit must be set: this is used as a work around if the
+basicConstraints extension is absent.
+
+=item B<Netscape SSL Server>
+
+For Netscape SSL clients to connect to an SSL server it must have the
+keyEncipherment bit set if the keyUsage extension is present. This isn't
+always valid because some cipher suites use the key for digital signing.
+Otherwise it is the same as a normal SSL server.
+
+=item B<Common S/MIME Client Tests>
+
+The extended key usage extension must be absent or include the "email
+protection" OID. Netscape certificate type must be absent or should have the
+S/MIME bit set. If the S/MIME bit is not set in netscape certificate type
+then the SSL client bit is tolerated as an alternative but a warning is shown:
+this is because some Verisign certificates don't set the S/MIME bit.
+
+=item B<S/MIME Signing>
+
+In addition to the common S/MIME client tests the digitalSignature bit must
+be set if the keyUsage extension is present.
+
+=item B<S/MIME Encryption>
+
+In addition to the common S/MIME tests the keyEncipherment bit must be set
+if the keyUsage extension is present.
+
+=item B<S/MIME CA>
+
+The extended key usage extension must be absent or include the "email
+protection" OID. Netscape certificate type must be absent or must have the
+S/MIME CA bit set: this is used as a work around if the basicConstraints
+extension is absent. 
+
+=item B<CRL Signing>
+
+The keyUsage extension must be absent or it must have the CRL signing bit
+set.
+
+=item B<CRL Signing CA>
+
+The normal CA tests apply. Except in this case the basicConstraints extension
+must be present.
+
+=back
+
+=head1 BUGS
+
+The way DNs are printed is in a "historical SSLeay" format which doesn't
+follow any published standard. It should follow some standard like RFC2253
+or RFC1779 with options to make the stuff more readable.
+
+Extensions in certificates are not transferred to certificate requests and
+vice versa.
+
+It is possible to produce invalid certificates or requests by specifying the
+wrong private key or using inconsistent options in some cases: these should
+be checked.
+
+There should be options to explicitly set such things as start and end
+dates rather than an offset from the current time.
+
+The code to implement the verify behaviour described in the B<TRUST SETTINGS>
+is currently being developed. It thus describes the intended behavior rather
+than the current behaviour. It is hoped that it will represent reality in
+OpenSSL 0.9.5 and later.
+
+=head1 SEE ALSO
+
+L<req(1)|req(1)>, L<ca(1)|ca(1)>, L<genrsa(1)|genrsa(1)>,
+L<gendsa(1)|gendsa(1)>, L<verify(1)|verify(1)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/c-indentation.el b/src/lib/libssl/src/doc/c-indentation.el
index 9a4a0be598..9111450915 100644
--- a/src/lib/libssl/src/doc/c-indentation.el
+++ b/src/lib/libssl/src/doc/c-indentation.el
@@ -26,11 +26,20 @@
                (c-hanging-braces-alist)
                (c-offsets-alist . ((defun-open . +)
                                    (defun-block-intro . 0)
+                                   (class-open . +)
+                                   (class-close . +)
                                    (block-open . 0)
+                                   (block-close . 0)
                                    (substatement-open . +)
+                                   (statement . 0)
                                    (statement-block-intro . 0)
                                    (statement-case-open . +)
                                    (statement-case-intro . +)
                                    (case-label . -)
                                    (label . -)
-                                   (arglist-cont-nonempty . +)))))
+                                   (arglist-cont-nonempty . +)
+                                   (topmost-intro . -)
+                                   (brace-list-close . +)
+                                   (brace-list-intro . +)
+                                   ))))
+
diff --git a/src/lib/libssl/src/doc/crypto.pod b/src/lib/libssl/src/doc/crypto.pod
index 9c8a143b09..e69de29bb2 100644
--- a/src/lib/libssl/src/doc/crypto.pod
+++ b/src/lib/libssl/src/doc/crypto.pod
@@ -1,27 +0,0 @@
-
-=pod
-
-=head1 NAME
-
-Crypto - OpenSSL Cryptography library
-
-=head1 SYNOPSIS
-
-=head1 DESCRIPTION
-
-The OpenSSL B<crypto> library implements various cryptography standards
-related to the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security
-(TLS v1) protocols. It provides a rich API which is documented here.
-
-...
-
-=head1 SEE ALSO
-
-openssl(1), ssl(3)
-
-=head1 HISTORY
-
-The crypto(3) document appeared in OpenSSL 0.9.2
-
-=cut
-
diff --git a/src/lib/libssl/src/doc/crypto/BN_CTX_new.pod b/src/lib/libssl/src/doc/crypto/BN_CTX_new.pod
new file mode 100644
index 0000000000..c94d8c610d
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_CTX_new.pod
@@ -0,0 +1,53 @@
+=pod
+
+=head1 NAME
+
+BN_CTX_new, BN_CTX_init, BN_CTX_free - allocate and free BN_CTX structures
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BN_CTX *BN_CTX_new(void);
+
+ void BN_CTX_init(BN_CTX *c);
+
+ void BN_CTX_free(BN_CTX *c);
+
+=head1 DESCRIPTION
+
+A B<BN_CTX> is a structure that holds B<BIGNUM> temporary variables used by
+library functions. Since dynamic memory allocation to create B<BIGNUM>s
+is rather expensive when used in conjunction with repeated subroutine
+calls, the B<BN_CTX> structure is used.
+
+BN_CTX_new() allocates and initializes a B<BN_CTX>
+structure. BN_CTX_init() initializes an existing uninitialized
+B<BN_CTX>.
+
+BN_CTX_free() frees the components of the B<BN_CTX>, and if it was
+created by BN_CTX_new(), also the structure itself.
+If L<BN_CTX_start(3)|BN_CTX_start(3)> has been used on the B<BN_CTX>,
+L<BN_CTX_end(3)|BN_CTX_end(3)> must be called before the B<BN_CTX>
+may be freed by BN_CTX_free().
+
+
+=head1 RETURN VALUES
+
+BN_CTX_new() returns a pointer to the B<BN_CTX>. If the allocation fails,
+it returns B<NULL> and sets an error code that can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>.
+
+BN_CTX_init() and BN_CTX_free() have no return values.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<BN_add(3)|BN_add(3)>,
+L<BN_CTX_start(3)|BN_CTX_start(3)>
+
+=head1 HISTORY
+
+BN_CTX_new() and BN_CTX_free() are available in all versions on SSLeay
+and OpenSSL. BN_CTX_init() was added in SSLeay 0.9.1b.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_CTX_start.pod b/src/lib/libssl/src/doc/crypto/BN_CTX_start.pod
new file mode 100644
index 0000000000..c30552b122
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_CTX_start.pod
@@ -0,0 +1,51 @@
+=pod
+
+=head1 NAME
+
+BN_CTX_start, BN_CTX_get, BN_CTX_end - use temporary BIGNUM variables
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ void BN_CTX_start(BN_CTX *ctx);
+
+ BIGNUM *BN_CTX_get(BN_CTX *ctx);
+
+ void BN_CTX_end(BN_CTX *ctx);
+
+=head1 DESCRIPTION
+
+These functions are used to obtain temporary B<BIGNUM> variables from
+a B<BN_CTX> in order to save the overhead of repeatedly creating and
+freeing B<BIGNUM>s in functions that are called from inside a loop.
+
+A function must call BN_CTX_start() first. Then, BN_CTX_get() may be
+called repeatedly to obtain temporary B<BIGNUM>s. All BN_CTX_get()
+calls must be made before calling any other functions that use the
+B<ctx> as an argument.
+
+Finally, BN_CTX_end() must be called before returning from the function.
+When BN_CTX_end() is called, the B<BIGNUM> pointers obtained from
+BN_CTX_get() become invalid.
+
+=head1 RETURN VALUES
+
+BN_CTX_start() and BN_CTX_end() return no values.
+
+BN_CTX_get() returns a pointer to the B<BIGNUM>, or B<NULL> on error.
+Once BN_CTX_get() has failed, the subsequent calls will return B<NULL>
+as well, so it is sufficient to check the return value of the last
+BN_CTX_get() call. In case of an error, an error code is set, which
+can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+
+=head1 SEE ALSO
+
+L<BN_CTX_new(3)|BN_CTX_new(3)>
+
+=head1 HISTORY
+
+BN_CTX_start(), BN_CTX_get() and BN_CTX_end() were added in OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_add.pod b/src/lib/libssl/src/doc/crypto/BN_add.pod
new file mode 100644
index 0000000000..0541d45643
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_add.pod
@@ -0,0 +1,99 @@
+=pod
+
+=head1 NAME
+
+BN_add, BN_sub, BN_mul, BN_div, BN_sqr, BN_mod, BN_mod_mul, BN_exp,
+BN_mod_exp, BN_gcd - arithmetic operations on BIGNUMs
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
+
+ int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
+
+ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
+
+ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *a, const BIGNUM *d,
+         BN_CTX *ctx);
+
+ int BN_sqr(BIGNUM *r, BIGNUM *a, BN_CTX *ctx);
+
+ int BN_mod(BIGNUM *rem, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
+
+ int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m,
+         BN_CTX *ctx);
+
+ int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx);
+
+ int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+         const BIGNUM *m, BN_CTX *ctx);
+
+ int BN_gcd(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
+
+=head1 DESCRIPTION
+
+BN_add() adds B<a> and B<b> and places the result in B<r> (C<r=a+b>).
+B<r> may be the same B<BIGNUM> as B<a> or B<b>.
+
+BN_sub() subtracts B<b> from B<a> and places the result in B<r> (C<r=a-b>).
+
+BN_mul() multiplies B<a> and B<b> and places the result in B<r> (C<r=a*b>).
+B<r> may be the same B<BIGNUM> as B<a> or B<b>.
+For multiplication by powers of 2, use L<BN_lshift(3)|BN_lshift(3)>.
+
+BN_div() divides B<a> by B<d> and places the result in B<dv> and the
+remainder in B<rem> (C<dv=a/d, rem=a%d>). Either of B<dv> and B<rem> may
+be NULL, in which case the respective value is not returned.
+For division by powers of 2, use BN_rshift(3).
+
+BN_sqr() takes the square of B<a> and places the result in B<r>
+(C<r=a^2>). B<r> and B<a> may be the same B<BIGNUM>.
+This function is faster than BN_mul(r,a,a).
+
+BN_mod() find the remainder of B<a> divided by B<m> and places it in
+B<rem> (C<rem=a%m>).
+
+BN_mod_mul() multiplies B<a> by B<b> and finds the remainder when
+divided by B<m> (C<r=(a*b)%m>). B<r> may be the same B<BIGNUM> as B<a>
+or B<b>. For a more efficient algorithm, see
+L<BN_mod_mul_montgomery(3)|BN_mod_mul_montgomery(3)>; for repeated
+computations using the same modulus, see L<BN_mod_mul_reciprocal(3)|BN_mod_mul_reciprocal(3)>.
+
+BN_exp() raises B<a> to the B<p>-th power and places the result in B<r>
+(C<r=a^p>). This function is faster than repeated applications of
+BN_mul().
+
+BN_mod_exp() computes B<a> to the B<p>-th power modulo B<m> (C<r=a^p %
+m>). This function uses less time and space than BN_exp().
+
+BN_gcd() computes the greatest common divisor of B<a> and B<b> and
+places the result in B<r>. B<r> may be the same B<BIGNUM> as B<a> or
+B<b>.
+
+For all functions, B<ctx> is a previously allocated B<BN_CTX> used for
+temporary variables; see L<BN_CTX_new(3)|BN_CTX_new(3)>.
+
+Unless noted otherwise, the result B<BIGNUM> must be different from
+the arguments.
+
+=head1 RETURN VALUES
+
+For all functions, 1 is returned for success, 0 on error. The return
+value should always be checked (e.g., C<if (!BN_add(r,a,b)) goto err;>).
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<BN_CTX_new(3)|BN_CTX_new(3)>,
+L<BN_add_word(3)|BN_add_word(3)>, L<BN_set_bit(3)|BN_set_bit(3)>
+
+=head1 HISTORY
+
+BN_add(), BN_sub(), BN_div(), BN_sqr(), BN_mod(), BN_mod_mul(),
+BN_mod_exp() and BN_gcd() are available in all versions of SSLeay and
+OpenSSL. The B<ctx> argument to BN_mul() was added in SSLeay
+0.9.1b. BN_exp() appeared in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_add_word.pod b/src/lib/libssl/src/doc/crypto/BN_add_word.pod
new file mode 100644
index 0000000000..66bedfb924
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_add_word.pod
@@ -0,0 +1,57 @@
+=pod
+
+=head1 NAME
+
+BN_add_word, BN_sub_word, BN_mul_word, BN_div_word, BN_mod_word - arithmetic
+functions on BIGNUMs with integers
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ int BN_add_word(BIGNUM *a, BN_ULONG w);
+
+ int BN_sub_word(BIGNUM *a, BN_ULONG w);
+
+ int BN_mul_word(BIGNUM *a, BN_ULONG w);
+
+ BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w);
+
+ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w);
+
+=head1 DESCRIPTION
+
+These functions perform arithmetic operations on BIGNUMs with unsigned
+integers. They are much more efficient than the normal BIGNUM
+arithmetic operations.
+
+BN_add_word() adds B<w> to B<a> (C<a+=w>).
+
+BN_sub_word() subtracts B<w> from B<a> (C<a-=w>).
+
+BN_mul_word() multiplies B<a> and B<w> (C<a*=b>).
+
+BN_div_word() divides B<a> by B<w> (C<a/=w>) and returns the remainder.
+
+BN_mod_word() returns the remainder of B<a> divided by B<w> (C<a%m>).
+
+For BN_div_word() and BN_mod_word(), B<w> must not be 0.
+
+=head1 RETURN VALUES
+
+BN_add_word(), BN_sub_word() and BN_mul_word() return 1 for success, 0
+on error. The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+BN_mod_word() and BN_div_word() return B<a>%B<w>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<BN_add(3)|BN_add(3)>
+
+=head1 HISTORY
+
+BN_add_word() and BN_mod_word() are available in all versions of
+SSLeay and OpenSSL. BN_div_word() was added in SSLeay 0.8, and
+BN_sub_word() and BN_mul_word() in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_bn2bin.pod b/src/lib/libssl/src/doc/crypto/BN_bn2bin.pod
new file mode 100644
index 0000000000..05f9e628cc
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_bn2bin.pod
@@ -0,0 +1,95 @@
+=pod
+
+=head1 NAME
+
+BN_bn2bin, BN_bin2bn, BN_bn2hex, BN_bn2dec, BN_hex2bn, BN_dec2bn,
+BN_print, BN_print_fp, BN_bn2mpi, BN_mpi2bn - format conversions
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ int BN_bn2bin(const BIGNUM *a, unsigned char *to);
+ BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret);
+
+ char *BN_bn2hex(const BIGNUM *a);
+ char *BN_bn2dec(const BIGNUM *a);
+ int BN_hex2bn(BIGNUM **a, const char *str);
+ int BN_dec2bn(BIGNUM **a, const char *str);
+
+ int BN_print(BIO *fp, const BIGNUM *a);
+ int BN_print_fp(FILE *fp, const BIGNUM *a);
+
+ int BN_bn2mpi(const BIGNUM *a, unsigned char *to);
+ BIGNUM *BN_mpi2bn(unsigned char *s, int len, BIGNUM *ret);
+
+=head1 DESCRIPTION
+
+BN_bn2bin() converts the absolute value of B<a> into big-endian form
+and stores it at B<to>. B<to> must point to BN_num_bytes(B<a>) bytes of
+memory.
+
+BN_bin2bn() converts the positive integer in big-endian form of length
+B<len> at B<s> into a B<BIGNUM> and places it in B<ret>. If B<ret> is
+NULL, a new B<BIGNUM> is created.
+
+BN_bn2hex() and BN_bn2dec() return printable strings containing the
+hexadecimal and decimal encoding of B<a> respectively. For negative
+numbers, the string is prefaced with a leading '-'. The string must be
+Free()d later.
+
+BN_hex2bn() converts the string B<str> containing a hexadecimal number
+to a B<BIGNUM> and stores it in **B<bn>. If *B<bn> is NULL, a new
+B<BIGNUM> is created. If B<bn> is NULL, it only computes the number's
+length in hexadecimal digits. If the string starts with '-', the
+number is negative. BN_dec2bn() is the same using the decimal system.
+
+BN_print() and BN_print_fp() write the hexadecimal encoding of B<a>,
+with a leading '-' for negative numbers, to the B<BIO> or B<FILE>
+B<fp>.
+
+BN_bn2mpi() and BN_mpi2bn() convert B<BIGNUM>s from and to a format
+that consists of the number's length in bytes represented as a 3-byte
+big-endian number, and the number itself in big-endian format, where
+the most significant bit signals a negative number (the representation
+of numbers with the MSB set is prefixed with null byte).
+
+BN_bn2mpi() stores the representation of B<a> at B<to>, where B<to>
+must be large enough to hold the result. The size can be determined by
+calling BN_bn2mpi(B<a>, NULL).
+
+BN_mpi2bn() converts the B<len> bytes long representation at B<s> to
+a B<BIGNUM> and stores it at B<ret>, or in a newly allocated B<BIGNUM>
+if B<ret> is NULL.
+
+=head1 RETURN VALUES
+
+BN_bn2bin() returns the length of the big-endian number placed at B<to>.
+BN_bin2bn() returns the B<BIGNUM>, NULL on error.
+
+BN_bn2hex() and BN_bn2dec() return a null-terminated string, or NULL
+on error. BN_hex2bn() and BN_dec2bn() return the number's length in
+hexadecimal or decimal digits, and 0 on error.
+
+BN_print_fp() and BN_print() return 1 on success, 0 on write errors.
+
+BN_bn2mpi() returns the length of the representation. BN_mpi2bn()
+returns the B<BIGNUM>, and NULL on error.
+
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<BN_zero(3)|BN_zero(3)>,
+L<ASN1_INTEGER_to_BN(3)|ASN1_INTEGER_to_BN(3)>,
+L<BN_num_bytes(3)|BN_num_bytes(3)>
+
+=head1 HISTORY
+
+BN_bn2bin(), BN_bin2bn(), BN_print_fp() and BN_print() are available
+in all versions of SSLeay and OpenSSL.
+
+BN_bn2hex(), BN_bn2dec(), BN_hex2bn(), BN_dec2bn(), BN_bn2mpi() and
+BN_mpi2bn() were added in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_cmp.pod b/src/lib/libssl/src/doc/crypto/BN_cmp.pod
new file mode 100644
index 0000000000..23e9ed0b4f
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_cmp.pod
@@ -0,0 +1,48 @@
+=pod
+
+=head1 NAME
+
+BN_cmp, BN_ucmp, BN_is_zero, BN_is_one, BN_is_word, BN_is_odd - BIGNUM comparison and test functions
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ int BN_cmp(BIGNUM *a, BIGNUM *b);
+ int BN_ucmp(BIGNUM *a, BIGNUM *b);
+
+ int BN_is_zero(BIGNUM *a);
+ int BN_is_one(BIGNUM *a);
+ int BN_is_word(BIGNUM *a, BN_ULONG w);
+ int BN_is_odd(BIGNUM *a);
+
+=head1 DESCRIPTION
+
+BN_cmp() compares the numbers B<a> and B<b>. BN_ucmp() compares their
+absolute values.
+
+BN_is_zero(), BN_is_one() and BN_is_word() test if B<a> equals 0, 1,
+or B<w> respectively. BN_is_odd() tests if a is odd.
+
+BN_is_zero(), BN_is_one(), BN_is_word() and BN_is_odd() are macros.
+
+=head1 RETURN VALUES
+
+BN_cmp() returns -1 if B<a> E<lt> B<b>, 0 if B<a> == B<b> and 1 if
+B<a> E<gt> B<b>. BN_ucmp() is the same using the absolute values
+of B<a> and B<b>.
+
+BN_is_zero(), BN_is_one() BN_is_word() and BN_is_odd() return 1 if
+the condition is true, 0 otherwise.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>
+
+=head1 HISTORY
+
+BN_cmp(), BN_ucmp(), BN_is_zero(), BN_is_one() and BN_is_word() are
+available in all versions of SSLeay and OpenSSL.
+BN_is_odd() was added in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_copy.pod b/src/lib/libssl/src/doc/crypto/BN_copy.pod
new file mode 100644
index 0000000000..8ad25e7834
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_copy.pod
@@ -0,0 +1,34 @@
+=pod
+
+=head1 NAME
+
+BN_copy, BN_dup - copy BIGNUMs
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BIGNUM *BN_copy(BIGNUM *to, const BIGNUM *from);
+
+ BIGNUM *BN_dup(const BIGNUM *from);
+
+=head1 DESCRIPTION
+
+BN_copy() copies B<from> to B<to>. BN_dup() creates a new B<BIGNUM>
+containing the value B<from>.
+
+=head1 RETURN VALUES
+
+BN_copy() returns B<to> on success, NULL on error. BN_dup() returns
+the new B<BIGNUM>, and NULL on error. The error codes can be obtained
+by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>
+
+=head1 HISTORY
+
+BN_copy() and BN_dup() are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_generate_prime.pod b/src/lib/libssl/src/doc/crypto/BN_generate_prime.pod
new file mode 100644
index 0000000000..638f6514ee
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_generate_prime.pod
@@ -0,0 +1,102 @@
+=pod
+
+=head1 NAME
+
+BN_generate_prime, BN_is_prime, BN_is_prime_fasttest - generate primes and test for primality
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BIGNUM *BN_generate_prime(BIGNUM *ret, int num, int safe, BIGNUM *add,
+     BIGNUM *rem, void (*callback)(int, int, void *), void *cb_arg);
+
+ int BN_is_prime(const BIGNUM *a, int checks, void (*callback)(int, int, 
+     void *), BN_CTX *ctx, void *cb_arg);
+
+ int BN_is_prime_fasttest(const BIGNUM *a, int checks,
+     void (*callback)(int, int, void *), BN_CTX *ctx, void *cb_arg,
+     int do_trial_division);
+
+=head1 DESCRIPTION
+
+BN_generate_prime() generates a pseudo-random prime number of B<num>
+bits.
+If B<ret> is not B<NULL>, it will be used to store the number.
+
+If B<callback> is not B<NULL>, it is called as follows:
+
+=over 4
+
+=item *
+
+B<callback(0, i, cb_arg)> is called after generating the i-th
+potential prime number.
+
+=item *
+
+While the number is being tested for primality, B<callback(1, j,
+cb_arg)> is called as described below.
+
+=item *
+
+When a prime has been found, B<callback(2, i, cb_arg)> is called.
+
+=back
+
+The prime may have to fulfill additional requirements for use in
+Diffie-Hellman key exchange:
+
+If B<add> is not B<NULL>, the prime will fulfill the condition p % B<add>
+== B<rem> (p % B<add> == 1 if B<rem> == B<NULL>) in order to suit a given
+generator.
+
+If B<safe> is true, it will be a safe prime (i.e. a prime p so
+that (p-1)/2 is also prime).
+
+The PRNG must be seeded prior to calling BN_generate_prime().
+The prime number generation has a negligible error probability.
+
+BN_is_prime() and BN_is_prime_fasttest() test if the number B<a> is
+prime.  The following tests are performed until one of them shows that
+B<a> is composite; if B<a> passes all these tests, it is considered
+prime.
+
+BN_is_prime_fasttest(), when called with B<do_trial_division == 1>,
+first attempts trial division by a number of small primes;
+if no divisors are found by this test and B<callback> is not B<NULL>,
+B<callback(1, -1, cb_arg)> is called.
+If B<do_trial_division == 0>, this test is skipped.
+
+Both BN_is_prime() and BN_is_prime_fasttest() perform a Miller-Rabin
+probabilistic primality test with B<checks> iterations. If
+B<checks == BN_prime_check>, a number of iterations is used that
+yields a false positive rate of at most 2^-80 for random input.
+
+If B<callback> is not B<NULL>, B<callback(1, j, cb_arg)> is called
+after the j-th iteration (j = 0, 1, ...). B<ctx> is a
+pre-allocated B<BN_CTX> (to save the overhead of allocating and
+freeing the structure in a loop), or B<NULL>.
+
+=head1 RETURN VALUES
+
+BN_generate_prime() returns the prime number on success, B<NULL> otherwise.
+
+BN_is_prime() returns 0 if the number is composite, 1 if it is
+prime with an error probability of less than 0.25^B<checks>, and
+-1 on error.
+
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>
+
+=head1 HISTORY
+
+The B<cb_arg> arguments to BN_generate_prime() and to BN_is_prime()
+were added in SSLeay 0.9.0. The B<ret> argument to BN_generate_prime()
+was added in SSLeay 0.9.1.
+BN_is_prime_fasttest() was added in OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_mod_inverse.pod b/src/lib/libssl/src/doc/crypto/BN_mod_inverse.pod
new file mode 100644
index 0000000000..49e62daf9f
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_mod_inverse.pod
@@ -0,0 +1,36 @@
+=pod
+
+=head1 NAME
+
+BN_mod_inverse - compute inverse modulo n
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BIGNUM *BN_mod_inverse(BIGNUM *r, BIGNUM *a, const BIGNUM *n,
+           BN_CTX *ctx);
+
+=head1 DESCRIPTION
+
+BN_mod_inverse() computes the inverse of B<a> modulo B<n>
+places the result in B<r> (C<(a*r)%n==1>). If B<r> is NULL,
+a new B<BIGNUM> is created.
+
+B<ctx> is a previously allocated B<BN_CTX> used for temporary
+variables. B<r> may be the same B<BIGNUM> as B<a> or B<n>.
+
+=head1 RETURN VALUES
+
+BN_mod_inverse() returns the B<BIGNUM> containing the inverse, and
+NULL on error. The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<BN_add(3)|BN_add(3)>
+
+=head1 HISTORY
+
+BN_mod_inverse() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_mod_mul_montgomery.pod b/src/lib/libssl/src/doc/crypto/BN_mod_mul_montgomery.pod
new file mode 100644
index 0000000000..0f0c1375af
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_mod_mul_montgomery.pod
@@ -0,0 +1,95 @@
+=pod
+
+=head1 NAME
+
+BN_mod_mul_montgomery, BN_MONT_CTX_new, BN_MONT_CTX_init,
+BN_MONT_CTX_free, BN_MONT_CTX_set, BN_MONT_CTX_copy,
+BN_from_montgomery, BN_to_montgomery - Montgomery multiplication
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BN_MONT_CTX *BN_MONT_CTX_new(void);
+ void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
+ void BN_MONT_CTX_free(BN_MONT_CTX *mont);
+
+ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *m, BN_CTX *ctx);
+ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from);
+
+ int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
+         BN_MONT_CTX *mont, BN_CTX *ctx);
+
+ int BN_from_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
+         BN_CTX *ctx);
+
+ int BN_to_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
+         BN_CTX *ctx);
+
+=head1 DESCRIPTION
+
+These functions implement Montgomery multiplication. They are used
+automatically when L<BN_mod_exp(3)|BN_mod_exp(3)> is called with suitable input,
+but they may be useful when several operations are to be performed
+using the same modulus.
+
+BN_MONT_CTX_new() allocates and initializes a B<BN_MONT_CTX> structure.
+BN_MONT_CTX_init() initializes an existing uninitialized B<BN_MONT_CTX>.
+
+BN_MONT_CTX_set() sets up the B<mont> structure from the modulus B<m>
+by precomputing its inverse and a value R.
+
+BN_MONT_CTX_copy() copies the B<N_MONT_CTX> B<from> to B<to>.
+
+BN_MONT_CTX_free() frees the components of the B<BN_MONT_CTX>, and, if
+it was created by BN_MONT_CTX_new(), also the structure itself.
+
+BN_mod_mul_montgomery() computes Mont(B<a>,B<b>):=B<a>*B<b>*R^-1 and places
+the result in B<r>.
+
+BN_from_montgomery() performs the Montgomery reduction B<r> = B<a>*R^-1.
+
+BN_to_montgomery() computes Mont(B<a>,R^2).
+
+For all functions, B<ctx> is a previously allocated B<BN_CTX> used for
+temporary variables.
+
+The B<BN_MONT_CTX> structure is defined as follows:
+
+ typedef struct bn_mont_ctx_st
+        {
+        int ri;         /* number of bits in R */
+        BIGNUM RR;      /* R^2 (used to convert to Montgomery form) */
+        BIGNUM N;       /* The modulus */
+        BIGNUM Ni;      /* R*(1/R mod N) - N*Ni = 1
+                         * (Ni is only stored for bignum algorithm) */
+        BN_ULONG n0;    /* least significant word of Ni */
+        int flags;
+        } BN_MONT_CTX;
+
+BN_to_montgomery() is a macro.
+
+=head1 RETURN VALUES
+
+BN_MONT_CTX_new() returns the newly allocated B<BN_MONT_CTX>, and NULL
+on error.
+
+BN_MONT_CTX_init() and BN_MONT_CTX_free() have no return values.
+
+For the other functions, 1 is returned for success, 0 on error.
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<BN_add(3)|BN_add(3)>,
+L<BN_CTX_new(3)|BN_CTX_new(3)>
+
+=head1 HISTORY
+
+BN_MONT_CTX_new(), BN_MONT_CTX_free(), BN_MONT_CTX_set(),
+BN_mod_mul_montgomery(), BN_from_montgomery() and BN_to_montgomery()
+are available in all versions of SSLeay and OpenSSL.
+
+BN_MONT_CTX_init() and BN_MONT_CTX_copy() were added in SSLeay 0.9.1b.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_mod_mul_reciprocal.pod b/src/lib/libssl/src/doc/crypto/BN_mod_mul_reciprocal.pod
new file mode 100644
index 0000000000..32432ce4e6
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_mod_mul_reciprocal.pod
@@ -0,0 +1,81 @@
+=pod
+
+=head1 NAME
+
+BN_mod_mul_reciprocal, BN_RECP_CTX_new, BN_RECP_CTX_init,
+BN_RECP_CTX_free, BN_RECP_CTX_set - modular multiplication using
+reciprocal
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BN_RECP_CTX *BN_RECP_CTX_new(void);
+ void BN_RECP_CTX_init(BN_RECP_CTX *recp);
+ void BN_RECP_CTX_free(BN_RECP_CTX *recp);
+
+ int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *m, BN_CTX *ctx);
+
+ int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *a, BN_RECP_CTX *recp,
+        BN_CTX *ctx);
+
+ int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *a, BIGNUM *b,
+        BN_RECP_CTX *recp, BN_CTX *ctx);
+
+=head1 DESCRIPTION
+
+BN_mod_mul_reciprocal() can be used to perform an efficient
+L<BN_mod_mul(3)|BN_mod_mul(3)> operation when the operation will be performed
+repeatedly with the same modulus. It computes B<r>=(B<a>*B<b>)%B<m>
+using B<recp>=1/B<m>, which is set as described below.  B<ctx> is a
+previously allocated B<BN_CTX> used for temporary variables.
+
+BN_RECP_CTX_new() allocates and initializes a B<BN_RECP> structure.
+BN_RECP_CTX_init() initializes an existing uninitialized B<BN_RECP>.
+
+BN_RECP_CTX_free() frees the components of the B<BN_RECP>, and, if it
+was created by BN_RECP_CTX_new(), also the structure itself.
+
+BN_RECP_CTX_set() stores B<m> in B<recp> and sets it up for computing
+1/B<m> and shifting it left by BN_num_bits(B<m>)+1 to make it an
+integer. The result and the number of bits it was shifted left will
+later be stored in B<recp>.
+
+BN_div_recp() divides B<a> by B<m> using B<recp>. It places the quotient
+in B<dv> and the remainder in B<rem>.
+
+The B<BN_RECP_CTX> structure is defined as follows:
+
+ typedef struct bn_recp_ctx_st
+        {
+        BIGNUM N;       /* the divisor */
+        BIGNUM Nr;      /* the reciprocal */
+        int num_bits;
+        int shift;
+        int flags;
+        } BN_RECP_CTX;
+
+It cannot be shared between threads.
+
+=head1 RETURN VALUES
+
+BN_RECP_CTX_new() returns the newly allocated B<BN_RECP_CTX>, and NULL
+on error.
+
+BN_RECP_CTX_init() and BN_RECP_CTX_free() have no return values.
+
+For the other functions, 1 is returned for success, 0 on error.
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<BN_add(3)|BN_add(3)>,
+L<BN_CTX_new(3)|BN_CTX_new(3)>
+
+=head1 HISTORY
+
+B<BN_RECP_CTX> was added in SSLeay 0.9.0. Before that, the function
+BN_reciprocal() was used instead, and the BN_mod_mul_reciprocal()
+arguments were different.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_new.pod b/src/lib/libssl/src/doc/crypto/BN_new.pod
new file mode 100644
index 0000000000..c1394ff2a3
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_new.pod
@@ -0,0 +1,53 @@
+=pod
+
+=head1 NAME
+
+BN_new, BN_init, BN_clear, BN_free, BN_clear_free - allocate and free BIGNUMs
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BIGNUM *BN_new(void);
+
+ void BN_init(BIGNUM *);
+
+ void BN_clear(BIGNUM *a);
+
+ void BN_free(BIGNUM *a);
+
+ void BN_clear_free(BIGNUM *a);
+
+=head1 DESCRIPTION
+
+BN_new() allocated and initializes a B<BIGNUM> structure. BN_init()
+initializes an existing uninitialized B<BIGNUM>.
+
+BN_clear() is used to destroy sensitive data such as keys when they
+are no longer needed. It erases the memory used by B<a> and sets it
+to the value 0.
+
+BN_free() frees the components of the B<BIGNUM>, and if it was created
+by BN_new(), also the structure itself. BN_clear_free() additionally
+overwrites the data before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+BN_new() returns a pointer to the B<BIGNUM>. If the allocation fails,
+it returns B<NULL> and sets an error code that can be obtained
+by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+BN_init(), BN_clear(), BN_free() and BN_clear_free() have no return
+values.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>
+
+=head1 HISTORY
+
+BN_new(), BN_clear(), BN_free() and BN_clear_free() are available in
+all versions on SSLeay and OpenSSL.  BN_init() was added in SSLeay
+0.9.1b.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_num_bytes.pod b/src/lib/libssl/src/doc/crypto/BN_num_bytes.pod
new file mode 100644
index 0000000000..61589fb9ac
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_num_bytes.pod
@@ -0,0 +1,37 @@
+=pod
+
+=head1 NAME
+
+BN_num_bits, BN_num_bytes, BN_num_bits_word - get BIGNUM size
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ int BN_num_bytes(const BIGNUM *a);
+
+ int BN_num_bits(const BIGNUM *a);
+
+ int BN_num_bits_word(BN_ULONG w);
+
+=head1 DESCRIPTION
+
+These functions return the size of a B<BIGNUM> in bytes or bits,
+and the size of an unsigned integer in bits.
+
+BN_num_bytes() is a macro.
+
+=head1 RETURN VALUES
+
+The size.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>
+
+=head1 HISTORY
+
+BN_num_bytes(), BN_num_bits() and BN_num_bits_word() are available in
+all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_rand.pod b/src/lib/libssl/src/doc/crypto/BN_rand.pod
new file mode 100644
index 0000000000..33363c981f
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_rand.pod
@@ -0,0 +1,45 @@
+=pod
+
+=head1 NAME
+
+BN_rand, BN_pseudo_rand - generate pseudo-random number
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ int BN_rand(BIGNUM *rnd, int bits, int top, int bottom);
+
+ int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom);
+
+=head1 DESCRIPTION
+
+BN_rand() generates a cryptographically strong pseudo-random number of
+B<bits> bits in length and stores it in B<rnd>. If B<top> is true, the
+two most significant bits of the number will be set to 1, so that the
+product of two such random numbers will always have 2*B<bits> length.
+If B<bottom> is true, the number will be odd.
+
+BN_pseudo_rand() does the same, but pseudo-random numbers generated by
+this function are not necessarily unpredictable. They can be used for
+non-cryptographic purposes and for certain purposes in cryptographic
+protocols, but usually not for key generation etc.
+
+The PRNG must be seeded prior to calling BN_rand().
+
+=head1 RETURN VALUES
+
+BN_rand() and BN_pseudo_rand() return 1 on success, 0 on error.
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<RAND_add(3)|RAND_add(3)>, L<RAND_bytes(3)|RAND_bytes(3)>
+
+=head1 HISTORY
+
+BN_rand() is available in all versions of SSLeay and OpenSSL.
+BN_pseudo_rand() was added in OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_set_bit.pod b/src/lib/libssl/src/doc/crypto/BN_set_bit.pod
new file mode 100644
index 0000000000..b7c47b9b01
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_set_bit.pod
@@ -0,0 +1,66 @@
+=pod
+
+=head1 NAME
+
+BN_set_bit, BN_clear_bit, BN_is_bit_set, BN_mask_bits, BN_lshift,
+BN_lshift1, BN_rshift, BN_rshift1 - bit operations on BIGNUMs
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ int BN_set_bit(BIGNUM *a, int n);
+ int BN_clear_bit(BIGNUM *a, int n);
+
+ int BN_is_bit_set(const BIGNUM *a, int n);
+
+ int BN_mask_bits(BIGNUM *a, int n);
+
+ int BN_lshift(BIGNUM *r, const BIGNUM *a, int n);
+ int BN_lshift1(BIGNUM *r, BIGNUM *a);
+
+ int BN_rshift(BIGNUM *r, BIGNUM *a, int n);
+ int BN_rshift1(BIGNUM *r, BIGNUM *a);
+
+=head1 DESCRIPTION
+
+BN_set_bit() sets bit B<n> in B<a> to 1 (C<a|=(1E<lt>E<lt>n)>). The
+number is expanded if necessary.
+
+BN_clear_bit() sets bit B<n> in B<a> to 0 (C<a&=~(1E<lt>E<lt>n)>). An
+error occurs if B<a> is shorter than B<n> bits.
+
+BN_is_bit_set() tests if bit B<n> in B<a> is set.
+
+BN_mask_bits() truncates B<a> to an B<n> bit number
+(C<a&=~((~0)E<gt>E<gt>n)>).  An error occurs if B<a> already is
+shorter than B<n> bits.
+
+BN_lshift() shifts B<a> left by B<n> bits and places the result in
+B<r> (C<r=a*2^n>). BN_lshift1() shifts B<a> left by one and places
+the result in B<r> (C<r=2*a>).
+
+BN_rshift() shifts B<a> right by B<n> bits and places the result in
+B<r> (C<r=a/2^n>). BN_rshift1() shifts B<a> right by one and places
+the result in B<r> (C<r=a/2>).
+
+For the shift functions, B<r> and B<a> may be the same variable.
+
+=head1 RETURN VALUES
+
+BN_is_bit_set() returns 1 if the bit is set, 0 otherwise.
+
+All other functions return 1 for success, 0 on error. The error codes
+can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<BN_num_bytes(3)|BN_num_bytes(3)>, L<BN_add(3)|BN_add(3)>
+
+=head1 HISTORY
+
+BN_set_bit(), BN_clear_bit(), BN_is_bit_set(), BN_mask_bits(),
+BN_lshift(), BN_lshift1(), BN_rshift(), and BN_rshift1() are available
+in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_zero.pod b/src/lib/libssl/src/doc/crypto/BN_zero.pod
new file mode 100644
index 0000000000..165fd9a228
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_zero.pod
@@ -0,0 +1,55 @@
+=pod
+
+=head1 NAME
+
+BN_zero, BN_one, BN_set_word, BN_get_word - BIGNUM assignment operations
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ int BN_zero(BIGNUM *a);
+ int BN_one(BIGNUM *a);
+
+ BIGNUM *BN_value_one(void);
+
+ int BN_set_word(BIGNUM *a, unsigned long w);
+ unsigned long BN_get_word(BIGNUM *a);
+
+=head1 DESCRIPTION
+
+BN_zero(), BN_one() and BN_set_word() set B<a> to the values 0, 1 and
+B<w> respectively.  BN_zero() and BN_one() are macros.
+
+BN_value_one() returns a B<BIGNUM> constant of value 1. This constant
+is useful for use in comparisons and assignment.
+
+BN_get_word() returns B<a>, if it can be represented as an unsigned
+long.
+
+=head1 RETURN VALUES
+
+BN_get_word() returns the value B<a>, and 0xffffffffL if B<a> cannot
+be represented as an unsigned long.
+
+BN_zero(), BN_one() and BN_set_word() return 1 on success, 0 otherwise.
+BN_value_one() returns the constant.
+
+=head1 BUGS
+
+Someone might change the constant.
+
+If a B<BIGNUM> is equal to 0xffffffffL it can be represented as an
+unsigned long but this value is also returned on error.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<BN_bn2bin(3)|BN_bn2bin(3)>
+
+=head1 HISTORY
+
+BN_zero(), BN_one() and BN_set_word() are available in all versions of
+SSLeay and OpenSSL. BN_value_one() and BN_get_word() were added in
+SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/CRYPTO_set_ex_data.pod b/src/lib/libssl/src/doc/crypto/CRYPTO_set_ex_data.pod
new file mode 100644
index 0000000000..1bd5bed67d
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/CRYPTO_set_ex_data.pod
@@ -0,0 +1,51 @@
+=pod
+
+=head1 NAME
+
+CRYPTO_set_ex_data, CRYPTO_get_ex_data - internal application specific data functions
+
+=head1 SYNOPSIS
+
+ int CRYPTO_set_ex_data(CRYPTO_EX_DATA *r, int idx, void *arg);
+
+ void *CRYPTO_get_ex_data(CRYPTO_EX_DATA *r, int idx);
+
+=head1 DESCRIPTION
+
+Several OpenSSL structures can have application specific data attached to them.
+These functions are used internally by OpenSSL to manipulate application
+specific data attached to a specific structure.
+
+These functions should only be used by applications to manipulate
+B<CRYPTO_EX_DATA> structures passed to the B<new_func()>, B<free_func()> and
+B<dup_func()> callbacks: as passed to B<RSA_get_ex_new_index()> for example.
+
+B<CRYPTO_set_ex_data()> is used to set application specific data, the data is
+supplied in the B<arg> parameter and its precise meaning is up to the
+application.
+
+B<CRYPTO_get_ex_data()> is used to retrieve application specific data. The data
+is returned to the application, this will be the same value as supplied to
+a previous B<CRYPTO_set_ex_data()> call.
+
+=head1 RETURN VALUES
+
+B<CRYPTO_set_ex_data()> returns 1 on success or 0 on failure.
+
+B<CRYPTO_get_ex_data()> returns the application data or 0 on failure. 0 may also
+be valid application data but currently it can only fail if given an invalid B<idx>
+parameter.
+
+On failure an error code can be obtained from L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>,
+L<DSA_get_ex_new_index(3)|DSA_get_ex_new_index(3)>,
+L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>
+
+=head1 HISTORY
+
+CRYPTO_set_ex_data() and CRYPTO_get_ex_data() have been available since SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DH_generate_key.pod b/src/lib/libssl/src/doc/crypto/DH_generate_key.pod
new file mode 100644
index 0000000000..920995b2e5
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DH_generate_key.pod
@@ -0,0 +1,50 @@
+=pod
+
+=head1 NAME
+
+DH_generate_key, DH_compute_key - perform Diffie-Hellman key exchange
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ int DH_generate_key(DH *dh);
+
+ int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh);
+
+=head1 DESCRIPTION
+
+DH_generate_key() performs the first step of a Diffie-Hellman key
+exchange by generating private and public DH values. By calling
+DH_compute_key(), these are combined with the other party's public
+value to compute the shared key.
+
+DH_generate_key() expects B<dh> to contain the shared parameters
+B<dh-E<gt>p> and B<dh-E<gt>g>. It generates a random private DH value
+unless B<dh-E<gt>priv_key> is already set, and computes the
+corresponding public value B<dh-E<gt>pub_key>, which can then be
+published.
+
+DH_compute_key() computes the shared secret from the private DH value
+in B<dh> and the other party's public value in B<pub_key> and stores
+it in B<key>. B<key> must point to B<DH_size(dh)> bytes of memory.
+
+=head1 RETURN VALUES
+
+DH_generate_key() returns 1 on success, 0 otherwise.
+
+DH_compute_key() returns the size of the shared secret on success, -1
+on error.
+
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<DH_size(3)|DH_size(3)>
+
+=head1 HISTORY
+
+DH_generate_key() and DH_compute_key() are available in all versions
+of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DH_generate_parameters.pod b/src/lib/libssl/src/doc/crypto/DH_generate_parameters.pod
new file mode 100644
index 0000000000..a7d0c75f0c
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DH_generate_parameters.pod
@@ -0,0 +1,72 @@
+=pod
+
+=head1 NAME
+
+DH_generate_parameters, DH_check - generate and check Diffie-Hellman parameters
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ DH *DH_generate_parameters(int prime_len, int generator,
+     void (*callback)(int, int, void *), void *cb_arg);
+
+ int DH_check(DH *dh, int *codes);
+
+=head1 DESCRIPTION
+
+DH_generate_parameters() generates Diffie-Hellman parameters that can
+be shared among a group of users, and returns them in a newly
+allocated B<DH> structure. The pseudo-random number generator must be
+seeded prior to calling DH_generate_parameters().
+
+B<prime_len> is the length in bits of the safe prime to be generated.
+B<generator> is a small number E<gt> 1, typically 2 or 5. 
+
+A callback function may be used to provide feedback about the progress
+of the key generation. If B<callback> is not B<NULL>, it will be
+called as described in L<BN_generate_prime(3)|BN_generate_prime(3)> while a random prime
+number is generated, and when a prime has been found, B<callback(3,
+0, cb_arg)> is called.
+
+DH_check() validates Diffie-Hellman parameters. It checks that B<p> is
+a safe prime, and that B<g> is a suitable generator. In the case of an
+error, the bit flags DH_CHECK_P_NOT_SAFE_PRIME or
+DH_NOT_SUITABLE_GENERATOR are set in B<*codes>.
+DH_UNABLE_TO_CHECK_GENERATOR is set if the generator cannot be
+checked, i.e. it does not equal 2 or 5.
+
+=head1 RETURN VALUES
+
+DH_generate_parameters() returns a pointer to the DH structure, or
+NULL if the parameter generation fails. The error codes can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+DH_check() returns 1 if the check could be performed, 0 otherwise.
+
+=head1 NOTES
+
+DH_generate_parameters() may run for several hours before finding a
+suitable prime.
+
+The parameters generated by DH_generate_parameters() are not to be
+used in signature schemes.
+
+=head1 BUGS
+
+If B<generator> is not 2 or 5, B<dh-E<gt>g>=B<generator> is not
+a usable generator.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<DH_free(3)|DH_free(3)>
+
+=head1 HISTORY
+
+DH_check() is available in all versions of SSLeay and OpenSSL.
+The B<cb_arg> argument to DH_generate_parameters() was added in SSLeay 0.9.0.
+
+In versions before OpenSSL 0.9.5, DH_CHECK_P_NOT_STRONG_PRIME is used
+instead of DH_CHECK_P_NOT_SAFE_PRIME.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DH_get_ex_new_index.pod b/src/lib/libssl/src/doc/crypto/DH_get_ex_new_index.pod
new file mode 100644
index 0000000000..82e2548bcd
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DH_get_ex_new_index.pod
@@ -0,0 +1,36 @@
+=pod
+
+=head1 NAME
+
+DH_get_ex_new_index, DH_set_ex_data, DH_get_ex_data - add application specific data to DH structures
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ int DH_get_ex_new_index(long argl, void *argp,
+                CRYPTO_EX_new *new_func,
+                CRYPTO_EX_dup *dup_func,
+                CRYPTO_EX_free *free_func);
+
+ int DH_set_ex_data(DH *d, int idx, void *arg);
+
+ char *DH_get_ex_data(DH *d, int idx);
+
+=head1 DESCRIPTION
+
+These functions handle application specific data in DH
+structures. Their usage is identical to that of
+RSA_get_ex_new_index(), RSA_set_ex_data() and RSA_get_ex_data()
+as described in L<RSA_get_ex_new_index(3)>.
+
+=head1 SEE ALSO
+
+L<RSA_get_ex_new_index()|RSA_get_ex_new_index()>, L<dh(3)|dh(3)>
+
+=head1 HISTORY
+
+DH_get_ex_new_index(), DH_set_ex_data() and DH_get_ex_data() are
+available since OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DH_new.pod b/src/lib/libssl/src/doc/crypto/DH_new.pod
new file mode 100644
index 0000000000..64624b9d15
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DH_new.pod
@@ -0,0 +1,40 @@
+=pod
+
+=head1 NAME
+
+DH_new, DH_free - allocate and free DH objects
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ DH* DH_new(void);
+
+ void DH_free(DH *dh);
+
+=head1 DESCRIPTION
+
+DH_new() allocates and initializes a B<DH> structure.
+
+DH_free() frees the B<DH> structure and its components. The values are
+erased before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+If the allocation fails, DH_new() returns B<NULL> and sets an error
+code that can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>. Otherwise it returns
+a pointer to the newly allocated structure.
+
+DH_free() returns no value.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<err(3)|err(3)>,
+L<DH_generate_parameters(3)|DH_generate_parameters(3)>,
+L<DH_generate_key(3)|DH_generate_key(3)>
+
+=head1 HISTORY
+
+DH_new() and DH_free() are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DH_set_method.pod b/src/lib/libssl/src/doc/crypto/DH_set_method.pod
new file mode 100644
index 0000000000..dca41d8dbc
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DH_set_method.pod
@@ -0,0 +1,99 @@
+=pod
+
+=head1 NAME
+
+DH_set_default_method, DH_get_default_method, DH_set_method,
+DH_new_method, DH_OpenSSL - select DH method
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ void DH_set_default_method(DH_METHOD *meth);
+
+ DH_METHOD *DH_get_default_method(void);
+
+ DH_METHOD *DH_set_method(DH *dh, DH_METHOD *meth);
+
+ DH *DH_new_method(DH_METHOD *meth);
+
+ DH_METHOD *DH_OpenSSL(void);
+
+=head1 DESCRIPTION
+
+A B<DH_METHOD> specifies the functions that OpenSSL uses for Diffie-Hellman
+operations. By modifying the method, alternative implementations
+such as hardware accelerators may be used.
+
+Initially, the default is to use the OpenSSL internal implementation.
+DH_OpenSSL() returns a pointer to that method.
+
+DH_set_default_method() makes B<meth> the default method for all B<DH>
+structures created later.
+
+DH_get_default_method() returns a pointer to the current default
+method.
+
+DH_set_method() selects B<meth> for all operations using the structure B<dh>.
+
+DH_get_method() returns a pointer to the method currently selected
+for B<dh>.
+
+DH_new_method() allocates and initializes a B<DH> structure so that
+B<method> will be used for the DH operations. If B<method> is B<NULL>,
+the default method is used.
+
+=head1 THE DH_METHOD STRUCTURE
+
+ typedef struct dh_meth_st
+ {
+     /* name of the implementation */
+        const char *name;
+
+     /* generate private and public DH values for key agreement */
+        int (*generate_key)(DH *dh);
+
+     /* compute shared secret */
+        int (*compute_key)(unsigned char *key, BIGNUM *pub_key, DH *dh);
+
+     /* compute r = a ^ p mod m. May be NULL */
+        int (*bn_mod_exp)(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                                const BIGNUM *m, BN_CTX *ctx,
+                                BN_MONT_CTX *m_ctx);
+
+     /* called at DH_new */
+        int (*init)(DH *dh);
+
+     /* called at DH_free */
+        int (*finish)(DH *dh);
+
+        int flags;
+
+        char *app_data; /* ?? */
+
+ } DH_METHOD;
+
+=head1 RETURN VALUES
+
+DH_OpenSSL(), DH_get_default_method() and DH_get_method() return
+pointers to the respective B<DH_METHOD>s.
+
+DH_set_default_method() returns no value.
+
+DH_set_method() returns a pointer to the B<DH_METHOD> previously
+associated with B<dh>.
+
+DH_new_method() returns B<NULL> and sets an error code that can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise it
+returns a pointer to the newly allocated structure.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<DH_new(3)|DH_new(3)>
+
+=head1 HISTORY
+
+DH_set_default_method(), DH_get_default_method(), DH_set_method(),
+DH_new_method() and DH_OpenSSL() were added in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DH_size.pod b/src/lib/libssl/src/doc/crypto/DH_size.pod
new file mode 100644
index 0000000000..97f26fda78
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DH_size.pod
@@ -0,0 +1,33 @@
+=pod
+
+=head1 NAME
+
+DH_size - get Diffie-Hellman prime size
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ int DH_size(DH *dh);
+
+=head1 DESCRIPTION
+
+This function returns the Diffie-Hellman size in bytes. It can be used
+to determine how much memory must be allocated for the shared secret
+computed by DH_compute_key().
+
+B<dh-E<gt>p> must not be B<NULL>.
+
+=head1 RETURN VALUE
+
+The size in bytes.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<DH_generate_key(3)|DH_generate_key(3)>
+
+=head1 HISTORY
+
+DH_size() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_SIG_new.pod b/src/lib/libssl/src/doc/crypto/DSA_SIG_new.pod
new file mode 100644
index 0000000000..671655554a
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_SIG_new.pod
@@ -0,0 +1,39 @@
+=pod
+
+=head1 NAME
+
+DSA_SIG_new, DSA_SIG_free - allocate and free DSA signature objects
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA_SIG *DSA_SIG_new(void);
+
+ void   DSA_SIG_free(DSA_SIG *a);
+
+=head1 DESCRIPTION
+
+DSA_SIG_new() allocates and initializes a B<DSA_SIG> structure.
+
+DSA_SIG_free() frees the B<DSA_SIG> structure and its components. The
+values are erased before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+If the allocation fails, DSA_SIG_new() returns B<NULL> and sets an
+error code that can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>. Otherwise it returns a pointer
+to the newly allocated structure.
+
+DSA_SIG_free() returns no value.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<DSA_do_sign(3)|DSA_do_sign(3)>
+
+=head1 HISTORY
+
+DSA_SIG_new() and DSA_SIG_free() were added in OpenSSL 0.9.3.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_do_sign.pod b/src/lib/libssl/src/doc/crypto/DSA_do_sign.pod
new file mode 100644
index 0000000000..a24fd5714e
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_do_sign.pod
@@ -0,0 +1,47 @@
+=pod
+
+=head1 NAME
+
+DSA_do_sign, DSA_do_verify - raw DSA signature operations
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA_SIG *DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+
+ int DSA_do_verify(const unsigned char *dgst, int dgst_len,
+             DSA_SIG *sig, DSA *dsa);
+
+=head1 DESCRIPTION
+
+DSA_do_sign() computes a digital signature on the B<len> byte message
+digest B<dgst> using the private key B<dsa> and returns it in a
+newly allocated B<DSA_SIG> structure.
+
+L<DSA_sign_setup(3)|DSA_sign_setup(3)> may be used to precompute part
+of the signing operation in case signature generation is
+time-critical.
+
+DSA_do_verify() verifies that the signature B<sig> matches a given
+message digest B<dgst> of size B<len>.  B<dsa> is the signer's public
+key.
+
+=head1 RETURN VALUES
+
+DSA_do_sign() returns the signature, NULL on error.  DSA_do_verify()
+returns 1 for a valid signature, 0 for an incorrect signature and -1
+on error. The error codes can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<DSA_SIG_new(3)|DSA_SIG_new(3)>,
+L<DSA_sign(3)|DSA_sign(3)>
+
+=head1 HISTORY
+
+DSA_do_sign() and DSA_do_verify() were added in OpenSSL 0.9.3.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_dup_DH.pod b/src/lib/libssl/src/doc/crypto/DSA_dup_DH.pod
new file mode 100644
index 0000000000..29cb1075d1
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_dup_DH.pod
@@ -0,0 +1,36 @@
+=pod
+
+=head1 NAME
+
+DSA_dup_DH - create a DH structure out of DSA structure
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DH * DSA_dup_DH(DSA *r);
+
+=head1 DESCRIPTION
+
+DSA_dup_DH() duplicates DSA parameters/keys as DH parameters/keys. q
+is lost during that conversion, but the resulting DH parameters
+contain its length.
+
+=head1 RETURN VALUE
+
+DSA_dup_DH() returns the new B<DH> structure, and NULL on error. The
+error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 NOTE
+
+Be careful to avoid small subgroup attacks when using this.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<dsa(3)|dsa(3)>, L<err(3)|err(3)>
+
+=head1 HISTORY
+
+DSA_dup_DH() was added in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_generate_key.pod b/src/lib/libssl/src/doc/crypto/DSA_generate_key.pod
new file mode 100644
index 0000000000..52890db5be
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_generate_key.pod
@@ -0,0 +1,33 @@
+=pod
+
+=head1 NAME
+
+DSA_generate_key - generate DSA key pair
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ int DSA_generate_key(DSA *a);
+
+=head1 DESCRIPTION
+
+DSA_generate_key() expects B<a> to contain DSA parameters. It generates
+a new key pair and stores it in B<a-E<gt>pub_key> and B<a-E<gt>priv_key>.
+
+The PRNG must be seeded prior to calling DSA_generate_key().
+
+=head1 RETURN VALUE
+
+DSA_generate_key() returns 1 on success, 0 otherwise.
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>
+
+=head1 HISTORY
+
+DSA_generate_key() is available since SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_generate_parameters.pod b/src/lib/libssl/src/doc/crypto/DSA_generate_parameters.pod
new file mode 100644
index 0000000000..43f60b0eb9
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_generate_parameters.pod
@@ -0,0 +1,105 @@
+=pod
+
+=head1 NAME
+
+DSA_generate_parameters - generate DSA parameters
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA *DSA_generate_parameters(int bits, unsigned char *seed,
+                int seed_len, int *counter_ret, unsigned long *h_ret,
+                void (*callback)(int, int, void *), void *cb_arg);
+
+=head1 DESCRIPTION
+
+DSA_generate_parameters() generates primes p and q and a generator g
+for use in the DSA.
+
+B<bits> is the length of the prime to be generated; the DSS allows a
+maximum of 1024 bits.
+
+If B<seed> is B<NULL> or B<seed_len> E<lt> 20, the primes will be
+generated at random. Otherwise, the seed is used to generate
+them. If the given seed does not yield a prime q, a new random
+seed is chosen and placed at B<seed>.
+
+DSA_generate_parameters() places the iteration count in
+*B<counter_ret> and a counter used for finding a generator in
+*B<h_ret>, unless these are B<NULL>.
+
+A callback function may be used to provide feedback about the progress
+of the key generation. If B<callback> is not B<NULL>, it will be
+called as follows:
+
+=over 4
+
+=item *
+
+When a candidate for q is generated, B<callback(0, m++, cb_arg)> is called
+(m is 0 for the first candidate).
+
+=item *
+
+When a candidate for q has passed a test by trial division,
+B<callback(1, -1, cb_arg)> is called.
+While a candidate for q is tested by Miller-Rabin primality tests,
+B<callback(1, i, cb_arg)> is called in the outer loop
+(once for each witness that confirms that the candidate may be prime);
+i is the loop counter (starting at 0).
+
+=item *
+
+When a prime q has been found, B<callback(2, 0, cb_arg)> and
+B<callback(3, 0, cb_arg)> are called.
+
+=item *
+
+Before a candidate for p (other than the first) is generated and tested,
+B<callback(0, counter, cb_arg)> is called.
+
+=item *
+
+When a candidate for p has passed the test by trial division,
+B<callback(1, -1, cb_arg)> is called.
+While it is tested by the Miller-Rabin primality test,
+B<callback(1, i, cb_arg)> is called in the outer loop
+(once for each witness that confirms that the candidate may be prime).
+i is the loop counter (starting at 0).
+
+=item *
+
+When p has been found, B<callback(2, 1, cb_arg)> is called.
+
+=item *
+
+When the generator has been found, B<callback(3, 1, cb_arg)> is called.
+
+=back
+
+=head1 RETURN VALUE
+
+DSA_generate_parameters() returns a pointer to the DSA structure, or
+B<NULL> if the parameter generation fails. The error codes can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+Seed lengths E<gt> 20 are not supported.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<DSA_free(3)|DSA_free(3)>
+
+=head1 HISTORY
+
+DSA_generate_parameters() appeared in SSLeay 0.8. The B<cb_arg>
+argument was added in SSLeay 0.9.0.
+In versions up to OpenSSL 0.9.4, B<callback(1, ...)> was called
+in the inner loop of the Miller-Rabin test whenever it reached the
+squaring step (the parameters to B<callback> did not reveal how many
+witnesses had been tested); since OpenSSL 0.9.5, B<callback(1, ...)>
+is called as in BN_is_prime(3), i.e. once for each witness.
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_get_ex_new_index.pod b/src/lib/libssl/src/doc/crypto/DSA_get_ex_new_index.pod
new file mode 100644
index 0000000000..4612e708ec
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_get_ex_new_index.pod
@@ -0,0 +1,36 @@
+=pod
+
+=head1 NAME
+
+DSA_get_ex_new_index, DSA_set_ex_data, DSA_get_ex_data - add application specific data to DSA structures
+
+=head1 SYNOPSIS
+
+ #include <openssl/DSA.h>
+
+ int DSA_get_ex_new_index(long argl, void *argp,
+                CRYPTO_EX_new *new_func,
+                CRYPTO_EX_dup *dup_func,
+                CRYPTO_EX_free *free_func);
+
+ int DSA_set_ex_data(DSA *d, int idx, void *arg);
+
+ char *DSA_get_ex_data(DSA *d, int idx);
+
+=head1 DESCRIPTION
+
+These functions handle application specific data in DSA
+structures. Their usage is identical to that of
+RSA_get_ex_new_index(), RSA_set_ex_data() and RSA_get_ex_data()
+as described in L<RSA_get_ex_new_index(3)>.
+
+=head1 SEE ALSO
+
+L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>, L<dsa(3)|dsa(3)>
+
+=head1 HISTORY
+
+DSA_get_ex_new_index(), DSA_set_ex_data() and DSA_get_ex_data() are
+available since OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_new.pod b/src/lib/libssl/src/doc/crypto/DSA_new.pod
new file mode 100644
index 0000000000..7dde54445b
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_new.pod
@@ -0,0 +1,41 @@
+=pod
+
+=head1 NAME
+
+DSA_new, DSA_free - allocate and free DSA objects
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA* DSA_new(void);
+
+ void DSA_free(DSA *dsa);
+
+=head1 DESCRIPTION
+
+DSA_new() allocates and initializes a B<DSA> structure.
+
+DSA_free() frees the B<DSA> structure and its components. The values are
+erased before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+If the allocation fails, DSA_new() returns B<NULL> and sets an error
+code that can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>. Otherwise it returns a pointer
+to the newly allocated structure.
+
+DSA_free() returns no value.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>,
+L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>,
+L<DSA_generate_key(3)|DSA_generate_key(3)>
+
+=head1 HISTORY
+
+DSA_new() and DSA_free() are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_set_method.pod b/src/lib/libssl/src/doc/crypto/DSA_set_method.pod
new file mode 100644
index 0000000000..0b13ec9237
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_set_method.pod
@@ -0,0 +1,111 @@
+=pod
+
+=head1 NAME
+
+DSA_set_default_method, DSA_get_default_method, DSA_set_method,
+DSA_new_method, DSA_OpenSSL - select RSA method
+
+=head1 SYNOPSIS
+
+ #include <openssl/DSA.h>
+
+ void DSA_set_default_method(DSA_METHOD *meth);
+
+ DSA_METHOD *DSA_get_default_method(void);
+
+ DSA_METHOD *DSA_set_method(DSA *dsa, DSA_METHOD *meth);
+
+ DSA *DSA_new_method(DSA_METHOD *meth);
+
+ DSA_METHOD *DSA_OpenSSL(void);
+
+=head1 DESCRIPTION
+
+A B<DSA_METHOD> specifies the functions that OpenSSL uses for DSA
+operations. By modifying the method, alternative implementations
+such as hardware accelerators may be used.
+
+Initially, the default is to use the OpenSSL internal implementation.
+DSA_OpenSSL() returns a pointer to that method.
+
+DSA_set_default_method() makes B<meth> the default method for all B<DSA>
+structures created later.
+
+DSA_get_default_method() returns a pointer to the current default
+method.
+
+DSA_set_method() selects B<meth> for all operations using the structure B<DSA>.
+
+DSA_get_method() returns a pointer to the method currently selected
+for B<DSA>.
+
+DSA_new_method() allocates and initializes a B<DSA> structure so that
+B<method> will be used for the DSA operations. If B<method> is B<NULL>,
+the default method is used.
+
+=head1 THE DSA_METHOD STRUCTURE
+
+struct
+ {
+     /* name of the implementation */
+        const char *name;
+
+     /* sign */
+        DSA_SIG *(*dsa_do_sign)(const unsigned char *dgst, int dlen,
+                                 DSA *dsa);
+
+     /* pre-compute k^-1 and r */
+        int (*dsa_sign_setup)(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
+                                 BIGNUM **rp);
+
+     /* verify */
+        int (*dsa_do_verify)(const unsigned char *dgst, int dgst_len,
+                                 DSA_SIG *sig, DSA *dsa);
+
+     /* compute rr = a1^p1 * a2^p2 mod m. May be NULL */
+        int (*dsa_mod_exp)(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
+                                 BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                                 BN_CTX *ctx, BN_MONT_CTX *in_mont);
+
+     /* compute r = a ^ p mod m. May be NULL */
+        int (*bn_mod_exp)(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                                 const BIGNUM *p, const BIGNUM *m,
+                                 BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+
+     /* called at DSA_new */
+        int (*init)(DSA *DSA);
+
+     /* called at DSA_free */
+        int (*finish)(DSA *DSA);
+
+        int flags;
+
+        char *app_data; /* ?? */
+
+ } DSA_METHOD;
+
+=head1 RETURN VALUES
+
+DSA_OpenSSL(), DSA_get_default_method() and DSA_get_method() return
+pointers to the respective B<DSA_METHOD>s.
+
+DSA_set_default_method() returns no value.
+
+DSA_set_method() returns a pointer to the B<DSA_METHOD> previously
+associated with B<dsa>.
+
+DSA_new_method() returns B<NULL> and sets an error code that can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation
+fails. Otherwise it returns a pointer to the newly allocated
+structure.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<DSA_new(3)|DSA_new(3)>
+
+=head1 HISTORY
+
+DSA_set_default_method(), DSA_get_default_method(), DSA_set_method(),
+DSA_new_method() and DSA_OpenSSL() were added in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_sign.pod b/src/lib/libssl/src/doc/crypto/DSA_sign.pod
new file mode 100644
index 0000000000..f6e60a8ca3
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_sign.pod
@@ -0,0 +1,66 @@
+=pod
+
+=head1 NAME
+
+DSA_sign, DSA_sign_setup, DSA_verify - DSA signatures
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ int    DSA_sign(int type, const unsigned char *dgst, int len,
+                unsigned char *sigret, unsigned int *siglen, DSA *dsa);
+
+ int    DSA_sign_setup(DSA *dsa, BN_CTX *ctx, BIGNUM **kinvp,
+                BIGNUM **rp);
+
+ int    DSA_verify(int type, const unsigned char *dgst, int len,
+                unsigned char *sigbuf, int siglen, DSA *dsa);
+
+=head1 DESCRIPTION
+
+DSA_sign() computes a digital signature on the B<len> byte message
+digest B<dgst> using the private key B<dsa> and places its ASN.1 DER
+encoding at B<sigret>. The length of the signature is places in
+*B<siglen>. B<sigret> must point to DSA_size(B<dsa>) bytes of memory.
+
+DSA_sign_setup() may be used to precompute part of the signing
+operation in case signature generation is time-critical. It expects
+B<dsa> to contain DSA parameters. It places the precomputed values
+in newly allocated B<BIGNUM>s at *B<kinvp> and *B<rp>, after freeing
+the old ones unless *B<kinvp> and *B<rp> are NULL. These values may
+be passed to DSA_sign() in B<dsa-E<gt>kinv> and B<dsa-E<gt>r>.
+B<ctx> is a pre-allocated B<BN_CTX> or NULL.
+
+DSA_verify() verifies that the signature B<sigbuf> of size B<siglen>
+matches a given message digest B<dgst> of size B<len>.
+B<dsa> is the signer's public key.
+
+The B<type> parameter is ignored.
+
+The PRNG must be seeded before DSA_sign() (or DSA_sign_setup())
+is called.
+
+=head1 RETURN VALUES
+
+DSA_sign() and DSA_sign_setup() return 1 on success, 0 on error.
+DSA_verify() returns 1 for a valid signature, 0 for an incorrect
+signature and -1 on error. The error codes can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 CONFORMING TO
+
+US Federal Information Processing Standard FIPS 186 (Digital Signature
+Standard, DSS), ANSI X9.30
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<DSA_do_sign(3)|DSA_do_sign(3)>
+
+=head1 HISTORY
+
+DSA_sign() and DSA_verify() are available in all versions of SSLeay.
+DSA_sign_setup() was added in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_size.pod b/src/lib/libssl/src/doc/crypto/DSA_size.pod
new file mode 100644
index 0000000000..23b6320a4d
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/DSA_size.pod
@@ -0,0 +1,33 @@
+=pod
+
+=head1 NAME
+
+DSA_size - get DSA signature size
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ int DSA_size(DSA *dsa);
+
+=head1 DESCRIPTION
+
+This function returns the size of an ASN.1 encoded DSA signature in
+bytes. It can be used to determine how much memory must be allocated
+for a DSA signature.
+
+B<dsa-E<gt>q> must not be B<NULL>.
+
+=head1 RETURN VALUE
+
+The size in bytes.
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<DSA_sign(3)|DSA_sign(3)>
+
+=head1 HISTORY
+
+DSA_size() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_GET_LIB.pod b/src/lib/libssl/src/doc/crypto/ERR_GET_LIB.pod
new file mode 100644
index 0000000000..2a129da036
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_GET_LIB.pod
@@ -0,0 +1,51 @@
+=pod
+
+=head1 NAME
+
+ERR_GET_LIB, ERR_GET_FUNC, ERR_GET_REASON - get library, function and
+reason code
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ int ERR_GET_LIB(unsigned long e);
+
+ int ERR_GET_FUNC(unsigned long e);
+
+ int ERR_GET_REASON(unsigned long e);
+
+=head1 DESCRIPTION
+
+The error code returned by ERR_get_error() consists of a library
+number, function code and reason code. ERR_GET_LIB(), ERR_GET_FUNC()
+and ERR_GET_REASON() can be used to extract these.
+
+The library number and function code describe where the error
+occurred, the reason code is the information about what went wrong.
+
+Each sub-library of OpenSSL has a unique library number; function and
+reason codes are unique within each sub-library.  Note that different
+libraries may use the same value to signal different functions and
+reasons.
+
+B<ERR_R_...> reason codes such as B<ERR_R_MALLOC_FAILURE> are globally
+unique. However, when checking for sub-library specific reason codes,
+be sure to also compare the library number.
+
+ERR_GET_LIB(), ERR_GET_FUNC() and ERR_GET_REASON() are macros.
+
+=head1 RETURN VALUES
+
+The library number, function code and reason code respectively.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>
+
+=head1 HISTORY
+
+ERR_GET_LIB(), ERR_GET_FUNC() and ERR_GET_REASON() are available in
+all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_clear_error.pod b/src/lib/libssl/src/doc/crypto/ERR_clear_error.pod
new file mode 100644
index 0000000000..566e1f4e31
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_clear_error.pod
@@ -0,0 +1,29 @@
+=pod
+
+=head1 NAME
+
+ERR_clear_error - clear the error queue
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_clear_error(void);
+
+=head1 DESCRIPTION
+
+ERR_clear_error() empties the current thread's error queue.
+
+=head1 RETURN VALUES
+
+ERR_clear_error() has no return value.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>
+
+=head1 HISTORY
+
+ERR_clear_error() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_error_string.pod b/src/lib/libssl/src/doc/crypto/ERR_error_string.pod
new file mode 100644
index 0000000000..0d2417599c
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_error_string.pod
@@ -0,0 +1,65 @@
+=pod
+
+=head1 NAME
+
+ERR_error_string - obtain human-readable error message
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ char *ERR_error_string(unsigned long e, char *buf);
+
+ const char *ERR_lib_error_string(unsigned long e);
+ const char *ERR_func_error_string(unsigned long e);
+ const char *ERR_reason_error_string(unsigned long e);
+
+=head1 DESCRIPTION
+
+ERR_error_string() generates a human-readable string representing the
+error code B<e>, and places it at B<buf>. B<buf> must be at least 120
+bytes long. If B<buf> is B<NULL>, the error string is placed in a
+static buffer.
+
+The string will have the following format:
+
+ error:[error code]:[library name]:[function name]:[reason string]
+
+I<error code> is an 8 digit hexadecimal number, I<library name>,
+I<function name> and I<reason string> are ASCII text.
+
+ERR_lib_error_string(), ERR_func_error_string() and
+ERR_reason_error_string() return the library name, function
+name and reason string respectively.
+
+The OpenSSL error strings should be loaded by calling
+L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)> or, for SSL
+applications, L<SSL_load_error_strings(3)|SSL_load_error_strings(3)>
+first.
+If there is no text string registered for the given error code,
+the error string will contain the numeric code.
+
+L<ERR_print_errors(3)|ERR_print_errors(3)> can be used to print
+all error codes currently in the queue.
+
+=head1 RETURN VALUES
+
+ERR_error_string() returns a pointer to a static buffer containing the
+string if B<buf == NULL>, B<buf> otherwise.
+
+ERR_lib_error_string(), ERR_func_error_string() and
+ERR_reason_error_string() return the strings, and B<NULL> if
+none is registered for the error code.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>,
+L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>,
+L<SSL_load_error_strings(3)|SSL_load_error_strings(3)>
+L<ERR_print_errors(3)|ERR_print_errors(3)>
+
+=head1 HISTORY
+
+ERR_error_string() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_get_error.pod b/src/lib/libssl/src/doc/crypto/ERR_get_error.pod
new file mode 100644
index 0000000000..75ece00d97
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_get_error.pod
@@ -0,0 +1,62 @@
+=pod
+
+=head1 NAME
+
+ERR_get_error, ERR_peek_error - obtain error code
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ unsigned long ERR_get_error(void);
+ unsigned long ERR_peek_error(void);
+
+ unsigned long ERR_get_error_line(const char **file, int *line);
+ unsigned long ERR_peek_error_line(const char **file, int *line);
+
+ unsigned long ERR_get_error_line_data(const char **file, int *line,
+         const char **data, int *flags);
+ unsigned long ERR_peek_error_line_data(const char **file, int *line,
+         const char **data, int *flags);
+
+=head1 DESCRIPTION
+
+ERR_get_error() returns the last error code from the thread's error
+queue and removes the entry. This function can be called repeatedly
+until there are no more error codes to return.
+
+ERR_peek_error() returns the last error code from the thread's
+error queue without modifying it.
+
+See L<ERR_GET_LIB(3)|ERR_GET_LIB(3)> for obtaining information about
+location and reason of the error, and
+L<ERR_error_string(3)|ERR_error_string(3)> for human-readable error
+messages.
+
+ERR_get_error_line() and ERR_peek_error_line() are the same as the
+above, but they additionally store the file name and line number where
+the error occurred in *B<file> and *B<line>, unless these are B<NULL>.
+
+ERR_get_error_line_data() and ERR_peek_error_line_data() store
+additional data and flags associated with the error code in *B<data>
+and *B<flags>, unless these are B<NULL>. *B<data> contains a string
+if *B<flags>&B<ERR_TXT_STRING>. If it has been allocated by Malloc(),
+*B<flags>&B<ERR_TXT_MALLOCED> is true.
+
+=head1 RETURN VALUES
+
+The error code, or 0 if there is no error in the queue.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>,
+L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>
+
+=head1 HISTORY
+
+ERR_get_error(), ERR_peek_error(), ERR_get_error_line() and
+ERR_peek_error_line() are available in all versions of SSLeay and
+OpenSSL. ERR_get_error_line_data() and ERR_peek_error_line_data()
+were added in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_load_crypto_strings.pod b/src/lib/libssl/src/doc/crypto/ERR_load_crypto_strings.pod
new file mode 100644
index 0000000000..9bdec75a46
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_load_crypto_strings.pod
@@ -0,0 +1,46 @@
+=pod
+
+=head1 NAME
+
+ERR_load_crypto_strings, SSL_load_error_strings, ERR_free_strings -
+load and free error strings
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_load_crypto_strings(void);
+ void ERR_free_strings(void);
+
+ #include <openssl/ssl.h>
+
+ void SSL_load_error_strings(void);
+
+=head1 DESCRIPTION
+
+ERR_load_crypto_strings() registers the error strings for all
+B<libcrypto> functions. SSL_load_error_strings() does the same,
+but also registers the B<libssl> error strings.
+
+One of these functions should be called before generating
+textual error messages. However, this is not required when memory
+usage is an issue.
+
+ERR_free_strings() frees all previously loaded error strings.
+
+=head1 RETURN VALUES
+
+ERR_load_crypto_strings(), SSL_load_error_strings() and
+ERR_free_strings() return no values.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>
+
+=head1 HISTORY
+
+ERR_load_error_strings(), SSL_load_error_strings() and
+ERR_free_strings() are available in all versions of SSLeay and
+OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_load_strings.pod b/src/lib/libssl/src/doc/crypto/ERR_load_strings.pod
new file mode 100644
index 0000000000..5acdd0edbc
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_load_strings.pod
@@ -0,0 +1,54 @@
+=pod
+
+=head1 NAME
+
+ERR_load_strings, ERR_PACK, ERR_get_next_error_library - load
+arbitrary error strings
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_load_strings(int lib, ERR_STRING_DATA str[]);
+
+ int ERR_get_next_error_library(void);
+
+ unsigned long ERR_PACK(int lib, int func, int reason);
+
+=head1 DESCRIPTION
+
+ERR_load_strings() registers error strings for library number B<lib>.
+
+B<str> is an array of error string data:
+
+ typedef struct ERR_string_data_st
+ {
+        unsigned long error;
+        char *string;
+ } ERR_STRING_DATA;
+
+The error code is generated from the library number and a function and
+reason code: B<error> = ERR_PACK(B<lib>, B<func>, B<reason>).
+ERR_PACK() is a macro.
+
+The last entry in the array is {0,0}.
+
+ERR_get_next_error_library() can be used to assign library numbers
+to user libraries at runtime.
+
+=head1 RETURN VALUE
+
+ERR_load_strings() returns no value. ERR_PACK() return the error code.
+ERR_get_next_error_library() returns a new library number.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)>
+
+=head1 HISTORY
+
+ERR_load_error_strings() and ERR_PACK() are available in all versions
+of SSLeay and OpenSSL. ERR_get_next_error_library() was added in
+SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_print_errors.pod b/src/lib/libssl/src/doc/crypto/ERR_print_errors.pod
new file mode 100644
index 0000000000..b100a5fa2b
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_print_errors.pod
@@ -0,0 +1,51 @@
+=pod
+
+=head1 NAME
+
+ERR_print_errors, ERR_print_errors_fp - print error messages
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_print_errors(BIO *bp);
+ void ERR_print_errors_fp(FILE *fp);
+
+=head1 DESCRIPTION
+
+ERR_print_errors() is a convenience function that prints the error
+strings for all errors that OpenSSL has recorded to B<bp>, thus
+emptying the error queue.
+
+ERR_print_errors_fp() is the same, except that the output goes to a
+B<FILE>.
+
+
+The error strings will have the following format:
+
+ [pid]:error:[error code]:[library name]:[function name]:[reason string]:[file name]:[line]:[optional text message]
+
+I<error code> is an 8 digit hexadecimal number. I<library name>,
+I<function name> and I<reason string> are ASCII text, as is I<optional
+text message> if one was set for the respective error code.
+
+If there is no text string registered for the given error code,
+the error string will contain the numeric code.
+
+=head1 RETURN VALUES
+
+ERR_print_errors() and ERR_print_errors_fp() return no values.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>,
+L<ERR_get_error(3)|ERR_get_error(3)>,
+L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>,
+L<SSL_load_error_strings(3)|SSL_load_error_strings(3)>
+
+=head1 HISTORY
+
+ERR_print_errors() and ERR_print_errors_fp()
+are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_put_error.pod b/src/lib/libssl/src/doc/crypto/ERR_put_error.pod
new file mode 100644
index 0000000000..acd241fbe4
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_put_error.pod
@@ -0,0 +1,44 @@
+=pod
+
+=head1 NAME
+
+ERR_put_error, ERR_add_error_data - record an error
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_put_error(int lib, int func, int reason, const char *file,
+         int line);
+
+ void ERR_add_error_data(int num, ...);
+
+=head1 DESCRIPTION
+
+ERR_put_error() adds an error code to the thread's error queue. It
+signals that the error of reason code B<reason> occurred in function
+B<func> of library B<lib>, in line number B<line> of B<file>.
+This function is usually called by a macro.
+
+ERR_add_error_data() associates the concatenation of its B<num> string
+arguments with the error code added last.
+
+L<ERR_load_strings(3)|ERR_load_strings(3)> can be used to register
+error strings so that the application can a generate human-readable
+error messages for the error code.
+
+=head1 RETURN VALUES
+
+ERR_put_error() and ERR_add_error_data() return
+no values.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)>
+
+=head1 HISTORY
+
+ERR_put_error() is available in all versions of SSLeay and OpenSSL.
+ERR_add_error_data() was added in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_remove_state.pod b/src/lib/libssl/src/doc/crypto/ERR_remove_state.pod
new file mode 100644
index 0000000000..ebcdc0f5a5
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_remove_state.pod
@@ -0,0 +1,34 @@
+=pod
+
+=head1 NAME
+
+ERR_remove_state - free a thread's error queue
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ void ERR_remove_state(unsigned long pid);
+
+=head1 DESCRIPTION
+
+ERR_remove_state() frees the error queue associated with thread B<pid>.
+If B<pid> == 0, the current thread will have its error queue removed.
+
+Since error queue data structures are allocated automatically for new
+threads, they must be freed when threads are terminated in oder to
+avoid memory leaks.
+
+=head1 RETURN VALUE
+
+ERR_remove_state() returns no value.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>
+
+=head1 HISTORY
+
+ERR_remove_state() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/EVP_DigestInit.pod b/src/lib/libssl/src/doc/crypto/EVP_DigestInit.pod
new file mode 100644
index 0000000000..345b1ddfa7
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/EVP_DigestInit.pod
@@ -0,0 +1,197 @@
+=pod
+
+=head1 NAME
+
+EVP_DigestInit, EVP_DigestUpdate, EVP_DigestFinal - EVP digest routines
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ void EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type);
+ void EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, unsigned int cnt);
+ void EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md,
+        unsigned int *s);
+
+ #define EVP_MAX_MD_SIZE (16+20) /* The SSLv3 md5+sha1 type */
+
+ int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in);  
+
+ #define EVP_MD_type(e)                 ((e)->type)
+ #define EVP_MD_pkey_type(e)            ((e)->pkey_type)
+ #define EVP_MD_size(e)                 ((e)->md_size)
+ #define EVP_MD_block_size(e)           ((e)->block_size)
+
+ #define EVP_MD_CTX_md(e)               (e)->digest)
+ #define EVP_MD_CTX_size(e)             EVP_MD_size((e)->digest)
+ #define EVP_MD_CTX_block_size(e)       EVP_MD_block_size((e)->digest)
+ #define EVP_MD_CTX_type(e)             EVP_MD_type((e)->digest)
+
+ EVP_MD *EVP_md_null(void);
+ EVP_MD *EVP_md2(void);
+ EVP_MD *EVP_md5(void);
+ EVP_MD *EVP_sha(void);
+ EVP_MD *EVP_sha1(void);
+ EVP_MD *EVP_dss(void);
+ EVP_MD *EVP_dss1(void);
+ EVP_MD *EVP_mdc2(void);
+ EVP_MD *EVP_ripemd160(void);
+
+ const EVP_MD *EVP_get_digestbyname(const char *name);
+ #define EVP_get_digestbynid(a) EVP_get_digestbyname(OBJ_nid2sn(a))
+ #define EVP_get_digestbyobj(a) EVP_get_digestbynid(OBJ_obj2nid(a))
+
+=head1 DESCRIPTION
+
+The EVP digest routines are a high level interface to message digests.
+
+EVP_DigestInit() initialises a digest context B<ctx> to use a digest
+B<type>: this will typically be supplied by a function such as
+EVP_sha1().
+
+EVP_DigestUpdate() hashes B<cnt> bytes of data at B<d> into the
+digest context B<ctx>. This funtion can be called several times on the
+same B<ctx> to hash additional data.
+
+EVP_DigestFinal() retrieves the digest value from B<ctx> and places
+it in B<md>. If the B<s> parameter is not NULL then the number of
+bytes of data written (i.e. the length of the digest) will be written
+to the integer at B<s>, at most B<EVP_MAX_MD_SIZE> bytes will be written.
+After calling EVP_DigestFinal() no additional calls to EVP_DigestUpdate()
+can be made, but EVP_DigestInit() can be called to initialiase a new
+digest operation.
+
+EVP_MD_CTX_copy() can be used to copy the message digest state from
+B<in> to B<out>. This is useful if large amounts of data are to be
+hashed which only differ in the last few bytes.
+
+EVP_MD_size() and EVP_MD_CTX_size() return the size of the message digest
+when passed an B<EVP_MD> or an B<EVP_MD_CTX> structure, i.e. the size of the
+hash.
+
+EVP_MD_block_size() and EVP_MD_CTX_block_size() return the block size of the
+message digest when passed an B<EVP_MD> or an B<EVP_MD_CTX> structure.
+
+EVP_MD_type() and EVP_MD_CTX_type() return the NID of the OBJECT IDENTIFIER
+representing the given message digest when passed an B<EVP_MD> structure.
+For example EVP_MD_type(EVP_sha1()) returns B<NID_sha1>. This function is
+normally used when setting ASN1 OIDs.
+
+EVP_MD_CTX_md() returns the B<EVP_MD> structure corresponding to the passed
+B<EVP_MD_CTX>.
+
+EVP_MD_pkey_type() returns the NID of the public key signing algorithm associated
+with this digest. For example EVP_sha1() is associated with RSA so this will
+return B<NID_sha1WithRSAEncryption>. This "link" between digests and signature
+algorithms may not be retained in future versions of OpenSSL.
+
+EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_mdc2() and EVP_ripemd160()
+return B<EVP_MD> structures for the MD2, MD5, SHA, SHA1, MDC2 and RIPEMD160 digest
+algorithms respectively. The associated signature algorithm is RSA in each case.
+
+EVP_dss() and EVP_dss1() return B<EVP_MD> structures for SHA and SHA1 digest
+algorithms but using DSS (DSA) for the signature algorithm.
+
+EVP_md_null() is a "null" message digest that does nothing: i.e. the hash it
+returns is of zero length.
+
+EVP_get_digestbyname(), EVP_get_digestbynid() and EVP_get_digestbyobj()
+return an B<EVP_MD> structure when passed a digest name, a digest NID or
+an ASN1_OBJECT structure respectively. The digest table must be initialised
+using, for example, OpenSSL_add_all_digests() for these functions to work.
+
+=head1 RETURN VALUES
+
+EVP_DigestInit(), EVP_DigestUpdate() and EVP_DigestFinal() do not return values.
+
+EVP_MD_CTX_copy() returns 1 if successful or 0 for failure.
+
+EVP_MD_type(), EVP_MD_pkey_type() and EVP_MD_type() return the NID of the
+corresponding OBJECT IDENTIFIER or NID_undef if none exists.
+
+EVP_MD_size(), EVP_MD_block_size(), EVP_MD_CTX_size(e), EVP_MD_size(),
+EVP_MD_CTX_block_size() and EVP_MD_block_size() return the digest or block
+size in bytes.
+
+EVP_md_null(), EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_dss(),
+EVP_dss1(), EVP_mdc2() and EVP_ripemd160() return pointers to the
+corresponding EVP_MD structures.
+
+EVP_get_digestbyname(), EVP_get_digestbynid() and EVP_get_digestbyobj()
+return either an B<EVP_MD> structure or NULL if an error occurs.
+
+=head1 NOTES
+
+The B<EVP> interface to message digests should almost always be used in
+preference to the low level interfaces. This is because the code then becomes
+transparent to the digest used and much more flexible.
+
+SHA1 is the digest of choice for new applications. The other digest algorithms
+are still in common use.
+
+=head1 EXAMPLE
+
+This example digests the data "Test Message\n" and "Hello World\n", using the
+digest name passed on the command line.
+
+ #include <stdio.h>
+ #include <openssl/evp.h>
+
+ main(int argc, char *argv[])
+ {
+ EVP_MD_CTX mdctx;
+ const EVP_MD *md;
+ char mess1[] = "Test Message\n";
+ char mess2[] = "Hello World\n";
+ unsigned char md_value[EVP_MAX_MD_SIZE];
+ int md_len, i;
+
+ OpenSSL_add_all_digests();
+
+ if(!argv[1]) {
+        printf("Usage: mdtest digestname\n");
+        exit(1);
+ }
+
+ md = EVP_get_digestbyname(argv[1]);
+
+ if(!md) {
+        printf("Unknown message digest %s\n", argv[1]);
+        exit(1);
+ }
+
+ EVP_DigestInit(&mdctx, md);
+ EVP_DigestUpdate(&mdctx, mess1, strlen(mess1));
+ EVP_DigestUpdate(&mdctx, mess2, strlen(mess2));
+ EVP_DigestFinal(&mdctx, md_value, &md_len);
+
+ printf("Digest is: ");
+ for(i = 0; i < md_len; i++) printf("%02x", md_value[i]);
+ printf("\n");
+ }
+
+=head1 BUGS
+
+Several of the functions do not return values: maybe they should. Although the
+internal digest operations will never fail some future hardware based operations
+might.
+
+The link between digests and signing algorithms results in a situation where
+EVP_sha1() must be used with RSA and EVP_dss1() must be used with DSS
+even though they are identical digests.
+
+The size of an B<EVP_MD_CTX> structure is determined at compile time: this results
+in code that must be recompiled if the size of B<EVP_MD_CTX> increases.
+
+=head1 SEE ALSO
+
+L<evp(3)|evp(3)>, L<hmac(3)|hmac(3)>, L<md2(3)|md2(3)>,
+L<md5(3)|md5(3)>, L<mdc2(3)|mdc2(3)>, L<ripemd(3)|ripemd(3)>,
+L<sha(3)|sha(3)>, L<digest(1)|digest(1)>
+
+=head1 HISTORY
+
+EVP_DigestInit(), EVP_DigestUpdate() and EVP_DigestFinal() are
+available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/EVP_EncryptInit.pod b/src/lib/libssl/src/doc/crypto/EVP_EncryptInit.pod
new file mode 100644
index 0000000000..77ed4ccdba
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/EVP_EncryptInit.pod
@@ -0,0 +1,224 @@
+=pod
+
+=head1 NAME
+
+EVP_EncryptInit, EVP_EncryptUpdate, EVP_EncryptFinal - EVP cipher routines
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ void EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+         unsigned char *key, unsigned char *iv);
+ void EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         int *outl, unsigned char *in, int inl);
+ void EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         int *outl);
+
+ void EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+         unsigned char *key, unsigned char *iv);
+ void EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         int *outl, unsigned char *in, int inl);
+ int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm,
+         int *outl);
+
+ void EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+         unsigned char *key, unsigned char *iv, int enc);
+ void EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         int *outl, unsigned char *in, int inl);
+ int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm,
+         int *outl);
+
+ void EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *a);
+
+ const EVP_CIPHER *EVP_get_cipherbyname(const char *name);
+ #define EVP_get_cipherbynid(a) EVP_get_cipherbyname(OBJ_nid2sn(a))
+ #define EVP_get_cipherbyobj(a) EVP_get_cipherbynid(OBJ_obj2nid(a))
+
+ #define EVP_CIPHER_nid(e)              ((e)->nid)
+ #define EVP_CIPHER_block_size(e)       ((e)->block_size)
+ #define EVP_CIPHER_key_length(e)       ((e)->key_len)
+ #define EVP_CIPHER_iv_length(e)        ((e)->iv_len)
+
+ int EVP_CIPHER_type(const EVP_CIPHER *ctx);
+ #define EVP_CIPHER_CTX_cipher(e)       ((e)->cipher)
+ #define EVP_CIPHER_CTX_nid(e)          ((e)->cipher->nid)
+ #define EVP_CIPHER_CTX_block_size(e)   ((e)->cipher->block_size)
+ #define EVP_CIPHER_CTX_key_length(e)   ((e)->cipher->key_len)
+ #define EVP_CIPHER_CTX_iv_length(e)    ((e)->cipher->iv_len)
+ #define EVP_CIPHER_CTX_type(c)         EVP_CIPHER_type(EVP_CIPHER_CTX_cipher(c))
+
+ int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
+ int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
+
+=head1 DESCRIPTION
+
+The EVP cipher routines are a high level interface to certain
+symmetric ciphers.
+
+EVP_EncryptInit() initialises a cipher context B<ctx> for encryption
+with cipher B<type>. B<type> is normally supplied by a function such
+as EVP_des_cbc() . B<key> is the symmetric key to use and B<iv> is the
+IV to use (if necessary), the actual number of bytes used for the
+key and IV depends on the cipher. It is possible to set all parameters
+to NULL except B<type> in an initial call and supply the remaining
+parameters in subsequent calls. This is normally done when the 
+EVP_CIPHER_asn1_to_param() function is called to set the cipher
+parameters from an ASN1 AlgorithmIdentifier and the key from a
+different source.
+
+EVP_EncryptUpdate() encrypts B<inl> bytes from the buffer B<in> and
+writes the encrypted version to B<out>. This function can be called
+multiple times to encrypt successive blocks of data. The amount
+of data written depends on the block alignment of the encrypted data:
+as a result the amount of data written may be anything from zero bytes
+to (inl + cipher_block_size - 1) so B<outl> should contain sufficient
+room.  The actual number of bytes written is placed in B<outl>.
+
+EVP_EncryptFinal() encrypts the "final" data, that is any data that
+remains in a partial block. It uses L<standard block padding|/NOTES> (aka PKCS
+padding). The encrypted final data is written to B<out> which should
+have sufficient space for one cipher block. The number of bytes written
+is placed in B<outl>. After this function is called the encryption operation
+is finished and no further calls to EVP_EncryptUpdate() should be made.
+
+EVP_DecryptInit(), EVP_DecryptUpdate() and EVP_DecryptFinal() are the
+corresponding decryption operations. EVP_DecryptFinal() will return an
+error code if the final block is not correctly formatted. The parameters
+and restrictions are identical to the encryption operations except that
+the decrypted data buffer B<out> passed to EVP_DecryptUpdate() should
+have sufficient room for (B<inl> + cipher_block_size) bytes unless the
+cipher block size is 1 in which case B<inl> bytes is sufficient.
+
+EVP_CipherInit(), EVP_CipherUpdate() and EVP_CipherFinal() are functions
+that can be used for decryption or encryption. The operation performed
+depends on the value of the B<enc> parameter. It should be set to 1 for
+encryption and 0 for decryption.
+
+EVP_CIPHER_CTX_cleanup() clears all information from a cipher context.
+It should be called after all operations using a cipher are complete
+so sensitive information does not remain in memory.
+
+EVP_get_cipherbyname(), EVP_get_cipherbynid() and EVP_get_cipherbyobj()
+return an EVP_CIPHER structure when passed a cipher name, a NID or an
+ASN1_OBJECT structure.
+
+EVP_CIPHER_nid() and EVP_CIPHER_CTX_nid() return the NID of a cipher when
+passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX> structure.  The actual NID
+value is an internal value which may not have a corresponding OBJECT
+IDENTIFIER.
+
+EVP_CIPHER_key_length() and EVP_CIPHER_CTX_key_length() return the key
+length of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>
+structure. The constant B<EVP_MAX_KEY_LENGTH> is the maximum key length
+for all ciphers.
+
+EVP_CIPHER_iv_length() and EVP_CIPHER_CTX_iv_length() return the IV
+length of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>.
+It will return zero if the cipher does not use an IV.  The constant
+B<EVP_MAX_IV_LENGTH> is the maximum IV length for all ciphers.
+
+EVP_CIPHER_block_size() and EVP_CIPHER_CTX_block_size() return the block
+size of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>
+structure. The constant B<EVP_MAX_IV_LENGTH> is also the maximum block
+length for all ciphers.
+
+EVP_CIPHER_type() and EVP_CIPHER_CTX_type() return the type of the passed
+cipher or context. This "type" is the actual NID of the cipher OBJECT
+IDENTIFIER as such it ignores the cipher parameters and 40 bit RC2 and
+128 bit RC2 have the same NID. If the cipher does not have an object
+identifier or does not have ASN1 support this function will return
+B<NID_undef>.
+
+EVP_CIPHER_CTX_cipher() returns the B<EVP_CIPHER> structure when passed
+an B<EVP_CIPHER_CTX> structure.
+
+EVP_CIPHER_param_to_asn1() sets the AlgorithmIdentifier "parameter" based
+on the passed cipher. This will typically include any parameters and an
+IV. The cipher IV (if any) must be set when this call is made. This call
+should be made before the cipher is actually "used" (before any
+EVP_EncryptUpdate(), EVP_DecryptUpdate() calls for example). This function
+may fail if the cipher does not have any ASN1 support.
+
+EVP_CIPHER_asn1_to_param() sets the cipher parameters based on an ASN1
+AlgorithmIdentifier "parameter". The precise effect depends on the cipher
+In the case of RC2, for example, it will set the IV and effective key length.
+This function should be called after the base cipher type is set but before
+the key is set. For example EVP_CipherInit() will be called with the IV and
+key set to NULL, EVP_CIPHER_asn1_to_param() will be called and finally
+EVP_CipherInit() again with all parameters except the key set to NULL. It is
+possible for this function to fail if the cipher does not have any ASN1 support
+or the parameters cannot be set (for example the RC2 effective key length
+does not have an B<EVP_CIPHER> structure).
+
+=head1 RETURN VALUES
+
+EVP_EncryptInit(), EVP_EncryptUpdate() and EVP_EncryptFinal() do not return
+values.
+
+EVP_DecryptInit() and EVP_DecryptUpdate() do not return values.
+EVP_DecryptFinal() returns 0 if the decrypt failed or 1 for success.
+
+EVP_CipherInit() and EVP_CipherUpdate() do not return values.
+EVP_CipherFinal() returns 1 for a decryption failure or 1 for success, if
+the operation is encryption then it always returns 1.
+
+EVP_CIPHER_CTX_cleanup() does not return a value.
+
+EVP_get_cipherbyname(), EVP_get_cipherbynid() and EVP_get_cipherbyobj()
+return an B<EVP_CIPHER> structure or NULL on error.
+
+EVP_CIPHER_nid() and EVP_CIPHER_CTX_nid() return a NID.
+
+EVP_CIPHER_block_size() and EVP_CIPHER_CTX_block_size() return the block
+size.
+
+EVP_CIPHER_key_length() and EVP_CIPHER_CTX_key_length() return the key
+length.
+
+EVP_CIPHER_iv_length() and EVP_CIPHER_CTX_iv_length() return the IV
+length or zero if the cipher does not use an IV.
+
+EVP_CIPHER_type() and EVP_CIPHER_CTX_type() return the NID of the cipher's
+OBJECT IDENTIFIER or NID_undef if it has no defined OBJECT IDENTIFIER.
+
+EVP_CIPHER_CTX_cipher() returns an B<EVP_CIPHER> structure.
+
+EVP_CIPHER_param_to_asn1() and EVP_CIPHER_asn1_to_param() return 1 for 
+success or zero for failure.
+
+=head1 NOTES
+
+Where possible the B<EVP> interface to symmetric ciphers should be used in
+preference to the low level interfaces. This is because the code then becomes
+transparent to the cipher used and much more flexible.
+
+PKCS padding works by adding B<n> padding bytes of value B<n> to make the total 
+length of the encrypted data a multiple of the block size. Padding is always
+added so if the data is already a multiple of the block size B<n> will equal
+the block size. For example if the block size is 8 and 11 bytes are to be
+encrypted then 5 padding bytes of value 5 will be added.
+
+When decrypting the final block is checked to see if it has the correct form.
+
+Although the decryption operation can produce an error, it is not a strong
+test that the input data or key is correct. A random block has better than
+1 in 256 chance of being of the correct format and problems with the
+input data earlier on will not produce a final decrypt error.
+
+=head1 BUGS
+
+The current B<EVP> cipher interface is not as flexible as it should be. Only
+certain "spot" encryption algorithms can be used for ciphers which have various
+parameters associated with them (RC2, RC5 for example) this is inadequate.
+
+Several of the functions do not return error codes because the software versions
+can never fail. This is not true of hardware versions.
+
+=head1 SEE ALSO
+
+L<evp(3)|evp(3)>
+
+=head1 HISTORY
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/OPENSSL_VERSION_NUMBER.pod b/src/lib/libssl/src/doc/crypto/OPENSSL_VERSION_NUMBER.pod
new file mode 100644
index 0000000000..b0b1058d19
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/OPENSSL_VERSION_NUMBER.pod
@@ -0,0 +1,46 @@
+=pod
+
+=head1 NAME
+
+OPENSSL_VERSION_NUMBER, SSLeay - get OpenSSL version number
+
+=head1 SYNOPSIS
+
+ #include <openssl/opensslv.h>
+ #define OPENSSL_VERSION_NUMBER 0xnnnnnnnnnL
+
+ #include <openssl/crypto.h>
+ long SSLeay(void);
+
+=head1 DESCRIPTION
+
+OPENSSL_VERSION_NUMBER is a numeric release version identifier:
+
+ MMNNFFRBB major minor fix final beta/patch
+
+for example
+
+ 0x000904100 == 0.9.4 release
+ 0x000905000 == 0.9.5 dev
+
+Versions prior to 0.9.3 have identifiers E<lt> 0x0930.
+For backward compatibility, SSLEAY_VERSION_NUMBER is also defined.
+
+SSLeay() returns this number. The return value can be compared to the
+macro to make sure that the correct version of the library has been
+loaded, especially when using DLLs on Windows systems.
+
+=head1 RETURN VALUE
+
+The version number.
+
+=head1 SEE ALSO
+
+L<crypto(3)|crypto(3)>
+
+=head1 HISTORY
+
+SSLeay() and SSLEAY_VERSION_NUMBER are available in all versions of SSLeay and OpenSSL.
+OPENSSL_VERSION_NUMBER is available in all versions of OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/OpenSSL_add_all_algorithms.pod b/src/lib/libssl/src/doc/crypto/OpenSSL_add_all_algorithms.pod
new file mode 100644
index 0000000000..1300fe190c
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/OpenSSL_add_all_algorithms.pod
@@ -0,0 +1,65 @@
+=pod
+
+=head1 NAME
+
+OpenSSL_add_all_algorithms() - add algorithms to internal table
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ void OpenSSL_add_all_algorithms(void);
+ void OpenSSL_add_all_ciphers(void);
+ void OpenSSL_add_all_digests(void);
+
+ void EVP_cleanup(void);
+
+=head1 DESCRIPTION
+
+OpenSSL keeps an internal table of digest algorithms and ciphers. It uses
+this table to lookup ciphers via functions such as EVP_get_cipher_byname().
+
+OpenSSL_add_all_digests() adds all digest algorithms to the table.
+
+OpenSSL_add_all_algorithms() adds all algorithms to the table (digests and
+ciphers).
+
+OpenSSL_add_all_ciphers() adds all encryption algorithms to the table including
+password based encryption algorithms.
+
+EVP_cleanup() removes all ciphers and digests from the table.
+
+=head1 RETURN VALUES
+
+None of the functions return a value.
+
+=head1 NOTES
+
+A typical application will will call OpenSSL_add_all_algorithms() initially and
+EVP_cleanup() before exiting.
+
+An application does not need to add algorithms to use them explicitly, for example
+by EVP_sha1(). It just needs to add them if it (or any of the functions it calls)
+needs to lookup algorithms.
+
+The cipher and digest lookup functions are used in many parts of the library. If
+the table is not initialised several functions will misbehave and complain they
+cannot find algorithms. This includes the PEM, PKCS#12, SSL and S/MIME libraries.
+This is a common query in the OpenSSL mailing lists.
+
+Calling OpenSSL_add_all_algorithms() links in all algorithms: as a result a
+statically linked executable can be quite large. If this is important it is possible
+to just add the required ciphers and digests.
+
+=head1 BUGS
+
+Although the functions do not return error codes it is possible for them to fail.
+This will only happen as a result of a memory allocation failure so this is not
+too much of a problem in practice.
+
+=head1 SEE ALSO
+
+L<evp(3)|evp(3)>, L<EVP_DigestInit(3)|EVP_DigestInit(3)>,
+L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RAND_add.pod b/src/lib/libssl/src/doc/crypto/RAND_add.pod
new file mode 100644
index 0000000000..0a13ec2a92
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RAND_add.pod
@@ -0,0 +1,68 @@
+=pod
+
+=head1 NAME
+
+RAND_add, RAND_seed, RAND_screen - add entropy to the PRNG
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ void RAND_seed(const void *buf, int num);
+
+ void RAND_add(const void *buf, int num, double entropy);
+
+ int  RAND_status(void);
+
+ void RAND_screen(void);
+
+=head1 DESCRIPTION
+
+RAND_add() mixes the B<num> bytes at B<buf> into the PRNG state. Thus,
+if the data at B<buf> are unpredictable to an adversary, this
+increases the uncertainty about the state and makes the PRNG output
+less predictable. Suitable input comes from user interaction (random
+key presses, mouse movements) and certain hardware events. The
+B<entropy> argument is (the lower bound of) an estimate of how much
+randomness is contained in B<buf>, measured in bytes. Details about
+sources of randomness and how to estimate their entropy can be found
+in the literature, e.g. RFC 1750.
+
+RAND_add() may be called with sensitive data such as user entered
+passwords. The seed values cannot be recovered from the PRNG output.
+
+OpenSSL makes sure that the PRNG state is unique for each thread. On
+systems that provide C</dev/urandom>, the randomness device is used
+to seed the PRNG transparently. However, on all other systems, the
+application is responsible for seeding the PRNG by calling RAND_add(),
+L<RAND_egd(3)|RAND_egd(3)>
+or L<RAND_load_file(3)|RAND_load_file(3)>.
+
+RAND_seed() is equivalent to RAND_add() when B<num == entropy>.
+
+The RAND_screen() function is available for the convenience of Windows
+programmers. It adds the current contents of the screen to the PRNG.
+For applications that can catch Windows events, seeding the PRNG with
+the parameters of B<WM_MOUSEMOVE> events is a significantly better
+source of randomness. It should be noted that both methods cannot be
+used on servers that run without user interaction.
+
+=head1 RETURN VALUES
+
+RAND_status() returns 1 if the PRNG has been seeded with enough data,
+0 otherwise.
+
+The other functions do not return values.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>, L<RAND_egd(3)|RAND_egd(3)>,
+L<RAND_load_file(3)|RAND_load_file(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)>
+
+=head1 HISTORY
+
+RAND_seed() and RAND_screen() are available in all versions of SSLeay
+and OpenSSL. RAND_add() and RAND_status() have been added in OpenSSL
+0.9.5.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RAND_bytes.pod b/src/lib/libssl/src/doc/crypto/RAND_bytes.pod
new file mode 100644
index 0000000000..b6ebd50527
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RAND_bytes.pod
@@ -0,0 +1,46 @@
+=pod
+
+=head1 NAME
+
+RAND_bytes, RAND_pseudo_bytes - generate random data
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ int RAND_bytes(unsigned char *buf, int num);
+
+ int RAND_pseudo_bytes(unsigned char *buf, int num);
+
+=head1 DESCRIPTION
+
+RAND_bytes() puts B<num> cryptographically strong pseudo-random bytes
+into B<buf>. An error occurs if the PRNG has not been seeded with
+enough randomness to ensure an unpredictable byte sequence.
+
+RAND_pseudo_bytes() puts B<num> pseudo-random bytes into B<buf>.
+Pseudo-random byte sequences generated by RAND_pseudo_bytes() will be
+unique if they are of sufficient length, but are not necessarily
+unpredictable. They can be used for non-cryptographic purposes and for
+certain purposes in cryptographic protocols, but usually not for key
+generation etc.
+
+=head1 RETURN VALUES
+
+RAND_bytes() returns 1 on success, 0 otherwise. The error code can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>. RAND_pseudo_bytes() returns 1 if the
+bytes generated are cryptographically strong, 0 otherwise. Both
+functions return -1 if they are not supported by the current RAND
+method.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>, L<err(3)|err(3)>, L<RAND_add(3)|RAND_add(3)>
+
+=head1 HISTORY
+
+RAND_bytes() is available in all versions of SSLeay and OpenSSL.  It
+has a return value since OpenSSL 0.9.5. RAND_pseudo_bytes() was added
+in OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RAND_cleanup.pod b/src/lib/libssl/src/doc/crypto/RAND_cleanup.pod
new file mode 100644
index 0000000000..3a8f0749a8
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RAND_cleanup.pod
@@ -0,0 +1,29 @@
+=pod
+
+=head1 NAME
+
+RAND_cleanup - erase the PRNG state
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ void RAND_cleanup(void);
+
+=head1 DESCRIPTION
+
+RAND_cleanup() erases the memory used by the PRNG.
+
+=head1 RETURN VALUE
+
+RAND_cleanup() returns no value.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>
+
+=head1 HISTORY
+
+RAND_cleanup() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RAND_egd.pod b/src/lib/libssl/src/doc/crypto/RAND_egd.pod
new file mode 100644
index 0000000000..a40bd96198
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RAND_egd.pod
@@ -0,0 +1,38 @@
+=pod
+
+=head1 NAME
+
+RAND_egd - query entropy gathering daemon
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ int RAND_egd(const char *path);
+
+=head1 DESCRIPTION
+
+RAND_egd() queries the entropy gathering daemon EGD on socket B<path>.
+
+EGD is available from http://www.lothar.com/tech/crypto/ (C<perl
+Makefile.PL; make; make install> to install). It is run as B<egd>
+I<path>, where I<path> is an absolute path designating a socket. When
+RAND_egd() is called with that path as an argument, it tries to read
+random bytes that EGD has collected. The read is performed in
+non-blocking mode.
+
+=head1 RETURN VALUE
+
+RAND_egd() returns the number of bytes read from the daemon on
+success, and -1 if the connection failed or the daemon did not return
+enough data to fully seed the PRNG.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>, L<RAND_add(3)|RAND_add(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)>
+
+=head1 HISTORY
+
+RAND_egd() is available since OpenSSL 0.9.5.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RAND_load_file.pod b/src/lib/libssl/src/doc/crypto/RAND_load_file.pod
new file mode 100644
index 0000000000..8dd700ca3d
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RAND_load_file.pod
@@ -0,0 +1,53 @@
+=pod
+
+=head1 NAME
+
+RAND_load_file, RAND_write_file, RAND_file_name - PRNG seed file
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ const char *RAND_file_name(char *buf, int num);
+
+ int RAND_load_file(const char *filename, long max_bytes);
+
+ int RAND_write_file(const char *filename);
+
+=head1 DESCRIPTION
+
+RAND_file_name() generates a default path for the random seed
+file. B<buf> points to a buffer of size B<num> in which to store the
+filename. The seed file is $RANDFILE if that environment variable is
+set, $HOME/.rnd otherwise. If $HOME is not set either, or B<num> is
+too small for the path name, an error occurs.
+
+RAND_load_file() reads a number of bytes from file B<filename> and
+adds them to the PRNG. If B<max_bytes> is non-negative,
+up to to B<max_bytes> are read; starting with OpenSSL 0.9.5,
+if B<max_bytes> is -1, the complete file is read.
+
+RAND_write_file() writes a number of random bytes (currently 1024) to
+file B<filename> which can be used to initialize the PRNG by calling
+RAND_load_file() in a later session.
+
+=head1 RETURN VALUES
+
+RAND_load_file() returns the number of bytes read.
+
+RAND_write_file() returns the number of bytes written, and -1 if the
+bytes written were generated without appropriate seed.
+
+RAND_file_name() returns a pointer to B<buf> on success, and NULL on
+error.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>, L<RAND_add(3)|RAND_add(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)>
+
+=head1 HISTORY
+
+RAND_load_file(), RAND_write_file() and RAND_file_name() are available in
+all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod b/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod
new file mode 100644
index 0000000000..466e9b8767
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod
@@ -0,0 +1,57 @@
+=pod
+
+=head1 NAME
+
+RAND_set_rand_method, RAND_get_rand_method, RAND_SSLeay - select RAND method
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ void RAND_set_rand_method(RAND_METHOD *meth);
+
+ RAND_METHOD *RAND_get_rand_method(void);
+
+ RAND_METHOD *RAND_SSLeay(void);
+
+=head1 DESCRIPTION
+
+A B<RAND_METHOD> specifies the functions that OpenSSL uses for random
+number generation. By modifying the method, alternative
+implementations such as hardware RNGs may be used.  Initially, the
+default is to use the OpenSSL internal implementation. RAND_SSLeay()
+returns a pointer to that method.
+
+RAND_set_rand_method() sets the RAND method to B<meth>.
+RAND_get_rand_method() returns a pointer to the current method.
+
+=head1 THE RAND_METHOD STRUCTURE
+
+ typedef struct rand_meth_st
+ {
+        void (*seed)(const void *buf, int num);
+        int (*bytes)(unsigned char *buf, int num);
+        void (*cleanup)(void);
+        void (*add)(const void *buf, int num, int entropy);
+        int (*pseudorand)(unsigned char *buf, int num);
+ } RAND_METHOD;
+
+The components point to the implementation of RAND_seed(),
+RAND_bytes(), RAND_cleanup(), RAND_add() and RAND_pseudo_rand().
+Each component may be NULL if the function is not implemented.
+
+=head1 RETURN VALUES
+
+RAND_set_rand_method() returns no value. RAND_get_rand_method() and
+RAND_SSLeay() return pointers to the respective methods.
+
+=head1 SEE ALSO
+
+L<rand(3)|rand(3)>
+
+=head1 HISTORY
+
+RAND_set_rand_method(), RAND_get_rand_method() and RAND_SSLeay() are
+available in all versions of OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_blinding_on.pod b/src/lib/libssl/src/doc/crypto/RSA_blinding_on.pod
new file mode 100644
index 0000000000..fd2c69abd8
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_blinding_on.pod
@@ -0,0 +1,43 @@
+=pod
+
+=head1 NAME
+
+RSA_blinding_on, RSA_blinding_off - protect the RSA operation from timing attacks
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_blinding_on(RSA *rsa, BN_CTX *ctx);
+
+ void RSA_blinding_off(RSA *rsa);
+
+=head1 DESCRIPTION
+
+RSA is vulnerable to timing attacks. In a setup where attackers can
+measure the time of RSA decryption or signature operations, blinding
+must be used to protect the RSA operation from that attack.
+
+RSA_blinding_on() turns blinding on for key B<rsa> and generates a
+random blinding factor. B<ctx> is B<NULL> or a pre-allocated and
+initialized B<BN_CTX>. The random number generator must be seeded
+prior to calling RSA_blinding_on().
+
+RSA_blinding_off() turns blinding off and frees the memory used for
+the blinding factor.
+
+=head1 RETURN VALUES
+
+RSA_blinding_on() returns 1 on success, and 0 if an error occurred.
+
+RSA_blinding_off() returns no value.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<rand(3)|rand(3)>
+
+=head1 HISTORY
+
+RSA_blinding_on() and RSA_blinding_off() appeared in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_check_key.pod b/src/lib/libssl/src/doc/crypto/RSA_check_key.pod
new file mode 100644
index 0000000000..79fed753ad
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_check_key.pod
@@ -0,0 +1,39 @@
+=pod
+
+=head1 NAME
+
+RSA_check_key - validate private RSA keys
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_check_key(RSA *rsa);
+
+=head1 DESCRIPTION
+
+This function validates RSA keys. It checks that B<p> and B<q> are
+in fact prime, and that B<n = p*q>.
+
+It also checks that B<d*e = 1 mod (p-1*q-1)>,
+and that B<dmp1>, B<dmq1> and B<iqmp> are set correctly or are B<NULL>.
+
+The key's public components may not be B<NULL>.
+
+=head1 RETURN VALUE
+
+RSA_check_key() returns 1 if B<rsa> is a valid RSA key, and 0 otherwise.
+-1 is returned if an error occurs while checking the key.
+
+If the key is invalid or an error occurred, the reason code can be
+obtained using L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<err(3)|err(3)>
+
+=head1 HISTORY
+
+RSA_check() appeared in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_generate_key.pod b/src/lib/libssl/src/doc/crypto/RSA_generate_key.pod
new file mode 100644
index 0000000000..fdaddbcb13
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_generate_key.pod
@@ -0,0 +1,68 @@
+=pod
+
+=head1 NAME
+
+RSA_generate_key - generate RSA key pair
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ RSA *RSA_generate_key(int num, unsigned long e,
+    void (*callback)(int,int,void *), void *cb_arg);
+
+=head1 DESCRIPTION
+
+RSA_generate_key() generates a key pair and returns it in a newly
+allocated B<RSA> structure. The pseudo-random number generator must
+be seeded prior to calling RSA_generate_key().
+
+The modulus size will be B<num> bits, and the public exponent will be
+B<e>. Key sizes with B<num> E<lt> 1024 should be considered insecure.
+The exponent is an odd number, typically 3 or 65535.
+
+A callback function may be used to provide feedback about the
+progress of the key generation. If B<callback> is not B<NULL>, it
+will be called as follows:
+
+=over 4
+
+=item *
+
+While a random prime number is generated, it is called as
+described in L<BN_generate_prime(3)|BN_generate_prime(3)>.
+
+=item *
+
+When the n-th randomly generated prime is rejected as not
+suitable for the key, B<callback(2, n, cb_arg)> is called.
+
+=item *
+
+When a random p has been found with p-1 relatively prime to B<e>,
+it is called as B<callback(3, 0, cb_arg)>.
+
+=back
+
+The process is then repeated for prime q with B<callback(3, 1, cb_arg)>.
+
+=head1 RETURN VALUE
+
+If key generation fails, RSA_generate_key() returns B<NULL>; the
+error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+B<callback(2, x, cb_arg)> is used with two different meanings.
+
+RSA_generate_key() goes into an infinite loop for illegal input values.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<RSA_free(3)|RSA_free(3)>
+
+=head1 HISTORY
+
+The B<cb_arg> argument was added in SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_get_ex_new_index.pod b/src/lib/libssl/src/doc/crypto/RSA_get_ex_new_index.pod
new file mode 100644
index 0000000000..920dc76325
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_get_ex_new_index.pod
@@ -0,0 +1,122 @@
+=pod
+
+=head1 NAME
+
+RSA_get_ex_new_index, RSA_set_ex_data, RSA_get_ex_data - add application specific data to RSA structures
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_get_ex_new_index(long argl, void *argp,
+                CRYPTO_EX_new *new_func,
+                CRYPTO_EX_dup *dup_func,
+                CRYPTO_EX_free *free_func);
+
+ int RSA_set_ex_data(RSA *r, int idx, void *arg);
+
+ void *RSA_get_ex_data(RSA *r, int idx);
+
+ int new_func(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+
+ void free_func(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+
+ int dup_func(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d, 
+                                        int idx, long argl, void *argp);
+
+=head1 DESCRIPTION
+
+Several OpenSSL structures can have application specific data attached to them.
+This has several potential uses, it can be used to cache data associated with
+a structure (for example the hash of some part of the structure) or some
+additional data (for example a handle to the data in an external library).
+
+Since the application data can be anything at all it is passed and retrieved
+as a B<void *> type.
+
+The B<RSA_get_ex_new_index()> function is initially called to "register" some
+new application specific data. It takes three optional function pointers which
+are called when the parent structure (in this case an RSA structure) is
+initially created, when it is copied and when it is freed up. If any or all of
+these function pointer arguments are not used they should be set to NULL. The
+precise manner in which these function pointers are called is described in more
+detail below. B<RSA_get_ex_new_index()> also takes additional long and pointer
+parameters which will be passed to the supplied functions but which otherwise
+have no special meaning. It returns an B<index> which should be stored
+(typically in a static variable) and passed used in the B<idx> parameter in
+the remaining functions. Each successful call to B<RSA_get_ex_new_index()>
+will return an index greater than any previously returned, this is important
+because the optional functions are called in order of increasing index value.
+
+B<RSA_set_ex_data()> is used to set application specific data, the data is
+supplied in the B<arg> parameter and its precise meaning is up to the
+application.
+
+B<RSA_get_ex_data()> is used to retrieve application specific data. The data
+is returned to the application, this will be the same value as supplied to
+a previous B<RSA_set_ex_data()> call.
+
+B<new_func()> is called when a structure is initially allocated (for example
+with B<RSA_new()>. The parent structure members will not have any meaningful
+values at this point. This function will typically be used to allocate any
+application specific structure.
+
+B<free_func()> is called when a structure is being freed up. The dynamic parent
+structure members should not be accessed because they will be freed up when
+this function is called.
+
+B<new_func()> and B<free_func()> take the same parameters. B<parent> is a
+pointer to the parent RSA structure. B<ptr> is a the application specific data
+(this wont be of much use in B<new_func()>. B<ad> is a pointer to the
+B<CRYPTO_EX_DATA> structure from the parent RSA structure: the functions
+B<CRYPTO_get_ex_data()> and B<CRYPTO_set_ex_data()> can be called to manipulate
+it. The B<idx> parameter is the index: this will be the same value returned by
+B<RSA_get_ex_new_index()> when the functions were initially registered. Finally
+the B<argl> and B<argp> parameters are the values originally passed to the same
+corresponding parameters when B<RSA_get_ex_new_index()> was called.
+
+B<dup_func()> is called when a structure is being copied. Pointers to the
+destination and source B<CRYPTO_EX_DATA> structures are passed in the B<to> and
+B<from> parameters respectively. The B<from_d> parameter is passed a pointer to
+the source application data when the function is called, when the function returns
+the value is copied to the destination: the application can thus modify the data
+pointed to by B<from_d> and have different values in the source and destination.
+The B<idx>, B<argl> and B<argp> parameters are the same as those in B<new_func()>
+and B<free_func()>.
+
+=head1 RETURN VALUES
+
+B<RSA_get_ex_new_index()> returns a new index or -1 on failure (note 0 is a valid
+index value).
+
+B<RSA_set_ex_data()> returns 1 on success or 0 on failure.
+
+B<RSA_get_ex_data()> returns the application data or 0 on failure. 0 may also
+be valid application data but currently it can only fail if given an invalid B<idx>
+parameter.
+
+B<new_func()> and B<dup_func()> should return 0 for failure and 1 for success.
+
+On failure an error code can be obtained from L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+B<dup_func()> is currently never called.
+
+The return value of B<new_func()> is ignored.
+
+The B<new_func()> function isn't very useful because no meaningful values are
+present in the parent RSA structure when it is called.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<CRYPTO_set_ex_data(3)|CRYPTO_set_ex_data(3)>
+
+=head1 HISTORY
+
+RSA_get_ex_new_index(), RSA_set_ex_data() and RSA_get_ex_data() are
+available since SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_new.pod b/src/lib/libssl/src/doc/crypto/RSA_new.pod
new file mode 100644
index 0000000000..f16490ea6a
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_new.pod
@@ -0,0 +1,38 @@
+=pod
+
+=head1 NAME
+
+RSA_new, RSA_free - allocate and free RSA objects
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ RSA * RSA_new(void);
+
+ void RSA_free(RSA *rsa);
+
+=head1 DESCRIPTION
+
+RSA_new() allocates and initializes an B<RSA> structure.
+
+RSA_free() frees the B<RSA> structure and its components. The key is
+erased before the memory is returned to the system.
+
+=head1 RETURN VALUES
+
+If the allocation fails, RSA_new() returns B<NULL> and sets an error
+code that can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>. Otherwise it returns
+a pointer to the newly allocated structure.
+
+RSA_free() returns no value.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<rsa(3)|rsa(3)>, L<RSA_generate_key(3)|RSA_generate_key(3)>
+
+=head1 HISTORY
+
+RSA_new() and RSA_free() are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_padding_add_PKCS1_type_1.pod b/src/lib/libssl/src/doc/crypto/RSA_padding_add_PKCS1_type_1.pod
new file mode 100644
index 0000000000..b8f678fe72
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_padding_add_PKCS1_type_1.pod
@@ -0,0 +1,124 @@
+=pod
+
+=head1 NAME
+
+RSA_padding_add_PKCS1_type_1, RSA_padding_check_PKCS1_type_1,
+RSA_padding_add_PKCS1_type_2, RSA_padding_check_PKCS1_type_2,
+RSA_padding_add_PKCS1_OAEP, RSA_padding_check_PKCS1_OAEP,
+RSA_padding_add_SSLv23, RSA_padding_check_SSLv23,
+RSA_padding_add_none, RSA_padding_check_none - asymmetric encryption
+padding
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
+    unsigned char *f, int fl);
+
+ int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len);
+
+ int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
+    unsigned char *f, int fl);
+
+ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len);
+
+ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
+    unsigned char *f, int fl, unsigned char *p, int pl);
+
+ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len, unsigned char *p, int pl);
+
+ int RSA_padding_add_SSLv23(unsigned char *to, int tlen,
+    unsigned char *f, int fl);
+
+ int RSA_padding_check_SSLv23(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len);
+
+ int RSA_padding_add_none(unsigned char *to, int tlen,
+    unsigned char *f, int fl);
+
+ int RSA_padding_check_none(unsigned char *to, int tlen,
+    unsigned char *f, int fl, int rsa_len);
+
+=head1 DESCRIPTION
+
+The RSA_padding_xxx_xxx() functions are called from the RSA encrypt,
+decrypt, sign and verify functions. Normally they should not be called
+from application programs.
+
+However, they can also be called directly to implement padding for other
+asymmetric ciphers. RSA_padding_add_PKCS1_OAEP() and
+RSA_padding_check_PKCS1_OAEP() may be used in an application combined
+with B<RSA_NO_PADDING> in order to implement OAEP with an encoding
+parameter.
+
+RSA_padding_add_xxx() encodes B<fl> bytes from B<f> so as to fit into
+B<tlen> bytes and stores the result at B<to>. An error occurs if B<fl>
+does not meet the size requirements of the encoding method.
+
+The following encoding methods are implemented:
+
+=over 4
+
+=item PKCS1_type_1
+
+PKCS #1 v2.0 EMSA-PKCS1-v1_5 (PKCS #1 v1.5 block type 1); used for signatures
+
+=item PKCS1_type_2
+
+PKCS #1 v2.0 EME-PKCS1-v1_5 (PKCS #1 v1.5 block type 2)
+
+=item PKCS1_OAEP
+
+PKCS #1 v2.0 EME-OAEP
+
+=item SSLv23
+
+PKCS #1 EME-PKCS1-v1_5 with SSL-specific modification
+
+=item none
+
+simply copy the data
+
+=back
+
+The random number generator must be seeded prior to calling
+RSA_padding_add_xxx().
+
+RSA_padding_check_xxx() verifies that the B<fl> bytes at B<f> contain
+a valid encoding for a B<rsa_len> byte RSA key in the respective
+encoding method and stores the recovered data of at most B<tlen> bytes
+(for B<RSA_NO_PADDING>: of size B<tlen>)
+at B<to>.
+
+For RSA_padding_xxx_OAEP(), B<p> points to the encoding parameter
+of length B<pl>. B<p> may be B<NULL> if B<pl> is 0.
+
+=head1 RETURN VALUES
+
+The RSA_padding_add_xxx() functions return 1 on success, 0 on error.
+The RSA_padding_check_xxx() functions return the length of the
+recovered data, -1 on error. Error codes can be obtained by calling
+L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<RSA_public_encrypt(3)|RSA_public_encrypt(3)>,
+L<RSA_private_decrypt(3)|RSA_private_decrypt(3)>,
+L<RSA_sign(3)|RSA_sign(3)>, L<RSA_verify(3)|RSA_verify(3)>
+
+=head1 HISTORY
+
+RSA_padding_add_PKCS1_type_1(), RSA_padding_check_PKCS1_type_1(),
+RSA_padding_add_PKCS1_type_2(), RSA_padding_check_PKCS1_type_2(),
+RSA_padding_add_SSLv23(), RSA_padding_check_SSLv23(),
+RSA_padding_add_none() and RSA_padding_check_none() appeared in
+SSLeay 0.9.0.
+
+RSA_padding_add_PKCS1_OAEP() and RSA_padding_check_PKCS1_OAEP() were
+added in OpenSSL 0.9.2b.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_print.pod b/src/lib/libssl/src/doc/crypto/RSA_print.pod
new file mode 100644
index 0000000000..dd968a5274
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_print.pod
@@ -0,0 +1,48 @@
+=pod
+
+=head1 NAME
+
+RSA_print, RSA_print_fp, DHparams_print, DHparams_print_fp - print
+cryptographic parameters
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_print(BIO *bp, RSA *x, int offset);
+ int RSA_print_fp(FILE *fp, RSA *x, int offset);
+
+ #include <openssl/dsa.h>
+
+ int DSAparams_print(BIO *bp, DSA *x);
+ int DSAparams_print_fp(FILE *fp, DSA *x);
+ int DSA_print(BIO *bp, DSA *x, int offset);
+ int DSA_print_fp(FILE *fp, DSA *x, int offset);
+
+ #include <openssl/dh.h>
+
+ int DHparams_print(BIO *bp, DH *x);
+ int DHparams_print_fp(FILE *fp, DH *x);
+
+=head1 DESCRIPTION
+
+A human-readable hexadecimal output of the components of the RSA
+key, DSA parameters or key or DH parameters is printed to B<bp> or B<fp>.
+
+The output lines are indented by B<offset> spaces.
+
+=head1 RETURN VALUES
+
+These functions return 1 on success, 0 on error.
+
+=head1 SEE ALSO
+
+L<dh(3)|dh(3)>, L<dsa(3)|dsa(3)>, L<rsa(3)|rsa(3)>, L<BN_bn2bin(3)|BN_bn2bin(3)>
+
+=head1 HISTORY
+
+RSA_print(), RSA_print_fp(), DSA_print(), DSA_print_fp(), DH_print(),
+DH_print_fp() are available in all versions of SSLeay and OpenSSL.
+DSAparams_print() and DSAparams_print_pf() were added in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_private_encrypt.pod b/src/lib/libssl/src/doc/crypto/RSA_private_encrypt.pod
new file mode 100644
index 0000000000..6861a98a10
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_private_encrypt.pod
@@ -0,0 +1,69 @@
+=pod
+
+=head1 NAME
+
+RSA_private_encrypt, RSA_public_decrypt - low level signature operations
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_private_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa, int padding);
+
+ int RSA_public_decrypt(int flen, unsigned char *from, 
+    unsigned char *to, RSA *rsa, int padding);
+
+=head1 DESCRIPTION
+
+These functions handle RSA signatures at a low level.
+
+RSA_private_encrypt() signs the B<flen> bytes at B<from> (usually a
+message digest with an algorithm identifier) using the private key
+B<rsa> and stores the signature in B<to>. B<to> must point to
+B<RSA_size(rsa)> bytes of memory.
+
+B<padding> denotes one of the following modes:
+
+=over 4
+
+=item RSA_PKCS1_PADDING
+
+PKCS #1 v1.5 padding. This function does not handle the
+B<algorithmIdentifier> specified in PKCS #1. When generating or
+verifying PKCS #1 signatures, L<RSA_sign(3)|RSA_sign(3)> and L<RSA_verify(3)|RSA_verify(3)> should be
+used.
+
+=item RSA_NO_PADDING
+
+Raw RSA signature. This mode should I<only> be used to implement
+cryptographically sound padding modes in the application code.
+Signing user data directly with RSA is insecure.
+
+=back
+
+RSA_public_decrypt() recovers the message digest from the B<flen>
+bytes long signature at B<from> using the signer's public key
+B<rsa>. B<to> must point to a memory section large enough to hold the
+message digest (which is smaller than B<RSA_size(rsa) -
+11>). B<padding> is the padding mode that was used to sign the data.
+
+=head1 RETURN VALUES
+
+RSA_private_encrypt() returns the size of the signature (i.e.,
+RSA_size(rsa)). RSA_public_decrypt() returns the size of the
+recovered message digest.
+
+On error, -1 is returned; the error codes can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<rsa(3)|rsa(3)>, L<RSA_sign(3)|RSA_sign(3)>, L<RSA_verify(3)|RSA_verify(3)>
+
+=head1 HISTORY
+
+The B<padding> argument was added in SSLeay 0.8. RSA_NO_PADDING is
+available since SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_public_encrypt.pod b/src/lib/libssl/src/doc/crypto/RSA_public_encrypt.pod
new file mode 100644
index 0000000000..910c4752b8
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_public_encrypt.pod
@@ -0,0 +1,86 @@
+=pod
+
+=head1 NAME
+
+RSA_public_encrypt, RSA_private_decrypt - RSA public key cryptography
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_public_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa, int padding);
+
+ int RSA_private_decrypt(int flen, unsigned char *from,
+     unsigned char *to, RSA *rsa, int padding);
+
+=head1 DESCRIPTION
+
+RSA_public_encrypt() encrypts the B<flen> bytes at B<from> (usually a
+session key) using the public key B<rsa> and stores the ciphertext in
+B<to>. B<to> must point to RSA_size(B<rsa>) bytes of memory.
+
+B<padding> denotes one of the following modes:
+
+=over 4
+
+=item RSA_PKCS1_PADDING
+
+PKCS #1 v1.5 padding. This currently is the most widely used mode.
+
+=item RSA_PKCS1_OAEP_PADDING
+
+EME-OAEP as defined in PKCS #1 v2.0 with SHA-1, MGF1 and an empty
+encoding parameter. This mode is recommended for all new applications.
+
+=item RSA_SSLV23_PADDING
+
+PKCS #1 v1.5 padding with an SSL-specific modification that denotes
+that the server is SSL3 capable.
+
+=item RSA_NO_PADDING
+
+Raw RSA encryption. This mode should I<only> be used to implement
+cryptographically sound padding modes in the application code.
+Encrypting user data directly with RSA is insecure.
+
+=back
+
+B<flen> must be less than RSA_size(B<rsa>) - 11 for the PKCS #1 v1.5
+based padding modes, and less than RSA_size(B<rsa>) - 21 for
+RSA_PKCS1_OAEP_PADDING. The random number generator must be seeded
+prior to calling RSA_public_encrypt().
+
+RSA_private_decrypt() decrypts the B<flen> bytes at B<from> using the
+private key B<rsa> and stores the plaintext in B<to>. B<to> must point
+to a memory section large enough to hold the decrypted data (which is
+smaller than RSA_size(B<rsa>)). B<padding> is the padding mode that
+was used to encrypt the data.
+
+=head1 RETURN VALUES
+
+RSA_public_encrypt() returns the size of the encrypted data (i.e.,
+RSA_size(B<rsa>)). RSA_private_decrypt() returns the size of the
+recovered plaintext.
+
+On error, -1 is returned; the error codes can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 CONFORMING TO
+
+SSL, PKCS #1 v2.0
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<RSA_size(3)|RSA_size(3)>
+
+=head1 NOTES
+
+The L<RSA_PKCS1_RSAref(3)|RSA_PKCS1_RSAref(3)> method supports only the RSA_PKCS1_PADDING mode.
+
+=head1 HISTORY
+
+The B<padding> argument was added in SSLeay 0.8. RSA_NO_PADDING is
+available since SSLeay 0.9.0, OAEP was added in OpenSSL 0.9.2b.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_set_method.pod b/src/lib/libssl/src/doc/crypto/RSA_set_method.pod
new file mode 100644
index 0000000000..deb1183a23
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_set_method.pod
@@ -0,0 +1,153 @@
+=pod
+
+=head1 NAME
+
+RSA_set_default_method, RSA_get_default_method, RSA_set_method,
+RSA_get_method, RSA_PKCS1_SSLeay, RSA_PKCS1_RSAref,
+RSA_PKCS1_null_method, RSA_flags, RSA_new_method - select RSA method
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ void RSA_set_default_method(RSA_METHOD *meth);
+
+ RSA_METHOD *RSA_get_default_method(void);
+
+ RSA_METHOD *RSA_set_method(RSA *rsa, RSA_METHOD *meth);
+
+ RSA_METHOD *RSA_get_method(RSA *rsa);
+
+ RSA_METHOD *RSA_PKCS1_SSLeay(void);
+
+ RSA_METHOD *RSA_PKCS1_RSAref(void);
+
+ RSA_METHOD *RSA_null_method(void);
+
+ int RSA_flags(RSA *rsa);
+
+ RSA *RSA_new_method(RSA_METHOD *method);
+
+=head1 DESCRIPTION
+
+An B<RSA_METHOD> specifies the functions that OpenSSL uses for RSA
+operations. By modifying the method, alternative implementations
+such as hardware accelerators may be used.
+
+Initially, the default is to use the OpenSSL internal implementation,
+unless OpenSSL was configured with the C<rsaref> or C<-DRSA_NULL>
+options. RSA_PKCS1_SSLeay() returns a pointer to that method.
+
+RSA_PKCS1_RSAref() returns a pointer to a method that uses the RSAref
+library. This is the default method in the C<rsaref> configuration;
+the function is not available in other configurations.
+RSA_null_method() returns a pointer to a method that does not support
+the RSA transformation. It is the default if OpenSSL is compiled with
+C<-DRSA_NULL>. These methods may be useful in the USA because of a
+patent on the RSA cryptosystem.
+
+RSA_set_default_method() makes B<meth> the default method for all B<RSA>
+structures created later.
+
+RSA_get_default_method() returns a pointer to the current default
+method.
+
+RSA_set_method() selects B<meth> for all operations using the key
+B<rsa>.
+
+RSA_get_method() returns a pointer to the method currently selected
+for B<rsa>.
+
+RSA_flags() returns the B<flags> that are set for B<rsa>'s current method.
+
+RSA_new_method() allocates and initializes an B<RSA> structure so that
+B<method> will be used for the RSA operations. If B<method> is B<NULL>,
+the default method is used.
+
+=head1 THE RSA_METHOD STRUCTURE
+
+ typedef struct rsa_meth_st
+ {
+     /* name of the implementation */
+        const char *name;
+
+     /* encrypt */
+        int (*rsa_pub_enc)(int flen, unsigned char *from,
+          unsigned char *to, RSA *rsa, int padding);
+
+     /* verify arbitrary data */
+        int (*rsa_pub_dec)(int flen, unsigned char *from,
+          unsigned char *to, RSA *rsa, int padding);
+
+     /* sign arbitrary data */
+        int (*rsa_priv_enc)(int flen, unsigned char *from,
+          unsigned char *to, RSA *rsa, int padding);
+
+     /* decrypt */
+        int (*rsa_priv_dec)(int flen, unsigned char *from,
+          unsigned char *to, RSA *rsa, int padding);
+
+     /* compute r0 = r0 ^ I mod rsa->n. May be NULL */
+        int (*rsa_mod_exp)(BIGNUM *r0, BIGNUM *I, RSA *rsa);
+
+     /* compute r = a ^ p mod m. May be NULL */
+        int (*bn_mod_exp)(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+
+     /* called at RSA_new */
+        int (*init)(RSA *rsa);
+
+     /* called at RSA_free */
+        int (*finish)(RSA *rsa);
+
+     /* RSA_FLAG_EXT_PKEY        - rsa_mod_exp is called for private key
+      *                            operations, even if p,q,dmp1,dmq1,iqmp
+      *                            are NULL
+      * RSA_FLAG_SIGN_VER        - enable rsa_sign and rsa_verify
+      * RSA_METHOD_FLAG_NO_CHECK - don't check pub/private match
+      */
+        int flags;
+
+        char *app_data; /* ?? */
+
+     /* sign. For backward compatibility, this is used only
+      * if (flags & RSA_FLAG_SIGN_VER)
+      */
+        int (*rsa_sign)(int type, unsigned char *m, unsigned int m_len,
+           unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+
+     /* verify. For backward compatibility, this is used only
+      * if (flags & RSA_FLAG_SIGN_VER)
+      */
+        int (*rsa_verify)(int type, unsigned char *m, unsigned int m_len,
+           unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+
+ } RSA_METHOD;
+
+=head1 RETURN VALUES
+
+RSA_PKCS1_SSLeay(), RSA_PKCS1_RSAref(), RSA_PKCS1_null_method(),
+RSA_get_default_method() and RSA_get_method() return pointers to the
+respective B<RSA_METHOD>s.
+
+RSA_set_default_method() returns no value.
+
+RSA_set_method() returns a pointer to the B<RSA_METHOD> previously
+associated with B<rsa>.
+
+RSA_new_method() returns B<NULL> and sets an error code that can be
+obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise it
+returns a pointer to the newly allocated structure.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<RSA_new(3)|RSA_new(3)>
+
+=head1 HISTORY
+
+RSA_new_method() and RSA_set_default_method() appeared in SSLeay 0.8.
+RSA_get_default_method(), RSA_set_method() and RSA_get_method() as
+well as the rsa_sign and rsa_verify components of RSA_METHOD were
+added in OpenSSL 0.9.4.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_sign.pod b/src/lib/libssl/src/doc/crypto/RSA_sign.pod
new file mode 100644
index 0000000000..f0bf6eea1b
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_sign.pod
@@ -0,0 +1,62 @@
+=pod
+
+=head1 NAME
+
+RSA_sign, RSA_verify - RSA signatures
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_sign(int type, unsigned char *m, unsigned int m_len,
+    unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+
+ int RSA_verify(int type, unsigned char *m, unsigned int m_len,
+    unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+
+=head1 DESCRIPTION
+
+RSA_sign() signs the message digest B<m> of size B<m_len> using the
+private key B<rsa> as specified in PKCS #1 v2.0. It stores the
+signature in B<sigret> and the signature size in B<siglen>. B<sigret>
+must point to RSA_size(B<rsa>) bytes of memory.
+
+B<type> denotes the message digest algorithm that was used to generate
+B<m>. It usually is one of B<NID_sha1>, B<NID_ripemd160> and B<NID_md5>;
+see L<objects(3)|objects(3)> for details. If B<type> is B<NID_md5_sha1>,
+an SSL signature (MD5 and SHA1 message digests with PKCS #1 padding
+and no algorithm identifier) is created.
+
+RSA_verify() verifies that the signature B<sigbuf> of size B<siglen>
+matches a given message digest B<m> of size B<m_len>. B<type> denotes
+the message digest algorithm that was used to generate the signature.
+B<rsa> is the signer's public key.
+
+=head1 RETURN VALUES
+
+RSA_sign() returns 1 on success, 0 otherwise.  RSA_verify() returns 1
+on successful verification, 0 otherwise.
+
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+Certain signatures with an improper algorithm identifier are accepted
+for compatibility with SSLeay 0.4.5 :-)
+
+=head1 CONFORMING TO
+
+SSL, PKCS #1 v2.0
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<objects(3)|objects(3)>, L<rsa(3)|rsa(3)>,
+L<RSA_private_encrypt(3)|RSA_private_encrypt(3)>,
+L<RSA_public_decrypt(3)|RSA_public_decrypt(3)> 
+
+=head1 HISTORY
+
+RSA_sign() and RSA_verify() are available in all versions of SSLeay
+and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod b/src/lib/libssl/src/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod
new file mode 100644
index 0000000000..df9ceb339a
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod
@@ -0,0 +1,59 @@
+=pod
+
+=head1 NAME
+
+RSA_sign_ASN1_OCTET_STRING, RSA_verify_ASN1_OCTET_STRING - RSA signatures
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_sign_ASN1_OCTET_STRING(int dummy, unsigned char *m,
+    unsigned int m_len, unsigned char *sigret, unsigned int *siglen,
+    RSA *rsa);
+
+ int RSA_verify_ASN1_OCTET_STRING(int dummy, unsigned char *m,
+    unsigned int m_len, unsigned char *sigbuf, unsigned int siglen,
+    RSA *rsa);
+
+=head1 DESCRIPTION
+
+RSA_sign_ASN1_OCTET_STRING() signs the octet string B<m> of size
+B<m_len> using the private key B<rsa> represented in DER using PKCS #1
+padding. It stores the signature in B<sigret> and the signature size
+in B<siglen>. B<sigret> must point to B<RSA_size(rsa)> bytes of
+memory.
+
+B<dummy> is ignored.
+
+The random number generator must be seeded prior to calling RSA_sign_ASN1_OCTET_STRING().
+
+RSA_verify_ASN1_OCTET_STRING() verifies that the signature B<sigbuf>
+of size B<siglen> is the DER representation of a given octet string
+B<m> of size B<m_len>. B<dummy> is ignored. B<rsa> is the signer's
+public key.
+
+=head1 RETURN VALUES
+
+RSA_sign_ASN1_OCTET_STRING() returns 1 on success, 0 otherwise.
+RSA_verify_ASN1_OCTET_STRING() returns 1 on successful verification, 0
+otherwise.
+
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 BUGS
+
+These functions serve no recognizable purpose.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>, L<objects(3)|objects(3)>, L<rand(3)|rand(3)>,
+L<rsa(3)|rsa(3)>, L<RSA_sign(3)|RSA_sign(3)>,
+L<RSA_verify(3)|RSA_verify(3)>
+
+=head1 HISTORY
+
+RSA_sign_ASN1_OCTET_STRING() and RSA_verify_ASN1_OCTET_STRING() were
+added in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_size.pod b/src/lib/libssl/src/doc/crypto/RSA_size.pod
new file mode 100644
index 0000000000..b36b4d58d5
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/RSA_size.pod
@@ -0,0 +1,33 @@
+=pod
+
+=head1 NAME
+
+RSA_size - get RSA modulus size
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ int RSA_size(RSA *rsa);
+
+=head1 DESCRIPTION
+
+This function returns the RSA modulus size in bytes. It can be used to
+determine how much memory must be allocated for an RSA encrypted
+value.
+
+B<rsa-E<gt>n> must not be B<NULL>.
+
+=head1 RETURN VALUE
+
+The size in bytes.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>
+
+=head1 HISTORY
+
+RSA_size() is available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/blowfish.pod b/src/lib/libssl/src/doc/crypto/blowfish.pod
new file mode 100644
index 0000000000..e8c7114311
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/blowfish.pod
@@ -0,0 +1,106 @@
+=pod
+
+=head1 NAME
+
+blowfish, BF_set_key, BF_encrypt, BF_decrypt, BF_ecb_encrypt, BF_cbc_encrypt,
+BF_cfb64_encrypt, BF_ofb64_encrypt, BF_options - Blowfish encryption
+
+=head1 SYNOPSIS
+
+ #include <openssl/blowfish.h>
+
+ void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
+
+ void BF_encrypt(BF_LONG *data,const BF_KEY *key);
+ void BF_decrypt(BF_LONG *data,const BF_KEY *key);
+ 
+ void BF_ecb_encrypt(const unsigned char *in, unsigned char *out,
+         BF_KEY *key, int enc);
+ void BF_cbc_encrypt(const unsigned char *in, unsigned char *out,
+         long length, BF_KEY *schedule, unsigned char *ivec, int enc);
+ void BF_cfb64_encrypt(const unsigned char *in, unsigned char *out,
+         long length, BF_KEY *schedule, unsigned char *ivec, int *num,
+         int enc);
+ void BF_ofb64_encrypt(const unsigned char *in, unsigned char *out,
+         long length, BF_KEY *schedule, unsigned char *ivec, int *num);
+ const char *BF_options(void);
+
+=head1 DESCRIPTION
+
+This library implements the Blowfish cipher, which is invented and described
+by Counterpane (see http://www.counterpane.com/blowfish/ ).
+
+Blowfish is a block cipher that operates on 64 bit (8 byte) blocks of data.
+It uses a variable size key, but typically, 128 bit (16 byte) keys are
+a considered good for strong encryption.  Blowfish can be used in the same
+modes as DES (see L<des_modes(7)|des_modes(7)>).  Blowfish is currently one
+of the faster block ciphers.  It is quite a bit faster than DES, and much
+faster than IDEA or RC2.
+
+Blowfish consists of a key setup phase and the actual encryption or decryption
+phase.
+
+BF_set_key() sets up the B<BF_KEY> B<key> using the B<len> bytes long key
+at B<data>.
+
+BF_encrypt() and BF_decrypt() are the lowest level functions for Blowfish
+encryption.  They encrypt/decrypt the first 64 bits of the vector pointed by
+B<data>, using the key B<key>.  These functions should not be used unless you
+implement 'modes' of Blowfish.
+
+BF_ecb_encrypt() is the basic Blowfish encryption and decryption function.
+It encrypts or decrypts the first 64 bits of B<in> using the key B<key>,
+putting the result in B<out>.  B<enc> decides if encryption (B<BF_ENCRYPT>)
+or decryption (B<BF_DECRYPT>) shall be performed.  The vector pointed at by
+B<in> and B<out> must be 64 bits in length, no less.  If they are larger,
+everything after the first 64 bits is ignored.
+
+The mode functions BF_cbc_encrypt(), BF_cfb64_encrypt() and BF_ofb64_encrypt()
+all operate on variable length data.  They all take an initialisation vector
+B<ivec> which must be initially filled with zeros, but then just need to be
+passed along into the next call of the same function for the same message. 
+BF_cbc_encrypt() operates of data that is a multiple of 8 bytes long, while
+BF_cfb64_encrypt() and BF_ofb64_encrypt() are used to encrypt an variable
+number of bytes (the amount does not have to be an exact multiple of 8).  The
+purpose of the latter two is to simulate stream ciphers, and therefore, they
+need the parameter B<num>, which is a pointer to an integer where the current
+offset in B<ivec> is stored between calls.  This integer must be initialised
+to zero when B<ivec> is filled with zeros.
+
+BF_cbc_encrypt() is the Cipher Block Chaining function for Blowfish.  It
+encrypts or decrypts the 64 bits chunks of B<in> using the key B<schedule>,
+putting the result in B<out>.  B<enc> decides if encryption (BF_ENCRYPT) or
+decryption (BF_DECRYPT) shall be performed.  B<ivec> must point at an 8 byte
+long initialisation vector, which must be initially filled with zeros.
+
+BF_cfb64_encrypt() is the CFB mode for Blowfish with 64 bit feedback.
+It encrypts or decrypts the bytes in B<in> using the key B<schedule>,
+putting the result in B<out>.  B<enc> decides if encryption (B<BF_ENCRYPT>)
+or decryption (B<BF_DECRYPT>) shall be performed.  B<ivec> must point at an
+8 byte long initialisation vector, which must be initially filled with zeros.
+B<num> must point at an integer which must be initially zero.
+
+BF_ofb64_encrypt() is the OFB mode for Blowfish with 64 bit feedback.
+It uses the same parameters as BF_cfb64_encrypt(), which must be initialised
+the same way.
+
+=head1 RETURN VALUES
+
+None of the functions presented here return any value.
+
+=head1 NOTE
+
+Applications should use the higher level functions
+L<EVP_EncryptInit(3)|EVP_EncryptInit(3)> etc. instead of calling the
+blowfish functions directly.
+
+=head1 SEE ALSO
+
+L<des_modes(7)|des_modes(7)>
+
+=head1 HISTORY
+
+The Blowfish functions are available in all versions of SSLeay and OpenSSL.
+
+=cut
+
diff --git a/src/lib/libssl/src/doc/crypto/bn.pod b/src/lib/libssl/src/doc/crypto/bn.pod
new file mode 100644
index 0000000000..1504a1c92d
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/bn.pod
@@ -0,0 +1,148 @@
+=pod
+
+=head1 NAME
+
+bn - multiprecision integer arithmetics
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BIGNUM *BN_new(void);
+ void BN_free(BIGNUM *a);
+ void BN_init(BIGNUM *);
+ void BN_clear(BIGNUM *a);
+ void BN_clear_free(BIGNUM *a);
+
+ BN_CTX *BN_CTX_new(void);
+ void BN_CTX_init(BN_CTX *c);
+ void BN_CTX_free(BN_CTX *c);
+
+ BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b);
+ BIGNUM *BN_dup(const BIGNUM *a);
+
+ int BN_num_bytes(const BIGNUM *a);
+ int BN_num_bits(const BIGNUM *a);
+ int BN_num_bits_word(BN_ULONG w);
+
+ int BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b);
+ int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
+ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
+ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *a, const BIGNUM *d,
+         BN_CTX *ctx);
+ int BN_sqr(BIGNUM *r, BIGNUM *a, BN_CTX *ctx);
+ int BN_mod(BIGNUM *rem, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
+ int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m,
+         BN_CTX *ctx);
+ int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx);
+ int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+         const BIGNUM *m, BN_CTX *ctx);
+ int BN_gcd(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
+
+ int BN_add_word(BIGNUM *a, BN_ULONG w);
+ int BN_sub_word(BIGNUM *a, BN_ULONG w);
+ int BN_mul_word(BIGNUM *a, BN_ULONG w);
+ BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w);
+ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w);
+
+ int BN_cmp(BIGNUM *a, BIGNUM *b);
+ int BN_ucmp(BIGNUM *a, BIGNUM *b);
+ int BN_is_zero(BIGNUM *a);
+ int BN_is_one(BIGNUM *a);
+ int BN_is_word(BIGNUM *a, BN_ULONG w);
+ int BN_is_odd(BIGNUM *a);
+
+ int BN_zero(BIGNUM *a);
+ int BN_one(BIGNUM *a);
+ BIGNUM *BN_value_one(void);
+ int BN_set_word(BIGNUM *a, unsigned long w);
+ unsigned long BN_get_word(BIGNUM *a);
+
+ int BN_rand(BIGNUM *rnd, int bits, int top, int bottom);
+ int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom);
+
+ BIGNUM *BN_generate_prime(BIGNUM *ret, int bits,int safe, BIGNUM *add,
+         BIGNUM *rem, void (*callback)(int, int, void *), void *cb_arg);
+ int BN_is_prime(const BIGNUM *p, int nchecks,
+         void (*callback)(int, int, void *), BN_CTX *ctx, void *cb_arg);
+
+ int BN_set_bit(BIGNUM *a, int n);
+ int BN_clear_bit(BIGNUM *a, int n);
+ int BN_is_bit_set(const BIGNUM *a, int n);
+ int BN_mask_bits(BIGNUM *a, int n);
+ int BN_lshift(BIGNUM *r, const BIGNUM *a, int n);
+ int BN_lshift1(BIGNUM *r, BIGNUM *a);
+ int BN_rshift(BIGNUM *r, BIGNUM *a, int n);
+ int BN_rshift1(BIGNUM *r, BIGNUM *a);
+
+ int BN_bn2bin(const BIGNUM *a, unsigned char *to);
+ BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret);
+ char *BN_bn2hex(const BIGNUM *a);
+ char *BN_bn2dec(const BIGNUM *a);
+ int BN_hex2bn(BIGNUM **a, const char *str);
+ int BN_dec2bn(BIGNUM **a, const char *str);
+ int BN_print(BIO *fp, const BIGNUM *a);
+ int BN_print_fp(FILE *fp, const BIGNUM *a);
+ int BN_bn2mpi(const BIGNUM *a, unsigned char *to);
+ BIGNUM *BN_mpi2bn(unsigned char *s, int len, BIGNUM *ret);
+
+ BIGNUM *BN_mod_inverse(BIGNUM *r, BIGNUM *a, const BIGNUM *n,
+     BN_CTX *ctx);
+
+ BN_RECP_CTX *BN_RECP_CTX_new(void);
+ void BN_RECP_CTX_init(BN_RECP_CTX *recp);
+ void BN_RECP_CTX_free(BN_RECP_CTX *recp);
+ int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *m, BN_CTX *ctx);
+ int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *a, BIGNUM *b,
+        BN_RECP_CTX *recp, BN_CTX *ctx);
+
+ BN_MONT_CTX *BN_MONT_CTX_new(void);
+ void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
+ void BN_MONT_CTX_free(BN_MONT_CTX *mont);
+ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *m, BN_CTX *ctx);
+ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from);
+ int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
+         BN_MONT_CTX *mont, BN_CTX *ctx);
+ int BN_from_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
+         BN_CTX *ctx);
+ int BN_to_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
+         BN_CTX *ctx);
+
+
+=head1 DESCRIPTION
+
+This library performs arithmetic operations on integers of arbitrary
+size. It was written for use in public key cryptography, such as RSA
+and Diffie-Hellman.
+
+It uses dynamic memory allocation for storing its data structures.
+That means that there is no limit on the size of the numbers
+manipulated by these functions, but return values must always be
+checked in case a memory allocation error has occurred.
+
+The basic object in this library is a B<BIGNUM>. It is used to hold a
+single large integer. This type should be considered opaque and fields
+should not be modified or accessed directly.
+
+The creation of B<BIGNUM> objects is described in L<BN_new(3)|BN_new(3)>;
+L<BN_add(3)|BN_add(3)> describes most of the arithmetic operations.
+Comparison is described in L<BN_cmp(3)|BN_cmp(3)>; L<BN_zero(3)|BN_zero(3)>
+describes certain assignments, L<BN_rand(3)|BN_rand(3)> the generation of
+random numbers, L<BN_generate_prime(3)|BN_generate_prime(3)> deals with prime
+numbers and L<BN_set_bit(3)|BN_set_bit(3)> with bit operations. The conversion
+of B<BIGNUM>s to external formats is described in L<BN_bn2bin(3)|BN_bn2bin(3)>.
+
+=head1 SEE ALSO
+
+L<bn_internal(3)|bn_internal(3)>,
+L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>,
+L<BN_new(3)|BN_new(3)>, L<BN_CTX_new(3)|BN_CTX_new(3)>,
+L<BN_copy(3)|BN_copy(3)>, L<BN_num_bytes(3)|BN_num_bytes(3)>,
+L<BN_add(3)|BN_add(3)>, L<BN_add_word(3)|BN_add_word(3)>,
+L<BN_cmp(3)|BN_cmp(3)>, L<BN_zero(3)|BN_zero(3)>, L<BN_rand(3)|BN_rand(3)>,
+L<BN_generate_prime(3)|BN_generate_prime(3)>, L<BN_set_bit(3)|BN_set_bit(3)>,
+L<BN_bn2bin(3)|BN_bn2bin(3)>, L<BN_mod_inverse(3)|BN_mod_inverse(3)>,
+L<BN_mod_mul_reciprocal(3)|BN_mod_mul_reciprocal(3)>,
+L<BN_mod_mul_montgomery(3)|BN_mod_mul_montgomery(3)> 
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/bn_internal.pod b/src/lib/libssl/src/doc/crypto/bn_internal.pod
new file mode 100644
index 0000000000..5af0c791c8
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/bn_internal.pod
@@ -0,0 +1,225 @@
+=pod
+
+=head1 NAME
+
+bn_mul_words, bn_mul_add_words, bn_sqr_words, bn_div_words,
+bn_add_words, bn_sub_words, bn_mul_comba4, bn_mul_comba8,
+bn_sqr_comba4, bn_sqr_comba8, bn_cmp_words, bn_mul_normal,
+bn_mul_low_normal, bn_mul_recursive, bn_mul_part_recursive,
+bn_mul_low_recursive, bn_mul_high, bn_sqr_normal, bn_sqr_recursive,
+bn_expand, bn_wexpand, bn_expand2, bn_fix_top, bn_check_top,
+bn_print, bn_dump, bn_set_max, bn_set_high, bn_set_low - BIGNUM
+library internal functions
+
+=head1 SYNOPSIS
+
+ BN_ULONG bn_mul_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
+ BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num,
+   BN_ULONG w);
+ void     bn_sqr_words(BN_ULONG *rp, BN_ULONG *ap, int num);
+ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d);
+ BN_ULONG bn_add_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,
+   int num);
+ BN_ULONG bn_sub_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,
+   int num);
+
+ void bn_mul_comba4(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b);
+ void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b);
+ void bn_sqr_comba4(BN_ULONG *r, BN_ULONG *a);
+ void bn_sqr_comba8(BN_ULONG *r, BN_ULONG *a);
+
+ int bn_cmp_words(BN_ULONG *a, BN_ULONG *b, int n);
+
+ void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b,
+   int nb);
+ void bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n);
+ void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
+   BN_ULONG *tmp);
+ void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b,
+   int tn, int n, BN_ULONG *tmp);
+ void bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b,
+   int n2, BN_ULONG *tmp);
+ void bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l,
+   int n2, BN_ULONG *tmp);
+
+ void bn_sqr_normal(BN_ULONG *r, BN_ULONG *a, int n, BN_ULONG *tmp);
+ void bn_sqr_recursive(BN_ULONG *r, BN_ULONG *a, int n2, BN_ULONG *tmp);
+
+ void mul(BN_ULONG r, BN_ULONG a, BN_ULONG w, BN_ULONG c);
+ void mul_add(BN_ULONG r, BN_ULONG a, BN_ULONG w, BN_ULONG c);
+ void sqr(BN_ULONG r0, BN_ULONG r1, BN_ULONG a);
+
+ BIGNUM *bn_expand(BIGNUM *a, int bits);
+ BIGNUM *bn_wexpand(BIGNUM *a, int n);
+ BIGNUM *bn_expand2(BIGNUM *a, int n);
+ void bn_fix_top(BIGNUM *a);
+
+ void bn_check_top(BIGNUM *a);
+ void bn_print(BIGNUM *a);
+ void bn_dump(BN_ULONG *d, int n);
+ void bn_set_max(BIGNUM *a);
+ void bn_set_high(BIGNUM *r, BIGNUM *a, int n);
+ void bn_set_low(BIGNUM *r, BIGNUM *a, int n);
+
+=head1 DESCRIPTION
+
+This page documents the internal functions used by the OpenSSL
+B<BIGNUM> implementation. They are described here to facilitate
+debugging and extending the library. They are I<not> to be used by
+applications.
+
+=head2 The BIGNUM structure
+
+ typedef struct bignum_st
+        {
+        int top;      /* index of last used d (most significant word) */
+        BN_ULONG *d;  /* pointer to an array of 'BITS2' bit chunks */
+        int max;      /* size of the d array */
+        int neg;      /* sign */
+        } BIGNUM;
+
+The big number is stored in B<d>, a malloc()ed array of B<BN_ULONG>s,
+least significant first. A B<BN_ULONG> can be either 16, 32 or 64 bits
+in size (B<BITS2>), depending on the 'number of bits' specified in
+C<openssl/bn.h>.
+
+B<max> is the size of the B<d> array that has been allocated.  B<top>
+is the 'last' entry being used, so for a value of 4, bn.d[0]=4 and
+bn.top=1.  B<neg> is 1 if the number is negative.  When a B<BIGNUM> is
+B<0>, the B<d> field can be B<NULL> and B<top> == B<0>.
+
+Various routines in this library require the use of temporary
+B<BIGNUM> variables during their execution.  Since dynamic memory
+allocation to create B<BIGNUM>s is rather expensive when used in
+conjunction with repeated subroutine calls, the B<BN_CTX> structure is
+used.  This structure contains B<BN_CTX_NUM> B<BIGNUM>s, see
+L<BN_CTX_start(3)|BN_CTX_start(3)>.
+
+=head2 Low-level arithmetic operations
+
+These functions are implemented in C and for several platforms in
+assembly language:
+
+bn_mul_words(B<rp>, B<ap>, B<num>, B<w>) operates on the B<num> word
+arrays B<rp> and B<ap>.  It computes B<ap> * B<w>, places the result
+in B<rp>, and returns the high word (carry).
+
+bn_mul_add_words(B<rp>, B<ap>, B<num>, B<w>) operates on the B<num>
+word arrays B<rp> and B<ap>.  It computes B<ap> * B<w> + B<rp>, places
+the result in B<rp>, and returns the high word (carry).
+
+bn_sqr_words(B<rp>, B<ap>, B<n>) operates on the B<num> word array
+B<ap> and the 2*B<num> word array B<ap>.  It computes B<ap> * B<ap>
+word-wise, and places the low and high bytes of the result in B<rp>.
+
+bn_div_words(B<h>, B<l>, B<d>) divides the two word number (B<h>,B<l>)
+by B<d> and returns the result.
+
+bn_add_words(B<rp>, B<ap>, B<bp>, B<num>) operates on the B<num> word
+arrays B<ap>, B<bp> and B<rp>.  It computes B<ap> + B<bp>, places the
+result in B<rp>, and returns the high word (carry).
+
+bn_sub_words(B<rp>, B<ap>, B<bp>, B<num>) operates on the B<num> word
+arrays B<ap>, B<bp> and B<rp>.  It computes B<ap> - B<bp>, places the
+result in B<rp>, and returns the carry (1 if B<bp> E<gt> B<ap>, 0
+otherwise).
+
+bn_mul_comba4(B<r>, B<a>, B<b>) operates on the 4 word arrays B<a> and
+B<b> and the 8 word array B<r>.  It computes B<a>*B<b> and places the
+result in B<r>.
+
+bn_mul_comba8(B<r>, B<a>, B<b>) operates on the 8 word arrays B<a> and
+B<b> and the 16 word array B<r>.  It computes B<a>*B<b> and places the
+result in B<r>.
+
+bn_sqr_comba4(B<r>, B<a>, B<b>) operates on the 4 word arrays B<a> and
+B<b> and the 8 word array B<r>.
+
+bn_sqr_comba8(B<r>, B<a>, B<b>) operates on the 8 word arrays B<a> and
+B<b> and the 16 word array B<r>.
+
+The following functions are implemented in C:
+
+bn_cmp_words(B<a>, B<b>, B<n>) operates on the B<n> word arrays B<a>
+and B<b>.  It returns 1, 0 and -1 if B<a> is greater than, equal and
+less than B<b>.
+
+bn_mul_normal(B<r>, B<a>, B<na>, B<b>, B<nb>) operates on the B<na>
+word array B<a>, the B<nb> word array B<b> and the B<na>+B<nb> word
+array B<r>.  It computes B<a>*B<b> and places the result in B<r>.
+
+bn_mul_low_normal(B<r>, B<a>, B<b>, B<n>) operates on the B<n> word
+arrays B<r>, B<a> und B<b>.  It computes the B<n> low words of
+B<a>*B<b> and places the result in B<r>.
+
+bn_mul_recursive(B<r>, B<a>, B<b>, B<n2>, B<t>) operates on the B<n2>
+word arrays B<a> and B<b> and the 2*B<n2> word arrays B<r> and B<t>.
+B<n2> must be a power of 2.  It computes B<a>*B<b> and places the
+result in B<r>.
+
+bn_mul_part_recursive(B<r>, B<a>, B<b>, B<tn>, B<n>, B<tmp>) operates
+on the B<n>+B<tn> word arrays B<a> and B<b> and the 4*B<n> word arrays
+B<r> and B<tmp>.
+
+bn_mul_low_recursive(B<r>, B<a>, B<b>, B<n2>, B<tmp>) operates on the
+B<n2> word arrays B<r> and B<tmp> and the B<n2>/2 word arrays B<a>
+and B<b>.
+
+bn_mul_high(B<r>, B<a>, B<b>, B<l>, B<n2>, B<tmp>) operates on the
+B<n2> word arrays B<r>, B<a>, B<b> and B<l> (?) and the 3*B<n2> word
+array B<tmp>.
+
+BN_mul() calls bn_mul_normal(), or an optimized implementation if the
+factors have the same size: bn_mul_comba8() is used if they are 8
+words long, bn_mul_recursive() if they are larger than
+B<BN_MULL_SIZE_NORMAL> and the size is an exact multiple of the word
+size, and bn_mul_part_recursive() for others that are larger than
+B<BN_MULL_SIZE_NORMAL>.
+
+bn_sqr_normal(B<r>, B<a>, B<n>, B<tmp>) operates on the B<n> word array
+B<a> and the 2*B<n> word arrays B<tmp> and B<r>.
+
+The implementations use the following macros which, depending on the
+architecture, may use "long long" C operations or inline assembler.
+They are defined in C<bn_lcl.h>.
+
+mul(B<r>, B<a>, B<w>, B<c>) computes B<w>*B<a>+B<c> and places the
+low word of the result in B<r> and the high word in B<c>.
+
+mul_add(B<r>, B<a>, B<w>, B<c>) computes B<w>*B<a>+B<r>+B<c> and
+places the low word of the result in B<r> and the high word in B<c>.
+
+sqr(B<r0>, B<r1>, B<a>) computes B<a>*B<a> and places the low word
+of the result in B<r0> and the high word in B<r1>.
+
+=head2 Size changes
+
+bn_expand() ensures that B<b> has enough space for a B<bits> bit
+number.  bn_wexpand() ensures that B<b> has enough space for an
+B<n> word number.  If the number has to be expanded, both macros
+call bn_expand2(), which allocates a new B<d> array and copies the
+data.  They return B<NULL> on error, B<b> otherwise.
+
+The bn_fix_top() macro reduces B<a-E<gt>top> to point to the most
+significant non-zero word when B<a> has shrunk.
+
+=head2 Debugging
+
+bn_check_top() verifies that C<((a)-E<gt>top E<gt>= 0 && (a)-E<gt>top
+E<lt>= (a)-E<gt>max)>.  A violation will cause the program to abort.
+
+bn_print() prints B<a> to stderr. bn_dump() prints B<n> words at B<d>
+(in reverse order, i.e. most significant word first) to stderr.
+
+bn_set_max() makes B<a> a static number with a B<max> of its current size.
+This is used by bn_set_low() and bn_set_high() to make B<r> a read-only
+B<BIGNUM> that contains the B<n> low or high words of B<a>.
+
+If B<BN_DEBUG> is not defined, bn_check_top(), bn_print(), bn_dump()
+and bn_set_max() are defined as empty macros.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/buffer.pod b/src/lib/libssl/src/doc/crypto/buffer.pod
new file mode 100644
index 0000000000..7088f51bc4
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/buffer.pod
@@ -0,0 +1,73 @@
+=pod
+
+=head1 NAME
+
+BUF_MEM_new, BUF_MEM_free, BUF_MEM_grow, BUF_strdup - simple
+character arrays structure
+
+=head1 SYNOPSIS
+
+ #include <openssl/buffer.h>
+
+ BUF_MEM *BUF_MEM_new(void);
+
+ void   BUF_MEM_free(BUF_MEM *a);
+
+ int    BUF_MEM_grow(BUF_MEM *str, int len);
+
+ char * BUF_strdup(const char *str);
+
+=head1 DESCRIPTION
+
+The buffer library handles simple character arrays. Buffers are used for
+various purposes in the library, most notably memory BIOs.
+
+The library uses the BUF_MEM structure defined in buffer.h:
+
+ typedef struct buf_mem_st
+ {
+        int length;     /* current number of bytes */
+        char *data;
+        int max;        /* size of buffer */
+ } BUF_MEM;
+
+B<length> is the current size of the buffer in bytes, B<max> is the amount of
+memory allocated to the buffer. There are three functions which handle these
+and one "miscellaneous" function.
+
+BUF_MEM_new() allocates a new buffer of zero size.
+
+BUF_MEM_free() frees up an already existing buffer. The data is zeroed
+before freeing up in case the buffer contains sensitive data.
+
+BUF_MEM_grow() changes the size of an already existing buffer to
+B<len>. Any data already in the buffer is preserved if it increases in
+size.
+
+BUF_strdup() copies a null terminated string into a block of allocated
+memory and returns a pointer to the allocated block.
+Unlike the standard C library strdup() this function uses Malloc() and so
+should be used in preference to the standard library strdup() because it can
+be used for memory leak checking or replacing the malloc() function.
+
+The memory allocated from BUF_strdup() should be freed up using the Free()
+function.
+
+=head1 RETURN VALUES
+
+BUF_MEM_new() returns the buffer or NULL on error.
+
+BUF_MEM_free() has no return value.
+
+BUF_MEM_grow() returns zero on error or the new size (i.e. B<len>).
+
+=head1 SEE ALSO
+
+L<bio(3)|bio(3)>
+
+=head1 HISTORY
+
+BUF_MEM_new(), BUF_MEM_free() and BUF_MEM_grow() are available in all
+versions of SSLeay and OpenSSL. BUF_strdup() was addded in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/crypto.pod b/src/lib/libssl/src/doc/crypto/crypto.pod
new file mode 100644
index 0000000000..4b9ceacd91
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/crypto.pod
@@ -0,0 +1,67 @@
+=pod
+
+=head1 NAME
+
+crypto - OpenSSL cryptographic library
+
+=head1 SYNOPSIS
+
+=head1 DESCRIPTION
+
+The OpenSSL B<crypto> library implements a wide range of cryptographic
+algorithms used in various Internet standards. The services provided
+by this library are used by the OpenSSL implementations of SSL, TLS
+and S/MIME, and they have also been used to implement SSH, OpenPGP, and
+other cryptographic standards.
+
+=head1 OVERVIEW
+
+B<libcrypto> consists of a number of sub-libraries that implement the
+individual algorithms.
+
+The functionality includes symmetric encryption, public key
+cryptography and key agreement, certificate handling, cryptographic
+hash functions and a cryptographic pseudo-random number generator.
+
+=over 4
+
+=item SYMMETRIC CIPHERS
+
+L<blowfish(3)|blowfish(3)>, L<cast(3)|cast(3)>, L<des(3)|des(3)>,
+L<idea(3)|idea(3)>, L<rc2(3)|rc2(3)>, L<rc4(3)|rc4(3)>, L<rc5(3)|rc5(3)> 
+
+=item PUBLIC KEY CRYPTOGRAPHY AND KEY AGREEMENT
+
+L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>, L<rsa(3)|rsa(3)>
+
+=item CERTIFICATES
+
+L<x509(3)|x509(3)>, L<x509v3(3)|x509v3(3)>
+
+=item AUTHENTICATION CODES, HASH FUNCTIONS
+
+L<hmac(3)|hmac(3)>, L<md2(3)|md2(3)>, L<md5(3)|md5(3)>, L<mdc2(3)|mdc2(3)>,
+L<ripemd(3)|ripemd(3)>, L<sha(3)|sha(3)> 
+
+=item AUXILIARY FUNCTIONS
+
+L<err(3)|err(3)>, L<threads(3)|threads(3)>, L<rand(3)|rand(3)>
+
+=item INPUT/OUTPUT, DATA ENCODING
+
+L<asn1(3)|asn1(3)>, L<bio(3)|bio(3)>, L<evp(3)|evp(3)>, L<pem(3)|pem(3)>,
+L<pkcs7(3)|pkcs7(3)>, L<pkcs12(3)|pkcs12(3)> 
+
+=item INTERNAL FUNCTIONS
+
+L<bn(3)|bn(3)>, L<buffer(3)|buffer(3)>, L<lhash(3)|lhash(3)>,
+L<objects(3)|objects(3)>, L<stack(3)|stack(3)>,
+L<txt_db(3)|txt_db(3)> 
+
+=back
+
+=head1 SEE ALSO
+
+L<openssl(1)|openssl(1)>, L<ssl(3)|ssl(3)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/d2i_DHparams.pod b/src/lib/libssl/src/doc/crypto/d2i_DHparams.pod
new file mode 100644
index 0000000000..a6d1743d39
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/d2i_DHparams.pod
@@ -0,0 +1,30 @@
+=pod
+
+=head1 NAME
+
+d2i_DHparams, i2d_DHparams - ...
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ DH *d2i_DHparams(DH **a, unsigned char **pp, long length);
+ int i2d_DHparams(DH *a, unsigned char **pp);
+
+=head1 DESCRIPTION
+
+...
+
+=head1 RETURN VALUES
+
+...
+
+=head1 SEE ALSO
+
+...
+
+=head1 HISTORY
+
+...
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/d2i_RSAPublicKey.pod b/src/lib/libssl/src/doc/crypto/d2i_RSAPublicKey.pod
new file mode 100644
index 0000000000..ff4d0d57db
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/d2i_RSAPublicKey.pod
@@ -0,0 +1,39 @@
+=pod
+
+=head1 NAME
+
+d2i_RSAPublicKey, i2d_RSAPublicKey, d2i_RSAPrivateKey, i2d_RSAPrivateKey, i2d_Netscape_RSA, d2i_Netscape_RSA - ...
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ RSA * d2i_RSAPublicKey(RSA **a, unsigned char **pp, long length);
+
+ int i2d_RSAPublicKey(RSA *a, unsigned char **pp);
+
+ RSA * d2i_RSAPrivateKey(RSA **a, unsigned char **pp, long length);
+
+ int i2d_RSAPrivateKey(RSA *a, unsigned char **pp);
+
+ int i2d_Netscape_RSA(RSA *a, unsigned char **pp, int (*cb)());
+
+ RSA * d2i_Netscape_RSA(RSA **a, unsigned char **pp, long length, int (*cb)());
+
+=head1 DESCRIPTION
+
+...
+
+=head1 RETURN VALUES
+
+...
+
+=head1 SEE ALSO
+
+...
+
+=head1 HISTORY
+
+...
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/des_modes.pod b/src/lib/libssl/src/doc/crypto/des_modes.pod
new file mode 100644
index 0000000000..d8148c86fc
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/des_modes.pod
@@ -0,0 +1,250 @@
+=pod
+
+=head1 NAME
+
+Modes of DES - the variants of DES and other crypto algorithms of OpenSSL
+
+=head1 DESCRIPTION
+
+Several crypto algorithms fo OpenSSL can be used in a number of modes.  Those
+are used for using block ciphers in a way similar to stream ciphers, among
+other things.
+
+=head1 OVERVIEW
+
+=head2 Electronic Codebook Mode (ECB)
+
+Normally, this is found as the function I<algorithm>_ecb_encrypt().
+
+=over 2
+
+=item *
+
+64 bits are enciphered at a time.
+
+=item *
+
+The order of the blocks can be rearranged without detection.
+
+=item *
+
+The same plaintext block always produces the same ciphertext block
+(for the same key) making it vulnerable to a 'dictionary attack'.
+
+=item *
+
+An error will only affect one ciphertext block.
+
+=back
+
+=head2 Cipher Block Chaining Mode (CBC)
+
+Normally, this is found as the function I<algorithm>_cbc_encrypt().
+Be aware that des_cbc_encrypt() is not really DES CBC (it does
+not update the IV); use des_ncbc_encrypt() instead.
+
+=over 2
+
+=item *
+
+a multiple of 64 bits are enciphered at a time.
+
+=item *
+
+The CBC mode produces the same ciphertext whenever the same
+plaintext is encrypted using the same key and starting variable.
+
+=item *
+
+The chaining operation makes the ciphertext blocks dependent on the
+current and all preceding plaintext blocks and therefore blocks can not
+be rearranged.
+
+=item *
+
+The use of different starting variables prevents the same plaintext
+enciphering to the same ciphertext.
+
+=item *
+
+An error will affect the current and the following ciphertext blocks.
+
+=back
+
+=head2 Cipher Feedback Mode (CFB)
+
+Normally, this is found as the function I<algorithm>_cfb_encrypt().
+
+=over 2
+
+=item *
+
+a number of bits (j) <= 64 are enciphered at a time.
+
+=item *
+
+The CFB mode produces the same ciphertext whenever the same
+plaintext is encrypted using the same key and starting variable.
+
+=item *
+
+The chaining operation makes the ciphertext variables dependent on the
+current and all preceding variables and therefore j-bit variables are
+chained together and can not be rearranged.
+
+=item *
+
+The use of different starting variables prevents the same plaintext
+enciphering to the same ciphertext.
+
+=item *
+
+The strength of the CFB mode depends on the size of k (maximal if
+j == k).  In my implementation this is always the case.
+
+=item *
+
+Selection of a small value for j will require more cycles through
+the encipherment algorithm per unit of plaintext and thus cause
+greater processing overheads.
+
+=item *
+
+Only multiples of j bits can be enciphered.
+
+=item *
+
+An error will affect the current and the following ciphertext variables.
+
+=back
+
+=head2 Output Feedback Mode (OFB)
+
+Normally, this is found as the function I<algorithm>_ofb_encrypt().
+
+=over 2
+
+
+=item *
+
+a number of bits (j) <= 64 are enciphered at a time.
+
+=item *
+
+The OFB mode produces the same ciphertext whenever the same
+plaintext enciphered using the same key and starting variable.  More
+over, in the OFB mode the same key stream is produced when the same
+key and start variable are used.  Consequently, for security reasons
+a specific start variable should be used only once for a given key.
+
+=item *
+
+The absence of chaining makes the OFB more vulnerable to specific attacks.
+
+=item *
+
+The use of different start variables values prevents the same
+plaintext enciphering to the same ciphertext, by producing different
+key streams.
+
+=item *
+
+Selection of a small value for j will require more cycles through
+the encipherment algorithm per unit of plaintext and thus cause
+greater processing overheads.
+
+=item *
+
+Only multiples of j bits can be enciphered.
+
+=item *
+
+OFB mode of operation does not extend ciphertext errors in the
+resultant plaintext output.  Every bit error in the ciphertext causes
+only one bit to be in error in the deciphered plaintext.
+
+=item *
+
+OFB mode is not self-synchronising.  If the two operation of
+encipherment and decipherment get out of synchronism, the system needs
+to be re-initialised.
+
+=item *
+
+Each re-initialisation should use a value of the start variable
+different from the start variable values used before with the same
+key.  The reason for this is that an identical bit stream would be
+produced each time from the same parameters.  This would be
+susceptible to a 'known plaintext' attack.
+
+=back
+
+=head2 Triple ECB Mode
+
+Normally, this is found as the function I<algorithm>_ecb3_encrypt().
+
+=over 2
+
+=item *
+
+Encrypt with key1, decrypt with key2 and encrypt with key3 again.
+
+=item *
+
+As for ECB encryption but increases the key length to 168 bits.
+There are theoretic attacks that can be used that make the effective
+key length 112 bits, but this attack also requires 2^56 blocks of
+memory, not very likely, even for the NSA.
+
+=item *
+
+If both keys are the same it is equivalent to encrypting once with
+just one key.
+
+=item *
+
+If the first and last key are the same, the key length is 112 bits.
+There are attacks that could reduce the key space to 55 bit's but it
+requires 2^56 blocks of memory.
+
+=item *
+
+If all 3 keys are the same, this is effectively the same as normal
+ecb mode.
+
+=back
+
+=head2 Triple CBC Mode
+
+Normally, this is found as the function I<algorithm>_ede3_cbc_encrypt().
+
+=over 2
+
+
+=item *
+
+Encrypt with key1, decrypt with key2 and then encrypt with key3.
+
+=item *
+
+As for CBC encryption but increases the key length to 168 bits with
+the same restrictions as for triple ecb mode.
+
+=back
+
+=head1 NOTES
+
+This text was been written in large parts by Eric Young in his original
+documentation for SSLeay, the predecessor of OpenSSL.  In turn, he attributed
+it to:
+
+        AS 2805.5.2
+        Australian Standard
+        Electronic funds transfer - Requirements for interfaces,
+        Part 5.2: Modes of operation for an n-bit block cipher algorithm
+        Appendix A
+
+=head1 SEE ALSO
+
+L<blowfish(3)|blowfish(3)>, L<des(3)|des(3)>, L<idea(3)|idea(3)>,
+L<rc2(3)|rc2(3)>
diff --git a/src/lib/libssl/src/doc/crypto/dh.pod b/src/lib/libssl/src/doc/crypto/dh.pod
new file mode 100644
index 0000000000..0a9b7c03a2
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/dh.pod
@@ -0,0 +1,68 @@
+=pod
+
+=head1 NAME
+
+dh - Diffie-Hellman key agreement
+
+=head1 SYNOPSIS
+
+ #include <openssl/dh.h>
+
+ DH *   DH_new(void);
+ void   DH_free(DH *dh);
+
+ int    DH_size(DH *dh);
+
+ DH *   DH_generate_parameters(int prime_len, int generator,
+                void (*callback)(int, int, void *), void *cb_arg);
+ int    DH_check(DH *dh, int *codes);
+
+ int    DH_generate_key(DH *dh);
+ int    DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh);
+
+ void DH_set_default_method(DH_METHOD *meth);
+ DH_METHOD *DH_get_default_method(void);
+ DH_METHOD *DH_set_method(DH *dh, DH_METHOD *meth);
+ DH *DH_new_method(DH_METHOD *meth);
+ DH_METHOD *DH_OpenSSL(void);
+
+ int DH_get_ex_new_index(long argl, char *argp, int (*new_func)(),
+             int (*dup_func)(), void (*free_func)());
+ int DH_set_ex_data(DH *d, int idx, char *arg);
+ char *DH_get_ex_data(DH *d, int idx);
+
+ DH *   d2i_DHparams(DH **a, unsigned char **pp, long length);
+ int    i2d_DHparams(DH *a, unsigned char **pp);
+
+ int    DHparams_print_fp(FILE *fp, DH *x);
+ int    DHparams_print(BIO *bp, DH *x);
+
+=head1 DESCRIPTION
+
+These functions implement the Diffie-Hellman key agreement protocol.
+The generation of shared DH parameters is described in
+L<DH_generate_parameters(3)|DH_generate_parameters(3)>; L<DH_generate_key(3)|DH_generate_key(3)> describes how
+to perform a key agreement.
+
+The B<DH> structure consists of several BIGNUM components.
+
+ struct
+        {
+        BIGNUM *p;              // prime number (shared)
+        BIGNUM *g;              // generator of Z_p (shared)
+        BIGNUM *priv_key;       // private DH value x
+        BIGNUM *pub_key;        // public DH value g^x
+        // ...
+        };
+ DH
+
+=head1 SEE ALSO
+
+L<dhparam(1)|dhparam(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<err(3)|err(3)>,
+L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<DH_set_method(3)|DH_set_method(3)>,
+L<DH_new(3)|DH_new(3)>, L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>,
+L<DH_generate_parameters(3)|DH_generate_parameters(3)>,
+L<DH_compute_key(3)|DH_compute_key(3)>, L<d2i_DHparams(3)|d2i_DHparams(3)>,
+L<RSA_print(3)|RSA_print(3)> 
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/dsa.pod b/src/lib/libssl/src/doc/crypto/dsa.pod
new file mode 100644
index 0000000000..2c09244899
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/dsa.pod
@@ -0,0 +1,104 @@
+=pod
+
+=head1 NAME
+
+dsa - Digital Signature Algorithm
+
+=head1 SYNOPSIS
+
+ #include <openssl/dsa.h>
+
+ DSA *  DSA_new(void);
+ void   DSA_free(DSA *dsa);
+
+ int    DSA_size(DSA *dsa);
+
+ DSA *  DSA_generate_parameters(int bits, unsigned char *seed,
+                int seed_len, int *counter_ret, unsigned long *h_ret,
+                void (*callback)(int, int, void *), void *cb_arg);
+
+ DH *   DSA_dup_DH(DSA *r);
+
+ int    DSA_generate_key(DSA *dsa);
+
+ int    DSA_sign(int dummy, const unsigned char *dgst, int len,
+                unsigned char *sigret, unsigned int *siglen, DSA *dsa);
+ int    DSA_sign_setup(DSA *dsa, BN_CTX *ctx, BIGNUM **kinvp,
+                BIGNUM **rp);
+ int    DSA_verify(int dummy, const unsigned char *dgst, int len,
+                unsigned char *sigbuf, int siglen, DSA *dsa);
+
+ void DSA_set_default_method(DSA_METHOD *meth);
+ DSA_METHOD *DSA_get_default_method(void);
+ DSA_METHOD *DSA_set_method(DSA *dsa, DSA_METHOD *meth);
+ DSA *DSA_new_method(DSA_METHOD *meth);
+ DSA_METHOD *DSA_OpenSSL(void);
+
+ int DSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
+             int (*dup_func)(), void (*free_func)());
+ int DSA_set_ex_data(DSA *d, int idx, char *arg);
+ char *DSA_get_ex_data(DSA *d, int idx);
+
+ DSA_SIG *DSA_SIG_new(void);
+ void   DSA_SIG_free(DSA_SIG *a);
+ int    i2d_DSA_SIG(DSA_SIG *a, unsigned char **pp);
+ DSA_SIG *d2i_DSA_SIG(DSA_SIG **v, unsigned char **pp, long length);
+
+ DSA_SIG *DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+ int    DSA_do_verify(const unsigned char *dgst, int dgst_len,
+             DSA_SIG *sig, DSA *dsa);
+
+ DSA *  d2i_DSAPublicKey(DSA **a, unsigned char **pp, long length);
+ DSA *  d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length);
+ DSA *  d2i_DSAparams(DSA **a, unsigned char **pp, long length);
+ int    i2d_DSAPublicKey(DSA *a, unsigned char **pp);
+ int    i2d_DSAPrivateKey(DSA *a, unsigned char **pp);
+ int    i2d_DSAparams(DSA *a,unsigned char **pp);
+
+ int    DSAparams_print(BIO *bp, DSA *x);
+ int    DSAparams_print_fp(FILE *fp, DSA *x);
+ int    DSA_print(BIO *bp, DSA *x, int off);
+ int    DSA_print_fp(FILE *bp, DSA *x, int off);
+
+=head1 DESCRIPTION
+
+These functions implement the Digital Signature Algorithm (DSA).  The
+generation of shared DSA parameters is described in
+L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>;
+L<DSA_generate_key(3)|DSA_generate_key(3)> describes how to
+generate a signature key. Signature generation and verification are
+described in L<DSA_sign(3)|DSA_sign(3)>.
+
+The B<DSA> structure consists of several BIGNUM components.
+
+ struct
+        {
+        BIGNUM *p;              // prime number (public)
+        BIGNUM *q;              // 160-bit subprime, q | p-1 (public)
+        BIGNUM *g;              // generator of subgroup (public)
+        BIGNUM *priv_key;       // private key x
+        BIGNUM *pub_key;        // public key y = g^x
+        // ...
+        }
+ DSA;
+
+In public keys, B<priv_key> is NULL.
+
+=head1 CONFORMING TO
+
+US Federal Information Processing Standard FIPS 186 (Digital Signature
+Standard, DSS), ANSI X9.30
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>, L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
+L<rsa(3)|rsa(3)>, L<sha(3)|sha(3)>, L<DSA_new(3)|DSA_new(3)>,
+L<DSA_size(3)|DSA_size(3)>,
+L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>,
+L<DSA_dup_DH(3)|DSA_dup_DH(3)>,
+L<DSA_generate_key(3)|DSA_generate_key(3)>,
+L<DSA_sign(3)|DSA_sign(3)>, L<DSA_set_method(3)|DSA_set_method(3)>,
+L<DSA_get_ex_new_index(3)|DSA_get_ex_new_index(3)>,
+L<RSA_print(3)|RSA_print(3)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/err.pod b/src/lib/libssl/src/doc/crypto/err.pod
new file mode 100644
index 0000000000..b824c92b57
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/err.pod
@@ -0,0 +1,187 @@
+=pod
+
+=head1 NAME
+
+err - error codes
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ unsigned long ERR_get_error(void);
+ unsigned long ERR_peek_error(void);
+ unsigned long ERR_get_error_line(const char **file, int *line);
+ unsigned long ERR_peek_error_line(const char **file, int *line);
+ unsigned long ERR_get_error_line_data(const char **file, int *line,
+         const char **data, int *flags);
+ unsigned long ERR_peek_error_line_data(const char **file, int *line,
+         const char **data, int *flags);
+
+ int ERR_GET_LIB(unsigned long e);
+ int ERR_GET_FUNC(unsigned long e);
+ int ERR_GET_REASON(unsigned long e);
+
+ void ERR_clear_error(void);
+
+ char *ERR_error_string(unsigned long e, char *buf);
+ const char *ERR_lib_error_string(unsigned long e);
+ const char *ERR_func_error_string(unsigned long e);
+ const char *ERR_reason_error_string(unsigned long e);
+
+ void ERR_print_errors(BIO *bp);
+ void ERR_print_errors_fp(FILE *fp);
+
+ void ERR_load_crypto_strings(void);
+ void ERR_free_strings(void);
+
+ void ERR_remove_state(unsigned long pid);
+
+ void ERR_put_error(int lib, int func, int reason, const char *file,
+         int line);
+ void ERR_add_error_data(int num, ...);
+
+ void ERR_load_strings(int lib,ERR_STRING_DATA str[]);
+ unsigned long ERR_PACK(int lib, int func, int reason);
+ int ERR_get_next_error_library(void);
+
+=head1 DESCRIPTION
+
+When a call to the OpenSSL library fails, this is usually signalled
+by the return value, and an error code is stored in an error queue
+associated with the current thread. The B<err> library provides
+functions to obtain these error codes and textual error messages.
+
+The L<ERR_get_error(3)|ERR_get_error(3)> manpage describes how to
+access error codes.
+
+Error codes contain information about where the error occurred, and
+what went wrong. L<ERR_GET_LIB(3)|ERR_GET_LIB(3)> describes how to
+extract this information. A method to obtain human-readable error
+messages is described in L<ERR_error_string(3)|ERR_error_string(3)>.
+
+L<ERR_clear_error(3)|ERR_clear_error(3)> can be used to clear the
+error queue.
+
+Note that L<ERR_remove_state(3)|ERR_remove_state(3)> should be used to
+avoid memory leaks when threads are terminated.
+
+=head1 ADDING NEW ERROR CODES TO OPENSSL
+
+See L<ERR_put_error(3)> if you want to record error codes in the
+OpenSSL error system from within your application.
+
+The remainder of this section is of interest only if you want to add
+new error codes to OpenSSL or add error codes from external libraries.
+
+=head2 Reporting errors
+
+Each sub-library has a specific macro XXXerr() that is used to report
+errors. Its first argument is a function code B<XXX_F_...>, the second
+argument is a reason code B<XXX_R_...>. Function codes are derived
+from the function names; reason codes consist of textual error
+descriptions. For example, the function ssl23_read() reports a
+"handshake failure" as follows:
+
+ SSLerr(SSL_F_SSL23_READ, SSL_R_SSL_HANDSHAKE_FAILURE);
+
+Function and reason codes should consist of upper case characters,
+numbers and underscores only. The error file generation script translates
+function codes into function names by looking in the header files
+for an appropriate function name, if none is found it just uses
+the capitalized form such as "SSL23_READ" in the above example.
+
+The trailing section of a reason code (after the "_R_") is translated
+into lower case and underscores changed to spaces.
+
+When you are using new function or reason codes, run B<make errors>.
+The necessary B<#define>s will then automatically be added to the
+sub-library's header file.
+
+Although a library will normally report errors using its own specific
+XXXerr macro, another library's macro can be used. This is normally
+only done when a library wants to include ASN1 code which must use
+the ASN1err() macro.
+
+=head2 Adding new libraries
+
+When adding a new sub-library to OpenSSL, assign it a library number
+B<ERR_LIB_XXX>, define a macro XXXerr() (both in B<err.h>), add its
+name to B<ERR_str_libraries[]> (in B<crypto/err/err.c>), and add
+C<ERR_load_XXX_strings()> to the ERR_load_crypto_strings() function
+(in B<crypto/err/err_all.c>). Finally, add an entry
+
+ L      XXX     xxx.h   xxx_err.c
+
+to B<crypto/err/openssl.ec>, and add B<xxx_err.c> to the Makefile.
+Running B<make errors> will then generate a file B<xxx_err.c>, and
+add all error codes used in the library to B<xxx.h>.
+
+Additionally the library include file must have a certain form.
+Typically it will initially look like this:
+
+ #ifndef HEADER_XXX_H
+ #define HEADER_XXX_H
+
+ #ifdef __cplusplus
+ extern "C" {
+ #endif
+
+ /* Include files */
+
+ #include <openssl/bio.h>
+ #include <openssl/x509.h>
+
+ /* Macros, structures and function prototypes */
+
+
+ /* BEGIN ERROR CODES */
+
+The B<BEGIN ERROR CODES> sequence is used by the error code
+generation script as the point to place new error codes, any text
+after this point will be overwritten when B<make errors> is run.
+The closing #endif etc will be automatically added by the script.
+
+The generated C error code file B<xxx_err.c> will load the header
+files B<stdio.h>, B<openssl/err.h> and B<openssl/xxx.h> so the
+header file must load any additional header files containg any
+definitions it uses.
+
+=head1 USING ERROR CODES IN EXTERNAL LIBRARIES
+
+It is also possible to use OpenSSL's error code scheme in external
+libraries. The library needs to load its own codes and call the OpenSSL
+error code insertion script B<mkerr.pl> explicitly to add codes to
+the header file and generate the C error code file. This will normally
+be done if the external library needs to generate new ASN1 structures
+but it can also be used to add more general purpose error code handling.
+
+TBA more details
+
+=head1 INTERNALS
+
+The error queues are stored in a hash table with one B<ERR_STATE>
+entry for each pid. ERR_get_state() returns the current thread's
+B<ERR_STATE>. An B<ERR_STATE> can hold up to B<ERR_NUM_ERRORS> error
+codes. When more error codes are added, the old ones are overwritten,
+on the assumption that the most recent errors are most important.
+
+Error strings are also stored in hash table. The hash tables can
+be obtained by calling ERR_get_err_state_table(void) and
+ERR_get_string_table(void) respectively.
+
+=head1 SEE ALSO
+
+L<CRYPTO_set_id_callback(3)|CRYPTO_set_id_callback(3)>,
+L<CRYPTO_set_locking_callback(3)|<CRYPTO_set_locking_callback(3)>,
+L<ERR_get_error(3)|ERR_get_error(3)>,
+L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>,
+L<ERR_clear_error(3)|ERR_clear_error(3)>,
+L<ERR_error_string(3)|ERR_error_string(3)>,
+L<ERR_print_errors(3)|ERR_print_errors(3)>,
+L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>,
+L<ERR_remove_state(3)|ERR_remove_state(3)>,
+L<ERR_put_error(3)|ERR_put_error(3)>,
+L<ERR_load_strings(3)|ERR_load_strings(3)>,
+L<SSL_get_error(3)|SSL_get_error(3)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/hmac.pod b/src/lib/libssl/src/doc/crypto/hmac.pod
new file mode 100644
index 0000000000..45b6108c39
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/hmac.pod
@@ -0,0 +1,75 @@
+=pod
+
+=head1 NAME
+
+HMAC, HMAC_Init, HMAC_Update, HMAC_Final - HMAC message authentication code
+
+=head1 SYNOPSIS
+
+ #include <openssl/hmac.h>
+
+ unsigned char *HMAC(const EVP_MD *evp_md, const void *key,
+               int key_len, const unsigned char *d, int n,
+               unsigned char *md, unsigned int *md_len);
+
+ void HMAC_Init(HMAC_CTX *ctx, const void *key, int key_len,
+               const EVP_MD *md);
+ void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, int len);
+ void HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len);
+
+ void HMAC_cleanup(HMAC_CTX *ctx);
+
+=head1 DESCRIPTION
+
+HMAC is a MAC (message authentication code), i.e. a keyed hash
+function used for message authentication, which is based on a hash
+function.
+
+HMAC() computes the message authentication code of the B<n> bytes at
+B<d> using the hash function B<evp_md> and the key B<key> which is
+B<key_len> bytes long.
+
+It places the result in B<md> (which must have space for the output of
+the hash function, which is no more than B<EVP_MAX_MD_SIZE> bytes).
+If B<md> is NULL, the digest is placed in a static array.  The size of
+the output is placed in B<md_len>, unless it is B<NULL>.
+
+B<evp_md> can be EVP_sha1(), EVP_ripemd160() etc.
+B<key> and B<evp_md> may be B<NULL> if a key and hash function have
+been set in a previous call to HMAC_Init() for that B<HMAC_CTX>.
+
+HMAC_cleanup() erases the key and other data from the B<HMAC_CTX>.
+
+The following functions may be used if the message is not completely
+stored in memory:
+
+HMAC_Init() initializes a B<HMAC_CTX> structure to use the hash
+function B<evp_md> and the key B<key> which is B<key_len> bytes long.
+
+HMAC_Update() can be called repeatedly with chunks of the message to
+be authenticated (B<len> bytes at B<data>).
+
+HMAC_Final() places the message authentication code in B<md>, which
+must have space for the hash function output.
+
+=head1 RETURN VALUES
+
+HMAC() returns a pointer to the message authentication code.
+
+HMAC_Init(), HMAC_Update(), HMAC_Final() and HMAC_cleanup() do not
+return values.
+
+=head1 CONFORMING TO
+
+RFC 2104
+
+=head1 SEE ALSO
+
+L<sha(3)|sha(3)>, L<evp(3)|evp(3)>
+
+=head1 HISTORY
+
+HMAC(), HMAC_Init(), HMAC_Update(), HMAC_Final() and HMAC_cleanup()
+are available since SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/lh_stats.pod b/src/lib/libssl/src/doc/crypto/lh_stats.pod
new file mode 100644
index 0000000000..3eeaa72e52
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/lh_stats.pod
@@ -0,0 +1,60 @@
+=pod
+
+=head1 NAME
+
+lh_stats, lh_node_stats, lh_node_usage_stats, lh_stats_bio,
+lh_node_stats_bio, lh_node_usage_stats_bio - LHASH statistics
+
+=head1 SYNOPSIS
+
+ #include <openssl/lhash.h>
+
+ void lh_stats(LHASH *table, FILE *out);
+ void lh_node_stats(LHASH *table, FILE *out);
+ void lh_node_usage_stats(LHASH *table, FILE *out);
+
+ void lh_stats_bio(LHASH *table, BIO *out);
+ void lh_node_stats_bio(LHASH *table, BIO *out);
+ void lh_node_usage_stats_bio(LHASH *table, BIO *out);
+
+=head1 DESCRIPTION
+
+The B<LHASH> structure records statistics about most aspects of
+accessing the hash table.  This is mostly a legacy of Eric Young
+writing this library for the reasons of implementing what looked like
+a nice algorithm rather than for a particular software product.
+
+lh_stats() prints out statistics on the size of the hash table, how
+many entries are in it, and the number and result of calls to the
+routines in this library.
+
+lh_node_stats() prints the number of entries for each 'bucket' in the
+hash table.
+
+lh_node_usage_stats() prints out a short summary of the state of the
+hash table.  It prints the 'load' and the 'actual load'.  The load is
+the average number of data items per 'bucket' in the hash table.  The
+'actual load' is the average number of items per 'bucket', but only
+for buckets which contain entries.  So the 'actual load' is the
+average number of searches that will need to find an item in the hash
+table, while the 'load' is the average number that will be done to
+record a miss.
+
+lh_stats_bio(), lh_node_stats_bio() and lh_node_usage_stats_bio()
+are the same as the above, except that the output goes to a B<BIO>.
+
+=head1 RETURN VALUES
+
+These functions do not return values.
+
+=head1 SEE ALSO
+
+L<bio(3)|bio(3)>, L<lhash(3)|lhash(3)>
+
+=head1 HISTORY
+
+These functions are available in all versions of SSLeay and OpenSSL.
+
+This manpage is derived from the SSLeay documentation.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/lhash.pod b/src/lib/libssl/src/doc/crypto/lhash.pod
new file mode 100644
index 0000000000..af2c9a7102
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/lhash.pod
@@ -0,0 +1,155 @@
+=pod
+
+=head1 NAME
+
+lh_new, lh_free, lh_insert, lh_delete, lh_retrieve, lh_doall,
+lh_doall_arg, lh_error - dynamic hash table
+
+=head1 SYNOPSIS
+
+ #include <openssl/lhash.h>
+
+ LHASH *lh_new(unsigned long (*hash)(/*void *a*/),
+          int (*compare)(/*void *a,void *b*/));
+ void lh_free(LHASH *table);
+
+ void *lh_insert(LHASH *table, void *data);
+ void *lh_delete(LHASH *table, void *data);
+ void *lh_retrieve(LHASH *table, void *data);
+
+ void lh_doall(LHASH *table, void (*func)(/*void *b*/));
+ void lh_doall_arg(LHASH *table, void (*func)(/*void *a,void *b*/),
+          void *arg);
+
+ int lh_error(LHASH *table);
+
+=head1 DESCRIPTION
+
+This library implements dynamic hash tables. The hash table entries
+can be arbitrary structures. Usually they consist of key and value
+fields.
+
+lh_new() creates a new B<LHASH> structure. B<hash> takes a pointer to
+the structure and returns an unsigned long hash value of its key
+field. The hash value is normally truncated to a power of 2, so make
+sure that your hash function returns well mixed low order
+bits. B<compare> takes two arguments, and returns 0 if their keys are
+equal, non-zero otherwise.
+
+lh_free() frees the B<LHASH> structure B<table>. Allocated hash table
+entries will not be freed; consider using lh_doall() to deallocate any
+remaining entries in the hash table.
+
+lh_insert() inserts the structure pointed to by B<data> into B<table>.
+If there already is an entry with the same key, the old value is
+replaced. Note that lh_insert() stores pointers, the data are not
+copied.
+
+lh_delete() deletes an entry from B<table>.
+
+lh_retrieve() looks up an entry in B<table>. Normally, B<data> is
+a structure with the key field(s) set; the function will return a
+pointer to a fully populated structure.
+
+lh_doall() will, for every entry in the hash table, call B<func> with
+the data item as parameters.
+This function can be quite useful when used as follows:
+ void cleanup(STUFF *a)
+  { STUFF_free(a); }
+ lh_doall(hash,cleanup);
+ lh_free(hash);
+This can be used to free all the entries. lh_free() then cleans up the
+'buckets' that point to nothing. When doing this, be careful if you
+delete entries from the hash table in B<func>: the table may decrease
+in size, moving item that you are currently on down lower in the hash
+table.  This could cause some entries to be skipped.  The best
+solution to this problem is to set hash-E<gt>down_load=0 before you
+start.  This will stop the hash table ever being decreased in size.
+
+lh_doall_arg() is the same as lh_doall() except that B<func> will
+be called with B<arg> as the second argument.
+
+lh_error() can be used to determine if an error occurred in the last
+operation. lh_error() is a macro.
+
+=head1 RETURN VALUES
+
+lh_new() returns B<NULL> on error, otherwise a pointer to the new
+B<LHASH> structure.
+
+When a hash table entry is replaced, lh_insert() returns the value
+being replaced. B<NULL> is returned on normal operation and on error.
+
+lh_delete() returns the entry being deleted.  B<NULL> is returned if
+there is no such value in the hash table.
+
+lh_retrieve() returns the hash table entry if it has been found,
+B<NULL> otherwise.
+
+lh_error() returns 1 if an error occurred in the last operation, 0
+otherwise.
+
+lh_free(), lh_doall() and lh_doall_arg() return no values.
+
+=head1 BUGS
+
+lh_insert() returns B<NULL> both for success and error.
+
+=head1 INTERNALS
+
+The following description is based on the SSLeay documentation:
+
+The B<lhash> library implements a hash table described in the
+I<Communications of the ACM> in 1991.  What makes this hash table
+different is that as the table fills, the hash table is increased (or
+decreased) in size via Realloc().  When a 'resize' is done, instead of
+all hashes being redistributed over twice as many 'buckets', one
+bucket is split.  So when an 'expand' is done, there is only a minimal
+cost to redistribute some values.  Subsequent inserts will cause more
+single 'bucket' redistributions but there will never be a sudden large
+cost due to redistributing all the 'buckets'.
+
+The state for a particular hash table is kept in the B<LHASH> structure.
+The decision to increase or decrease the hash table size is made
+depending on the 'load' of the hash table.  The load is the number of
+items in the hash table divided by the size of the hash table.  The
+default values are as follows.  If (hash->up_load E<lt> load) =E<gt>
+expand.  if (hash-E<gt>down_load E<gt> load) =E<gt> contract.  The
+B<up_load> has a default value of 1 and B<down_load> has a default value
+of 2.  These numbers can be modified by the application by just
+playing with the B<up_load> and B<down_load> variables.  The 'load' is
+kept in a form which is multiplied by 256.  So
+hash-E<gt>up_load=8*256; will cause a load of 8 to be set.
+
+If you are interested in performance the field to watch is
+num_comp_calls.  The hash library keeps track of the 'hash' value for
+each item so when a lookup is done, the 'hashes' are compared, if
+there is a match, then a full compare is done, and
+hash-E<gt>num_comp_calls is incremented.  If num_comp_calls is not equal
+to num_delete plus num_retrieve it means that your hash function is
+generating hashes that are the same for different values.  It is
+probably worth changing your hash function if this is the case because
+even if your hash table has 10 items in a 'bucket', it can be searched
+with 10 B<unsigned long> compares and 10 linked list traverses.  This
+will be much less expensive that 10 calls to you compare function.
+
+lh_strhash() is a demo string hashing function:
+
+ unsigned long lh_strhash(const char *c);
+
+Since the B<LHASH> routines would normally be passed structures, this
+routine would not normally be passed to lh_new(), rather it would be
+used in the function passed to lh_new().
+
+=head1 SEE ALSO
+
+L<lh_stats(3)|lh_stats(3)>
+
+=head1 HISTORY
+
+The B<lhash> library is available in all versions of SSLeay and OpenSSL.
+lh_error() was added in SSLeay 0.9.1b.
+
+This manpage is derived from the SSLeay documentation.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/md5.pod b/src/lib/libssl/src/doc/crypto/md5.pod
new file mode 100644
index 0000000000..d7c120023d
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/md5.pod
@@ -0,0 +1,85 @@
+=pod
+
+=head1 NAME
+
+MD2, MD5, MD2_Init, MD2_Update, MD2_Final, MD5_Init, MD5_Update,
+MD5_Final - MD2 and MD5 hash functions
+
+=head1 SYNOPSIS
+
+ #include <openssl/md2.h>
+
+ unsigned char *MD2(const unsigned char *d, unsigned long n,
+                  unsigned char *md);
+
+ void MD2_Init(MD2_CTX *c);
+ void MD2_Update(MD2_CTX *c, const unsigned char *data,
+                  unsigned long len);
+ void MD2_Final(unsigned char *md, MD2_CTX *c);
+
+
+ #include <openssl/md5.h>
+
+ unsigned char *MD5(const unsigned char *d, unsigned long n,
+                  unsigned char *md);
+
+ void MD5_Init(MD5_CTX *c);
+ void MD5_Update(MD5_CTX *c, const void *data,
+                  unsigned long len);
+ void MD5_Final(unsigned char *md, MD5_CTX *c);
+
+=head1 DESCRIPTION
+
+MD2 and MD5 are cryptographic hash functions with a 128 bit output.
+
+MD2() and MD5() compute the MD2 and MD5 message digest of the B<n>
+bytes at B<d> and place it in B<md> (which must have space for
+MD2_DIGEST_LENGTH == MD5_DIGEST_LENGTH == 16 bytes of output). If
+B<md> is NULL, the digest is placed in a static array.
+
+The following functions may be used if the message is not completely
+stored in memory:
+
+MD2_Init() initializes a B<MD2_CTX> structure.
+
+MD2_Update() can be called repeatedly with chunks of the message to
+be hashed (B<len> bytes at B<data>).
+
+MD2_Final() places the message digest in B<md>, which must have space
+for MD2_DIGEST_LENGTH == 16 bytes of output, and erases the B<MD2_CTX>.
+
+MD5_Init(), MD5_Update() and MD5_Final() are analogous using an
+B<MD5_CTX> structure.
+
+Applications should use the higher level functions
+L<EVP_DigestInit(3)|EVP_DigestInit(3)>
+etc. instead of calling the hash functions directly.
+
+=head1 NOTE
+
+MD2 and MD5 are recommended only for compatibility with existing
+applications. In new applications, SHA-1 or RIPEMD-160 should be
+preferred.
+
+=head1 RETURN VALUES
+
+MD2() and MD5() return pointers to the hash value. 
+
+MD2_Init(), MD2_Update() MD2_Final(), MD5_Init(), MD5_Update() and
+MD5_Final() do not return values.
+
+=head1 CONFORMING TO
+
+RFC 1319, RFC 1321
+
+=head1 SEE ALSO
+
+L<sha(3)|sha(3)>, L<ripemd(3)|ripemd(3)>, L<EVP_DigestInit(3)|EVP_DigestInit(3)>
+
+=head1 HISTORY
+
+MD2(), MD2_Init(), MD2_Update() MD2_Final(), MD5(), MD5_Init(),
+MD5_Update() and MD5_Final() are available in all versions of SSLeay
+and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/mdc2.pod b/src/lib/libssl/src/doc/crypto/mdc2.pod
new file mode 100644
index 0000000000..11dc303e04
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/mdc2.pod
@@ -0,0 +1,64 @@
+=pod
+
+=head1 NAME
+
+MDC2, MDC2_Init, MDC2_Update, MDC2_Final - MDC2 hash function
+
+=head1 SYNOPSIS
+
+ #include <openssl/mdc2.h>
+
+ unsigned char *MDC2(const unsigned char *d, unsigned long n,
+                  unsigned char *md);
+
+ void MDC2_Init(MDC2_CTX *c);
+ void MDC2_Update(MDC2_CTX *c, const unsigned char *data,
+                  unsigned long len);
+ void MDC2_Final(unsigned char *md, MDC2_CTX *c);
+
+=head1 DESCRIPTION
+
+MDC2 is a method to construct hash functions with 128 bit output from
+block ciphers.  These functions are an implementation of MDC2 with
+DES.
+
+MDC2() computes the MDC2 message digest of the B<n>
+bytes at B<d> and places it in B<md> (which must have space for
+MDC2_DIGEST_LENGTH == 16 bytes of output). If B<md> is NULL, the digest
+is placed in a static array.
+
+The following functions may be used if the message is not completely
+stored in memory:
+
+MDC2_Init() initializes a B<MDC2_CTX> structure.
+
+MDC2_Update() can be called repeatedly with chunks of the message to
+be hashed (B<len> bytes at B<data>).
+
+MDC2_Final() places the message digest in B<md>, which must have space
+for MDC2_DIGEST_LENGTH == 16 bytes of output, and erases the B<MDC2_CTX>.
+
+Applications should use the higher level functions
+L<EVP_DigestInit(3)|EVP_DigestInit(3)> etc. instead of calling the
+hash functions directly.
+
+=head1 RETURN VALUES
+
+MDC2() returns a pointer to the hash value. 
+
+MDC2_Init(), MDC2_Update() and MDC2_Final() do not return values.
+
+=head1 CONFORMING TO
+
+ISO/IEC 10118-2, with DES
+
+=head1 SEE ALSO
+
+L<sha(3)|sha(3)>, L<EVP_DigestInit(3)|EVP_DigestInit(3)>
+
+=head1 HISTORY
+
+MDC2(), MDC2_Init(), MDC2_Update() and MDC2_Final() are available since
+SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/rand.pod b/src/lib/libssl/src/doc/crypto/rand.pod
new file mode 100644
index 0000000000..295b681050
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/rand.pod
@@ -0,0 +1,158 @@
+=pod
+
+=head1 NAME
+
+rand - pseudo-random number generator
+
+=head1 SYNOPSIS
+
+ #include <openssl/rand.h>
+
+ int  RAND_bytes(unsigned char *buf,int num);
+ int  RAND_pseudo_bytes(unsigned char *buf,int num);
+
+ void RAND_seed(const void *buf,int num);
+ void RAND_add(const void *buf,int num,int entropy);
+ int  RAND_status(void);
+ void RAND_screen(void);
+
+ int  RAND_load_file(const char *file,long max_bytes);
+ int  RAND_write_file(const char *file);
+ const char *RAND_file_name(char *file,int num);
+
+ int  RAND_egd(const char *path);
+
+ void RAND_set_rand_method(RAND_METHOD *meth);
+ RAND_METHOD *RAND_get_rand_method(void);
+ RAND_METHOD *RAND_SSLeay(void);
+
+ void RAND_cleanup(void);
+
+=head1 DESCRIPTION
+
+These functions implement a cryptographically secure pseudo-random
+number generator (PRNG). It is used by other library functions for
+example to generate random keys, and applications can use it when they
+need randomness.
+
+A cryptographic PRNG must be seeded with unpredictable data such as
+mouse movements or keys pressed at random by the user. This is
+described in L<RAND_add(3)|RAND_add(3)>. Its state can be saved in a seed file
+(see L<RAND_load_file(3)|RAND_load_file(3)>) to avoid having to go through the
+seeding process whenever the application is started.
+
+L<RAND_bytes(3)|RAND_bytes(3)> describes how to obtain random data from the
+PRNG. 
+
+=head1 INTERNALS
+
+The RAND_SSLeay() method implements a PRNG based on a cryptographic
+hash function.
+
+The following description of its design is based on the SSLeay
+documentation:
+
+First up I will state the things I believe I need for a good RNG.
+
+=over 4
+
+=item 1
+
+A good hashing algorithm to mix things up and to convert the RNG 'state'
+to random numbers.
+
+=item 2
+
+An initial source of random 'state'.
+
+=item 3
+
+The state should be very large.  If the RNG is being used to generate
+4096 bit RSA keys, 2 2048 bit random strings are required (at a minimum).
+If your RNG state only has 128 bits, you are obviously limiting the
+search space to 128 bits, not 2048.  I'm probably getting a little
+carried away on this last point but it does indicate that it may not be
+a bad idea to keep quite a lot of RNG state.  It should be easier to
+break a cipher than guess the RNG seed data.
+
+=item 4
+
+Any RNG seed data should influence all subsequent random numbers
+generated.  This implies that any random seed data entered will have
+an influence on all subsequent random numbers generated.
+
+=item 5
+
+When using data to seed the RNG state, the data used should not be
+extractable from the RNG state.  I believe this should be a
+requirement because one possible source of 'secret' semi random
+data would be a private key or a password.  This data must
+not be disclosed by either subsequent random numbers or a
+'core' dump left by a program crash.
+
+=item 6
+
+Given the same initial 'state', 2 systems should deviate in their RNG state
+(and hence the random numbers generated) over time if at all possible.
+
+=item 7
+
+Given the random number output stream, it should not be possible to determine
+the RNG state or the next random number.
+
+=back
+
+The algorithm is as follows.
+
+There is global state made up of a 1023 byte buffer (the 'state'), a
+working hash value ('md'), and a counter ('count').
+
+Whenever seed data is added, it is inserted into the 'state' as
+follows.
+
+The input is chopped up into units of 20 bytes (or less for
+the last block).  Each of these blocks is run through the hash
+function as follows:  The data passed to the hash function
+is the current 'md', the same number of bytes from the 'state'
+(the location determined by in incremented looping index) as
+the current 'block', the new key data 'block', and 'count'
+(which is incremented after each use).
+The result of this is kept in 'md' and also xored into the
+'state' at the same locations that were used as input into the
+hash function. I
+believe this system addresses points 1 (hash function; currently
+SHA-1), 3 (the 'state'), 4 (via the 'md'), 5 (by the use of a hash
+function and xor).
+
+When bytes are extracted from the RNG, the following process is used.
+For each group of 10 bytes (or less), we do the following:
+
+Input into the hash function the top 10 bytes from the local 'md'
+(which is initialized from the global 'md' before any bytes are
+generated), the bytes that are to be overwritten by the random bytes,
+and bytes from the 'state' (incrementing looping index). From this
+digest output (which is kept in 'md'), the top (up to) 10 bytes are
+returned to the caller and the bottom (up to) 10 bytes are xored into
+the 'state'.
+
+Finally, after we have finished 'num' random bytes for the caller,
+'count' (which is incremented) and the local and global 'md' are fed
+into the hash function and the results are kept in the global 'md'.
+
+I believe the above addressed points 1 (use of SHA-1), 6 (by hashing
+into the 'state' the 'old' data from the caller that is about to be
+overwritten) and 7 (by not using the 10 bytes given to the caller to
+update the 'state', but they are used to update 'md').
+
+So of the points raised, only 2 is not addressed (but see
+L<RAND_add(3)|RAND_add(3)>).
+
+=head1 SEE ALSO
+
+L<BN_rand(3)|BN_rand(3)>, L<RAND_add(3)|RAND_add(3)>,
+L<RAND_load_file(3)|RAND_load_file(3)>, L<RAND_egd(3)|RAND_egd(3)>,
+L<RAND_bytes(3)|RAND_bytes(3)>,
+L<RAND_set_rand_method(3)|RAND_set_rand_method(3)>,
+L<RAND_cleanup(3)|RAND_cleanup(3)> 
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/rc4.pod b/src/lib/libssl/src/doc/crypto/rc4.pod
new file mode 100644
index 0000000000..b6d3a4342c
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/rc4.pod
@@ -0,0 +1,62 @@
+=pod
+
+=head1 NAME
+
+RC4_set_key, RC4 - RC4 encryption
+
+=head1 SYNOPSIS
+
+ #include <openssl/rc4.h>
+
+ void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
+
+ void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
+          unsigned char *outdata);
+
+=head1 DESCRIPTION
+
+This library implements the Alleged RC4 cipher, which is described for
+example in I<Applied Cryptography>.  It is believed to be compatible
+with RC4[TM], a proprietary cipher of RSA Security Inc.
+
+RC4 is a stream cipher with variable key length.  Typically, 128 bit
+(16 byte) keys are used for strong encryption, but shorter insecure
+key sizes have been widely used due to export restrictions.
+
+RC4 consists of a key setup phase and the actual encryption or
+decryption phase.
+
+RC4_set_key() sets up the B<RC4_KEY> B<key> using the B<len> bytes long
+key at B<data>.
+
+RC4() encrypts or decrypts the B<len> bytes of data at B<indata> using
+B<key> and places the result at B<outdata>.  Repeated RC4() calls with
+the same B<key> yield a continuous key stream.
+
+Since RC4 is a stream cipher (the input is XORed with a pseudo-random
+key stream to produce the output), decryption uses the same function
+calls as encryption.
+
+Applications should use the higher level functions
+L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>
+etc. instead of calling the RC4 functions directly.
+
+=head1 RETURN VALUES
+
+RC4_set_key() and RC4() do not return values.
+
+=head1 NOTE
+
+Certain conditions have to be observed to securely use stream ciphers.
+It is not permissible to perform multiple encryptions using the same
+key stream.
+
+=head1 SEE ALSO
+
+L<blowfish(3)|blowfish(3)>, L<des(3)|des(3)>, L<rc2(3)|rc2(3)>
+
+=head1 HISTORY
+
+RC4_set_key() and RC4() are available in all versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ripemd.pod b/src/lib/libssl/src/doc/crypto/ripemd.pod
new file mode 100644
index 0000000000..31054b6a8c
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ripemd.pod
@@ -0,0 +1,66 @@
+=pod
+
+=head1 NAME
+
+RIPEMD160, RIPEMD160_Init, RIPEMD160_Update, RIPEMD160_Final -
+RIPEMD-160 hash function
+
+=head1 SYNOPSIS
+
+ #include <openssl/ripemd.h>
+
+ unsigned char *RIPEMD160(const unsigned char *d, unsigned long n,
+                  unsigned char *md);
+
+ void RIPEMD160_Init(RIPEMD160_CTX *c);
+ void RIPEMD160_Update(RIPEMD_CTX *c, const void *data,
+                  unsigned long len);
+ void RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
+
+=head1 DESCRIPTION
+
+RIPEMD-160 is a cryptographic hash function with a
+160 bit output.
+
+RIPEMD160() computes the RIPEMD-160 message digest of the B<n>
+bytes at B<d> and places it in B<md> (which must have space for
+RIPEMD160_DIGEST_LENGTH == 20 bytes of output). If B<md> is NULL, the digest
+is placed in a static array.
+
+The following functions may be used if the message is not completely
+stored in memory:
+
+RIPEMD160_Init() initializes a B<RIPEMD160_CTX> structure.
+
+RIPEMD160_Update() can be called repeatedly with chunks of the message to
+be hashed (B<len> bytes at B<data>).
+
+RIPEMD160_Final() places the message digest in B<md>, which must have
+space for RIPEMD160_DIGEST_LENGTH == 20 bytes of output, and erases
+the B<RIPEMD160_CTX>.
+
+Applications should use the higher level functions
+L<EVP_DigestInit(3)|EVP_DigestInit(3)> etc. instead of calling the
+hash functions directly.
+
+=head1 RETURN VALUES
+
+RIPEMD160() returns a pointer to the hash value. 
+
+RIPEMD160_Init(), RIPEMD160_Update() and RIPEMD160_Final() do not
+return values.
+
+=head1 CONFORMING TO
+
+ISO/IEC 10118-3 (draft) (??)
+
+=head1 SEE ALSO
+
+L<sha(3)|sha(3)>, L<hmac(3)|hmac(3)>, L<EVP_DigestInit(3)|EVP_DigestInit(3)>
+
+=head1 HISTORY
+
+RIPEMD160(), RIPEMD160_Init(), RIPEMD160_Update() and
+RIPEMD160_Final() are available since SSLeay 0.9.0.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/rsa.pod b/src/lib/libssl/src/doc/crypto/rsa.pod
new file mode 100644
index 0000000000..0486c044a6
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/rsa.pod
@@ -0,0 +1,115 @@
+=pod
+
+=head1 NAME
+
+rsa - RSA public key cryptosystem
+
+=head1 SYNOPSIS
+
+ #include <openssl/rsa.h>
+
+ RSA * RSA_new(void);
+ void RSA_free(RSA *rsa);
+
+ int RSA_public_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa, int padding);
+ int RSA_private_decrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa, int padding);
+
+ int RSA_sign(int type, unsigned char *m, unsigned int m_len,
+    unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+ int RSA_verify(int type, unsigned char *m, unsigned int m_len,
+    unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+
+ int RSA_size(RSA *rsa);
+
+ RSA *RSA_generate_key(int num, unsigned long e,
+    void (*callback)(int,int,void *), void *cb_arg);
+
+ int RSA_check_key(RSA *rsa);
+
+ int RSA_blinding_on(RSA *rsa, BN_CTX *ctx);
+ void RSA_blinding_off(RSA *rsa);
+
+ void RSA_set_default_method(RSA_METHOD *meth);
+ RSA_METHOD *RSA_get_default_method(void);
+ RSA_METHOD *RSA_set_method(RSA *rsa, RSA_METHOD *meth);
+ RSA_METHOD *RSA_get_method(RSA *rsa);
+ RSA_METHOD *RSA_PKCS1_SSLeay(void);
+ RSA_METHOD *RSA_PKCS1_RSAref(void);
+ RSA_METHOD *RSA_null_method(void);
+ int RSA_flags(RSA *rsa);
+ RSA *RSA_new_method(RSA_METHOD *method);
+
+ int RSA_print(BIO *bp, RSA *x, int offset);
+ int RSA_print_fp(FILE *fp, RSA *x, int offset);
+
+ int RSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
+    int (*dup_func)(), void (*free_func)());
+ int RSA_set_ex_data(RSA *r,int idx,char *arg);
+ char *RSA_get_ex_data(RSA *r, int idx);
+
+ int RSA_private_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa,int padding);
+ int RSA_public_decrypt(int flen, unsigned char *from, 
+    unsigned char *to, RSA *rsa,int padding);
+
+ int RSA_sign_ASN1_OCTET_STRING(int dummy, unsigned char *m,
+    unsigned int m_len, unsigned char *sigret, unsigned int *siglen,
+    RSA *rsa);
+ int RSA_verify_ASN1_OCTET_STRING(int dummy, unsigned char *m,
+    unsigned int m_len, unsigned char *sigbuf, unsigned int siglen,
+    RSA *rsa);
+
+=head1 DESCRIPTION
+
+These functions implement RSA public key encryption and signatures
+as defined in PKCS #1 v2.0 [RFC 2437].
+
+The B<RSA> structure consists of several BIGNUM components. It can
+contain public as well as private RSA keys:
+
+ struct
+        {
+        BIGNUM *n;              // public modulus
+        BIGNUM *e;              // public exponent
+        BIGNUM *d;              // private exponent
+        BIGNUM *p;              // secret prime factor
+        BIGNUM *q;              // secret prime factor
+        BIGNUM *dmp1;           // d mod (p-1)
+        BIGNUM *dmq1;           // d mod (q-1)
+        BIGNUM *iqmp;           // q^-1 mod p
+        // ...
+        };
+ RSA
+
+In public keys, the private exponent and the related secret values are
+B<NULL>.
+
+B<dmp1>, B<dmq1> and B<iqmp> may be B<NULL> in private keys, but the
+RSA operations are much faster when these values are available.
+
+=head1 CONFORMING TO
+
+SSL, PKCS #1 v2.0
+
+=head1 PATENTS
+
+RSA is covered by a US patent which expires in September 2000.
+
+=head1 SEE ALSO
+
+L<rsa(1)|rsa(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>,
+L<rand(3)|rand(3)>, L<RSA_new(3)|RSA_new(3)>,
+L<RSA_public_encrypt(3)|RSA_public_encrypt(3)>,
+L<RSA_sign(3)|RSA_sign(3)>, L<RSA_size(3)|RSA_size(3)>,
+L<RSA_generate_key(3)|RSA_generate_key(3)>,
+L<RSA_check_key(3)|RSA_check_key(3)>,
+L<RSA_blinding_on(3)|RSA_blinding_on(3)>,
+L<RSA_set_method(3)|RSA_set_method(3)>, L<RSA_print(3)|RSA_print(3)>,
+L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>,
+L<RSA_private_encrypt(3)|RSA_private_encrypt(3)>,
+L<RSA_sign_ASN_OCTET_STRING(3)|RSA_sign_ASN_OCTET_STRING(3)>,
+L<RSA_padding_add_PKCS1_type_1(3)|RSA_padding_add_PKCS1_type_1(3)> 
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/sha.pod b/src/lib/libssl/src/doc/crypto/sha.pod
new file mode 100644
index 0000000000..0ba315d6d7
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/sha.pod
@@ -0,0 +1,70 @@
+=pod
+
+=head1 NAME
+
+SHA1, SHA1_Init, SHA1_Update, SHA1_Final - Secure Hash Algorithm
+
+=head1 SYNOPSIS
+
+ #include <openssl/sha.h>
+
+ unsigned char *SHA1(const unsigned char *d, unsigned long n,
+                  unsigned char *md);
+
+ void SHA1_Init(SHA_CTX *c);
+ void SHA1_Update(SHA_CTX *c, const void *data,
+                  unsigned long len);
+ void SHA1_Final(unsigned char *md, SHA_CTX *c);
+
+=head1 DESCRIPTION
+
+SHA-1 (Secure Hash Algorithm) is a cryptographic hash function with a
+160 bit output.
+
+SHA1() computes the SHA-1 message digest of the B<n>
+bytes at B<d> and places it in B<md> (which must have space for
+SHA_DIGEST_LENGTH == 20 bytes of output). If B<md> is NULL, the digest
+is placed in a static array.
+
+The following functions may be used if the message is not completely
+stored in memory:
+
+SHA1_Init() initializes a B<SHA_CTX> structure.
+
+SHA1_Update() can be called repeatedly with chunks of the message to
+be hashed (B<len> bytes at B<data>).
+
+SHA1_Final() places the message digest in B<md>, which must have space
+for SHA_DIGEST_LENGTH == 20 bytes of output, and erases the B<SHA_CTX>.
+
+Applications should use the higher level functions
+L<EVP_DigestInit(3)|EVP_DigestInit(3)>
+etc. instead of calling the hash functions directly.
+
+The predecessor of SHA-1, SHA, is also implemented, but it should be
+used only when backward compatibility is required.
+
+=head1 RETURN VALUES
+
+SHA1() returns a pointer to the hash value. 
+
+SHA1_Init(), SHA1_Update() and SHA1_Final() do not return values.
+
+=head1 CONFORMING TO
+
+SHA: US Federal Information Processing Standard FIPS PUB 180 (Secure Hash
+Standard),
+SHA-1: US Federal Information Processing Standard FIPS PUB 180-1 (Secure Hash
+Standard),
+ANSI X9.30
+
+=head1 SEE ALSO
+
+L<ripemd(3)|ripemd(3)>, L<hmac(3)|hmac(3)>, L<EVP_DigestInit(3)|EVP_DigestInit(3)>
+
+=head1 HISTORY
+
+SHA1(), SHA1_Init(), SHA1_Update() and SHA1_Final() are available in all
+versions of SSLeay and OpenSSL.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/threads.pod b/src/lib/libssl/src/doc/crypto/threads.pod
new file mode 100644
index 0000000000..5da056f3f8
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/threads.pod
@@ -0,0 +1,70 @@
+=pod
+
+=head1 NAME
+
+CRYPTO_set_locking_callback, CRYPTO_set_id_callback - OpenSSL thread support
+
+=head1 SYNOPSIS
+
+ #include <openssl/crypto.h>
+
+ void CRYPTO_set_locking_callback(void (*locking_function)(int mode,
+        int n, const char *file, int line));
+
+ void CRYPTO_set_id_callback(unsigned long (*id_function)(void));
+
+ int CRYPTO_num_locks(void);
+
+=head1 DESCRIPTION
+
+OpenSSL can safely be used in multi-threaded applications provided
+that two callback functions are set.
+
+locking_function(int mode, int n, const char *file, int line) is
+needed to perform locking on shared data stuctures. Multi-threaded
+applications will crash at random if it is not set.
+
+locking_function() must be able to handle up to CRYPTO_num_locks()
+different mutex locks. It sets the B<n>-th lock if B<mode> &
+B<CRYPTO_LOCK>, and releases it otherwise.
+
+B<file> and B<line> are the file number of the function setting the
+lock. They can be useful for debugging.
+
+id_function(void) is a function that returns a thread ID. It is not
+needed on Windows nor on platforms where getpid() returns a different
+ID for each thread (most notably Linux).
+
+=head1 RETURN VALUES
+
+CRYPTO_num_locks() returns the required number of locks.
+The other functions return no values.
+
+=head1 NOTE
+
+You can find out if OpenSSL was configured with thread support:
+
+ #define OPENSSL_THREAD_DEFINES
+ #include <openssl/opensslconf.h>
+ #if defined(THREADS)
+   // thread support enabled
+ #else
+   // no thread support
+ #endif
+
+=head1 EXAMPLES
+
+B<crypto/threads/mttest.c> shows examples of the callback functions on
+Solaris, Irix and Win32.
+
+=head1 HISTORY
+
+CRYPTO_set_locking_callback() and CRYPTO_set_id_callback() are
+available in all versions of SSLeay and OpenSSL.
+CRYPTO_num_locks() was added in OpenSSL 0.9.4.
+
+=head1 SEE ALSO
+
+L<crypto(3)|crypto(3)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/openssl.pod b/src/lib/libssl/src/doc/openssl.pod
index 561f01e0ca..e69de29bb2 100644
--- a/src/lib/libssl/src/doc/openssl.pod
+++ b/src/lib/libssl/src/doc/openssl.pod
@@ -1,304 +0,0 @@
-
-=pod
-
-=head1 NAME
-
-openssl - OpenSSL command line tool
-
-=head1 SYNOPSIS
-
-B<openssl>
-I<command>
-[ I<command_opts> ]
-[ I<command_args> ]
-
-=head1 DESCRIPTION
-
-OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL
-v2/v3) and Transport Layer Security (TLS v1) network protocols and related
-cryptography standards required by them.
-
-The B<openssl> program is a command line tool for using the various
-cryptography functions of OpenSSL's B<crypto> library from the shell. 
-It can be used for 
-
- o  Creation of RSA, DH and DSA key parameters
- o  Creation of X.509 certificates, CSRs and CRLs 
- o  Calculation of Message Digests
- o  Encryption and Decryption with Ciphers
- o  SSL/TLS Client and Server Tests
-
-=head1 COMMAND SUMMARY
-
-The B<openssl> program provides a rich variety of commands (I<command> in the
-SYNOPSIS above), each of which often has a wealth of options and arguments
-(I<command_opts> and I<command_args> in the SYNOPSIS).
-
-=head2 STANDARD COMMANDS
-
-=over 10
-
-=item B<asn1parse> 
-
-Parse an ASN.1 sequence.
-
-=item B<ca>
-
-Certificate Authority (CA) Management.  
-
-=item B<ciphers>
-
-Cipher Suite Description Determination.
-
-=item B<crl>
-
-Certificate Revocation List (CRL) Management.
-
-=item B<crl2pkcs7>      
-
-CRL2 to PKCS#7 Conversion.
-
-=item B<dgst>
-
-Message Digest Calculation.
-
-=item B<dh>
-
-Diffie-Hellman Data Management.
-
-=item B<dsa>
-
-DSA Data Management.
-
-=item B<dsaparam>
-
-DSA Parameter Generation.
-
-=item B<enc>            
-
-Encoding with Ciphers.
-
-=item B<errstr>
-
-Error Number to Error String Conversion.
-
-=item B<gendh>
-
-Generation of Diffie-Hellman Parameters.
-
-=item B<gendsa>
-
-Generation of DSA Parameters.
-
-=item B<genrsa>
-
-Generation of RSA Parameters.
-
-=item B<pkcs7>
-
-PKCS#7 Data Management.
-
-=item B<req>
-
-X.509 Certificate Signing Request (CSR) Management.
-
-=item B<rsa>
-
-RSA Data Management.
-
-=item B<s_client>
-
-This implements a generic SSL/TLS client which can establish a transparent
-connection to a remote server speaking SSL/TLS. It's intended for testing
-purposes only and provides only rudimentary interface functionality but
-internally uses mostly all functionality of the OpenSSL B<ssl> library.
-
-=item B<s_server>
-
-This implements a generic SSL/TLS server which accepts connections from remote
-clients speaking SSL/TLS. It's intended for testing purposes only and provides
-only rudimentary interface functionality but internally uses mostly all
-functionality of the OpenSSL B<ssl> library.  It provides both an own command
-line oriented protocol for testing SSL functions and a simple HTTP response
-facility to emulate an SSL/TLS-aware webserver.
-
-=item B<s_time>        
-
-SSL Connection Timer.
-
-=item B<sess_id>
-
-SSL Session Data Management.
-
-=item B<speed>
-
-Algorithm Speed Measurement.
-
-=item B<verify>
-
-X.509 Certificate Verification.
-
-=item B<version>
-
-OpenSSL Version Information.
-
-=item B<x509>           
-
-X.509 Certificate Data Management.
-
-=back
-
-=head2 MESSAGE DIGEST COMMANDS
-
-=over 10
-
-=item B<md2>
-
-MD2 Digest
-
-=item B<md5>
-
-MD5 Digest
-
-=item B<mdc2>
-
-MDC2 Digest
-
-=item B<rmd160>
-
-RMD-160 Digest
-
-=item B<sha>            
-
-SHA Digest
-
-=item B<sha1>           
-
-SHA-1 Digest
-
-=back
-
-=head2 ENCODING AND CIPHER COMMANDS
-
-=over 10
-
-=item B<base64>
-
-Base64 Encoding
-
-=item B<bf bf-cbc bf-cfb bf-ecb bf-ofb>
-
-Blowfish Cipher
-
-=item B<cast cast-cbc>
-
-CAST Cipher
-
-=item B<cast5-cbc cast5-cfb cast5-ecb cast5-ofb>
-
-CAST5 Cipher
-
-=item B<des des-cbc des-cfb des-ecb des-ede des-ede-cbc des-ede-cfb des-ede-ofb des-ofb>
-
-DES Cipher
-
-=item B<des3 desx des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb>
-
-Triple-DES Cipher
-
-=item B<idea idea-cbc idea-cfb idea-ecb idea-ofb>
-
-IDEA Cipher
-
-=item B<rc2 rc2-cbc rc2-cfb rc2-ecb rc2-ofb>
-
-RC2 Cipher
-
-=item B<rc4>
-
-RC4 Cipher
-
-=item B<rc5 rc5-cbc rc5-cfb rc5-ecb rc5-ofb>
-
-RC5 Cipher
-
-=back
-
-=head1 DETAILED COMMAND DESCRIPTION
-
-The following is a detailed description of every B<openssl> I<command>.
-
-=over 4
-
-=item B<openssl> B<s_client>
-[B<-connect> I<host>B<:>I<port>]
-[B<-verify> I<arg>]
-[B<-cert> I<arg>]
-[B<-key> I<arg>]
-[B<-CApath> I<arg>]
-[B<-CAfile> I<arg>]
-[B<-reconnect>]
-[B<-pause>]
-[B<-debug>]
-[B<-nbio_test>]
-[B<-state>]
-[B<-nbio>]
-[B<-quiet>]
-[B<-ssl2>]
-[B<-ssl3>]
-[B<-tls1>]
-[B<-no_ssl2>]
-[B<-no_ssl3>]
-[B<-no_tls1>]
-[B<-bugs>]
-[B<-cipher>]
-
-The B<s_client> command implements a generic SSL/TLS client which can
-establish a transparent connection to a remote I<host> and I<port> speaking
-SSL/TLS. 
-
-=item B<openssl> B<s_server>
-[B<-accept> I<port>]
-[B<-verify> I<arg>]
-[B<-Verify> I<arg>]
-[B<-cert> I<arg>]
-[B<-key> I<arg>]
-[B<-dcert> I<arg>]
-[B<-dkey> I<arg>]
-[B<-nbio>]
-[B<-nbio_test>]
-[B<-debug>]
-[B<-state>]
-[B<-CApath> I<arg>]
-[B<-CAfile> I<arg>]
-[B<-nocert>]
-[B<-cipher> I<arg>]
-[B<-quiet>]
-[B<-no_tmp_rsa>]
-[B<-ssl2>]
-[B<-ssl3>]
-[B<-tls1>]
-[B<-no_ssl2>]
-[B<-no_ssl3>]
-[B<-no_tls1>]
-[B<-bugs>]
-[B<-www>]
-[B<-WWW>]
-
-The B<s_server> command implements a generic SSL/TLS server which accepts
-connections from remote clients on I<port> speaking SSL/TLS.
-
-=back
-
-...
-
-=head1 SEE ALSO
-
-crypto(3), ssl(3)
-
-=head1 HISTORY
-
-The openssl(3) document appeared in OpenSSL 0.9.2
-
-=cut
-
diff --git a/src/lib/libssl/src/doc/openssl.txt b/src/lib/libssl/src/doc/openssl.txt
index 91b85e5f14..880eace4da 100644
--- a/src/lib/libssl/src/doc/openssl.txt
+++ b/src/lib/libssl/src/doc/openssl.txt
@@ -1,53 +1,12 @@
 
 This is some preliminary documentation for OpenSSL.
 
-==============================================================================
-                            BUFFER Library
-==============================================================================
-
-The buffer library handles simple character arrays. Buffers are used for
-various purposes in the library, most notably memory BIOs.
-
-The library uses the BUF_MEM structure defined in buffer.h:
-
-typedef struct buf_mem_st
-{
-        int length;     /* current number of bytes */
-        char *data;
-        int max;        /* size of buffer */
-} BUF_MEM;
-
-'length' is the current size of the buffer in bytes, 'max' is the amount of
-memory allocated to the buffer. There are three functions which handle these
-and one "miscellaneous" function.
-
-BUF_MEM *BUF_MEM_new()
-
-This allocates a new buffer of zero size. Returns the buffer or NULL on error.
-
-void BUF_MEM_free(BUF_MEM *a)
-
-This frees up an already existing buffer. The data is zeroed before freeing
-up in case the buffer contains sensitive data.
-
-int BUF_MEM_grow(BUF_MEM *str, int len)
-
-This changes the size of an already existing buffer. It returns zero on error
-or the new size (i.e. 'len'). Any data already in the buffer is preserved if
-it increases in size.
-
-char * BUF_strdup(char *str)
+Contents:
 
-This is the previously mentioned strdup function: like the standard library
-strdup() it copies a null terminated string into a block of allocated memory
-and returns a pointer to the allocated block.
+ OpenSSL X509V3 extension configuration
+ X509V3 Extension code: programmers guide
+ PKCS#12 Library
 
-Unlike the standard C library strdup() this function uses Malloc() and so
-should be used in preference to the standard library strdup() because it can
-be used for memory leak checking or replacing the malloc() function.
-
-The memory allocated from BUF_strdup() should be freed up using the Free()
-function.
 
 ==============================================================================
                OpenSSL X509V3 extension configuration
@@ -188,7 +147,7 @@ email.1=steve@here
 email.2=steve@there
 
 This is because the configuration file code cannot handle the same name
-occurring twice in the same extension.
+occurring twice in the same section.
 
 The syntax of raw extensions is governed by the extension code: it can
 for example contain data in multiple sections. The correct syntax to
@@ -315,6 +274,41 @@ TRUE. An end user certificate MUST NOT have the CA value set to true.
 According to PKIX recommendations it should exclude the extension entirely,
 however some software may require CA set to FALSE for end entity certificates.
 
+Extended Key Usage.
+
+This extensions consists of a list of usages.
+
+These can either be object short names of the dotted numerical form of OIDs.
+While any OID can be used only certain values make sense. In particular the
+following PKIX, NS and MS values are meaningful:
+
+Value                   Meaning
+-----                   -------
+serverAuth              SSL/TLS Web Server Authentication.
+clientAuth              SSL/TLS Web Client Authentication.
+codeSigning             Code signing.
+emailProtection         E-mail Protection (S/MIME).
+timeStamping            Trusted Timestamping
+msCodeInd               Microsoft Individual Code Signing (authenticode)
+msCodeCom               Microsoft Commercial Code Signing (authenticode)
+msCTLSign               Microsoft Trust List Signing
+msSGC                   Microsoft Server Gated Crypto
+msEFS                   Microsoft Encrypted File System
+nsSGC                   Netscape Server Gated Crypto
+
+For example, under IE5 a CA can be used for any purpose: by including a list
+of the above usages the CA can be restricted to only authorised uses.
+
+Note: software packages may place additional interpretations on certificate 
+use, in particular some usages may only work for selected CAs. Don't for example
+expect just including msSGC or nsSGC will automatically mean that a certificate
+can be used for SGC ("step up" encryption) otherwise anyone could use it.
+
+Examples:
+
+extendedKeyUsage=critical,codeSigning,1.2.3.4
+extendedKeyUsage=nsSGC,msSGC
+
 Subject Key Identifier.
 
 This is really a string extension and can take two possible values. Either
@@ -459,16 +453,16 @@ extension in a human or machine readable form.
 
 1. Initialisation and cleanup.
 
-X509V3_add_standard_extensions();
-
-This function should be called before any other extension code. It adds support
-for some common PKIX and Netscape extensions. Additional custom extensions can
-be added as well (see later).
+No special initialisation is needed before calling the extension functions.
+You used to have to call X509V3_add_standard_extensions(); but this is no longer
+required and this function no longer does anything.
 
 void X509V3_EXT_cleanup(void);
 
-This function should be called last to cleanup the extension code. After this
-call no other extension calls should be made.
+This function should be called to cleanup the extension code if any custom
+extensions have been added. If no custom extensions have been added then this
+call does nothing. After this call all custom extension code is freed up but
+you can still use the standard extensions.
 
 2. Printing and parsing extensions.
 
@@ -512,7 +506,7 @@ or CRL is due to be signed. Both return 0 on error on non zero for success.
 In each case 'conf' is the LHASH pointer of the configuration file to use
 and 'section' is the section containing the extension details.
 
-See the 'context functions' section for a description of the ctx paramater.
+See the 'context functions' section for a description of the ctx parameter.
 
 
 X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name,
@@ -531,7 +525,7 @@ takes the NID of the extension rather than its name.
 For example to produce basicConstraints with the CA flag and a path length of
 10:
 
-x = X509V3_EXT_conf_nid(NULL, NULL, NID_basicConstraints, "CA:TRUE,pathlen:10");
+x = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints,"CA:TRUE,pathlen:10");
 
 
 X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc);
@@ -659,7 +653,7 @@ The same as above but for an unsigned character value.
 int X509V3_add_value_bool(const char *name, int asn1_bool,
                                                 STACK_OF(CONF_VALUE) **extlist);
 
-This adds either "TRUE" or "FALSE" depending on the value of 'ans1_bool'
+This adds either "TRUE" or "FALSE" depending on the value of 'asn1_bool'
 
 int X509V3_add_value_bool_nf(char *name, int asn1_bool,
                                                 STACK_OF(CONF_VALUE) **extlist);
@@ -686,7 +680,7 @@ Multi value extensions are passed a STACK_OF(CONF_VALUE) name and value pairs
 or return a STACK_OF(CONF_VALUE).
 
 Raw extensions are just passed a BIO or a value and it is the extensions
-responsiblity to handle all the necessary printing.
+responsibility to handle all the necessary printing.
 
 There are two ways to add an extension. One is simply as an alias to an already
 existing extension. An alias is an extension that is identical in ASN1 structure
@@ -811,7 +805,7 @@ int i2r(struct v3_ext_method *method, void *ext, BIO *out, int indent);
 
 This function is passed the internal extension structure in the ext parameter
 and sends out a human readable version of the extension to out. The 'indent'
-paremeter should be noted to determine the necessary amount of indentation
+parameter should be noted to determine the necessary amount of indentation
 needed on the output.
 
 void * r2i(struct v3_ext_method *method, struct v3_ext_ctx *ctx, char *str);
@@ -882,7 +876,7 @@ d2i_PKCS12_fp(fp, p12)
 
 This is the same but for a FILE pointer.
 
-3. Parsing and creation functions.
+3. High level functions.
 
 3.1 Parsing with PKCS12_parse().
 
@@ -920,6 +914,14 @@ p12 = PKCS12_create(pass, "My Certificate", pkey, cert, NULL, 0,0,0,0,0);
 i2d_PKCS12_fp(fp, p12);
 PKCS12_free(p12);
 
+3.3 Changing a PKCS#12 structure password.
+
+int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass);
+
+This changes the password of an already existing PKCS#12 structure. oldpass
+is the old password and newpass is the new one. An error occurs if the old
+password is incorrect.
+
 LOW LEVEL FUNCTIONS.
 
 In some cases the high level functions do not provide the necessary
diff --git a/src/lib/libssl/src/doc/ssl.pod b/src/lib/libssl/src/doc/ssl.pod
index 46ee443f57..e69de29bb2 100644
--- a/src/lib/libssl/src/doc/ssl.pod
+++ b/src/lib/libssl/src/doc/ssl.pod
@@ -1,633 +0,0 @@
-
-=pod
-
-=head1 NAME
-
-SSL - OpenSSL SSL/TLS library
-
-=head1 SYNOPSIS
-
-=head1 DESCRIPTION
-
-The OpenSSL B<ssl> library implements the Secure Sockets Layer (SSL v2/v3) and
-Transport Layer Security (TLS v1) protocols. It provides a rich API which is
-documented here.
-
-=head1 HEADER FILES
-
-Currently the OpenSSL B<ssl> library provides the following C header files
-containing the prototypes for the data structures and and functions:
-
-=over 4
-
-=item B<ssl.h>
-
-That's the common header file for the SSL/TLS API.  Include it into your
-program to make the API of the B<ssl> library available. It internally
-includes both more private SSL headers and headers from the B<crypto> library.
-Whenever you need hard-core details on the internals of the SSL API, look
-inside this header file.
-
-=item B<ssl2.h>
-
-That's the sub header file dealing with the SSLv2 protocol only.
-I<Usually you don't have to include it explicitly because
-it's already included by ssl.h>.
-
-=item B<ssl3.h>
-
-That's the sub header file dealing with the SSLv3 protocol only.
-I<Usually you don't have to include it explicitly because
-it's already included by ssl.h>.
-
-=item B<ssl23.h>
-
-That's the sub header file dealing with the combined use of the SSLv2 and
-SSLv3 protocols.
-I<Usually you don't have to include it explicitly because
-it's already included by ssl.h>.
-
-=item B<tls1.h>
-
-That's the sub header file dealing with the TLSv1 protocol only.
-I<Usually you don't have to include it explicitly because
-it's already included by ssl.h>.
-
-=back
-
-=head1 DATA STRUCTURES
-
-Currently the OpenSSL B<ssl> library functions deals with the following data
-structures:
-
-=over 4
-
-=item B<SSL_METHOD> (SSL Method)
-
-That's a dispatch structure describing the internal B<ssl> library
-methods/functions which implement the various protocol versions (SSLv1, SSLv2
-and TLSv1). It's needed to create an B<SSL_CTX>.
-
-=item B<SSL_CIPHER> (SSL Cipher)
-
-This structure holds the algorithm information for a particular cipher which
-are a core part of the SSL/TLS protocol. The available ciphers are configured
-on a B<SSL_CTX> basis and the actually used ones are then part of the
-B<SSL_SESSION>.
-
-=item B<SSL_CTX> (SSL Context)
-
-That's the global context structure which is created by a server or client
-once per program life-time and which holds mainly default values for the
-B<SSL> structures which are later created for the connections.
-
-=item B<SSL_SESSION> (SSL Session)
-
-This is a structure containing the current SSL session details for a
-connection: B<SSL_CIPHER>s, client and server certificates, keys, etc.
-
-=item B<SSL> (SSL Connection)
-
-That's the main SSL/TLS structure which is created by a server or client per
-established connection. This actually is the core structure in the SSL API.
-Under run-time the application usually deals with this structure which has
-links to mostly all other structures.
-
-=back
-
-=head1 API FUNCTIONS
-
-Currently the OpenSSL B<ssl> library exports 214 API functions.
-They are documented in the following:
-
-=head2 DEALING WITH PROTOCOL METHODS
-
-Here we document the various API functions which deal with the SSL/TLS
-protocol methods defined in B<SSL_METHOD> structures.
-
-=over 4
-
-=item SSL_METHOD *B<SSLv2_client_method>(void);
-
-Constructor for the SSLv2 SSL_METHOD structure for a dedicated client.
-
-=item SSL_METHOD *B<SSLv2_server_method>(void);
-
-Constructor for the SSLv2 SSL_METHOD structure for a dedicated server.
-
-=item SSL_METHOD *B<SSLv2_method>(void);
-
-Constructor for the SSLv2 SSL_METHOD structure for combined client and server.
-
-=item SSL_METHOD *B<SSLv3_client_method>(void);
-
-Constructor for the SSLv3 SSL_METHOD structure for a dedicated client.
-
-=item SSL_METHOD *B<SSLv3_server_method>(void);
-
-Constructor for the SSLv3 SSL_METHOD structure for a dedicated server.
-
-=item SSL_METHOD *B<SSLv3_method>(void);
-
-Constructor for the SSLv3 SSL_METHOD structure for combined client and server.
-
-=item SSL_METHOD *B<TLSv1_client_method>(void);
-
-Constructor for the TLSv1 SSL_METHOD structure for a dedicated client.
-
-=item SSL_METHOD *B<TLSv1_server_method>(void);
-
-Constructor for the TLSv1 SSL_METHOD structure for a dedicated server.
-
-=item SSL_METHOD *B<TLSv1_method>(void);
-
-Constructor for the TLSv1 SSL_METHOD structure for combined client and server.
-
-=back
-
-=head2 DEALING WITH CIPHERS
-
-Here we document the various API functions which deal with the SSL/TLS
-ciphers defined in B<SSL_CIPHER> structures.
-
-=over 4
-
-=item char *B<SSL_CIPHER_description>(SSL_CIPHER *cipher, char *buf, int len);
-
-Write a string to I<buf> (with a maximum size of I<len>) containing a human
-readable description of I<cipher>. Returns I<buf>.
-
-=item int B<SSL_CIPHER_get_bits>(SSL_CIPHER *cipher, int *alg_bits);
-
-Determine the number of bits in I<cipher>. Because of export crippled ciphers
-there are two bits: The bits the algorithm supports in general (stored to
-I<alg_bits>) and the bits which are actually used (the return value).
-
-=item char *B<SSL_CIPHER_get_name>(SSL_CIPHER *cipher);
-
-Return the internal name of I<cipher> as a string. These are the various
-strings defined by the I<SSL2_TXT_xxx>, I<SSL3_TXT_xxx> and I<TLS1_TXT_xxx>
-definitions in the header files.
-
-=item char *B<SSL_CIPHER_get_version>(SSL_CIPHER *cipher);
-
-Returns a string like "C<TLSv1/SSLv3>" or "C<SSLv2>" which indicates the
-SSL/TLS protocol version to which I<cipher> belongs (i.e. where it was defined
-in the specification the first time).
-
-=back
-
-=head2 DEALING WITH PROTOCOL CONTEXTS
-
-Here we document the various API functions which deal with the SSL/TLS
-protocol context defined in the B<SSL_CTX> structure.
-
-=over 4
-
-=item int B<SSL_CTX_add_client_CA>(SSL_CTX *ctx, X509 *x);
-
-=item long B<SSL_CTX_add_extra_chain_cert>(SSL_CTX *ctx, X509 *x509);
-
-=item int B<SSL_CTX_add_session>(SSL_CTX *ctx, SSL_SESSION *c);
-
-=item int B<SSL_CTX_check_private_key>(SSL_CTX *ctx);
-
-=item long B<SSL_CTX_ctrl>(SSL_CTX *ctx, int cmd, long larg, char *parg);
-
-=item void B<SSL_CTX_flush_sessions>(SSL_CTX *s, long t);
-
-=item void B<SSL_CTX_free>(SSL_CTX *a);
-
-=item char *B<SSL_CTX_get_app_data>(SSL_CTX *ctx);
-
-=item X509_STORE *B<SSL_CTX_get_cert_store>(SSL_CTX *ctx);
-
-=item STACK *B<SSL_CTX_get_client_CA_list>(SSL_CTX *ctx);
-
-=item int (*B<SSL_CTX_get_client_cert_cb>(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
-
-=item char *B<SSL_CTX_get_ex_data>(SSL_CTX *s, int idx);
-
-=item int B<SSL_CTX_get_ex_new_index>(long argl, char *argp, int (*new_func);(void), int (*dup_func)(void), void (*free_func)(void))
-
-=item void (*B<SSL_CTX_get_info_callback>(SSL_CTX *ctx))(SSL *ssl, int cb, int ret);
-
-=item int B<SSL_CTX_get_quiet_shutdown>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_get_session_cache_mode>(SSL_CTX *ctx);
-
-=item long B<SSL_CTX_get_timeout>(SSL_CTX *ctx);
-
-=item int (*B<SSL_CTX_get_verify_callback>(SSL_CTX *ctx))(int ok, X509_STORE_CTX *ctx);
-
-=item int B<SSL_CTX_get_verify_mode>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_load_verify_locations>(SSL_CTX *ctx, char *CAfile, char *CApath);
-
-=item long B<SSL_CTX_need_tmp_RSA>(SSL_CTX *ctx);
-
-=item SSL_CTX *B<SSL_CTX_new>(SSL_METHOD *meth);
-
-=item int B<SSL_CTX_remove_session>(SSL_CTX *ctx, SSL_SESSION *c);
-
-=item int B<SSL_CTX_sess_accept>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_accept_good>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_accept_renegotiate>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_cache_full>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_cb_hits>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_connect>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_connect_good>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_connect_renegotiate>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_get_cache_size>(SSL_CTX *ctx);
-
-=item SSL_SESSION *(*B<SSL_CTX_sess_get_get_cb>(SSL_CTX *ctx))(SSL *ssl, unsigned char *data, int len, int *copy);
-
-=item int (*B<SSL_CTX_sess_get_new_cb>(SSL_CTX *ctx)(SSL *ssl, SSL_SESSION *sess);
-
-=item void (*B<SSL_CTX_sess_get_remove_cb>(SSL_CTX *ctx)(SSL_CTX *ctx, SSL_SESSION *sess);
-
-=item int B<SSL_CTX_sess_hits>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_misses>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_sess_number>(SSL_CTX *ctx);
-
-=item void B<SSL_CTX_sess_set_cache_size>(SSL_CTX *ctx,t);
-
-=item void B<SSL_CTX_sess_set_get_cb>(SSL_CTX *ctx, SSL_SESSION *(*cb)(SSL *ssl, unsigned char *data, int len, int *copy));
-
-=item void B<SSL_CTX_sess_set_new_cb>(SSL_CTX *ctx, int (*cb)(SSL *ssl, SSL_SESSION *sess));
-
-=item void B<SSL_CTX_sess_set_remove_cb>(SSL_CTX *ctx, void (*cb)(SSL_CTX *ctx, SSL_SESSION *sess));
-
-=item int B<SSL_CTX_sess_timeouts>(SSL_CTX *ctx);
-
-=item LHASH *B<SSL_CTX_sessions>(SSL_CTX *ctx);
-
-=item void B<SSL_CTX_set_app_data>(SSL_CTX *ctx, void *arg);
-
-=item void B<SSL_CTX_set_cert_store>(SSL_CTX *ctx, X509_STORE *cs);
-
-=item void B<SSL_CTX_set_cert_verify_cb>(SSL_CTX *ctx, int (*cb)(SSL_CTX *), char *arg)
-
-=item int B<SSL_CTX_set_cipher_list>(SSL_CTX *ctx, char *str);
-
-=item void B<SSL_CTX_set_client_CA_list>(SSL_CTX *ctx, STACK *list);
-
-=item void B<SSL_CTX_set_client_cert_cb>(SSL_CTX *ctx, int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey));
-
-=item void B<SSL_CTX_set_default_passwd_cb>(SSL_CTX *ctx, int (*cb);(void))
-
-=item void B<SSL_CTX_set_default_read_ahead>(SSL_CTX *ctx, int m);
-
-=item int B<SSL_CTX_set_default_verify_paths>(SSL_CTX *ctx);
-
-=item int B<SSL_CTX_set_ex_data>(SSL_CTX *s, int idx, char *arg);
-
-=item void B<SSL_CTX_set_info_callback>(SSL_CTX *ctx, void (*cb)(SSL *ssl, int cb, int ret));
-
-=item void B<SSL_CTX_set_options>(SSL_CTX *ctx, unsigned long op);
-
-=item void B<SSL_CTX_set_quiet_shutdown>(SSL_CTX *ctx, int mode);
-
-=item void B<SSL_CTX_set_session_cache_mode>(SSL_CTX *ctx, int mode);
-
-=item int B<SSL_CTX_set_ssl_version>(SSL_CTX *ctx, SSL_METHOD *meth);
-
-=item void B<SSL_CTX_set_timeout>(SSL_CTX *ctx, long t);
-
-=item long B<SSL_CTX_set_tmp_dh>(SSL_CTX* ctx, DH *dh);
-
-=item long B<SSL_CTX_set_tmp_dh_callback>(SSL_CTX *ctx, DH *(*cb)(void));
-
-=item long B<SSL_CTX_set_tmp_rsa>(SSL_CTX *ctx, RSA *rsa);
-
-=item SSL_CTX_set_tmp_rsa_callback
-
-C<long B<SSL_CTX_set_tmp_rsa_callback>(SSL_CTX *B<ctx>, RSA *(*B<cb>)(SSL *B<ssl>, int B<export>, int B<keylength>));>
-
-Sets the callback which will be called when a temporary private key is
-required. The B<C<export>> flag will be set if the reason for needing
-a temp key is that an export ciphersuite is in use, in which case,
-B<C<keylength>> will contain the required keylength in bits. Generate a key of
-appropriate size (using ???) and return it.
-
-=item SSL_set_tmp_rsa_callback
-
-long B<SSL_set_tmp_rsa_callback>(SSL *ssl, RSA *(*cb)(SSL *ssl, int export, int keylength));
-
-The same as L<"SSL_CTX_set_tmp_rsa_callback">, except it operates on an SSL
-session instead of a context.
-
-=item void B<SSL_CTX_set_verify>(SSL_CTX *ctx, int mode, int (*cb);(void))
-
-=item int B<SSL_CTX_use_PrivateKey>(SSL_CTX *ctx, EVP_PKEY *pkey);
-
-=item int B<SSL_CTX_use_PrivateKey_ASN1>(int type, SSL_CTX *ctx, unsigned char *d, long len);
-
-=item int B<SSL_CTX_use_PrivateKey_file>(SSL_CTX *ctx, char *file, int type);
-
-=item int B<SSL_CTX_use_RSAPrivateKey>(SSL_CTX *ctx, RSA *rsa);
-
-=item int B<SSL_CTX_use_RSAPrivateKey_ASN1>(SSL_CTX *ctx, unsigned char *d, long len);
-
-=item int B<SSL_CTX_use_RSAPrivateKey_file>(SSL_CTX *ctx, char *file, int type);
-
-=item int B<SSL_CTX_use_certificate>(SSL_CTX *ctx, X509 *x);
-
-=item int B<SSL_CTX_use_certificate_ASN1>(SSL_CTX *ctx, int len, unsigned char *d);
-
-=item int B<SSL_CTX_use_certificate_file>(SSL_CTX *ctx, char *file, int type);
-
-=back
-
-=head2 DEALING WITH SESSIONS
-
-Here we document the various API functions which deal with the SSL/TLS
-sessions defined in the B<SSL_SESSION> structures.
-
-=over 4
-
-=item int B<SSL_SESSION_cmp>(SSL_SESSION *a, SSL_SESSION *b);
-
-=item void B<SSL_SESSION_free>(SSL_SESSION *ss);
-
-=item char *B<SSL_SESSION_get_app_data>(SSL_SESSION *s);
-
-=item char *B<SSL_SESSION_get_ex_data>(SSL_SESSION *s, int idx);
-
-=item int B<SSL_SESSION_get_ex_new_index>(long argl, char *argp, int (*new_func);(void), int (*dup_func)(void), void (*free_func)(void))
-
-=item long B<SSL_SESSION_get_time>(SSL_SESSION *s);
-
-=item long B<SSL_SESSION_get_timeout>(SSL_SESSION *s);
-
-=item unsigned long B<SSL_SESSION_hash>(SSL_SESSION *a);
-
-=item SSL_SESSION *B<SSL_SESSION_new>(void);
-
-=item int B<SSL_SESSION_print>(BIO *bp, SSL_SESSION *x);
-
-=item int B<SSL_SESSION_print_fp>(FILE *fp, SSL_SESSION *x);
-
-=item void B<SSL_SESSION_set_app_data>(SSL_SESSION *s, char *a);
-
-=item int B<SSL_SESSION_set_ex_data>(SSL_SESSION *s, int idx, char *arg);
-
-=item long B<SSL_SESSION_set_time>(SSL_SESSION *s, long t);
-
-=item long B<SSL_SESSION_set_timeout>(SSL_SESSION *s, long t);
-
-=back
-
-=head2 DEALING WITH CONNECTIONS
-
-Here we document the various API functions which deal with the SSL/TLS
-connection defined in the B<SSL> structure.
-
-=over 4
-
-=item int B<SSL_accept>(SSL *ssl);
-
-=item int B<SSL_add_dir_cert_subjects_to_stack>(STACK *stack, const char *dir);
-
-=item int B<SSL_add_file_cert_subjects_to_stack>(STACK *stack, const char *file);
-
-=item int B<SSL_add_client_CA>(SSL *ssl, X509 *x);
-
-=item char *B<SSL_alert_desc_string>(int value);
-
-=item char *B<SSL_alert_desc_string_long>(int value);
-
-=item char *B<SSL_alert_type_string>(int value);
-
-=item char *B<SSL_alert_type_string_long>(int value);
-
-=item int B<SSL_check_private_key>(SSL *ssl);
-
-=item void B<SSL_clear>(SSL *ssl);
-
-=item long B<SSL_clear_num_renegotiations>(SSL *ssl);
-
-=item int B<SSL_connect>(SSL *ssl);
-
-=item void B<SSL_copy_session_id>(SSL *t, SSL *f);
-
-=item long B<SSL_ctrl>(SSL *ssl, int cmd, long larg, char *parg);
-
-=item int B<SSL_do_handshake>(SSL *ssl);
-
-=item SSL *B<SSL_dup>(SSL *ssl);
-
-=item STACK *B<SSL_dup_CA_list>(STACK *sk);
-
-=item void B<SSL_free>(SSL *ssl);
-
-=item SSL_CTX *B<SSL_get_SSL_CTX>(SSL *ssl);
-
-=item char *B<SSL_get_app_data>(SSL *ssl);
-
-=item X509 *B<SSL_get_certificate>(SSL *ssl);
-
-=item SSL_CIPHER *B<SSL_get_cipher>(SSL *ssl);
-
-=item int B<SSL_get_cipher_bits>(SSL *ssl, int *alg_bits);
-
-=item char *B<SSL_get_cipher_list>(SSL *ssl, int n);
-
-=item char *B<SSL_get_cipher_name>(SSL *ssl);
-
-=item char *B<SSL_get_cipher_version>(SSL *ssl);
-
-=item STACK *B<SSL_get_ciphers>(SSL *ssl);
-
-=item STACK *B<SSL_get_client_CA_list>(SSL *ssl);
-
-=item SSL_CIPHER *B<SSL_get_current_cipher>(SSL *ssl);
-
-=item long B<SSL_get_default_timeout>(SSL *ssl);
-
-=item int B<SSL_get_error>(SSL *ssl, int i);
-
-=item char *B<SSL_get_ex_data>(SSL *ssl, int idx);
-
-=item int B<SSL_get_ex_data_X509_STORE_CTX_idx>(void);
-
-=item int B<SSL_get_ex_new_index>(long argl, char *argp, int (*new_func);(void), int (*dup_func)(void), void (*free_func)(void))
-
-=item int B<SSL_get_fd>(SSL *ssl);
-
-=item void (*B<SSL_get_info_callback>(SSL *ssl);)(void)
-
-=item STACK *B<SSL_get_peer_cert_chain>(SSL *ssl);
-
-=item X509 *B<SSL_get_peer_certificate>(SSL *ssl);
-
-=item EVP_PKEY *B<SSL_get_privatekey>(SSL *ssl);
-
-=item int B<SSL_get_quiet_shutdown>(SSL *ssl);
-
-=item BIO *B<SSL_get_rbio>(SSL *ssl);
-
-=item int B<SSL_get_read_ahead>(SSL *ssl);
-
-=item SSL_SESSION *B<SSL_get_session>(SSL *ssl);
-
-=item char *B<SSL_get_shared_ciphers>(SSL *ssl, char *buf, int len);
-
-=item int B<SSL_get_shutdown>(SSL *ssl);
-
-=item SSL_METHOD *B<SSL_get_ssl_method>(SSL *ssl);
-
-=item int B<SSL_get_state>(SSL *ssl);
-
-=item long B<SSL_get_time>(SSL *ssl);
-
-=item long B<SSL_get_timeout>(SSL *ssl);
-
-=item int (*B<SSL_get_verify_callback>(SSL *ssl);)(void)
-
-=item int B<SSL_get_verify_mode>(SSL *ssl);
-
-=item long B<SSL_get_verify_result>(SSL *ssl);
-
-=item char *B<SSL_get_version>(SSL *ssl);
-
-=item BIO *B<SSL_get_wbio>(SSL *ssl);
-
-=item int B<SSL_in_accept_init>(SSL *ssl);
-
-=item int B<SSL_in_before>(SSL *ssl);
-
-=item int B<SSL_in_connect_init>(SSL *ssl);
-
-=item int B<SSL_in_init>(SSL *ssl);
-
-=item int B<SSL_is_init_finished>(SSL *ssl);
-
-=item STACK *B<SSL_load_client_CA_file>(char *file);
-
-=item void B<SSL_load_error_strings>(void);
-
-=item SSL *B<SSL_new>(SSL_CTX *ctx);
-
-=item long B<SSL_num_renegotiations>(SSL *ssl);
-
-=item int B<SSL_peek>(SSL *ssl, char *buf, int num);
-
-=item int B<SSL_pending>(SSL *ssl);
-
-=item int B<SSL_read>(SSL *ssl, char *buf, int num);
-
-=item int B<SSL_renegotiate>(SSL *ssl);
-
-=item char *B<SSL_rstate_string>(SSL *ssl);
-
-=item char *B<SSL_rstate_string_long>(SSL *ssl);
-
-=item long B<SSL_session_reused>(SSL *ssl);
-
-=item void B<SSL_set_accept_state>(SSL *ssl);
-
-=item void B<SSL_set_app_data>(SSL *ssl, char *arg);
-
-=item void B<SSL_set_bio>(SSL *ssl, BIO *rbio, BIO *wbio);
-
-=item int B<SSL_set_cipher_list>(SSL *ssl, char *str);
-
-=item void B<SSL_set_client_CA_list>(SSL *ssl, STACK *list);
-
-=item void B<SSL_set_connect_state>(SSL *ssl);
-
-=item int B<SSL_set_ex_data>(SSL *ssl, int idx, char *arg);
-
-=item int B<SSL_set_fd>(SSL *ssl, int fd);
-
-=item void B<SSL_set_info_callback>(SSL *ssl, void (*cb);(void))
-
-=item void B<SSL_set_options>(SSL *ssl, unsigned long op);
-
-=item void B<SSL_set_quiet_shutdown>(SSL *ssl, int mode);
-
-=item void B<SSL_set_read_ahead>(SSL *ssl, int yes);
-
-=item int B<SSL_set_rfd>(SSL *ssl, int fd);
-
-=item int B<SSL_set_session>(SSL *ssl, SSL_SESSION *session);
-
-=item void B<SSL_set_shutdown>(SSL *ssl, int mode);
-
-=item int B<SSL_set_ssl_method>(SSL *ssl, SSL_METHOD *meth);
-
-=item void B<SSL_set_time>(SSL *ssl, long t);
-
-=item void B<SSL_set_timeout>(SSL *ssl, long t);
-
-=item void B<SSL_set_verify>(SSL *ssl, int mode, int (*callback);(void))
-
-=item void B<SSL_set_verify_result>(SSL *ssl, long arg);
-
-=item int B<SSL_set_wfd>(SSL *ssl, int fd);
-
-=item int B<SSL_shutdown>(SSL *ssl);
-
-=item int B<SSL_state>(SSL *ssl);
-
-=item char *B<SSL_state_string>(SSL *ssl);
-
-=item char *B<SSL_state_string_long>(SSL *ssl);
-
-=item long B<SSL_total_renegotiations>(SSL *ssl);
-
-=item int B<SSL_use_PrivateKey>(SSL *ssl, EVP_PKEY *pkey);
-
-=item int B<SSL_use_PrivateKey_ASN1>(int type, SSL *ssl, unsigned char *d, long len);
-
-=item int B<SSL_use_PrivateKey_file>(SSL *ssl, char *file, int type);
-
-=item int B<SSL_use_RSAPrivateKey>(SSL *ssl, RSA *rsa);
-
-=item int B<SSL_use_RSAPrivateKey_ASN1>(SSL *ssl, unsigned char *d, long len);
-
-=item int B<SSL_use_RSAPrivateKey_file>(SSL *ssl, char *file, int type);
-
-=item int B<SSL_use_certificate>(SSL *ssl, X509 *x);
-
-=item int B<SSL_use_certificate_ASN1>(SSL *ssl, int len, unsigned char *d);
-
-=item int B<SSL_use_certificate_file>(SSL *ssl, char *file, int type);
-
-=item int B<SSL_version>(SSL *ssl);
-
-=item int B<SSL_want>(SSL *ssl);
-
-=item int B<SSL_want_nothing>(SSL *ssl);
-
-=item int B<SSL_want_read>(SSL *ssl);
-
-=item int B<SSL_want_write>(SSL *ssl);
-
-=item int B<SSL_want_x509_lookup>(s);
-
-=item int B<SSL_write>(SSL *ssl, char *buf, int num);
-
-=back
-
-=head1 SEE ALSO
-
-openssl(1), crypto(3)
-
-=head1 HISTORY
-
-The ssl(3) document appeared in OpenSSL 0.9.2
-
-=cut
-
diff --git a/src/lib/libssl/src/doc/ssl/SSL_get_error.pod b/src/lib/libssl/src/doc/ssl/SSL_get_error.pod
new file mode 100644
index 0000000000..9cacdedc57
--- /dev/null
+++ b/src/lib/libssl/src/doc/ssl/SSL_get_error.pod
@@ -0,0 +1,91 @@
+=pod
+
+=head1 NAME
+
+SSL_get_error - obtain result code for SSL I/O operation
+
+=head1 SYNOPSIS
+
+ #include <openssl/ssl.h>
+
+ int SSL_get_error(SSL *ssl, int ret);
+
+=head1 DESCRIPTION
+
+SSL_get_error() returns a result code (suitable for the C "switch"
+statement) for a preceding call to SSL_connect(), SSL_accept(),
+SSL_read(), or SSL_write() on B<ssl>.  The value returned by that
+SSL I/O function must be passed to SSL_get_error() in parameter
+B<ret>.
+
+In addition to B<ssl> and B<ret>, SSL_get_error() inspects the
+current thread's OpenSSL error queue.  Thus, SSL_get_error() must be
+used in the same thread that performed the SSL I/O operation, and no
+other OpenSSL function calls should appear in between.  The current
+thread's error queue must be empty before the SSL I/O operation is
+attempted, or SSL_get_error() will not work reliably.
+
+=head1 RETURN VALUES
+
+The following return values can currently occur:
+
+=over 4
+
+=item SSL_ERROR_NONE
+
+The SSL I/O operation completed.  This result code is returned
+if and only if B<ret E<gt> 0>.
+
+=item SSL_ERROR_ZERO_RETURN
+
+The SSL connection has been closed.  If the protocol version is SSL 3.0
+or TLS 1.0, this result code is returned only if a closure
+alerts has occurred in the protocol, i.e. if the connection has been
+closed cleanly.
+
+=item SSL_ERROR_WANT_READ, SSL_ERROR_WANT_WRITE
+
+The operation did not complete; the same SSL I/O function should be
+called again later.  There will be protocol progress if, by then, the
+underlying B<BIO> has data available for reading (if the result code is
+B<SSL_ERROR_WANT_READ>) or allows writing data (B<SSL_ERROR_WANT_WRITE>). 
+For socket B<BIO>s (e.g. when SSL_set_fd() was used) this means that
+select() or poll() on the underlying socket can be used to find out
+when the SSL I/O function should be retried.
+
+Caveat: Any SSL I/O function can lead to either of
+B<SSL_ERROR_WANT_READ> and B<SSL_ERROR_WANT_WRITE>, i.e. SSL_read()
+may want to write data and SSL_write() may want to read data.
+
+=item SSL_ERROR_WANT_X509_LOOKUP
+
+The operation did not complete because an application callback set by
+SSL_CTX_set_client_cert_cb() has asked to be called again.
+The SSL I/O function should be called again later.
+Details depend on the application.
+
+=item SSL_ERROR_SYSCALL
+
+Some I/O error occurred.  The OpenSSL error queue may contain more
+information on the error.  If the error queue is empty
+(i.e. ERR_get_error() returns 0), B<ret> can be used to find out more
+about the error: If B<ret == 0>, an EOF was observed that violates
+the protocol.  If B<ret == -1>, the underlying B<BIO> reported an
+I/O error (for socket I/O on Unix systems, consult B<errno> for details).
+
+=item SSL_ERROR_SSL
+
+A failure in the SSL library occurred, usually a protocol error.  The
+OpenSSL error queue contains more information on the error.
+
+=back
+
+=head1 SEE ALSO
+
+L<ssl(3)|ssl(3)>, L<err(3)|err(3)>
+
+=head1 HISTORY
+
+SSL_get_error() was added in SSLeay 0.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/ssl/ssl.pod b/src/lib/libssl/src/doc/ssl/ssl.pod
new file mode 100644
index 0000000000..e53876654a
--- /dev/null
+++ b/src/lib/libssl/src/doc/ssl/ssl.pod
@@ -0,0 +1,634 @@
+
+=pod
+
+=head1 NAME
+
+SSL - OpenSSL SSL/TLS library
+
+=head1 SYNOPSIS
+
+=head1 DESCRIPTION
+
+The OpenSSL B<ssl> library implements the Secure Sockets Layer (SSL v2/v3) and
+Transport Layer Security (TLS v1) protocols. It provides a rich API which is
+documented here.
+
+=head1 HEADER FILES
+
+Currently the OpenSSL B<ssl> library provides the following C header files
+containing the prototypes for the data structures and and functions:
+
+=over 4
+
+=item B<ssl.h>
+
+That's the common header file for the SSL/TLS API.  Include it into your
+program to make the API of the B<ssl> library available. It internally
+includes both more private SSL headers and headers from the B<crypto> library.
+Whenever you need hard-core details on the internals of the SSL API, look
+inside this header file.
+
+=item B<ssl2.h>
+
+That's the sub header file dealing with the SSLv2 protocol only.
+I<Usually you don't have to include it explicitly because
+it's already included by ssl.h>.
+
+=item B<ssl3.h>
+
+That's the sub header file dealing with the SSLv3 protocol only.
+I<Usually you don't have to include it explicitly because
+it's already included by ssl.h>.
+
+=item B<ssl23.h>
+
+That's the sub header file dealing with the combined use of the SSLv2 and
+SSLv3 protocols.
+I<Usually you don't have to include it explicitly because
+it's already included by ssl.h>.
+
+=item B<tls1.h>
+
+That's the sub header file dealing with the TLSv1 protocol only.
+I<Usually you don't have to include it explicitly because
+it's already included by ssl.h>.
+
+=back
+
+=head1 DATA STRUCTURES
+
+Currently the OpenSSL B<ssl> library functions deals with the following data
+structures:
+
+=over 4
+
+=item B<SSL_METHOD> (SSL Method)
+
+That's a dispatch structure describing the internal B<ssl> library
+methods/functions which implement the various protocol versions (SSLv1, SSLv2
+and TLSv1). It's needed to create an B<SSL_CTX>.
+
+=item B<SSL_CIPHER> (SSL Cipher)
+
+This structure holds the algorithm information for a particular cipher which
+are a core part of the SSL/TLS protocol. The available ciphers are configured
+on a B<SSL_CTX> basis and the actually used ones are then part of the
+B<SSL_SESSION>.
+
+=item B<SSL_CTX> (SSL Context)
+
+That's the global context structure which is created by a server or client
+once per program life-time and which holds mainly default values for the
+B<SSL> structures which are later created for the connections.
+
+=item B<SSL_SESSION> (SSL Session)
+
+This is a structure containing the current SSL session details for a
+connection: B<SSL_CIPHER>s, client and server certificates, keys, etc.
+
+=item B<SSL> (SSL Connection)
+
+That's the main SSL/TLS structure which is created by a server or client per
+established connection. This actually is the core structure in the SSL API.
+Under run-time the application usually deals with this structure which has
+links to mostly all other structures.
+
+=back
+
+=head1 API FUNCTIONS
+
+Currently the OpenSSL B<ssl> library exports 214 API functions.
+They are documented in the following:
+
+=head2 DEALING WITH PROTOCOL METHODS
+
+Here we document the various API functions which deal with the SSL/TLS
+protocol methods defined in B<SSL_METHOD> structures.
+
+=over 4
+
+=item SSL_METHOD *B<SSLv2_client_method>(void);
+
+Constructor for the SSLv2 SSL_METHOD structure for a dedicated client.
+
+=item SSL_METHOD *B<SSLv2_server_method>(void);
+
+Constructor for the SSLv2 SSL_METHOD structure for a dedicated server.
+
+=item SSL_METHOD *B<SSLv2_method>(void);
+
+Constructor for the SSLv2 SSL_METHOD structure for combined client and server.
+
+=item SSL_METHOD *B<SSLv3_client_method>(void);
+
+Constructor for the SSLv3 SSL_METHOD structure for a dedicated client.
+
+=item SSL_METHOD *B<SSLv3_server_method>(void);
+
+Constructor for the SSLv3 SSL_METHOD structure for a dedicated server.
+
+=item SSL_METHOD *B<SSLv3_method>(void);
+
+Constructor for the SSLv3 SSL_METHOD structure for combined client and server.
+
+=item SSL_METHOD *B<TLSv1_client_method>(void);
+
+Constructor for the TLSv1 SSL_METHOD structure for a dedicated client.
+
+=item SSL_METHOD *B<TLSv1_server_method>(void);
+
+Constructor for the TLSv1 SSL_METHOD structure for a dedicated server.
+
+=item SSL_METHOD *B<TLSv1_method>(void);
+
+Constructor for the TLSv1 SSL_METHOD structure for combined client and server.
+
+=back
+
+=head2 DEALING WITH CIPHERS
+
+Here we document the various API functions which deal with the SSL/TLS
+ciphers defined in B<SSL_CIPHER> structures.
+
+=over 4
+
+=item char *B<SSL_CIPHER_description>(SSL_CIPHER *cipher, char *buf, int len);
+
+Write a string to I<buf> (with a maximum size of I<len>) containing a human
+readable description of I<cipher>. Returns I<buf>.
+
+=item int B<SSL_CIPHER_get_bits>(SSL_CIPHER *cipher, int *alg_bits);
+
+Determine the number of bits in I<cipher>. Because of export crippled ciphers
+there are two bits: The bits the algorithm supports in general (stored to
+I<alg_bits>) and the bits which are actually used (the return value).
+
+=item char *B<SSL_CIPHER_get_name>(SSL_CIPHER *cipher);
+
+Return the internal name of I<cipher> as a string. These are the various
+strings defined by the I<SSL2_TXT_xxx>, I<SSL3_TXT_xxx> and I<TLS1_TXT_xxx>
+definitions in the header files.
+
+=item char *B<SSL_CIPHER_get_version>(SSL_CIPHER *cipher);
+
+Returns a string like "C<TLSv1/SSLv3>" or "C<SSLv2>" which indicates the
+SSL/TLS protocol version to which I<cipher> belongs (i.e. where it was defined
+in the specification the first time).
+
+=back
+
+=head2 DEALING WITH PROTOCOL CONTEXTS
+
+Here we document the various API functions which deal with the SSL/TLS
+protocol context defined in the B<SSL_CTX> structure.
+
+=over 4
+
+=item int B<SSL_CTX_add_client_CA>(SSL_CTX *ctx, X509 *x);
+
+=item long B<SSL_CTX_add_extra_chain_cert>(SSL_CTX *ctx, X509 *x509);
+
+=item int B<SSL_CTX_add_session>(SSL_CTX *ctx, SSL_SESSION *c);
+
+=item int B<SSL_CTX_check_private_key>(SSL_CTX *ctx);
+
+=item long B<SSL_CTX_ctrl>(SSL_CTX *ctx, int cmd, long larg, char *parg);
+
+=item void B<SSL_CTX_flush_sessions>(SSL_CTX *s, long t);
+
+=item void B<SSL_CTX_free>(SSL_CTX *a);
+
+=item char *B<SSL_CTX_get_app_data>(SSL_CTX *ctx);
+
+=item X509_STORE *B<SSL_CTX_get_cert_store>(SSL_CTX *ctx);
+
+=item STACK *B<SSL_CTX_get_client_CA_list>(SSL_CTX *ctx);
+
+=item int (*B<SSL_CTX_get_client_cert_cb>(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
+
+=item char *B<SSL_CTX_get_ex_data>(SSL_CTX *s, int idx);
+
+=item int B<SSL_CTX_get_ex_new_index>(long argl, char *argp, int (*new_func);(void), int (*dup_func)(void), void (*free_func)(void))
+
+=item void (*B<SSL_CTX_get_info_callback>(SSL_CTX *ctx))(SSL *ssl, int cb, int ret);
+
+=item int B<SSL_CTX_get_quiet_shutdown>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_get_session_cache_mode>(SSL_CTX *ctx);
+
+=item long B<SSL_CTX_get_timeout>(SSL_CTX *ctx);
+
+=item int (*B<SSL_CTX_get_verify_callback>(SSL_CTX *ctx))(int ok, X509_STORE_CTX *ctx);
+
+=item int B<SSL_CTX_get_verify_mode>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_load_verify_locations>(SSL_CTX *ctx, char *CAfile, char *CApath);
+
+=item long B<SSL_CTX_need_tmp_RSA>(SSL_CTX *ctx);
+
+=item SSL_CTX *B<SSL_CTX_new>(SSL_METHOD *meth);
+
+=item int B<SSL_CTX_remove_session>(SSL_CTX *ctx, SSL_SESSION *c);
+
+=item int B<SSL_CTX_sess_accept>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_accept_good>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_accept_renegotiate>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_cache_full>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_cb_hits>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_connect>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_connect_good>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_connect_renegotiate>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_get_cache_size>(SSL_CTX *ctx);
+
+=item SSL_SESSION *(*B<SSL_CTX_sess_get_get_cb>(SSL_CTX *ctx))(SSL *ssl, unsigned char *data, int len, int *copy);
+
+=item int (*B<SSL_CTX_sess_get_new_cb>(SSL_CTX *ctx)(SSL *ssl, SSL_SESSION *sess);
+
+=item void (*B<SSL_CTX_sess_get_remove_cb>(SSL_CTX *ctx)(SSL_CTX *ctx, SSL_SESSION *sess);
+
+=item int B<SSL_CTX_sess_hits>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_misses>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_sess_number>(SSL_CTX *ctx);
+
+=item void B<SSL_CTX_sess_set_cache_size>(SSL_CTX *ctx,t);
+
+=item void B<SSL_CTX_sess_set_get_cb>(SSL_CTX *ctx, SSL_SESSION *(*cb)(SSL *ssl, unsigned char *data, int len, int *copy));
+
+=item void B<SSL_CTX_sess_set_new_cb>(SSL_CTX *ctx, int (*cb)(SSL *ssl, SSL_SESSION *sess));
+
+=item void B<SSL_CTX_sess_set_remove_cb>(SSL_CTX *ctx, void (*cb)(SSL_CTX *ctx, SSL_SESSION *sess));
+
+=item int B<SSL_CTX_sess_timeouts>(SSL_CTX *ctx);
+
+=item LHASH *B<SSL_CTX_sessions>(SSL_CTX *ctx);
+
+=item void B<SSL_CTX_set_app_data>(SSL_CTX *ctx, void *arg);
+
+=item void B<SSL_CTX_set_cert_store>(SSL_CTX *ctx, X509_STORE *cs);
+
+=item void B<SSL_CTX_set_cert_verify_cb>(SSL_CTX *ctx, int (*cb)(SSL_CTX *), char *arg)
+
+=item int B<SSL_CTX_set_cipher_list>(SSL_CTX *ctx, char *str);
+
+=item void B<SSL_CTX_set_client_CA_list>(SSL_CTX *ctx, STACK *list);
+
+=item void B<SSL_CTX_set_client_cert_cb>(SSL_CTX *ctx, int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey));
+
+=item void B<SSL_CTX_set_default_passwd_cb>(SSL_CTX *ctx, int (*cb);(void))
+
+=item void B<SSL_CTX_set_default_read_ahead>(SSL_CTX *ctx, int m);
+
+=item int B<SSL_CTX_set_default_verify_paths>(SSL_CTX *ctx);
+
+=item int B<SSL_CTX_set_ex_data>(SSL_CTX *s, int idx, char *arg);
+
+=item void B<SSL_CTX_set_info_callback>(SSL_CTX *ctx, void (*cb)(SSL *ssl, int cb, int ret));
+
+=item void B<SSL_CTX_set_options>(SSL_CTX *ctx, unsigned long op);
+
+=item void B<SSL_CTX_set_quiet_shutdown>(SSL_CTX *ctx, int mode);
+
+=item void B<SSL_CTX_set_session_cache_mode>(SSL_CTX *ctx, int mode);
+
+=item int B<SSL_CTX_set_ssl_version>(SSL_CTX *ctx, SSL_METHOD *meth);
+
+=item void B<SSL_CTX_set_timeout>(SSL_CTX *ctx, long t);
+
+=item long B<SSL_CTX_set_tmp_dh>(SSL_CTX* ctx, DH *dh);
+
+=item long B<SSL_CTX_set_tmp_dh_callback>(SSL_CTX *ctx, DH *(*cb)(void));
+
+=item long B<SSL_CTX_set_tmp_rsa>(SSL_CTX *ctx, RSA *rsa);
+
+=item SSL_CTX_set_tmp_rsa_callback
+
+C<long B<SSL_CTX_set_tmp_rsa_callback>(SSL_CTX *B<ctx>, RSA *(*B<cb>)(SSL *B<ssl>, int B<export>, int B<keylength>));>
+
+Sets the callback which will be called when a temporary private key is
+required. The B<C<export>> flag will be set if the reason for needing
+a temp key is that an export ciphersuite is in use, in which case,
+B<C<keylength>> will contain the required keylength in bits. Generate a key of
+appropriate size (using ???) and return it.
+
+=item SSL_set_tmp_rsa_callback
+
+long B<SSL_set_tmp_rsa_callback>(SSL *ssl, RSA *(*cb)(SSL *ssl, int export, int keylength));
+
+The same as L<"SSL_CTX_set_tmp_rsa_callback">, except it operates on an SSL
+session instead of a context.
+
+=item void B<SSL_CTX_set_verify>(SSL_CTX *ctx, int mode, int (*cb);(void))
+
+=item int B<SSL_CTX_use_PrivateKey>(SSL_CTX *ctx, EVP_PKEY *pkey);
+
+=item int B<SSL_CTX_use_PrivateKey_ASN1>(int type, SSL_CTX *ctx, unsigned char *d, long len);
+
+=item int B<SSL_CTX_use_PrivateKey_file>(SSL_CTX *ctx, char *file, int type);
+
+=item int B<SSL_CTX_use_RSAPrivateKey>(SSL_CTX *ctx, RSA *rsa);
+
+=item int B<SSL_CTX_use_RSAPrivateKey_ASN1>(SSL_CTX *ctx, unsigned char *d, long len);
+
+=item int B<SSL_CTX_use_RSAPrivateKey_file>(SSL_CTX *ctx, char *file, int type);
+
+=item int B<SSL_CTX_use_certificate>(SSL_CTX *ctx, X509 *x);
+
+=item int B<SSL_CTX_use_certificate_ASN1>(SSL_CTX *ctx, int len, unsigned char *d);
+
+=item int B<SSL_CTX_use_certificate_file>(SSL_CTX *ctx, char *file, int type);
+
+=back
+
+=head2 DEALING WITH SESSIONS
+
+Here we document the various API functions which deal with the SSL/TLS
+sessions defined in the B<SSL_SESSION> structures.
+
+=over 4
+
+=item int B<SSL_SESSION_cmp>(SSL_SESSION *a, SSL_SESSION *b);
+
+=item void B<SSL_SESSION_free>(SSL_SESSION *ss);
+
+=item char *B<SSL_SESSION_get_app_data>(SSL_SESSION *s);
+
+=item char *B<SSL_SESSION_get_ex_data>(SSL_SESSION *s, int idx);
+
+=item int B<SSL_SESSION_get_ex_new_index>(long argl, char *argp, int (*new_func);(void), int (*dup_func)(void), void (*free_func)(void))
+
+=item long B<SSL_SESSION_get_time>(SSL_SESSION *s);
+
+=item long B<SSL_SESSION_get_timeout>(SSL_SESSION *s);
+
+=item unsigned long B<SSL_SESSION_hash>(SSL_SESSION *a);
+
+=item SSL_SESSION *B<SSL_SESSION_new>(void);
+
+=item int B<SSL_SESSION_print>(BIO *bp, SSL_SESSION *x);
+
+=item int B<SSL_SESSION_print_fp>(FILE *fp, SSL_SESSION *x);
+
+=item void B<SSL_SESSION_set_app_data>(SSL_SESSION *s, char *a);
+
+=item int B<SSL_SESSION_set_ex_data>(SSL_SESSION *s, int idx, char *arg);
+
+=item long B<SSL_SESSION_set_time>(SSL_SESSION *s, long t);
+
+=item long B<SSL_SESSION_set_timeout>(SSL_SESSION *s, long t);
+
+=back
+
+=head2 DEALING WITH CONNECTIONS
+
+Here we document the various API functions which deal with the SSL/TLS
+connection defined in the B<SSL> structure.
+
+=over 4
+
+=item int B<SSL_accept>(SSL *ssl);
+
+=item int B<SSL_add_dir_cert_subjects_to_stack>(STACK *stack, const char *dir);
+
+=item int B<SSL_add_file_cert_subjects_to_stack>(STACK *stack, const char *file);
+
+=item int B<SSL_add_client_CA>(SSL *ssl, X509 *x);
+
+=item char *B<SSL_alert_desc_string>(int value);
+
+=item char *B<SSL_alert_desc_string_long>(int value);
+
+=item char *B<SSL_alert_type_string>(int value);
+
+=item char *B<SSL_alert_type_string_long>(int value);
+
+=item int B<SSL_check_private_key>(SSL *ssl);
+
+=item void B<SSL_clear>(SSL *ssl);
+
+=item long B<SSL_clear_num_renegotiations>(SSL *ssl);
+
+=item int B<SSL_connect>(SSL *ssl);
+
+=item void B<SSL_copy_session_id>(SSL *t, SSL *f);
+
+=item long B<SSL_ctrl>(SSL *ssl, int cmd, long larg, char *parg);
+
+=item int B<SSL_do_handshake>(SSL *ssl);
+
+=item SSL *B<SSL_dup>(SSL *ssl);
+
+=item STACK *B<SSL_dup_CA_list>(STACK *sk);
+
+=item void B<SSL_free>(SSL *ssl);
+
+=item SSL_CTX *B<SSL_get_SSL_CTX>(SSL *ssl);
+
+=item char *B<SSL_get_app_data>(SSL *ssl);
+
+=item X509 *B<SSL_get_certificate>(SSL *ssl);
+
+=item SSL_CIPHER *B<SSL_get_cipher>(SSL *ssl);
+
+=item int B<SSL_get_cipher_bits>(SSL *ssl, int *alg_bits);
+
+=item char *B<SSL_get_cipher_list>(SSL *ssl, int n);
+
+=item char *B<SSL_get_cipher_name>(SSL *ssl);
+
+=item char *B<SSL_get_cipher_version>(SSL *ssl);
+
+=item STACK *B<SSL_get_ciphers>(SSL *ssl);
+
+=item STACK *B<SSL_get_client_CA_list>(SSL *ssl);
+
+=item SSL_CIPHER *B<SSL_get_current_cipher>(SSL *ssl);
+
+=item long B<SSL_get_default_timeout>(SSL *ssl);
+
+=item int B<SSL_get_error>(SSL *ssl, int i);
+
+=item char *B<SSL_get_ex_data>(SSL *ssl, int idx);
+
+=item int B<SSL_get_ex_data_X509_STORE_CTX_idx>(void);
+
+=item int B<SSL_get_ex_new_index>(long argl, char *argp, int (*new_func);(void), int (*dup_func)(void), void (*free_func)(void))
+
+=item int B<SSL_get_fd>(SSL *ssl);
+
+=item void (*B<SSL_get_info_callback>(SSL *ssl);)(void)
+
+=item STACK *B<SSL_get_peer_cert_chain>(SSL *ssl);
+
+=item X509 *B<SSL_get_peer_certificate>(SSL *ssl);
+
+=item EVP_PKEY *B<SSL_get_privatekey>(SSL *ssl);
+
+=item int B<SSL_get_quiet_shutdown>(SSL *ssl);
+
+=item BIO *B<SSL_get_rbio>(SSL *ssl);
+
+=item int B<SSL_get_read_ahead>(SSL *ssl);
+
+=item SSL_SESSION *B<SSL_get_session>(SSL *ssl);
+
+=item char *B<SSL_get_shared_ciphers>(SSL *ssl, char *buf, int len);
+
+=item int B<SSL_get_shutdown>(SSL *ssl);
+
+=item SSL_METHOD *B<SSL_get_ssl_method>(SSL *ssl);
+
+=item int B<SSL_get_state>(SSL *ssl);
+
+=item long B<SSL_get_time>(SSL *ssl);
+
+=item long B<SSL_get_timeout>(SSL *ssl);
+
+=item int (*B<SSL_get_verify_callback>(SSL *ssl);)(void)
+
+=item int B<SSL_get_verify_mode>(SSL *ssl);
+
+=item long B<SSL_get_verify_result>(SSL *ssl);
+
+=item char *B<SSL_get_version>(SSL *ssl);
+
+=item BIO *B<SSL_get_wbio>(SSL *ssl);
+
+=item int B<SSL_in_accept_init>(SSL *ssl);
+
+=item int B<SSL_in_before>(SSL *ssl);
+
+=item int B<SSL_in_connect_init>(SSL *ssl);
+
+=item int B<SSL_in_init>(SSL *ssl);
+
+=item int B<SSL_is_init_finished>(SSL *ssl);
+
+=item STACK *B<SSL_load_client_CA_file>(char *file);
+
+=item void B<SSL_load_error_strings>(void);
+
+=item SSL *B<SSL_new>(SSL_CTX *ctx);
+
+=item long B<SSL_num_renegotiations>(SSL *ssl);
+
+=item int B<SSL_peek>(SSL *ssl, char *buf, int num);
+
+=item int B<SSL_pending>(SSL *ssl);
+
+=item int B<SSL_read>(SSL *ssl, char *buf, int num);
+
+=item int B<SSL_renegotiate>(SSL *ssl);
+
+=item char *B<SSL_rstate_string>(SSL *ssl);
+
+=item char *B<SSL_rstate_string_long>(SSL *ssl);
+
+=item long B<SSL_session_reused>(SSL *ssl);
+
+=item void B<SSL_set_accept_state>(SSL *ssl);
+
+=item void B<SSL_set_app_data>(SSL *ssl, char *arg);
+
+=item void B<SSL_set_bio>(SSL *ssl, BIO *rbio, BIO *wbio);
+
+=item int B<SSL_set_cipher_list>(SSL *ssl, char *str);
+
+=item void B<SSL_set_client_CA_list>(SSL *ssl, STACK *list);
+
+=item void B<SSL_set_connect_state>(SSL *ssl);
+
+=item int B<SSL_set_ex_data>(SSL *ssl, int idx, char *arg);
+
+=item int B<SSL_set_fd>(SSL *ssl, int fd);
+
+=item void B<SSL_set_info_callback>(SSL *ssl, void (*cb);(void))
+
+=item void B<SSL_set_options>(SSL *ssl, unsigned long op);
+
+=item void B<SSL_set_quiet_shutdown>(SSL *ssl, int mode);
+
+=item void B<SSL_set_read_ahead>(SSL *ssl, int yes);
+
+=item int B<SSL_set_rfd>(SSL *ssl, int fd);
+
+=item int B<SSL_set_session>(SSL *ssl, SSL_SESSION *session);
+
+=item void B<SSL_set_shutdown>(SSL *ssl, int mode);
+
+=item int B<SSL_set_ssl_method>(SSL *ssl, SSL_METHOD *meth);
+
+=item void B<SSL_set_time>(SSL *ssl, long t);
+
+=item void B<SSL_set_timeout>(SSL *ssl, long t);
+
+=item void B<SSL_set_verify>(SSL *ssl, int mode, int (*callback);(void))
+
+=item void B<SSL_set_verify_result>(SSL *ssl, long arg);
+
+=item int B<SSL_set_wfd>(SSL *ssl, int fd);
+
+=item int B<SSL_shutdown>(SSL *ssl);
+
+=item int B<SSL_state>(SSL *ssl);
+
+=item char *B<SSL_state_string>(SSL *ssl);
+
+=item char *B<SSL_state_string_long>(SSL *ssl);
+
+=item long B<SSL_total_renegotiations>(SSL *ssl);
+
+=item int B<SSL_use_PrivateKey>(SSL *ssl, EVP_PKEY *pkey);
+
+=item int B<SSL_use_PrivateKey_ASN1>(int type, SSL *ssl, unsigned char *d, long len);
+
+=item int B<SSL_use_PrivateKey_file>(SSL *ssl, char *file, int type);
+
+=item int B<SSL_use_RSAPrivateKey>(SSL *ssl, RSA *rsa);
+
+=item int B<SSL_use_RSAPrivateKey_ASN1>(SSL *ssl, unsigned char *d, long len);
+
+=item int B<SSL_use_RSAPrivateKey_file>(SSL *ssl, char *file, int type);
+
+=item int B<SSL_use_certificate>(SSL *ssl, X509 *x);
+
+=item int B<SSL_use_certificate_ASN1>(SSL *ssl, int len, unsigned char *d);
+
+=item int B<SSL_use_certificate_file>(SSL *ssl, char *file, int type);
+
+=item int B<SSL_version>(SSL *ssl);
+
+=item int B<SSL_want>(SSL *ssl);
+
+=item int B<SSL_want_nothing>(SSL *ssl);
+
+=item int B<SSL_want_read>(SSL *ssl);
+
+=item int B<SSL_want_write>(SSL *ssl);
+
+=item int B<SSL_want_x509_lookup>(s);
+
+=item int B<SSL_write>(SSL *ssl, char *buf, int num);
+
+=back
+
+=head1 SEE ALSO
+
+L<openssl(1)|openssl(1)>, L<crypto(3)|crypto(3)>,
+L<SSL_get_error(3)|SSL_get_error(3)>
+
+=head1 HISTORY
+
+The L<ssl(3)|ssl(3)> document appeared in OpenSSL 0.9.2
+
+=cut
+
diff --git a/src/lib/libssl/src/doc/ssleay.txt b/src/lib/libssl/src/doc/ssleay.txt
index 094e28ce48..3e964c2e9a 100644
--- a/src/lib/libssl/src/doc/ssleay.txt
+++ b/src/lib/libssl/src/doc/ssleay.txt
@@ -6710,8 +6710,8 @@ CRYPTO_set_locking_callback(locking_function);
 before any multithreading is started.
 id_function does not need to be defined under Windows NT or 95, the
 correct function will be called if it is not.  Under unix, getpid()
-is call if the id_callback is not defined, for solaris this is wrong
-(since threads id's are not pid's) but under IRIX it is correct
+is call if the id_callback is not defined, for Solaris this is wrong
+(since threads id's are not pid's) but under Linux it is correct
 (threads are just processes sharing the data segement).
 
 The locking_callback is used to perform locking by the SSLeay library.
diff --git a/src/lib/libssl/src/e_os.h b/src/lib/libssl/src/e_os.h
index 07f039f71c..406bd4fc78 100644
--- a/src/lib/libssl/src/e_os.h
+++ b/src/lib/libssl/src/e_os.h
@@ -82,6 +82,20 @@ extern "C" {
 #define DEVRANDOM "/dev/arandom"
 #endif
 
+#if defined(__MWERKS__) && defined(macintosh)
+# if macintosh==1
+#  ifndef MAC_OS_GUSI_SOURCE
+#    define MAC_OS_pre_X
+#    define NO_SYS_TYPES_H
+#  endif
+#  define NO_SYS_PARAM_H
+#  define NO_CHMOD
+#  define NO_SYSLOG
+#  undef  DEVRANDOM
+#  define GETPID_IS_MEANINGLESS
+# endif
+#endif
+
 /********************************************************************
  The Microsoft section
  ********************************************************************/
@@ -93,6 +107,10 @@ extern "C" {
 #  define MS_STATIC
 #endif
 
+#if defined(_WIN32) && !defined(WIN32)
+#  define WIN32
+#endif
+
 #if defined(WIN32) || defined(WIN16)
 #  ifndef WINDOWS
 #    define WINDOWS
@@ -102,6 +120,10 @@ extern "C" {
 #  endif
 #endif
 
+#if defined(MSDOS) && !defined(GETPID_IS_MEANINGLESS)
+#  define GETPID_IS_MEANINGLESS
+#endif
+
 #ifdef WIN32
 #define get_last_sys_error()    GetLastError()
 #define clear_sys_error()       SetLastError(0)
@@ -119,6 +141,12 @@ extern "C" {
 #define readsocket(s,b,n)       recv((s),(b),(n),0)
 #define writesocket(s,b,n)      send((s),(b),(n),0)
 #define EADDRINUSE              WSAEADDRINUSE
+#elif defined(MAC_OS_pre_X)
+#define get_last_socket_error() errno
+#define clear_socket_error()    errno=0
+#define closesocket(s)          MacSocket_close(s)
+#define readsocket(s,b,n)       MacSocket_recv((s),(b),(n),true)
+#define writesocket(s,b,n)      MacSocket_send((s),(b),(n))
 #else
 #define get_last_socket_error() errno
 #define clear_socket_error()    errno=0
@@ -172,6 +200,7 @@ extern "C" {
 #define _O_TEXT O_TEXT
 #define _O_BINARY O_BINARY
 #define _int64 __int64
+#define _kbhit kbhit
 #endif
 
 #if defined(WIN16) && !defined(MONOLITH) && defined(SSLEAY) && defined(_WINEXITNOPERSIST)
@@ -227,9 +256,17 @@ extern "C" {
                                      __VMS_EXIT |= 0x10000000; \
                                      return(n); } while(0)
 #    endif
+#    define NO_SYS_PARAM_H
 #  else
      /* !defined VMS */
-#    include OPENSSL_UNISTD
+#    ifdef OPENSSL_UNISTD
+#      include OPENSSL_UNISTD
+#    else
+#      include <unistd.h>
+#    endif
+#    ifndef NO_SYS_TYPES_H
+#      include <sys/types.h>
+#    endif
 
 #    define OPENSSL_CONF        "openssl.cnf"
 #    define SSLEAY_CONF         OPENSSL_CONF
@@ -268,11 +305,17 @@ extern HINSTANCE _hInstance;
 #      define SHUTDOWN2(fd)             { shutdown((fd),2); closesocket(fd); }
 #    endif
 
+#  elif defined(MAC_OS_pre_X)
+
+#    include "MacSocket.h"
+#    define SSLeay_Write(a,b,c)         MacSocket_send((a),(b),(c))
+#    define SSLeay_Read(a,b,c)          MacSocket_recv((a),(b),(c),true)
+#    define SHUTDOWN(fd)                MacSocket_close(fd)
+#    define SHUTDOWN2(fd)               MacSocket_close(fd)
 
 #  else
 
-#    include <sys/types.h>
-#    ifndef VMS
+#    ifndef NO_SYS_PARAM_H
 #      include <sys/param.h>
 #    endif
 #    include <sys/time.h> /* Needed under linux for FD_XXX */
@@ -320,8 +363,8 @@ extern HINSTANCE _hInstance;
 
 #    define SSLeay_Read(a,b,c)     read((a),(b),(c))
 #    define SSLeay_Write(a,b,c)    write((a),(b),(c))
-#    define SHUTDOWN(fd)    { shutdown((fd),0); close((fd)); }
-#    define SHUTDOWN2(fd)   { shutdown((fd),2); close((fd)); }
+#    define SHUTDOWN(fd)    { shutdown((fd),0); closesocket((fd)); }
+#    define SHUTDOWN2(fd)   { shutdown((fd),2); closesocket((fd)); }
 #    define INVALID_SOCKET      (-1)
 #  endif
 #endif
diff --git a/src/lib/libssl/src/install.com b/src/lib/libssl/src/install.com
index 16eac9aab2..e09d13ae5f 100644
--- a/src/lib/libssl/src/install.com
+++ b/src/lib/libssl/src/install.com
@@ -56,6 +56,7 @@ $	SDIRS := CRYPTO,SSL,RSAREF,APPS,VMS!,TEST,TOOLS
 $       EXHEADER := e_os.h,e_os2.h
 $
 $       COPY 'EXHEADER' WRK_SSLINCLUDE: /LOG
+$       SET FILE/PROT=WORLD:RE WRK_SSLINCLUDE:'EXHEADER'
 $
 $       I = 0
 $ LOOP_SDIRS: 
diff --git a/src/lib/libssl/src/makevms.com b/src/lib/libssl/src/makevms.com
index 977f2cee42..e89b309e87 100644
--- a/src/lib/libssl/src/makevms.com
+++ b/src/lib/libssl/src/makevms.com
@@ -17,8 +17,10 @@ $!
 $! Specify one of the following build options for P1.
 $!
 $!      ALL       Just build "everything".
+$!      CONFIG    Just build the "[.CRYPTO]OPENSSLCONF.H" file.
 $!      BUILDINF  Just build the "[.CRYPTO]BUILDINF.H" file.
 $!      SOFTLINKS Just fix the Unix soft links.
+$!      BUILDALL  Same as ALL, except CONFIG, BUILDINF and SOFTILNKS aren't done.
 $!      RSAREF    Just build the "[.xxx.EXE.RSAREF]LIBRSAGLUE.OLB" library.
 $!      CRYPTO    Just build the "[.xxx.EXE.CRYPTO]LIBCRYPTO.OLB" library.
 $!      SSL       Just build the "[.xxx.EXE.SSL]LIBSSL.OLB" library.
@@ -61,6 +63,16 @@ $!
 $! P6, if defined, sets a compiler thread NOT needed on OpenVMS 7.1 (and up)
 $!
 $!
+$! Check if we're in a batch job, and make sure we get to 
+$! the directory this script is in
+$!
+$ IF F$MODE() .EQS. "BATCH"
+$ THEN
+$   COMNAME=F$ENVIRONMENT("PROCEDURE")
+$   COMPATH=F$PARSE("A.;",COMNAME) - "A.;"
+$   SET DEF 'COMPATH'
+$ ENDIF
+$!
 $! Check Which Architecture We Are Using.
 $!
 $ IF (F$GETSYI("CPU").GE.128)
@@ -88,18 +100,26 @@ $ GOSUB CHECK_OPTIONS
 $!
 $! Check To See What We Are To Do.
 $!
-$ IF (BUILDALL.EQS."TRUE")
+$ IF (BUILDCOMMAND.EQS."ALL")
 $ THEN
 $!
-$!  Since Nothing Special Was Specified, Do Everything.
-$!  First, Fix The Unix Softlinks.
+$!  Start with building the OpenSSL configuration file.
 $!
-$   GOSUB SOFTLINKS
+$   GOSUB CONFIG
 $!
 $!  Create The "BUILDINF.H" Include File.
 $!
 $   GOSUB BUILDINF
 $!
+$!  Fix The Unix Softlinks.
+$!
+$   GOSUB SOFTLINKS
+$!
+$ ENDIF
+$!
+$ IF (BUILDCOMMAND.EQS."ALL".OR.BUILDCOMMAND.EQS."BUILDALL")
+$ THEN
+$!
 $!  Check To See If We Are Going To Be Building The 
 $!  [.xxx.EXE.RSAREF]LIBRSAGLUE.OLB Library.
 $!
@@ -140,12 +160,121 @@ $ ELSE
 $!
 $!    Build Just What The User Wants Us To Build.
 $!
-$     GOSUB 'BUILDALL'
+$     GOSUB 'BUILDCOMMAND'
+$!
 $ ENDIF
 $!
 $! Time To EXIT.
 $!
-$ EXIT   
+$ EXIT
+$!
+$! Rebuild The "[.CRYPTO]OPENSSLCONF.H" file.
+$!
+$ CONFIG:
+$!
+$! Tell The User We Are Creating The [.CRYPTO]OPENSSLCONF.H File.
+$!
+$ WRITE SYS$OUTPUT "Creating [.CRYPTO]OPENSSLCONF.H Include File."
+$!
+$! Create The [.CRYPTO]OPENSSLCONF.H File.
+$!
+$ OPEN/WRITE H_FILE SYS$DISK:[.CRYPTO]OPENSSLCONF.H
+$!
+$! Write The [.CRYPTO]OPENSSLCONF.H File.
+$!
+$ WRITE H_FILE "/* This file was automatically built using makevms.com */"
+$ WRITE H_FILE "/* and [.CRYPTO]OPENSSLCONF.H_IN */"
+$
+$! Different tar version may have named the file differently
+$ IF F$SEARCH("[.CRYPTO]OPENSSLCONF.H_IN") .NES. ""
+$ THEN
+$   TYPE [.CRYPTO]OPENSSLCONF.H_IN /OUTPUT=H_FILE:
+$ ELSE
+$   IF F$SEARCH("[.CRYPTO]OPENSSLCONF_H.IN") .NES. ""
+$   THEN
+$     TYPE [.CRYPTO]OPENSSLCONF_H.IN /OUTPUT=H_FILE:
+$   ELSE
+$     WRITE SYS$ERROR "Couldn't find a [.CRYPTO]OPENSSLCONF.H_IN.  Exiting!"
+$     EXIT 0
+$   ENDIF
+$ ENDIF
+$!
+$ IF ARCH .EQS. "AXP"
+$ THEN
+$!
+$!  Write the Alpha specific data
+$!
+$   WRITE H_FILE "#if defined(HEADER_RC4_H)"
+$   WRITE H_FILE "#undef RC4_INT"
+$   WRITE H_FILE "#define RC4_INT unsigned int"
+$   WRITE H_FILE "#undef RC4_CHUNK"
+$   WRITE H_FILE "#define RC4_CHUNK unsigned long long"
+$   WRITE H_FILE "#endif"
+$!
+$   WRITE H_FILE "#if defined(HEADER_DES_LOCL_H)"
+$   WRITE H_FILE "#undef DES_LONG"
+$   WRITE H_FILE "#define DES_LONG unsigned int"
+$   WRITE H_FILE "#undef DES_PTR"
+$   WRITE H_FILE "#define DES_PTR"
+$   WRITE H_FILE "#undef DES_RISC1"
+$   WRITE H_FILE "#undef DES_RISC2"
+$   WRITE H_FILE "#define DES_RISC1"
+$   WRITE H_FILE "#undef DES_UNROLL"
+$   WRITE H_FILE "#define DES_UNROLL"
+$   WRITE H_FILE "#endif"
+$!
+$   WRITE H_FILE "#if defined(HEADER_BN_H)"
+$   WRITE H_FILE "#undef SIXTY_FOUR_BIT_LONG"
+$   WRITE H_FILE "#undef SIXTY_FOUR_BIT"
+$   WRITE H_FILE "#define SIXTY_FOUR_BIT"
+$   WRITE H_FILE "#undef THIRTY_TWO_BIT"
+$   WRITE H_FILE "#undef SIXTEEN_BIT"
+$   WRITE H_FILE "#undef EIGHT_BIT"
+$   WRITE H_FILE "#endif"
+$!
+$!  Else...
+$!
+$ ELSE
+$!
+$!  Write the VAX specific data
+$!
+$   WRITE H_FILE "#if defined(HEADER_RC4_H)"
+$   WRITE H_FILE "#undef RC4_INT"
+$   WRITE H_FILE "#define RC4_INT unsigned char"
+$   WRITE H_FILE "#undef RC4_CHUNK"
+$   WRITE H_FILE "#define RC4_CHUNK unsigned long"
+$   WRITE H_FILE "#endif"
+$!
+$   WRITE H_FILE "#if defined(HEADER_DES_LOCL_H)"
+$   WRITE H_FILE "#undef DES_LONG"
+$   WRITE H_FILE "#define DES_LONG unsigned long"
+$   WRITE H_FILE "#undef DES_PTR"
+$   WRITE H_FILE "#define DES_PTR"
+$   WRITE H_FILE "#undef DES_RISC1"
+$   WRITE H_FILE "#undef DES_RISC2"
+$   WRITE H_FILE "#undef DES_UNROLL"
+$   WRITE H_FILE "#endif"
+$!
+$   WRITE H_FILE "#if defined(HEADER_BN_H)"
+$   WRITE H_FILE "#undef SIXTY_FOUR_BIT_LONG"
+$   WRITE H_FILE "#undef SIXTY_FOUR_BIT"
+$   WRITE H_FILE "#undef THIRTY_TWO_BIT"
+$   WRITE H_FILE "#define THIRTY_TWO_BIT"
+$   WRITE H_FILE "#undef SIXTEEN_BIT"
+$   WRITE H_FILE "#undef EIGHT_BIT"
+$   WRITE H_FILE "#endif"
+$!
+$!  End
+$!
+$ ENDIF
+$!
+$! Close the [.CRYPTO]OPENSSLCONF.H file
+$!
+$ CLOSE H_FILE
+$!
+$! That's All, Time To RETURN.
+$!
+$ RETURN
 $!
 $! Rebuild The "[.CRYPTO]BUILDINF.H" file.
 $!
@@ -278,9 +407,9 @@ $ IF D .EQS. "," THEN GOTO LOOP_SDIRS_END
 $ tmp = EXHEADER_'D'
 $ IF D .EQS. ""
 $ THEN
-$   COPY [.CRYPTO]'tmp' SYS$DISK:[.INCLUDE.OPENSSL] /LOG
+$   COPY [.CRYPTO]'tmp' SYS$DISK:[.INCLUDE.OPENSSL] !/LOG
 $ ELSE
-$   COPY [.CRYPTO.'D']'tmp' SYS$DISK:[.INCLUDE.OPENSSL] /LOG
+$   COPY [.CRYPTO.'D']'tmp' SYS$DISK:[.INCLUDE.OPENSSL] !/LOG
 $ ENDIF
 $ GOTO LOOP_SDIRS
 $ LOOP_SDIRS_END:
@@ -323,7 +452,11 @@ $ SET DEFAULT SYS$DISK:[.CRYPTO]
 $!
 $! Build The [.xxx.EXE.CRYPTO]LIBCRYPTO.OLB Library.
 $!  
-$ @CRYPTO-LIB 'RSAREF' 'DEBUGGER' "''COMPILER'" "''TCPIP_TYPE'" 'ISSEVEN'
+$ @CRYPTO-LIB LIBRARY 'RSAREF' 'DEBUGGER' "''COMPILER'" "''TCPIP_TYPE'" 'ISSEVEN'
+$!
+$! Build The [.xxx.EXE.CRYPTO]*.EXE Test Applications.
+$!  
+$ @CRYPTO-LIB APPS 'RSAREF' 'DEBUGGER' "''COMPILER'" "''TCPIP_TYPE'" 'ISSEVEN'
 $!
 $! Go Back To The Main Directory.
 $!
@@ -469,7 +602,7 @@ $ THEN
 $!
 $!   P1 Is ALL, So Build Everything.
 $!
-$    BUILDALL = "TRUE"
+$    BUILDCOMMAND = "ALL"
 $!
 $! Else...
 $!
@@ -484,7 +617,7 @@ $   THEN
 $!
 $!    A Valid Arguement.
 $!
-$     BUILDALL = P1
+$     BUILDCOMMAND = P1
 $!
 $!  Else...
 $!
@@ -496,8 +629,10 @@ $     WRITE SYS$OUTPUT ""
 $     WRITE SYS$OUTPUT "The Option ",P1," Is Invalid.  The Valid Options Are:"
 $     WRITE SYS$OUTPUT ""
 $     WRITE SYS$OUTPUT "    ALL      :  Just Build Everything."
+$     WRITE SYS$OUTPUT "    CONFIG   :  Just build the [.CRYPTO]OPENSSLCONF.H file."
 $     WRITE SYS$OUTPUT "    BUILDINF :  Just build the [.CRYPTO]BUILDINF.H file."
 $     WRITE SYS$OUTPUT "    SOFTLINKS:  Just Fix The Unix soft links."
+$     WRITE SYS$OUTPUT "    BUILDALL :  Same as ALL, except CONFIG, BUILDINF and SOFTILNKS aren't done."
 $     WRITE SYS$OUTPUT "    RSAREF   :  To Build Just The [.xxx.EXE.RSAREF]LIBRSAGLUE.OLB Library."
 $     WRITE SYS$OUTPUT "    CRYPTO   :  To Build Just The [.xxx.EXE.CRYPTO]LIBCRYPTO.OLB Library."
 $     WRITE SYS$OUTPUT "    SSL      :  To Build Just The [.xxx.EXE.SSL]LIBSSL.OLB Library."
diff --git a/src/lib/libssl/src/ms/test.bat b/src/lib/libssl/src/ms/test.bat
index a40f7478d7..3506a644f5 100644
--- a/src/lib/libssl/src/ms/test.bat
+++ b/src/lib/libssl/src/ms/test.bat
@@ -7,8 +7,8 @@ set OPENSSL_CONF=..\apps\openssl.cnf
 

 rem run this from inside the bin directory

 

-echo rsa_oaep_test

-rsa_oaep_test

+echo rsa_test

+rsa_test

 if errorlevel 1 goto done

 

 echo destest

@@ -135,6 +135,10 @@ echo test sslv2 via BIO pair
 ssltest -bio_pair -ssl2

 if errorlevel 1 goto done

 

+echo test sslv2/sslv3 with 1024 bit DHE via BIO pair

+ssltest -bio_pair -dhe1024 -v

+if errorlevel 1 goto done

+

 echo test sslv2 with server authentication via BIO pair

 ssltest -bio_pair -ssl2 -server_auth -CAfile cert.tmp

 if errorlevel 1 goto done

diff --git a/src/lib/libssl/src/mt/README b/src/lib/libssl/src/mt/README
index df6b26e146..e69de29bb2 100644
--- a/src/lib/libssl/src/mt/README
+++ b/src/lib/libssl/src/mt/README
@@ -1,14 +0,0 @@
-Mutithreading testing area.
-
-Since this stuff is very very platorm specific, this is not part of the
-normal build.  Have a read of doc/threads.doc.
-
-mttest will do some testing and will currently build under Windows NT/95,
-Solaris and Linux.  The IRIX stuff is not finished.
-
-I have tested this program on a 12 CPU ultra sparc box (solaris 2.5.1)
-and things seem to work ok.
-
-The Linux pthreads package can be retrieved from 
-http://www.mit.edu:8001/people/proven/pthreads.html
-
diff --git a/src/lib/libssl/src/mt/mttest.c b/src/lib/libssl/src/mt/mttest.c
index b2f332602d..e69de29bb2 100644
--- a/src/lib/libssl/src/mt/mttest.c
+++ b/src/lib/libssl/src/mt/mttest.c
@@ -1,1092 +0,0 @@
-/* mt/mttest.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-#ifdef LINUX
-#include <typedefs.h>
-#endif
-#ifdef WIN32
-#include <windows.h>
-#endif
-#ifdef SOLARIS
-#include <synch.h>
-#include <thread.h>
-#endif
-#ifdef IRIX
-#include <ulocks.h>
-#include <sys/prctl.h>
-#endif
-#include <openssl/lhash.h>
-#include <openssl/crypto.h>
-#include <openssl/buffer.h>
-#include "../e_os.h"
-#include <openssl/x509.h>
-#include <openssl/ssl.h>
-#include <openssl/err.h>
-
-#ifdef NO_FP_API
-#define APPS_WIN16
-#include "../crypto/buffer/bss_file.c"
-#endif
-
-#define TEST_SERVER_CERT "../apps/server.pem"
-#define TEST_CLIENT_CERT "../apps/client.pem"
-
-#define MAX_THREAD_NUMBER       100
-
-int MS_CALLBACK verify_callback(int ok, X509 *xs, X509 *xi, int depth,
-        int error,char *arg);
-void thread_setup(void);
-void thread_cleanup(void);
-void do_threads(SSL_CTX *s_ctx,SSL_CTX *c_ctx);
-
-void irix_locking_callback(int mode,int type,char *file,int line);
-void solaris_locking_callback(int mode,int type,char *file,int line);
-void win32_locking_callback(int mode,int type,char *file,int line);
-void pthreads_locking_callback(int mode,int type,char *file,int line);
-
-unsigned long irix_thread_id(void );
-unsigned long solaris_thread_id(void );
-unsigned long pthreads_thread_id(void );
-
-BIO *bio_err=NULL;
-BIO *bio_stdout=NULL;
-
-static char *cipher=NULL;
-int verbose=0;
-#ifdef FIONBIO
-static int s_nbio=0;
-#endif
-
-int thread_number=10;
-int number_of_loops=10;
-int reconnect=0;
-int cache_stats=0;
-
-int doit(char *ctx[4]);
-static void print_stats(fp,ctx)
-FILE *fp;
-SSL_CTX *ctx;
-{
-        fprintf(fp,"%4ld items in the session cache\n",
-                SSL_CTX_sess_number(ctx));
-        fprintf(fp,"%4d client connects (SSL_connect())\n",
-                SSL_CTX_sess_connect(ctx));
-        fprintf(fp,"%4d client connects that finished\n",
-                SSL_CTX_sess_connect_good(ctx));
-        fprintf(fp,"%4d server connects (SSL_accept())\n",
-                SSL_CTX_sess_accept(ctx));
-        fprintf(fp,"%4d server connects that finished\n",
-                SSL_CTX_sess_accept_good(ctx));
-        fprintf(fp,"%4d session cache hits\n",SSL_CTX_sess_hits(ctx));
-        fprintf(fp,"%4d session cache misses\n",SSL_CTX_sess_misses(ctx));
-        fprintf(fp,"%4d session cache timeouts\n",SSL_CTX_sess_timeouts(ctx));
-        }
-
-static void sv_usage()
-        {
-        fprintf(stderr,"usage: ssltest [args ...]\n");
-        fprintf(stderr,"\n");
-        fprintf(stderr," -server_auth  - check server certificate\n");
-        fprintf(stderr," -client_auth  - do client authentication\n");
-        fprintf(stderr," -v            - more output\n");
-        fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
-        fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
-        fprintf(stderr," -threads arg  - number of threads\n");
-        fprintf(stderr," -loops arg    - number of 'connections', per thread\n");
-        fprintf(stderr," -reconnect    - reuse session-id's\n");
-        fprintf(stderr," -stats        - server session-id cache stats\n");
-        fprintf(stderr," -cert arg     - server certificate/key\n");
-        fprintf(stderr," -ccert arg    - client certificate/key\n");
-        fprintf(stderr," -ssl3         - just SSLv3n\n");
-        }
-
-int main(argc, argv)
-int argc;
-char *argv[];
-        {
-        char *CApath=NULL,*CAfile=NULL;
-        int badop=0;
-        int ret=1;
-        int client_auth=0;
-        int server_auth=0;
-        SSL_CTX *s_ctx=NULL;
-        SSL_CTX *c_ctx=NULL;
-        char *scert=TEST_SERVER_CERT;
-        char *ccert=TEST_CLIENT_CERT;
-        SSL_METHOD *ssl_method=SSLv23_method();
-
-        if (bio_err == NULL)
-                bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
-        if (bio_stdout == NULL)
-                bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE);
-        argc--;
-        argv++;
-
-        while (argc >= 1)
-                {
-                if      (strcmp(*argv,"-server_auth") == 0)
-                        server_auth=1;
-                else if (strcmp(*argv,"-client_auth") == 0)
-                        client_auth=1;
-                else if (strcmp(*argv,"-reconnect") == 0)
-                        reconnect=1;
-                else if (strcmp(*argv,"-stats") == 0)
-                        cache_stats=1;
-                else if (strcmp(*argv,"-ssl3") == 0)
-                        ssl_method=SSLv3_method();
-                else if (strcmp(*argv,"-ssl2") == 0)
-                        ssl_method=SSLv2_method();
-                else if (strcmp(*argv,"-CApath") == 0)
-                        {
-                        if (--argc < 1) goto bad;
-                        CApath= *(++argv);
-                        }
-                else if (strcmp(*argv,"-CAfile") == 0)
-                        {
-                        if (--argc < 1) goto bad;
-                        CAfile= *(++argv);
-                        }
-                else if (strcmp(*argv,"-cert") == 0)
-                        {
-                        if (--argc < 1) goto bad;
-                        scert= *(++argv);
-                        }
-                else if (strcmp(*argv,"-ccert") == 0)
-                        {
-                        if (--argc < 1) goto bad;
-                        ccert= *(++argv);
-                        }
-                else if (strcmp(*argv,"-threads") == 0)
-                        {
-                        if (--argc < 1) goto bad;
-                        thread_number= atoi(*(++argv));
-                        if (thread_number == 0) thread_number=1;
-                        if (thread_number > MAX_THREAD_NUMBER)
-                                thread_number=MAX_THREAD_NUMBER;
-                        }
-                else if (strcmp(*argv,"-loops") == 0)
-                        {
-                        if (--argc < 1) goto bad;
-                        number_of_loops= atoi(*(++argv));
-                        if (number_of_loops == 0) number_of_loops=1;
-                        }
-                else
-                        {
-                        fprintf(stderr,"unknown option %s\n",*argv);
-                        badop=1;
-                        break;
-                        }
-                argc--;
-                argv++;
-                }
-        if (badop)
-                {
-bad:
-                sv_usage();
-                goto end;
-                }
-
-        if (cipher == NULL) cipher=getenv("SSL_CIPHER");
-
-        SSL_load_error_strings();
-        SSLeay_add_ssl_algorithms();
-
-        c_ctx=SSL_CTX_new(ssl_method);
-        s_ctx=SSL_CTX_new(ssl_method);
-        if ((c_ctx == NULL) || (s_ctx == NULL))
-                {
-                ERR_print_errors(bio_err);
-                goto end;
-                }
-
-        SSL_CTX_set_session_cache_mode(s_ctx,
-                SSL_SESS_CACHE_NO_AUTO_CLEAR|SSL_SESS_CACHE_SERVER);
-        SSL_CTX_set_session_cache_mode(c_ctx,
-                SSL_SESS_CACHE_NO_AUTO_CLEAR|SSL_SESS_CACHE_SERVER);
-
-        SSL_CTX_use_certificate_file(s_ctx,scert,SSL_FILETYPE_PEM);
-        SSL_CTX_use_RSAPrivateKey_file(s_ctx,scert,SSL_FILETYPE_PEM);
-
-        if (client_auth)
-                {
-                SSL_CTX_use_certificate_file(c_ctx,ccert,
-                        SSL_FILETYPE_PEM);
-                SSL_CTX_use_RSAPrivateKey_file(c_ctx,ccert,
-                        SSL_FILETYPE_PEM);
-                }
-
-        if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
-                (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
-                (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
-                (!SSL_CTX_set_default_verify_paths(c_ctx)))
-                {
-                fprintf(stderr,"SSL_load_verify_locations\n");
-                ERR_print_errors(bio_err);
-                goto end;
-                }
-
-        if (client_auth)
-                {
-                fprintf(stderr,"client authentication\n");
-                SSL_CTX_set_verify(s_ctx,
-                        SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
-                        verify_callback);
-                }
-        if (server_auth)
-                {
-                fprintf(stderr,"server authentication\n");
-                SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
-                        verify_callback);
-                }
-
-        thread_setup();
-        do_threads(s_ctx,c_ctx);
-        thread_cleanup();
-end:
-        
-        if (c_ctx != NULL) 
-                {
-                fprintf(stderr,"Client SSL_CTX stats then free it\n");
-                print_stats(stderr,c_ctx);
-                SSL_CTX_free(c_ctx);
-                }
-        if (s_ctx != NULL)
-                {
-                fprintf(stderr,"Server SSL_CTX stats then free it\n");
-                print_stats(stderr,s_ctx);
-                if (cache_stats)
-                        {
-                        fprintf(stderr,"-----\n");
-                        lh_stats(SSL_CTX_sessions(s_ctx),stderr);
-                        fprintf(stderr,"-----\n");
-                /*      lh_node_stats(SSL_CTX_sessions(s_ctx),stderr);
-                        fprintf(stderr,"-----\n"); */
-                        lh_node_usage_stats(SSL_CTX_sessions(s_ctx),stderr);
-                        fprintf(stderr,"-----\n");
-                        }
-                SSL_CTX_free(s_ctx);
-                fprintf(stderr,"done free\n");
-                }
-        exit(ret);
-        return(0);
-        }
-
-#define W_READ  1
-#define W_WRITE 2
-#define C_DONE  1
-#define S_DONE  2
-
-int ndoit(ssl_ctx)
-SSL_CTX *ssl_ctx[2];
-        {
-        int i;
-        int ret;
-        char *ctx[4];
-
-        ctx[0]=(char *)ssl_ctx[0];
-        ctx[1]=(char *)ssl_ctx[1];
-
-        if (reconnect)
-                {
-                ctx[2]=(char *)SSL_new(ssl_ctx[0]);
-                ctx[3]=(char *)SSL_new(ssl_ctx[1]);
-                }
-        else
-                {
-                ctx[2]=NULL;
-                ctx[3]=NULL;
-                }
-
-        fprintf(stdout,"started thread %lu\n",CRYPTO_thread_id());
-        for (i=0; i<number_of_loops; i++)
-                {
-/*              fprintf(stderr,"%4d %2d ctx->ref (%3d,%3d)\n",
-                        CRYPTO_thread_id(),i,
-                        ssl_ctx[0]->references,
-                        ssl_ctx[1]->references); */
-        /*      pthread_delay_np(&tm);*/
-
-                ret=doit(ctx);
-                if (ret != 0)
-                        {
-                        fprintf(stdout,"error[%d] %lu - %d\n",
-                                i,CRYPTO_thread_id(),ret);
-                        return(ret);
-                        }
-                }
-        fprintf(stdout,"DONE %lu\n",CRYPTO_thread_id());
-        if (reconnect)
-                {
-                SSL_free((SSL *)ctx[2]);
-                SSL_free((SSL *)ctx[3]);
-                }
-        return(0);
-        }
-
-int doit(ctx)
-char *ctx[4];
-        {
-        SSL_CTX *s_ctx,*c_ctx;
-        static char cbuf[200],sbuf[200];
-        SSL *c_ssl=NULL;
-        SSL *s_ssl=NULL;
-        BIO *c_to_s=NULL;
-        BIO *s_to_c=NULL;
-        BIO *c_bio=NULL;
-        BIO *s_bio=NULL;
-        int c_r,c_w,s_r,s_w;
-        int c_want,s_want;
-        int i;
-        int done=0;
-        int c_write,s_write;
-        int do_server=0,do_client=0;
-
-        s_ctx=(SSL_CTX *)ctx[0];
-        c_ctx=(SSL_CTX *)ctx[1];
-
-        if (ctx[2] != NULL)
-                s_ssl=(SSL *)ctx[2];
-        else
-                s_ssl=SSL_new(s_ctx);
-
-        if (ctx[3] != NULL)
-                c_ssl=(SSL *)ctx[3];
-        else
-                c_ssl=SSL_new(c_ctx);
-
-        if ((s_ssl == NULL) || (c_ssl == NULL)) goto err;
-
-        c_to_s=BIO_new(BIO_s_mem());
-        s_to_c=BIO_new(BIO_s_mem());
-        if ((s_to_c == NULL) || (c_to_s == NULL)) goto err;
-
-        c_bio=BIO_new(BIO_f_ssl());
-        s_bio=BIO_new(BIO_f_ssl());
-        if ((c_bio == NULL) || (s_bio == NULL)) goto err;
-
-        SSL_set_connect_state(c_ssl);
-        SSL_set_bio(c_ssl,s_to_c,c_to_s);
-        BIO_set_ssl(c_bio,c_ssl,(ctx[2] == NULL)?BIO_CLOSE:BIO_NOCLOSE);
-
-        SSL_set_accept_state(s_ssl);
-        SSL_set_bio(s_ssl,c_to_s,s_to_c);
-        BIO_set_ssl(s_bio,s_ssl,(ctx[3] == NULL)?BIO_CLOSE:BIO_NOCLOSE);
-
-        c_r=0; s_r=1;
-        c_w=1; s_w=0;
-        c_want=W_WRITE;
-        s_want=0;
-        c_write=1,s_write=0;
-
-        /* We can always do writes */
-        for (;;)
-                {
-                do_server=0;
-                do_client=0;
-
-                i=(int)BIO_pending(s_bio);
-                if ((i && s_r) || s_w) do_server=1;
-
-                i=(int)BIO_pending(c_bio);
-                if ((i && c_r) || c_w) do_client=1;
-
-                if (do_server && verbose)
-                        {
-                        if (SSL_in_init(s_ssl))
-                                printf("server waiting in SSL_accept - %s\n",
-                                        SSL_state_string_long(s_ssl));
-                        else if (s_write)
-                                printf("server:SSL_write()\n");
-                        else 
-                                printf("server:SSL_read()\n");
-                        }
-
-                if (do_client && verbose)
-                        {
-                        if (SSL_in_init(c_ssl))
-                                printf("client waiting in SSL_connect - %s\n",
-                                        SSL_state_string_long(c_ssl));
-                        else if (c_write)
-                                printf("client:SSL_write()\n");
-                        else
-                                printf("client:SSL_read()\n");
-                        }
-
-                if (!do_client && !do_server)
-                        {
-                        fprintf(stdout,"ERROR IN STARTUP\n");
-                        break;
-                        }
-                if (do_client && !(done & C_DONE))
-                        {
-                        if (c_write)
-                                {
-                                i=BIO_write(c_bio,"hello from client\n",18);
-                                if (i < 0)
-                                        {
-                                        c_r=0;
-                                        c_w=0;
-                                        if (BIO_should_retry(c_bio))
-                                                {
-                                                if (BIO_should_read(c_bio))
-                                                        c_r=1;
-                                                if (BIO_should_write(c_bio))
-                                                        c_w=1;
-                                                }
-                                        else
-                                                {
-                                                fprintf(stderr,"ERROR in CLIENT\n");
-                                                return(1);
-                                                }
-                                        }
-                                else if (i == 0)
-                                        {
-                                        fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
-                                        return(1);
-                                        }
-                                else
-                                        {
-                                        /* ok */
-                                        c_write=0;
-                                        }
-                                }
-                        else
-                                {
-                                i=BIO_read(c_bio,cbuf,100);
-                                if (i < 0)
-                                        {
-                                        c_r=0;
-                                        c_w=0;
-                                        if (BIO_should_retry(c_bio))
-                                                {
-                                                if (BIO_should_read(c_bio))
-                                                        c_r=1;
-                                                if (BIO_should_write(c_bio))
-                                                        c_w=1;
-                                                }
-                                        else
-                                                {
-                                                fprintf(stderr,"ERROR in CLIENT\n");
-                                                return(1);
-                                                }
-                                        }
-                                else if (i == 0)
-                                        {
-                                        fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
-                                        return(1);
-                                        }
-                                else
-                                        {
-                                        done|=C_DONE;
-#ifdef undef
-                                        fprintf(stdout,"CLIENT:from server:");
-                                        fwrite(cbuf,1,i,stdout);
-                                        fflush(stdout);
-#endif
-                                        }
-                                }
-                        }
-
-                if (do_server && !(done & S_DONE))
-                        {
-                        if (!s_write)
-                                {
-                                i=BIO_read(s_bio,sbuf,100);
-                                if (i < 0)
-                                        {
-                                        s_r=0;
-                                        s_w=0;
-                                        if (BIO_should_retry(s_bio))
-                                                {
-                                                if (BIO_should_read(s_bio))
-                                                        s_r=1;
-                                                if (BIO_should_write(s_bio))
-                                                        s_w=1;
-                                                }
-                                        else
-                                                {
-                                                fprintf(stderr,"ERROR in SERVER\n");
-                                                ERR_print_errors_fp(stderr);
-                                                return(1);
-                                                }
-                                        }
-                                else if (i == 0)
-                                        {
-                                        fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
-                                        return(1);
-                                        }
-                                else
-                                        {
-                                        s_write=1;
-                                        s_w=1;
-#ifdef undef
-                                        fprintf(stdout,"SERVER:from client:");
-                                        fwrite(sbuf,1,i,stdout);
-                                        fflush(stdout);
-#endif
-                                        }
-                                }
-                        else
-                                {
-                                i=BIO_write(s_bio,"hello from server\n",18);
-                                if (i < 0)
-                                        {
-                                        s_r=0;
-                                        s_w=0;
-                                        if (BIO_should_retry(s_bio))
-                                                {
-                                                if (BIO_should_read(s_bio))
-                                                        s_r=1;
-                                                if (BIO_should_write(s_bio))
-                                                        s_w=1;
-                                                }
-                                        else
-                                                {
-                                                fprintf(stderr,"ERROR in SERVER\n");
-                                                ERR_print_errors_fp(stderr);
-                                                return(1);
-                                                }
-                                        }
-                                else if (i == 0)
-                                        {
-                                        fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
-                                        return(1);
-                                        }
-                                else
-                                        {
-                                        s_write=0;
-                                        s_r=1;
-                                        done|=S_DONE;
-                                        }
-                                }
-                        }
-
-                if ((done & S_DONE) && (done & C_DONE)) break;
-                }
-
-        SSL_set_shutdown(c_ssl,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
-        SSL_set_shutdown(s_ssl,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
-
-#ifdef undef
-        fprintf(stdout,"DONE\n");
-#endif
-err:
-        /* We have to set the BIO's to NULL otherwise they will be
-         * free()ed twice.  Once when th s_ssl is SSL_free()ed and
-         * again when c_ssl is SSL_free()ed.
-         * This is a hack required because s_ssl and c_ssl are sharing the same
-         * BIO structure and SSL_set_bio() and SSL_free() automatically
-         * BIO_free non NULL entries.
-         * You should not normally do this or be required to do this */
-
-        if (s_ssl != NULL)
-                {
-                s_ssl->rbio=NULL;
-                s_ssl->wbio=NULL;
-                }
-        if (c_ssl != NULL)
-                {
-                c_ssl->rbio=NULL;
-                c_ssl->wbio=NULL;
-                }
-
-        /* The SSL's are optionally freed in the following calls */
-        if (c_to_s != NULL) BIO_free(c_to_s);
-        if (s_to_c != NULL) BIO_free(s_to_c);
-
-        if (c_bio != NULL) BIO_free(c_bio);
-        if (s_bio != NULL) BIO_free(s_bio);
-        return(0);
-        }
-
-int MS_CALLBACK verify_callback(ok, xs, xi, depth, error, arg)
-int ok;
-X509 *xs;
-X509 *xi;
-int depth;
-int error;
-char *arg;
-        {
-        char buf[256];
-
-        if (verbose)
-                {
-                X509_NAME_oneline(X509_get_subject_name(xs),buf,256);
-                if (ok)
-                        fprintf(stderr,"depth=%d %s\n",depth,buf);
-                else
-                        fprintf(stderr,"depth=%d error=%d %s\n",depth,error,buf);
-                }
-        return(ok);
-        }
-
-#define THREAD_STACK_SIZE (16*1024)
-
-#ifdef WIN32
-
-static PRLOCK lock_cs[CRYPTO_NUM_LOCKS];
-
-void thread_setup()
-        {
-        int i;
-
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
-                {
-                lock_cs[i]=CreateMutex(NULL,FALSE,NULL);
-                }
-
-        CRYPTO_set_locking_callback((void (*)(int,int,char *,int))win32_locking_callback);
-        /* id callback defined */
-        }
-
-void thread_cleanup()
-        {
-        int i;
-
-        CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
-                CloseHandle(lock_cs[i]);
-        }
-
-void win32_locking_callback(mode,type,file,line)
-int mode;
-int type;
-char *file;
-int line;
-        {
-        if (mode & CRYPTO_LOCK)
-                {
-                WaitForSingleObject(lock_cs[type],INFINITE);
-                }
-        else
-                {
-                ReleaseMutex(lock_cs[type]);
-                }
-        }
-
-void do_threads(s_ctx,c_ctx)
-SSL_CTX *s_ctx,*c_ctx;
-        {
-        double ret;
-        SSL_CTX *ssl_ctx[2];
-        DWORD thread_id[MAX_THREAD_NUMBER];
-        HANDLE thread_handle[MAX_THREAD_NUMBER];
-        int i;
-        SYSTEMTIME start,end;
-
-        ssl_ctx[0]=s_ctx;
-        ssl_ctx[1]=c_ctx;
-
-        GetSystemTime(&start);
-        for (i=0; i<thread_number; i++)
-                {
-                thread_handle[i]=CreateThread(NULL,
-                        THREAD_STACK_SIZE,
-                        (LPTHREAD_START_ROUTINE)ndoit,
-                        (void *)ssl_ctx,
-                        0L,
-                        &(thread_id[i]));
-                }
-
-        printf("reaping\n");
-        for (i=0; i<thread_number; i+=50)
-                {
-                int j;
-
-                j=(thread_number < (i+50))?(thread_number-i):50;
-
-                if (WaitForMultipleObjects(j,
-                        (CONST HANDLE *)&(thread_handle[i]),TRUE,INFINITE)
-                        == WAIT_FAILED)
-                        {
-                        fprintf(stderr,"WaitForMultipleObjects failed:%d\n",GetLastError());
-                        exit(1);
-                        }
-                }
-        GetSystemTime(&end);
-
-        if (start.wDayOfWeek > end.wDayOfWeek) end.wDayOfWeek+=7;
-        ret=(end.wDayOfWeek-start.wDayOfWeek)*24;
-
-        ret=(ret+end.wHour-start.wHour)*60;
-        ret=(ret+end.wMinute-start.wMinute)*60;
-        ret=(ret+end.wSecond-start.wSecond);
-        ret+=(end.wMilliseconds-start.wMilliseconds)/1000.0;
-
-        printf("win32 threads done - %.3f seconds\n",ret);
-        }
-
-#endif /* WIN32 */
-
-#ifdef SOLARIS
-
-static mutex_t lock_cs[CRYPTO_NUM_LOCKS];
-/*static rwlock_t lock_cs[CRYPTO_NUM_LOCKS]; */
-static long lock_count[CRYPTO_NUM_LOCKS];
-
-void thread_setup()
-        {
-        int i;
-
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
-                {
-                lock_count[i]=0;
-                /* rwlock_init(&(lock_cs[i]),USYNC_THREAD,NULL); */
-                mutex_init(&(lock_cs[i]),USYNC_THREAD,NULL);
-                }
-
-        CRYPTO_set_id_callback((unsigned long (*)())solaris_thread_id);
-        CRYPTO_set_locking_callback((void (*)())solaris_locking_callback);
-        }
-
-void thread_cleanup()
-        {
-        int i;
-
-        CRYPTO_set_locking_callback(NULL);
-fprintf(stderr,"cleanup\n");
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
-                {
-                /* rwlock_destroy(&(lock_cs[i])); */
-                mutex_destroy(&(lock_cs[i]));
-                fprintf(stderr,"%8ld:%s\n",lock_count[i],CRYPTO_get_lock_name(i));
-                }
-fprintf(stderr,"done cleanup\n");
-        }
-
-void solaris_locking_callback(mode,type,file,line)
-int mode;
-int type;
-char *file;
-int line;
-        {
-#ifdef undef
-fprintf(stderr,"thread=%4d mode=%s lock=%s %s:%d\n",
-        CRYPTO_thread_id(),
-        (mode&CRYPTO_LOCK)?"l":"u",
-        (type&CRYPTO_READ)?"r":"w",file,line);
-#endif
-
-/*
-if (CRYPTO_LOCK_SSL_CERT == type)
-        fprintf(stderr,"(t,m,f,l) %ld %d %s %d\n",
-                CRYPTO_thread_id(),
-                mode,file,line);
-*/
-        if (mode & CRYPTO_LOCK)
-                {
-        /*      if (mode & CRYPTO_READ)
-                        rw_rdlock(&(lock_cs[type]));
-                else
-                        rw_wrlock(&(lock_cs[type])); */
-
-                mutex_lock(&(lock_cs[type]));
-                lock_count[type]++;
-                }
-        else
-                {
-/*              rw_unlock(&(lock_cs[type]));  */
-                mutex_unlock(&(lock_cs[type]));
-                }
-        }
-
-void do_threads(s_ctx,c_ctx)
-SSL_CTX *s_ctx,*c_ctx;
-        {
-        SSL_CTX *ssl_ctx[2];
-        thread_t thread_ctx[MAX_THREAD_NUMBER];
-        int i;
-
-        ssl_ctx[0]=s_ctx;
-        ssl_ctx[1]=c_ctx;
-
-        thr_setconcurrency(thread_number);
-        for (i=0; i<thread_number; i++)
-                {
-                thr_create(NULL, THREAD_STACK_SIZE,
-                        (void *(*)())ndoit,
-                        (void *)ssl_ctx,
-                        0L,
-                        &(thread_ctx[i]));
-                }
-
-        printf("reaping\n");
-        for (i=0; i<thread_number; i++)
-                {
-                thr_join(thread_ctx[i],NULL,NULL);
-                }
-
-        printf("solaris threads done (%d,%d)\n",
-                s_ctx->references,c_ctx->references);
-        }
-
-unsigned long solaris_thread_id()
-        {
-        unsigned long ret;
-
-        ret=(unsigned long)thr_self();
-        return(ret);
-        }
-#endif /* SOLARIS */
-
-#ifdef IRIX
-
-
-static usptr_t *arena;
-static usema_t *lock_cs[CRYPTO_NUM_LOCKS];
-
-void thread_setup()
-        {
-        int i;
-        char filename[20];
-
-        strcpy(filename,"/tmp/mttest.XXXXXX");
-        mktemp(filename);
-
-        usconfig(CONF_STHREADIOOFF);
-        usconfig(CONF_STHREADMALLOCOFF);
-        usconfig(CONF_INITUSERS,100);
-        usconfig(CONF_LOCKTYPE,US_DEBUGPLUS);
-        arena=usinit(filename);
-        unlink(filename);
-
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
-                {
-                lock_cs[i]=usnewsema(arena,1);
-                }
-
-        CRYPTO_set_id_callback((unsigned long (*)())irix_thread_id);
-        CRYPTO_set_locking_callback((void (*)())irix_locking_callback);
-        }
-
-void thread_cleanup()
-        {
-        int i;
-
-        CRYPTO_set_locking_callback(NULL);
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
-                {
-                char buf[10];
-
-                sprintf(buf,"%2d:",i);
-                usdumpsema(lock_cs[i],stdout,buf);
-                usfreesema(lock_cs[i],arena);
-                }
-        }
-
-void irix_locking_callback(mode,type,file,line)
-int mode;
-int type;
-char *file;
-int line;
-        {
-        if (mode & CRYPTO_LOCK)
-                {
-                printf("lock %d\n",type);
-                uspsema(lock_cs[type]);
-                }
-        else
-                {
-                printf("unlock %d\n",type);
-                usvsema(lock_cs[type]);
-                }
-        }
-
-void do_threads(s_ctx,c_ctx)
-SSL_CTX *s_ctx,*c_ctx;
-        {
-        SSL_CTX *ssl_ctx[2];
-        int thread_ctx[MAX_THREAD_NUMBER];
-        int i;
-
-        ssl_ctx[0]=s_ctx;
-        ssl_ctx[1]=c_ctx;
-
-        for (i=0; i<thread_number; i++)
-                {
-                thread_ctx[i]=sproc((void (*)())ndoit,
-                        PR_SADDR|PR_SFDS,(void *)ssl_ctx);
-                }
-
-        printf("reaping\n");
-        for (i=0; i<thread_number; i++)
-                {
-                wait(NULL);
-                }
-
-        printf("irix threads done (%d,%d)\n",
-                s_ctx->references,c_ctx->references);
-        }
-
-unsigned long irix_thread_id()
-        {
-        unsigned long ret;
-
-        ret=(unsigned long)getpid();
-        return(ret);
-        }
-#endif /* IRIX */
-
-#ifdef PTHREADS
-
-static pthread_mutex_t lock_cs[CRYPTO_NUM_LOCKS];
-static long lock_count[CRYPTO_NUM_LOCKS];
-
-void thread_setup()
-        {
-        int i;
-
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
-                {
-                lock_count[i]=0;
-                pthread_mutex_init(&(lock_cs[i]),NULL);
-                }
-
-        CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
-        CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
-        }
-
-void thread_cleanup()
-        {
-        int i;
-
-        CRYPTO_set_locking_callback(NULL);
-        fprintf(stderr,"cleanup\n");
-        for (i=0; i<CRYPTO_NUM_LOCKS; i++)
-                {
-                pthread_mutex_destroy(&(lock_cs[i]));
-                fprintf(stderr,"%8ld:%s\n",lock_count[i],
-                        CRYPTO_get_lock_name(i));
-                }
-        fprintf(stderr,"done cleanup\n");
-        }
-
-void pthreads_locking_callback(mode,type,file,line)
-int mode;
-int type;
-char *file;
-int line;
-      {
-#ifdef undef
-        fprintf(stderr,"thread=%4d mode=%s lock=%s %s:%d\n",
-                CRYPTO_thread_id(),
-                (mode&CRYPTO_LOCK)?"l":"u",
-                (type&CRYPTO_READ)?"r":"w",file,line);
-#endif
-/*
-        if (CRYPTO_LOCK_SSL_CERT == type)
-                fprintf(stderr,"(t,m,f,l) %ld %d %s %d\n",
-                CRYPTO_thread_id(),
-                mode,file,line);
-*/
-        if (mode & CRYPTO_LOCK)
-                {
-                pthread_mutex_lock(&(lock_cs[type]));
-                lock_count[type]++;
-                }
-        else
-                {
-                pthread_mutex_unlock(&(lock_cs[type]));
-                }
-        }
-
-void do_threads(s_ctx,c_ctx)
-SSL_CTX *s_ctx,*c_ctx;
-        {
-        SSL_CTX *ssl_ctx[2];
-        pthread_t thread_ctx[MAX_THREAD_NUMBER];
-        int i;
-
-        ssl_ctx[0]=s_ctx;
-        ssl_ctx[1]=c_ctx;
-
-        /*
-        thr_setconcurrency(thread_number);
-        */
-        for (i=0; i<thread_number; i++)
-                {
-                pthread_create(&(thread_ctx[i]), NULL,
-                        (void *(*)())ndoit, (void *)ssl_ctx);
-                }
-
-        printf("reaping\n");
-        for (i=0; i<thread_number; i++)
-                {
-                pthread_join(thread_ctx[i],NULL);
-                }
-
-        printf("pthreads threads done (%d,%d)\n",
-        s_ctx->references,c_ctx->references);
-        }
-
-unsigned long pthreads_thread_id()
-        {
-        unsigned long ret;
-
-        ret=(unsigned long)pthread_self();
-        return(ret);
-        }
-
-#endif /* PTHREADS */
-
-
-
diff --git a/src/lib/libssl/src/mt/profile.sh b/src/lib/libssl/src/mt/profile.sh
index de5eb06708..e69de29bb2 100644
--- a/src/lib/libssl/src/mt/profile.sh
+++ b/src/lib/libssl/src/mt/profile.sh
@@ -1,4 +0,0 @@
-#!/bin/sh
-/bin/rm -f mttest
-cc -p -DSOLARIS -I../include -g mttest.c -o mttest -L/usr/lib/libc -ldl -L.. -lthread  -lssl -lcrypto -lnsl -lsocket
-
diff --git a/src/lib/libssl/src/mt/ptest.bat b/src/lib/libssl/src/mt/ptest.bat
index ccaccae09d..e69de29bb2 100644
--- a/src/lib/libssl/src/mt/ptest.bat
+++ b/src/lib/libssl/src/mt/ptest.bat
@@ -1,4 +0,0 @@
-del mttest.exe
-
-purify cl /O2 -DWIN32 /MD -I..\out mttest.c /Femttest ..\out\ssl32.lib ..\out\crypt32.lib
-
diff --git a/src/lib/libssl/src/mt/pthread.sh b/src/lib/libssl/src/mt/pthread.sh
index 7d0b6e55f5..e69de29bb2 100644
--- a/src/lib/libssl/src/mt/pthread.sh
+++ b/src/lib/libssl/src/mt/pthread.sh
@@ -1,9 +0,0 @@
-#!/bin/sh
-#
-# build using pthreads
-#
-# http://www.mit.edu:8001/people/proven/pthreads.html
-#
-/bin/rm -f mttest
-pgcc -DPTHREADS -I../include -g mttest.c -o mttest -L.. -lssl -lcrypto 
-
diff --git a/src/lib/libssl/src/mt/purify.sh b/src/lib/libssl/src/mt/purify.sh
index 57c4017073..e69de29bb2 100644
--- a/src/lib/libssl/src/mt/purify.sh
+++ b/src/lib/libssl/src/mt/purify.sh
@@ -1,4 +0,0 @@
-#!/bin/sh
-/bin/rm -f mttest
-purify cc -DSOLARIS -I../include -g mttest.c -o mttest -L.. -lthread  -lssl -lcrypto -lnsl -lsocket
-
diff --git a/src/lib/libssl/src/mt/solaris.sh b/src/lib/libssl/src/mt/solaris.sh
index f6a90b17ee..e69de29bb2 100644
--- a/src/lib/libssl/src/mt/solaris.sh
+++ b/src/lib/libssl/src/mt/solaris.sh
@@ -1,4 +0,0 @@
-#!/bin/sh
-/bin/rm -f mttest
-cc -DSOLARIS -I../include -g mttest.c -o mttest -L.. -lthread  -lssl -lcrypto -lnsl -lsocket
-
diff --git a/src/lib/libssl/src/mt/win32.bat b/src/lib/libssl/src/mt/win32.bat
index 56089f69be..e69de29bb2 100644
--- a/src/lib/libssl/src/mt/win32.bat
+++ b/src/lib/libssl/src/mt/win32.bat
@@ -1,4 +0,0 @@
-del mttest.exe
-
-cl /O2 -DWIN32 /MD -I..\out mttest.c /Femttest ..\out\ssleay32.lib ..\out\libeay32.lib
-
diff --git a/src/lib/libssl/src/rsaref/Makefile.ssl b/src/lib/libssl/src/rsaref/Makefile.ssl
index 03b081bac3..8d06a531d7 100644
--- a/src/lib/libssl/src/rsaref/Makefile.ssl
+++ b/src/lib/libssl/src/rsaref/Makefile.ssl
@@ -88,11 +88,12 @@ clean:
 rsar_err.o: ../include/openssl/bn.h ../include/openssl/crypto.h
 rsar_err.o: ../include/openssl/err.h ../include/openssl/opensslconf.h
 rsar_err.o: ../include/openssl/opensslv.h ../include/openssl/rsa.h
-rsar_err.o: ../include/openssl/rsaref.h ../include/openssl/stack.h
+rsar_err.o: ../include/openssl/rsaref.h ../include/openssl/safestack.h
+rsar_err.o: ../include/openssl/stack.h
 rsaref.o: ../crypto/cryptlib.h ../include/openssl/bio.h ../include/openssl/bn.h
 rsaref.o: ../include/openssl/buffer.h ../include/openssl/crypto.h
 rsaref.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
 rsaref.o: ../include/openssl/err.h ../include/openssl/opensslconf.h
 rsaref.o: ../include/openssl/opensslv.h ../include/openssl/rand.h
 rsaref.o: ../include/openssl/rsa.h ../include/openssl/rsaref.h
-rsaref.o: ../include/openssl/stack.h
+rsaref.o: ../include/openssl/safestack.h ../include/openssl/stack.h
diff --git a/src/lib/libssl/src/rsaref/rsaref.c b/src/lib/libssl/src/rsaref/rsaref.c
index 7677eb9fce..ae70feb3e9 100644
--- a/src/lib/libssl/src/rsaref/rsaref.c
+++ b/src/lib/libssl/src/rsaref/rsaref.c
@@ -279,7 +279,8 @@ int RSA_ref_public_encrypt(int len, unsigned char *from, unsigned char *to,
         R_GetRandomBytesNeeded((unsigned int *)&i,&rnd);
         while (i > 0)
                 {
-                RAND_bytes(buf,16);
+                if (RAND_bytes(buf,16) <= 0)
+                        goto err;
                 R_RandomUpdate(&rnd,buf,(unsigned int)((i>16)?16:i));
                 i-=16;
                 }
@@ -298,4 +299,10 @@ err:
         memset(&rnd,0,sizeof(rnd));
         return(outlen);
         }
+#else /* !NO_RSA */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/ssl/Makefile.ssl b/src/lib/libssl/src/ssl/Makefile.ssl
index f0d4775900..7165804eb3 100644
--- a/src/lib/libssl/src/ssl/Makefile.ssl
+++ b/src/lib/libssl/src/ssl/Makefile.ssl
@@ -537,9 +537,10 @@ ssl_asn1.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h ssl_locl.h
 ssl_cert.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 ssl_cert.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 ssl_cert.o: ../include/openssl/buffer.h ../include/openssl/cast.h
-ssl_cert.o: ../include/openssl/comp.h ../include/openssl/crypto.h
-ssl_cert.o: ../include/openssl/des.h ../include/openssl/dh.h
-ssl_cert.o: ../include/openssl/dsa.h ../include/openssl/e_os.h
+ssl_cert.o: ../include/openssl/comp.h ../include/openssl/conf.h
+ssl_cert.o: ../include/openssl/crypto.h ../include/openssl/des.h
+ssl_cert.o: ../include/openssl/dh.h ../include/openssl/dsa.h
+ssl_cert.o: ../include/openssl/e_os.h ../include/openssl/e_os.h
 ssl_cert.o: ../include/openssl/e_os2.h ../include/openssl/err.h
 ssl_cert.o: ../include/openssl/evp.h ../include/openssl/idea.h
 ssl_cert.o: ../include/openssl/lhash.h ../include/openssl/md2.h
@@ -554,7 +555,8 @@ ssl_cert.o: ../include/openssl/sha.h ../include/openssl/ssl.h
 ssl_cert.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
 ssl_cert.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
 ssl_cert.o: ../include/openssl/tls1.h ../include/openssl/x509.h
-ssl_cert.o: ../include/openssl/x509_vfy.h ssl_locl.h
+ssl_cert.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h
+ssl_cert.o: ssl_locl.h
 ssl_ciph.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 ssl_ciph.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 ssl_ciph.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -619,24 +621,25 @@ ssl_err2.o: ../include/openssl/x509_vfy.h
 ssl_lib.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 ssl_lib.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 ssl_lib.o: ../include/openssl/buffer.h ../include/openssl/cast.h
-ssl_lib.o: ../include/openssl/comp.h ../include/openssl/crypto.h
-ssl_lib.o: ../include/openssl/des.h ../include/openssl/dh.h
-ssl_lib.o: ../include/openssl/dsa.h ../include/openssl/e_os.h
-ssl_lib.o: ../include/openssl/e_os2.h ../include/openssl/err.h
-ssl_lib.o: ../include/openssl/evp.h ../include/openssl/idea.h
-ssl_lib.o: ../include/openssl/lhash.h ../include/openssl/md2.h
-ssl_lib.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
-ssl_lib.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
-ssl_lib.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
-ssl_lib.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
-ssl_lib.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
-ssl_lib.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
-ssl_lib.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
-ssl_lib.o: ../include/openssl/sha.h ../include/openssl/ssl.h
-ssl_lib.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
-ssl_lib.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
-ssl_lib.o: ../include/openssl/tls1.h ../include/openssl/x509.h
-ssl_lib.o: ../include/openssl/x509_vfy.h ssl_locl.h
+ssl_lib.o: ../include/openssl/comp.h ../include/openssl/conf.h
+ssl_lib.o: ../include/openssl/crypto.h ../include/openssl/des.h
+ssl_lib.o: ../include/openssl/dh.h ../include/openssl/dsa.h
+ssl_lib.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+ssl_lib.o: ../include/openssl/err.h ../include/openssl/evp.h
+ssl_lib.o: ../include/openssl/idea.h ../include/openssl/lhash.h
+ssl_lib.o: ../include/openssl/md2.h ../include/openssl/md5.h
+ssl_lib.o: ../include/openssl/mdc2.h ../include/openssl/objects.h
+ssl_lib.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+ssl_lib.o: ../include/openssl/pem.h ../include/openssl/pem2.h
+ssl_lib.o: ../include/openssl/pkcs7.h ../include/openssl/rc2.h
+ssl_lib.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
+ssl_lib.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
+ssl_lib.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+ssl_lib.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
+ssl_lib.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
+ssl_lib.o: ../include/openssl/stack.h ../include/openssl/tls1.h
+ssl_lib.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+ssl_lib.o: ../include/openssl/x509v3.h ssl_locl.h
 ssl_rsa.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 ssl_rsa.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 ssl_rsa.o: ../include/openssl/buffer.h ../include/openssl/cast.h
diff --git a/src/lib/libssl/src/ssl/bio_ssl.c b/src/lib/libssl/src/ssl/bio_ssl.c
index f62cde4e5d..d73c41adcd 100644
--- a/src/lib/libssl/src/ssl/bio_ssl.c
+++ b/src/lib/libssl/src/ssl/bio_ssl.c
@@ -71,6 +71,7 @@ static int ssl_puts(BIO *h,char *str);
 static long ssl_ctrl(BIO *h,int cmd,long arg1,char *arg2);
 static int ssl_new(BIO *h);
 static int ssl_free(BIO *data);
+static long ssl_callback_ctrl(BIO *h,int cmd,void (*fp)());
 typedef struct bio_ssl_st
         {
         SSL *ssl; /* The ssl handle :-) */
@@ -92,6 +93,7 @@ static BIO_METHOD methods_sslp=
         ssl_ctrl,
         ssl_new,
         ssl_free,
+        ssl_callback_ctrl,
         };
 
 BIO_METHOD *BIO_f_ssl(void)
@@ -444,7 +446,14 @@ static long ssl_ctrl(BIO *b, int cmd, long num, char *ptr)
                 ret=BIO_ctrl(ssl->rbio,cmd,num,ptr);
                 break;
         case BIO_CTRL_SET_CALLBACK:
-                SSL_set_info_callback(ssl,(void (*)())ptr);
+                {
+#if 0 /* FIXME: Should this be used?  -- Richard Levitte */
+                BIOerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ret = -1;
+#else
+                ret=0;
+#endif
+                }
                 break;
         case BIO_CTRL_GET_CALLBACK:
                 {
@@ -461,6 +470,28 @@ static long ssl_ctrl(BIO *b, int cmd, long num, char *ptr)
         return(ret);
         }
 
+static long ssl_callback_ctrl(BIO *b, int cmd, void (*fp)())
+        {
+        SSL *ssl;
+        BIO_SSL *bs;
+        long ret=1;
+
+        bs=(BIO_SSL *)b->ptr;
+        ssl=bs->ssl;
+        switch (cmd)
+                {
+        case BIO_CTRL_SET_CALLBACK:
+                {
+                SSL_set_info_callback(ssl,fp);
+                }
+                break;
+        default:
+                ret=BIO_callback_ctrl(ssl->rbio,cmd,fp);
+                break;
+                }
+        return(ret);
+        }
+
 static int ssl_puts(BIO *bp, char *str)
         {
         int n,ret;
diff --git a/src/lib/libssl/src/ssl/install.com b/src/lib/libssl/src/ssl/install.com
index 2b62f4e499..5d20201e8a 100644
--- a/src/lib/libssl/src/ssl/install.com
+++ b/src/lib/libssl/src/ssl/install.com
@@ -46,6 +46,7 @@ $	VEXE_DIR := [-.VAX.EXE.SSL]
 $       AEXE_DIR := [-.AXP.EXE.SSL]
 $
 $       COPY 'EXHEADER' WRK_SSLINCLUDE:/LOG
+$       SET FILE/PROT=WORLD:RE WRK_SSLINCLUDE:'EXHEADER'
 $
 $       I = 0
 $ LOOP_EXE: 
diff --git a/src/lib/libssl/src/ssl/s23_clnt.c b/src/lib/libssl/src/ssl/s23_clnt.c
index 299d2ae5d2..aaedf6a9bb 100644
--- a/src/lib/libssl/src/ssl/s23_clnt.c
+++ b/src/lib/libssl/src/ssl/s23_clnt.c
@@ -68,8 +68,10 @@ static int ssl23_client_hello(SSL *s);
 static int ssl23_get_server_hello(SSL *s);
 static SSL_METHOD *ssl23_get_client_method(int ver)
         {
+#ifndef NO_SSL2
         if (ver == SSL2_VERSION)
                 return(SSLv2_client_method());
+#endif
         if (ver == SSL3_VERSION)
                 return(SSLv3_client_method());
         else if (ver == TLS1_VERSION)
@@ -102,7 +104,7 @@ int ssl23_connect(SSL *s)
         int ret= -1;
         int new_state,state;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -222,7 +224,7 @@ static int ssl23_client_hello(SSL *s)
 #endif
 
                 p=s->s3->client_random;
-                RAND_bytes(p,SSL3_RANDOM_SIZE);
+                RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE);
 
                 /* Do the message type and length last */
                 d= &(buf[2]);
@@ -283,7 +285,7 @@ static int ssl23_client_hello(SSL *s)
                         i=ch_len;
                 s2n(i,d);
                 memset(&(s->s3->client_random[0]),0,SSL3_RANDOM_SIZE);
-                RAND_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
+                RAND_pseudo_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
                 memcpy(p,&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
                 p+=i;
 
@@ -307,7 +309,7 @@ static int ssl23_get_server_hello(SSL *s)
         {
         char buf[8];
         unsigned char *p;
-        int i,ch_len;
+        int i;
         int n;
 
         n=ssl23_read_bytes(s,7);
@@ -320,9 +322,14 @@ static int ssl23_get_server_hello(SSL *s)
         if ((p[0] & 0x80) && (p[2] == SSL2_MT_SERVER_HELLO) &&
                 (p[5] == 0x00) && (p[6] == 0x02))
                 {
+#ifdef NO_SSL2
+                SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
+                goto err;
+#else
                 /* we are talking sslv2 */
                 /* we need to clean up the SSLv3 setup and put in the
                  * sslv2 stuff. */
+                int ch_len;
 
                 if (s->options & SSL_OP_NO_SSLv2)
                         {
@@ -375,6 +382,7 @@ static int ssl23_get_server_hello(SSL *s)
 
                 s->method=SSLv2_client_method();
                 s->handshake_func=s->method->ssl_connect;
+#endif
                 }
         else if ((p[0] == SSL3_RT_HANDSHAKE) &&
                  (p[1] == SSL3_VERSION_MAJOR) &&
diff --git a/src/lib/libssl/src/ssl/s23_lib.c b/src/lib/libssl/src/ssl/s23_lib.c
index 822a395837..dded7a19c5 100644
--- a/src/lib/libssl/src/ssl/s23_lib.c
+++ b/src/lib/libssl/src/ssl/s23_lib.c
@@ -67,7 +67,7 @@ static int ssl23_write(SSL *s, const void *buf, int len);
 static long ssl23_default_timeout(void );
 static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
 static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p);
-char *SSL23_version_str="SSLv2/3 compatibility" OPENSSL_VERSION_PTEXT;
+const char *SSL23_version_str="SSLv2/3 compatibility" OPENSSL_VERSION_PTEXT;
 
 static SSL_METHOD SSLv23_data= {
         TLS1_VERSION,
@@ -92,6 +92,9 @@ static SSL_METHOD SSLv23_data= {
         ssl_bad_method,
         ssl23_default_timeout,
         &ssl3_undef_enc_method,
+        ssl_undefined_function,
+        ssl3_callback_ctrl,
+        ssl3_ctx_callback_ctrl,
         };
 
 static long ssl23_default_timeout(void)
@@ -106,7 +109,11 @@ SSL_METHOD *sslv23_base_method(void)
 
 static int ssl23_num_ciphers(void)
         {
-        return(ssl3_num_ciphers()+ssl2_num_ciphers());
+        return(ssl3_num_ciphers()
+#ifndef NO_SSL2
+               + ssl2_num_ciphers()
+#endif
+            );
         }
 
 static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
@@ -116,7 +123,11 @@ static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
         if (u < uu)
                 return(ssl3_get_cipher(u));
         else
+#ifndef NO_SSL2
                 return(ssl2_get_cipher(u-uu));
+#else
+                return(NULL);
+#endif
         }
 
 /* This function needs to check if the ciphers required are actually
@@ -132,8 +143,10 @@ static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
                 ((unsigned long)p[1]<<8L)|(unsigned long)p[2];
         c.id=id;
         cp=ssl3_get_cipher_by_char(p);
+#ifndef NO_SSL2
         if (cp == NULL)
                 cp=ssl2_get_cipher_by_char(p);
+#endif
         return(cp);
         }
 
diff --git a/src/lib/libssl/src/ssl/s23_pkt.c b/src/lib/libssl/src/ssl/s23_pkt.c
index 8370ea508c..f45e1ce3d8 100644
--- a/src/lib/libssl/src/ssl/s23_pkt.c
+++ b/src/lib/libssl/src/ssl/s23_pkt.c
@@ -89,7 +89,7 @@ int ssl23_write_bytes(SSL *s)
                 }
         }
 
-/* only return when we have read 'n' bytes */
+/* return regularly only when we have read (at least) 'n' bytes */
 int ssl23_read_bytes(SSL *s, int n)
         {
         unsigned char *p;
diff --git a/src/lib/libssl/src/ssl/s23_srvr.c b/src/lib/libssl/src/ssl/s23_srvr.c
index e4122f2d78..6a3bbb10b9 100644
--- a/src/lib/libssl/src/ssl/s23_srvr.c
+++ b/src/lib/libssl/src/ssl/s23_srvr.c
@@ -67,8 +67,10 @@ static SSL_METHOD *ssl23_get_server_method(int ver);
 int ssl23_get_client_hello(SSL *s);
 static SSL_METHOD *ssl23_get_server_method(int ver)
         {
+#ifndef NO_SSL2
         if (ver == SSL2_VERSION)
                 return(SSLv2_server_method());
+#endif
         if (ver == SSL3_VERSION)
                 return(SSLv3_server_method());
         else if (ver == TLS1_VERSION)
@@ -101,7 +103,7 @@ int ssl23_accept(SSL *s)
         int ret= -1;
         int new_state,state;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -186,23 +188,39 @@ end:
 
 int ssl23_get_client_hello(SSL *s)
         {
-        char buf_space[8];
+        char buf_space[11]; /* Request this many bytes in initial read.
+                             * We can detect SSL 3.0/TLS 1.0 Client Hellos
+                             * ('type == 3') correctly only when the following
+                             * is in a single record, which is not guaranteed by
+                             * the protocol specification:
+                             * Byte  Content
+                             *  0     type            \
+                             *  1/2   version          > record header
+                             *  3/4   length          /
+                             *  5     msg_type        \
+                             *  6-8   length           > Client Hello message
+                             *  9/10  client_version  /
+                             */
         char *buf= &(buf_space[0]);
         unsigned char *p,*d,*dd;
         unsigned int i;
         unsigned int csl,sil,cl;
-        int n=0,j,tls1=0;
-        int type=0,use_sslv2_strong=0;
+        int n=0,j;
+        int type=0;
         int v[2];
+#ifndef NO_RSA
+        int use_sslv2_strong=0;
+#endif
 
-        /* read the initial header */
-        v[0]=v[1]=0;
         if (s->state == SSL23_ST_SR_CLNT_HELLO_A)
                 {
+                /* read the initial header */
+                v[0]=v[1]=0;
+
                 if (!ssl3_setup_buffers(s)) goto err;
 
-                n=ssl23_read_bytes(s,7);
-                if (n != 7) return(n); /* n == -1 || n == 0 */
+                n=ssl23_read_bytes(s, sizeof buf_space);
+                if (n != sizeof buf_space) return(n); /* n == -1 || n == 0 */
 
                 p=s->packet;
 
@@ -210,7 +228,9 @@ int ssl23_get_client_hello(SSL *s)
 
                 if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO))
                         {
-                        /* SSLv2 header */
+                        /*
+                         * SSLv2 header
+                         */
                         if ((p[3] == 0x00) && (p[4] == 0x02))
                                 {
                                 v[0]=p[3]; v[1]=p[4];
@@ -226,11 +246,14 @@ int ssl23_get_client_hello(SSL *s)
                                         {
                                         if (!(s->options & SSL_OP_NO_TLSv1))
                                                 {
-                                                tls1=1;
+                                                s->version=TLS1_VERSION;
+                                                /* type=2; */ /* done later to survive restarts */
                                                 s->state=SSL23_ST_SR_CLNT_HELLO_B;
                                                 }
                                         else if (!(s->options & SSL_OP_NO_SSLv3))
                                                 {
+                                                s->version=SSL3_VERSION;
+                                                /* type=2; */
                                                 s->state=SSL23_ST_SR_CLNT_HELLO_B;
                                                 }
                                         else if (!(s->options & SSL_OP_NO_SSLv2))
@@ -239,12 +262,26 @@ int ssl23_get_client_hello(SSL *s)
                                                 }
                                         }
                                 else if (!(s->options & SSL_OP_NO_SSLv3))
+                                        {
+                                        s->version=SSL3_VERSION;
+                                        /* type=2; */
                                         s->state=SSL23_ST_SR_CLNT_HELLO_B;
+                                        }
                                 else if (!(s->options & SSL_OP_NO_SSLv2))
                                         type=1;
 
                                 if (s->options & SSL_OP_NON_EXPORT_FIRST)
+                                        /* Not only utterly confusing, but broken
+                                         * ('fractured programming'?) -- the details
+                                         * of this block nearly make it work
+                                         * as intended in this environment, but on one
+                                         * of the fine points (w.r.t. restarts) it fails.
+                                         * The obvious fix would be even more devastating
+                                         * to program structure; if you want the functionality,
+                                         * throw this away and implement it in a way
+                                         * that makes sense */
                                         {
+#if 0
                                         STACK_OF(SSL_CIPHER) *sk;
                                         SSL_CIPHER *c;
                                         int ne2,ne3;
@@ -294,27 +331,51 @@ int ssl23_get_client_hello(SSL *s)
                                                         goto next_bit;
                                                         }
                                                 }
+#else
+                                        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_OPTION);
+                                        goto err;
+#endif
                                         }
                                 }
                         }
                 else if ((p[0] == SSL3_RT_HANDSHAKE) &&
                          (p[1] == SSL3_VERSION_MAJOR) &&
-                         (p[5] == SSL3_MT_CLIENT_HELLO))
+                         (p[5] == SSL3_MT_CLIENT_HELLO) &&
+                         ((p[3] == 0 && p[4] < 5 /* silly record length? */)
+                                || (p[9] == p[1])))
                         {
-                        v[0]=p[1]; v[1]=p[2];
-                        /* true SSLv3 or tls1 */
-                        if (p[2] >= TLS1_VERSION_MINOR)
+                        /*
+                         * SSLv3 or tls1 header
+                         */
+                        
+                        v[0]=p[1]; /* major version */
+                        /* We must look at client_version inside the Client Hello message
+                         * to get the correct minor version: */
+                        v[1]=p[10];
+                        /* However if we have only a pathologically small fragment of the
+                         * Client Hello message, we simply use the version from the
+                         * record header -- this is incorrect but unlikely to fail in
+                         * practice */
+                        if (p[3] == 0 && p[4] < 6)
+                                v[1]=p[2];
+                        if (v[1] >= TLS1_VERSION_MINOR)
                                 {
                                 if (!(s->options & SSL_OP_NO_TLSv1))
                                         {
+                                        s->version=TLS1_VERSION;
                                         type=3;
-                                        tls1=1;
                                         }
                                 else if (!(s->options & SSL_OP_NO_SSLv3))
+                                        {
+                                        s->version=SSL3_VERSION;
                                         type=3;
+                                        }
                                 }
                         else if (!(s->options & SSL_OP_NO_SSLv3))
+                                {
+                                s->version=SSL3_VERSION;
                                 type=3;
+                                }
                         }
                 else if ((strncmp("GET ", (char *)p,4) == 0) ||
                          (strncmp("POST ",(char *)p,5) == 0) ||
@@ -331,12 +392,16 @@ int ssl23_get_client_hello(SSL *s)
                         }
                 }
 
-next_bit:
         if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
                 {
-                /* we have a SSLv3/TLSv1 in a SSLv2 header */
+                /* we have SSLv3/TLSv1 in an SSLv2 header
+                 * (other cases skip this state) */
+
                 type=2;
                 p=s->packet;
+                v[0] = p[3]; /* == SSL3_VERSION_MAJOR */
+                v[1] = p[4];
+
                 n=((p[0]&0x7f)<<8)|p[1];
                 if (n > (1024*4))
                         {
@@ -361,14 +426,11 @@ next_bit:
                         goto err;
                         }
 
-                *(d++)=SSL3_VERSION_MAJOR;
-                if (tls1)
-                        *(d++)=TLS1_VERSION_MINOR;
-                else
-                        *(d++)=SSL3_VERSION_MINOR;
+                *(d++) = SSL3_VERSION_MAJOR; /* == v[0] */
+                *(d++) = v[1];
 
                 /* lets populate the random area */
-                /* get the chalenge_length */
+                /* get the challenge_length */
                 i=(cl > SSL3_RANDOM_SIZE)?SSL3_RANDOM_SIZE:cl;
                 memset(d,0,SSL3_RANDOM_SIZE);
                 memcpy(&(d[SSL3_RANDOM_SIZE-i]),&(p[csl+sil]),i);
@@ -402,8 +464,15 @@ next_bit:
                 s->s3->tmp.message_size=i;
                 }
 
+        /* imaginary new state (for program structure): */
+        /* s->state = SSL23_SR_CLNT_HELLO_C */
+
         if (type == 1)
                 {
+#ifdef NO_SSL2
+                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
+                goto err;
+#else
                 /* we are talking sslv2 */
                 /* we need to clean up the SSLv3/TLSv1 setup and put in the
                  * sslv2 stuff. */
@@ -431,7 +500,7 @@ next_bit:
                 else
                         s->s2->ssl2_rollback=1;
 
-                /* setup the 5 bytes we have read so we get them from
+                /* setup the n bytes we have read so we get them from
                  * the sslv2 buffer */
                 s->rstate=SSL_ST_READ_HEADER;
                 s->packet_length=n;
@@ -442,11 +511,12 @@ next_bit:
 
                 s->method=SSLv2_server_method();
                 s->handshake_func=s->method->ssl_accept;
+#endif
                 }
 
         if ((type == 2) || (type == 3))
                 {
-                /* we have SSLv3/TLSv1 */
+                /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */
 
                 if (!ssl_init_wbio_buffer(s,1)) goto err;
 
@@ -471,17 +541,13 @@ next_bit:
                         s->s3->rbuf.offset=0;
                         }
 
-                if (tls1)
-                        {
-                        s->version=TLS1_VERSION;
-                        s->method=TLSv1_server_method();
-                        }
+                if (s->version == TLS1_VERSION)
+                        s->method = TLSv1_server_method();
                 else
-                        {
-                        s->version=SSL3_VERSION;
-                        s->method=SSLv3_server_method();
-                        }
+                        s->method = SSLv3_server_method();
+#if 0 /* ssl3_get_client_hello does this */
                 s->client_version=(v[0]<<8)|v[1];
+#endif
                 s->handshake_func=s->method->ssl_accept;
                 }
         
@@ -500,4 +566,3 @@ err:
         if (buf != buf_space) Free(buf);
         return(-1);
         }
-
diff --git a/src/lib/libssl/src/ssl/s2_clnt.c b/src/lib/libssl/src/ssl/s2_clnt.c
index 1fe8bd627d..6ff6a51362 100644
--- a/src/lib/libssl/src/ssl/s2_clnt.c
+++ b/src/lib/libssl/src/ssl/s2_clnt.c
@@ -56,12 +56,12 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef NO_RSA
+#include "ssl_locl.h"
+#ifndef NO_SSL2
 #include <stdio.h>
 #include <openssl/rand.h>
 #include <openssl/buffer.h>
 #include <openssl/objects.h>
-#include "ssl_locl.h"
 #include <openssl/evp.h>
 
 static SSL_METHOD *ssl2_get_client_method(int ver);
@@ -108,7 +108,7 @@ int ssl2_connect(SSL *s)
         void (*cb)()=NULL;
         int new_state,state;
 
-        RAND_seed(&l,sizeof(l));
+        RAND_add(&l,sizeof(l),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -245,7 +245,7 @@ int ssl2_connect(SSL *s)
                 /*      ERR_clear_error();*/
 
                         /* If we want to cache session-ids in the client
-                         * and we sucessfully add the session-id to the
+                         * and we successfully add the session-id to the
                          * cache, and there is a callback, then pass it out.
                          * 26/11/96 - eay - only add if not a re-used session.
                          */
@@ -310,7 +310,13 @@ static int get_server_hello(SSL *s)
                                         SSL_R_PEER_ERROR);
                         return(-1);
                         }
+#ifdef __APPLE_CC__
+                /* The Rhapsody 5.5 (a.k.a. MacOS X) compiler bug
+                 * workaround. <appro@fy.chalmers.se> */
+                s->hit=(i=*(p++))?1:0;
+#else
                 s->hit=(*(p++))?1:0;
+#endif
                 s->s2->tmp.cert_type= *(p++);
                 n2s(p,i);
                 if (i < s->version) s->version=i;
@@ -362,7 +368,7 @@ static int get_server_hello(SSL *s)
                 */
 #endif
 
-                /* we need to do this incase we were trying to reuse a 
+                /* we need to do this in case we were trying to reuse a 
                  * client session but others are already reusing it.
                  * If this was a new 'blank' session ID, the session-id
                  * length will still be 0 */
@@ -412,7 +418,7 @@ static int get_server_hello(SSL *s)
 
                 /* In theory we could have ciphers sent back that we
                  * don't want to use but that does not matter since we
-                 * will check against the list we origionally sent and
+                 * will check against the list we originally sent and
                  * for performance reasons we should not bother to match
                  * the two lists up just to check. */
                 for (i=0; i<sk_SSL_CIPHER_num(cl); i++)
@@ -429,26 +435,28 @@ static int get_server_hello(SSL *s)
                         return(-1);
                         }
                 s->session->cipher=sk_SSL_CIPHER_value(cl,i);
-                }
 
-        if (s->session->peer != NULL)
-                X509_free(s->session->peer);
-
-#if 0 /* What is all this meant to accomplish?? */
-        /* hmmm, can we have the problem of the other session with this
-         * cert, Free's it before we increment the reference count. */
-        CRYPTO_w_lock(CRYPTO_LOCK_X509);
-        s->session->peer=s->session->sess_cert->key->x509;
-        /* Shouldn't do this: already locked */
-        /*CRYPTO_add(&s->session->peer->references,1,CRYPTO_LOCK_X509);*/
-        s->session->peer->references++;
-        CRYPTO_w_unlock(CRYPTO_LOCK_X509);
-#else
-        s->session->peer = s->session->sess_cert->peer_key->x509;
-    /* peer_key->x509 has been set by ssl2_set_certificate. */
-        CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
-#endif
 
+                if (s->session->peer != NULL) /* can't happen*/
+                        {
+                        ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
+                        SSLerr(SSL_F_GET_SERVER_HELLO, SSL_R_INTERNAL_ERROR);
+                        return(-1);
+                        }
+
+                s->session->peer = s->session->sess_cert->peer_key->x509;
+                /* peer_key->x509 has been set by ssl2_set_certificate. */
+                CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
+                }
+
+        if (s->session->peer != s->session->sess_cert->peer_key->x509)
+                /* can't happen */
+                {
+                ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
+                SSLerr(SSL_F_GET_SERVER_HELLO, SSL_R_INTERNAL_ERROR);
+                return(-1);
+                }
+                
         s->s2->conn_id_length=s->s2->tmp.conn_id_length;
         memcpy(s->s2->conn_id,p,s->s2->tmp.conn_id_length);
         return(1);
@@ -509,7 +517,7 @@ static int client_hello(SSL *s)
                 s->s2->challenge_length=SSL2_CHALLENGE_LENGTH;
                 s2n(SSL2_CHALLENGE_LENGTH,p);           /* challenge length */
                 /*challenge id data*/
-                RAND_bytes(s->s2->challenge,SSL2_CHALLENGE_LENGTH);
+                RAND_pseudo_bytes(s->s2->challenge,SSL2_CHALLENGE_LENGTH);
                 memcpy(d,s->s2->challenge,SSL2_CHALLENGE_LENGTH);
                 d+=SSL2_CHALLENGE_LENGTH;
 
@@ -551,12 +559,19 @@ static int client_master_key(SSL *s)
                 /* make key_arg data */
                 i=EVP_CIPHER_iv_length(c);
                 sess->key_arg_length=i;
-                if (i > 0) RAND_bytes(sess->key_arg,i);
+                if (i > 0) RAND_pseudo_bytes(sess->key_arg,i);
 
                 /* make a master key */
                 i=EVP_CIPHER_key_length(c);
                 sess->master_key_length=i;
-                if (i > 0) RAND_bytes(sess->master_key,i);
+                if (i > 0)
+                        {
+                        if (RAND_bytes(sess->master_key,i) <= 0)
+                                {
+                                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
+                                return(-1);
+                                }
+                        }
 
                 if (sess->cipher->algorithm2 & SSL2_CF_8_BYTE_ENC)
                         enc=8;
@@ -753,7 +768,7 @@ static int client_certificate(SSL *s)
                         {
                         /* this is not good.  If things have failed it
                          * means there so something wrong with the key.
-                         * We will contiune with a 0 length signature
+                         * We will continue with a 0 length signature
                          */
                         }
                 memset(&ctx,0,sizeof(ctx));
@@ -968,4 +983,10 @@ end:
         EVP_PKEY_free(pkey);
         return(i);
         }
+#else /* !NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/ssl/s2_enc.c b/src/lib/libssl/src/ssl/s2_enc.c
index 09835008a9..a9458e7fa7 100644
--- a/src/lib/libssl/src/ssl/s2_enc.c
+++ b/src/lib/libssl/src/ssl/s2_enc.c
@@ -56,8 +56,9 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
 #include "ssl_locl.h"
+#ifndef NO_SSL2
+#include <stdio.h>
 
 int ssl2_enc_init(SSL *s, int client)
         {
@@ -177,4 +178,10 @@ void ssl2_mac(SSL *s, unsigned char *md, int send)
         EVP_DigestFinal(&c,md,NULL);
         /* some would say I should zero the md context */
         }
+#else /* !NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
 
+#endif
diff --git a/src/lib/libssl/src/ssl/s2_lib.c b/src/lib/libssl/src/ssl/s2_lib.c
index ff804d8e0d..5ddba23a06 100644
--- a/src/lib/libssl/src/ssl/s2_lib.c
+++ b/src/lib/libssl/src/ssl/s2_lib.c
@@ -56,12 +56,12 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef NO_RSA
+#include "ssl_locl.h"
+#ifndef NO_SSL2
 #include <stdio.h>
 #include <openssl/rsa.h>
 #include <openssl/objects.h>
 #include <openssl/md5.h>
-#include "ssl_locl.h"
 
 static long ssl2_default_timeout(void );
 const char *ssl2_version_str="SSLv2" OPENSSL_VERSION_PTEXT;
@@ -75,9 +75,12 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
         1,
         SSL2_TXT_NULL_WITH_MD5,
         SSL2_CK_NULL_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5|SSL_EXP40|SSL_SSLV2,
+        SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5|SSL_SSLV2,
+        SSL_EXPORT|SSL_EXP40,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 #endif
 /* RC4_128_EXPORT40_WITH_MD5 */
@@ -85,63 +88,91 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
         1,
         SSL2_TXT_RC4_128_EXPORT40_WITH_MD5,
         SSL2_CK_RC4_128_EXPORT40_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_EXP40|SSL_SSLV2,
+        SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_SSLV2,
+        SSL_EXPORT|SSL_EXP40,
         SSL2_CF_5_BYTE_ENC,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* RC4_128_WITH_MD5 */
         {
         1,
         SSL2_TXT_RC4_128_WITH_MD5,
         SSL2_CK_RC4_128_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_NOT_EXP|SSL_SSLV2|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_SSLV2,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* RC2_128_CBC_EXPORT40_WITH_MD5 */
         {
         1,
         SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5,
         SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_EXP40|SSL_SSLV2,
+        SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_SSLV2,
+        SSL_EXPORT|SSL_EXP40,
         SSL2_CF_5_BYTE_ENC,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* RC2_128_CBC_WITH_MD5 */
         {
         1,
         SSL2_TXT_RC2_128_CBC_WITH_MD5,
         SSL2_CK_RC2_128_CBC_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_NOT_EXP|SSL_SSLV2|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_SSLV2,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* IDEA_128_CBC_WITH_MD5 */
         {
         1,
         SSL2_TXT_IDEA_128_CBC_WITH_MD5,
         SSL2_CK_IDEA_128_CBC_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_IDEA|SSL_MD5|SSL_NOT_EXP|SSL_SSLV2|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_IDEA|SSL_MD5|SSL_SSLV2,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* DES_64_CBC_WITH_MD5 */
         {
         1,
         SSL2_TXT_DES_64_CBC_WITH_MD5,
         SSL2_CK_DES_64_CBC_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5|SSL_NOT_EXP|SSL_SSLV2|SSL_LOW,
+        SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5|SSL_SSLV2,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* DES_192_EDE3_CBC_WITH_MD5 */
         {
         1,
         SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5,
         SSL2_CK_DES_192_EDE3_CBC_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5|SSL_NOT_EXP|SSL_SSLV2|SSL_HIGH,
+        SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5|SSL_SSLV2,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* RC4_64_WITH_MD5 */
 #if 1
@@ -149,9 +180,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
         1,
         SSL2_TXT_RC4_64_WITH_MD5,
         SSL2_CK_RC4_64_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_SSLV2|SSL_LOW,
+        SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_SSLV2,
+        SSL_NOT_EXP|SSL_LOW,
         SSL2_CF_8_BYTE_ENC,
+        64,
+        64,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 #endif
 /* NULL SSLeay (testing) */
@@ -161,7 +196,11 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
         SSL2_TXT_NULL,
         SSL2_CK_NULL,
         0,
+        0,
+        0,
+        0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 #endif
 
@@ -191,6 +230,9 @@ static SSL_METHOD SSLv2_data= {
         ssl_bad_method,
         ssl2_default_timeout,
         &ssl3_undef_enc_method,
+        ssl_undefined_function,
+        ssl2_callback_ctrl,     /* local */
+        ssl2_ctx_callback_ctrl, /* local */
         };
 
 static long ssl2_default_timeout(void)
@@ -223,14 +265,14 @@ int ssl2_pending(SSL *s)
 
 int ssl2_new(SSL *s)
         {
-        SSL2_CTX *s2;
+        SSL2_STATE *s2;
 
-        if ((s2=(SSL2_CTX *)Malloc(sizeof(SSL2_CTX))) == NULL) goto err;
-        memset(s2,0,sizeof(SSL2_CTX));
+        if ((s2=Malloc(sizeof *s2)) == NULL) goto err;
+        memset(s2,0,sizeof *s2);
 
-        if ((s2->rbuf=(unsigned char *)Malloc(
+        if ((s2->rbuf=Malloc(
                 SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2)) == NULL) goto err;
-        if ((s2->wbuf=(unsigned char *)Malloc(
+        if ((s2->wbuf=Malloc(
                 SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER+2)) == NULL) goto err;
         s->s2=s2;
 
@@ -248,7 +290,7 @@ err:
 
 void ssl2_free(SSL *s)
         {
-        SSL2_CTX *s2;
+        SSL2_STATE *s2;
 
         if(s == NULL)
             return;
@@ -256,14 +298,14 @@ void ssl2_free(SSL *s)
         s2=s->s2;
         if (s2->rbuf != NULL) Free(s2->rbuf);
         if (s2->wbuf != NULL) Free(s2->wbuf);
-        memset(s2,0,sizeof(SSL2_CTX));
+        memset(s2,0,sizeof *s2);
         Free(s2);
         s->s2=NULL;
         }
 
 void ssl2_clear(SSL *s)
         {
-        SSL2_CTX *s2;
+        SSL2_STATE *s2;
         unsigned char *rbuf,*wbuf;
 
         s2=s->s2;
@@ -271,7 +313,7 @@ void ssl2_clear(SSL *s)
         rbuf=s2->rbuf;
         wbuf=s2->wbuf;
 
-        memset(s2,0,sizeof(SSL2_CTX));
+        memset(s2,0,sizeof *s2);
 
         s2->rbuf=rbuf;
         s2->wbuf=wbuf;
@@ -296,11 +338,21 @@ long ssl2_ctrl(SSL *s, int cmd, long larg, char *parg)
         return(ret);
         }
 
+long ssl2_callback_ctrl(SSL *s, int cmd, void (*fp)())
+        {
+        return(0);
+        }
+
 long ssl2_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
         {
         return(0);
         }
 
+long ssl2_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+        {
+        return(0);
+        }
+
 /* This function needs to check if the ciphers required are actually
  * available */
 SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p)
@@ -372,7 +424,7 @@ void ssl2_generate_key_material(SSL *s)
                 MD5_Init(&ctx);
 
                 MD5_Update(&ctx,s->session->master_key,s->session->master_key_length);
-                MD5_Update(&ctx,(unsigned char *)&c,1);
+                MD5_Update(&ctx,&c,1);
                 c++;
                 MD5_Update(&ctx,s->s2->challenge,s->s2->challenge_length);
                 MD5_Update(&ctx,s->s2->conn_id,s->s2->conn_id_length);
@@ -421,4 +473,10 @@ int ssl2_shutdown(SSL *s)
         s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
         return(1);
         }
+#else /* !NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/ssl/s2_meth.c b/src/lib/libssl/src/ssl/s2_meth.c
index e2add164dd..deb9e1d6f3 100644
--- a/src/lib/libssl/src/ssl/s2_meth.c
+++ b/src/lib/libssl/src/ssl/s2_meth.c
@@ -56,10 +56,10 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef NO_RSA
+#include "ssl_locl.h"
+#ifndef NO_SSL2
 #include <stdio.h>
 #include <openssl/objects.h>
-#include "ssl_locl.h"
 
 static SSL_METHOD *ssl2_get_method(int ver);
 static SSL_METHOD *ssl2_get_method(int ver)
@@ -86,4 +86,10 @@ SSL_METHOD *SSLv2_method(void)
                 }
         return(&SSLv2_data);
         }
+#else /* !NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/ssl/s2_pkt.c b/src/lib/libssl/src/ssl/s2_pkt.c
index a1bb5bca4b..56662f29fa 100644
--- a/src/lib/libssl/src/ssl/s2_pkt.c
+++ b/src/lib/libssl/src/ssl/s2_pkt.c
@@ -56,10 +56,11 @@
  * [including the GNU Public Licence.]
  */
 
+#include "ssl_locl.h"
+#ifndef NO_SSL2
 #include <stdio.h>
 #include <errno.h>
 #define USE_SOCKETS
-#include "ssl_locl.h"
 
 static int read_n(SSL *s,unsigned int n,unsigned int max,unsigned int extend);
 static int do_ssl_write(SSL *s, const unsigned char *buf, unsigned int len);
@@ -638,3 +639,10 @@ static int ssl_mt_error(int n)
                 }
         return(ret);
         }
+#else /* !NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
+#endif
diff --git a/src/lib/libssl/src/ssl/s2_srvr.c b/src/lib/libssl/src/ssl/s2_srvr.c
index 9aeedef55f..332e284451 100644
--- a/src/lib/libssl/src/ssl/s2_srvr.c
+++ b/src/lib/libssl/src/ssl/s2_srvr.c
@@ -56,12 +56,12 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef NO_RSA
+#include "ssl_locl.h"
+#ifndef NO_SSL2
 #include <stdio.h>
 #include <openssl/bio.h>
 #include <openssl/rand.h>
 #include <openssl/objects.h>
-#include "ssl_locl.h"
 #include <openssl/evp.h>
 
 static SSL_METHOD *ssl2_get_server_method(int ver);
@@ -109,7 +109,7 @@ int ssl2_accept(SSL *s)
         void (*cb)()=NULL;
         int new_state,state;
 
-        RAND_seed(&l,sizeof(l));
+        RAND_add(&l,sizeof(l),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -415,7 +415,7 @@ static int get_client_master_key(SSL *s)
                         i=ek;
                 else
                         i=EVP_CIPHER_key_length(c);
-                RAND_bytes(p,i);
+                RAND_pseudo_bytes(p,i);
                 }
 #else
         if (i < 0)
@@ -680,7 +680,7 @@ static int server_hello(SSL *s)
                 /* make and send conn_id */
                 s2n(SSL2_CONNECTION_ID_LENGTH,p);       /* add conn_id length */
                 s->s2->conn_id_length=SSL2_CONNECTION_ID_LENGTH;
-                RAND_bytes(s->s2->conn_id,(int)s->s2->conn_id_length);
+                RAND_pseudo_bytes(s->s2->conn_id,(int)s->s2->conn_id_length);
                 memcpy(d,s->s2->conn_id,SSL2_CONNECTION_ID_LENGTH);
                 d+=SSL2_CONNECTION_ID_LENGTH;
 
@@ -689,7 +689,7 @@ static int server_hello(SSL *s)
                 s->init_off=0;
                 }
         /* SSL2_ST_SEND_SERVER_HELLO_B */
-        /* If we are using TCP/IP, the performace is bad if we do 2
+        /* If we are using TCP/IP, the performance is bad if we do 2
          * writes without a read between them.  This occurs when
          * Session-id reuse is used, so I will put in a buffering module
          */
@@ -798,7 +798,7 @@ static int request_certificate(SSL *s)
                 p=(unsigned char *)s->init_buf->data;
                 *(p++)=SSL2_MT_REQUEST_CERTIFICATE;
                 *(p++)=SSL2_AT_MD5_WITH_RSA_ENCRYPTION;
-                RAND_bytes(ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
+                RAND_pseudo_bytes(ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
                 memcpy(p,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
 
                 s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_B;
@@ -898,7 +898,7 @@ static int request_certificate(SSL *s)
                 EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
 
                 i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
-                buf2=(unsigned char *)Malloc((unsigned int)i);
+                buf2=Malloc((unsigned int)i);
                 if (buf2 == NULL)
                         {
                         SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);
@@ -921,6 +921,7 @@ static int request_certificate(SSL *s)
                                 X509_free(s->session->peer);
                         s->session->peer=x509;
                         CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509);
+                        s->session->verify_result = s->verify_result;
                         ret=1;
                         goto end;
                         }
@@ -965,4 +966,10 @@ static int ssl_rsa_private_decrypt(CERT *c, int len, unsigned char *from,
                 SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT,ERR_R_RSA_LIB);
         return(i);
         }
+#else /* !NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
+
 #endif
diff --git a/src/lib/libssl/src/ssl/s3_both.c b/src/lib/libssl/src/ssl/s3_both.c
index f3f27715d5..03e0c38770 100644
--- a/src/lib/libssl/src/ssl/s3_both.c
+++ b/src/lib/libssl/src/ssl/s3_both.c
@@ -55,7 +55,61 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
+#include <string.h>
 #include <stdio.h>
 #include <openssl/buffer.h>
 #include <openssl/rand.h>
@@ -64,8 +118,27 @@
 #include <openssl/x509.h>
 #include "ssl_locl.h"
 
-int ssl3_send_finished(SSL *s, int a, int b, unsigned char *sender,
-             int slen)
+/* send s->init_buf in records of type 'type' */
+int ssl3_do_write(SSL *s, int type)
+        {
+        int ret;
+
+        ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
+                             s->init_num);
+        if (ret < 0) return(-1);
+        if (type == SSL3_RT_HANDSHAKE)
+                /* should not be done for 'Hello Request's, but in that case
+                 * we'll ignore the result anyway */
+                ssl3_finish_mac(s,(unsigned char *)&s->init_buf->data[s->init_off],ret);
+        
+        if (ret == s->init_num)
+                return(1);
+        s->init_off+=ret;
+        s->init_num-=ret;
+        return(0);
+        }
+
+int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
         {
         unsigned char *p,*d;
         int i;
@@ -79,7 +152,9 @@ int ssl3_send_finished(SSL *s, int a, int b, unsigned char *sender,
                 i=s->method->ssl3_enc->final_finish_mac(s,
                         &(s->s3->finish_dgst1),
                         &(s->s3->finish_dgst2),
-                        sender,slen,p);
+                        sender,slen,s->s3->tmp.finish_md);
+                s->s3->tmp.finish_md_len = i;
+                memcpy(p, s->s3->tmp.finish_md, i);
                 p+=i;
                 l=i;
 
@@ -109,7 +184,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
         unsigned char *p;
 
         /* the mac has already been generated when we received the
-         * change cipher spec message and is in s->s3->tmp.in_dgst[12]
+         * change cipher spec message and is in s->s3->tmp.peer_finish_md
          */ 
 
         n=ssl3_get_message(s,
@@ -121,7 +196,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
 
         if (!ok) return((int)n);
 
-        /* If this occurs if we has missed a message */
+        /* If this occurs, we have missed a message */
         if (!s->s3->change_cipher_spec)
                 {
                 al=SSL_AD_UNEXPECTED_MESSAGE;
@@ -130,9 +205,8 @@ int ssl3_get_finished(SSL *s, int a, int b)
                 }
         s->s3->change_cipher_spec=0;
 
-        p=(unsigned char *)s->init_buf->data;
-
-        i=s->method->ssl3_enc->finish_mac_length;
+        p = (unsigned char *)s->init_buf->data;
+        i = s->s3->tmp.peer_finish_md_len;
 
         if (i != n)
                 {
@@ -141,7 +215,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
                 goto f_err;
                 }
 
-        if (memcmp(  p,    (char *)&(s->s3->tmp.finish_md[0]),i) != 0)
+        if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
                 {
                 al=SSL_AD_DECRYPT_ERROR;
                 SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
@@ -255,6 +329,11 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
         return(l);
         }
 
+/* Obtain handshake message of message type 'mt' (any if mt == -1),
+ * maximum acceptable body length 'max'.
+ * The first four bytes (msg_type and length) are read in state 'st1',
+ * the body is read in state 'stn'.
+ */
 long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         {
         unsigned char *p;
@@ -277,15 +356,38 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
 
         p=(unsigned char *)s->init_buf->data;
 
-        if (s->state == st1)
+        if (s->state == st1) /* s->init_num < 4 */
                 {
-                i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
-                                  4-s->init_num);
-                if (i < (4-s->init_num))
+                int skip_message;
+
+                do
                         {
-                        *ok=0;
-                        return(ssl3_part_read(s,i));
+                        while (s->init_num < 4)
+                                {
+                                i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
+                                        4 - s->init_num);
+                                if (i <= 0)
+                                        {
+                                        s->rwstate=SSL_READING;
+                                        *ok = 0;
+                                        return i;
+                                        }
+                                s->init_num+=i;
+                                }
+                        
+                        skip_message = 0;
+                        if (!s->server)
+                                if (p[0] == SSL3_MT_HELLO_REQUEST)
+                                        /* The server may always send 'Hello Request' messages --
+                                         * we are doing a handshake anyway now, so ignore them
+                                         * if their format is correct. Does not count for
+                                         * 'Finished' MAC. */
+                                        if (p[1] == 0 && p[2] == 0 &&p[3] == 0)
+                                                skip_message = 1;
                         }
+                while (skip_message);
+
+                /* s->init_num == 4 */
 
                 if ((mt >= 0) && (*p != mt))
                         {
@@ -293,6 +395,20 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
                         SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
                         goto f_err;
                         }
+                if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) &&
+                                        (st1 == SSL3_ST_SR_CERT_A) &&
+                                        (stn == SSL3_ST_SR_CERT_B))
+                        {
+                        /* At this point we have got an MS SGC second client
+                         * hello (maybe we should always allow the client to
+                         * start a new handshake?). We need to restart the mac.
+                         * Don't increment {num,total}_renegotiations because
+                         * we have not completed the handshake. */
+                        ssl3_init_finished_mac(s);
+                        }
+
+                ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, 4);
+                        
                 s->s3->tmp.message_type= *(p++);
 
                 n2l3(p,l);
@@ -316,17 +432,21 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         /* next state (stn) */
         p=(unsigned char *)s->init_buf->data;
         n=s->s3->tmp.message_size;
-        if (n > 0)
+        while (n > 0)
                 {
                 i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n);
-                if (i != (int)n)
+                if (i <= 0)
                         {
-                        *ok=0;
-                        return(ssl3_part_read(s,i));
+                        s->rwstate=SSL_READING;
+                        *ok = 0;
+                        return i;
                         }
+                s->init_num += i;
+                n -= i;
                 }
+        ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num);
         *ok=1;
-        return(n);
+        return s->init_num;
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 err:
@@ -447,7 +567,7 @@ int ssl3_setup_buffers(SSL *s)
                         extra=SSL3_RT_MAX_EXTRA;
                 else
                         extra=0;
-                if ((p=(unsigned char *)Malloc(SSL3_RT_MAX_PACKET_SIZE+extra))
+                if ((p=Malloc(SSL3_RT_MAX_PACKET_SIZE+extra))
                         == NULL)
                         goto err;
                 s->s3->rbuf.buf=p;
@@ -455,7 +575,7 @@ int ssl3_setup_buffers(SSL *s)
 
         if (s->s3->wbuf.buf == NULL)
                 {
-                if ((p=(unsigned char *)Malloc(SSL3_RT_MAX_PACKET_SIZE))
+                if ((p=Malloc(SSL3_RT_MAX_PACKET_SIZE))
                         == NULL)
                         goto err;
                 s->s3->wbuf.buf=p;
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index d3e6b4d1e5..279d2c0198 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -110,7 +110,7 @@ int ssl3_connect(SSL *s)
         int ret= -1;
         int new_state,state,skip=0;;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -325,8 +325,8 @@ int ssl3_connect(SSL *s)
                 case SSL3_ST_CW_FINISHED_B:
                         ret=ssl3_send_finished(s,
                                 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
-                                s->method->ssl3_enc->client_finished,
-                                s->method->ssl3_enc->client_finished_len);
+                                s->method->ssl3_enc->client_finished_label,
+                                s->method->ssl3_enc->client_finished_label_len);
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_CW_FLUSH;
 
@@ -466,7 +466,7 @@ static int ssl3_client_hello(SSL *s)
                 p=s->s3->client_random;
                 Time=time(NULL);                        /* Time */
                 l2n(Time,p);
-                RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
+                RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
 
                 /* Do the message type and length last */
                 d=p= &(buf[4]);
@@ -1053,15 +1053,15 @@ static int ssl3_get_key_exchange(SSL *s)
                                 q+=i;
                                 j+=i;
                                 }
-                        i=RSA_public_decrypt((int)n,p,p,pkey->pkey.rsa,
-                                RSA_PKCS1_PADDING);
-                        if (i <= 0)
+                        i=RSA_verify(NID_md5_sha1, md_buf, j, p, n,
+                                                                pkey->pkey.rsa);
+                        if (i < 0)
                                 {
                                 al=SSL_AD_DECRYPT_ERROR;
                                 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
                                 goto f_err;
                                 }
-                        if ((j != i) || (memcmp(p,md_buf,i) != 0))
+                        if (i == 0)
                                 {
                                 /* bad signature */
                                 al=SSL_AD_DECRYPT_ERROR;
@@ -1225,7 +1225,7 @@ fclose(out);
 
                 if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL)
                         {
-                        /* If netscape tollerance is on, ignore errors */
+                        /* If netscape tolerance is on, ignore errors */
                         if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG)
                                 goto cont;
                         else
@@ -1258,7 +1258,7 @@ cont:
                 ERR_clear_error();
                 }
 
-        /* we should setup a certficate to return.... */
+        /* we should setup a certificate to return.... */
         s->s3->tmp.cert_req=1;
         s->s3->tmp.ctype_num=ctype_num;
         if (s->s3->tmp.ca_names != NULL)
@@ -1341,7 +1341,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                 
                         tmp_buf[0]=s->client_version>>8;
                         tmp_buf[1]=s->client_version&0xff;
-                        RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
+                        if (RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2) <= 0)
+                                        goto err;
 
                         s->session->master_key_length=SSL_MAX_MASTER_KEY_LENGTH;
 
@@ -1460,7 +1461,7 @@ static int ssl3_send_client_verify(SSL *s)
         unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
         EVP_PKEY *pkey;
 #ifndef NO_RSA
-        int i=0;
+        unsigned u=0;
 #endif
         unsigned long n;
 #ifndef NO_DSA
@@ -1481,17 +1482,15 @@ static int ssl3_send_client_verify(SSL *s)
                         {
                         s->method->ssl3_enc->cert_verify_mac(s,
                                 &(s->s3->finish_dgst1),&(data[0]));
-                        i=RSA_private_encrypt(
-                                MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
-                                data,&(p[2]),pkey->pkey.rsa,
-                                RSA_PKCS1_PADDING);
-                        if (i <= 0)
+                        if (RSA_sign(NID_md5_sha1, data,
+                                         MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
+                                        &(p[2]), &u, pkey->pkey.rsa) <= 0 )
                                 {
                                 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
                                 goto err;
                                 }
-                        s2n(i,p);
-                        n=i+2;
+                        s2n(u,p);
+                        n=u+2;
                         }
                 else
 #endif
@@ -1689,13 +1688,13 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
 #endif
 #endif
 
-        if (SSL_IS_EXPORT(algs) && !has_bits(i,EVP_PKT_EXP))
+        if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
                 {
 #ifndef NO_RSA
                 if (algs & SSL_kRSA)
                         {
                         if (rsa == NULL
-                            || RSA_size(rsa) > SSL_EXPORT_PKEYLENGTH(algs))
+                            || RSA_size(rsa) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
                                 {
                                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
                                 goto f_err;
@@ -1707,7 +1706,7 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
                         if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                             {
                             if (dh == NULL
-                                || DH_size(dh) > SSL_EXPORT_PKEYLENGTH(algs))
+                                || DH_size(dh) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
                                 {
                                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
                                 goto f_err;
diff --git a/src/lib/libssl/src/ssl/s3_enc.c b/src/lib/libssl/src/ssl/s3_enc.c
index 15d4af6dfb..df4acab3d0 100644
--- a/src/lib/libssl/src/ssl/s3_enc.c
+++ b/src/lib/libssl/src/ssl/s3_enc.c
@@ -78,12 +78,8 @@ static unsigned char ssl3_pad_2[48]={
         0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
         0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c };
 
-#ifndef NO_PROTO
 static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx,
-        unsigned char *sender, int len, unsigned char *p);
-#else
-static int ssl3_handshake_mac();
-#endif
+        const char *sender, int len, unsigned char *p);
 
 static void ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
         {
@@ -304,7 +300,7 @@ int ssl3_setup_key_block(SSL *s)
 
         ssl3_cleanup_key_block(s);
 
-        if ((p=(unsigned char *)Malloc(num)) == NULL)
+        if ((p=Malloc(num)) == NULL)
                 goto err;
 
         s->s3->tmp.key_block_length=num;
@@ -416,7 +412,7 @@ int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *ctx, unsigned char *p)
         }
 
 int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1, EVP_MD_CTX *ctx2,
-             unsigned char *sender, int len, unsigned char *p)
+             const char *sender, int len, unsigned char *p)
         {
         int ret;
 
@@ -427,7 +423,7 @@ int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1, EVP_MD_CTX *ctx2,
         }
 
 static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx,
-             unsigned char *sender, int len, unsigned char *p)
+             const char *sender, int len, unsigned char *p)
         {
         unsigned int ret;
         int npad,n;
@@ -447,7 +443,7 @@ static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx,
         EVP_DigestUpdate(&ctx,ssl3_pad_1,npad);
         EVP_DigestFinal(&ctx,md_buf,&i);
 
-        EVP_DigestInit(&ctx,EVP_MD_CTX_type(&ctx));
+        EVP_DigestInit(&ctx,EVP_MD_CTX_md(&ctx));
         EVP_DigestUpdate(&ctx,s->session->master_key,
                 s->session->master_key_length);
         EVP_DigestUpdate(&ctx,ssl3_pad_2,npad);
@@ -575,11 +571,11 @@ int ssl3_alert_code(int code)
         case SSL_AD_ACCESS_DENIED:      return(SSL3_AD_HANDSHAKE_FAILURE);
         case SSL_AD_DECODE_ERROR:       return(SSL3_AD_HANDSHAKE_FAILURE);
         case SSL_AD_DECRYPT_ERROR:      return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_EXPORT_RESTRICION:  return(SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_EXPORT_RESTRICTION: return(SSL3_AD_HANDSHAKE_FAILURE);
         case SSL_AD_PROTOCOL_VERSION:   return(SSL3_AD_HANDSHAKE_FAILURE);
         case SSL_AD_INSUFFICIENT_SECURITY:return(SSL3_AD_HANDSHAKE_FAILURE);
         case SSL_AD_INTERNAL_ERROR:     return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_USER_CANCLED:       return(SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_USER_CANCELLED:     return(SSL3_AD_HANDSHAKE_FAILURE);
         case SSL_AD_NO_RENEGOTIATION:   return(-1); /* Don't send it :-) */
         default:                        return(-1);
                 }
diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index aeff6b5c5b..c4b49aaedf 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -75,18 +75,26 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         SSL3_TXT_RSA_NULL_MD5,
         SSL3_CK_RSA_NULL_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_SSLV3,
+        SSL_NOT_EXP,
+        0,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 02 */
         {
         1,
         SSL3_TXT_RSA_NULL_SHA,
         SSL3_CK_RSA_NULL_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
+        0,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* anon DH */
@@ -95,45 +103,65 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         SSL3_TXT_ADH_RC4_40_MD5,
         SSL3_CK_ADH_RC4_40_MD5,
-        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 18 */
         {
         1,
         SSL3_TXT_ADH_RC4_128_MD5,
         SSL3_CK_ADH_RC4_128_MD5,
-        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_NOT_EXP,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 19 */
         {
         1,
         SSL3_TXT_ADH_DES_40_CBC_SHA,
         SSL3_CK_ADH_DES_40_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 1A */
         {
         1,
         SSL3_TXT_ADH_DES_64_CBC_SHA,
         SSL3_CK_ADH_DES_64_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 1B */
         {
         1,
         SSL3_TXT_ADH_DES_192_CBC_SHA,
         SSL3_CK_ADH_DES_192_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* RSA again */
@@ -142,72 +170,104 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         SSL3_TXT_RSA_RC4_40_MD5,
         SSL3_CK_RSA_RC4_40_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 04 */
         {
         1,
         SSL3_TXT_RSA_RC4_128_MD5,
         SSL3_CK_RSA_RC4_128_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_MD5|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 05 */
         {
         1,
         SSL3_TXT_RSA_RC4_128_SHA,
         SSL3_CK_RSA_RC4_128_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_RC4  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 06 */
         {
         1,
         SSL3_TXT_RSA_RC2_40_MD5,
         SSL3_CK_RSA_RC2_40_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC2  |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_RC2  |SSL_MD5 |SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 07 */
         {
         1,
         SSL3_TXT_RSA_IDEA_128_SHA,
         SSL3_CK_RSA_IDEA_128_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
+        SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_MEDIUM,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 08 */
         {
         1,
         SSL3_TXT_RSA_DES_40_CBC_SHA,
         SSL3_CK_RSA_DES_40_CBC_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 09 */
         {
         1,
         SSL3_TXT_RSA_DES_64_CBC_SHA,
         SSL3_CK_RSA_DES_64_CBC_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kRSA|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0A */
         {
         1,
         SSL3_TXT_RSA_DES_192_CBC3_SHA,
         SSL3_CK_RSA_DES_192_CBC3_SHA,
-        SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /*  The DH ciphers */
@@ -216,54 +276,78 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
         SSL3_CK_DH_DSS_DES_40_CBC_SHA,
-        SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0C */
         {
         0,
         SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
         SSL3_CK_DH_DSS_DES_64_CBC_SHA,
-        SSL_kDHd |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kDHd |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0D */
         {
         0,
         SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
         SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
-        SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0E */
         {
         0,
         SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
         SSL3_CK_DH_RSA_DES_40_CBC_SHA,
-        SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 0F */
         {
         0,
         SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
         SSL3_CK_DH_RSA_DES_64_CBC_SHA,
-        SSL_kDHr |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kDHr |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 10 */
         {
         0,
         SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
         SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
-        SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* The Ephemeral DH ciphers */
@@ -272,54 +356,78 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
         SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
-        SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 12 */
         {
         1,
         SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
         SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
-        SSL_kEDH|SSL_aDSS|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kEDH|SSL_aDSS|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 13 */
         {
         1,
         SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
         SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
-        SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 14 */
         {
         1,
         SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
         SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
-        SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
+        SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
         0,
+        40,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 15 */
         {
         1,
         SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
         SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
-        SSL_kEDH|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
+        SSL_kEDH|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
         0,
+        56,
+        56,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 /* Cipher 16 */
         {
         1,
         SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
         SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
-        SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
+        SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
+        168,
+        168,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* Fortezza */
@@ -328,9 +436,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         SSL3_TXT_FZA_DMS_NULL_SHA,
         SSL3_CK_FZA_DMS_NULL_SHA,
-        SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
+        0,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* Cipher 1D */
@@ -338,9 +450,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         SSL3_TXT_FZA_DMS_FZA_SHA,
         SSL3_CK_FZA_DMS_FZA_SHA,
-        SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
+        0,
+        0,
         0,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 /* Cipher 1E */
@@ -348,9 +464,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         SSL3_TXT_FZA_DMS_RC4_SHA,
         SSL3_CK_FZA_DMS_RC4_SHA,
-        SSL_kFZA|SSL_aFZA |SSL_RC4  |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
+        SSL_kFZA|SSL_aFZA |SSL_RC4  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP,
         0,
+        128,
+        128,
         SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
         },
 
 #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
@@ -360,54 +480,78 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
             TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
-            SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_EXP56|SSL_TLSV1,
+            SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 61 */
             {
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
             TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
-            SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_EXP56|SSL_TLSV1,
+            SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 62 */
             {
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
             TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
-            SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_EXP56|SSL_TLSV1,
+            SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            56,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 63 */
             {
             1,
             TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
             TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
-            SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_EXP56|SSL_TLSV1,
+            SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            56,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 64 */
             {
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
             TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
-            SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_EXP56|SSL_TLSV1,
+            SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 65 */
             {
             1,
             TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
             TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
-            SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_EXP56|SSL_TLSV1,
+            SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_EXPORT|SSL_EXP56,
             0,
-            SSL_ALL_CIPHERS
+            56,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
         /* Cipher 66 */
             {
@@ -415,8 +559,12 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
             TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
             SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
             0,
-            SSL_ALL_CIPHERS
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS
             },
 #endif
 
@@ -460,6 +608,9 @@ static SSL_METHOD SSLv3_data= {
         ssl_bad_method,
         ssl3_default_timeout,
         &SSLv3_enc_data,
+        ssl_undefined_function,
+        ssl3_callback_ctrl,
+        ssl3_ctx_callback_ctrl,
         };
 
 static long ssl3_default_timeout(void)
@@ -495,19 +646,12 @@ int ssl3_pending(SSL *s)
 
 int ssl3_new(SSL *s)
         {
-        SSL3_CTX *s3;
+        SSL3_STATE *s3;
 
-        if ((s3=(SSL3_CTX *)Malloc(sizeof(SSL3_CTX))) == NULL) goto err;
-        memset(s3,0,sizeof(SSL3_CTX));
+        if ((s3=Malloc(sizeof *s3)) == NULL) goto err;
+        memset(s3,0,sizeof *s3);
 
         s->s3=s3;
-        /*
-        s->s3->tmp.ca_names=NULL;
-        s->s3->tmp.key_block=NULL;
-        s->s3->tmp.key_block_length=0;
-        s->s3->rbuf.buf=NULL;
-        s->s3->wbuf.buf=NULL;
-        */
 
         s->method->ssl_clear(s);
         return(1);
@@ -533,7 +677,7 @@ void ssl3_free(SSL *s)
 #endif
         if (s->s3->tmp.ca_names != NULL)
                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
-        memset(s->s3,0,sizeof(SSL3_CTX));
+        memset(s->s3,0,sizeof *s->s3);
         Free(s->s3);
         s->s3=NULL;
         }
@@ -551,11 +695,15 @@ void ssl3_clear(SSL *s)
                 Free(s->s3->rrec.comp);
                 s->s3->rrec.comp=NULL;
                 }
+#ifndef NO_DH
+        if (s->s3->tmp.dh != NULL)
+                DH_free(s->s3->tmp.dh);
+#endif
 
         rp=s->s3->rbuf.buf;
         wp=s->s3->wbuf.buf;
 
-        memset(s->s3,0,sizeof(SSL3_CTX));
+        memset(s->s3,0,sizeof *s->s3);
         if (rp != NULL) s->s3->rbuf.buf=rp;
         if (wp != NULL) s->s3->wbuf.buf=wp;
 
@@ -638,7 +786,10 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg)
                 }
                 break;
         case SSL_CTRL_SET_TMP_RSA_CB:
-                s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))parg;
+                {
+                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(ret);
+                }
                 break;
 #endif
 #ifndef NO_DH
@@ -665,7 +816,54 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg)
                 }
                 break;
         case SSL_CTRL_SET_TMP_DH_CB:
-                s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))parg;
+                {
+                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(ret);
+                }
+                break;
+#endif
+        default:
+                break;
+                }
+        return(ret);
+        }
+
+long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)())
+        {
+        int ret=0;
+
+#if !defined(NO_DSA) || !defined(NO_RSA)
+        if (
+#ifndef NO_RSA
+            cmd == SSL_CTRL_SET_TMP_RSA_CB ||
+#endif
+#ifndef NO_DSA
+            cmd == SSL_CTRL_SET_TMP_DH_CB ||
+#endif
+                0)
+                {
+                if (!ssl_cert_inst(&s->cert))
+                        {
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
+                        return(0);
+                        }
+                }
+#endif
+
+        switch (cmd)
+                {
+#ifndef NO_RSA
+        case SSL_CTRL_SET_TMP_RSA_CB:
+                {
+                s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+#ifndef NO_DH
+        case SSL_CTRL_SET_TMP_DH_CB:
+                {
+                s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
+                }
                 break;
 #endif
         default:
@@ -721,7 +919,10 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
                 }
                 /* break; */
         case SSL_CTRL_SET_TMP_RSA_CB:
-                cert->rsa_tmp_cb=(RSA *(*)(SSL *, int, int))parg;
+                {
+                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(0);
+                }
                 break;
 #endif
 #ifndef NO_DH
@@ -748,7 +949,10 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
                 }
                 /*break; */
         case SSL_CTRL_SET_TMP_DH_CB:
-                cert->dh_tmp_cb=(DH *(*)(SSL *, int, int))parg;
+                {
+                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(0);
+                }
                 break;
 #endif
         /* A Thawte special :-) */
@@ -767,6 +971,34 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
         return(1);
         }
 
+long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+        {
+        CERT *cert;
+
+        cert=ctx->cert;
+
+        switch (cmd)
+                {
+#ifndef NO_RSA
+        case SSL_CTRL_SET_TMP_RSA_CB:
+                {
+                cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+#ifndef NO_DH
+        case SSL_CTRL_SET_TMP_DH_CB:
+                {
+                cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+        default:
+                return(0);
+                }
+        return(1);
+        }
+
 /* This function needs to check if the ciphers required are actually
  * available */
 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
@@ -819,21 +1051,6 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
         return(2);
         }
 
-int ssl3_part_read(SSL *s, int i)
-        {
-        s->rwstate=SSL_READING;
-
-        if (i < 0)
-                {
-                return(i);
-                }
-        else
-                {
-                s->init_num+=i;
-                return(0);
-                }
-        }
-
 SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *have,
              STACK_OF(SSL_CIPHER) *pref)
         {
@@ -865,7 +1082,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *have,
                 emask=cert->export_mask;
                         
                 alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK);
-                if (SSL_IS_EXPORT(c->algorithms))
+                if (SSL_C_IS_EXPORT(c))
                         {
                         ok=((alg & emask) == alg)?1:0;
 #ifdef CIPHER_DEBUG
@@ -1034,8 +1251,12 @@ int ssl3_read(SSL *s, void *buf, int len)
         ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len);
         if ((ret == -1) && (s->s3->in_read_app_data == 0))
                 {
-                ERR_get_error(); /* clear the error */
-                s->s3->in_read_app_data=0;
+                /* ssl3_read_bytes decided to call s->handshake_func, which
+                 * called ssl3_read_bytes to read handshake data.
+                 * However, ssl3_read_bytes actually found application data
+                 * and thinks that application data makes sense here (signalled
+                 * by resetting 'in_read_app_data', strangely); so disable
+                 * handshake processing and try to read application data again. */
                 s->in_handshake++;
                 ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len);
                 s->in_handshake--;
@@ -1092,7 +1313,7 @@ int ssl3_renegotiate_check(SSL *s)
                         {
 /*
 if we are the server, and we have sent a 'RENEGOTIATE' message, we
-need to go to SSL_ST_ACCEPT.
+need to go to SSL_ST_ACCEPT.
 */
                         /* SSL_ST_ACCEPT */
                         s->state=SSL_ST_RENEGOTIATE;
diff --git a/src/lib/libssl/src/ssl/s3_pkt.c b/src/lib/libssl/src/ssl/s3_pkt.c
index 7893d03123..eb965310d9 100644
--- a/src/lib/libssl/src/ssl/s3_pkt.c
+++ b/src/lib/libssl/src/ssl/s3_pkt.c
@@ -55,6 +55,59 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
 #include <stdio.h>
 #include <errno.h>
@@ -71,104 +124,98 @@ static int ssl3_get_record(SSL *s);
 static int do_compress(SSL *ssl);
 static int do_uncompress(SSL *ssl);
 static int do_change_cipher_spec(SSL *ssl);
+
+/* used only by ssl3_get_record */
 static int ssl3_read_n(SSL *s, int n, int max, int extend)
         {
+        /* If extend == 0, obtain new n-byte packet; if extend == 1, increase
+         * packet by another n bytes.
+         * The packet will be in the sub-array of s->s3->rbuf.buf specified
+         * by s->packet and s->packet_length.
+         * (If s->read_ahead is set, 'max' bytes may be stored in rbuf
+         * [plus s->packet_length bytes if extend == 1].)
+         */
         int i,off,newb;
 
-        /* if there is stuff still in the buffer from a previous read,
-         * and there is more than we want, take some. */
+        if (!extend)
+                {
+                /* start with empty packet ... */
+                if (s->s3->rbuf.left == 0)
+                        s->s3->rbuf.offset = 0;
+                s->packet = s->s3->rbuf.buf + s->s3->rbuf.offset;
+                s->packet_length = 0;
+                /* ... now we can act as if 'extend' was set */
+                }
+
+        /* if there is enough in the buffer from a previous read, take some */
         if (s->s3->rbuf.left >= (int)n)
                 {
-                if (extend)
-                        s->packet_length+=n;
-                else
-                        {
-                        s->packet= &(s->s3->rbuf.buf[s->s3->rbuf.offset]);
-                        s->packet_length=n;
-                        }
+                s->packet_length+=n;
                 s->s3->rbuf.left-=n;
                 s->s3->rbuf.offset+=n;
                 return(n);
                 }
 
         /* else we need to read more data */
-        if (!s->read_ahead) max=n;
-        if (max > SSL3_RT_MAX_PACKET_SIZE)
-                max=SSL3_RT_MAX_PACKET_SIZE;
-
-        /* First check if there is some left or we want to extend */
-        off=0;
-        if (    (s->s3->rbuf.left != 0) ||
-                ((s->packet_length != 0) && extend))
-                {
-                newb=s->s3->rbuf.left;
-                if (extend)
-                        {
-                        /* Copy bytes back to the front of the buffer 
-                         * Take the bytes already pointed to by 'packet'
-                         * and take the extra ones on the end. */
-                        off=s->packet_length;
-                        if (s->packet != s->s3->rbuf.buf)
-                                memcpy(s->s3->rbuf.buf,s->packet,newb+off);
-                        }
-                else if (s->s3->rbuf.offset != 0)
-                        { /* so the data is not at the start of the buffer */
-                        memcpy(s->s3->rbuf.buf,
-                                &(s->s3->rbuf.buf[s->s3->rbuf.offset]),newb);
-                        s->s3->rbuf.offset=0;
-                        }
+        if (!s->read_ahead)
+                max=n;
 
-                s->s3->rbuf.left=0;
+        {
+                /* avoid buffer overflow */
+                int max_max = SSL3_RT_MAX_PACKET_SIZE - s->packet_length;
+                if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
+                        max_max += SSL3_RT_MAX_EXTRA;
+                if (max > max_max)
+                        max = max_max;
+        }
+        if (n > max) /* does not happen */
+                {
+                SSLerr(SSL_F_SSL3_READ_N,SSL_R_INTERNAL_ERROR);
+                return -1;
                 }
-        else
-                newb=0;
 
-        /* So we now have 'newb' bytes at the front of 
-         * s->s3->rbuf.buf and need to read some more in on the end
-         * We start reading into the buffer at 's->s3->rbuf.offset'
-         */
-        s->packet=s->s3->rbuf.buf;
+        off = s->packet_length;
+        newb = s->s3->rbuf.left;
+        /* Move any available bytes to front of buffer:
+         * 'off' bytes already pointed to by 'packet',
+         * 'newb' extra ones at the end */
+        if (s->packet != s->s3->rbuf.buf)
+                {
+                /*  off > 0 */
+                memmove(s->s3->rbuf.buf, s->packet, off+newb);
+                s->packet = s->s3->rbuf.buf;
+                }
 
         while (newb < n)
                 {
+                /* Now we have off+newb bytes at the front of s->s3->rbuf.buf and need
+                 * to read in more until we have off+n (up to off+max if possible) */
+
                 clear_sys_error();
                 if (s->rbio != NULL)
                         {
                         s->rwstate=SSL_READING;
-                        i=BIO_read(s->rbio,
-                                (char *)&(s->s3->rbuf.buf[off+newb]),
-                                max-newb);
+                        i=BIO_read(s->rbio,     &(s->s3->rbuf.buf[off+newb]), max-newb);
                         }
                 else
                         {
                         SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET);
-                        i= -1;
+                        i = -1;
                         }
 
                 if (i <= 0)
                         {
-                        s->s3->rbuf.left+=newb;
+                        s->s3->rbuf.left = newb;
                         return(i);
                         }
                 newb+=i;
                 }
 
-        /* record used data read */
-        if (newb > n)
-                {
-                s->s3->rbuf.offset=n+off;
-                s->s3->rbuf.left=newb-n;
-                }
-        else
-                {
-                s->s3->rbuf.offset=0;
-                s->s3->rbuf.left=0;
-                }
-
-        if (extend)
-                s->packet_length+=n;
-        else
-                s->packet_length+=n;
+        /* done reading, now the book-keeping */
+        s->s3->rbuf.offset = off + n;
+        s->s3->rbuf.left = newb - n;
+        s->packet_length += n;
+        s->rwstate=SSL_NOTHING;
         return(n);
         }
 
@@ -176,15 +223,15 @@ static int ssl3_read_n(SSL *s, int n, int max, int extend)
  * It will return <= 0 if more data is needed, normally due to an error
  * or non-blocking IO.
  * When it finishes, one packet has been decoded and can be found in
- * ssl->s3->rrec.type   - is the type of record
- * ssl->s3->rrec.data,  - data
+ * ssl->s3->rrec.type    - is the type of record
+ * ssl->s3->rrec.data,   - data
  * ssl->s3->rrec.length, - number of bytes
  */
+/* used only by ssl3_read_bytes */
 static int ssl3_get_record(SSL *s)
         {
         int ssl_major,ssl_minor,al;
         int n,i,ret= -1;
-        SSL3_BUFFER *rb;
         SSL3_RECORD *rr;
         SSL_SESSION *sess;
         unsigned char *p;
@@ -194,7 +241,6 @@ static int ssl3_get_record(SSL *s)
         int clear=0,extra;
 
         rr= &(s->s3->rrec);
-        rb= &(s->s3->rbuf);
         sess=s->session;
 
         if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
@@ -253,27 +299,26 @@ again:
                         goto f_err;
                         }
 
-                s->rstate=SSL_ST_READ_BODY;
+                /* now s->rstate == SSL_ST_READ_BODY */
                 }
 
-        /* get and decode the data */
-        if (s->rstate == SSL_ST_READ_BODY)
+        /* s->rstate == SSL_ST_READ_BODY, get and decode the data */
+
+        if (rr->length > (s->packet_length-SSL3_RT_HEADER_LENGTH))
                 {
-                if (rr->length > (s->packet_length-SSL3_RT_HEADER_LENGTH))
-                        {
-                        i=rr->length;
-                        /*-(s->packet_length-SSL3_RT_HEADER_LENGTH); */
-                        n=ssl3_read_n(s,i,i,1);
-                        if (n <= 0) return(n); /* error or non-blocking io */
-                        }
-                s->rstate=SSL_ST_READ_HEADER;
+                /* now s->packet_length == SSL3_RT_HEADER_LENGTH */
+                i=rr->length;
+                n=ssl3_read_n(s,i,i,1);
+                if (n <= 0) return(n); /* error or non-blocking io */
+                /* now n == rr->length,
+                 * and s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length */
                 }
 
-        /* At this point, we have the data in s->packet and there should be
-         * s->packet_length bytes, we must not 'overrun' this buffer :-)
-         * One of the following functions will copy the data from the
-         * s->packet buffer */
+        s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */
 
+        /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
+         * and we have that many bytes in s->packet
+         */
         rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);
 
         /* ok, we can now read from 's->packet' data into 'rr'
@@ -283,13 +328,10 @@ again:
          * When the data is 'copied' into the rr->data buffer,
          * rr->input will be pointed at the new buffer */ 
 
-        /* Set the state for the following operations */
-        s->rstate=SSL_ST_READ_HEADER;
-
         /* We now have - encrypted [ MAC [ compressed [ plain ] ] ]
          * rr->length bytes of encrypted compressed stuff. */
 
-        /* check is not needed I belive */
+        /* check is not needed I believe */
         if (rr->length > (unsigned int)SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)
                 {
                 al=SSL_AD_RECORD_OVERFLOW;
@@ -326,7 +368,7 @@ printf("\n");
                         SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
                         goto f_err;
                         }
-                /* check MAC for rr->input' */
+                /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
                 if (rr->length < mac_size)
                         {
                         al=SSL_AD_DECODE_ERROR;
@@ -426,12 +468,12 @@ static int do_compress(SSL *ssl)
         return(1);
         }
 
-/* Call this to write data
+/* Call this to write data in records of type 'type'
  * It will return <= 0 if not all data has been sent or non-blocking IO.
  */
-int ssl3_write_bytes(SSL *s, int type, const void *_buf, int len)
+int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
         {
-        const unsigned char *buf=_buf;
+        const unsigned char *buf=buf_;
         unsigned int tot,n,nw;
         int i;
 
@@ -457,7 +499,7 @@ int ssl3_write_bytes(SSL *s, int type, const void *_buf, int len)
                         nw=SSL3_RT_MAX_PLAIN_LENGTH;
                 else
                         nw=n;
-                        
+
                 i=do_ssl3_write(s,type,&(buf[tot]),nw);
                 if (i <= 0)
                         {
@@ -465,9 +507,6 @@ int ssl3_write_bytes(SSL *s, int type, const void *_buf, int len)
                         return(i);
                         }
 
-                if (type == SSL3_RT_HANDSHAKE)
-                        ssl3_finish_mac(s,&(buf[tot]),i);
-
                 if ((i == (int)n) ||
                         (type == SSL3_RT_APPLICATION_DATA &&
                          (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)))
@@ -503,8 +542,8 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                 /* if it went, fall through and send more stuff */
                 }
 
-        if (len <= 0) return(len);
-        
+        if (len == 0) return(len);
+
         wr= &(s->s3->wrec);
         wb= &(s->s3->wbuf);
         sess=s->session;
@@ -527,11 +566,11 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
 
         *(p++)=(s->version>>8);
         *(p++)=s->version&0xff;
-        
+
         /* record where we are to write out packet length */
         plen=p; 
         p+=2;
-        
+
         /* lets setup the record stuff. */
         wr->data=p;
         wr->length=(int)len;
@@ -638,19 +677,75 @@ static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
                 }
         }
 
+/* Return up to 'len' payload bytes received in 'type' records.
+ * 'type' is one of the following:
+ *
+ *   -  SSL3_RT_HANDSHAKE (when ssl3_get_message calls us)
+ *   -  SSL3_RT_APPLICATION_DATA (when ssl3_read calls us)
+ *   -  0 (during a shutdown, no data has to be returned)
+ *
+ * If we don't have stored data to work from, read a SSL/TLS record first
+ * (possibly multiple records if we still don't have anything to return).
+ *
+ * This function must handle any surprises the peer may have for us, such as
+ * Alert records (e.g. close_notify), ChangeCipherSpec records (not really
+ * a surprise, but handled as if it were), or renegotiation requests.
+ * Also if record payloads contain fragments too small to process, we store
+ * them until there is enough for the respective protocol (the record protocol
+ * may use arbitrary fragmentation and even interleaving):
+ *     Change cipher spec protocol
+ *             just 1 byte needed, no need for keeping anything stored
+ *     Alert protocol
+ *             2 bytes needed (AlertLevel, AlertDescription)
+ *     Handshake protocol
+ *             4 bytes needed (HandshakeType, uint24 length) -- we just have
+ *             to detect unexpected Client Hello and Hello Request messages
+ *             here, anything else is handled by higher layers
+ *     Application data protocol
+ *             none of our business
+ */
 int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len)
         {
-        int al,i,j,n,ret;
+        int al,i,j,ret;
+        unsigned int n;
         SSL3_RECORD *rr;
         void (*cb)()=NULL;
-        BIO *bio;
 
-        if (s->s3->rbuf.buf == NULL) /* Not initialize yet */
+        if (s->s3->rbuf.buf == NULL) /* Not initialized yet */
                 if (!ssl3_setup_buffers(s))
                         return(-1);
 
+        if ((type != SSL3_RT_APPLICATION_DATA) && (type != SSL3_RT_HANDSHAKE) && type)
+                {
+                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_INTERNAL_ERROR);
+                return -1;
+                }
+
+        if ((type == SSL3_RT_HANDSHAKE) && (s->s3->handshake_fragment_len > 0))
+                /* (partially) satisfy request from storage */
+                {
+                unsigned char *src = s->s3->handshake_fragment;
+                unsigned char *dst = buf;
+                unsigned int k;
+
+                n = 0;
+                while ((len > 0) && (s->s3->handshake_fragment_len > 0))
+                        {
+                        *dst++ = *src++;
+                        len--; s->s3->handshake_fragment_len--;
+                        n++;
+                        }
+                /* move any remaining fragment bytes: */
+                for (k = 0; k < s->s3->handshake_fragment_len; k++)
+                        s->s3->handshake_fragment[k] = *src++;
+                return n;
+        }
+
+        /* Now s->s3->handshake_fragment_len == 0 if type == SSL3_RT_HANDSHAKE. */
+
         if (!s->in_handshake && SSL_in_init(s))
                 {
+                /* type == SSL3_RT_APPLICATION_DATA */
                 i=s->handshake_func(s);
                 if (i < 0) return(i);
                 if (i == 0)
@@ -662,11 +757,11 @@ int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len)
 start:
         s->rwstate=SSL_NOTHING;
 
-        /* s->s3->rrec.type     - is the type of record
-         * s->s3->rrec.data,    - data
-         * s->s3->rrec.off,     - ofset into 'data' for next read
-         * s->s3->rrec.length,  - number of bytes. */
-        rr= &(s->s3->rrec);
+        /* s->s3->rrec.type         - is the type of record
+         * s->s3->rrec.data,    - data
+         * s->s3->rrec.off,     - offset into 'data' for next read
+         * s->s3->rrec.length,  - number of bytes. */
+        rr = &(s->s3->rrec);
 
         /* get new packet */
         if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY))
@@ -677,7 +772,9 @@ start:
 
         /* we now have a packet which can be read and processed */
 
-        if (s->s3->change_cipher_spec && (rr->type != SSL3_RT_HANDSHAKE))
+        if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,
+                                       * reset by ssl3_get_finished */
+                && (rr->type != SSL3_RT_HANDSHAKE))
                 {
                 al=SSL_AD_UNEXPECTED_MESSAGE;
                 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
@@ -692,16 +789,98 @@ start:
                 return(0);
                 }
 
-        /* Check for an incoming 'Client Request' message */
-        if ((rr->type == SSL3_RT_HANDSHAKE) && (rr->length == 4) &&
-                (rr->data[0] == SSL3_MT_CLIENT_REQUEST) &&
+
+        if (type == rr->type) /* SSL3_RT_APPLICATION_DATA or SSL3_RT_HANDSHAKE */
+                {
+                /* make sure that we are not getting application data when we
+                 * are doing a handshake for the first time */
+                if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
+                        (s->enc_read_ctx == NULL))
+                        {
+                        al=SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);
+                        goto f_err;
+                        }
+
+                if (len <= 0) return(len);
+
+                if ((unsigned int)len > rr->length)
+                        n = rr->length;
+                else
+                        n = (unsigned int)len;
+
+                memcpy(buf,&(rr->data[rr->off]),n);
+                rr->length-=n;
+                rr->off+=n;
+                if (rr->length == 0)
+                        {
+                        s->rstate=SSL_ST_READ_HEADER;
+                        rr->off=0;
+                        }
+                return(n);
+                }
+
+
+        /* If we get here, then type != rr->type; if we have a handshake
+         * message, then it was unexpected (Hello Request or Client Hello). */
+
+        /* In case of record types for which we have 'fragment' storage,
+         * fill that so that we can process the data at a fixed place.
+         */
+                {
+                unsigned int dest_maxlen = 0;
+                unsigned char *dest = NULL;
+                unsigned int *dest_len = NULL;
+
+                if (rr->type == SSL3_RT_HANDSHAKE)
+                        {
+                        dest_maxlen = sizeof s->s3->handshake_fragment;
+                        dest = s->s3->handshake_fragment;
+                        dest_len = &s->s3->handshake_fragment_len;
+                        }
+                else if (rr->type == SSL3_RT_ALERT)
+                        {
+                        dest_maxlen = sizeof s->s3->alert_fragment;
+                        dest = s->s3->alert_fragment;
+                        dest_len = &s->s3->alert_fragment_len;
+                        }
+
+                if (dest_maxlen > 0)
+                        {
+                        n = dest_maxlen - *dest_len; /* available space in 'dest' */
+                        if (rr->length < n)
+                                n = rr->length; /* available bytes */
+
+                        /* now move 'n' bytes: */
+                        while (n-- > 0)
+                                {
+                                dest[(*dest_len)++] = rr->data[rr->off++];
+                                rr->length--;
+                                }
+
+                        if (*dest_len < dest_maxlen)
+                                goto start; /* fragment was too small */
+                        }
+                }
+
+        /* s->s3->handshake_fragment_len == 4  iff  rr->type == SSL3_RT_HANDSHAKE;
+         * s->s3->alert_fragment_len == 2      iff  rr->type == SSL3_RT_ALERT.
+         * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */
+
+        /* If we are a client, check for an incoming 'Hello Request': */
+        if ((!s->server) &&
+                (s->s3->handshake_fragment_len >= 4) &&
+                (s->s3->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&
                 (s->session != NULL) && (s->session->cipher != NULL))
                 {
-                if ((rr->data[1] != 0) || (rr->data[2] != 0) ||
-                        (rr->data[3] != 0))
+                s->s3->handshake_fragment_len = 0;
+
+                if ((s->s3->handshake_fragment[1] != 0) ||
+                        (s->s3->handshake_fragment[2] != 0) ||
+                        (s->s3->handshake_fragment[3] != 0))
                         {
                         al=SSL_AD_DECODE_ERROR;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CLIENT_REQUEST);
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_HELLO_REQUEST);
                         goto err;
                         }
 
@@ -712,220 +891,209 @@ start:
                         ssl3_renegotiate(s);
                         if (ssl3_renegotiate_check(s))
                                 {
-                                n=s->handshake_func(s);
-                                if (n < 0) return(n);
-                                if (n == 0)
+                                i=s->handshake_func(s);
+                                if (i < 0) return(i);
+                                if (i == 0)
                                         {
                                         SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
                                         return(-1);
                                         }
+
+                                if (s->s3->rbuf.left == 0) /* no read-ahead left? */
+                                        {
+                                        BIO *bio;
+                                        /* In the case where we try to read application data
+                                         * the first time, but we trigger an SSL handshake, we
+                                         * return -1 with the retry option set.  I do this
+                                         * otherwise renegotiation can cause nasty problems 
+                                         * in the blocking world */ /* ? */
+                                        s->rwstate=SSL_READING;
+                                        bio=SSL_get_rbio(s);
+                                        BIO_clear_retry_flags(bio);
+                                        BIO_set_retry_read(bio);
+                                        return(-1);
+                                        }
                                 }
                         }
-                rr->length=0;
-/* ZZZ */       goto start;
+                /* we either finished a handshake or ignored the request,
+                 * now try again to obtain the (application) data we were asked for */
+                goto start;
                 }
 
-        /* if it is not the type we want, or we have shutdown and want
-         * the peer shutdown */
-        if ((rr->type != type) || (s->shutdown & SSL_SENT_SHUTDOWN))
+        if (s->s3->alert_fragment_len >= 2)
                 {
-                if (rr->type == SSL3_RT_ALERT)
-                        {
-                        if ((rr->length != 2) || (rr->off != 0))
-                                {
-                                al=SSL_AD_DECODE_ERROR;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_ALERT_RECORD);
-                                goto f_err;
-                                }
+                int alert_level = s->s3->alert_fragment[0];
+                int alert_descr = s->s3->alert_fragment[1];
 
-                        i=rr->data[0];
-                        n=rr->data[1];
+                s->s3->alert_fragment_len = 0;
 
-                        /* clear from buffer */
-                        rr->length=0;
-
-                        if (s->info_callback != NULL)
-                                cb=s->info_callback;
-                        else if (s->ctx->info_callback != NULL)
-                                cb=s->ctx->info_callback;
+                if (s->info_callback != NULL)
+                        cb=s->info_callback;
+                else if (s->ctx->info_callback != NULL)
+                        cb=s->ctx->info_callback;
 
-                        if (cb != NULL)
-                                {
-                                j=(i<<8)|n;
-                                cb(s,SSL_CB_READ_ALERT,j);
-                                }
+                if (cb != NULL)
+                        {
+                        j = (alert_level << 8) | alert_descr;
+                        cb(s, SSL_CB_READ_ALERT, j);
+                        }
 
-                        if (i == 1)
-                                {
-                                s->s3->warn_alert=n;
-                                if (n == SSL_AD_CLOSE_NOTIFY)
-                                        {
-                                        s->shutdown|=SSL_RECEIVED_SHUTDOWN;
-                                        return(0);
-                                        }
-                                }
-                        else if (i == 2)
+                if (alert_level == 1) /* warning */
+                        {
+                        s->s3->warn_alert = alert_descr;
+                        if (alert_descr == SSL_AD_CLOSE_NOTIFY)
                                 {
-                                char tmp[16];
-
-                                s->rwstate=SSL_NOTHING;
-                                s->s3->fatal_alert=n;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,
-                                        SSL_AD_REASON_OFFSET+n);
-                                sprintf(tmp,"%d",n);
-                                ERR_add_error_data(2,"SSL alert number ",tmp);
-                                s->shutdown|=SSL_RECEIVED_SHUTDOWN;
-                                SSL_CTX_remove_session(s->ctx,s->session);
+                                s->shutdown |= SSL_RECEIVED_SHUTDOWN;
                                 return(0);
                                 }
-                        else
-                                {
-                                al=SSL_AD_ILLEGAL_PARAMETER;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);
-                                goto f_err;
-                                }
-
-                        rr->length=0;
-                        goto start;
                         }
-
-                if (s->shutdown & SSL_SENT_SHUTDOWN)
+                else if (alert_level == 2) /* fatal */
                         {
+                        char tmp[16];
+
                         s->rwstate=SSL_NOTHING;
-                        rr->length=0;
+                        s->s3->fatal_alert = alert_descr;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
+                        sprintf(tmp,"%d",alert_descr);
+                        ERR_add_error_data(2,"SSL alert number ",tmp);
+                        s->shutdown|=SSL_RECEIVED_SHUTDOWN;
+                        SSL_CTX_remove_session(s->ctx,s->session);
                         return(0);
                         }
-
-                if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
+                else
                         {
-                        if (    (rr->length != 1) || (rr->off != 0) ||
-                                (rr->data[0] != SSL3_MT_CCS))
-                                {
-                                i=SSL_AD_ILLEGAL_PARAMETER;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
-                                goto err;
-                                }
+                        al=SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);
+                        goto f_err;
+                        }
 
-                        rr->length=0;
-                        s->s3->change_cipher_spec=1;
-                        if (!do_change_cipher_spec(s))
-                                goto err;
-                        else
-                                goto start;
+                goto start;
+                }
+
+        if (s->shutdown & SSL_SENT_SHUTDOWN) /* but we have not received a shutdown */
+                {
+                s->rwstate=SSL_NOTHING;
+                rr->length=0;
+                return(0);
+                }
+
+        if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
+                {
+                /* 'Change Cipher Spec' is just a single byte, so we know
+                 * exactly what the record payload has to look like */
+                if (    (rr->length != 1) || (rr->off != 0) ||
+                        (rr->data[0] != SSL3_MT_CCS))
+                        {
+                        i=SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
+                        goto err;
                         }
 
-                /* else we have a handshake */
-                if ((rr->type == SSL3_RT_HANDSHAKE) &&
-                        !s->in_handshake)
+                rr->length=0;
+                s->s3->change_cipher_spec=1;
+                if (!do_change_cipher_spec(s))
+                        goto err;
+                else
+                        goto start;
+                }
+
+        /* Unexpected handshake message (Client Hello, or protocol violation) */
+        if ((s->s3->handshake_fragment_len >= 4) &&     !s->in_handshake)
+                {
+                if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
+                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))
                         {
-                        if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
-                                !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))
-                                {
-                                s->state=SSL_ST_BEFORE|(s->server)
-                                                ?SSL_ST_ACCEPT
-                                                :SSL_ST_CONNECT;
-                                s->new_session=1;
-                                }
-                        n=s->handshake_func(s);
-                        if (n < 0) return(n);
-                        if (n == 0)
-                                {
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
-                                return(-1);
-                                }
+#if 0 /* worked only because C operator preferences are not as expected (and
+       * because this is not really needed for clients except for detecting
+       * protocol violations): */
+                        s->state=SSL_ST_BEFORE|(s->server)
+                                ?SSL_ST_ACCEPT
+                                :SSL_ST_CONNECT;
+#else
+                        s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
+#endif
+                        s->new_session=1;
+                        }
+                i=s->handshake_func(s);
+                if (i < 0) return(i);
+                if (i == 0)
+                        {
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return(-1);
+                        }
 
+                if (s->s3->rbuf.left == 0) /* no read-ahead left? */
+                        {
+                        BIO *bio;
                         /* In the case where we try to read application data
                          * the first time, but we trigger an SSL handshake, we
                          * return -1 with the retry option set.  I do this
                          * otherwise renegotiation can cause nasty problems 
-                         * in the non-blocking world */
-
+                         * in the blocking world */ /* ? */
                         s->rwstate=SSL_READING;
                         bio=SSL_get_rbio(s);
                         BIO_clear_retry_flags(bio);
                         BIO_set_retry_read(bio);
                         return(-1);
                         }
+                goto start;
+                }
 
-                switch (rr->type)
-                        {
-                default:
+        switch (rr->type)
+                {
+        default:
 #ifndef NO_TLS
-                        /* TLS just ignores unknown message types */
-                        if (s->version == TLS1_VERSION)
-                                {
-                                goto start;
-                                }
+                /* TLS just ignores unknown message types */
+                if (s->version == TLS1_VERSION)
+                        {
+                        goto start;
+                        }
 #endif
-                case SSL3_RT_CHANGE_CIPHER_SPEC:
-                case SSL3_RT_ALERT:
-                case SSL3_RT_HANDSHAKE:
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                goto f_err;
+        case SSL3_RT_CHANGE_CIPHER_SPEC:
+        case SSL3_RT_ALERT:
+        case SSL3_RT_HANDSHAKE:
+                /* we already handled all of these, with the possible exception
+                 * of SSL3_RT_HANDSHAKE when s->in_handshake is set, but that
+                 * should not happen when type != rr->type */
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_INTERNAL_ERROR);
+                goto f_err;
+        case SSL3_RT_APPLICATION_DATA:
+                /* At this point, we were expecting handshake data,
+                 * but have application data.  If the library was
+                 * running inside ssl3_read() (i.e. in_read_app_data
+                 * is set) and it makes sense to read application data
+                 * at this point (session renegotiation not yet started),
+                 * we will indulge it.
+                 */
+                if (s->s3->in_read_app_data &&
+                        (s->s3->total_renegotiations != 0) &&
+                        ((
+                                (s->state & SSL_ST_CONNECT) &&
+                                (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
+                                (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
+                                ) || (
+                                        (s->state & SSL_ST_ACCEPT) &&
+                                        (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
+                                        (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
+                                        )
+                                ))
+                        {
+                        s->s3->in_read_app_data=0;
+                        return(-1);
+                        }
+                else
+                        {
                         al=SSL_AD_UNEXPECTED_MESSAGE;
                         SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
                         goto f_err;
-                case SSL3_RT_APPLICATION_DATA:
-                        /* At this point, we were expecting something else,
-                         * but have application data.  What we do is set the
-                         * error, and return -1.  On the way out, if the
-                         * library was running inside ssl3_read() and it makes
-                         * sense to read application data at this point, we
-                         * will indulge it.  This will mostly happen during
-                         * session renegotiation.
-                         */
-                        if (s->s3->in_read_app_data &&
-                                (s->s3->total_renegotiations != 0) &&
-                                ((
-                                  (s->state & SSL_ST_CONNECT) &&
-                                  (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
-                                  (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
-                                 ) || (
-                                  (s->state & SSL_ST_ACCEPT) &&
-                                  (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
-                                  (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
-                                 )
-                                ))
-                                {
-                                s->s3->in_read_app_data=0;
-                                return(-1);
-                                }
-                        else
-                                {
-                                al=SSL_AD_UNEXPECTED_MESSAGE;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
-                                goto f_err;
-                                }
                         }
                 }
+        /* not reached */
 
-        /* make sure that we are not getting application data when we
-         * are doing a handshake for the first time */
-        if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
-                (s->enc_read_ctx == NULL))
-                {
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);
-                goto f_err;
-                }
-
-        if (len <= 0) return(len);
-
-        if ((unsigned int)len > rr->length)
-                n=rr->length;
-        else
-                n=len;
-
-        memcpy(buf,&(rr->data[rr->off]),(unsigned int)n);
-        rr->length-=n;
-        rr->off+=n;
-        if (rr->length <= 0)
-                {
-                s->rstate=SSL_ST_READ_HEADER;
-                rr->off=0;
-                }
-
-        if (type == SSL3_RT_HANDSHAKE)
-                ssl3_finish_mac(s,buf,n);
-        return(n);
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 err:
@@ -935,7 +1103,7 @@ err:
 static int do_change_cipher_spec(SSL *s)
         {
         int i;
-        unsigned char *sender;
+        const char *sender;
         int slen;
 
         if (s->state & SSL_ST_ACCEPT)
@@ -957,37 +1125,23 @@ static int do_change_cipher_spec(SSL *s)
          * the finished message */
         if (s->state & SSL_ST_CONNECT)
                 {
-                sender=s->method->ssl3_enc->server_finished;
-                slen=s->method->ssl3_enc->server_finished_len;
+                sender=s->method->ssl3_enc->server_finished_label;
+                slen=s->method->ssl3_enc->server_finished_label_len;
                 }
         else
                 {
-                sender=s->method->ssl3_enc->client_finished;
-                slen=s->method->ssl3_enc->client_finished_len;
+                sender=s->method->ssl3_enc->client_finished_label;
+                slen=s->method->ssl3_enc->client_finished_label_len;
                 }
 
-        s->method->ssl3_enc->final_finish_mac(s,
+        s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
                 &(s->s3->finish_dgst1),
                 &(s->s3->finish_dgst2),
-                sender,slen,&(s->s3->tmp.finish_md[0]));
+                sender,slen,s->s3->tmp.peer_finish_md);
 
         return(1);
         }
 
-int ssl3_do_write(SSL *s, int type)
-        {
-        int ret;
-
-        ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
-                             s->init_num);
-        if (ret == s->init_num)
-                return(1);
-        if (ret < 0) return(-1);
-        s->init_off+=ret;
-        s->init_num-=ret;
-        return(0);
-        }
-
 void ssl3_send_alert(SSL *s, int level, int desc)
         {
         /* Map tls/ssl alert value to correct one */
@@ -1029,7 +1183,7 @@ int ssl3_dispatch_alert(SSL *s)
                         cb=s->info_callback;
                 else if (s->ctx->info_callback != NULL)
                         cb=s->ctx->info_callback;
-                
+
                 if (cb != NULL)
                         {
                         j=(s->s3->send_alert[0]<<8)|s->s3->send_alert[1];
@@ -1038,4 +1192,3 @@ int ssl3_dispatch_alert(SSL *s)
                 }
         return(i);
         }
-
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index e003d88357..90806e2d99 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -57,6 +57,8 @@
  */
 
 #define REUSE_CIPHER_BUG
+#define NETSCAPE_HANG_BUG
+
 
 #include <stdio.h>
 #include <openssl/buffer.h>
@@ -70,13 +72,14 @@
 
 static SSL_METHOD *ssl3_get_server_method(int ver);
 static int ssl3_get_client_hello(SSL *s);
+static int ssl3_check_client_hello(SSL *s);
 static int ssl3_send_server_hello(SSL *s);
 static int ssl3_send_server_key_exchange(SSL *s);
 static int ssl3_send_certificate_request(SSL *s);
 static int ssl3_send_server_done(SSL *s);
-static int ssl3_get_cert_verify(SSL *s);
 static int ssl3_get_client_key_exchange(SSL *s);
 static int ssl3_get_client_certificate(SSL *s);
+static int ssl3_get_cert_verify(SSL *s);
 static int ssl3_send_hello_request(SSL *s);
 
 static SSL_METHOD *ssl3_get_server_method(int ver)
@@ -112,7 +115,7 @@ int ssl3_accept(SSL *s)
         int ret= -1;
         int new_state,state,skip=0;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -151,7 +154,6 @@ int ssl3_accept(SSL *s)
 
                         if ((s->version>>8) != 3)
                                 abort();
-                        /* s->version=SSL3_VERSION; */
                         s->type=SSL_ST_ACCEPT;
 
                         if (s->init_buf == NULL)
@@ -184,8 +186,8 @@ int ssl3_accept(SSL *s)
 
                         if (s->state != SSL_ST_RENEGOTIATE)
                                 {
-                                s->state=SSL3_ST_SR_CLNT_HELLO_A;
                                 ssl3_init_finished_mac(s);
+                                s->state=SSL3_ST_SR_CLNT_HELLO_A;
                                 s->ctx->stats.sess_accept++;
                                 }
                         else
@@ -268,8 +270,8 @@ int ssl3_accept(SSL *s)
                             || (l & (SSL_DH|SSL_kFZA))
                             || ((l & SSL_kRSA)
                                 && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
-                                    || (SSL_IS_EXPORT(l)
-                                        && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_EXPORT_PKEYLENGTH(l)
+                                    || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)
+                                        && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)
                                         )
                                     )
                                 )
@@ -287,9 +289,19 @@ int ssl3_accept(SSL *s)
 
                 case SSL3_ST_SW_CERT_REQ_A:
                 case SSL3_ST_SW_CERT_REQ_B:
-                        if (!(s->verify_mode & SSL_VERIFY_PEER) ||
+                        if (/* don't request cert unless asked for it: */
+                                !(s->verify_mode & SSL_VERIFY_PEER) ||
+                                /* if SSL_VERIFY_CLIENT_ONCE is set,
+                                 * don't request cert during re-negotiation: */
                                 ((s->session->peer != NULL) &&
-                                 (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)))
+                                 (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
+                                /* never request cert in anonymous ciphersuites
+                                 * (see section "Certificate request" in SSL 3 drafts
+                                 * and in RFC 2246): */
+                                ((s->s3->tmp.new_cipher->algorithms & SSL_aNULL) &&
+                                 /* ... except when the application insists on verification
+                                  * (against the specs, but s3_clnt.c accepts this for SSL 3) */
+                                 !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))
                                 {
                                 /* no cert request */
                                 skip=1;
@@ -301,7 +313,12 @@ int ssl3_accept(SSL *s)
                                 s->s3->tmp.cert_request=1;
                                 ret=ssl3_send_certificate_request(s);
                                 if (ret <= 0) goto end;
+#ifndef NETSCAPE_HANG_BUG
                                 s->state=SSL3_ST_SW_SRVR_DONE_A;
+#else
+                                s->state=SSL3_ST_SW_FLUSH;
+                                s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
+#endif
                                 s->init_num=0;
                                 }
                         break;
@@ -331,12 +348,20 @@ int ssl3_accept(SSL *s)
 
                 case SSL3_ST_SR_CERT_A:
                 case SSL3_ST_SR_CERT_B:
-                        /* could be sent for a DH cert, even if we
-                         * have not asked for it :-) */
-                        ret=ssl3_get_client_certificate(s);
-                        if (ret <= 0) goto end;
-                        s->init_num=0;
-                        s->state=SSL3_ST_SR_KEY_EXCH_A;
+                        /* Check for second client hello (MS SGC) */
+                        ret = ssl3_check_client_hello(s);
+                        if (ret <= 0)
+                                goto end;
+                        if (ret == 2)
+                                s->state = SSL3_ST_SR_CLNT_HELLO_C;
+                        else {
+                                /* could be sent for a DH cert, even if we
+                                 * have not asked for it :-) */
+                                ret=ssl3_get_client_certificate(s);
+                                if (ret <= 0) goto end;
+                                s->init_num=0;
+                                s->state=SSL3_ST_SR_KEY_EXCH_A;
+                        }
                         break;
 
                 case SSL3_ST_SR_KEY_EXCH_A:
@@ -350,10 +375,10 @@ int ssl3_accept(SSL *s)
                          * a client cert, it can be verified */ 
                         s->method->ssl3_enc->cert_verify_mac(s,
                                 &(s->s3->finish_dgst1),
-                                &(s->s3->tmp.finish_md[0]));
+                                &(s->s3->tmp.cert_verify_md[0]));
                         s->method->ssl3_enc->cert_verify_mac(s,
                                 &(s->s3->finish_dgst2),
-                                &(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]));
+                                &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
 
                         break;
 
@@ -407,8 +432,8 @@ int ssl3_accept(SSL *s)
                 case SSL3_ST_SW_FINISHED_B:
                         ret=ssl3_send_finished(s,
                                 SSL3_ST_SW_FINISHED_A,SSL3_ST_SW_FINISHED_B,
-                                s->method->ssl3_enc->server_finished,
-                                s->method->ssl3_enc->server_finished_len);
+                                s->method->ssl3_enc->server_finished_label,
+                                s->method->ssl3_enc->server_finished_label_len);
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_SW_FLUSH;
                         if (s->hit)
@@ -485,7 +510,7 @@ static int ssl3_send_hello_request(SSL *s)
         if (s->state == SSL3_ST_SW_HELLO_REQ_A)
                 {
                 p=(unsigned char *)s->init_buf->data;
-                *(p++)=SSL3_MT_CLIENT_REQUEST;
+                *(p++)=SSL3_MT_HELLO_REQUEST;
                 *(p++)=0;
                 *(p++)=0;
                 *(p++)=0;
@@ -500,6 +525,37 @@ static int ssl3_send_hello_request(SSL *s)
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
 
+static int ssl3_check_client_hello(SSL *s)
+        {
+        int ok;
+        long n;
+
+        n=ssl3_get_message(s,
+                SSL3_ST_SR_CERT_A,
+                SSL3_ST_SR_CERT_B,
+                -1,
+                SSL3_RT_MAX_PLAIN_LENGTH,
+                &ok);
+        if (!ok) return((int)n);
+        s->s3->tmp.reuse_message = 1;
+        if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
+                {
+                /* Throw away what we have done so far in the current handshake,
+                 * which will now be aborted. (A full SSL_clear would be too much.)
+                 * I hope that tmp.dh is the only thing that may need to be cleared
+                 * when a handshake is not completed ... */
+#ifndef NO_DH
+                if (s->s3->tmp.dh != NULL)
+                        {
+                        DH_free(s->s3->tmp.dh);
+                        s->s3->tmp.dh = NULL;
+                        }
+#endif
+                return 2;
+                }
+        return 1;
+}
+
 static int ssl3_get_client_hello(SSL *s)
         {
         int i,j,ok,al,ret= -1;
@@ -531,10 +587,9 @@ static int ssl3_get_client_hello(SSL *s)
         if (!ok) return((int)n);
         d=p=(unsigned char *)s->init_buf->data;
 
-        /* The version number has already been checked in ssl3_get_message.
-         * I a native TLSv1/SSLv3 method, the match must be correct except
-         * perhaps for the first message */
-/*      s->client_version=(((int)p[0])<<8)|(int)p[1]; */
+        /* use version from inside client hello, not from record header
+         * (may differ: see RFC 2246, Appendix E, second paragraph) */
+        s->client_version=(((int)p[0])<<8)|(int)p[1];
         p+=2;
 
         /* load the client random */
@@ -754,7 +809,7 @@ static int ssl3_get_client_hello(SSL *s)
          * compression          - basically ignored right now
          * ssl version is set   - sslv3
          * s->session           - The ssl session has been setup.
-         * s->hit               - sesson reuse flag
+         * s->hit               - session reuse flag
          * s->tmp.new_cipher    - the new cipher to use.
          */
 
@@ -782,7 +837,7 @@ static int ssl3_send_server_hello(SSL *s)
                 p=s->s3->server_random;
                 Time=time(NULL);                        /* Time */
                 l2n(Time,p);
-                RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
+                RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
                 /* Do the message type and length last */
                 d=p= &(buf[4]);
 
@@ -866,9 +921,10 @@ static int ssl3_send_server_key_exchange(SSL *s)
         int j,num;
         RSA *rsa;
         unsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
+        unsigned int u;
 #endif
 #ifndef NO_DH
-        DH *dh,*dhp;
+        DH *dh=NULL,*dhp;
 #endif
         EVP_PKEY *pkey;
         unsigned char *p,*d;
@@ -899,6 +955,12 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                 rsa=s->cert->rsa_tmp_cb(s,
                                       SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
                                       SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
+                                if(rsa == NULL)
+                                {
+                                        al=SSL_AD_HANDSHAKE_FAILURE;
+                                        SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_ERROR_GENERATING_TMP_RSA_KEY);
+                                        goto f_err;
+                                }
                                 CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
                                 cert->rsa_tmp=rsa;
                                 }
@@ -928,6 +990,14 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
                                 goto f_err;
                                 }
+
+                        if (s->s3->tmp.dh != NULL)
+                                {
+                                DH_free(dh);
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, SSL_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
                         if ((dh=DHparams_dup(dhp)) == NULL)
                                 {
                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
@@ -1027,15 +1097,14 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                         q+=i;
                                         j+=i;
                                         }
-                                i=RSA_private_encrypt(j,md_buf,&(p[2]),
-                                        pkey->pkey.rsa,RSA_PKCS1_PADDING);
-                                if (i <= 0)
+                                if (RSA_sign(NID_md5_sha1, md_buf, j,
+                                        &(p[2]), &u, pkey->pkey.rsa) <= 0)
                                         {
                                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA);
                                         goto err;
                                         }
-                                s2n(i,p);
-                                n+=i+2;
+                                s2n(u,p);
+                                n+=u+2;
                                 }
                         else
 #endif
@@ -1075,7 +1144,7 @@ static int ssl3_send_server_key_exchange(SSL *s)
                 s->init_off=0;
                 }
 
-        /* SSL3_ST_SW_KEY_EXCH_B */
+        s->state = SSL3_ST_SW_KEY_EXCH_B;
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
@@ -1152,6 +1221,17 @@ static int ssl3_send_certificate_request(SSL *s)
 
                 s->init_num=n+4;
                 s->init_off=0;
+#ifdef NETSCAPE_HANG_BUG
+                p=(unsigned char *)s->init_buf->data + s->init_num;
+
+                /* do the header */
+                *(p++)=SSL3_MT_SERVER_DONE;
+                *(p++)=0;
+                *(p++)=0;
+                *(p++)=0;
+                s->init_num += 4;
+#endif
+
                 }
 
         /* SSL3_ST_SW_CERT_REQ_B */
@@ -1239,31 +1319,6 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                 i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING);
 
-#if 1
-                /* If a bad decrypt, use a random master key */
-                if ((i != SSL_MAX_MASTER_KEY_LENGTH) ||
-                        ((p[0] != (s->client_version>>8)) ||
-                         (p[1] != (s->client_version & 0xff))))
-                        {
-                        int bad=1;
-
-                        if ((i == SSL_MAX_MASTER_KEY_LENGTH) &&
-                                (p[0] == (s->version>>8)) &&
-                                (p[1] == 0))
-                                {
-                                if (s->options & SSL_OP_TLS_ROLLBACK_BUG)
-                                        bad=0;
-                                }
-                        if (bad)
-                                {
-                                p[0]=(s->version>>8);
-                                p[1]=(s->version & 0xff);
-                                RAND_bytes(&(p[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
-                                i=SSL_MAX_MASTER_KEY_LENGTH;
-                                }
-                        /* else, an SSLeay bug, ssl only server, tls client */
-                        }
-#else
                 if (i != SSL_MAX_MASTER_KEY_LENGTH)
                         {
                         al=SSL_AD_DECODE_ERROR;
@@ -1271,13 +1326,12 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         goto f_err;
                         }
 
-                if ((p[0] != (s->version>>8)) || (p[1] != (s->version & 0xff)))
+                if ((p[0] != (s->client_version>>8)) || (p[1] != (s->client_version & 0xff)))
                         {
                         al=SSL_AD_DECODE_ERROR;
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
                         goto f_err;
                         }
-#endif
 
                 s->session->master_key_length=
                         s->method->ssl3_enc->generate_master_secret(s,
@@ -1450,16 +1504,16 @@ static int ssl3_get_cert_verify(SSL *s)
 #ifndef NO_RSA 
         if (pkey->type == EVP_PKEY_RSA)
                 {
-                i=RSA_public_decrypt(i,p,p,pkey->pkey.rsa,RSA_PKCS1_PADDING);
+                i=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,
+                        MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i, 
+                                                        pkey->pkey.rsa);
                 if (i < 0)
                         {
                         al=SSL_AD_DECRYPT_ERROR;
                         SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
                         goto f_err;
                         }
-                if ((i != (MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH)) ||
-                        memcmp(&(s->s3->tmp.finish_md[0]),p,
-                                MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH))
+                if (i == 0)
                         {
                         al=SSL_AD_DECRYPT_ERROR;
                         SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
@@ -1472,7 +1526,7 @@ static int ssl3_get_cert_verify(SSL *s)
                 if (pkey->type == EVP_PKEY_DSA)
                 {
                 j=DSA_verify(pkey->save_type,
-                        &(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]),
+                        &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
                         SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
                 if (j <= 0)
                         {
@@ -1532,7 +1586,7 @@ static int ssl3_get_client_certificate(SSL *s)
                         al=SSL_AD_HANDSHAKE_FAILURE;
                         goto f_err;
                         }
-                /* If tls asked for a client cert we must return a 0 list */
+                /* If tls asked for a client cert, the client must return a 0 list */
                 if ((s->version > SSL3_VERSION) && s->s3->tmp.cert_request)
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST);
@@ -1628,6 +1682,7 @@ static int ssl3_get_client_certificate(SSL *s)
         if (s->session->peer != NULL) /* This should not be needed */
                 X509_free(s->session->peer);
         s->session->peer=sk_X509_shift(sk);
+        s->session->verify_result = s->verify_result;
 
         /* With the current implementation, sess_cert will always be NULL
          * when we arrive here. */
diff --git a/src/lib/libssl/src/ssl/ssl-lib.com b/src/lib/libssl/src/ssl/ssl-lib.com
index 75fa89f193..0a8581898c 100644
--- a/src/lib/libssl/src/ssl/ssl-lib.com
+++ b/src/lib/libssl/src/ssl/ssl-lib.com
@@ -897,12 +897,36 @@ $!
 $! Set Up Initial CC Definitions, Possibly With User Ones
 $!
 $ CCDEFS = "VMS=1,TCPIP_TYPE_''P5'"
+$ IF F$TRNLNM("OPENSSL_NO_ASM") THEN CCDEFS = CCDEFS + ",NO_ASM"
+$ IF F$TRNLNM("OPENSSL_NO_RSA") THEN CCDEFS = CCDEFS + ",NO_RSA"
+$ IF F$TRNLNM("OPENSSL_NO_DSA") THEN CCDEFS = CCDEFS + ",NO_DSA"
+$ IF F$TRNLNM("OPENSSL_NO_DH") THEN CCDEFS = CCDEFS + ",NO_DH"
+$ IF F$TRNLNM("OPENSSL_NO_MD2") THEN CCDEFS = CCDEFS + ",NO_MD2"
+$ IF F$TRNLNM("OPENSSL_NO_MD5") THEN CCDEFS = CCDEFS + ",NO_MD5"
+$ IF F$TRNLNM("OPENSSL_NO_RIPEMD") THEN CCDEFS = CCDEFS + ",NO_RIPEMD"
+$ IF F$TRNLNM("OPENSSL_NO_SHA") THEN CCDEFS = CCDEFS + ",NO_SHA"
+$ IF F$TRNLNM("OPENSSL_NO_SHA0") THEN CCDEFS = CCDEFS + ",NO_SHA0"
+$ IF F$TRNLNM("OPENSSL_NO_SHA1") THEN CCDEFS = CCDEFS + ",NO_SHA1"
+$ IF F$TRNLNM("OPENSSL_NO_DES")
+$ THEN
+$   CCDEFS = CCDEFS + ",NO_DES,NO_MDC2"
+$ ELSE
+$   IF F$TRNLNM("OPENSSL_NO_MDC2") THEN CCDEFS = CCDEFS + ",NO_MDC2"
+$ ENDIF
+$ IF F$TRNLNM("OPENSSL_NO_RC2") THEN CCDEFS = CCDEFS + ",NO_RC2"
+$ IF F$TRNLNM("OPENSSL_NO_RC4") THEN CCDEFS = CCDEFS + ",NO_RC4"
+$ IF F$TRNLNM("OPENSSL_NO_RC5") THEN CCDEFS = CCDEFS + ",NO_RC5"
+$ IF F$TRNLNM("OPENSSL_NO_IDEA") THEN CCDEFS = CCDEFS + ",NO_IDEA"
+$ IF F$TRNLNM("OPENSSL_NO_BF") THEN CCDEFS = CCDEFS + ",NO_BF"
+$ IF F$TRNLNM("OPENSSL_NO_CAST") THEN CCDEFS = CCDEFS + ",NO_CAST"
+$ IF F$TRNLNM("OPENSSL_NO_HMAC") THEN CCDEFS = CCDEFS + ",NO_HMAC"
+$ IF F$TRNLNM("OPENSSL_NO_SSL2") THEN CCDEFS = CCDEFS + ",NO_SSL2"
 $ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS
 $ CCEXTRAFLAGS = ""
 $ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS
-$ CCDISABLEWARNINGS = ""
+$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"
 $ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -
-        CCDISABLEWARNINGS = USER_CCDISABLEWARNINGS
+        CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS
 $!
 $!  Check To See If The User Entered A Valid Paramter.
 $!
diff --git a/src/lib/libssl/src/ssl/ssl.h b/src/lib/libssl/src/ssl/ssl.h
index fbe4f667fa..f29f775347 100644
--- a/src/lib/libssl/src/ssl/ssl.h
+++ b/src/lib/libssl/src/ssl/ssl.h
@@ -123,8 +123,9 @@ extern "C" {
 #define SSL_TXT_MD5             "MD5"
 #define SSL_TXT_SHA1            "SHA1"
 #define SSL_TXT_SHA             "SHA"
-#define SSL_TXT_EXP40           "EXP"
+#define SSL_TXT_EXP             "EXP"
 #define SSL_TXT_EXPORT          "EXPORT"
+#define SSL_TXT_EXP40           "EXPORT40"
 #define SSL_TXT_EXP56           "EXPORT56"
 #define SSL_TXT_SSLV2           "SSLv2"
 #define SSL_TXT_SSLV3           "SSLv3"
@@ -133,12 +134,7 @@ extern "C" {
 
 /* 'DEFAULT' at the start of the cipher list insert the following string
  * in addition to this being the default cipher string */
-#ifndef NO_RSA
-#define SSL_DEFAULT_CIPHER_LIST "ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
-#else
-#define SSL_ALLOW_ADH
-#define SSL_DEFAULT_CIPHER_LIST "HIGH:MEDIUM:LOW:ADH+3DES:ADH+RC4:ADH+DES:+EXP"
-#endif
+#define SSL_DEFAULT_CIPHER_LIST "ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH"
 
 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */
 #define SSL_SENT_SHUTDOWN       1
@@ -151,6 +147,10 @@ extern "C" {
 #include <openssl/pem.h>
 #include <openssl/x509.h>
 
+#if (defined(NO_RSA) || defined(NO_MD5)) && !defined(NO_SSL2)
+#define NO_SSL2
+#endif
+
 #define SSL_FILETYPE_ASN1       X509_FILETYPE_ASN1
 #define SSL_FILETYPE_PEM        X509_FILETYPE_PEM
 
@@ -166,8 +166,12 @@ typedef struct ssl_cipher_st
         const char *name;               /* text name */
         unsigned long id;               /* id, 4 bytes, first is version */
         unsigned long algorithms;       /* what ciphers are used */
+        unsigned long algo_strength;    /* strength and export flags */
         unsigned long algorithm2;       /* Extra flags */
+        int strength_bits;              /* Number of bits really used */
+        int alg_bits;                   /* Number of bits for algorithm */
         unsigned long mask;             /* used for matching */
+        unsigned long mask_strength;    /* also used for matching */
         } SSL_CIPHER;
 
 DECLARE_STACK_OF(SSL_CIPHER)
@@ -201,6 +205,8 @@ typedef struct ssl_method_st
         long (*get_timeout)(void);
         struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
         int (*ssl_version)();
+        long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)());
+        long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)());
         } SSL_METHOD;
 
 /* Lets make this into an ASN.1 type structure as follows
@@ -215,7 +221,8 @@ typedef struct ssl_method_st
  *      Timeout [ 2 ] EXPLICIT  INTEGER,        -- optional Timeout ins seconds
  *      Peer [ 3 ] EXPLICIT     X509,           -- optional Peer Certificate
  *      Session_ID_context [ 4 ] EXPLICIT OCTET_STRING,   -- the Session ID context
- *      Compression [5] IMPLICIT ASN1_OBJECT    -- compression OID XXXXX
+ *      Verify_result [ 5 ] EXPLICIT INTEGER    -- X509_V_... code for `Peer'
+ *      Compression [6] IMPLICIT ASN1_OBJECT    -- compression OID XXXXX
  *      }
  * Look in ssl/ssl_asn1.c for more details
  * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).
@@ -249,6 +256,9 @@ typedef struct ssl_session_st
          * (the latter is not enough as sess_cert is not retained
          * in the external representation of sessions, see ssl_asn1.c). */
         X509 *peer;
+        /* when app_verify_callback accepts a session where the peer's certificate
+         * is not ok, we must remember the error for session reuse: */
+        long verify_result; /* only for servers */
 
         int references;
         long timeout;
@@ -291,6 +301,7 @@ typedef struct ssl_session_st
 #define SSL_OP_PKCS1_CHECK_1                            0x08000000L
 #define SSL_OP_PKCS1_CHECK_2                            0x10000000L
 #define SSL_OP_NETSCAPE_CA_DN_BUG                       0x20000000L
+/* SSL_OP_NON_EXPORT_FIRST looks utterly broken .. */
 #define SSL_OP_NON_EXPORT_FIRST                         0x40000000L
 #define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG          0x80000000L
 #define SSL_OP_ALL                                      0x000FFFFFL
@@ -355,9 +366,9 @@ struct ssl_ctx_st
         STACK_OF(SSL_CIPHER) *cipher_list_by_id;
 
         struct x509_store_st /* X509_STORE */ *cert_store;
-        struct lhash_st /* LHASH */ *sessions;  /* a set of SSL_SESSION's */
+        struct lhash_st /* LHASH */ *sessions;  /* a set of SSL_SESSIONs */
         /* Most session-ids that will be cached, default is
-         * SSL_SESSION_CACHE_SIZE_DEFAULT. 0 is unlimited. */
+         * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited. */
         unsigned long session_cache_size;
         struct ssl_session_st *session_cache_head;
         struct ssl_session_st *session_cache_tail;
@@ -424,6 +435,9 @@ struct ssl_ctx_st
 /**/    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
 /**/    int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx);
 
+        int purpose;            /* Purpose setting */
+        int trust;              /* Trust setting */
+
         /* Default password callback. */
 /**/    pem_password_cb *default_passwd_callback;
 
@@ -433,7 +447,7 @@ struct ssl_ctx_st
         /* get client cert callback */
 /**/    int (*client_cert_cb)(/* SSL *ssl, X509 **x509, EVP_PKEY **pkey */);
 
-        /* what we put in client requests */
+        /* what we put in client cert requests */
         STACK_OF(X509_NAME) *client_CA;
 
 /**/    int quiet_shutdown;
@@ -458,6 +472,7 @@ struct ssl_ctx_st
  * defined, this will still get called. */
 #define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP       0x0100
 
+  struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx);
 #define SSL_CTX_sess_number(ctx) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL)
 #define SSL_CTX_sess_connect(ctx) \
@@ -564,17 +579,21 @@ struct ssl_st
         unsigned char *packet;
         unsigned int packet_length;
 
-        struct ssl2_ctx_st *s2; /* SSLv2 variables */
-        struct ssl3_ctx_st *s3; /* SSLv3 variables */
+        struct ssl2_state_st *s2; /* SSLv2 variables */
+        struct ssl3_state_st *s3; /* SSLv3 variables */
 
-        int read_ahead;         /* Read as many input bytes as possible */
+        int read_ahead;         /* Read as many input bytes as possible
+                                 * (for non-blocking reads) */
         int hit;                /* reusing a previous session */
 
+        int purpose;            /* Purpose setting */
+        int trust;              /* Trust setting */
+
         /* crypto */
         STACK_OF(SSL_CIPHER) *cipher_list;
         STACK_OF(SSL_CIPHER) *cipher_list_by_id;
 
-        /* These are the ones being used, the ones is SSL_SESSION are
+        /* These are the ones being used, the ones in SSL_SESSION are
          * the ones to be 'copied' into these ones */
 
         EVP_CIPHER_CTX *enc_read_ctx;           /* cryptographic state */
@@ -634,7 +653,7 @@ struct ssl_st
         unsigned long mode; /* API behaviour */
         int first_packet;
         int client_version;     /* what was passed, used for
-                                 * SSLv3/TLS rolback check */
+                                 * SSLv3/TLS rollback check */
         };
 
 #include <openssl/ssl2.h>
@@ -642,7 +661,7 @@ struct ssl_st
 #include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */
 #include <openssl/ssl23.h>
 
-/* compatablity */
+/* compatibility */
 #define SSL_set_app_data(s,arg)         (SSL_set_ex_data(s,0,(char *)arg))
 #define SSL_get_app_data(s)             (SSL_get_ex_data(s,0))
 #define SSL_SESSION_set_app_data(s,a)   (SSL_SESSION_set_ex_data(s,0,(char *)a))
@@ -651,7 +670,7 @@ struct ssl_st
 #define SSL_CTX_set_app_data(ctx,arg)   (SSL_CTX_set_ex_data(ctx,0,(char *)arg))
 
 /* The following are the possible values for ssl->state are are
- * used to indicate where we are upto in the SSL connection establishment.
+ * used to indicate where we are up to in the SSL connection establishment.
  * The macros that follow are about the only things you should need to use
  * and even then, only when using non-blocking IO.
  * It can also be useful to work out where you were when the connection
@@ -693,6 +712,13 @@ struct ssl_st
 #define SSL_ST_READ_BODY                        0xF1
 #define SSL_ST_READ_DONE                        0xF2
 
+/* Obtain latest Finished message
+ *   -- that we sent (SSL_get_finished)
+ *   -- that we expected from peer (SSL_get_peer_finished).
+ * Returns length (0 == no Finished so far), copies up to 'count' bytes. */
+size_t SSL_get_finished(SSL *s, void *buf, size_t count);
+size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count);
+
 /* use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options
  * are 'ored' with SSL_VERIFY_PEER if they are desired */
 #define SSL_VERIFY_NONE                 0x00
@@ -700,9 +726,10 @@ struct ssl_st
 #define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02
 #define SSL_VERIFY_CLIENT_ONCE          0x04
 
+#define OpenSSL_add_ssl_algorithms()    SSL_library_init()
 #define SSLeay_add_ssl_algorithms()     SSL_library_init()
 
-/* this is for backward compatablility */
+/* this is for backward compatibility */
 #if 0 /* NEW_SSLEAY */
 #define SSL_CTX_set_default_verify(a,b,c) SSL_CTX_set_verify(a,b,c)
 #define SSL_set_pref_cipher(c,n)        SSL_set_cipher_list(c,n)
@@ -710,7 +737,7 @@ struct ssl_st
 #define SSL_remove_session(a,b)         SSL_CTX_remove_session((a),(b))
 #define SSL_flush_sessions(a,b)         SSL_CTX_flush_sessions((a),(b))
 #endif
-/* More backward compatablity */
+/* More backward compatibility */
 #define SSL_get_cipher(s) \
                 SSL_CIPHER_get_name(SSL_get_current_cipher(s))
 #define SSL_get_cipher_bits(s,np) \
@@ -762,11 +789,11 @@ struct ssl_st
 #define SSL_AD_ACCESS_DENIED            TLS1_AD_ACCESS_DENIED   /* fatal */
 #define SSL_AD_DECODE_ERROR             TLS1_AD_DECODE_ERROR    /* fatal */
 #define SSL_AD_DECRYPT_ERROR            TLS1_AD_DECRYPT_ERROR
-#define SSL_AD_EXPORT_RESTRICION        TLS1_AD_EXPORT_RESTRICION/* fatal */
+#define SSL_AD_EXPORT_RESTRICTION       TLS1_AD_EXPORT_RESTRICTION/* fatal */
 #define SSL_AD_PROTOCOL_VERSION         TLS1_AD_PROTOCOL_VERSION /* fatal */
 #define SSL_AD_INSUFFICIENT_SECURITY    TLS1_AD_INSUFFICIENT_SECURITY/* fatal */
 #define SSL_AD_INTERNAL_ERROR           TLS1_AD_INTERNAL_ERROR  /* fatal */
-#define SSL_AD_USER_CANCLED             TLS1_AD_USER_CANCLED
+#define SSL_AD_USER_CANCELLED           TLS1_AD_USER_CANCELLED
 #define SSL_AD_NO_RENEGOTIATION         TLS1_AD_NO_RENEGOTIATION
 
 #define SSL_ERROR_NONE                  0
@@ -867,7 +894,7 @@ void BIO_ssl_shutdown(BIO *ssl_bio);
 
 #endif
 
-int     SSL_CTX_set_cipher_list(SSL_CTX *,char *str);
+int     SSL_CTX_set_cipher_list(SSL_CTX *,const char *str);
 SSL_CTX *SSL_CTX_new(SSL_METHOD *meth);
 void    SSL_CTX_free(SSL_CTX *);
 long SSL_CTX_set_timeout(SSL_CTX *ctx,long t);
@@ -899,7 +926,7 @@ void	SSL_set_bio(SSL *s, BIO *rbio,BIO *wbio);
 BIO *   SSL_get_rbio(SSL *s);
 BIO *   SSL_get_wbio(SSL *s);
 #endif
-int     SSL_set_cipher_list(SSL *s, char *str);
+int     SSL_set_cipher_list(SSL *s, const char *str);
 void    SSL_set_read_ahead(SSL *s, int yes);
 int     SSL_get_verify_mode(SSL *s);
 int     SSL_get_verify_depth(SSL *s);
@@ -998,6 +1025,12 @@ int	SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
 SSL *   SSL_new(SSL_CTX *ctx);
 int     SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
                                    unsigned int sid_ctx_len);
+
+int SSL_CTX_set_purpose(SSL_CTX *s, int purpose);
+int SSL_set_purpose(SSL *s, int purpose);
+int SSL_CTX_set_trust(SSL_CTX *s, int trust);
+int SSL_set_trust(SSL *s, int trust);
+
 void    SSL_free(SSL *ssl);
 int     SSL_accept(SSL *ssl);
 int     SSL_connect(SSL *ssl);
@@ -1005,10 +1038,12 @@ int 	SSL_read(SSL *ssl,char *buf,int num);
 int     SSL_peek(SSL *ssl,char *buf,int num);
 int     SSL_write(SSL *ssl,const char *buf,int num);
 long    SSL_ctrl(SSL *ssl,int cmd, long larg, char *parg);
+long    SSL_callback_ctrl(SSL *, int, void (*)());
 long    SSL_CTX_ctrl(SSL_CTX *ctx,int cmd, long larg, char *parg);
+long    SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)());
 
 int     SSL_get_error(SSL *s,int ret_code);
-char *  SSL_get_version(SSL *s);
+const char *SSL_get_version(SSL *s);
 
 /* This sets the 'default' SSL version that SSL_new() will create */
 int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth);
@@ -1074,7 +1109,9 @@ int SSL_version(SSL *ssl);
 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx);
 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
         const char *CApath);
+#define SSL_get0_session SSL_get_session /* just peek at pointer */
 SSL_SESSION *SSL_get_session(SSL *ssl);
+SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */
 SSL_CTX *SSL_get_SSL_CTX(SSL *ssl);
 void SSL_set_info_callback(SSL *ssl,void (*cb)());
 void (*SSL_get_info_callback(SSL *ssl))();
@@ -1085,18 +1122,18 @@ long SSL_get_verify_result(SSL *ssl);
 
 int SSL_set_ex_data(SSL *ssl,int idx,void *data);
 void *SSL_get_ex_data(SSL *ssl,int idx);
-int SSL_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 
 int SSL_SESSION_set_ex_data(SSL_SESSION *ss,int idx,void *data);
 void *SSL_SESSION_get_ex_data(SSL_SESSION *ss,int idx);
-int SSL_SESSION_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 
 int SSL_CTX_set_ex_data(SSL_CTX *ssl,int idx,void *data);
 void *SSL_CTX_get_ex_data(SSL_CTX *ssl,int idx);
-int SSL_CTX_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 
 int SSL_get_ex_data_X509_STORE_CTX_idx(void );
 
@@ -1219,13 +1256,18 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_F_SSL_CERT_INSTANTIATE                       214
 #define SSL_F_SSL_CERT_NEW                               162
 #define SSL_F_SSL_CHECK_PRIVATE_KEY                      163
+#define SSL_F_SSL_CIPHER_PROCESS_RULESTR                 230
+#define SSL_F_SSL_CIPHER_STRENGTH_SORT                   231
 #define SSL_F_SSL_CLEAR                                  164
 #define SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD            165
 #define SSL_F_SSL_CREATE_CIPHER_LIST                     166
+#define SSL_F_SSL_CTRL                                   232
 #define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY                  168
 #define SSL_F_SSL_CTX_NEW                                169
+#define SSL_F_SSL_CTX_SET_PURPOSE                        226
 #define SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT             219
 #define SSL_F_SSL_CTX_SET_SSL_VERSION                    170
+#define SSL_F_SSL_CTX_SET_TRUST                          229
 #define SSL_F_SSL_CTX_USE_CERTIFICATE                    171
 #define SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1               172
 #define SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE         220
@@ -1253,9 +1295,11 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_F_SSL_SET_CERT                               191
 #define SSL_F_SSL_SET_FD                                 192
 #define SSL_F_SSL_SET_PKEY                               193
+#define SSL_F_SSL_SET_PURPOSE                            227
 #define SSL_F_SSL_SET_RFD                                194
 #define SSL_F_SSL_SET_SESSION                            195
 #define SSL_F_SSL_SET_SESSION_ID_CONTEXT                 218
+#define SSL_F_SSL_SET_TRUST                              228
 #define SSL_F_SSL_SET_WFD                                196
 #define SSL_F_SSL_SHUTDOWN                               224
 #define SSL_F_SSL_UNDEFINED_FUNCTION                     197
@@ -1282,7 +1326,6 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_BAD_AUTHENTICATION_TYPE                    102
 #define SSL_R_BAD_CHANGE_CIPHER_SPEC                     103
 #define SSL_R_BAD_CHECKSUM                               104
-#define SSL_R_BAD_CLIENT_REQUEST                         105
 #define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK              106
 #define SSL_R_BAD_DECOMPRESSION                          107
 #define SSL_R_BAD_DH_G_LENGTH                            108
@@ -1290,6 +1333,7 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_BAD_DH_P_LENGTH                            110
 #define SSL_R_BAD_DIGEST_LENGTH                          111
 #define SSL_R_BAD_DSA_SIGNATURE                          112
+#define SSL_R_BAD_HELLO_REQUEST                          105
 #define SSL_R_BAD_LENGTH                                 271
 #define SSL_R_BAD_MAC_DECODE                             113
 #define SSL_R_BAD_MESSAGE_TYPE                           114
@@ -1329,6 +1373,7 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG            148
 #define SSL_R_DIGEST_CHECK_FAILED                        149
 #define SSL_R_ENCRYPTED_LENGTH_TOO_LONG                  150
+#define SSL_R_ERROR_GENERATING_TMP_RSA_KEY               1092
 #define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST              151
 #define SSL_R_EXCESSIVE_MESSAGE_SIZE                     152
 #define SSL_R_EXTRA_DATA_IN_MESSAGE                      153
@@ -1337,6 +1382,9 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_HTTP_REQUEST                               156
 #define SSL_R_INTERNAL_ERROR                             157
 #define SSL_R_INVALID_CHALLENGE_LENGTH                   158
+#define SSL_R_INVALID_COMMAND                            280
+#define SSL_R_INVALID_PURPOSE                            278
+#define SSL_R_INVALID_TRUST                              279
 #define SSL_R_LENGTH_MISMATCH                            159
 #define SSL_R_LENGTH_TOO_SHORT                           160
 #define SSL_R_LIBRARY_BUG                                274
@@ -1429,14 +1477,14 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_TLSV1_ALERT_DECODE_ERROR                   1050
 #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED              1021
 #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR                  1051
-#define SSL_R_TLSV1_ALERT_EXPORT_RESTRICION              1060
+#define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION             1060
 #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY          1071
 #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR                 1080
 #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION               1100
 #define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION               1070
 #define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW                1022
 #define SSL_R_TLSV1_ALERT_UNKNOWN_CA                     1048
-#define SSL_R_TLSV1_ALERT_USER_CANCLED                   1090
+#define SSL_R_TLSV1_ALERT_USER_CANCELLED                 1090
 #define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER       232
 #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
 #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG    234
@@ -1464,6 +1512,7 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_UNKNOWN_STATE                              255
 #define SSL_R_UNSUPPORTED_CIPHER                         256
 #define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM          257
+#define SSL_R_UNSUPPORTED_OPTION                         1091
 #define SSL_R_UNSUPPORTED_PROTOCOL                       258
 #define SSL_R_UNSUPPORTED_SSL_VERSION                    259
 #define SSL_R_WRITE_BIO_NOT_SET                          260
diff --git a/src/lib/libssl/src/ssl/ssl2.h b/src/lib/libssl/src/ssl/ssl2.h
index d7f24ac1b4..01d41c88c5 100644
--- a/src/lib/libssl/src/ssl/ssl2.h
+++ b/src/lib/libssl/src/ssl/ssl2.h
@@ -151,7 +151,7 @@ extern "C" {
 #define  CERT           char
 #endif
 
-typedef struct ssl2_ctx_st
+typedef struct ssl2_state_st
         {
         int three_byte_header;
         int clear_text;         /* clear text */
@@ -214,7 +214,7 @@ typedef struct ssl2_ctx_st
                 unsigned int clen;
                 unsigned int rlen;
                 } tmp;
-        } SSL2_CTX;
+        } SSL2_STATE;
 
 /* SSLv2 */
 /* client */
diff --git a/src/lib/libssl/src/ssl/ssl3.h b/src/lib/libssl/src/ssl/ssl3.h
index 2a9714fc19..f616763830 100644
--- a/src/lib/libssl/src/ssl/ssl3.h
+++ b/src/lib/libssl/src/ssl/ssl3.h
@@ -158,24 +158,8 @@ extern "C" {
 #define SSL3_RT_MAX_PACKET_SIZE         (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH)
 #define SSL3_RT_MAX_DATA_SIZE                   (1024*1024)
 
-/* the states that a SSL3_RECORD can be in
- * For SSL_read it goes
- * rbuf->ENCODED        -> read 
- * ENCODED              -> we need to decode everything - call decode_record
- */
- 
-#define SSL3_RS_BLANK                   1
-#define SSL3_RS_DATA
-
-#define SSL3_RS_ENCODED                 2
-#define SSL3_RS_READ_MORE               3
-#define SSL3_RS_WRITE_MORE
-#define SSL3_RS_PLAIN                   3
-#define SSL3_RS_PART_READ               4
-#define SSL3_RS_PART_WRITE              5
-
-#define SSL3_MD_CLIENT_FINISHED_CONST   {0x43,0x4C,0x4E,0x54}
-#define SSL3_MD_SERVER_FINISHED_CONST   {0x53,0x52,0x56,0x52}
+#define SSL3_MD_CLIENT_FINISHED_CONST   "\x43\x4C\x4E\x54"
+#define SSL3_MD_SERVER_FINISHED_CONST   "\x53\x52\x56\x52"
 
 #define SSL3_VERSION                    0x0300
 #define SSL3_VERSION_MAJOR              0x03
@@ -204,22 +188,20 @@ extern "C" {
 
 typedef struct ssl3_record_st
         {
-/*r */  int type;               /* type of record */
-/*  */  /*int state;*/          /* any data in it? */
-/*rw*/  unsigned int length;    /* How many bytes available */
-/*r */  unsigned int off;       /* read/write offset into 'buf' */
-/*rw*/  unsigned char *data;    /* pointer to the record data */
-/*rw*/  unsigned char *input;   /* where the decode bytes are */
-/*r */  unsigned char *comp;    /* only used with decompression - malloc()ed */
+/*r */  int type;               /* type of record */
+/*rw*/  unsigned int length;    /* How many bytes available */
+/*r */  unsigned int off;       /* read/write offset into 'buf' */
+/*rw*/  unsigned char *data;    /* pointer to the record data */
+/*rw*/  unsigned char *input;   /* where the decode bytes are */
+/*r */  unsigned char *comp;    /* only used with decompression - malloc()ed */
         } SSL3_RECORD;
 
 typedef struct ssl3_buffer_st
         {
-/*r */  int total;              /* used in non-blocking writes */
-/*r */  int wanted;             /* how many more bytes we need */
-/*rw*/  int left;               /* how many bytes left */
-/*rw*/  int offset;             /* where to 'copy from' */
-/*rw*/  unsigned char *buf;     /* SSL3_RT_MAX_PACKET_SIZE bytes */
+        unsigned char *buf;     /* SSL3_RT_MAX_PACKET_SIZE bytes (more if
+                                 * SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER is set) */
+        int offset;             /* where to 'copy from' */
+        int left;               /* how many bytes left */
         } SSL3_BUFFER;
 
 #define SSL3_CT_RSA_SIGN                        1
@@ -236,34 +218,7 @@ typedef struct ssl3_buffer_st
 #define SSL3_FLAGS_POP_BUFFER                   0x0004
 #define TLS1_FLAGS_TLS_PADDING_BUG              0x0008
 
-#if 0
-#define AD_CLOSE_NOTIFY                 0
-#define AD_UNEXPECTED_MESSAGE           1
-#define AD_BAD_RECORD_MAC               2
-#define AD_DECRYPTION_FAILED            3
-#define AD_RECORD_OVERFLOW              4
-#define AD_DECOMPRESSION_FAILURE        5       /* fatal */
-#define AD_HANDSHAKE_FAILURE            6       /* fatal */
-#define AD_NO_CERTIFICATE               7       /* Not under TLS */
-#define AD_BAD_CERTIFICATE              8
-#define AD_UNSUPPORTED_CERTIFICATE      9
-#define AD_CERTIFICATE_REVOKED          10      
-#define AD_CERTIFICATE_EXPIRED          11
-#define AD_CERTIFICATE_UNKNOWN          12
-#define AD_ILLEGAL_PARAMETER            13      /* fatal */
-#define AD_UNKNOWN_CA                   14      /* fatal */
-#define AD_ACCESS_DENIED                15      /* fatal */
-#define AD_DECODE_ERROR                 16      /* fatal */
-#define AD_DECRYPT_ERROR                17
-#define AD_EXPORT_RESTRICION            18      /* fatal */
-#define AD_PROTOCOL_VERSION             19      /* fatal */
-#define AD_INSUFFICIENT_SECURITY        20      /* fatal */
-#define AD_INTERNAL_ERROR               21      /* fatal */
-#define AD_USER_CANCLED                 22
-#define AD_NO_RENEGOTIATION             23
-#endif
-
-typedef struct ssl3_ctx_st
+typedef struct ssl3_state_st
         {
         long flags;
         int delay_buf_pop_ret;
@@ -278,10 +233,16 @@ typedef struct ssl3_ctx_st
 
         SSL3_BUFFER rbuf;       /* read IO goes into here */
         SSL3_BUFFER wbuf;       /* write IO goes into here */
+
         SSL3_RECORD rrec;       /* each decoded record goes in here */
         SSL3_RECORD wrec;       /* goes out from here */
-                                /* Used by ssl3_read_n to point
-                                 * to input data packet */
+
+        /* storage for Alert/Handshake protocol data received but not
+         * yet processed by ssl3_read_bytes: */
+        unsigned char alert_fragment[2];
+        unsigned int alert_fragment_len;
+        unsigned char handshake_fragment[4];
+        unsigned int handshake_fragment_len;
 
         /* partial write - check the numbers match */
         unsigned int wnum;      /* number of bytes sent so far */
@@ -300,7 +261,7 @@ typedef struct ssl3_ctx_st
 
         int warn_alert;
         int fatal_alert;
-        /* we alow one fatal and one warning alert to be outstanding,
+        /* we allow one fatal and one warning alert to be outstanding,
          * send close alert via the warning alert */
         int alert_dispatch;
         unsigned char send_alert[2];
@@ -314,8 +275,14 @@ typedef struct ssl3_ctx_st
         int in_read_app_data;
 
         struct  {
-                /* Actually only needs to be 16+20 for SSLv3 and 12 for TLS */
+                /* actually only needs to be 16+20 */
+                unsigned char cert_verify_md[EVP_MAX_MD_SIZE*2];
+
+                /* actually only need to be 16+20 for SSLv3 and 12 for TLS */
                 unsigned char finish_md[EVP_MAX_MD_SIZE*2];
+                int finish_md_len;
+                unsigned char peer_finish_md[EVP_MAX_MD_SIZE*2];
+                int peer_finish_md_len;
                 
                 unsigned long message_size;
                 int message_type;
@@ -351,7 +318,7 @@ typedef struct ssl3_ctx_st
                 int cert_request;
                 } tmp;
 
-        } SSL3_CTX;
+        } SSL3_STATE;
 
 /* SSLv3 */
 /*client */
@@ -429,7 +396,7 @@ typedef struct ssl3_ctx_st
 #define SSL3_ST_SW_FINISHED_A           (0x1E0|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_FINISHED_B           (0x1E1|SSL_ST_ACCEPT)
 
-#define SSL3_MT_CLIENT_REQUEST                  0
+#define SSL3_MT_HELLO_REQUEST                   0
 #define SSL3_MT_CLIENT_HELLO                    1
 #define SSL3_MT_SERVER_HELLO                    2
 #define SSL3_MT_CERTIFICATE                     11
diff --git a/src/lib/libssl/src/ssl/ssl_asn1.c b/src/lib/libssl/src/ssl/ssl_asn1.c
index 0f6a0884e4..e77cdddfd3 100644
--- a/src/lib/libssl/src/ssl/ssl_asn1.c
+++ b/src/lib/libssl/src/ssl/ssl_asn1.c
@@ -60,6 +60,7 @@
 #include <stdlib.h>
 #include <openssl/asn1_mac.h>
 #include <openssl/objects.h>
+#include <openssl/x509.h>
 #include "ssl_locl.h"
 
 typedef struct ssl_session_asn1_st
@@ -73,14 +74,15 @@ typedef struct ssl_session_asn1_st
         ASN1_OCTET_STRING key_arg;
         ASN1_INTEGER time;
         ASN1_INTEGER timeout;
+        ASN1_INTEGER verify_result;
         } SSL_SESSION_ASN1;
 
 int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
         {
 #define LSIZE2 (sizeof(long)*2)
-        int v1=0,v2=0,v3=0,v4=0;
+        int v1=0,v2=0,v3=0,v4=0,v5=0;
         unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2];
-        unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2];
+        unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2],ibuf5[LSIZE2];
         long l;
         SSL_SESSION_ASN1 a;
         M_ASN1_I2D_vars(in);
@@ -89,7 +91,7 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                 return(0);
 
         /* Note that I cheat in the following 2 assignments.  I know
-         * that if the ASN1_INTERGER passed to ASN1_INTEGER_set
+         * that if the ASN1_INTEGER passed to ASN1_INTEGER_set
          * is > sizeof(long)+1, the buffer will not be re-Malloc()ed.
          * This is a bit evil but makes things simple, no dynamic allocation
          * to clean up :-) */
@@ -156,6 +158,14 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                 ASN1_INTEGER_set(&(a.timeout),in->timeout);
                 }
 
+        if (in->verify_result != X509_V_OK)
+                {
+                a.verify_result.length=LSIZE2;
+                a.verify_result.type=V_ASN1_INTEGER;
+                a.verify_result.data=ibuf5;
+                ASN1_INTEGER_set(&a.verify_result,in->verify_result);
+                }
+
         M_ASN1_I2D_len(&(a.version),            i2d_ASN1_INTEGER);
         M_ASN1_I2D_len(&(a.ssl_version),        i2d_ASN1_INTEGER);
         M_ASN1_I2D_len(&(a.cipher),             i2d_ASN1_OCTET_STRING);
@@ -170,6 +180,8 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
         if (in->peer != NULL)
                 M_ASN1_I2D_len_EXP_opt(in->peer,i2d_X509,3,v3);
         M_ASN1_I2D_len_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,v4);
+        if (in->verify_result != X509_V_OK)
+                M_ASN1_I2D_len_EXP_opt(&(a.verify_result),i2d_ASN1_INTEGER,5,v5);
 
         M_ASN1_I2D_seq_total();
 
@@ -188,7 +200,8 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                 M_ASN1_I2D_put_EXP_opt(in->peer,i2d_X509,3,v3);
         M_ASN1_I2D_put_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,
                                v4);
-
+        if (in->verify_result != X509_V_OK)
+                M_ASN1_I2D_put_EXP_opt(&a.verify_result,i2d_ASN1_INTEGER,5,v5);
         M_ASN1_I2D_finish();
         }
 
@@ -322,6 +335,15 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, unsigned char **pp,
         else
             ret->sid_ctx_length=0;
 
+        ai.length=0;
+        M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,5);
+        if (ai.data != NULL)
+                {
+                ret->verify_result=ASN1_INTEGER_get(aip);
+                Free(ai.data); ai.data=NULL; ai.length=0;
+                }
+        else
+                ret->verify_result=X509_V_OK;
+
         M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION);
         }
-
diff --git a/src/lib/libssl/src/ssl/ssl_cert.c b/src/lib/libssl/src/ssl/ssl_cert.c
index 6d2511f76c..48f247ceac 100644
--- a/src/lib/libssl/src/ssl/ssl_cert.c
+++ b/src/lib/libssl/src/ssl/ssl_cert.c
@@ -105,17 +105,26 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#if !defined(WIN32) && !defined(VSM) && !defined(NeXT)
+
+#include "openssl/e_os.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
+#if !defined(WIN32) && !defined(VSM) && !defined(NeXT) && !defined(MAC_OS_pre_X)
 #include <dirent.h>
 #endif
+
 #ifdef NeXT
 #include <sys/dir.h>
 #define dirent direct
 #endif
+
 #include <openssl/objects.h>
 #include <openssl/bio.h>
 #include <openssl/pem.h>
+#include <openssl/x509v3.h>
 #include "ssl_locl.h"
 
 int SSL_get_ex_data_X509_STORE_CTX_idx(void)
@@ -422,8 +431,16 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
         X509_STORE_CTX_init(&ctx,s->ctx->cert_store,x,sk);
         if (SSL_get_verify_depth(s) >= 0)
                 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
-        X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),
-                (char *)s);
+        X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),s);
+        /* We need to set the verify purpose. The purpose can be determined by
+         * the context: if its a server it will verify SSL client certificates
+         * or vice versa.
+         */
+
+        if(s->server) i = X509_PURPOSE_SSL_CLIENT;
+        else i = X509_PURPOSE_SSL_SERVER;
+
+        X509_STORE_CTX_purpose_inherit(&ctx, i, s->purpose, s->trust);
 
         if (s->ctx->app_verify_callback != NULL)
                 i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */
@@ -534,7 +551,7 @@ int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x)
         return(add_client_CA(&(ctx->client_CA),x));
         }
 
-static int name_cmp(X509_NAME **a,X509_NAME **b)
+static int xname_cmp(X509_NAME **a,X509_NAME **b)
         {
         return(X509_NAME_cmp(*a,*b));
         }
@@ -556,7 +573,7 @@ STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file)
         STACK_OF(X509_NAME) *ret,*sk;
 
         ret=sk_X509_NAME_new(NULL);
-        sk=sk_X509_NAME_new(name_cmp);
+        sk=sk_X509_NAME_new(xname_cmp);
 
         in=BIO_new(BIO_s_file_internal());
 
@@ -617,7 +634,7 @@ int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
     int ret=1;
     int (*oldcmp)(X509_NAME **a, X509_NAME **b);
 
-    oldcmp=sk_X509_NAME_set_cmp_func(stack,name_cmp);
+    oldcmp=sk_X509_NAME_set_cmp_func(stack,xname_cmp);
 
     in=BIO_new(BIO_s_file_internal());
 
@@ -671,6 +688,7 @@ err:
 
 #ifndef WIN32
 #ifndef VMS                     /* XXXX This may be fixed in the future */
+#ifndef MAC_OS_pre_X
 
 int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
                                        const char *dir)
@@ -714,3 +732,4 @@ err:
 
 #endif
 #endif
+#endif
diff --git a/src/lib/libssl/src/ssl/ssl_ciph.c b/src/lib/libssl/src/ssl/ssl_ciph.c
index 4c2989c47a..1cbc2886e9 100644
--- a/src/lib/libssl/src/ssl/ssl_ciph.c
+++ b/src/lib/libssl/src/ssl/ssl_ciph.c
@@ -83,24 +83,11 @@ static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={
         NULL,NULL,
         };
 
-typedef struct cipher_sort_st
-        {
-        SSL_CIPHER *cipher;
-        int pref;
-        } CIPHER_SORT;
-
 #define CIPHER_ADD      1
 #define CIPHER_KILL     2
 #define CIPHER_DEL      3
 #define CIPHER_ORD      4
-
-typedef struct cipher_choice_st
-        {
-        int type;
-        unsigned long algorithms;
-        unsigned long mask;
-        long top;
-        } CIPHER_CHOICE;
+#define CIPHER_SPECIAL  5
 
 typedef struct cipher_order_st
         {
@@ -110,59 +97,55 @@ typedef struct cipher_order_st
         struct cipher_order_st *next,*prev;
         } CIPHER_ORDER;
 
-static SSL_CIPHER cipher_aliases[]={
+static const SSL_CIPHER cipher_aliases[]={
         /* Don't include eNULL unless specifically enabled */
-        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, 0,SSL_ALL}, /* must be first */
-        {0,SSL_TXT_kRSA,0,SSL_kRSA,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_kDHr,0,SSL_kDHr,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_kDHd,0,SSL_kDHd,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_kEDH,0,SSL_kEDH,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_kFZA,0,SSL_kFZA,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_DH,  0,SSL_DH,    0,SSL_MKEY_MASK},
-        {0,SSL_TXT_EDH, 0,SSL_EDH,   0,SSL_MKEY_MASK|SSL_AUTH_MASK},
-
-        {0,SSL_TXT_aRSA,0,SSL_aRSA,  0,SSL_AUTH_MASK},
-        {0,SSL_TXT_aDSS,0,SSL_aDSS,  0,SSL_AUTH_MASK},
-        {0,SSL_TXT_aFZA,0,SSL_aFZA,  0,SSL_AUTH_MASK},
-        {0,SSL_TXT_aNULL,0,SSL_aNULL,0,SSL_AUTH_MASK},
-        {0,SSL_TXT_aDH, 0,SSL_aDH,   0,SSL_AUTH_MASK},
-        {0,SSL_TXT_DSS, 0,SSL_DSS,   0,SSL_AUTH_MASK},
-
-        {0,SSL_TXT_DES, 0,SSL_DES,   0,SSL_ENC_MASK},
-        {0,SSL_TXT_3DES,0,SSL_3DES,  0,SSL_ENC_MASK},
-        {0,SSL_TXT_RC4, 0,SSL_RC4,   0,SSL_ENC_MASK},
-        {0,SSL_TXT_RC2, 0,SSL_RC2,   0,SSL_ENC_MASK},
-        {0,SSL_TXT_IDEA,0,SSL_IDEA,  0,SSL_ENC_MASK},
-        {0,SSL_TXT_eNULL,0,SSL_eNULL,0,SSL_ENC_MASK},
-        {0,SSL_TXT_eFZA,0,SSL_eFZA,  0,SSL_ENC_MASK},
-
-        {0,SSL_TXT_MD5, 0,SSL_MD5,   0,SSL_MAC_MASK},
-        {0,SSL_TXT_SHA1,0,SSL_SHA1,  0,SSL_MAC_MASK},
-        {0,SSL_TXT_SHA, 0,SSL_SHA,   0,SSL_MAC_MASK},
-
-        {0,SSL_TXT_NULL,0,SSL_NULL,  0,SSL_ENC_MASK},
-        {0,SSL_TXT_RSA, 0,SSL_RSA,   0,SSL_AUTH_MASK|SSL_MKEY_MASK},
-        {0,SSL_TXT_ADH, 0,SSL_ADH,   0,SSL_AUTH_MASK|SSL_MKEY_MASK},
-        {0,SSL_TXT_FZA, 0,SSL_FZA,   0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK},
-
-        {0,SSL_TXT_EXP40, 0,SSL_EXP40, 0,SSL_EXP_MASK},
-        {0,SSL_TXT_EXPORT,0,SSL_EXP40, 0,SSL_EXP_MASK},
-        {0,SSL_TXT_EXP56, 0,SSL_EXP56, 0,SSL_EXP_MASK},
-        {0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,SSL_SSL_MASK},
-        {0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,SSL_SSL_MASK},
-        {0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,SSL_SSL_MASK},
-        {0,SSL_TXT_LOW,   0,SSL_LOW,   0,SSL_STRONG_MASK},
-        {0,SSL_TXT_MEDIUM,0,SSL_MEDIUM,0,SSL_STRONG_MASK},
-        {0,SSL_TXT_HIGH,  0,SSL_HIGH,  0,SSL_STRONG_MASK},
+        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
+        {0,SSL_TXT_kRSA,0,SSL_kRSA,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_kDHr,0,SSL_kDHr,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_kDHd,0,SSL_kDHd,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_kEDH,0,SSL_kEDH,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_kFZA,0,SSL_kFZA,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_DH,  0,SSL_DH,    0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_EDH, 0,SSL_EDH,   0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0},
+
+        {0,SSL_TXT_aRSA,0,SSL_aRSA,  0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_aDSS,0,SSL_aDSS,  0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_aFZA,0,SSL_aFZA,  0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_aNULL,0,SSL_aNULL,0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_aDH, 0,SSL_aDH,   0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_DSS, 0,SSL_DSS,   0,0,0,0,SSL_AUTH_MASK,0},
+
+        {0,SSL_TXT_DES, 0,SSL_DES,   0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_3DES,0,SSL_3DES,  0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_RC4, 0,SSL_RC4,   0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_RC2, 0,SSL_RC2,   0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_IDEA,0,SSL_IDEA,  0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_eFZA,0,SSL_eFZA,  0,0,0,0,SSL_ENC_MASK,0},
+
+        {0,SSL_TXT_MD5, 0,SSL_MD5,   0,0,0,0,SSL_MAC_MASK,0},
+        {0,SSL_TXT_SHA1,0,SSL_SHA1,  0,0,0,0,SSL_MAC_MASK,0},
+        {0,SSL_TXT_SHA, 0,SSL_SHA,   0,0,0,0,SSL_MAC_MASK,0},
+
+        {0,SSL_TXT_NULL,0,SSL_NULL,  0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_RSA, 0,SSL_RSA,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
+        {0,SSL_TXT_ADH, 0,SSL_ADH,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
+        {0,SSL_TXT_FZA, 0,SSL_FZA,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK,0},
+
+        {0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,0,0,0,SSL_SSL_MASK,0},
+        {0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,0,0,0,SSL_SSL_MASK,0},
+        {0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,0,0,0,SSL_SSL_MASK,0},
+
+        {0,SSL_TXT_EXP   ,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK},
+        {0,SSL_TXT_EXPORT,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK},
+        {0,SSL_TXT_EXP40, 0, 0, SSL_EXP40, 0,0,0,0,SSL_STRONG_MASK},
+        {0,SSL_TXT_EXP56, 0, 0, SSL_EXP56, 0,0,0,0,SSL_STRONG_MASK},
+        {0,SSL_TXT_LOW,   0, 0,   SSL_LOW, 0,0,0,0,SSL_STRONG_MASK},
+        {0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK},
+        {0,SSL_TXT_HIGH,  0, 0,  SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK},
         };
 
 static int init_ciphers=1;
-static void load_ciphers();
-
-static int cmp_by_name(SSL_CIPHER **a, SSL_CIPHER **b)
-        {
-        return(strcmp((*a)->name,(*b)->name));
-        }
 
 static void load_ciphers(void)
         {
@@ -294,170 +277,320 @@ static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
         *tail=curr;
         }
 
-STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *ssl_method,
-                STACK_OF(SSL_CIPHER) **cipher_list,
-                STACK_OF(SSL_CIPHER) **cipher_list_by_id,
-                char *str)
+static unsigned long ssl_cipher_get_disabled(void)
         {
-        SSL_CIPHER *c;
-        char *l;
-        STACK_OF(SSL_CIPHER) *ret=NULL,*ok=NULL;
-#define CL_BUF  40
-        char buf[CL_BUF];
-        char *tmp_str=NULL;
-        unsigned long mask,algorithms,ma;
-        char *start;
-        int i,j,k,num=0,ch,multi;
-        unsigned long al;
-        STACK *ca_list=NULL;
-        int current_x,num_x;
-        CIPHER_CHOICE *ops=NULL;
-        CIPHER_ORDER *list=NULL,*head=NULL,*tail=NULL,*curr,*tail2,*curr2;
-        int list_num;
-        int type;
-        SSL_CIPHER c_tmp,*cp;
-
-        if (str == NULL) return(NULL);
-
-        if (strncmp(str,"DEFAULT",7) == 0)
-                {
-                i=strlen(str)+2+strlen(SSL_DEFAULT_CIPHER_LIST);
-                if ((tmp_str=Malloc(i)) == NULL)
-                        {
-                        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
-                        goto err;
-                        }
-                strcpy(tmp_str,SSL_DEFAULT_CIPHER_LIST);
-                strcat(tmp_str,":");
-                strcat(tmp_str,&(str[7]));
-                str=tmp_str;
-                }
-        if (init_ciphers) load_ciphers();
-
-        num=ssl_method->num_ciphers();
-
-        if ((ret=sk_SSL_CIPHER_new(NULL)) == NULL) goto err;
-        if ((ca_list=(STACK *)sk_new(cmp_by_name)) == NULL) goto err;
+        unsigned long mask;
 
-        mask =SSL_kFZA;
+        mask = SSL_kFZA;
 #ifdef NO_RSA
-        mask|=SSL_aRSA|SSL_kRSA;
+        mask |= SSL_aRSA|SSL_kRSA;
 #endif
 #ifdef NO_DSA
-        mask|=SSL_aDSS;
+        mask |= SSL_aDSS;
 #endif
 #ifdef NO_DH
-        mask|=SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
+        mask |= SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
 #endif
 
 #ifdef SSL_FORBID_ENULL
-        mask|=SSL_eNULL;
+        mask |= SSL_eNULL;
 #endif
 
-        mask|=(ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL)?SSL_DES :0;
-        mask|=(ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL)?SSL_3DES:0;
-        mask|=(ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL)?SSL_RC4 :0;
-        mask|=(ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL)?SSL_RC2 :0;
-        mask|=(ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL)?SSL_IDEA:0;
-        mask|=(ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL)?SSL_eFZA:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL) ? SSL_DES :0;
+        mask |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL) ? SSL_RC4 :0;
+        mask |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0;
+        mask |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL) ? SSL_eFZA:0;
+
+        mask |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0;
+        mask |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0;
 
-        mask|=(ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL)?SSL_MD5 :0;
-        mask|=(ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL)?SSL_SHA1:0;
+        return(mask);
+        }
+
+static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
+                int num_of_ciphers, unsigned long mask, CIPHER_ORDER *list,
+                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
+        {
+        int i, list_num;
+        SSL_CIPHER *c;
 
-        if ((list=(CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER)*num)) == NULL)
-                goto err;
+        /*
+         * We have num_of_ciphers descriptions compiled in, depending on the
+         * method selected (SSLv2 and/or SSLv3, TLSv1 etc).
+         * These will later be sorted in a linked list with at most num
+         * entries.
+         */
 
         /* Get the initial list of ciphers */
-        list_num=0;
-        for (i=0; i<num; i++)
+        list_num = 0;   /* actual count of ciphers */
+        for (i = 0; i < num_of_ciphers; i++)
                 {
-                c=ssl_method->get_cipher((unsigned int)i);
+                c = ssl_method->get_cipher(i);
                 /* drop those that use any of that is not available */
                 if ((c != NULL) && c->valid && !(c->algorithms & mask))
                         {
-                        list[list_num].cipher=c;
-                        list[list_num].next=NULL;
-                        list[list_num].prev=NULL;
-                        list[list_num].active=0;
+                        list[list_num].cipher = c;
+                        list[list_num].next = NULL;
+                        list[list_num].prev = NULL;
+                        list[list_num].active = 0;
                         list_num++;
+                        /*
                         if (!sk_push(ca_list,(char *)c)) goto err;
+                        */
                         }
                 }
-        
-        for (i=1; i<list_num-1; i++)
+
+        /*
+         * Prepare linked list from list entries
+         */     
+        for (i = 1; i < list_num - 1; i++)
                 {
-                list[i].prev= &(list[i-1]);
-                list[i].next= &(list[i+1]);
+                list[i].prev = &(list[i-1]);
+                list[i].next = &(list[i+1]);
                 }
         if (list_num > 0)
                 {
-                head= &(list[0]);
-                head->prev=NULL;
-                head->next= &(list[1]);
-                tail= &(list[list_num-1]);
-                tail->prev= &(list[list_num-2]);
-                tail->next=NULL;
+                (*head_p) = &(list[0]);
+                (*head_p)->prev = NULL;
+                (*head_p)->next = &(list[1]);
+                (*tail_p) = &(list[list_num - 1]);
+                (*tail_p)->prev = &(list[list_num - 2]);
+                (*tail_p)->next = NULL;
                 }
+        }
 
-        /* special case */
-        cipher_aliases[0].algorithms &= ~mask;
+static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list,
+                        int num_of_group_aliases, unsigned long mask,
+                        CIPHER_ORDER *head)
+        {
+        CIPHER_ORDER *ciph_curr;
+        SSL_CIPHER **ca_curr;
+        int i;
 
-        /* get the aliases */
-        k=sizeof(cipher_aliases)/sizeof(SSL_CIPHER);
-        for (j=0; j<k; j++)
+        /*
+         * First, add the real ciphers as already collected
+         */
+        ciph_curr = head;
+        ca_curr = ca_list;
+        while (ciph_curr != NULL)
                 {
-                al=cipher_aliases[j].algorithms;
-                /* Drop those that are not relevent */
-                if ((al & mask) == al) continue;
-                if (!sk_push(ca_list,(char *)&(cipher_aliases[j]))) goto err;
+                *ca_curr = ciph_curr->cipher;
+                ca_curr++;
+                ciph_curr = ciph_curr->next;
                 }
 
-        /* ca_list now holds a 'stack' of SSL_CIPHERS, some real, some
-         * 'aliases' */
+        /*
+         * Now we add the available ones from the cipher_aliases[] table.
+         * They represent either an algorithm, that must be fully
+         * supported (not match any bit in mask) or represent a cipher
+         * strength value (will be added in any case because algorithms=0).
+         */
+        for (i = 0; i < num_of_group_aliases; i++)
+                {
+                if ((i == 0) ||         /* always fetch "ALL" */
+                    !(cipher_aliases[i].algorithms & mask))
+                        {
+                        *ca_curr = (SSL_CIPHER *)(cipher_aliases + i);
+                        ca_curr++;
+                        }
+                }
 
-        /* how many parameters are there? */
-        num=1;
-        for (l=str; *l; l++)
-                if (ITEM_SEP(*l))
-                        num++;
-        ops=(CIPHER_CHOICE *)Malloc(sizeof(CIPHER_CHOICE)*num);
-        if (ops == NULL) goto err;
-        memset(ops,0,sizeof(CIPHER_CHOICE)*num);
+        *ca_curr = NULL;        /* end of list */
+        }
 
-        /* we now parse the input string and create our operations */
-        l=str;
-        i=0;
-        current_x=0;
+static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
+                unsigned long algo_strength, unsigned long mask_strength,
+                int rule, int strength_bits, CIPHER_ORDER *list,
+                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
+        {
+        CIPHER_ORDER *head, *tail, *curr, *curr2, *tail2;
+        SSL_CIPHER *cp;
+        unsigned long ma, ma_s;
 
+#ifdef CIPHER_DEBUG
+        printf("Applying rule %d with %08lx %08lx %08lx %08lx (%d)\n",
+                rule, algorithms, mask, algo_strength, mask_strength,
+                strength_bits);
+#endif
+
+        curr = head = *head_p;
+        curr2 = head;
+        tail2 = tail = *tail_p;
         for (;;)
                 {
-                ch= *l;
+                if ((curr == NULL) || (curr == tail2)) break;
+                curr = curr2;
+                curr2 = curr->next;
+
+                cp = curr->cipher;
+
+                /*
+                 * Selection criteria is either the number of strength_bits
+                 * or the algorithm used.
+                 */
+                if (strength_bits == -1)
+                        {
+                        ma = mask & cp->algorithms;
+                        ma_s = mask_strength & cp->algo_strength;
+
+#ifdef CIPHER_DEBUG
+                        printf("\nName: %s:\nAlgo = %08lx Algo_strength = %08lx\nMask = %08lx Mask_strength %08lx\n", cp->name, cp->algorithms, cp->algo_strength, mask, mask_strength);
+                        printf("ma = %08lx ma_s %08lx, ma&algo=%08lx, ma_s&algos=%08lx\n", ma, ma_s, ma&algorithms, ma_s&algo_strength);
+#endif
+                        /*
+                         * Select: if none of the mask bit was met from the
+                         * cipher or not all of the bits were met, the
+                         * selection does not apply.
+                         */
+                        if (((ma == 0) && (ma_s == 0)) ||
+                            ((ma & algorithms) != ma) ||
+                            ((ma_s & algo_strength) != ma_s))
+                                continue; /* does not apply */
+                        }
+                else if (strength_bits != cp->strength_bits)
+                        continue;       /* does not apply */
+
+#ifdef CIPHER_DEBUG
+                printf("Action = %d\n", rule);
+#endif
+
+                /* add the cipher if it has not been added yet. */
+                if (rule == CIPHER_ADD)
+                        {
+                        if (!curr->active)
+                                {
+                                ll_append_tail(&head, curr, &tail);
+                                curr->active = 1;
+                                }
+                        }
+                /* Move the added cipher to this location */
+                else if (rule == CIPHER_ORD)
+                        {
+                        if (curr->active)
+                                {
+                                ll_append_tail(&head, curr, &tail);
+                                }
+                        }
+                else if (rule == CIPHER_DEL)
+                        curr->active = 0;
+                else if (rule == CIPHER_KILL)
+                        {
+                        if (head == curr)
+                                head = curr->next;
+                        else
+                                curr->prev->next = curr->next;
+                        if (tail == curr)
+                                tail = curr->prev;
+                        curr->active = 0;
+                        if (curr->next != NULL)
+                                curr->next->prev = curr->prev;
+                        if (curr->prev != NULL)
+                                curr->prev->next = curr->next;
+                        curr->next = NULL;
+                        curr->prev = NULL;
+                        }
+                }
+
+        *head_p = head;
+        *tail_p = tail;
+        }
+
+static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p,
+                                     CIPHER_ORDER **tail_p)
+        {
+        int max_strength_bits, i, *number_uses;
+        CIPHER_ORDER *curr;
+
+        /*
+         * This routine sorts the ciphers with descending strength. The sorting
+         * must keep the pre-sorted sequence, so we apply the normal sorting
+         * routine as '+' movement to the end of the list.
+         */
+        max_strength_bits = 0;
+        curr = *head_p;
+        while (curr != NULL)
+                {
+                if (curr->active &&
+                    (curr->cipher->strength_bits > max_strength_bits))
+                    max_strength_bits = curr->cipher->strength_bits;
+                curr = curr->next;
+                }
+
+        number_uses = Malloc((max_strength_bits + 1) * sizeof(int));
+        if (!number_uses)
+        {
+                SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT,ERR_R_MALLOC_FAILURE);
+                return(0);
+        }
+        memset(number_uses, 0, (max_strength_bits + 1) * sizeof(int));
+
+        /*
+         * Now find the strength_bits values actually used
+         */
+        curr = *head_p;
+        while (curr != NULL)
+                {
+                if (curr->active)
+                        number_uses[curr->cipher->strength_bits]++;
+                curr = curr->next;
+                }
+        /*
+         * Go through the list of used strength_bits values in descending
+         * order.
+         */
+        for (i = max_strength_bits; i >= 0; i--)
+                if (number_uses[i] > 0)
+                        ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
+                                        list, head_p, tail_p);
+
+        Free(number_uses);
+        return(1);
+        }
 
-                if (ch == '\0') break;
+static int ssl_cipher_process_rulestr(const char *rule_str,
+                CIPHER_ORDER *list, CIPHER_ORDER **head_p,
+                CIPHER_ORDER **tail_p, SSL_CIPHER **ca_list)
+        {
+        unsigned long algorithms, mask, algo_strength, mask_strength;
+        const char *l, *start, *buf;
+        int j, multi, found, rule, retval, ok, buflen;
+        char ch;
+
+        retval = 1;
+        l = rule_str;
+        for (;;)
+                {
+                ch = *l;
 
+                if (ch == '\0')
+                        break;          /* done */
                 if (ch == '-')
-                        { j=CIPHER_DEL; l++; }
+                        { rule = CIPHER_DEL; l++; }
                 else if (ch == '+')
-                        { j=CIPHER_ORD; l++; }
+                        { rule = CIPHER_ORD; l++; }
                 else if (ch == '!')
-                        { j=CIPHER_KILL; l++; }
-                else    
-                        { j=CIPHER_ADD; }
+                        { rule = CIPHER_KILL; l++; }
+                else if (ch == '@')
+                        { rule = CIPHER_SPECIAL; l++; }
+                else
+                        { rule = CIPHER_ADD; }
 
                 if (ITEM_SEP(ch))
                         {
                         l++;
                         continue;
                         }
-                ops[current_x].type=j;
-                ops[current_x].algorithms=0;
-                ops[current_x].mask=0;
+
+                algorithms = mask = algo_strength = mask_strength = 0;
 
                 start=l;
                 for (;;)
                         {
-                        ch= *l;
-                        i=0;
+                        ch = *l;
+                        buf = l;
+                        buflen = 0;
 #ifndef CHARSET_EBCDIC
                         while ( ((ch >= 'A') && (ch <= 'Z')) ||
                                 ((ch >= '0') && (ch <= '9')) ||
@@ -467,12 +600,28 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *ssl_method,
                         while ( isalnum(ch) || (ch == '-'))
 #endif
                                  {
-                                 buf[i]=ch;
-                                 ch= *(++l);
-                                 i++;
-                                 if (i >= (CL_BUF-2)) break;
+                                 ch = *(++l);
+                                 buflen++;
                                  }
-                        buf[i]='\0';
+
+                        if (buflen == 0)
+                                {
+                                /*
+                                 * We hit something, we cannot deal with,
+                                 * it is no command or separator nor
+                                 * alphanumeric, so we call this an error.
+                                 */
+                                SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
+                                       SSL_R_INVALID_COMMAND);
+                                retval = found = 0;
+                                l++;
+                                break;
+                                }
+
+                        if (rule == CIPHER_SPECIAL)
+                                {
+                                break;  /* special treatment */
+                                }
 
                         /* check for multi-part specification */
                         if (ch == '+')
@@ -483,133 +632,237 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *ssl_method,
                         else
                                 multi=0;
 
-                        c_tmp.name=buf;
-                        j=sk_find(ca_list,(char *)&c_tmp);
-                        if (j < 0)
-                                goto end_loop;
+                        /*
+                         * Now search for the name in the ca_list. Be careful
+                         * with the strncmp, because the "buflen" limitation
+                         * will make the rule "ADH:SOME" and the cipher
+                         * "ADH-MY-CIPHER" look like a match for buflen=3.
+                         * So additionally check, whether the cipher name found
+                         * has the correct length. We can save a strlen() call,
+                         * just checking for the '\0' at the right place is
+                         * sufficient, we have to strncmp() anyway.
+                         */
+                         j = found = 0;
+                         while (ca_list[j])
+                                {
+                                if ((ca_list[j]->name[buflen] == '\0') &&
+                                    !strncmp(buf, ca_list[j]->name, buflen))
+                                        {
+                                        found = 1;
+                                        break;
+                                        }
+                                else
+                                        j++;
+                                }
+                        if (!found)
+                                break;  /* ignore this entry */
+
+                        algorithms |= ca_list[j]->algorithms;
+                        mask |= ca_list[j]->mask;
+                        algo_strength |= ca_list[j]->algo_strength;
+                        mask_strength |= ca_list[j]->mask_strength;
 
-                        cp=(SSL_CIPHER *)sk_value(ca_list,j);
-                        ops[current_x].algorithms|=cp->algorithms;
-                        /* We add the SSL_SSL_MASK so we can match the
-                         * SSLv2 and SSLv3 versions of RC4-MD5 */
-                        ops[current_x].mask|=cp->mask;
                         if (!multi) break;
                         }
-                current_x++;
-                if (ch == '\0') break;
-end_loop:
-                /* Make sure we scan until the next valid start point */
-                while ((*l != '\0') && ITEM_SEP(*l))
-                        l++;
+
+                        /*
+                         * Ok, we have the rule, now apply it
+                         */
+                        if (rule == CIPHER_SPECIAL)
+                                {       /* special command */
+                                ok = 0;
+                                if ((buflen == 8) &&
+                                        !strncmp(buf, "STRENGTH", 8))
+                                        ok = ssl_cipher_strength_sort(list,
+                                                        head_p, tail_p);
+                                else
+                                        SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
+                                                SSL_R_INVALID_COMMAND);
+                                if (ok == 0)
+                                        retval = 0;
+                                /*
+                                 * We do not support any "multi" options
+                                 * together with "@", so throw away the
+                                 * rest of the command, if any left, until
+                                 * end or ':' is found.
+                                 */
+                                while ((*l != '\0') && ITEM_SEP(*l))
+                                        l++;
+                                }
+                        else if (found)
+                                {
+                                ssl_cipher_apply_rule(algorithms, mask,
+                                        algo_strength, mask_strength, rule, -1,
+                                        list, head_p, tail_p);
+                                }
+                        else
+                                {
+                                while ((*l != '\0') && ITEM_SEP(*l))
+                                        l++;
+                                }
+                        if (*l == '\0') break; /* done */
                 }
 
-        num_x=current_x;
-        current_x=0;
+        return(retval);
+        }
 
-        /* We will now process the list of ciphers, once for each category, to
-         * decide what we should do with it. */
-        for (j=0; j<num_x; j++)
+STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
+                STACK_OF(SSL_CIPHER) **cipher_list,
+                STACK_OF(SSL_CIPHER) **cipher_list_by_id,
+                const char *rule_str)
+        {
+        int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
+        unsigned long disabled_mask;
+        STACK_OF(SSL_CIPHER) *cipherstack;
+        const char *rule_p;
+        CIPHER_ORDER *list = NULL, *head = NULL, *tail = NULL, *curr;
+        SSL_CIPHER **ca_list = NULL;
+
+        /*
+         * Return with error if nothing to do.
+         */
+        if (rule_str == NULL) return(NULL);
+
+        if (init_ciphers) load_ciphers();
+
+        /*
+         * To reduce the work to do we only want to process the compiled
+         * in algorithms, so we first get the mask of disabled ciphers.
+         */
+        disabled_mask = ssl_cipher_get_disabled();
+
+        /*
+         * Now we have to collect the available ciphers from the compiled
+         * in ciphers. We cannot get more than the number compiled in, so
+         * it is used for allocation.
+         */
+        num_of_ciphers = ssl_method->num_ciphers();
+        list = (CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
+        if (list == NULL)
                 {
-                algorithms=ops[j].algorithms;
-                type=ops[j].type;
-                mask=ops[j].mask;
+                SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
+                return(NULL);   /* Failure */
+                }
 
-                curr=head;
-                curr2=head;
-                tail2=tail;
-                for (;;)
-                        {
-                        if ((curr == NULL) || (curr == tail2)) break;
-                        curr=curr2;
-                        curr2=curr->next;
+        ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask,
+                                   list, &head, &tail);
+
+        /*
+         * We also need cipher aliases for selecting based on the rule_str.
+         * There might be two types of entries in the rule_str: 1) names
+         * of ciphers themselves 2) aliases for groups of ciphers.
+         * For 1) we need the available ciphers and for 2) the cipher
+         * groups of cipher_aliases added together in one list (otherwise
+         * we would be happy with just the cipher_aliases table).
+         */
+        num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
+        num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
+        ca_list =
+                (SSL_CIPHER **)Malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
+        if (ca_list == NULL)
+                {
+                Free(list);
+                SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
+                return(NULL);   /* Failure */
+                }
+        ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mask,
+                                   head);
+
+        /*
+         * If the rule_string begins with DEFAULT, apply the default rule
+         * before using the (possibly available) additional rules.
+         */
+        ok = 1;
+        rule_p = rule_str;
+        if (strncmp(rule_str,"DEFAULT",7) == 0)
+                {
+                ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
+                        list, &head, &tail, ca_list);
+                rule_p += 7;
+                if (*rule_p == ':')
+                        rule_p++;
+                }
 
-                        cp=curr->cipher;
-                        ma=mask & cp->algorithms;
-                        if ((ma == 0) || ((ma & algorithms) != ma))
-                                {
-                                /* does not apply */
-                                continue;
-                                }
+        if (ok && (strlen(rule_p) > 0))
+                ok = ssl_cipher_process_rulestr(rule_p, list, &head, &tail,
+                                                ca_list);
 
-                        /* add the cipher if it has not been added yet. */
-                        if (type == CIPHER_ADD)
-                                {
-                                if (!curr->active)
-                                        {
-                                        ll_append_tail(&head,curr,&tail);
-                                        curr->active=1;
-                                        }
-                                }
-                        /* Move the added cipher to this location */
-                        else if (type == CIPHER_ORD)
-                                {
-                                if (curr->active)
-                                        {
-                                        ll_append_tail(&head,curr,&tail);
-                                        }
-                                }
-                        else if (type == CIPHER_DEL)
-                                curr->active=0;
-                        if (type == CIPHER_KILL)
-                                {
-                                if (head == curr)
-                                        head=curr->next;
-                                else
-                                        curr->prev->next=curr->next;
-                                if (tail == curr)
-                                        tail=curr->prev;
-                                curr->active=0;
-                                if (curr->next != NULL)
-                                        curr->next->prev=curr->prev;
-                                if (curr->prev != NULL)
-                                        curr->prev->next=curr->next;
-                                curr->next=NULL;
-                                curr->prev=NULL;
-                                }
-                        }
+        Free(ca_list);  /* Not needed anymore */
+
+        if (!ok)
+                {       /* Rule processing failure */
+                Free(list);
+                return(NULL);
+                }
+        /*
+         * Allocate new "cipherstack" for the result, return with error
+         * if we cannot get one.
+         */
+        if ((cipherstack = sk_SSL_CIPHER_new(NULL)) == NULL)
+                {
+                Free(list);
+                return(NULL);
                 }
 
-        for (curr=head; curr != NULL; curr=curr->next)
+        /*
+         * The cipher selection for the list is done. The ciphers are added
+         * to the resulting precedence to the STACK_OF(SSL_CIPHER).
+         */
+        for (curr = head; curr != NULL; curr = curr->next)
                 {
                 if (curr->active)
                         {
-                        sk_SSL_CIPHER_push(ret,curr->cipher);
+                        sk_SSL_CIPHER_push(cipherstack, curr->cipher);
 #ifdef CIPHER_DEBUG
                         printf("<%s>\n",curr->cipher->name);
 #endif
                         }
                 }
-
+        Free(list);     /* Not needed any longer */
+
+        /*
+         * The following passage is a little bit odd. If pointer variables
+         * were supplied to hold STACK_OF(SSL_CIPHER) return information,
+         * the old memory pointed to is free()ed. Then, however, the
+         * cipher_list entry will be assigned just a copy of the returned
+         * cipher stack. For cipher_list_by_id a copy of the cipher stack
+         * will be created. See next comment...
+         */
         if (cipher_list != NULL)
                 {
                 if (*cipher_list != NULL)
                         sk_SSL_CIPHER_free(*cipher_list);
-                *cipher_list=ret;
+                *cipher_list = cipherstack;
                 }
 
         if (cipher_list_by_id != NULL)
                 {
                 if (*cipher_list_by_id != NULL)
                         sk_SSL_CIPHER_free(*cipher_list_by_id);
-                *cipher_list_by_id=sk_SSL_CIPHER_dup(ret);
+                *cipher_list_by_id = sk_SSL_CIPHER_dup(cipherstack);
                 }
 
+        /*
+         * Now it is getting really strange. If something failed during
+         * the previous pointer assignment or if one of the pointers was
+         * not requested, the error condition is met. That might be
+         * discussable. The strange thing is however that in this case
+         * the memory "ret" pointed to is "free()ed" and hence the pointer
+         * cipher_list becomes wild. The memory reserved for
+         * cipher_list_by_id however is not "free()ed" and stays intact.
+         */
         if (    (cipher_list_by_id == NULL) ||
                 (*cipher_list_by_id == NULL) ||
                 (cipher_list == NULL) ||
                 (*cipher_list == NULL))
-                goto err;
+                {
+                sk_SSL_CIPHER_free(cipherstack);
+                return(NULL);
+                }
+
         sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
 
-        ok=ret;
-        ret=NULL;
-err:
-        if (tmp_str) Free(tmp_str);
-        if (ops != NULL) Free(ops);
-        if (ret != NULL) sk_SSL_CIPHER_free(ret);
-        if (ca_list != NULL) sk_free(ca_list);
-        if (list != NULL) Free(list);
-        return(ok);
+        return(cipherstack);
         }
 
 char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
@@ -617,15 +870,16 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         int is_export,pkl,kl;
         char *ver,*exp;
         char *kx,*au,*enc,*mac;
-        unsigned long alg,alg2;
+        unsigned long alg,alg2,alg_s;
         static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
         
         alg=cipher->algorithms;
+        alg_s=cipher->algo_strength;
         alg2=cipher->algorithm2;
 
-        is_export=SSL_IS_EXPORT(alg);
-        pkl=SSL_EXPORT_PKEYLENGTH(alg);
-        kl=SSL_EXPORT_KEYLENGTH(alg);
+        is_export=SSL_C_IS_EXPORT(cipher);
+        pkl=SSL_C_EXPORT_PKEYLENGTH(cipher);
+        kl=SSL_C_EXPORT_KEYLENGTH(cipher);
         exp=is_export?" export":"";
 
         if (alg & SSL_SSLV2)
@@ -752,37 +1006,16 @@ const char *SSL_CIPHER_get_name(SSL_CIPHER *c)
         return("(NONE)");
         }
 
-/* number of bits for symetric cipher */
+/* number of bits for symmetric cipher */
 int SSL_CIPHER_get_bits(SSL_CIPHER *c, int *alg_bits)
         {
-        int ret=0,a=0;
-        const EVP_CIPHER *enc;
-        const EVP_MD *md;
-        SSL_SESSION ss;
+        int ret=0;
 
         if (c != NULL)
                 {
-                ss.cipher=c;
-                if (!ssl_cipher_get_evp(&ss,&enc,&md,NULL))
-                        return(0);
-
-                a=EVP_CIPHER_key_length(enc)*8;
-
-                if (SSL_C_IS_EXPORT(c))
-                        {
-                        ret=SSL_C_EXPORT_KEYLENGTH(c)*8;
-                        }
-                else
-                        {
-                        if (c->algorithm2 & SSL2_CF_8_BYTE_ENC)
-                                ret=64;
-                        else
-                                ret=a;
-                        }
+                if (alg_bits != NULL) *alg_bits = c->alg_bits;
+                ret = c->strength_bits;
                 }
-
-        if (alg_bits != NULL) *alg_bits=a;
-        
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/ssl/ssl_err.c b/src/lib/libssl/src/ssl/ssl_err.c
index 3ddc805b53..5618e34a30 100644
--- a/src/lib/libssl/src/ssl/ssl_err.c
+++ b/src/lib/libssl/src/ssl/ssl_err.c
@@ -135,13 +135,18 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_PACK(0,SSL_F_SSL_CERT_INSTANTIATE,0),      "SSL_CERT_INSTANTIATE"},
 {ERR_PACK(0,SSL_F_SSL_CERT_NEW,0),      "SSL_CERT_NEW"},
 {ERR_PACK(0,SSL_F_SSL_CHECK_PRIVATE_KEY,0),     "SSL_check_private_key"},
+{ERR_PACK(0,SSL_F_SSL_CIPHER_PROCESS_RULESTR,0),        "SSL_CIPHER_PROCESS_RULESTR"},
+{ERR_PACK(0,SSL_F_SSL_CIPHER_STRENGTH_SORT,0),  "SSL_CIPHER_STRENGTH_SORT"},
 {ERR_PACK(0,SSL_F_SSL_CLEAR,0), "SSL_clear"},
 {ERR_PACK(0,SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,0),   "SSL_COMP_add_compression_method"},
 {ERR_PACK(0,SSL_F_SSL_CREATE_CIPHER_LIST,0),    "SSL_CREATE_CIPHER_LIST"},
+{ERR_PACK(0,SSL_F_SSL_CTRL,0),  "SSL_ctrl"},
 {ERR_PACK(0,SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,0), "SSL_CTX_check_private_key"},
 {ERR_PACK(0,SSL_F_SSL_CTX_NEW,0),       "SSL_CTX_new"},
+{ERR_PACK(0,SSL_F_SSL_CTX_SET_PURPOSE,0),       "SSL_CTX_set_purpose"},
 {ERR_PACK(0,SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,0),    "SSL_CTX_set_session_id_context"},
 {ERR_PACK(0,SSL_F_SSL_CTX_SET_SSL_VERSION,0),   "SSL_CTX_set_ssl_version"},
+{ERR_PACK(0,SSL_F_SSL_CTX_SET_TRUST,0), "SSL_CTX_set_trust"},
 {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE,0),   "SSL_CTX_use_certificate"},
 {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,0),      "SSL_CTX_use_certificate_ASN1"},
 {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,0),        "SSL_CTX_use_certificate_chain_file"},
@@ -169,9 +174,11 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_PACK(0,SSL_F_SSL_SET_CERT,0),      "SSL_SET_CERT"},
 {ERR_PACK(0,SSL_F_SSL_SET_FD,0),        "SSL_set_fd"},
 {ERR_PACK(0,SSL_F_SSL_SET_PKEY,0),      "SSL_SET_PKEY"},
+{ERR_PACK(0,SSL_F_SSL_SET_PURPOSE,0),   "SSL_set_purpose"},
 {ERR_PACK(0,SSL_F_SSL_SET_RFD,0),       "SSL_set_rfd"},
 {ERR_PACK(0,SSL_F_SSL_SET_SESSION,0),   "SSL_set_session"},
 {ERR_PACK(0,SSL_F_SSL_SET_SESSION_ID_CONTEXT,0),        "SSL_set_session_id_context"},
+{ERR_PACK(0,SSL_F_SSL_SET_TRUST,0),     "SSL_set_trust"},
 {ERR_PACK(0,SSL_F_SSL_SET_WFD,0),       "SSL_set_wfd"},
 {ERR_PACK(0,SSL_F_SSL_SHUTDOWN,0),      "SSL_shutdown"},
 {ERR_PACK(0,SSL_F_SSL_UNDEFINED_FUNCTION,0),    "SSL_UNDEFINED_FUNCTION"},
@@ -201,7 +208,6 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_BAD_AUTHENTICATION_TYPE           ,"bad authentication type"},
 {SSL_R_BAD_CHANGE_CIPHER_SPEC            ,"bad change cipher spec"},
 {SSL_R_BAD_CHECKSUM                      ,"bad checksum"},
-{SSL_R_BAD_CLIENT_REQUEST                ,"bad client request"},
 {SSL_R_BAD_DATA_RETURNED_BY_CALLBACK     ,"bad data returned by callback"},
 {SSL_R_BAD_DECOMPRESSION                 ,"bad decompression"},
 {SSL_R_BAD_DH_G_LENGTH                   ,"bad dh g length"},
@@ -209,6 +215,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_BAD_DH_P_LENGTH                   ,"bad dh p length"},
 {SSL_R_BAD_DIGEST_LENGTH                 ,"bad digest length"},
 {SSL_R_BAD_DSA_SIGNATURE                 ,"bad dsa signature"},
+{SSL_R_BAD_HELLO_REQUEST                 ,"bad hello request"},
 {SSL_R_BAD_LENGTH                        ,"bad length"},
 {SSL_R_BAD_MAC_DECODE                    ,"bad mac decode"},
 {SSL_R_BAD_MESSAGE_TYPE                  ,"bad message type"},
@@ -248,6 +255,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG   ,"dh public value length is wrong"},
 {SSL_R_DIGEST_CHECK_FAILED               ,"digest check failed"},
 {SSL_R_ENCRYPTED_LENGTH_TOO_LONG         ,"encrypted length too long"},
+{SSL_R_ERROR_GENERATING_TMP_RSA_KEY      ,"error generating tmp rsa key"},
 {SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST     ,"error in received cipher list"},
 {SSL_R_EXCESSIVE_MESSAGE_SIZE            ,"excessive message size"},
 {SSL_R_EXTRA_DATA_IN_MESSAGE             ,"extra data in message"},
@@ -256,6 +264,9 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_HTTP_REQUEST                      ,"http request"},
 {SSL_R_INTERNAL_ERROR                    ,"internal error"},
 {SSL_R_INVALID_CHALLENGE_LENGTH          ,"invalid challenge length"},
+{SSL_R_INVALID_COMMAND                   ,"invalid command"},
+{SSL_R_INVALID_PURPOSE                   ,"invalid purpose"},
+{SSL_R_INVALID_TRUST                     ,"invalid trust"},
 {SSL_R_LENGTH_MISMATCH                   ,"length mismatch"},
 {SSL_R_LENGTH_TOO_SHORT                  ,"length too short"},
 {SSL_R_LIBRARY_BUG                       ,"library bug"},
@@ -348,14 +359,14 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_TLSV1_ALERT_DECODE_ERROR          ,"tlsv1 alert decode error"},
 {SSL_R_TLSV1_ALERT_DECRYPTION_FAILED     ,"tlsv1 alert decryption failed"},
 {SSL_R_TLSV1_ALERT_DECRYPT_ERROR         ,"tlsv1 alert decrypt error"},
-{SSL_R_TLSV1_ALERT_EXPORT_RESTRICION     ,"tlsv1 alert export restricion"},
+{SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION    ,"tlsv1 alert export restriction"},
 {SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY ,"tlsv1 alert insufficient security"},
 {SSL_R_TLSV1_ALERT_INTERNAL_ERROR        ,"tlsv1 alert internal error"},
 {SSL_R_TLSV1_ALERT_NO_RENEGOTIATION      ,"tlsv1 alert no renegotiation"},
 {SSL_R_TLSV1_ALERT_PROTOCOL_VERSION      ,"tlsv1 alert protocol version"},
 {SSL_R_TLSV1_ALERT_RECORD_OVERFLOW       ,"tlsv1 alert record overflow"},
 {SSL_R_TLSV1_ALERT_UNKNOWN_CA            ,"tlsv1 alert unknown ca"},
-{SSL_R_TLSV1_ALERT_USER_CANCLED          ,"tlsv1 alert user cancled"},
+{SSL_R_TLSV1_ALERT_USER_CANCELLED        ,"tlsv1 alert user cancelled"},
 {SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER,"tls client cert req with anon cipher"},
 {SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST,"tls peer did not respond with certificate list"},
 {SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG,"tls rsa encrypted value length is wrong"},
@@ -383,6 +394,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_UNKNOWN_STATE                     ,"unknown state"},
 {SSL_R_UNSUPPORTED_CIPHER                ,"unsupported cipher"},
 {SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM ,"unsupported compression algorithm"},
+{SSL_R_UNSUPPORTED_OPTION                ,"unsupported option"},
 {SSL_R_UNSUPPORTED_PROTOCOL              ,"unsupported protocol"},
 {SSL_R_UNSUPPORTED_SSL_VERSION           ,"unsupported ssl version"},
 {SSL_R_WRITE_BIO_NOT_SET                 ,"write bio not set"},
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index e192fc4cac..3109708480 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -61,22 +61,24 @@
 #include <stdio.h>
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
+#include <openssl/x509v3.h>
 #include "ssl_locl.h"
 
-char *SSL_version_str=OPENSSL_VERSION_TEXT;
+const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 
-static STACK *ssl_meth=NULL;
-static STACK *ssl_ctx_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_ctx_meth=NULL;
 static int ssl_meth_num=0;
 static int ssl_ctx_meth_num=0;
 
 OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={
+        /* evil casts, but these functions are only called if there's a library bug */
+        (int (*)(SSL *,int))ssl_undefined_function,
+        (int (*)(SSL *, unsigned char *, int))ssl_undefined_function,
         ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_undefined_function,
+        (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
+        (int (*)(SSL*, int))ssl_undefined_function,
+        (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function
         };
 
 int SSL_clear(SSL *s)
@@ -93,10 +95,17 @@ int SSL_clear(SSL *s)
         s->hit=0;
         s->shutdown=0;
 
-#if 0
+#if 0 /* Disabled since version 1.10 of this file (early return not
+       * needed because SSL_clear is not called when doing renegotiation) */
         /* This is set if we are doing dynamic renegotiation so keep
          * the old cipher.  It is sort of a SSL_clear_lite :-) */
         if (s->new_session) return(1);
+#else
+        if (s->new_session)
+                {
+                SSLerr(SSL_F_SSL_CLEAR,SSL_R_INTERNAL_ERROR);
+                return 0;
+                }
 #endif
 
         state=s->state; /* Keep to check if we throw away the session-id */
@@ -201,6 +210,8 @@ SSL *SSL_new(SSL_CTX *ctx)
         s->verify_mode=ctx->verify_mode;
         s->verify_depth=ctx->verify_depth;
         s->verify_callback=ctx->default_verify_callback;
+        s->purpose = ctx->purpose;
+        s->trust = ctx->trust;
         CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
         s->ctx=ctx;
 
@@ -218,7 +229,7 @@ SSL *SSL_new(SSL_CTX *ctx)
         s->mode=ctx->mode;
         SSL_clear(s);
 
-        CRYPTO_new_ex_data(ssl_meth,(char *)s,&s->ex_data);
+        CRYPTO_new_ex_data(ssl_meth,s,&s->ex_data);
 
         return(s);
 err:
@@ -262,6 +273,46 @@ int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
     return 1;
     }
 
+int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
+{
+        if(X509_PURPOSE_get_by_id(purpose) == -1) {
+                SSLerr(SSL_F_SSL_CTX_SET_PURPOSE, SSL_R_INVALID_PURPOSE);
+                return 0;
+        }
+        s->purpose = purpose;
+        return 1;
+}
+
+int SSL_set_purpose(SSL *s, int purpose)
+{
+        if(X509_PURPOSE_get_by_id(purpose) == -1) {
+                SSLerr(SSL_F_SSL_SET_PURPOSE, SSL_R_INVALID_PURPOSE);
+                return 0;
+        }
+        s->purpose = purpose;
+        return 1;
+}
+        
+int SSL_CTX_set_trust(SSL_CTX *s, int trust)
+{
+        if(X509_TRUST_get_by_id(trust) == -1) {
+                SSLerr(SSL_F_SSL_CTX_SET_TRUST, SSL_R_INVALID_TRUST);
+                return 0;
+        }
+        s->trust = trust;
+        return 1;
+}
+
+int SSL_set_trust(SSL *s, int trust)
+{
+        if(X509_TRUST_get_by_id(trust) == -1) {
+                SSLerr(SSL_F_SSL_SET_TRUST, SSL_R_INVALID_TRUST);
+                return 0;
+        }
+        s->trust = trust;
+        return 1;
+}
+
 void SSL_free(SSL *s)
         {
         int i;
@@ -324,7 +375,7 @@ void SSL_free(SSL *s)
 
         if (s->method != NULL) s->method->ssl_free(s);
 
-        Free((char *)s);
+        Free(s);
         }
 
 void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio)
@@ -433,6 +484,38 @@ err:
         }
 #endif
 
+
+/* return length of latest Finished message we sent, copy to 'buf' */
+size_t SSL_get_finished(SSL *s, void *buf, size_t count)
+        {
+        size_t ret = 0;
+        
+        if (s->s3 != NULL)
+                {
+                ret = s->s3->tmp.finish_md_len;
+                if (count > ret)
+                        count = ret;
+                memcpy(buf, s->s3->tmp.finish_md, count);
+                }
+        return ret;
+        }
+
+/* return length of latest Finished message we expected, copy to 'buf' */
+size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count)
+        {
+        size_t ret = 0;
+        
+        if (s->s3 != NULL)
+                {
+                ret = s->s3->tmp.peer_finish_md_len;
+                if (count > ret)
+                        count = ret;
+                memcpy(buf, s->s3->tmp.peer_finish_md, count);
+                }
+        return ret;
+        }
+
+
 int SSL_get_verify_mode(SSL *s)
         {
         return(s->verify_mode);
@@ -706,6 +789,20 @@ long SSL_ctrl(SSL *s,int cmd,long larg,char *parg)
                 }
         }
 
+long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)())
+        {
+        switch(cmd)
+                {
+        default:
+                return(s->method->ssl_callback_ctrl(s,cmd,fp));
+                }
+        }
+
+struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx)
+        {
+        return ctx->sessions;
+        }
+
 long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,char *parg)
         {
         long l;
@@ -765,6 +862,15 @@ long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,char *parg)
                 }
         }
 
+long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+        {
+        switch(cmd)
+                {
+        default:
+                return(ctx->method->ssl_ctx_callback_ctrl(ctx,cmd,fp));
+                }
+        }
+
 int ssl_cipher_id_cmp(SSL_CIPHER *a,SSL_CIPHER *b)
         {
         long l;
@@ -834,8 +940,8 @@ const char *SSL_get_cipher_list(SSL *s,int n)
         return(c->name);
         }
 
-/** specify the ciphers to be used by defaut by the SSL_CTX */
-int SSL_CTX_set_cipher_list(SSL_CTX *ctx,char *str)
+/** specify the ciphers to be used by default by the SSL_CTX */
+int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
         {
         STACK_OF(SSL_CIPHER) *sk;
         
@@ -846,7 +952,7 @@ int SSL_CTX_set_cipher_list(SSL_CTX *ctx,char *str)
         }
 
 /** specify the ciphers to be used by the SSL */
-int SSL_set_cipher_list(SSL *s,char *str)
+int SSL_set_cipher_list(SSL *s,const char *str)
         {
         STACK_OF(SSL_CIPHER) *sk;
         
@@ -1127,7 +1233,7 @@ void SSL_CTX_free(SSL_CTX *a)
                 sk_X509_pop_free(a->extra_certs,X509_free);
         if (a->comp_methods != NULL)
                 sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free);
-        Free((char *)a);
+        Free(a);
         }
 
 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
@@ -1254,10 +1360,8 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
                 emask|=SSL_aDSS;
                 }
 
-#ifdef SSL_ALLOW_ADH
         mask|=SSL_aNULL;
         emask|=SSL_aNULL;
-#endif
 
         c->mask=mask;
         c->export_mask=emask;
@@ -1274,7 +1378,7 @@ X509 *ssl_get_server_send_cert(SSL *s)
         c=s->cert;
         ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
         alg=s->s3->tmp.new_cipher->algorithms;
-        is_export=SSL_IS_EXPORT(alg);
+        is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
         mask=is_export?c->export_mask:c->mask;
         kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK);
 
@@ -1527,7 +1631,7 @@ SSL_METHOD *ssl_bad_method(int ver)
         return(NULL);
         }
 
-char *SSL_get_version(SSL *s)
+const char *SSL_get_version(SSL *s)
         {
         if (s->version == TLS1_VERSION)
                 return("TLSv1");
@@ -1831,8 +1935,8 @@ long SSL_get_verify_result(SSL *ssl)
         return(ssl->verify_result);
         }
 
-int SSL_get_ex_new_index(long argl,char *argp,int (*new_func)(),
-                         int (*dup_func)(),void (*free_func)())
+int SSL_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func,
+                         CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func)
         {
         ssl_meth_num++;
         return(CRYPTO_get_ex_new_index(ssl_meth_num-1,
@@ -1849,8 +1953,8 @@ void *SSL_get_ex_data(SSL *s,int idx)
         return(CRYPTO_get_ex_data(&s->ex_data,idx));
         }
 
-int SSL_CTX_get_ex_new_index(long argl,char *argp,int (*new_func)(),
-                             int (*dup_func)(),void (*free_func)())
+int SSL_CTX_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func,
+                             CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func)
         {
         ssl_ctx_meth_num++;
         return(CRYPTO_get_ex_new_index(ssl_ctx_meth_num-1,
@@ -1899,13 +2003,16 @@ int SSL_want(SSL *s)
 void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,
                                                           int is_export,
                                                           int keylength))
-    { SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,0,(char *)cb); }
-#endif
+    {
+    SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
+    }
 
-#ifndef NO_RSA
-void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,int is_export,
-                                                          int keylength))
-    { SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,0,(char *)cb); }
+void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,
+                                                  int is_export,
+                                                  int keylength))
+    {
+    SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
+    }
 #endif
 
 #ifdef DOXYGEN
@@ -1932,11 +2039,15 @@ RSA *cb(SSL *ssl,int is_export,int keylength)
 #ifndef NO_DH
 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export,
                                                         int keylength))
-    { SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,0,(char *)dh); }
+    {
+    SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
+    }
 
 void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export,
-                                                        int keylength))
-    { SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,0,(char *)dh); }
+                                                int keylength))
+    {
+    SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
+    }
 #endif
 
 #if defined(_WINDLL) && defined(WIN16)
diff --git a/src/lib/libssl/src/ssl/ssl_locl.h b/src/lib/libssl/src/ssl/ssl_locl.h
index 0bfd57db32..9a52bab254 100644
--- a/src/lib/libssl/src/ssl/ssl_locl.h
+++ b/src/lib/libssl/src/ssl/ssl_locl.h
@@ -155,6 +155,19 @@
 #define DEC32(a)        ((a)=((a)-1)&0xffffffffL)
 #define MAX_MAC_SIZE    20 /* up from 16 for SSLv3 */
 
+/*
+ * Define the Bitmasks for SSL_CIPHER.algorithms.
+ * This bits are used packed as dense as possible. If new methods/ciphers
+ * etc will be added, the bits a likely to change, so this information
+ * is for internal library use only, even though SSL_CIPHER.algorithms
+ * can be publicly accessed.
+ * Use the according functions for cipher management instead.
+ *
+ * The bit mask handling in the selection and sorting scheme in
+ * ssl_create_cipher_list() has only limited capabilities, reflecting
+ * that the different entities within are mutually exclusive:
+ * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
+ */
 #define SSL_MKEY_MASK           0x0000001FL
 #define SSL_kRSA                0x00000001L /* RSA key exchange */
 #define SSL_kDHr                0x00000002L /* DH cert RSA CA cert */
@@ -191,36 +204,75 @@
 #define SSL_SHA1                0x00040000L
 #define SSL_SHA                 (SSL_SHA1)
 
-#define SSL_EXP_MASK            0x00300000L
-#define SSL_EXP40               0x00100000L
-#define SSL_NOT_EXP             0x00200000L
-#define SSL_EXP56               0x00300000L
-#define SSL_IS_EXPORT(a)        ((a)&SSL_EXP40)
-#define SSL_IS_EXPORT56(a)      (((a)&SSL_EXP_MASK) == SSL_EXP56)
-#define SSL_IS_EXPORT40(a)      (((a)&SSL_EXP_MASK) == SSL_EXP40)
-#define SSL_C_IS_EXPORT(c)      SSL_IS_EXPORT((c)->algorithms)
-#define SSL_C_IS_EXPORT56(c)    SSL_IS_EXPORT56((c)->algorithms)
-#define SSL_C_IS_EXPORT40(c)    SSL_IS_EXPORT40((c)->algorithms)
-#define SSL_EXPORT_KEYLENGTH(a) (SSL_IS_EXPORT40(a) ? 5 : \
+#define SSL_SSL_MASK            0x00180000L
+#define SSL_SSLV2               0x00080000L
+#define SSL_SSLV3               0x00100000L
+#define SSL_TLSV1               SSL_SSLV3       /* for now */
+
+/* we have used 001fffff - 11 bits left to go */
+
+/*
+ * Export and cipher strength information. For each cipher we have to decide
+ * whether it is exportable or not. This information is likely to change
+ * over time, since the export control rules are no static technical issue.
+ *
+ * Independent of the export flag the cipher strength is sorted into classes.
+ * SSL_EXP40 was denoting the 40bit US export limit of past times, which now
+ * is at 56bit (SSL_EXP56). If the exportable cipher class is going to change
+ * again (eg. to 64bit) the use of "SSL_EXP*" becomes blurred even more,
+ * since SSL_EXP64 could be similar to SSL_LOW.
+ * For this reason SSL_MICRO and SSL_MINI macros are included to widen the
+ * namespace of SSL_LOW-SSL_HIGH to lower values. As development of speed
+ * and ciphers goes, another extension to SSL_SUPER and/or SSL_ULTRA would
+ * be possible.
+ */
+#define SSL_EXP_MASK            0x00000003L
+#define SSL_NOT_EXP             0x00000001L
+#define SSL_EXPORT              0x00000002L
+
+#define SSL_STRONG_MASK         0x0000007cL
+#define SSL_EXP40               0x00000004L
+#define SSL_MICRO               (SSL_EXP40)
+#define SSL_EXP56               0x00000008L
+#define SSL_MINI                (SSL_EXP56)
+#define SSL_LOW                 0x00000010L
+#define SSL_MEDIUM              0x00000020L
+#define SSL_HIGH                0x00000040L
+
+/* we have used 0000007f - 25 bits left to go */
+
+/*
+ * Macros to check the export status and cipher strength for export ciphers.
+ * Even though the macros for EXPORT and EXPORT40/56 have similar names,
+ * their meaning is different:
+ * *_EXPORT macros check the 'exportable' status.
+ * *_EXPORT40/56 macros are used to check whether a certain cipher strength
+ *          is given.
+ * Since the SSL_IS_EXPORT* and SSL_EXPORT* macros depend on the correct
+ * algorithm structure element to be passed (algorithms, algo_strength) and no
+ * typechecking can be done as they are all of type unsigned long, their
+ * direct usage is discouraged.
+ * Use the SSL_C_* macros instead.
+ */
+#define SSL_IS_EXPORT(a)        ((a)&SSL_EXPORT)
+#define SSL_IS_EXPORT56(a)      ((a)&SSL_EXP56)
+#define SSL_IS_EXPORT40(a)      ((a)&SSL_EXP40)
+#define SSL_C_IS_EXPORT(c)      SSL_IS_EXPORT((c)->algo_strength)
+#define SSL_C_IS_EXPORT56(c)    SSL_IS_EXPORT56((c)->algo_strength)
+#define SSL_C_IS_EXPORT40(c)    SSL_IS_EXPORT40((c)->algo_strength)
+
+#define SSL_EXPORT_KEYLENGTH(a,s)       (SSL_IS_EXPORT40(s) ? 5 : \
                                  ((a)&SSL_ENC_MASK) == SSL_DES ? 8 : 7)
 #define SSL_EXPORT_PKEYLENGTH(a) (SSL_IS_EXPORT40(a) ? 512 : 1024)
-#define SSL_C_EXPORT_KEYLENGTH(c)       SSL_EXPORT_KEYLENGTH((c)->algorithms)
-#define SSL_C_EXPORT_PKEYLENGTH(c)      SSL_EXPORT_PKEYLENGTH((c)->algorithms)
-
-#define SSL_SSL_MASK            0x00c00000L
-#define SSL_SSLV2               0x00400000L
-#define SSL_SSLV3               0x00800000L
-#define SSL_TLSV1               SSL_SSLV3       /* for now */
+#define SSL_C_EXPORT_KEYLENGTH(c)       SSL_EXPORT_KEYLENGTH((c)->algorithms, \
+                                (c)->algo_strength)
+#define SSL_C_EXPORT_PKEYLENGTH(c)      SSL_EXPORT_PKEYLENGTH((c)->algo_strength)
 
-#define SSL_STRONG_MASK         0x07000000L
-#define SSL_LOW                 0x01000000L
-#define SSL_MEDIUM              0x02000000L
-#define SSL_HIGH                0x04000000L
 
-/* we have used 0fffffff - 4 bits left to go */
 #define SSL_ALL                 0xffffffffL
 #define SSL_ALL_CIPHERS         (SSL_MKEY_MASK|SSL_AUTH_MASK|SSL_ENC_MASK|\
-                                SSL_MAC_MASK|SSL_EXP_MASK)
+                                SSL_MAC_MASK)
+#define SSL_ALL_STRENGTHS       (SSL_EXP_MASK|SSL_STRONG_MASK)
 
 /* Mostly for SSLv3 */
 #define SSL_PKEY_RSA_ENC        0
@@ -254,9 +306,9 @@ typedef struct cert_st
         {
         /* Current active set */
         CERT_PKEY *key; /* ALWAYS points to an element of the pkeys array
-                                         * Probably it would make more sense to store
-                                         * an index, not a pointer. */
-
+                         * Probably it would make more sense to store
+                         * an index, not a pointer. */
+ 
         /* The following masks are for the key and auth
          * algorithms that are supported by the certs below */
         int valid;
@@ -319,28 +371,28 @@ typedef struct sess_cert_st
 
 /* This is for the SSLv3/TLSv1.0 differences in crypto/hash stuff
  * It is a bit of a mess of functions, but hell, think of it as
- * an opaque strucute :-) */
+ * an opaque structure :-) */
 typedef struct ssl3_enc_method
         {
-        int (*enc)();
-        int (*mac)();
-        int (*setup_key_block)();
-        int (*generate_master_secret)();
-        int (*change_cipher_state)();
-        int (*final_finish_mac)();
+        int (*enc)(SSL *, int);
+        int (*mac)(SSL *, unsigned char *, int);
+        int (*setup_key_block)(SSL *);
+        int (*generate_master_secret)(SSL *, unsigned char *, unsigned char *, int);
+        int (*change_cipher_state)(SSL *, int);
+        int (*final_finish_mac)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char *, int, unsigned char *);
         int finish_mac_length;
-        int (*cert_verify_mac)();
-        unsigned char client_finished[20];
-        int client_finished_len;
-        unsigned char server_finished[20];
-        int server_finished_len;
-        int (*alert_value)();
+        int (*cert_verify_mac)(SSL *, EVP_MD_CTX *, unsigned char *);
+        const char *client_finished_label;
+        int client_finished_label_len;
+        const char *server_finished_label;
+        int server_finished_label_len;
+        int (*alert_value)(int);
         } SSL3_ENC_METHOD;
 
 /* Used for holding the relevant compression methods loaded into SSL_CTX */
 typedef struct ssl3_comp_st
         {
-        int comp_id;    /* The identifer byte for this compression type */
+        int comp_id;    /* The identifier byte for this compression type */
         char *name;     /* Text name used for the compression type */
         COMP_METHOD *method; /* The method :-) */
         } SSL3_COMP;
@@ -376,10 +428,10 @@ int ssl_cipher_ptr_id_cmp(SSL_CIPHER **ap,SSL_CIPHER **bp);
 STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
                                                STACK_OF(SSL_CIPHER) **skp);
 int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p);
-STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *meth,
+STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth,
                                              STACK_OF(SSL_CIPHER) **pref,
                                              STACK_OF(SSL_CIPHER) **sorted,
-                                             char *str);
+                                             const char *rule_str);
 void ssl_update_cache(SSL *s, int mode);
 int ssl_cipher_get_evp(SSL_SESSION *s,const EVP_CIPHER **enc,const EVP_MD **md,
                        SSL_COMP **comp);
@@ -416,6 +468,8 @@ int	ssl2_shutdown(SSL *s);
 void    ssl2_clear(SSL *s);
 long    ssl2_ctrl(SSL *s,int cmd, long larg, char *parg);
 long    ssl2_ctx_ctrl(SSL_CTX *s,int cmd, long larg, char *parg);
+long    ssl2_callback_ctrl(SSL *s,int cmd, void (*fp)());
+long    ssl2_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)());
 int     ssl2_pending(SSL *s);
 
 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
@@ -433,17 +487,16 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out,
         unsigned char *p, int len);
 int ssl3_get_req_cert_type(SSL *s,unsigned char *p);
 long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok);
-int ssl3_send_finished(SSL *s, int a, int b, unsigned char *sender,int slen);
+int ssl3_send_finished(SSL *s, int a, int b, const char *sender,int slen);
 int ssl3_num_ciphers(void);
 SSL_CIPHER *ssl3_get_cipher(unsigned int u);
 int ssl3_renegotiate(SSL *ssl); 
 int ssl3_renegotiate_check(SSL *ssl); 
 int ssl3_dispatch_alert(SSL *s);
 int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len);
-int ssl3_part_read(SSL *s, int i);
 int ssl3_write_bytes(SSL *s, int type, const void *buf, int len);
-int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1,EVP_MD_CTX *ctx2,
-        unsigned char *sender, int slen,unsigned char *p);
+int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1, EVP_MD_CTX *ctx2,
+        const char *sender, int slen,unsigned char *p);
 int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p);
 void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len);
 int ssl3_enc(SSL *s, int send_data);
@@ -463,6 +516,8 @@ int	ssl3_shutdown(SSL *s);
 void    ssl3_clear(SSL *s);
 long    ssl3_ctrl(SSL *s,int cmd, long larg, char *parg);
 long    ssl3_ctx_ctrl(SSL_CTX *s,int cmd, long larg, char *parg);
+long    ssl3_callback_ctrl(SSL *s,int cmd, void (*fp)());
+long    ssl3_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)());
 int     ssl3_pending(SSL *s);
 
 int ssl23_accept(SSL *s);
@@ -474,6 +529,7 @@ int tls1_new(SSL *s);
 void tls1_free(SSL *s);
 void tls1_clear(SSL *s);
 long tls1_ctrl(SSL *s,int cmd, long larg, char *parg);
+long tls1_callback_ctrl(SSL *s,int cmd, void (*fp)());
 SSL_METHOD *tlsv1_base_method(void );
 
 int ssl_init_wbio_buffer(SSL *s, int push);
@@ -483,7 +539,7 @@ int tls1_change_cipher_state(SSL *s, int which);
 int tls1_setup_key_block(SSL *s);
 int tls1_enc(SSL *s, int snd);
 int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx,
-        unsigned char *str, int slen, unsigned char *p);
+        const char *str, int slen, unsigned char *p);
 int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p);
 int tls1_mac(SSL *ssl, unsigned char *md, int snd);
 int tls1_generate_master_secret(SSL *s, unsigned char *out,
diff --git a/src/lib/libssl/src/ssl/ssl_sess.c b/src/lib/libssl/src/ssl/ssl_sess.c
index 681499f08a..9e01f72753 100644
--- a/src/lib/libssl/src/ssl/ssl_sess.c
+++ b/src/lib/libssl/src/ssl/ssl_sess.c
@@ -65,15 +65,31 @@ static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
 static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s);
 static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
 static int ssl_session_num=0;
-static STACK *ssl_session_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_session_meth=NULL;
 
 SSL_SESSION *SSL_get_session(SSL *ssl)
+/* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */
         {
         return(ssl->session);
         }
 
-int SSL_SESSION_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-             int (*dup_func)(), void (*free_func)())
+SSL_SESSION *SSL_get1_session(SSL *ssl)
+/* variant of SSL_get_session: caller really gets something */
+        {
+        SSL_SESSION *sess;
+        /* Need to lock this all up rather than just use CRYPTO_add so that
+         * somebody doesn't free ssl->session between when we check it's
+         * non-null and when we up the reference count. */
+        CRYPTO_r_lock(CRYPTO_LOCK_SSL_SESSION);
+        sess = ssl->session;
+        if(sess)
+                sess->references++;
+        CRYPTO_r_unlock(CRYPTO_LOCK_SSL_SESSION);
+        return(sess);
+        }
+
+int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         ssl_session_num++;
         return(CRYPTO_get_ex_new_index(ssl_session_num-1,
@@ -103,13 +119,14 @@ SSL_SESSION *SSL_SESSION_new(void)
                 }
         memset(ss,0,sizeof(SSL_SESSION));
 
+        ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
         ss->references=1;
         ss->timeout=60*5+4; /* 5 minute timeout by default */
         ss->time=time(NULL);
         ss->prev=NULL;
         ss->next=NULL;
         ss->compress_meth=0;
-        CRYPTO_new_ex_data(ssl_session_meth,(char *)ss,&ss->ex_data);
+        CRYPTO_new_ex_data(ssl_session_meth,ss,&ss->ex_data);
         return(ss);
         }
 
@@ -161,15 +178,20 @@ int ssl_get_new_session(SSL *s, int session)
                         {
                         SSL_SESSION *r;
 
-                        RAND_bytes(ss->session_id,ss->session_id_length);
+                        RAND_pseudo_bytes(ss->session_id,ss->session_id_length);
                         CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
-                        r=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,
-                                (char *)ss);
+                        r=(SSL_SESSION *)lh_retrieve(s->ctx->sessions, ss);
                         CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
                         if (r == NULL) break;
                         /* else - woops a session_id match */
-                        /* XXX should also check external cache!
-                         * (But the probability of a collision is negligible, anyway...) */
+                        /* XXX We should also check the external cache --
+                         * but the probability of a collision is negligible, and
+                         * we could not prevent the concurrent creation of sessions
+                         * with identical IDs since we currently don't have means
+                         * to atomically check whether a session ID already exists
+                         * and make a reservation for it if it does not
+                         * (this problem applies to the internal cache as well).
+                         */
                         }
                 }
         else
@@ -181,6 +203,7 @@ int ssl_get_new_session(SSL *s, int session)
         ss->sid_ctx_length=s->sid_ctx_length;
         s->session=ss;
         ss->ssl_version=s->version;
+        ss->verify_result = X509_V_OK;
 
         return(1);
         }
@@ -192,7 +215,6 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
         SSL_SESSION *ret=NULL,data;
         int fatal = 0;
 
-        /* conn_init();*/
         data.ssl_version=s->version;
         data.session_id_length=len;
         if (len > SSL_MAX_SSL_SESSION_ID_LENGTH)
@@ -202,7 +224,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
         if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
                 {
                 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
-                ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,(char *)&data);
+                ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,&data);
                 if (ret != NULL)
                     /* don't allow other threads to steal it: */
                     CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION);
@@ -311,6 +333,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
         if (s->session != NULL)
                 SSL_SESSION_free(s->session);
         s->session=ret;
+        s->verify_result = s->session->verify_result;
         return(1);
 
  err:
@@ -327,27 +350,47 @@ int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
         int ret=0;
         SSL_SESSION *s;
 
-        /* conn_init(); */
+        /* add just 1 reference count for the SSL_CTX's session cache
+         * even though it has two ways of access: each session is in a
+         * doubly linked list and an lhash */
         CRYPTO_add(&c->references,1,CRYPTO_LOCK_SSL_SESSION);
+        /* if session c is in already in cache, we take back the increment later */
 
         CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
-        s=(SSL_SESSION *)lh_insert(ctx->sessions,(char *)c);
+        s=(SSL_SESSION *)lh_insert(ctx->sessions,c);
         
-        /* Put on the end of the queue unless it is already in the cache */
+        /* s != NULL iff we already had a session with the given PID.
+         * In this case, s == c should hold (then we did not really modify
+         * ctx->sessions), or we're in trouble. */
+        if (s != NULL && s != c)
+                {
+                /* We *are* in trouble ... */
+                SSL_SESSION_list_remove(ctx,s);
+                SSL_SESSION_free(s);
+                /* ... so pretend the other session did not exist in cache
+                 * (we cannot handle two SSL_SESSION structures with identical
+                 * session ID in the same cache, which could happen e.g. when
+                 * two threads concurrently obtain the same session from an external
+                 * cache) */
+                s = NULL;
+                }
+
+        /* Put at the head of the queue unless it is already in the cache */
         if (s == NULL)
                 SSL_SESSION_list_add(ctx,c);
 
-        /* If the same session if is being 're-added', Free the old
-         * one when the last person stops using it.
-         * This will also work if it is alread in the cache.
-         * The references will go up and then down :-) */
         if (s != NULL)
                 {
-                SSL_SESSION_free(s);
+                /* existing cache entry -- decrement previously incremented reference
+                 * count because it already takes into account the cache */
+
+                SSL_SESSION_free(s); /* s == c */
                 ret=0;
                 }
         else
                 {
+                /* new cache entry -- remove old ones if cache has become too large */
+                
                 ret=1;
 
                 if (SSL_CTX_sess_get_cache_size(ctx) > 0)
@@ -380,7 +423,7 @@ static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
         if ((c != NULL) && (c->session_id_length != 0))
                 {
                 if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
-                r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
+                r=(SSL_SESSION *)lh_delete(ctx->sessions,c);
                 if (r != NULL)
                         {
                         ret=1;
@@ -422,7 +465,7 @@ void SSL_SESSION_free(SSL_SESSION *ss)
                 }
 #endif
 
-        CRYPTO_free_ex_data(ssl_session_meth,(char *)ss,&ss->ex_data);
+        CRYPTO_free_ex_data(ssl_session_meth,ss,&ss->ex_data);
 
         memset(ss->key_arg,0,SSL_MAX_KEY_ARG_LENGTH);
         memset(ss->master_key,0,SSL_MAX_MASTER_KEY_LENGTH);
@@ -541,7 +584,7 @@ static void timeout(SSL_SESSION *s, TIMEOUT_PARAM *p)
                 {
                 /* The reason we don't call SSL_CTX_remove_session() is to
                  * save on locking overhead */
-                lh_delete(p->cache,(char *)s);
+                lh_delete(p->cache,s);
                 SSL_SESSION_list_remove(p->ctx,s);
                 s->not_resumable=1;
                 if (p->ctx->remove_session_cb != NULL)
@@ -562,7 +605,7 @@ void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
         CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
         i=tp.cache->down_load;
         tp.cache->down_load=0;
-        lh_doall_arg(tp.cache,(void (*)())timeout,(char *)&tp);
+        lh_doall_arg(tp.cache,(void (*)())timeout,&tp);
         tp.cache->down_load=i;
         CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
         }
diff --git a/src/lib/libssl/src/ssl/ssl_stat.c b/src/lib/libssl/src/ssl/ssl_stat.c
index 3eca4ee601..8e12461f3b 100644
--- a/src/lib/libssl/src/ssl/ssl_stat.c
+++ b/src/lib/libssl/src/ssl/ssl_stat.c
@@ -183,7 +183,7 @@ case SSL3_ST_SR_CERT_VRFY_B:	str="SSLv3 read certificate verify B"; break;
 #endif
 
 #if !defined(NO_SSL2) && !defined(NO_SSL3)
-/* SSLv2/v3 compatablitity states */
+/* SSLv2/v3 compatibility states */
 /* client */
 case SSL23_ST_CW_CLNT_HELLO_A:  str="SSLv2/v3 write client hello A"; break;
 case SSL23_ST_CW_CLNT_HELLO_B:  str="SSLv2/v3 write client hello B"; break;
@@ -331,7 +331,7 @@ case SSL3_ST_SR_CERT_VRFY_B:			str="3RCV_B"; break;
 #endif
 
 #if !defined(NO_SSL2) && !defined(NO_SSL3)
-/* SSLv2/v3 compatablitity states */
+/* SSLv2/v3 compatibility states */
 /* client */
 case SSL23_ST_CW_CLNT_HELLO_A:                  str="23WCHA"; break;
 case SSL23_ST_CW_CLNT_HELLO_B:                  str="23WCHB"; break;
@@ -402,7 +402,7 @@ char *SSL_alert_desc_string_long(int value)
                 str="close notify";
                 break;
         case SSL3_AD_UNEXPECTED_MESSAGE:
-                str="unexected_message";
+                str="unexpected_message";
                 break;
         case SSL3_AD_BAD_RECORD_MAC:
                 str="bad record mac";
@@ -429,7 +429,7 @@ char *SSL_alert_desc_string_long(int value)
                 str="certificate expired";
                 break;
         case SSL3_AD_CERTIFICATE_UNKNOWN:
-                str="certifcate unknown";
+                str="certificate unknown";
                 break;
         case SSL3_AD_ILLEGAL_PARAMETER:
                 str="illegal parameter";
diff --git a/src/lib/libssl/src/ssl/ssl_task.c b/src/lib/libssl/src/ssl/ssl_task.c
index 321e35c83b..cac701a798 100644
--- a/src/lib/libssl/src/ssl/ssl_task.c
+++ b/src/lib/libssl/src/ssl/ssl_task.c
@@ -226,7 +226,7 @@ int main ( int argc, char **argv )
         printf("cipher list: %s\n", cipher ? cipher : "{undefined}" );
 
         SSL_load_error_strings();
-        SSLeay_add_all_algorithms();
+        OpenSSL_add_all_algorithms();
 
 /* DRM, this was the original, but there is no such thing as SSLv2()
         s_ctx=SSL_CTX_new(SSLv2());
diff --git a/src/lib/libssl/src/ssl/ssl_txt.c b/src/lib/libssl/src/ssl/ssl_txt.c
index ca67a98d89..7e27857bcf 100644
--- a/src/lib/libssl/src/ssl/ssl_txt.c
+++ b/src/lib/libssl/src/ssl/ssl_txt.c
@@ -112,7 +112,7 @@ int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
                 sprintf(str,"%02X",x->session_id[i]);
                 if (BIO_puts(bp,str) <= 0) goto err;
                 }
-        if (BIO_puts(bp,"\nSession-ID-ctx: ") <= 0) goto err;
+        if (BIO_puts(bp,"\n    Session-ID-ctx: ") <= 0) goto err;
         for (i=0; i<x->sid_ctx_length; i++)
                 {
                 sprintf(str,"%02X",x->sid_ctx[i]);
@@ -163,6 +163,11 @@ int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
                 if (BIO_puts(bp,str) <= 0) goto err;
                 }
         if (BIO_puts(bp,"\n") <= 0) goto err;
+
+        if (BIO_puts(bp, "    Verify return code ") <= 0) goto err;
+        sprintf(str, "%ld (%s)\n", x->verify_result, 
+                        X509_verify_cert_error_string(x->verify_result));
+        if (BIO_puts(bp,str) <= 0) goto err;
                 
         return(1);
 err:
diff --git a/src/lib/libssl/src/ssl/ssltest.c b/src/lib/libssl/src/ssl/ssltest.c
index 90570f4bee..d655bbbd84 100644
--- a/src/lib/libssl/src/ssl/ssltest.c
+++ b/src/lib/libssl/src/ssl/ssltest.c
@@ -56,11 +56,12 @@
  * [including the GNU Public Licence.]
  */
 
+#include <assert.h>
+#include <errno.h>
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <errno.h>
-#include <limits.h>
 
 #include "openssl/e_os.h"
 
@@ -69,14 +70,11 @@
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <openssl/rand.h>
 #ifdef WINDOWS
 #include "../crypto/bio/bss_file.c"
 #endif
 
-#if defined(NO_RSA) && !defined(NO_SSL2)
-#define NO_SSL2
-#endif
-
 #ifdef VMS
 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
@@ -85,19 +83,23 @@
 #  define TEST_CLIENT_CERT "../apps/client.pem"
 #endif
 
-int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
+static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 #ifndef NO_RSA
 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 #endif
 #ifndef NO_DH
 static DH *get_dh512(void);
 #endif
-BIO *bio_err=NULL;
-BIO *bio_stdout=NULL;
+#ifndef NO_DSA
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg);
+#endif
+
+static BIO *bio_err=NULL;
+static BIO *bio_stdout=NULL;
 
 static char *cipher=NULL;
-int verbose=0;
-int debug=0;
+static int verbose=0;
+static int debug=0;
 #if 0
 /* Not used yet. */
 #ifdef FIONBIO
@@ -105,6 +107,7 @@ static int s_nbio=0;
 #endif
 #endif
 
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 
 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes);
 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
@@ -122,6 +125,9 @@ static void sv_usage(void)
 #if !defined NO_DH && !defined NO_DSA
         fprintf(stderr," -dhe1024      - generate 1024 bit key for DHE\n");
 #endif
+#if !defined NO_DH
+        fprintf(stderr," -no_dhe       - disable DHE\n");
+#endif
 #ifndef NO_SSL2
         fprintf(stderr," -ssl2         - use SSLv2\n");
 #endif
@@ -159,16 +165,21 @@ int main(int argc, char *argv[])
         int number=1,reuse=0;
         long bytes=1L;
         SSL_CIPHER *ciph;
-        int dhe1024 = 0;
+        int dhe1024 = 0, no_dhe = 0;
 #ifndef NO_DH
         DH *dh;
 #endif
+        verbose = 0;
+        debug = 0;
+        cipher = 0;
+        
+        CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+
+        RAND_seed(rnd_seed, sizeof rnd_seed);
 
         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE);
 
-        CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
-
         argc--;
         argv++;
 
@@ -186,6 +197,8 @@ int main(int argc, char *argv[])
                         reuse=1;
                 else if (strcmp(*argv,"-dhe1024") == 0)
                         dhe1024=1;
+                else if (strcmp(*argv,"-no_dhe") == 0)
+                        no_dhe=1;
                 else if (strcmp(*argv,"-ssl2") == 0)
                         ssl2=1;
                 else if (strcmp(*argv,"-tls1") == 0)
@@ -311,31 +324,36 @@ bad:
                 }
 
 #ifndef NO_DH
-# ifndef NO_DSA
-        if (dhe1024) 
+        if (!no_dhe)
                 {
-                DSA *dsa;
-
-                if (verbose)
+# ifndef NO_DSA
+                if (dhe1024) 
                         {
-                        fprintf(stdout, "Creating 1024 bit DHE parameters ...");
-                        fflush(stdout);
+                        DSA *dsa;
+                        unsigned char seed[20];
+                        
+                        if (verbose)
+                                {
+                                BIO_printf(bio_err, "Creating 1024 bit DHE parameters\n");
+                                BIO_flush(bio_err);
+                                }
+                        
+                        memcpy(seed, "Random String no. 12", 20);
+                        dsa = DSA_generate_parameters(1024, seed, 20, NULL, NULL, dsa_cb, bio_err);
+                        dh = DSA_dup_DH(dsa);   
+                        DSA_free(dsa);
+                        /* important: SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
+                        SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
+                        
+                        if (verbose)
+                                fprintf(stdout, " done\n");
                         }
-
-                dsa = DSA_generate_parameters(1024, NULL, 0, NULL, NULL, 0, NULL);
-                dh = DSA_dup_DH(dsa);   
-                DSA_free(dsa);
-                /* important: SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
-                SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
-
-                if (verbose)
-                        fprintf(stdout, " done\n");
-                }
-        else
+                else
 # endif
-                dh=get_dh512();
-        SSL_CTX_set_tmp_dh(s_ctx,dh);
-        DH_free(dh);
+                        dh=get_dh512();
+                SSL_CTX_set_tmp_dh(s_ctx,dh);
+                DH_free(dh);
+                }
 #endif
 
 #ifndef NO_RSA
@@ -373,17 +391,22 @@ bad:
 
         if (client_auth)
                 {
-                fprintf(stderr,"client authentication\n");
+                BIO_printf(bio_err,"client authentication\n");
                 SSL_CTX_set_verify(s_ctx,
                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
                         verify_callback);
                 }
         if (server_auth)
                 {
-                fprintf(stderr,"server authentication\n");
+                BIO_printf(bio_err,"server authentication\n");
                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
                         verify_callback);
                 }
+        
+        {
+                int session_id_context = 0;
+                SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
+        }
 
         c_ssl=SSL_new(c_ctx);
         s_ssl=SSL_new(s_ctx);
@@ -400,13 +423,13 @@ bad:
         if (!verbose)
                 {
                 ciph=SSL_get_current_cipher(c_ssl);
-                fprintf(stdout,"Protocol %s, cipher %s, %s\n",
+                BIO_printf(bio_stdout,"Protocol %s, cipher %s, %s\n",
                         SSL_get_version(c_ssl),
                         SSL_CIPHER_get_version(ciph),
                         SSL_CIPHER_get_name(ciph));
                 }
         if ((number > 1) || (bytes > 1L))
-                printf("%d handshakes of %ld bytes done\n",number,bytes);
+                BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
 
         SSL_free(s_ssl);
         SSL_free(c_ssl);
@@ -421,6 +444,7 @@ end:
         ERR_remove_state(0);
         EVP_cleanup();
         CRYPTO_mem_leaks(bio_err);
+        if (bio_err != NULL) BIO_free(bio_err);
         EXIT(ret);
         }
 
@@ -485,7 +509,7 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count)
                  * BIO_ctrl_pending(bio)              number of bytes we can read now
                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
                  *                                      other side's read attempt
-                 * BIO_ctrl_get_write_gurantee(bio)   number of bytes we can write now
+                 * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
                  *
                  * ..._read_request is never more than ..._write_guarantee;
                  * it depends on the application which one you should use.
@@ -517,7 +541,7 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count)
                                 else
                                         i = (int)cw_num;
                                 r = BIO_write(c_ssl_bio, cbuf, i);
-                                if (r == -1)
+                                if (r < 0)
                                         {
                                         if (!BIO_should_retry(c_ssl_bio))
                                                 {
@@ -590,7 +614,7 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count)
                                 else
                                         i = (int)sw_num;
                                 r = BIO_write(s_ssl_bio, sbuf, i);
-                                if (r == -1)
+                                if (r < 0)
                                         {
                                         if (!BIO_should_retry(s_ssl_bio))
                                                 {
@@ -643,45 +667,40 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count)
                         {
                         /* "I/O" BETWEEN CLIENT AND SERVER. */
 
-#define RELAYBUFSIZ 200
-                        static char buf[RELAYBUFSIZ];
-
-                        /* RELAYBUF is arbitrary.  When writing data over some real
-                         * network, use a buffer of the same size as in the BIO_pipe
-                         * and make that size large (for reading from the network
-                         * small buffers usually won't hurt).
-                         * Here sizes differ for testing. */
-
                         size_t r1, r2;
-                        size_t num;
-                        int r;
+                        BIO *io1 = server_io, *io2 = client_io;
+                        /* we use the non-copying interface for io1
+                         * and the standard BIO_write/BIO_read interface for io2
+                         */
+                        
                         static int prev_progress = 1;
                         int progress = 0;
                         
-                        /* client to server */
+                        /* io1 to io2 */
                         do
                                 {
-                                r1 = BIO_ctrl_pending(client_io);
-                                r2 = BIO_ctrl_get_write_guarantee(server_io);
+                                size_t num;
+                                int r;
+
+                                r1 = BIO_ctrl_pending(io1);
+                                r2 = BIO_ctrl_get_write_guarantee(io2);
 
                                 num = r1;
                                 if (r2 < num)
                                         num = r2;
                                 if (num)
                                         {
-                                        if (sizeof buf < num)
-                                                num = sizeof buf;
+                                        char *dataptr;
+
                                         if (INT_MAX < num) /* yeah, right */
                                                 num = INT_MAX;
                                         
-                                        r = BIO_read(client_io, buf, (int)num);
-                                        if (r != (int)num) /* can't happen */
-                                                {
-                                                fprintf(stderr, "ERROR: BIO_read could not read "
-                                                        "BIO_ctrl_pending() bytes");
-                                                goto err;
-                                                }
-                                        r = BIO_write(server_io, buf, (int)num);
+                                        r = BIO_nread(io1, &dataptr, (int)num);
+                                        assert(r > 0);
+                                        assert(r <= (int)num);
+                                        /* possibly r < num (non-contiguous data) */
+                                        num = r;
+                                        r = BIO_write(io2, dataptr, (int)num);
                                         if (r != (int)num) /* can't happen */
                                                 {
                                                 fprintf(stderr, "ERROR: BIO_write could not write "
@@ -691,48 +710,58 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count)
                                         progress = 1;
 
                                         if (debug)
-                                                printf("C->S relaying: %d bytes\n", (int)num);
+                                                printf((io1 == client_io) ?
+                                                        "C->S relaying: %d bytes\n" :
+                                                        "S->C relaying: %d bytes\n",
+                                                        (int)num);
                                         }
                                 }
                         while (r1 && r2);
 
-                        /* server to client */
-                        do
-                                {
-                                r1 = BIO_ctrl_pending(server_io);
-                                r2 = BIO_ctrl_get_write_guarantee(client_io);
-
+                        /* io2 to io1 */
+                        {
+                                size_t num;
+                                int r;
+
+                                r1 = BIO_ctrl_pending(io2);
+                                r2 = BIO_ctrl_get_read_request(io1);
+                                /* here we could use ..._get_write_guarantee instead of
+                                 * ..._get_read_request, but by using the latter
+                                 * we test restartability of the SSL implementation
+                                 * more thoroughly */
                                 num = r1;
                                 if (r2 < num)
                                         num = r2;
                                 if (num)
                                         {
-                                        if (sizeof buf < num)
-                                                num = sizeof buf;
+                                        char *dataptr;
+                                        
                                         if (INT_MAX < num)
                                                 num = INT_MAX;
+
+                                        if (num > 1)
+                                                --num; /* test restartability even more thoroughly */
                                         
-                                        r = BIO_read(server_io, buf, (int)num);
+                                        r = BIO_nwrite(io1, &dataptr, (int)num);
+                                        assert(r > 0);
+                                        assert(r <= (int)num);
+                                        num = r;
+                                        r = BIO_read(io2, dataptr, (int)num);
                                         if (r != (int)num) /* can't happen */
                                                 {
                                                 fprintf(stderr, "ERROR: BIO_read could not read "
                                                         "BIO_ctrl_pending() bytes");
                                                 goto err;
                                                 }
-                                        r = BIO_write(client_io, buf, (int)num);
-                                        if (r != (int)num) /* can't happen */
-                                                {
-                                                fprintf(stderr, "ERROR: BIO_write could not write "
-                                                        "BIO_ctrl_get_write_guarantee() bytes");
-                                                goto err;
-                                                }
                                         progress = 1;
-
+                                        
                                         if (debug)
-                                                printf("S->C relaying: %d bytes\n", (int)num);
+                                                printf((io2 == client_io) ?
+                                                        "C->S relaying: %d bytes\n" :
+                                                        "S->C relaying: %d bytes\n",
+                                                        (int)num);
                                         }
-                                }
-                        while (r1 && r2);
+                        } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
 
                         if (!progress && !prev_progress)
                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
@@ -1091,7 +1120,7 @@ err:
         return(ret);
         }
 
-int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
+static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
         {
         char *s,buf[256];
 
@@ -1161,3 +1190,24 @@ static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
         return(rsa_tmp);
         }
 #endif
+
+#ifndef NO_DSA
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
+        {
+        char c='*';
+        static int ok=0,num=0;
+
+        if (p == 0) { c='.'; num++; };
+        if (p == 1) c='+';
+        if (p == 2) { c='*'; ok++; }
+        if (p == 3) c='\n';
+        BIO_write(arg,&c,1);
+        (void)BIO_flush(arg);
+
+        if (!ok && (p == 0) && (num > 1))
+                {
+                BIO_printf((BIO *)arg,"error in dsatest\n");
+                exit(1);
+                }
+        }
+#endif
diff --git a/src/lib/libssl/src/ssl/t1_enc.c b/src/lib/libssl/src/ssl/t1_enc.c
index 914b743498..279e45db5d 100644
--- a/src/lib/libssl/src/ssl/t1_enc.c
+++ b/src/lib/libssl/src/ssl/t1_enc.c
@@ -494,7 +494,7 @@ int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in_ctx, unsigned char *out)
         }
 
 int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx,
-             unsigned char *str, int slen, unsigned char *out)
+             const char *str, int slen, unsigned char *out)
         {
         unsigned int i;
         EVP_MD_CTX ctx;
@@ -621,11 +621,11 @@ int tls1_alert_code(int code)
         case SSL_AD_ACCESS_DENIED:      return(TLS1_AD_ACCESS_DENIED);
         case SSL_AD_DECODE_ERROR:       return(TLS1_AD_DECODE_ERROR);
         case SSL_AD_DECRYPT_ERROR:      return(TLS1_AD_DECRYPT_ERROR);
-        case SSL_AD_EXPORT_RESTRICION:  return(TLS1_AD_EXPORT_RESTRICION);
+        case SSL_AD_EXPORT_RESTRICTION: return(TLS1_AD_EXPORT_RESTRICTION);
         case SSL_AD_PROTOCOL_VERSION:   return(TLS1_AD_PROTOCOL_VERSION);
         case SSL_AD_INSUFFICIENT_SECURITY:return(TLS1_AD_INSUFFICIENT_SECURITY);
         case SSL_AD_INTERNAL_ERROR:     return(TLS1_AD_INTERNAL_ERROR);
-        case SSL_AD_USER_CANCLED:       return(TLS1_AD_USER_CANCLED);
+        case SSL_AD_USER_CANCELLED:     return(TLS1_AD_USER_CANCELLED);
         case SSL_AD_NO_RENEGOTIATION:   return(TLS1_AD_NO_RENEGOTIATION);
         default:                        return(-1);
                 }
diff --git a/src/lib/libssl/src/ssl/t1_lib.c b/src/lib/libssl/src/ssl/t1_lib.c
index ddf5c15799..ca6c03d5af 100644
--- a/src/lib/libssl/src/ssl/t1_lib.c
+++ b/src/lib/libssl/src/ssl/t1_lib.c
@@ -60,13 +60,9 @@
 #include <openssl/objects.h>
 #include "ssl_locl.h"
 
-char *tls1_version_str="TLSv1" OPENSSL_VERSION_PTEXT;
+const char *tls1_version_str="TLSv1" OPENSSL_VERSION_PTEXT;
 
-#ifndef NO_PROTO
 static long tls1_default_timeout(void);
-#else
-static long tls1_default_timeout();
-#endif
 
 static SSL3_ENC_METHOD TLSv1_enc_data={
         tls1_enc,
@@ -105,6 +101,9 @@ static SSL_METHOD TLSv1_data= {
         ssl_bad_method,
         tls1_default_timeout,
         &TLSv1_enc_data,
+        ssl_undefined_function,
+        ssl3_callback_ctrl,
+        ssl3_ctx_callback_ctrl,
         };
 
 static long tls1_default_timeout(void)
@@ -142,4 +141,9 @@ long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
         {
         return(0);
         }
+
+long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
+        {
+        return(0);
+        }
 #endif
diff --git a/src/lib/libssl/src/ssl/tls1.h b/src/lib/libssl/src/ssl/tls1.h
index a931efa936..6e2b06d34f 100644
--- a/src/lib/libssl/src/ssl/tls1.h
+++ b/src/lib/libssl/src/ssl/tls1.h
@@ -65,7 +65,7 @@
 extern "C" {
 #endif
 
-#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES    0
+#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES    1
 
 #define TLS1_VERSION                    0x0301
 #define TLS1_VERSION_MAJOR              0x03
@@ -77,11 +77,11 @@ extern "C" {
 #define TLS1_AD_ACCESS_DENIED           49      /* fatal */
 #define TLS1_AD_DECODE_ERROR            50      /* fatal */
 #define TLS1_AD_DECRYPT_ERROR           51
-#define TLS1_AD_EXPORT_RESTRICION       60      /* fatal */
+#define TLS1_AD_EXPORT_RESTRICTION      60      /* fatal */
 #define TLS1_AD_PROTOCOL_VERSION        70      /* fatal */
 #define TLS1_AD_INSUFFICIENT_SECURITY   71      /* fatal */
 #define TLS1_AD_INTERNAL_ERROR          80      /* fatal */
-#define TLS1_AD_USER_CANCLED            90
+#define TLS1_AD_USER_CANCELLED          90
 #define TLS1_AD_NO_RENEGOTIATION        100
 
 #define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5          0x03000060
diff --git a/src/lib/libssl/src/test/Makefile.ssl b/src/lib/libssl/src/test/Makefile.ssl
index ea86520128..dbb523bf15 100644
--- a/src/lib/libssl/src/test/Makefile.ssl
+++ b/src/lib/libssl/src/test/Makefile.ssl
@@ -13,6 +13,7 @@ INSTALLTOP=	/usr/local/ssl
 MAKEFILE=       Makefile.ssl
 MAKE=           make -f $(MAKEFILE)
 MAKEDEPEND=     $(TOP)/util/domd $(TOP)
+PERL=           perl
 
 PEX_LIBS=
 EX_LIBS= #-lnsl -lsocket
@@ -50,7 +51,7 @@ DHTEST=		dhtest
 DSATEST=        dsatest
 METHTEST=       methtest
 SSLTEST=        ssltest
-RSATEST=        rsa_oaep_test
+RSATEST=        rsa_test
 
 EXE=    $(BNTEST) $(IDEATEST) $(MD2TEST)  $(MD5TEST) $(HMACTEST) \
         $(RC2TEST) $(RC4TEST) $(RC5TEST) \
@@ -98,9 +99,9 @@ tags:
 
 tests:  exe apps \
         test_des test_idea test_sha test_md5 test_hmac test_md2 test_mdc2 \
-        test_rc2 test_rc4 test_rc5 test_bf test_cast \
+        test_rmd test_rc2 test_rc4 test_rc5 test_bf test_cast \
         test_rand test_bn test_enc test_x509 test_rsa test_crl test_sid \
-        test_reqgen test_req test_pkcs7 test_verify test_dh test_dsa \
+        test_gen test_req test_pkcs7 test_verify test_dh test_dsa \
         test_ss test_ssl test_ca
 
 apps:
@@ -180,9 +181,10 @@ test_pkcs7:
 
 test_bn:
         @echo starting big number library test, could take a while...
-        @(./$(BNTEST)|bc) | awk '{ \
-if ($$0 != "0") {print "error"; exit(1); } \
-if (((NR+1)%64) == 0) print NR+1," tests done"; }'
+        @./$(BNTEST) >tmp.bntest
+        @echo quit >>tmp.bntest
+        @echo "running bc"
+        @bc tmp.bntest 2>&1 | $(PERL) -e 'while (<STDIN>) {if (/^test (.*)/) {print STDERR "\nverify $$1";} elsif (!/^0$$/) {die "\nFailed! bc: $$_";} print STDERR "."; $$i++;} print STDERR "\n$$i tests passed\n"'
         @echo 'test a^b%c implementations'
         ./$(EXPTEST)
 
@@ -192,14 +194,15 @@ test_verify:
         ../apps/openssl verify -CApath ../certs ../certs/*.pem
 
 test_dh:
-        @echo "Generate as set of DH parameters"
+        @echo "Generate a set of DH parameters"
         ./$(DHTEST)
 
 test_dsa:
-        @echo "Generate as set of DSA parameters"
+        @echo "Generate a set of DSA parameters"
         ./$(DSATEST)
+        ./$(DSATEST) -app2_1
 
-test_reqgen:
+test_gen:
         @echo "Generate and verify a certificate request"
         @sh ./testgen
 
@@ -226,7 +229,7 @@ dclean:
         mv -f Makefile.new $(MAKEFILE)
 
 clean:
-        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff $(EXE) *.ss log
+        rm -f .rnd tmp.bntest *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff $(EXE) *.ss log
 
 $(DLIBSSL):
         (cd ../ssl; $(MAKE))
@@ -325,16 +328,19 @@ destest.o: ../include/openssl/opensslconf.h
 dhtest.o: ../include/openssl/bio.h ../include/openssl/bn.h
 dhtest.o: ../include/openssl/crypto.h ../include/openssl/dh.h
 dhtest.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+dhtest.o: ../include/openssl/rand.h ../include/openssl/safestack.h
 dhtest.o: ../include/openssl/stack.h
 dsatest.o: ../include/openssl/bio.h ../include/openssl/bn.h
 dsatest.o: ../include/openssl/crypto.h ../include/openssl/dh.h
 dsatest.o: ../include/openssl/dsa.h ../include/openssl/err.h
 dsatest.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-dsatest.o: ../include/openssl/rand.h ../include/openssl/stack.h
+dsatest.o: ../include/openssl/rand.h ../include/openssl/safestack.h
+dsatest.o: ../include/openssl/stack.h
 exptest.o: ../include/openssl/bio.h ../include/openssl/bn.h
 exptest.o: ../include/openssl/crypto.h ../include/openssl/err.h
 exptest.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-exptest.o: ../include/openssl/rand.h ../include/openssl/stack.h
+exptest.o: ../include/openssl/rand.h ../include/openssl/safestack.h
+exptest.o: ../include/openssl/stack.h
 hmactest.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 hmactest.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 hmactest.o: ../include/openssl/cast.h ../include/openssl/crypto.h
@@ -359,11 +365,12 @@ rc2test.o: ../include/openssl/opensslconf.h ../include/openssl/rc2.h
 rc4test.o: ../include/openssl/opensslconf.h ../include/openssl/rc4.h
 rc5test.o: ../include/openssl/rc5.h
 rmdtest.o: ../include/openssl/ripemd.h
-rsa_oaep_test.o: ../include/openssl/bn.h ../include/openssl/crypto.h
-rsa_oaep_test.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
-rsa_oaep_test.o: ../include/openssl/err.h ../include/openssl/opensslconf.h
-rsa_oaep_test.o: ../include/openssl/opensslv.h ../include/openssl/rsa.h
-rsa_oaep_test.o: ../include/openssl/stack.h
+rsa_test.o: ../include/openssl/bn.h ../include/openssl/crypto.h
+rsa_test.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+rsa_test.o: ../include/openssl/err.h ../include/openssl/opensslconf.h
+rsa_test.o: ../include/openssl/opensslv.h ../include/openssl/rand.h
+rsa_test.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+rsa_test.o: ../include/openssl/stack.h
 sha1test.o: ../include/openssl/sha.h
 shatest.o: ../include/openssl/sha.h
 ssltest.o: ../include/openssl/asn1.h ../include/openssl/bio.h
@@ -378,11 +385,12 @@ ssltest.o: ../include/openssl/md2.h ../include/openssl/md5.h
 ssltest.o: ../include/openssl/mdc2.h ../include/openssl/objects.h
 ssltest.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 ssltest.o: ../include/openssl/pem.h ../include/openssl/pem2.h
-ssltest.o: ../include/openssl/pkcs7.h ../include/openssl/rc2.h
-ssltest.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
-ssltest.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
-ssltest.o: ../include/openssl/safestack.h ../include/openssl/sha.h
-ssltest.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
-ssltest.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
-ssltest.o: ../include/openssl/stack.h ../include/openssl/tls1.h
-ssltest.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+ssltest.o: ../include/openssl/pkcs7.h ../include/openssl/rand.h
+ssltest.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+ssltest.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+ssltest.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+ssltest.o: ../include/openssl/sha.h ../include/openssl/ssl.h
+ssltest.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
+ssltest.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
+ssltest.o: ../include/openssl/tls1.h ../include/openssl/x509.h
+ssltest.o: ../include/openssl/x509_vfy.h
diff --git a/src/lib/libssl/src/test/dsa-ca.pem b/src/lib/libssl/src/test/dsa-ca.pem
index 9eb08f3ddd..e69de29bb2 100644
--- a/src/lib/libssl/src/test/dsa-ca.pem
+++ b/src/lib/libssl/src/test/dsa-ca.pem
@@ -1,43 +0,0 @@
------BEGIN DSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,C5B6C7CC9E1FE2C0
-
-svCXBcBRhMuU22UXOfiKZA+thmz6KYXpt1Yg5Rd+TYQcQ1MdvNy0B0tkP1SxzDq0
-Xh1eMeTML9/9/0rKakgNXXXbpi5RB8t6BmwRSyej89F7nn1mtR3qzoyPRpp15SDl
-Tn67C+2v+HDF3MFk88hiNCYkNbcmi7TWvChsl8N1r7wdZwtIox56yXdgxw6ZIpa/
-par0oUCzN7fiavPgCWz1kfPNSaBQSdxwH7TZi5tMHAr0J3C7a7QRnZfE09R59Uqr
-zslrq+ndIw1BZAxoY0SlBu+iFOVaBVlwToC4AsHkv7j7l8ITtr7f42YbBa44D9TO
-uOhONmkk/v3Fso4RaOEzdKZC+hnmmzvHs6TiTWm6yzJgSFwyOUK0eGmKEeVxpcH5
-rUOlHOwzen+FFtocZDZAfdFnb7QY7L/boQvyA5A+ZbRG4DUpmBQeQsSaICHM5Rxx
-1QaLF413VNPXTLPbW0ilSc2H8x2iZTIVKfd33oSO6NhXPtSYQgfecEF4BvNHY5c4
-HovjT4mckbK95bcBzoCHu43vuSQkmZzdYo/ydSZt6zoPavbBLueTpgSbdXiDi827
-MVqOsYxGCb+kez0FoDSTgw==
------END DSA PRIVATE KEY-----
------BEGIN CERTIFICATE REQUEST-----
-MIICUjCCAhECAQAwUjELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUx
-ITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAxMCQ0Ew
-ggG0MIIBKQYFKw4DAgwwggEeAoGBAKc/boW/QWopffCfRxkwkJoJHdpqMx7FPYaW
-sxXgUy6P4FmCc5A+dTGZR3pS+4Xk2aZ7OJtoioSbh8YetX6GS1NbWc9xZRmIbs5m
-rmuINvvsKNzC16W75Sw5JkvamnAYlTeVEFYj9hXtugRe3jlP/bdDH7WkZW/NgBHk
-cJVbUM1JAhUA9wcx7fpsBgPVhYocrJxl51BmZW8CgYBN30wDppGK9RlvUEYlmeVo
-bzDjaeHls12YuyiGSPzemQQ/X4gMnHMkDSBduSqaPxiWJ+Rih8F7dGJT/GEnqHqR
-CZ228U2cVA9YBu5JdAfOVX4jzhb2ytxaYQF+yXG1TfbcNCmHaPZeIJOz2/XkCWxB
-F5WS6wG1c6Vqftgy7Q4CuAOBhAACgYAapll6iqz9XrZFlk2GCVcB+KihxWnH7IuH
-vSLw9YUrJahcBHmbpvt494lF4gC5w3WPM+vXJofbusk4GoQEEsQNMDaah4m49uUq
-AylOVFJJJXuirVJ+o+0TtOFDITEAl+YZZariXOD7tdOSOl9RLMPC6+daHKS9e68u
-3enxhqnDGaAAMAkGBSsOAwIbBQADMAAwLQIVAJGVuFsG/0DBuSZ0jF7ypdU0/G0v
-AhQfeF5BoMMDbX/kidUVpQ6gadPlZA==
------END CERTIFICATE REQUEST-----
------BEGIN CERTIFICATE-----
-MIIBrjCCAWwCAQswCQYFKw4DAhsFADBTMQswCQYDVQQGEwJBVTETMBEGA1UECBMK
-U29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQww
-CgYDVQQDEwNQQ0EwHhcNOTcwNjE1MDIxNDI5WhcNOTcwNzE1MDIxNDI5WjBSMQsw
-CQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJu
-ZXQgV2lkZ2l0cyBQdHkgTHRkMQswCQYDVQQDEwJDQTCBkjAJBgUrDgMCDAUAA4GE
-AAKBgBqmWXqKrP1etkWWTYYJVwH4qKHFacfsi4e9IvD1hSslqFwEeZum+3j3iUXi
-ALnDdY8z69cmh9u6yTgahAQSxA0wNpqHibj25SoDKU5UUkkle6KtUn6j7RO04UMh
-MQCX5hllquJc4Pu105I6X1Esw8Lr51ocpL17ry7d6fGGqcMZMAkGBSsOAwIbBQAD
-MQAwLgIVAJ4wtQsANPxHo7Q4IQZYsL12SKdbAhUAjJ9n38zxT+iai2164xS+LIfa
-C1Q=
------END CERTIFICATE-----
-
diff --git a/src/lib/libssl/src/test/dsa-pca.pem b/src/lib/libssl/src/test/dsa-pca.pem
index e3641ad47e..e69de29bb2 100644
--- a/src/lib/libssl/src/test/dsa-pca.pem
+++ b/src/lib/libssl/src/test/dsa-pca.pem
@@ -1,49 +0,0 @@
------BEGIN DSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,F80EEEBEEA7386C4
-
-GZ9zgFcHOlnhPoiSbVi/yXc9mGoj44A6IveD4UlpSEUt6Xbse3Fr0KHIUyQ3oGnS
-mClKoAp/eOTb5Frhto85SzdsxYtac+X1v5XwdzAMy2KowHVk1N8A5jmE2OlkNPNt
-of132MNlo2cyIRYaa35PPYBGNCmUm7YcYS8O90YtkrQZZTf4+2C4kllhMcdkQwkr
-FWSWC8YOQ7w0LHb4cX1FejHHom9Nd/0PN3vn3UyySvfOqoR7nbXkrpHXmPIr0hxX
-RcF0aXcV/CzZ1/nfXWQf4o3+oD0T22SDoVcZY60IzI0oIc3pNCbDV3uKNmgekrFd
-qOUJ+QW8oWp7oefRx62iBfIeC8DZunohMXaWAQCU0sLQOR4yEdeUCnzCSywe0bG1
-diD0KYaEe+Yub1BQH4aLsBgDjardgpJRTQLq0DUvw0/QGO1irKTJzegEDNVBKrVn
-V4AHOKT1CUKqvGNRP1UnccUDTF6miOAtaj/qpzra7sSk7dkGBvIEeFoAg84kfh9h
-hVvF1YyzC9bwZepruoqoUwke/WdNIR5ymOVZ/4Liw0JdIOcq+atbdRX08niqIRkf
-dsZrUj4leo3zdefYUQ7w4N2Ns37yDFq7
------END DSA PRIVATE KEY-----
------BEGIN CERTIFICATE REQUEST-----
-MIICVTCCAhMCAQAwUzELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUx
-ITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEMMAoGA1UEAxMDUENB
-MIIBtTCCASkGBSsOAwIMMIIBHgKBgQCnP26Fv0FqKX3wn0cZMJCaCR3aajMexT2G
-lrMV4FMuj+BZgnOQPnUxmUd6UvuF5NmmezibaIqEm4fGHrV+hktTW1nPcWUZiG7O
-Zq5riDb77Cjcwtelu+UsOSZL2ppwGJU3lRBWI/YV7boEXt45T/23Qx+1pGVvzYAR
-5HCVW1DNSQIVAPcHMe36bAYD1YWKHKycZedQZmVvAoGATd9MA6aRivUZb1BGJZnl
-aG8w42nh5bNdmLsohkj83pkEP1+IDJxzJA0gXbkqmj8YlifkYofBe3RiU/xhJ6h6
-kQmdtvFNnFQPWAbuSXQHzlV+I84W9srcWmEBfslxtU323DQph2j2XiCTs9v15Als
-QReVkusBtXOlan7YMu0OArgDgYUAAoGBAKbtuR5AdW+ICjCFe2ixjUiJJzM2IKwe
-6NZEMXg39+HQ1UTPTmfLZLps+rZfolHDXuRKMXbGFdSF0nXYzotPCzi7GauwEJTZ
-yr27ZZjA1C6apGSQ9GzuwNvZ4rCXystVEagAS8OQ4H3D4dWS17Zg31ICb5o4E5r0
-z09o/Uz46u0VoAAwCQYFKw4DAhsFAAMxADAuAhUArRubTxsbIXy3AhtjQ943AbNB
-nSICFQCu+g1iW3jwF+gOcbroD4S/ZcvB3w==
------END CERTIFICATE REQUEST-----
------BEGIN CERTIFICATE-----
-MIIC0zCCApECAQAwCQYFKw4DAhsFADBTMQswCQYDVQQGEwJBVTETMBEGA1UECBMK
-U29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQww
-CgYDVQQDEwNQQ0EwHhcNOTcwNjE0MjI1NDQ1WhcNOTcwNzE0MjI1NDQ1WjBTMQsw
-CQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJu
-ZXQgV2lkZ2l0cyBQdHkgTHRkMQwwCgYDVQQDEwNQQ0EwggG1MIIBKQYFKw4DAgww
-ggEeAoGBAKc/boW/QWopffCfRxkwkJoJHdpqMx7FPYaWsxXgUy6P4FmCc5A+dTGZ
-R3pS+4Xk2aZ7OJtoioSbh8YetX6GS1NbWc9xZRmIbs5mrmuINvvsKNzC16W75Sw5
-JkvamnAYlTeVEFYj9hXtugRe3jlP/bdDH7WkZW/NgBHkcJVbUM1JAhUA9wcx7fps
-BgPVhYocrJxl51BmZW8CgYBN30wDppGK9RlvUEYlmeVobzDjaeHls12YuyiGSPze
-mQQ/X4gMnHMkDSBduSqaPxiWJ+Rih8F7dGJT/GEnqHqRCZ228U2cVA9YBu5JdAfO
-VX4jzhb2ytxaYQF+yXG1TfbcNCmHaPZeIJOz2/XkCWxBF5WS6wG1c6Vqftgy7Q4C
-uAOBhQACgYEApu25HkB1b4gKMIV7aLGNSIknMzYgrB7o1kQxeDf34dDVRM9OZ8tk
-umz6tl+iUcNe5EoxdsYV1IXSddjOi08LOLsZq7AQlNnKvbtlmMDULpqkZJD0bO7A
-29nisJfKy1URqABLw5DgfcPh1ZLXtmDfUgJvmjgTmvTPT2j9TPjq7RUwCQYFKw4D
-AhsFAAMxADAuAhUAvtv6AkMolix1Jvy3UnVEIUqdCUICFQC+jq8P49mwrY9oJ24n
-5rKUjNBhSg==
------END CERTIFICATE-----
-
diff --git a/src/lib/libssl/src/test/maketests.com b/src/lib/libssl/src/test/maketests.com
index e4b052e688..1246d9a077 100644
--- a/src/lib/libssl/src/test/maketests.com
+++ b/src/lib/libssl/src/test/maketests.com
@@ -147,7 +147,7 @@ $ TEST_FILES = "BNTEST,IDEATEST,MD2TEST,MD5TEST,HMACTEST,"+ -
                "RC2TEST,RC4TEST,RC5TEST,"+ -
                "DESTEST,SHATEST,SHA1TEST,MDC2TEST,RMDTEST,"+ -
                "RANDTEST,DHTEST,"+ -
-               "BFTEST,CASTTEST,SSLTEST,EXPTEST,DSATEST,RSA_OAEP_TEST"
+               "BFTEST,CASTTEST,SSLTEST,EXPTEST,DSATEST,RSA_TEST"
 $ TCPIP_PROGRAMS = ",,"
 $ IF COMPILER .EQS. "VAXC" THEN -
      TCPIP_PROGRAMS = ",SSLTEST,"
@@ -730,12 +730,36 @@ $!
 $! Set Up Initial CC Definitions, Possibly With User Ones
 $!
 $ CCDEFS = "VMS=1,TCPIP_TYPE_''P4'"
+$ IF F$TRNLNM("OPENSSL_NO_ASM") THEN CCDEFS = CCDEFS + ",NO_ASM"
+$ IF F$TRNLNM("OPENSSL_NO_RSA") THEN CCDEFS = CCDEFS + ",NO_RSA"
+$ IF F$TRNLNM("OPENSSL_NO_DSA") THEN CCDEFS = CCDEFS + ",NO_DSA"
+$ IF F$TRNLNM("OPENSSL_NO_DH") THEN CCDEFS = CCDEFS + ",NO_DH"
+$ IF F$TRNLNM("OPENSSL_NO_MD2") THEN CCDEFS = CCDEFS + ",NO_MD2"
+$ IF F$TRNLNM("OPENSSL_NO_MD5") THEN CCDEFS = CCDEFS + ",NO_MD5"
+$ IF F$TRNLNM("OPENSSL_NO_RIPEMD") THEN CCDEFS = CCDEFS + ",NO_RIPEMD"
+$ IF F$TRNLNM("OPENSSL_NO_SHA") THEN CCDEFS = CCDEFS + ",NO_SHA"
+$ IF F$TRNLNM("OPENSSL_NO_SHA0") THEN CCDEFS = CCDEFS + ",NO_SHA0"
+$ IF F$TRNLNM("OPENSSL_NO_SHA1") THEN CCDEFS = CCDEFS + ",NO_SHA1"
+$ IF F$TRNLNM("OPENSSL_NO_DES")
+$ THEN
+$   CCDEFS = CCDEFS + ",NO_DES,NO_MDC2"
+$ ELSE
+$   IF F$TRNLNM("OPENSSL_NO_MDC2") THEN CCDEFS = CCDEFS + ",NO_MDC2"
+$ ENDIF
+$ IF F$TRNLNM("OPENSSL_NO_RC2") THEN CCDEFS = CCDEFS + ",NO_RC2"
+$ IF F$TRNLNM("OPENSSL_NO_RC4") THEN CCDEFS = CCDEFS + ",NO_RC4"
+$ IF F$TRNLNM("OPENSSL_NO_RC5") THEN CCDEFS = CCDEFS + ",NO_RC5"
+$ IF F$TRNLNM("OPENSSL_NO_IDEA") THEN CCDEFS = CCDEFS + ",NO_IDEA"
+$ IF F$TRNLNM("OPENSSL_NO_BF") THEN CCDEFS = CCDEFS + ",NO_BF"
+$ IF F$TRNLNM("OPENSSL_NO_CAST") THEN CCDEFS = CCDEFS + ",NO_CAST"
+$ IF F$TRNLNM("OPENSSL_NO_HMAC") THEN CCDEFS = CCDEFS + ",NO_HMAC"
+$ IF F$TRNLNM("OPENSSL_NO_SSL2") THEN CCDEFS = CCDEFS + ",NO_SSL2"
 $ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS
 $ CCEXTRAFLAGS = ""
 $ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS
-$ CCDISABLEWARNINGS = ""
+$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"
 $ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -
-        CCDISABLEWARNINGS = USER_CCDISABLEWARNINGS
+        CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS
 $!
 $!  Check To See If The User Entered A Valid Paramter.
 $!
diff --git a/src/lib/libssl/src/test/rsa_test.c b/src/lib/libssl/src/test/rsa_test.c
new file mode 100644
index 0000000000..e5ae0c1f69
--- /dev/null
+++ b/src/lib/libssl/src/test/rsa_test.c
@@ -0,0 +1,314 @@
+/* test vectors from p1ovect1.txt */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "openssl/e_os.h"
+
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+#ifdef NO_RSA
+int main(int argc, char *argv[])
+{
+    printf("No RSA support\n");
+    return(0);
+}
+#else
+#include <openssl/rsa.h>
+
+#define SetKey \
+  key->n = BN_bin2bn(n, sizeof(n)-1, key->n); \
+  key->e = BN_bin2bn(e, sizeof(e)-1, key->e); \
+  key->d = BN_bin2bn(d, sizeof(d)-1, key->d); \
+  key->p = BN_bin2bn(p, sizeof(p)-1, key->p); \
+  key->q = BN_bin2bn(q, sizeof(q)-1, key->q); \
+  key->dmp1 = BN_bin2bn(dmp1, sizeof(dmp1)-1, key->dmp1); \
+  key->dmq1 = BN_bin2bn(dmq1, sizeof(dmq1)-1, key->dmq1); \
+  key->iqmp = BN_bin2bn(iqmp, sizeof(iqmp)-1, key->iqmp); \
+  memcpy(c, ctext_ex, sizeof(ctext_ex) - 1); \
+  return (sizeof(ctext_ex) - 1);
+
+static int key1(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F"
+"\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5"
+"\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93"
+"\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1"
+"\xF5";
+
+    static unsigned char e[] = "\x11";
+
+    static unsigned char d[] =
+"\x0A\x03\x37\x48\x62\x64\x87\x69\x5F\x5F\x30\xBC\x38\xB9\x8B\x44"
+"\xC2\xCD\x2D\xFF\x43\x40\x98\xCD\x20\xD8\xA1\x38\xD0\x90\xBF\x64"
+"\x79\x7C\x3F\xA7\xA2\xCD\xCB\x3C\xD1\xE0\xBD\xBA\x26\x54\xB4\xF9"
+"\xDF\x8E\x8A\xE5\x9D\x73\x3D\x9F\x33\xB3\x01\x62\x4A\xFD\x1D\x51";
+
+    static unsigned char p[] =
+"\x00\xD8\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
+"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x12"
+"\x0D";
+    
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
+"\x89";
+
+    static unsigned char dmp1[] =
+"\x59\x0B\x95\x72\xA2\xC2\xA9\xC4\x06\x05\x9D\xC2\xAB\x2F\x1D\xAF"
+"\xEB\x7E\x8B\x4F\x10\xA7\x54\x9E\x8E\xED\xF5\xB4\xFC\xE0\x9E\x05";
+
+    static unsigned char dmq1[] =
+"\x00\x8E\x3C\x05\x21\xFE\x15\xE0\xEA\x06\xA3\x6F\xF0\xF1\x0C\x99"
+"\x52\xC3\x5B\x7A\x75\x14\xFD\x32\x38\xB8\x0A\xAD\x52\x98\x62\x8D"
+"\x51";
+
+    static unsigned char iqmp[] =
+"\x36\x3F\xF7\x18\x9D\xA8\xE9\x0B\x1D\x34\x1F\x71\xD0\x9B\x76\xA8"
+"\xA9\x43\xE1\x1D\x10\xB2\x4D\x24\x9F\x2D\xEA\xFE\xF8\x0C\x18\x26";
+
+    static unsigned char ctext_ex[] =
+"\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89"
+"\x2b\xfb\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52"
+"\x33\x89\x5c\x74\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44"
+"\xb0\x05\xc3\x9e\xd8\x27\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";
+
+    SetKey;
+    }
+
+static int key2(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xA3\x07\x9A\x90\xDF\x0D\xFD\x72\xAC\x09\x0C\xCC\x2A\x78\xB8"
+"\x74\x13\x13\x3E\x40\x75\x9C\x98\xFA\xF8\x20\x4F\x35\x8A\x0B\x26"
+"\x3C\x67\x70\xE7\x83\xA9\x3B\x69\x71\xB7\x37\x79\xD2\x71\x7B\xE8"
+"\x34\x77\xCF";
+
+    static unsigned char e[] = "\x3";
+
+    static unsigned char d[] =
+"\x6C\xAF\xBC\x60\x94\xB3\xFE\x4C\x72\xB0\xB3\x32\xC6\xFB\x25\xA2"
+"\xB7\x62\x29\x80\x4E\x68\x65\xFC\xA4\x5A\x74\xDF\x0F\x8F\xB8\x41"
+"\x3B\x52\xC0\xD0\xE5\x3D\x9B\x59\x0F\xF1\x9B\xE7\x9F\x49\xDD\x21"
+"\xE5\xEB";
+
+    static unsigned char p[] =
+"\x00\xCF\x20\x35\x02\x8B\x9D\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92"
+"\xEA\x0D\xA3\xB4\x32\x04\xB5\xCF\xCE\x91";
+
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5F";
+    
+    static unsigned char dmp1[] =
+"\x00\x8A\x15\x78\xAC\x5D\x13\xAF\x10\x2B\x22\xB9\x99\xCD\x74\x61"
+"\xF1\x5E\x6D\x22\xCC\x03\x23\xDF\xDF\x0B";
+
+    static unsigned char dmq1[] =
+"\x00\x86\x55\x21\x4A\xC5\x4D\x8D\x4E\xCD\x61\x77\xF1\xC7\x36\x90"
+"\xCE\x2A\x48\x2C\x8B\x05\x99\xCB\xE0\x3F";
+
+    static unsigned char iqmp[] =
+"\x00\x83\xEF\xEF\xB8\xA9\xA4\x0D\x1D\xB6\xED\x98\xAD\x84\xED\x13"
+"\x35\xDC\xC1\x08\xF3\x22\xD0\x57\xCF\x8D";
+
+    static unsigned char ctext_ex[] =
+"\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a"
+"\x8b\x40\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4"
+"\x17\x53\x03\x29\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52"
+"\x62\x51";
+
+    SetKey;
+    }
+
+static int key3(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xBB\xF8\x2F\x09\x06\x82\xCE\x9C\x23\x38\xAC\x2B\x9D\xA8\x71"
+"\xF7\x36\x8D\x07\xEE\xD4\x10\x43\xA4\x40\xD6\xB6\xF0\x74\x54\xF5"
+"\x1F\xB8\xDF\xBA\xAF\x03\x5C\x02\xAB\x61\xEA\x48\xCE\xEB\x6F\xCD"
+"\x48\x76\xED\x52\x0D\x60\xE1\xEC\x46\x19\x71\x9D\x8A\x5B\x8B\x80"
+"\x7F\xAF\xB8\xE0\xA3\xDF\xC7\x37\x72\x3E\xE6\xB4\xB7\xD9\x3A\x25"
+"\x84\xEE\x6A\x64\x9D\x06\x09\x53\x74\x88\x34\xB2\x45\x45\x98\x39"
+"\x4E\xE0\xAA\xB1\x2D\x7B\x61\xA5\x1F\x52\x7A\x9A\x41\xF6\xC1\x68"
+"\x7F\xE2\x53\x72\x98\xCA\x2A\x8F\x59\x46\xF8\xE5\xFD\x09\x1D\xBD"
+"\xCB";
+
+    static unsigned char e[] = "\x11";
+
+    static unsigned char d[] =
+"\x00\xA5\xDA\xFC\x53\x41\xFA\xF2\x89\xC4\xB9\x88\xDB\x30\xC1\xCD"
+"\xF8\x3F\x31\x25\x1E\x06\x68\xB4\x27\x84\x81\x38\x01\x57\x96\x41"
+"\xB2\x94\x10\xB3\xC7\x99\x8D\x6B\xC4\x65\x74\x5E\x5C\x39\x26\x69"
+"\xD6\x87\x0D\xA2\xC0\x82\xA9\x39\xE3\x7F\xDC\xB8\x2E\xC9\x3E\xDA"
+"\xC9\x7F\xF3\xAD\x59\x50\xAC\xCF\xBC\x11\x1C\x76\xF1\xA9\x52\x94"
+"\x44\xE5\x6A\xAF\x68\xC5\x6C\x09\x2C\xD3\x8D\xC3\xBE\xF5\xD2\x0A"
+"\x93\x99\x26\xED\x4F\x74\xA1\x3E\xDD\xFB\xE1\xA1\xCE\xCC\x48\x94"
+"\xAF\x94\x28\xC2\xB7\xB8\x88\x3F\xE4\x46\x3A\x4B\xC8\x5B\x1C\xB3"
+"\xC1";
+
+    static unsigned char p[] =
+"\x00\xEE\xCF\xAE\x81\xB1\xB9\xB3\xC9\x08\x81\x0B\x10\xA1\xB5\x60"
+"\x01\x99\xEB\x9F\x44\xAE\xF4\xFD\xA4\x93\xB8\x1A\x9E\x3D\x84\xF6"
+"\x32\x12\x4E\xF0\x23\x6E\x5D\x1E\x3B\x7E\x28\xFA\xE7\xAA\x04\x0A"
+"\x2D\x5B\x25\x21\x76\x45\x9D\x1F\x39\x75\x41\xBA\x2A\x58\xFB\x65"
+"\x99";
+
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
+"\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
+"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x15"
+"\x03";
+
+    static unsigned char dmp1[] =
+"\x54\x49\x4C\xA6\x3E\xBA\x03\x37\xE4\xE2\x40\x23\xFC\xD6\x9A\x5A"
+"\xEB\x07\xDD\xDC\x01\x83\xA4\xD0\xAC\x9B\x54\xB0\x51\xF2\xB1\x3E"
+"\xD9\x49\x09\x75\xEA\xB7\x74\x14\xFF\x59\xC1\xF7\x69\x2E\x9A\x2E"
+"\x20\x2B\x38\xFC\x91\x0A\x47\x41\x74\xAD\xC9\x3C\x1F\x67\xC9\x81";
+
+    static unsigned char dmq1[] =
+"\x47\x1E\x02\x90\xFF\x0A\xF0\x75\x03\x51\xB7\xF8\x78\x86\x4C\xA9"
+"\x61\xAD\xBD\x3A\x8A\x7E\x99\x1C\x5C\x05\x56\xA9\x4C\x31\x46\xA7"
+"\xF9\x80\x3F\x8F\x6F\x8A\xE3\x42\xE9\x31\xFD\x8A\xE4\x7A\x22\x0D"
+"\x1B\x99\xA4\x95\x84\x98\x07\xFE\x39\xF9\x24\x5A\x98\x36\xDA\x3D";
+    
+    static unsigned char iqmp[] =
+"\x00\xB0\x6C\x4F\xDA\xBB\x63\x01\x19\x8D\x26\x5B\xDB\xAE\x94\x23"
+"\xB3\x80\xF2\x71\xF7\x34\x53\x88\x50\x93\x07\x7F\xCD\x39\xE2\x11"
+"\x9F\xC9\x86\x32\x15\x4F\x58\x83\xB1\x67\xA9\x67\xBF\x40\x2B\x4E"
+"\x9E\x2E\x0F\x96\x56\xE6\x98\xEA\x36\x66\xED\xFB\x25\x79\x80\x39"
+"\xF7";
+
+    static unsigned char ctext_ex[] =
+"\xb8\x24\x6b\x56\xa6\xed\x58\x81\xae\xb5\x85\xd9\xa2\x5b\x2a\xd7"
+"\x90\xc4\x17\xe0\x80\x68\x1b\xf1\xac\x2b\xc3\xde\xb6\x9d\x8b\xce"
+"\xf0\xc4\x36\x6f\xec\x40\x0a\xf0\x52\xa7\x2e\x9b\x0e\xff\xb5\xb3"
+"\xf2\xf1\x92\xdb\xea\xca\x03\xc1\x27\x40\x05\x71\x13\xbf\x1f\x06"
+"\x69\xac\x22\xe9\xf3\xa7\x85\x2e\x3c\x15\xd9\x13\xca\xb0\xb8\x86"
+"\x3a\x95\xc9\x92\x94\xce\x86\x74\x21\x49\x54\x61\x03\x46\xf4\xd4"
+"\x74\xb2\x6f\x7c\x48\xb4\x2e\xe6\x8e\x1f\x57\x2a\x1f\xc4\x02\x6a"
+"\xc4\x56\xb4\xf5\x9f\x7b\x62\x1e\xa1\xb9\xd8\x8f\x64\x20\x2f\xb1";
+
+    SetKey;
+    }
+
+static int pad_unknown(void)
+{
+    unsigned long l;
+    while ((l = ERR_get_error()) != 0)
+      if (ERR_GET_REASON(l) == RSA_R_UNKNOWN_PADDING_TYPE)
+        return(1);
+    return(0);
+}
+
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
+int main(int argc, char *argv[])
+    {
+    int err=0;
+    int v;
+    RSA *key;
+    unsigned char ptext[256];
+    unsigned char ctext[256];
+    static unsigned char ptext_ex[] = "\x54\x85\x9b\x34\x2c\x49\xea\x2a";
+    unsigned char ctext_ex[256];
+    int plen;
+    int clen = 0;
+    int num;
+
+    RAND_seed(rnd_seed, sizeof rnd_seed); /* or OAEP may fail */
+
+    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+        
+    plen = sizeof(ptext_ex) - 1;
+
+    for (v = 0; v < 3; v++)
+        {
+        key = RSA_new();
+        switch (v) {
+    case 0:
+        clen = key1(key, ctext_ex);
+        break;
+    case 1:
+        clen = key2(key, ctext_ex);
+        break;
+    case 2:
+        clen = key3(key, ctext_ex);
+        break;
+        }
+
+        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
+                                 RSA_PKCS1_PADDING);
+        if (num != clen)
+            {
+            printf("PKCS#1 v1.5 encryption failed!\n");
+            err=1;
+            goto oaep;
+            }
+  
+        num = RSA_private_decrypt(num, ctext, ptext, key,
+                                  RSA_PKCS1_PADDING);
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("PKCS#1 v1.5 decryption failed!\n");
+            err=1;
+            }
+        else
+            printf("PKCS #1 v1.5 encryption/decryption ok\n");
+
+    oaep:
+        ERR_clear_error();
+        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
+                                 RSA_PKCS1_OAEP_PADDING);
+        if (num == -1 && pad_unknown())
+            {
+            printf("No OAEP support\n");
+            goto next;
+            }
+        if (num != clen)
+            {
+            printf("OAEP encryption failed!\n");
+            err=1;
+            goto next;
+            }
+  
+        num = RSA_private_decrypt(num, ctext, ptext, key,
+                                  RSA_PKCS1_OAEP_PADDING);
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("OAEP decryption (encrypted data) failed!\n");
+            err=1;
+            }
+        else if (memcmp(ctext, ctext_ex, num) == 0)
+            {
+            printf("OAEP test vector %d passed!\n", v);
+            goto next;
+            }
+    
+        /* Different ciphertexts (rsa_oaep.c without -DPKCS_TESTVECT).
+           Try decrypting ctext_ex */
+
+        num = RSA_private_decrypt(clen, ctext_ex, ptext, key,
+                                  RSA_PKCS1_OAEP_PADDING);
+
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("OAEP decryption (test vector data) failed!\n");
+            err=1;
+            }
+        else
+            printf("OAEP encryption/decryption ok\n");
+    next:
+        RSA_free(key);
+        }
+
+    ERR_remove_state(0);
+
+    CRYPTO_mem_leaks_fp(stdout);
+
+    return err;
+    }
+#endif
diff --git a/src/lib/libssl/src/test/tcrl.com b/src/lib/libssl/src/test/tcrl.com
index cef21467bb..2e6ab2814d 100644
--- a/src/lib/libssl/src/test/tcrl.com
+++ b/src/lib/libssl/src/test/tcrl.com
@@ -10,6 +10,9 @@ $	t := testcrl.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing CRL conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: fff.p ff.p2
+$!      backup/compare fff.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$!      difference/output=nl: f.t ff.t1
+$!      backup/compare f.t ff.t1
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t2
+$!      backup/compare f.t ff.t2
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t3
+$!      backup/compare f.t ff.t3
 $!      if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.p ff.p2
+$!      backup/compare f.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/src/test/testca.com b/src/lib/libssl/src/test/testca.com
index ea75479cd5..c670f2bf5f 100644
--- a/src/lib/libssl/src/test/testca.com
+++ b/src/lib/libssl/src/test/testca.com
@@ -40,7 +40,9 @@ $
 $       set noon
 $       call deltree [.demoCA]*.*
 $       set file/prot=(S:RWED,O:RWED,G:RWED,W:RWED) demoCA.dir;*
-$       delete demoCA.dir;*,newcert.pem;*,newreq.pem;*
+$       delete demoCA.dir;*
+$       if f$search("newcert.pem") .nes. "" then delete newcert.pem;*
+$       if f$search("newcert.pem") .nes. "" then delete newreq.pem;*
 $       set on
 $!      #usage: CA -newcert|-newreq|-newca|-sign|-verify
 $
diff --git a/src/lib/libssl/src/test/testenc.com b/src/lib/libssl/src/test/testenc.com
index 0756e8bada..3b66f2e0d0 100644
--- a/src/lib/libssl/src/test/testenc.com
+++ b/src/lib/libssl/src/test/testenc.com
@@ -8,19 +8,23 @@ $	testsrc := makefile.ssl
 $       test := p.txt
 $       cmd := mcr 'exe_dir'openssl
 $
+$       if f$search(test) .nes. "" then delete 'test';*
 $       copy 'testsrc' 'test'
 $
+$       if f$search(test+"-cipher") .nes. "" then delete 'test'-cipher;*
+$       if f$search(test+"-clear") .nes. "" then delete 'test'-clear;*
+$
 $       write sys$output "cat"
 $       'cmd' enc -in 'test' -out 'test'-cipher
 $       'cmd' enc -in 'test'-cipher -out 'test'-clear
-$       difference/output=nl: 'test' 'test'-clear
+$       backup/compare 'test' 'test'-clear
 $       if $severity .ne. 1 then exit 3
 $       delete 'test'-cipher;*,'test'-clear;*
 $
 $       write sys$output "base64"
 $       'cmd' enc -a -e -in 'test' -out 'test'-cipher
 $       'cmd' enc -a -d -in 'test'-cipher -out 'test'-clear
-$       difference/output=nl: 'test' 'test'-clear
+$       backup/compare 'test' 'test'-clear
 $       if $severity .ne. 1 then exit 3
 $       delete 'test'-cipher;*,'test'-clear;*
 $
@@ -30,16 +34,22 @@ $	open/read f 'test'-cipher-commands
 $ loop_cipher_commands:
 $       read/end=loop_cipher_commands_end f i
 $       write sys$output i
+$
+$       if f$search(test+"-"+i+"-cipher") .nes. "" then -
+                delete 'test'-'i'-cipher;*
+$       if f$search(test+"-"+i+"-clear") .nes. "" then -
+                delete 'test'-'i'-clear;*
+$
 $       'cmd' 'i' -bufsize 113 -e -k test -in 'test' -out 'test'-'i'-cipher
 $       'cmd' 'i' -bufsize 157 -d -k test -in 'test'-'i'-cipher -out 'test'-'i'-clear
-$       difference/output=nl: 'test' 'test'-'i'-clear
+$       backup/compare 'test' 'test'-'i'-clear
 $       if $severity .ne. 1 then exit 3
 $       delete 'test'-'i'-cipher;*,'test'-'i'-clear;*
 $
 $       write sys$output i," base64"
 $       'cmd' 'i' -bufsize 113 -a -e -k test -in 'test' -out 'test'-'i'-cipher
 $       'cmd' 'i' -bufsize 157 -a -d -k test -in 'test'-'i'-cipher -out 'test'-'i'-clear
-$       difference/output=nl: 'test' 'test'-'i'-clear
+$       backup/compare 'test' 'test'-'i'-clear
 $       if $severity .ne. 1 then exit 3
 $       delete 'test'-'i'-cipher;*,'test'-'i'-clear;*
 $
diff --git a/src/lib/libssl/src/test/testgen b/src/lib/libssl/src/test/testgen
index 3534f5821f..c5f61b582b 100644
--- a/src/lib/libssl/src/test/testgen
+++ b/src/lib/libssl/src/test/testgen
@@ -15,6 +15,8 @@ echo "There should be a 2 sequences of .'s and some +'s."
 echo "There should not be more that at most 80 per line"
 echo "This could take some time."
 
+echo "string to make the random number generator think it has entropy" >> ./.rnd
+
 ../apps/openssl req -config test.cnf -new -out testreq.pem
 if [ $? != 0 ]; then
 echo problems creating request
diff --git a/src/lib/libssl/src/test/testgen.com b/src/lib/libssl/src/test/testgen.com
index ec302f524a..0e9029371a 100644
--- a/src/lib/libssl/src/test/testgen.com
+++ b/src/lib/libssl/src/test/testgen.com
@@ -20,6 +20,11 @@ $	write sys$output "There should be a 2 sequences of .'s and some +'s."
 $       write sys$output "There should not be more that at most 80 per line"
 $       write sys$output "This could take some time."
 $
+$       append/new nl: .rnd
+$       open/append random_file .rnd
+$       write random_file "string to make the random number generator think it has entropy"
+$       close random_file
+$
 $       mcr 'exe_dir'openssl req -config test.cnf -new -out testreq.pem
 $       if $severity .ne. 1
 $       then
diff --git a/src/lib/libssl/src/test/tests.com b/src/lib/libssl/src/test/tests.com
index 147b8aa838..040dafab8d 100644
--- a/src/lib/libssl/src/test/tests.com
+++ b/src/lib/libssl/src/test/tests.com
@@ -20,9 +20,9 @@ $	    tests = p1
 $       else
 $           tests := -
         test_des,test_idea,test_sha,test_md5,test_hmac,test_md2,test_mdc2,-
-        test_rc2,test_rc4,test_rc5,test_bf,test_cast,-
+        test_rmd,test_rc2,test_rc4,test_rc5,test_bf,test_cast,-
         test_rand,test_bn,test_enc,test_x509,test_rsa,test_crl,test_sid,-
-        test_reqgen,test_req,test_pkcs7,test_verify,test_dh,test_dsa,-
+        test_gen,test_req,test_pkcs7,test_verify,test_dh,test_dsa,-
         test_ss,test_ssl,test_ca
 $       endif
 $       tests = f$edit(tests,"COLLAPSE")
@@ -48,7 +48,7 @@ $	DHTEST :=	dhtest
 $       DSATEST :=      dsatest
 $       METHTEST :=     methtest
 $       SSLTEST :=      ssltest
-$       RSATEST :=      rsa_oaep_test
+$       RSATEST :=      rsa_test
 $
 $       tests_i = 0
 $ loop_tests:
@@ -151,9 +151,7 @@ RECORD
 $       create/fdl=bntest-vms.fdl bntest-vms.sh
 $       open/append foo bntest-vms.sh
 $       type/output=foo: sys$input:
-<< __FOO__ bc | awk '{ \
-if ($$0 != "0") {print "error"; exit(1); } \
-if (((NR+1)%64) == 0) print NR+1," tests done"; }'
+<< __FOO__ bc | perl -e 'while (<STDIN>) {if (/^test (.*)/) {print STDERR "\nverify $1";} elsif (!/^0$/) {die "\nFailed! bc: $_";} print STDERR "."; $i++;} print STDERR "\n$i tests passed\n"'
 $       define/user sys$output bntest-vms.tmp
 $       mcr 'texe_dir''bntest'
 $       copy bntest-vms.tmp foo:
@@ -173,14 +171,14 @@ $	write sys$output "There are definitly a few expired certificates"
 $       @tverify.com
 $       goto loop_tests
 $ test_dh:
-$       write sys$output "Generate as set of DH parameters"
+$       write sys$output "Generate a set of DH parameters"
 $       mcr 'texe_dir''dhtest'
 $       goto loop_tests
 $ test_dsa:
-$       write sys$output "Generate as set of DSA parameters"
+$       write sys$output "Generate a set of DSA parameters"
 $       mcr 'texe_dir''dsatest'
 $       goto loop_tests
-$ test_reqgen:
+$ test_gen:
 $       write sys$output "Generate and verify a certificate request"
 $       @testgen.com
 $       goto loop_tests
diff --git a/src/lib/libssl/src/test/testssl b/src/lib/libssl/src/test/testssl
index 255ae5e976..a88e290c57 100644
--- a/src/lib/libssl/src/test/testssl
+++ b/src/lib/libssl/src/test/testssl
@@ -63,6 +63,12 @@ echo test sslv3 with both client and server authentication via BIO pair
 echo test sslv2/sslv3 via BIO pair
 ./ssltest || exit 1
 
+echo test sslv2/sslv3 w/o DHE via BIO pair
+./ssltest -bio_pair -no_dhe || exit 1
+
+echo test sslv2/sslv3 with 1024bit DHE
+./ssltest -bio_pair -dhe1024 -v || exit 1
+
 echo test sslv2/sslv3 with server authentication
 ./ssltest -bio_pair -server_auth -CApath ../certs || exit 1
 
diff --git a/src/lib/libssl/src/test/testssl.com b/src/lib/libssl/src/test/testssl.com
index 93a9aef802..0b4b0a0ad3 100644
--- a/src/lib/libssl/src/test/testssl.com
+++ b/src/lib/libssl/src/test/testssl.com
@@ -58,6 +58,10 @@ $	write sys$output "test sslv2 via BIO pair"
 $       mcr 'exe_dir'ssltest -bio_pair -ssl2 
 $       if $severity .ne. 1 then goto exit3
 $
+$       write sys$output "test sslv2/sslv3 with 1024 bit DHE via BIO pair"
+$       mcr 'exe_dir'ssltest -bio_pair -dhe1024 -v
+$       if $severity .ne. 1 then goto exit3
+$
 $       write sys$output "test sslv2 with server authentication via BIO pair"
 $       mcr 'exe_dir'ssltest -bio_pair -ssl2 -server_auth "-CAfile" certs.tmp 
 $       if $severity .ne. 1 then goto exit3
@@ -90,6 +94,10 @@ $	write sys$output "test sslv2/sslv3 via BIO pair"
 $       mcr 'exe_dir'ssltest 
 $       if $severity .ne. 1 then goto exit3
 $
+$       write sys$output "test sslv2/sslv3 w/o DHE via BIO pair"
+$       mcr 'exe_dir'ssltest -bio_pair -no_dhe
+$       if $severity .ne. 1 then goto exit3
+$
 $       write sys$output "test sslv2/sslv3 with server authentication"
 $       mcr 'exe_dir'ssltest -bio_pair -server_auth "-CAfile" certs.tmp 
 $       if $severity .ne. 1 then goto exit3
diff --git a/src/lib/libssl/src/test/tpkcs7.com b/src/lib/libssl/src/test/tpkcs7.com
index 5ed920ac34..9e345937c6 100644
--- a/src/lib/libssl/src/test/tpkcs7.com
+++ b/src/lib/libssl/src/test/tpkcs7.com
@@ -10,6 +10,9 @@ $	t := testp7.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing PKCS7 conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -34,16 +37,16 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/src/test/tpkcs7d.com b/src/lib/libssl/src/test/tpkcs7d.com
index 08d33eaa69..7d4f8794a4 100644
--- a/src/lib/libssl/src/test/tpkcs7d.com
+++ b/src/lib/libssl/src/test/tpkcs7d.com
@@ -10,6 +10,9 @@ $	t := pkcs7-1.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing PKCS7 conversions (2)"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -34,9 +37,9 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/src/test/treq.com b/src/lib/libssl/src/test/treq.com
index 9eb1d26f6e..22c22c3aa9 100644
--- a/src/lib/libssl/src/test/treq.com
+++ b/src/lib/libssl/src/test/treq.com
@@ -10,6 +10,9 @@ $	t := testreq.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing req conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: fff.p ff.p2
+$!      backup/compare fff.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$!      difference/output=nl: f.t ff.t1
+$!      backup/compare f.t ff.t1
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t2
+$!      backup/compare f.t ff.t2
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t3
+$!      backup/compare f.t ff.t3
 $!      if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.p ff.p2
+$!      backup/compare f.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/src/test/trsa.com b/src/lib/libssl/src/test/trsa.com
index 9c9083d02b..28add5eefd 100644
--- a/src/lib/libssl/src/test/trsa.com
+++ b/src/lib/libssl/src/test/trsa.com
@@ -10,6 +10,9 @@ $	t := testrsa.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing RSA conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: fff.p ff.p2
+$!      backup/compare fff.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$!      difference/output=nl: f.t ff.t1
+$!      backup/compare f.t ff.t1
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t2
+$!      backup/compare f.t ff.t2
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t3
+$!      backup/compare f.t ff.t3
 $!      if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.p ff.p2
+$!      backup/compare f.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/src/test/tsid.com b/src/lib/libssl/src/test/tsid.com
index 28d83e5c4e..bde23f9bb9 100644
--- a/src/lib/libssl/src/test/tsid.com
+++ b/src/lib/libssl/src/test/tsid.com
@@ -10,6 +10,9 @@ $	t := testsid.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing session-id conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: fff.p ff.p2
+$!      backup/compare fff.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$!      difference/output=nl: f.t ff.t1
+$!      backup/compare f.t ff.t1
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t2
+$!      backup/compare f.t ff.t2
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t3
+$!      backup/compare f.t ff.t3
 $!      if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.p ff.p2
+$!      backup/compare f.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/src/test/tx509.com b/src/lib/libssl/src/test/tx509.com
index bbcf0a384b..985969c566 100644
--- a/src/lib/libssl/src/test/tx509.com
+++ b/src/lib/libssl/src/test/tx509.com
@@ -10,6 +10,9 @@ $	t := testx509.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing X509 conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p2
+$       backup/compare fff.p ff.p2
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.n ff.n1
+$       backup/compare f.n ff.n1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.n ff.n2
+$       backup/compare f.n ff.n2
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.n ff.n3
+$       backup/compare f.n ff.n3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p2
+$       backup/compare f.p ff.p2
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/src/util/domd b/src/lib/libssl/src/util/domd
index 324051f60b..9f75131f22 100644
--- a/src/lib/libssl/src/util/domd
+++ b/src/lib/libssl/src/util/domd
@@ -7,5 +7,5 @@ shift
 
 cp Makefile.ssl Makefile.save
 makedepend -f Makefile.ssl $@
-$TOP/util/clean-depend.pl < Makefile.ssl > Makefile.new
+perl $TOP/util/clean-depend.pl < Makefile.ssl > Makefile.new
 mv Makefile.new Makefile.ssl
diff --git a/src/lib/libssl/src/util/libeay.num b/src/lib/libssl/src/util/libeay.num
index 59c2040a29..e3818ef6e4 100644
--- a/src/lib/libssl/src/util/libeay.num
+++ b/src/lib/libssl/src/util/libeay.num
@@ -499,9 +499,9 @@ SHA1_Update				504
 SHA_Final                               505
 SHA_Init                                506
 SHA_Update                              507
-SSLeay_add_all_algorithms               508
-SSLeay_add_all_ciphers                  509
-SSLeay_add_all_digests                  510
+OpenSSL_add_all_algorithms              508
+OpenSSL_add_all_ciphers                 509
+OpenSSL_add_all_digests                 510
 TXT_DB_create_index                     511
 TXT_DB_free                             512
 TXT_DB_get_by_index                     513
@@ -1304,13 +1304,12 @@ i2d_SXNETID                             1329
 d2i_SXNETID                             1330
 SXNETID_new                             1331
 SXNETID_free                            1332
-DSA_SIG_new                                                             1333
-DSA_SIG_free                                                    1334
-DSA_do_sign                                                             1335
-DSA_do_verify                                                   1336
-d2i_DSA_SIG                                                             1337
-i2d_DSA_SIG                                                             1338
-
+DSA_SIG_new                             1333
+DSA_SIG_free                            1334
+DSA_do_sign                             1335
+DSA_do_verify                           1336
+d2i_DSA_SIG                             1337
+i2d_DSA_SIG                             1338
 i2d_ASN1_VISIBLESTRING                  1339
 d2i_ASN1_VISIBLESTRING                  1340
 i2d_ASN1_UTF8STRING                     1341
@@ -1844,3 +1843,387 @@ sk_DIST_POINT_sort                      1868
 RSA_check_key                           1869
 OBJ_obj2txt                             1870
 DSA_dup_DH                              1871
+X509_REQ_get_extensions                 1872
+X509_REQ_set_extension_nids             1873
+BIO_nwrite                              1874
+X509_REQ_extension_nid                  1875
+BIO_nread                               1876
+X509_REQ_get_extension_nids              1877
+BIO_nwrite0                             1878
+X509_REQ_add_extensions_nid             1879
+BIO_nread0                              1880
+X509_REQ_add_extensions                 1881
+BIO_new_mem_buf                         1882
+DH_set_ex_data                          1883
+DH_set_method                           1884
+DSA_OpenSSL                             1885
+DH_get_ex_data                          1886
+DH_get_ex_new_index                     1887
+DSA_new_method                          1888
+DH_new_method                           1889
+DH_OpenSSL                              1890
+DSA_get_ex_new_index                    1891
+DH_get_default_method                   1892
+DSA_set_ex_data                         1893
+DH_set_default_method                   1894
+DSA_get_ex_data                         1895
+X509V3_EXT_REQ_add_conf                 1896
+NETSCAPE_SPKI_print                     1897
+NETSCAPE_SPKI_set_pubkey                1898
+NETSCAPE_SPKI_b64_encode                1899
+NETSCAPE_SPKI_get_pubkey                1900
+NETSCAPE_SPKI_b64_decode                1901
+UTF8_putc                               1902
+UTF8_getc                               1903
+RSA_null_method                         1904
+ASN1_tag2str                            1905
+BIO_ctrl_reset_read_request             1906
+DISPLAYTEXT_new                         1907
+ASN1_GENERALIZEDTIME_free               1908
+X509_REVOKED_get_ext_d2i                1909
+X509_set_ex_data                        1910
+X509_reject_set_bit_asc                 1911
+X509_NAME_add_entry_by_txt              1912
+sk_X509_TRUST_pop                       1913
+X509_NAME_add_entry_by_NID              1914
+X509_PURPOSE_get0                       1915
+sk_ACCESS_DESCRIPTION_shift             1916
+PEM_read_X509_AUX                       1917
+d2i_AUTHORITY_INFO_ACCESS               1918
+sk_X509_TRUST_set_cmp_func              1919
+sk_X509_TRUST_free                      1920
+PEM_write_PUBKEY                        1921
+sk_X509_TRUST_num                       1922
+sk_ACCESS_DESCRIPTION_delete            1923
+sk_ASN1_STRING_TABLE_value              1924
+ACCESS_DESCRIPTION_new                  1925
+X509_CERT_AUX_free                      1926
+d2i_ACCESS_DESCRIPTION                  1927
+X509_trust_clear                        1928
+sk_X509_PURPOSE_value                   1929
+sk_X509_PURPOSE_zero                    1930
+X509_TRUST_add                          1931
+ASN1_VISIBLESTRING_new                  1932
+X509_alias_set1                         1933
+ASN1_PRINTABLESTRING_free               1934
+EVP_PKEY_get1_DSA                       1935
+ASN1_BMPSTRING_new                      1936
+ASN1_mbstring_copy                      1937
+ASN1_UTF8STRING_new                     1938
+sk_ACCESS_DESCRIPTION_set               1939
+sk_X509_PURPOSE_pop                     1940
+DSA_get_default_method                  1941
+sk_X509_PURPOSE_push                    1942
+sk_X509_PURPOSE_delete                  1943
+sk_X509_PURPOSE_num                     1944
+i2d_ASN1_SET_OF_ACCESS_DESCRIPTION      1945
+ASN1_T61STRING_free                     1946
+sk_ACCESS_DESCRIPTION_free              1947
+sk_ASN1_STRING_TABLE_pop                1948
+DSA_set_method                          1949
+X509_get_ex_data                        1950
+ASN1_STRING_type                        1951
+X509_PURPOSE_get_by_sname               1952
+sk_X509_PURPOSE_find                    1953
+ASN1_TIME_free                          1954
+ASN1_OCTET_STRING_cmp                   1955
+sk_ACCESS_DESCRIPTION_value             1956
+ASN1_BIT_STRING_new                     1957
+X509_get_ext_d2i                        1958
+PEM_read_bio_X509_AUX                   1959
+ASN1_STRING_set_default_mask_asc        1960
+PEM_write_bio_RSA_PUBKEY                1961
+sk_ASN1_STRING_TABLE_num                1962
+ASN1_INTEGER_cmp                        1963
+d2i_RSA_PUBKEY_fp                       1964
+sk_ACCESS_DESCRIPTION_unshift           1965
+sk_ASN1_STRING_TABLE_delete_ptr         1966
+X509_trust_set_bit_asc                  1967
+PEM_write_bio_DSA_PUBKEY                1968
+X509_STORE_CTX_free                     1969
+EVP_PKEY_set1_DSA                       1970
+i2d_DSA_PUBKEY_fp                       1971
+X509_load_cert_crl_file                 1972
+ASN1_TIME_new                           1973
+i2d_RSA_PUBKEY                          1974
+sk_X509_TRUST_pop_free                  1975
+X509_STORE_CTX_purpose_inherit          1976
+PEM_read_RSA_PUBKEY                     1977
+sk_X509_TRUST_zero                      1978
+sk_ACCESS_DESCRIPTION_pop_free          1979
+d2i_X509_AUX                            1980
+i2d_DSA_PUBKEY                          1981
+X509_CERT_AUX_print                     1982
+sk_X509_PURPOSE_new_null                1983
+PEM_read_DSA_PUBKEY                     1984
+i2d_RSA_PUBKEY_bio                      1985
+ASN1_BIT_STRING_num_asc                 1986
+i2d_PUBKEY                              1987
+ASN1_UTCTIME_free                       1988
+DSA_set_default_method                  1989
+X509_PURPOSE_get_by_id                  1990
+sk_X509_TRUST_push                      1991
+sk_ASN1_STRING_TABLE_sort               1992
+sk_X509_PURPOSE_set_cmp_func            1993
+ACCESS_DESCRIPTION_free                 1994
+PEM_read_bio_PUBKEY                     1995
+ASN1_STRING_set_by_NID                  1996
+X509_PURPOSE_get_id                     1997
+DISPLAYTEXT_free                        1998
+OTHERNAME_new                           1999
+sk_X509_TRUST_find                      2000
+X509_CERT_AUX_new                       2001
+sk_ACCESS_DESCRIPTION_dup               2002
+sk_ASN1_STRING_TABLE_pop_free           2003
+sk_ASN1_STRING_TABLE_unshift            2004
+sk_X509_TRUST_shift                     2005
+sk_ACCESS_DESCRIPTION_zero              2006
+X509_TRUST_cleanup                      2007
+X509_NAME_add_entry_by_OBJ              2008
+X509_CRL_get_ext_d2i                    2009
+sk_X509_TRUST_set                       2010
+X509_PURPOSE_get0_name                  2011
+PEM_read_PUBKEY                         2012
+sk_ACCESS_DESCRIPTION_new               2013
+i2d_DSA_PUBKEY_bio                      2014
+i2d_OTHERNAME                           2015
+ASN1_OCTET_STRING_free                  2016
+ASN1_BIT_STRING_set_asc                 2017
+sk_ACCESS_DESCRIPTION_push              2018
+X509_get_ex_new_index                   2019
+ASN1_STRING_TABLE_cleanup               2020
+X509_TRUST_get_by_id                    2021
+X509_PURPOSE_get_trust                  2022
+ASN1_STRING_length                      2023
+d2i_ASN1_SET_OF_ACCESS_DESCRIPTION      2024
+ASN1_PRINTABLESTRING_new                2025
+X509V3_get_d2i                          2026
+ASN1_ENUMERATED_free                    2027
+i2d_X509_CERT_AUX                       2028
+sk_ACCESS_DESCRIPTION_find              2029
+X509_STORE_CTX_set_trust                2030
+sk_X509_PURPOSE_unshift                 2031
+ASN1_STRING_set_default_mask            2032
+X509_STORE_CTX_new                      2033
+EVP_PKEY_get1_RSA                       2034
+sk_X509_PURPOSE_set                     2035
+sk_ASN1_STRING_TABLE_insert             2036
+sk_X509_PURPOSE_sort                    2037
+DIRECTORYSTRING_free                    2038
+PEM_write_X509_AUX                      2039
+ASN1_OCTET_STRING_set                   2040
+d2i_DSA_PUBKEY_fp                       2041
+sk_ASN1_STRING_TABLE_free               2042
+sk_X509_TRUST_value                     2043
+d2i_RSA_PUBKEY                          2044
+sk_ASN1_STRING_TABLE_set                2045
+X509_TRUST_get0_name                    2046
+X509_TRUST_get0                         2047
+AUTHORITY_INFO_ACCESS_free              2048
+ASN1_IA5STRING_new                      2049
+d2i_DSA_PUBKEY                          2050
+X509_check_purpose                      2051
+ASN1_ENUMERATED_new                     2052
+d2i_RSA_PUBKEY_bio                      2053
+d2i_PUBKEY                              2054
+X509_TRUST_get_trust                    2055
+X509_TRUST_get_flags                    2056
+ASN1_BMPSTRING_free                     2057
+ASN1_T61STRING_new                      2058
+sk_X509_TRUST_unshift                   2059
+ASN1_UTCTIME_new                        2060
+sk_ACCESS_DESCRIPTION_pop               2061
+i2d_AUTHORITY_INFO_ACCESS               2062
+EVP_PKEY_set1_RSA                       2063
+X509_STORE_CTX_set_purpose              2064
+ASN1_IA5STRING_free                     2065
+PEM_write_bio_X509_AUX                  2066
+X509_PURPOSE_get_count                  2067
+CRYPTO_add_info                         2068
+sk_ACCESS_DESCRIPTION_num               2069
+sk_ASN1_STRING_TABLE_set_cmp_func       2070
+X509_NAME_ENTRY_create_by_txt           2071
+ASN1_STRING_get_default_mask            2072
+sk_X509_TRUST_dup                       2073
+X509_alias_get0                         2074
+ASN1_STRING_data                        2075
+sk_X509_TRUST_insert                    2076
+i2d_ACCESS_DESCRIPTION                  2077
+X509_trust_set_bit                      2078
+sk_X509_PURPOSE_delete_ptr              2079
+ASN1_BIT_STRING_free                    2080
+PEM_read_bio_RSA_PUBKEY                 2081
+X509_add1_reject_object                 2082
+X509_check_trust                        2083
+sk_X509_TRUST_new_null                  2084
+sk_ACCESS_DESCRIPTION_new_null          2085
+sk_ACCESS_DESCRIPTION_delete_ptr        2086
+sk_X509_TRUST_sort                      2087
+PEM_read_bio_DSA_PUBKEY                 2088
+sk_X509_TRUST_new                       2089
+X509_PURPOSE_add                        2090
+ASN1_STRING_TABLE_get                   2091
+ASN1_UTF8STRING_free                    2092
+d2i_DSA_PUBKEY_bio                      2093
+sk_ASN1_STRING_TABLE_delete             2094
+PEM_write_RSA_PUBKEY                    2095
+d2i_OTHERNAME                           2096
+sk_ACCESS_DESCRIPTION_insert            2097
+X509_reject_set_bit                     2098
+sk_X509_TRUST_delete_ptr                2099
+sk_X509_PURPOSE_pop_free                2100
+PEM_write_DSA_PUBKEY                    2101
+sk_X509_PURPOSE_free                    2102
+sk_X509_PURPOSE_dup                     2103
+sk_ASN1_STRING_TABLE_zero               2104
+X509_PURPOSE_get0_sname                 2105
+sk_ASN1_STRING_TABLE_shift              2106
+EVP_PKEY_set1_DH                        2107
+ASN1_OCTET_STRING_dup                   2108
+ASN1_BIT_STRING_set                     2109
+X509_TRUST_get_count                    2110
+ASN1_INTEGER_free                       2111
+OTHERNAME_free                          2112
+i2d_RSA_PUBKEY_fp                       2113
+ASN1_INTEGER_dup                        2114
+d2i_X509_CERT_AUX                       2115
+sk_ASN1_STRING_TABLE_new_null           2116
+PEM_write_bio_PUBKEY                    2117
+ASN1_VISIBLESTRING_free                 2118
+X509_PURPOSE_cleanup                    2119
+sk_ASN1_STRING_TABLE_push               2120
+sk_ASN1_STRING_TABLE_dup                2121
+sk_X509_PURPOSE_shift                   2122
+ASN1_mbstring_ncopy                     2123
+sk_X509_PURPOSE_new                     2124
+sk_X509_PURPOSE_insert                  2125
+ASN1_GENERALIZEDTIME_new                2126
+sk_ACCESS_DESCRIPTION_sort              2127
+EVP_PKEY_get1_DH                        2128
+sk_ACCESS_DESCRIPTION_set_cmp_func      2129
+ASN1_OCTET_STRING_new                   2130
+ASN1_INTEGER_new                        2131
+i2d_X509_AUX                            2132
+sk_ASN1_STRING_TABLE_find               2133
+ASN1_BIT_STRING_name_print              2134
+X509_cmp                                2135
+ASN1_STRING_length_set                  2136
+DIRECTORYSTRING_new                     2137
+sk_ASN1_STRING_TABLE_new                2138
+sk_X509_TRUST_delete                    2139
+X509_add1_trust_object                  2140
+PKCS12_newpass                          2141
+SMIME_write_PKCS7                       2142
+SMIME_read_PKCS7                        2143
+des_set_key_checked                     2144
+PKCS7_verify                            2145
+PKCS7_encrypt                           2146
+des_set_key_unchecked                   2147
+SMIME_crlf_copy                         2148
+i2d_ASN1_PRINTABLESTRING                2149
+PKCS7_get0_signers                      2150
+PKCS7_decrypt                           2151
+SMIME_text                              2152
+PKCS7_simple_smimecap                   2153
+PKCS7_get_smimecap                      2154
+PKCS7_sign                              2155
+PKCS7_add_attrib_smimecap               2156
+CRYPTO_dbg_set_options                  2157
+CRYPTO_remove_all_info                  2158
+CRYPTO_get_mem_debug_functions          2159
+CRYPTO_is_mem_check_on                  2160
+CRYPTO_set_mem_debug_functions          2161
+CRYPTO_pop_info                         2162
+CRYPTO_push_info_                       2163
+CRYPTO_set_mem_debug_options            2164
+PEM_write_PKCS8PrivateKey_nid           2165
+PEM_write_bio_PKCS8PrivateKey_nid       2166
+d2i_PKCS8PrivateKey_bio                 2167
+ASN1_NULL_free                          2168
+d2i_ASN1_NULL                           2169
+ASN1_NULL_new                           2170
+i2d_PKCS8PrivateKey_bio                 2171
+i2d_PKCS8PrivateKey_fp                  2172
+i2d_ASN1_NULL                           2173
+i2d_PKCS8PrivateKey_nid_fp              2174
+d2i_PKCS8PrivateKey_fp                  2175
+i2d_PKCS8PrivateKey_nid_bio             2176
+i2d_PKCS8PrivateKeyInfo_fp              2177
+i2d_PKCS8PrivateKeyInfo_bio             2178
+PEM_cb                                  2179
+i2d_PrivateKey_fp                       2180
+d2i_PrivateKey_bio                      2181
+d2i_PrivateKey_fp                       2182
+i2d_PrivateKey_bio                      2183
+X509_reject_clear                       2184
+X509_TRUST_set_default                  2185
+d2i_AutoPrivateKey                      2186
+X509_ATTRIBUTE_get0_type                2187
+X509_ATTRIBUTE_set1_data                2188
+X509at_get_attr                         2189
+X509at_get_attr_count                   2190
+X509_ATTRIBUTE_create_by_NID            2191
+X509_ATTRIBUTE_set1_object              2192
+X509_ATTRIBUTE_count                    2193
+X509_ATTRIBUTE_create_by_OBJ            2194
+X509_ATTRIBUTE_get0_object              2195
+X509at_get_attr_by_NID                  2196
+X509at_add1_attr                        2197
+X509_ATTRIBUTE_get0_data                2198
+X509at_delete_attr                      2199
+X509at_get_attr_by_OBJ                  2200
+RAND_add                                2201
+BIO_number_written                      2202
+BIO_number_read                         2203
+X509_STORE_CTX_get1_chain               2204
+ERR_load_RAND_strings                   2205
+RAND_pseudo_bytes                       2206
+X509_REQ_get_attr_by_NID                2207
+X509_REQ_get_attr                       2208
+X509_REQ_add1_attr_by_NID               2209
+X509_REQ_get_attr_by_OBJ                2210
+X509at_add1_attr_by_NID                 2211
+X509_REQ_add1_attr_by_OBJ               2212
+X509_REQ_get_attr_count                 2213
+X509_REQ_add1_attr                      2214
+X509_REQ_delete_attr                    2215
+X509at_add1_attr_by_OBJ                 2216
+X509_REQ_add1_attr_by_txt               2217
+X509_ATTRIBUTE_create_by_txt            2218
+X509at_add1_attr_by_txt                 2219
+sk_CRYPTO_EX_DATA_FUNCS_delete          2220
+sk_CRYPTO_EX_DATA_FUNCS_set             2221
+sk_CRYPTO_EX_DATA_FUNCS_unshift         2222
+sk_CRYPTO_EX_DATA_FUNCS_new_null        2223
+sk_CRYPTO_EX_DATA_FUNCS_set_cmp_func    2224
+sk_CRYPTO_EX_DATA_FUNCS_sort            2225
+sk_CRYPTO_EX_DATA_FUNCS_dup             2226
+sk_CRYPTO_EX_DATA_FUNCS_shift           2227
+sk_CRYPTO_EX_DATA_FUNCS_value           2228
+sk_CRYPTO_EX_DATA_FUNCS_pop             2229
+sk_CRYPTO_EX_DATA_FUNCS_push            2230
+sk_CRYPTO_EX_DATA_FUNCS_find            2231
+sk_CRYPTO_EX_DATA_FUNCS_new             2232
+sk_CRYPTO_EX_DATA_FUNCS_free            2233
+sk_CRYPTO_EX_DATA_FUNCS_delete_ptr      2234
+sk_CRYPTO_EX_DATA_FUNCS_num             2235
+sk_CRYPTO_EX_DATA_FUNCS_pop_free        2236
+sk_CRYPTO_EX_DATA_FUNCS_insert          2237
+sk_CRYPTO_EX_DATA_FUNCS_zero            2238
+BN_pseudo_rand                          2239
+BN_is_prime_fasttest                    2240
+BN_CTX_end                              2241
+BN_CTX_start                            2242
+BN_CTX_get                              2243
+EVP_PKEY2PKCS8_broken                   2244
+ASN1_STRING_TABLE_add                   2245
+CRYPTO_dbg_get_options                  2246
+AUTHORITY_INFO_ACCESS_new               2247
+CRYPTO_get_mem_debug_options            2248
+des_crypt                               2249
+PEM_write_bio_X509_REQ_NEW              2250
+PEM_write_X509_REQ_NEW                  2251
+BIO_callback_ctrl                       2252
+RAND_egd                                2253
+RAND_status                             2254
+bn_dump1                                2255
diff --git a/src/lib/libssl/src/util/mkdef.pl b/src/lib/libssl/src/util/mkdef.pl
index 80384af325..4e2845a4e1 100644
--- a/src/lib/libssl/src/util/mkdef.pl
+++ b/src/lib/libssl/src/util/mkdef.pl
@@ -6,26 +6,34 @@
 # prototyped functions: it then prunes the output.
 #
 
-$crypto_num="util/libeay.num";
-$ssl_num=   "util/ssleay.num";
+my $crypto_num="util/libeay.num";
+my $ssl_num=   "util/ssleay.num";
 
 my $do_update = 0;
 my $do_crypto = 0;
 my $do_ssl = 0;
-$rsaref = 0;
+my $do_ctest = 0;
+my $rsaref = 0;
 
-$W32=1;
-$NT=0;
+my $W32=1;
+my $NT=0;
 # Set this to make typesafe STACK definitions appear in DEF
-$safe_stack_def = 1;
+my $safe_stack_def = 1;
 
-$options="";
+my $options="";
 open(IN,"<Makefile.ssl") || die "unable to open Makefile.ssl!\n";
 while(<IN>) {
     $options=$1 if (/^OPTIONS=(.*)$/);
 }
 close(IN);
 
+# The following ciphers may be excluded (by Configure). This means functions
+# defined with ifndef(NO_XXX) are not included in the .def file, and everything
+# in directory xxx is ignored.
+my $no_rc2; my $no_rc4; my $no_rc5; my $no_idea; my $no_des; my $no_bf;
+my $no_cast; my $no_md2; my $no_md5; my $no_sha; my $no_ripemd; my $no_mdc2;
+my $no_rsa; my $no_dsa; my $no_dh; my $no_hmac=0;
+
 foreach (@ARGV, split(/ /, $options))
         {
         $W32=1 if $_ eq "32";
@@ -39,6 +47,7 @@ foreach (@ARGV, split(/ /, $options))
         $do_crypto=1 if $_ eq "libeay";
         $do_crypto=1 if $_ eq "crypto";
         $do_update=1 if $_ eq "update";
+        $do_ctest=1 if $_ eq "ctest";
         $rsaref=1 if $_ eq "rsaref";
 
         if    (/^no-rc2$/)      { $no_rc2=1; }
@@ -59,6 +68,7 @@ foreach (@ARGV, split(/ /, $options))
         elsif (/^no-hmac$/)     { $no_hmac=1; }
         }
 
+
 if (!$do_ssl && !$do_crypto)
         {
         print STDERR "usage: $0 ( ssl | crypto ) [ 16 | 32 | NT ] [rsaref]\n";
@@ -70,9 +80,9 @@ $max_ssl = $max_num;
 %crypto_list=&load_numbers($crypto_num);
 $max_crypto = $max_num;
 
-$ssl="ssl/ssl.h";
+my $ssl="ssl/ssl.h";
 
-$crypto ="crypto/crypto.h";
+my $crypto ="crypto/crypto.h";
 $crypto.=" crypto/des/des.h" unless $no_des;
 $crypto.=" crypto/idea/idea.h" unless $no_idea;
 $crypto.=" crypto/rc4/rc4.h" unless $no_rc4;
@@ -115,8 +125,8 @@ $crypto.=" crypto/rand/rand.h";
 $crypto.=" crypto/comp/comp.h";
 $crypto.=" crypto/tmdiff.h";
 
-@ssl_func = &do_defs("SSLEAY", $ssl);
-@crypto_func = &do_defs("LIBEAY", $crypto);
+my @ssl_func = &do_defs("SSLEAY", $ssl);
+my @crypto_func = &do_defs("LIBEAY", $crypto);
 
 
 if ($do_update) {
@@ -131,7 +141,26 @@ if($do_crypto == 1) {
         open(OUT, ">>$crypto_num");
         &update_numbers(*OUT,"LIBEAY",*crypto_list,$max_crypto, @crypto_func);
         close OUT;
-}
+} 
+
+} elsif ($do_ctest) {
+
+        print <<"EOF";
+
+/* Test file to check all DEF file symbols are present by trying
+ * to link to all of them. This is *not* intended to be run!
+ */
+
+int main()
+{
+EOF
+        &print_test_file(*STDOUT,"SSLEAY",*ssl_list,@ssl_func)
+                if $do_ssl == 1;
+
+        &print_test_file(*STDOUT,"LIBEAY",*crypto_list,@crypto_func)
+                if $do_crypto == 1;
+
+        print "}\n";
 
 } else {
 
@@ -147,14 +176,15 @@ if($do_crypto == 1) {
 sub do_defs
 {
         my($name,$files)=@_;
+        my $file;
         my @ret;
         my %funcs;
+        my $cpp;
 
         foreach $file (split(/\s+/,$files))
                 {
                 open(IN,"<$file") || die "unable to open $file:$!\n";
-
-                my $line = "", $def= "";
+                my $line = "", my $def= "";
                 my %tag = (
                         FreeBSD         => 0,
                         NOPROTO         => 0,
@@ -164,6 +194,22 @@ sub do_defs
                         NO_FP_API       => 0,
                         CONST_STRICT    => 0,
                         TRUE            => 1,
+                        NO_RC2          => 0,
+                        NO_RC4          => 0,
+                        NO_RC5          => 0,
+                        NO_IDEA         => 0,
+                        NO_DES          => 0,
+                        NO_BF           => 0,
+                        NO_CAST         => 0,
+                        NO_MD2          => 0,
+                        NO_MD5          => 0,
+                        NO_SHA          => 0,
+                        NO_RIPEMD       => 0,
+                        NO_MDC2         => 0,
+                        NO_RSA          => 0,
+                        NO_DSA          => 0,
+                        NO_DH           => 0,
+                        NO_HMAC         => 0,
                 );
                 while(<IN>) {
                         last if (/BEGIN ERROR CODES/);
@@ -214,6 +260,11 @@ sub do_defs
                                 push(@tag,"TRUE");
                                 $tag{"TRUE"}=1;
                                 next;
+                        } elsif (/^\#\s*if\s+0/) {
+                                # Dummy tag
+                                push(@tag,"TRUE");
+                                $tag{"TRUE"}=-1;
+                                next;
                         } elsif (/^\#/) {
                                 next;
                         }
@@ -250,7 +301,20 @@ sub do_defs
                                 }
                                 $funcs{"PEM_read_bio_${1}"} = 1;
                                 $funcs{"PEM_write_bio_${1}"} = 1;
-                        } elsif ( 
+                        } elsif (/^DECLARE_PEM_write\s*\(\s*(\w*)\s*,/ ||
+                                     /^DECLARE_PEM_write_cb\s*\(\s*(\w*)\s*,/ ) {
+                                if($W32) {
+                                        $funcs{"PEM_write_${1}"} = 1;
+                                }
+                                $funcs{"PEM_write_bio_${1}"} = 1;
+                        } elsif (/^DECLARE_PEM_read\s*\(\s*(\w*)\s*,/ ||
+                                     /^DECLARE_PEM_read_cb\s*\(\s*(\w*)\s*,/ ) {
+                                if($W32) {
+                                        $funcs{"PEM_read_${1}"} = 1;
+                                }
+                                $funcs{"PEM_read_bio_${1}"} = 1;
+                        } elsif (
+                                ($tag{'TRUE'} != -1) &&
                                 ($tag{'FreeBSD'} != 1) &&
                                 ($tag{'CONST_STRICT'} != 1) &&
                                 (($W32 && ($tag{'WIN16'} != 1)) ||
@@ -260,7 +324,23 @@ sub do_defs
                                 ((!$W32 && $tag{'_WINDLL'} != -1) ||
                                  ($W32 && $tag{'_WINDLL'} != 1)) &&
                                 ((($tag{'NO_FP_API'} != 1) && $W32) ||
-                                 (($tag{'NO_FP_API'} != -1) && !$W32)))
+                                 (($tag{'NO_FP_API'} != -1) && !$W32)) &&
+                                ($tag{'NO_RC2'} == 0  || !$no_rc2) &&
+                                ($tag{'NO_RC4'} == 0  || !$no_rc4) &&
+                                ($tag{'NO_RC5'} == 0  || !$no_rc5) &&
+                                ($tag{'NO_IDEA'} == 0 || !$no_idea) &&
+                                ($tag{'NO_DES'} == 0  || !$no_des) &&
+                                ($tag{'NO_BF'} == 0   || !$no_bf) &&
+                                ($tag{'NO_CAST'} == 0 || !$no_cast) &&
+                                ($tag{'NO_MD2'} == 0  || !$no_md2) &&
+                                ($tag{'NO_MD5'} == 0  || !$no_md5) &&
+                                ($tag{'NO_SHA'} == 0  || !$no_sha) &&
+                                ($tag{'NO_RIPEMD'} == 0 || !$no_ripemd) &&
+                                ($tag{'NO_MDC2'} == 0 || !$no_mdc2) &&
+                                ($tag{'NO_RSA'} == 0  || !$no_rsa) &&
+                                ($tag{'NO_DSA'} == 0  || !$no_dsa) &&
+                                ($tag{'NO_DH'} == 0   || !$no_dh) &&
+                                ($tag{'NO_HMAC'} == 0 || !$no_hmac))
                                 {
                                         if (/{|\/\*/) { # }
                                                 $line = $_;
@@ -309,8 +389,8 @@ sub do_defs
         # Prune the returned functions
 
         delete $funcs{"SSL_add_dir_cert_subjects_to_stack"};
-        delete $funcs{"des_crypt"};
         delete $funcs{"RSA_PKCS1_RSAref"} unless $rsaref;
+        delete $funcs{"bn_dump1"};
 
         if($W32) {
                 delete $funcs{"BIO_s_file_internal"};
@@ -334,10 +414,31 @@ sub do_defs
         return(@ret);
 }
 
+sub print_test_file
+{
+        (*OUT,my $name,*nums,my @functions)=@_;
+        my $n = 1; my @e; my @r;
+        my $func;
+
+        (@e)=grep(/^SSLeay/,@functions);
+        (@r)=grep(!/^SSLeay/,@functions);
+        @functions=((sort @e),(sort @r));
+
+        foreach $func (@functions) {
+                if (!defined($nums{$func})) {
+                        printf STDERR "$func does not have a number assigned\n"
+                                        if(!$do_update);
+                } else {
+                        $n=$nums{$func};
+                        print OUT "\t$func();\n";
+                }
+        }
+}
+
 sub print_def_file
 {
-        (*OUT,my $name,*nums,@functions)=@_;
-        my $n =1;
+        (*OUT,my $name,*nums,my @functions)=@_;
+        my $n = 1; my @e; my @r;
 
         if ($W32)
                 { $name.="32"; }
diff --git a/src/lib/libssl/src/util/mkerr.pl b/src/lib/libssl/src/util/mkerr.pl
index 4b3bccb13e..ebc059ef22 100644
--- a/src/lib/libssl/src/util/mkerr.pl
+++ b/src/lib/libssl/src/util/mkerr.pl
@@ -450,7 +450,7 @@ void ERR_load_${lib}_strings(void)
 #ifdef ${lib}_LIB_NAME
                 ${lib}_lib_name->error = ERR_PACK(${lib}_lib_error_code,0,0);
                 ERR_load_strings(0,${lib}_lib_name);
-#endif;
+#endif
                 }
         }
 
diff --git a/src/lib/libssl/src/util/pl/BC-32.pl b/src/lib/libssl/src/util/pl/BC-32.pl
index 09c45a21a6..df6e2c742e 100644
--- a/src/lib/libssl/src/util/pl/BC-32.pl
+++ b/src/lib/libssl/src/util/pl/BC-32.pl
@@ -19,7 +19,7 @@ $out_def="out32";
 $tmp_def="tmp32";
 $inc_def="inc32";
 #enable max error messages, disable most common warnings
-$cflags="-DWIN32_LEAN_AND_MEAN -j255 -w-aus -w-par -w-inl  -c -tWC -tWM -DWINDOWS -DWIN32 -DL_ENDIAN ";
+$cflags="-DWIN32_LEAN_AND_MEAN -q -w-aus -w-par -w-inl  -c -tWC -tWM -DWINDOWS -DWIN32 -DL_ENDIAN ";
 if ($debug)
 {
     $cflags.="-Od -y -v -vi- -D_DEBUG";
diff --git a/src/lib/libssl/src/util/pl/Mingw32.pl b/src/lib/libssl/src/util/pl/Mingw32.pl
index 84c2a22db3..585cacd820 100644
--- a/src/lib/libssl/src/util/pl/Mingw32.pl
+++ b/src/lib/libssl/src/util/pl/Mingw32.pl
@@ -17,7 +17,7 @@ $mkdir='gmkdir';
 
 $cc='gcc';
 if ($debug)
-        { $cflags="-g2 -ggdb"; }
+        { $cflags="-DL_ENDIAN -g2 -ggdb"; }
 else
         { $cflags="-DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall"; }
 
diff --git a/src/lib/libssl/src/util/pl/VC-32.pl b/src/lib/libssl/src/util/pl/VC-32.pl
index 6db1c9fe23..046f0e253c 100644
--- a/src/lib/libssl/src/util/pl/VC-32.pl
+++ b/src/lib/libssl/src/util/pl/VC-32.pl
@@ -22,7 +22,7 @@ $inc_def="inc32";
 
 if ($debug)
         {
-        $cflags=" /MDd /W3 /WX /Zi /Yd /Od /nologo -DWINDOWS -DWIN32 -D_DEBUG -DL_ENDIAN -DWIN32_LEAN_AND_MEAN -DDEBUG";
+        $cflags=" /MDd /W3 /WX /Zi /Yd /Od /nologo -DWIN32 -D_DEBUG -DL_ENDIAN -DWIN32_LEAN_AND_MEAN -DDEBUG";
         $lflags.=" /debug";
         $mlflags.=' /debug';
         }
diff --git a/src/lib/libssl/src/util/pod2man.pl b/src/lib/libssl/src/util/pod2man.pl
new file mode 100644
index 0000000000..f5ec0767ed
--- /dev/null
+++ b/src/lib/libssl/src/util/pod2man.pl
@@ -0,0 +1,1181 @@
+: #!/usr/bin/perl-5.005
+    eval 'exec /usr/bin/perl -S $0 ${1+"$@"}'
+        if $running_under_some_shell;
+
+$DEF_PM_SECTION = '3pm' || '3';
+
+=head1 NAME
+
+pod2man - translate embedded Perl pod directives into man pages
+
+=head1 SYNOPSIS
+
+B<pod2man>
+[ B<--section=>I<manext> ]
+[ B<--release=>I<relpatch> ]
+[ B<--center=>I<string> ]
+[ B<--date=>I<string> ]
+[ B<--fixed=>I<font> ]
+[ B<--official> ]
+[ B<--lax> ]
+I<inputfile>
+
+=head1 DESCRIPTION
+
+B<pod2man> converts its input file containing embedded pod directives (see
+L<perlpod>) into nroff source suitable for viewing with nroff(1) or
+troff(1) using the man(7) macro set.
+
+Besides the obvious pod conversions, B<pod2man> also takes care of
+func(), func(n), and simple variable references like $foo or @bar so
+you don't have to use code escapes for them; complex expressions like
+C<$fred{'stuff'}> will still need to be escaped, though.  Other nagging
+little roffish things that it catches include translating the minus in
+something like foo-bar, making a long dash--like this--into a real em
+dash, fixing up "paired quotes", putting a little space after the
+parens in something like func(), making C++ and PI look right, making
+double underbars have a little tiny space between them, making ALLCAPS
+a teeny bit smaller in troff(1), and escaping backslashes so you don't
+have to.
+
+=head1 OPTIONS
+
+=over 8
+
+=item center
+
+Set the centered header to a specific string.  The default is
+"User Contributed Perl Documentation", unless the C<--official> flag is
+given, in which case the default is "Perl Programmers Reference Guide".
+
+=item date
+
+Set the left-hand footer string to this value.  By default,
+the modification date of the input file will be used.
+
+=item fixed
+
+The fixed font to use for code refs.  Defaults to CW.
+
+=item official
+
+Set the default header to indicate that this page is of
+the standard release in case C<--center> is not given.
+
+=item release
+
+Set the centered footer.  By default, this is the current
+perl release.
+
+=item section
+
+Set the section for the C<.TH> macro.  The standard conventions on
+sections are to use 1 for user commands,  2 for system calls, 3 for
+functions, 4 for devices, 5 for file formats, 6 for games, 7 for
+miscellaneous information, and 8 for administrator commands.  This works
+best if you put your Perl man pages in a separate tree, like
+F</usr/local/perl/man/>.  By default, section 1 will be used
+unless the file ends in F<.pm> in which case section 3 will be selected.
+
+=item lax
+
+Don't complain when required sections aren't present.
+
+=back
+
+=head1 Anatomy of a Proper Man Page
+
+For those not sure of the proper layout of a man page, here's
+an example of the skeleton of a proper man page.  Head of the
+major headers should be setout as a C<=head1> directive, and
+are historically written in the rather startling ALL UPPER CASE
+format, although this is not mandatory.
+Minor headers may be included using C<=head2>, and are
+typically in mixed case.
+
+=over 10
+
+=item NAME
+
+Mandatory section; should be a comma-separated list of programs or
+functions documented by this podpage, such as:
+
+    foo, bar - programs to do something
+
+=item SYNOPSIS
+
+A short usage summary for programs and functions, which
+may someday be deemed mandatory.
+
+=item DESCRIPTION
+
+Long drawn out discussion of the program.  It's a good idea to break this
+up into subsections using the C<=head2> directives, like
+
+    =head2 A Sample Subection
+
+    =head2 Yet Another Sample Subection
+
+=item OPTIONS
+
+Some people make this separate from the description.
+
+=item RETURN VALUE
+
+What the program or function returns if successful.
+
+=item ERRORS
+
+Exceptions, return codes, exit stati, and errno settings.
+
+=item EXAMPLES
+
+Give some example uses of the program.
+
+=item ENVIRONMENT
+
+Envariables this program might care about.
+
+=item FILES
+
+All files used by the program.  You should probably use the FE<lt>E<gt>
+for these.
+
+=item SEE ALSO
+
+Other man pages to check out, like man(1), man(7), makewhatis(8), or catman(8).
+
+=item NOTES
+
+Miscellaneous commentary.
+
+=item CAVEATS
+
+Things to take special care with; sometimes called WARNINGS.
+
+=item DIAGNOSTICS
+
+All possible messages the program can print out--and
+what they mean.
+
+=item BUGS
+
+Things that are broken or just don't work quite right.
+
+=item RESTRICTIONS
+
+Bugs you don't plan to fix :-)
+
+=item AUTHOR
+
+Who wrote it (or AUTHORS if multiple).
+
+=item HISTORY
+
+Programs derived from other sources sometimes have this, or
+you might keep a modification log here.
+
+=back
+
+=head1 EXAMPLES
+
+    pod2man program > program.1
+    pod2man some_module.pm > /usr/perl/man/man3/some_module.3
+    pod2man --section=7 note.pod > note.7
+
+=head1 DIAGNOSTICS
+
+The following diagnostics are generated by B<pod2man>.  Items
+marked "(W)" are non-fatal, whereas the "(F)" errors will cause
+B<pod2man> to immediately exit with a non-zero status.
+
+=over 4
+
+=item bad option in paragraph %d of %s: ``%s'' should be [%s]<%s>
+
+(W) If you start include an option, you should set it off
+as bold, italic, or code.
+
+=item can't open %s: %s
+
+(F) The input file wasn't available for the given reason.
+
+=item Improper man page - no dash in NAME header in paragraph %d of %s
+
+(W) The NAME header did not have an isolated dash in it.  This is
+considered important.
+
+=item Invalid man page - no NAME line in %s
+
+(F) You did not include a NAME header, which is essential.
+
+=item roff font should be 1 or 2 chars, not `%s'  (F)
+
+(F) The font specified with the C<--fixed> option was not
+a one- or two-digit roff font.
+
+=item %s is missing required section: %s
+
+(W) Required sections include NAME, DESCRIPTION, and if you're
+using a section starting with a 3, also a SYNOPSIS.  Actually,
+not having a NAME is a fatal.
+
+=item Unknown escape: %s in %s
+
+(W) An unknown HTML entity (probably for an 8-bit character) was given via
+a C<EE<lt>E<gt>> directive.  Besides amp, lt, gt, and quot, recognized
+entities are Aacute, aacute, Acirc, acirc, AElig, aelig, Agrave, agrave,
+Aring, aring, Atilde, atilde, Auml, auml, Ccedil, ccedil, Eacute, eacute,
+Ecirc, ecirc, Egrave, egrave, ETH, eth, Euml, euml, Iacute, iacute, Icirc,
+icirc, Igrave, igrave, Iuml, iuml, Ntilde, ntilde, Oacute, oacute, Ocirc,
+ocirc, Ograve, ograve, Oslash, oslash, Otilde, otilde, Ouml, ouml, szlig,
+THORN, thorn, Uacute, uacute, Ucirc, ucirc, Ugrave, ugrave, Uuml, uuml,
+Yacute, yacute, and yuml.
+
+=item Unmatched =back
+
+(W) You have a C<=back> without a corresponding C<=over>.
+
+=item Unrecognized pod directive: %s
+
+(W) You specified a pod directive that isn't in the known list of
+C<=head1>, C<=head2>, C<=item>, C<=over>, C<=back>, or C<=cut>.
+
+
+=back
+
+=head1 NOTES
+
+If you would like to print out a lot of man page continuously, you
+probably want to set the C and D registers to set contiguous page
+numbering and even/odd paging, at least on some versions of man(7).
+Settting the F register will get you some additional experimental
+indexing:
+
+    troff -man -rC1 -rD1 -rF1 perl.1 perldata.1 perlsyn.1 ...
+
+The indexing merely outputs messages via C<.tm> for each
+major page, section, subsection, item, and any C<XE<lt>E<gt>>
+directives.
+
+
+=head1 RESTRICTIONS
+
+None at this time.
+
+=head1 BUGS
+
+The =over and =back directives don't really work right.  They
+take absolute positions instead of offsets, don't nest well, and
+making people count is suboptimal in any event.
+
+=head1 AUTHORS
+
+Original prototype by Larry Wall, but so massively hacked over by
+Tom Christiansen such that Larry probably doesn't recognize it anymore.
+
+=cut
+
+$/ = "";
+$cutting = 1;
+@Indices = ();
+
+# We try first to get the version number from a local binary, in case we're
+# running an installed version of Perl to produce documentation from an
+# uninstalled newer version's pod files.
+if ($^O ne 'plan9' and $^O ne 'dos' and $^O ne 'os2' and $^O ne 'MSWin32') {
+  my $perl = (-x './perl' && -f './perl' ) ?
+                 './perl' :
+                 ((-x '../perl' && -f '../perl') ?
+                      '../perl' :
+                      '');
+  ($version,$patch) = `$perl -e 'print $]'` =~ /^(\d\.\d{3})(\d{2})?/ if $perl;
+}
+# No luck; we'll just go with the running Perl's version
+($version,$patch) = $] =~ /^(.{5})(\d{2})?/ unless $version;
+$DEF_RELEASE  = "perl $version";
+$DEF_RELEASE .= ", patch $patch" if $patch;
+
+
+sub makedate {
+    my $secs = shift;
+    my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime($secs);
+    my $mname = (qw{Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec})[$mon];
+    $year += 1900;
+    return "$mday/$mname/$year";
+}
+
+use Getopt::Long;
+
+$DEF_SECTION = 1;
+$DEF_CENTER = "User Contributed Perl Documentation";
+$STD_CENTER = "Perl Programmers Reference Guide";
+$DEF_FIXED = 'CW';
+$DEF_LAX = 0;
+
+sub usage {
+    warn "$0: @_\n" if @_;
+    die <<EOF;
+usage: $0 [options] podpage
+Options are:
+        --section=manext      (default "$DEF_SECTION")
+        --release=relpatch    (default "$DEF_RELEASE")
+        --center=string       (default "$DEF_CENTER")
+        --date=string         (default "$DEF_DATE")
+        --fixed=font          (default "$DEF_FIXED")
+        --official            (default NOT)
+        --lax                 (default NOT)
+EOF
+}
+
+$uok = GetOptions( qw(
+        section=s
+        release=s
+        center=s
+        date=s
+        fixed=s
+        official
+        lax
+        help));
+
+$DEF_DATE = makedate((stat($ARGV[0]))[9] || time());
+
+usage("Usage error!") unless $uok;
+usage() if $opt_help;
+usage("Need one and only one podpage argument") unless @ARGV == 1;
+
+$section = $opt_section || ($ARGV[0] =~ /\.pm$/
+                                ? $DEF_PM_SECTION : $DEF_SECTION);
+$RP = $opt_release || $DEF_RELEASE;
+$center = $opt_center || ($opt_official ? $STD_CENTER : $DEF_CENTER);
+$lax = $opt_lax || $DEF_LAX;
+
+$CFont = $opt_fixed || $DEF_FIXED;
+
+if (length($CFont) == 2) {
+    $CFont_embed = "\\f($CFont";
+}
+elsif (length($CFont) == 1) {
+    $CFont_embed = "\\f$CFont";
+}
+else {
+    die "roff font should be 1 or 2 chars, not `$CFont_embed'";
+}
+
+$date = $opt_date || $DEF_DATE;
+
+for (qw{NAME DESCRIPTION}) {
+# for (qw{NAME DESCRIPTION AUTHOR}) {
+    $wanna_see{$_}++;
+}
+$wanna_see{SYNOPSIS}++ if $section =~ /^3/;
+
+
+$name = @ARGV ? $ARGV[0] : "<STDIN>";
+$Filename = $name;
+if ($section =~ /^1/) {
+    require File::Basename;
+    $name = uc File::Basename::basename($name);
+}
+$name =~ s/\.(pod|p[lm])$//i;
+
+# Lose everything up to the first of
+#     */lib/*perl*      standard or site_perl module
+#     */*perl*/lib      from -D prefix=/opt/perl
+#     */*perl*/         random module hierarchy
+# which works.
+$name =~ s-//+-/-g;
+if ($name =~ s-^.*?/lib/[^/]*perl[^/]*/--i
+        or $name =~ s-^.*?/[^/]*perl[^/]*/lib/--i
+        or $name =~ s-^.*?/[^/]*perl[^/]*/--i) {
+    # Lose ^site(_perl)?/.
+    $name =~ s-^site(_perl)?/--;
+    # Lose ^arch/.      (XXX should we use Config? Just for archname?)
+    $name =~ s~^(.*-$^O|$^O-.*)/~~o;
+    # Lose ^version/.
+    $name =~ s-^\d+\.\d+/--;
+}
+
+# Translate Getopt/Long to Getopt::Long, etc.
+$name =~ s(/)(::)g;
+
+if ($name ne 'something') {
+    FCHECK: {
+        open(F, "< $ARGV[0]") || die "can't open $ARGV[0]: $!";
+        while (<F>) {
+            next unless /^=\b/;
+            if (/^=head1\s+NAME\s*$/) {  # an /m would forgive mistakes
+                $_ = <F>;
+                unless (/\s*-+\s+/) {
+                    $oops++;
+                    warn "$0: Improper man page - no dash in NAME header in paragraph $. of $ARGV[0]\n"
+                } else {
+                    my @n = split /\s+-+\s+/;
+                    if (@n != 2) {
+                        $oops++;
+                        warn "$0: Improper man page - malformed NAME header in paragraph $. of $ARGV[0]\n"
+                    }
+                    else {
+                        %namedesc = @n;
+                    }
+                }
+                last FCHECK;
+            }
+            next if /^=cut\b/;  # DB_File and Net::Ping have =cut before NAME
+            next if /^=pod\b/;  # It is OK to have =pod before NAME
+            die "$0: Invalid man page - 1st pod line is not NAME in $ARGV[0]\n" unless $lax;
+        }
+        die "$0: Invalid man page - no documentation in $ARGV[0]\n" unless $lax;
+    }
+    close F;
+}
+
+print <<"END";
+.rn '' }`
+''' \$RCSfile\$\$Revision\$\$Date\$
+'''
+''' \$Log\$
+'''
+.de Sh
+.br
+.if t .Sp
+.ne 5
+.PP
+\\fB\\\\\$1\\fR
+.PP
+..
+.de Sp
+.if t .sp .5v
+.if n .sp
+..
+.de Ip
+.br
+.ie \\\\n(.\$>=3 .ne \\\\\$3
+.el .ne 3
+.IP "\\\\\$1" \\\\\$2
+..
+.de Vb
+.ft $CFont
+.nf
+.ne \\\\\$1
+..
+.de Ve
+.ft R
+
+.fi
+..
+'''
+'''
+'''     Set up \\*(-- to give an unbreakable dash;
+'''     string Tr holds user defined translation string.
+'''     Bell System Logo is used as a dummy character.
+'''
+.tr \\(*W-|\\(bv\\*(Tr
+.ie n \\{\\
+.ds -- \\(*W-
+.ds PI pi
+.if (\\n(.H=4u)&(1m=24u) .ds -- \\(*W\\h'-12u'\\(*W\\h'-12u'-\\" diablo 10 pitch
+.if (\\n(.H=4u)&(1m=20u) .ds -- \\(*W\\h'-12u'\\(*W\\h'-8u'-\\" diablo 12 pitch
+.ds L" ""
+.ds R" ""
+'''   \\*(M", \\*(S", \\*(N" and \\*(T" are the equivalent of
+'''   \\*(L" and \\*(R", except that they are used on ".xx" lines,
+'''   such as .IP and .SH, which do another additional levels of
+'''   double-quote interpretation
+.ds M" """
+.ds S" """
+.ds N" """""
+.ds T" """""
+.ds L' '
+.ds R' '
+.ds M' '
+.ds S' '
+.ds N' '
+.ds T' '
+'br\\}
+.el\\{\\
+.ds -- \\(em\\|
+.tr \\*(Tr
+.ds L" ``
+.ds R" ''
+.ds M" ``
+.ds S" ''
+.ds N" ``
+.ds T" ''
+.ds L' `
+.ds R' '
+.ds M' `
+.ds S' '
+.ds N' `
+.ds T' '
+.ds PI \\(*p
+'br\\}
+END
+
+print <<'END';
+.\"     If the F register is turned on, we'll generate
+.\"     index entries out stderr for the following things:
+.\"             TH      Title 
+.\"             SH      Header
+.\"             Sh      Subsection 
+.\"             Ip      Item
+.\"             X<>     Xref  (embedded
+.\"     Of course, you have to process the output yourself
+.\"     in some meaninful fashion.
+.if \nF \{
+.de IX
+.tm Index:\\$1\t\\n%\t"\\$2"
+..
+.nr % 0
+.rr F
+.\}
+END
+
+print <<"END";
+.TH $name $section "$RP" "$date" "$center"
+.UC
+END
+
+push(@Indices, qq{.IX Title "$name $section"});
+
+while (($name, $desc) = each %namedesc) {
+    for ($name, $desc) { s/^\s+//; s/\s+$//; }
+    push(@Indices, qq(.IX Name "$name - $desc"\n));
+}
+
+print <<'END';
+.if n .hy 0
+.if n .na
+.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
+.de CQ          \" put $1 in typewriter font
+END
+print ".ft $CFont\n";
+print <<'END';
+'if n "\c
+'if t \\&\\$1\c
+'if n \\&\\$1\c
+'if n \&"
+\\&\\$2 \\$3 \\$4 \\$5 \\$6 \\$7
+'.ft R
+..
+.\" @(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2
+.       \" AM - accent mark definitions
+.bd B 3
+.       \" fudge factors for nroff and troff
+.if n \{\
+.       ds #H 0
+.       ds #V .8m
+.       ds #F .3m
+.       ds #[ \f1
+.       ds #] \fP
+.\}
+.if t \{\
+.       ds #H ((1u-(\\\\n(.fu%2u))*.13m)
+.       ds #V .6m
+.       ds #F 0
+.       ds #[ \&
+.       ds #] \&
+.\}
+.       \" simple accents for nroff and troff
+.if n \{\
+.       ds ' \&
+.       ds ` \&
+.       ds ^ \&
+.       ds , \&
+.       ds ~ ~
+.       ds ? ?
+.       ds ! !
+.       ds /
+.       ds q
+.\}
+.if t \{\
+.       ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
+.       ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
+.       ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
+.       ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
+.       ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
+.       ds ? \s-2c\h'-\w'c'u*7/10'\u\h'\*(#H'\zi\d\s+2\h'\w'c'u*8/10'
+.       ds ! \s-2\(or\s+2\h'-\w'\(or'u'\v'-.8m'.\v'.8m'
+.       ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
+.       ds q o\h'-\w'o'u*8/10'\s-4\v'.4m'\z\(*i\v'-.4m'\s+4\h'\w'o'u*8/10'
+.\}
+.       \" troff and (daisy-wheel) nroff accents
+.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
+.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
+.ds v \\k:\h'-(\\n(.wu*9/10-\*(#H)'\v'-\*(#V'\*(#[\s-4v\s0\v'\*(#V'\h'|\\n:u'\*(#]
+.ds _ \\k:\h'-(\\n(.wu*9/10-\*(#H+(\*(#F*2/3))'\v'-.4m'\z\(hy\v'.4m'\h'|\\n:u'
+.ds . \\k:\h'-(\\n(.wu*8/10)'\v'\*(#V*4/10'\z.\v'-\*(#V*4/10'\h'|\\n:u'
+.ds 3 \*(#[\v'.2m'\s-2\&3\s0\v'-.2m'\*(#]
+.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
+.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
+.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
+.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
+.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
+.ds ae a\h'-(\w'a'u*4/10)'e
+.ds Ae A\h'-(\w'A'u*4/10)'E
+.ds oe o\h'-(\w'o'u*4/10)'e
+.ds Oe O\h'-(\w'O'u*4/10)'E
+.       \" corrections for vroff
+.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
+.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
+.       \" for low resolution devices (crt and lpr)
+.if \n(.H>23 .if \n(.V>19 \
+\{\
+.       ds : e
+.       ds 8 ss
+.       ds v \h'-1'\o'\(aa\(ga'
+.       ds _ \h'-1'^
+.       ds . \h'-1'.
+.       ds 3 3
+.       ds o a
+.       ds d- d\h'-1'\(ga
+.       ds D- D\h'-1'\(hy
+.       ds th \o'bp'
+.       ds Th \o'LP'
+.       ds ae ae
+.       ds Ae AE
+.       ds oe oe
+.       ds Oe OE
+.\}
+.rm #[ #] #H #V #F C
+END
+
+$indent = 0;
+
+$begun = "";
+
+# Unrolling [^A-Z>]|[A-Z](?!<) gives:    // MRE pp 165.
+my $nonest = '(?:[^A-Z>]*(?:[A-Z](?!<)[^A-Z>]*)*)';
+
+while (<>) {
+    if ($cutting) {
+        next unless /^=/;
+        $cutting = 0;
+    }
+    if ($begun) {
+        if (/^=end\s+$begun/) {
+            $begun = "";
+        }
+        elsif ($begun =~ /^(roff|man)$/) {
+            print STDOUT $_;
+        }
+        next;
+    }
+    chomp;
+
+    # Translate verbatim paragraph
+
+    if (/^\s/) {
+        @lines = split(/\n/);
+        for (@lines) {
+            1 while s
+                {^( [^\t]* ) \t ( \t* ) }
+                { $1 . ' ' x (8 - (length($1)%8) + 8 * (length($2))) }ex;
+            s/\\/\\e/g;
+            s/\A/\\&/s;
+        }
+        $lines = @lines;
+        makespace() unless $verbatim++;
+        print ".Vb $lines\n";
+        print join("\n", @lines), "\n";
+        print ".Ve\n";
+        $needspace = 0;
+        next;
+    }
+
+    $verbatim = 0;
+
+    if (/^=for\s+(\S+)\s*/s) {
+        if ($1 eq "man" or $1 eq "roff") {
+            print STDOUT $',"\n\n";
+        } else {
+            # ignore unknown for
+        }
+        next;
+    }
+    elsif (/^=begin\s+(\S+)\s*/s) {
+        $begun = $1;
+        if ($1 eq "man" or $1 eq "roff") {
+            print STDOUT $'."\n\n";
+        }
+        next;
+    }
+
+    # check for things that'll hosed our noremap scheme; affects $_
+    init_noremap();
+
+    if (!/^=item/) {
+
+        # trofficate backslashes; must do it before what happens below
+        s/\\/noremap('\\e')/ge;
+
+        # protect leading periods and quotes against *roff
+        # mistaking them for directives
+        s/^(?:[A-Z]<)?[.']/\\&$&/gm;
+
+        # first hide the escapes in case we need to
+        # intuit something and get it wrong due to fmting
+
+        1 while s/([A-Z]<$nonest>)/noremap($1)/ge;
+
+        # func() is a reference to a perl function
+        s{
+            \b
+            (
+                [:\w]+ \(\)
+            )
+        } {I<$1>}gx;
+
+        # func(n) is a reference to a perl function or a man page
+        s{
+            ([:\w]+)
+            (
+                \( [^\051]+ \)
+            )
+        } {I<$1>\\|$2}gx;
+
+        # convert simple variable references
+        s/(\s+)([\$\@%][\w:]+)(?!\()/${1}C<$2>/g;
+
+        if (m{ (
+                    [\-\w]+
+                    \(
+                        [^\051]*?
+                        [\@\$,]
+                        [^\051]*?
+                    \)
+                )
+            }x && $` !~ /([LCI]<[^<>]*|-)$/ && !/^=\w/)
+        {
+            warn "$0: bad option in paragraph $. of $ARGV: ``$1'' should be [LCI]<$1>\n";
+            $oops++;
+        }
+
+        while (/(-[a-zA-Z])\b/g && $` !~ /[\w\-]$/) {
+            warn "$0: bad option in paragraph $. of $ARGV: ``$1'' should be [CB]<$1>\n";
+            $oops++;
+        }
+
+        # put it back so we get the <> processed again;
+        clear_noremap(0); # 0 means leave the E's
+
+    } else {
+        # trofficate backslashes
+        s/\\/noremap('\\e')/ge;
+
+    }
+
+    # need to hide E<> first; they're processed in clear_noremap
+    s/(E<[^<>]+>)/noremap($1)/ge;
+
+
+    $maxnest = 10;
+    while ($maxnest-- && /[A-Z]</) {
+
+        # can't do C font here
+        s/([BI])<($nonest)>/font($1) . $2 . font('R')/eg;
+
+        # files and filelike refs in italics
+        s/F<($nonest)>/I<$1>/g;
+
+        # no break -- usually we want C<> for this
+        s/S<($nonest)>/nobreak($1)/eg;
+
+        # LREF: a la HREF L<show this text|man/section>
+        s:L<([^|>]+)\|[^>]+>:$1:g;
+
+        # LREF: a manpage(3f)
+        s:L<([a-zA-Z][^\s\/]+)(\([^\)]+\))?>:the I<$1>$2 manpage:g;
+
+        # LREF: an =item on another manpage
+        s{
+            L<
+                ([^/]+)
+                /
+                (
+                    [:\w]+
+                    (\(\))?
+                )
+            >
+        } {the C<$2> entry in the I<$1> manpage}gx;
+
+        # LREF: an =item on this manpage
+        s{
+           ((?:
+            L<
+                /
+                (
+                    [:\w]+
+                    (\(\))?
+                )
+            >
+            (,?\s+(and\s+)?)?
+          )+)
+        } { internal_lrefs($1) }gex;
+
+        # LREF: a =head2 (head1?), maybe on a manpage, maybe right here
+        # the "func" can disambiguate
+        s{
+            L<
+                (?:
+                    ([a-zA-Z]\S+?) /
+                )?
+                "?(.*?)"?
+            >
+        }{
+            do {
+                $1      # if no $1, assume it means on this page.
+                    ?  "the section on I<$2> in the I<$1> manpage"
+                    :  "the section on I<$2>"
+            }
+        }gesx; # s in case it goes over multiple lines, so . matches \n
+
+        s/Z<>/\\&/g;
+
+        # comes last because not subject to reprocessing
+        s/C<($nonest)>/noremap("${CFont_embed}${1}\\fR")/eg;
+    }
+
+    if (s/^=//) {
+        $needspace = 0;         # Assume this.
+
+        s/\n/ /g;
+
+        ($Cmd, $_) = split(' ', $_, 2);
+
+        $dotlevel = 1;
+        if ($Cmd eq 'head1') {
+           $dotlevel = 1;
+        }
+        elsif ($Cmd eq 'head2') {
+           $dotlevel = 1;
+        }
+        elsif ($Cmd eq 'item') {
+           $dotlevel = 2;
+        }
+
+        if (defined $_) {
+            &escapes($dotlevel);
+            s/"/""/g;
+        }
+
+        clear_noremap(1);
+
+        if ($Cmd eq 'cut') {
+            $cutting = 1;
+        }
+        elsif ($Cmd eq 'head1') {
+            s/\s+$//;
+            delete $wanna_see{$_} if exists $wanna_see{$_};
+            print qq{.SH "$_"\n};
+      push(@Indices, qq{.IX Header "$_"\n});
+        }
+        elsif ($Cmd eq 'head2') {
+            print qq{.Sh "$_"\n};
+      push(@Indices, qq{.IX Subsection "$_"\n});
+        }
+        elsif ($Cmd eq 'over') {
+            push(@indent,$indent);
+            $indent += ($_ + 0) || 5;
+        }
+        elsif ($Cmd eq 'back') {
+            $indent = pop(@indent);
+            warn "$0: Unmatched =back in paragraph $. of $ARGV\n" unless defined $indent;
+            $needspace = 1;
+        }
+        elsif ($Cmd eq 'item') {
+            s/^\*( |$)/\\(bu$1/g;
+            # if you know how to get ":s please do
+            s/\\\*\(L"([^"]+?)\\\*\(R"/'$1'/g;
+            s/\\\*\(L"([^"]+?)""/'$1'/g;
+            s/[^"]""([^"]+?)""[^"]/'$1'/g;
+            # here do something about the $" in perlvar?
+            print STDOUT qq{.Ip "$_" $indent\n};
+      push(@Indices, qq{.IX Item "$_"\n});
+        }
+        elsif ($Cmd eq 'pod') {
+            # this is just a comment
+        } 
+        else {
+            warn "$0: Unrecognized pod directive in paragraph $. of $ARGV: $Cmd\n";
+        }
+    }
+    else {
+        if ($needspace) {
+            &makespace;
+        }
+        &escapes(0);
+        clear_noremap(1);
+        print $_, "\n";
+        $needspace = 1;
+    }
+}
+
+print <<"END";
+
+.rn }` ''
+END
+
+if (%wanna_see && !$lax) {
+    @missing = keys %wanna_see;
+    warn "$0: $Filename is missing required section"
+        .  (@missing > 1 && "s")
+        .  ": @missing\n";
+    $oops++;
+}
+
+foreach (@Indices) { print "$_\n"; }
+
+exit;
+#exit ($oops != 0);
+
+#########################################################################
+
+sub nobreak {
+    my $string = shift;
+    $string =~ s/ /\\ /g;
+    $string;
+}
+
+sub escapes {
+    my $indot = shift;
+
+    s/X<(.*?)>/mkindex($1)/ge;
+
+    # translate the minus in foo-bar into foo\-bar for roff
+    s/([^0-9a-z-])-([^-])/$1\\-$2/g;
+
+    # make -- into the string version \*(-- (defined above)
+    s/\b--\b/\\*(--/g;
+    s/"--([^"])/"\\*(--$1/g;  # should be a better way
+    s/([^"])--"/$1\\*(--"/g;
+
+    # fix up quotes; this is somewhat tricky
+    my $dotmacroL = 'L';
+    my $dotmacroR = 'R';
+    if ( $indot == 1 ) {
+        $dotmacroL = 'M';
+        $dotmacroR = 'S';
+    }  
+    elsif ( $indot >= 2 ) {
+        $dotmacroL = 'N';
+        $dotmacroR = 'T';
+    }  
+    if (!/""/) {
+        s/(^|\s)(['"])/noremap("$1\\*($dotmacroL$2")/ge;
+        s/(['"])($|[\-\s,;\\!?.])/noremap("\\*($dotmacroR$1$2")/ge;
+    }
+
+    #s/(?!")(?:.)--(?!")(?:.)/\\*(--/g;
+    #s/(?:(?!")(?:.)--(?:"))|(?:(?:")--(?!")(?:.))/\\*(--/g;
+
+
+    # make sure that func() keeps a bit a space tween the parens
+    ### s/\b\(\)/\\|()/g;
+    ### s/\b\(\)/(\\|)/g;
+
+    # make C++ into \*C+, which is a squinched version (defined above)
+    s/\bC\+\+/\\*(C+/g;
+
+    # make double underbars have a little tiny space between them
+    s/__/_\\|_/g;
+
+    # PI goes to \*(PI (defined above)
+    s/\bPI\b/noremap('\\*(PI')/ge;
+
+    # make all caps a teeny bit smaller, but don't muck with embedded code literals
+    my $hidCFont = font('C');
+    if ($Cmd !~ /^head1/) { # SH already makes smaller
+        # /g isn't enough; 1 while or we'll be off
+
+#       1 while s{
+#           (?!$hidCFont)(..|^.|^)
+#           \b
+#           (
+#               [A-Z][\/A-Z+:\-\d_$.]+
+#           )
+#           (s?)                
+#           \b
+#       } {$1\\s-1$2\\s0}gmox;
+
+        1 while s{
+            (?!$hidCFont)(..|^.|^)
+            (
+                \b[A-Z]{2,}[\/A-Z+:\-\d_\$]*\b
+            )
+        } {
+            $1 . noremap( '\\s-1' .  $2 . '\\s0' )
+        }egmox;
+
+    }
+}
+
+# make troff just be normal, but make small nroff get quoted
+# decided to just put the quotes in the text; sigh;
+sub ccvt {
+    local($_,$prev) = @_;
+    noremap(qq{.CQ "$_" \n\\&});
+}
+
+sub makespace {
+    if ($indent) {
+        print ".Sp\n";
+    }
+    else {
+        print ".PP\n";
+    }
+}
+
+sub mkindex {
+    my ($entry) = @_;
+    my @entries = split m:\s*/\s*:, $entry;
+    push @Indices, ".IX Xref " . join ' ', map {qq("$_")} @entries;
+    return '';
+}
+
+sub font {
+    local($font) = shift;
+    return '\\f' . noremap($font);
+}
+
+sub noremap {
+    local($thing_to_hide) = shift;
+    $thing_to_hide =~ tr/\000-\177/\200-\377/;
+    return $thing_to_hide;
+}
+
+sub init_noremap {
+        # escape high bit characters in input stream
+        s/([\200-\377])/"E<".ord($1).">"/ge;
+}
+
+sub clear_noremap {
+    my $ready_to_print = $_[0];
+
+    tr/\200-\377/\000-\177/;
+
+    # trofficate backslashes
+    # s/(?!\\e)(?:..|^.|^)\\/\\e/g;
+
+    # now for the E<>s, which have been hidden until now
+    # otherwise the interative \w<> processing would have
+    # been hosed by the E<gt>
+    s {
+            E<
+            (
+                ( \d + ) 
+                | ( [A-Za-z]+ ) 
+            )
+            >   
+    } {
+         do {
+             defined $2
+                ? chr($2)
+                :       
+             exists $HTML_Escapes{$3}
+                ? do { $HTML_Escapes{$3} }
+                : do {
+                    warn "$0: Unknown escape in paragraph $. of $ARGV: ``$&''\n";
+                    "E<$1>";
+                }
+         }
+    }egx if $ready_to_print;
+}
+
+sub internal_lrefs {
+    local($_) = shift;
+    local $trailing_and = s/and\s+$// ? "and " : "";
+
+    s{L</([^>]+)>}{$1}g;
+    my(@items) = split( /(?:,?\s+(?:and\s+)?)/ );
+    my $retstr = "the ";
+    my $i;
+    for ($i = 0; $i <= $#items; $i++) {
+        $retstr .= "C<$items[$i]>";
+        $retstr .= ", " if @items > 2 && $i != $#items;
+        $retstr .= " and " if $i+2 == @items;
+    }
+
+    $retstr .= " entr" . ( @items > 1  ? "ies" : "y" )
+            .  " elsewhere in this document";
+    # terminal space to avoid words running together (pattern used
+    # strips terminal spaces)
+    $retstr .= " " if length $trailing_and;
+    $retstr .=  $trailing_and;
+
+    return $retstr;
+
+}
+
+BEGIN {
+%HTML_Escapes = (
+    'amp'       =>      '&',    #   ampersand
+    'lt'        =>      '<',    #   left chevron, less-than
+    'gt'        =>      '>',    #   right chevron, greater-than
+    'quot'      =>      '"',    #   double quote
+
+    "Aacute"    =>      "A\\*'",        #   capital A, acute accent
+    "aacute"    =>      "a\\*'",        #   small a, acute accent
+    "Acirc"     =>      "A\\*^",        #   capital A, circumflex accent
+    "acirc"     =>      "a\\*^",        #   small a, circumflex accent
+    "AElig"     =>      '\*(AE',        #   capital AE diphthong (ligature)
+    "aelig"     =>      '\*(ae',        #   small ae diphthong (ligature)
+    "Agrave"    =>      "A\\*`",        #   capital A, grave accent
+    "agrave"    =>      "A\\*`",        #   small a, grave accent
+    "Aring"     =>      'A\\*o',        #   capital A, ring
+    "aring"     =>      'a\\*o',        #   small a, ring
+    "Atilde"    =>      'A\\*~',        #   capital A, tilde
+    "atilde"    =>      'a\\*~',        #   small a, tilde
+    "Auml"      =>      'A\\*:',        #   capital A, dieresis or umlaut mark
+    "auml"      =>      'a\\*:',        #   small a, dieresis or umlaut mark
+    "Ccedil"    =>      'C\\*,',        #   capital C, cedilla
+    "ccedil"    =>      'c\\*,',        #   small c, cedilla
+    "Eacute"    =>      "E\\*'",        #   capital E, acute accent
+    "eacute"    =>      "e\\*'",        #   small e, acute accent
+    "Ecirc"     =>      "E\\*^",        #   capital E, circumflex accent
+    "ecirc"     =>      "e\\*^",        #   small e, circumflex accent
+    "Egrave"    =>      "E\\*`",        #   capital E, grave accent
+    "egrave"    =>      "e\\*`",        #   small e, grave accent
+    "ETH"       =>      '\\*(D-',       #   capital Eth, Icelandic
+    "eth"       =>      '\\*(d-',       #   small eth, Icelandic
+    "Euml"      =>      "E\\*:",        #   capital E, dieresis or umlaut mark
+    "euml"      =>      "e\\*:",        #   small e, dieresis or umlaut mark
+    "Iacute"    =>      "I\\*'",        #   capital I, acute accent
+    "iacute"    =>      "i\\*'",        #   small i, acute accent
+    "Icirc"     =>      "I\\*^",        #   capital I, circumflex accent
+    "icirc"     =>      "i\\*^",        #   small i, circumflex accent
+    "Igrave"    =>      "I\\*`",        #   capital I, grave accent
+    "igrave"    =>      "i\\*`",        #   small i, grave accent
+    "Iuml"      =>      "I\\*:",        #   capital I, dieresis or umlaut mark
+    "iuml"      =>      "i\\*:",        #   small i, dieresis or umlaut mark
+    "Ntilde"    =>      'N\*~',         #   capital N, tilde
+    "ntilde"    =>      'n\*~',         #   small n, tilde
+    "Oacute"    =>      "O\\*'",        #   capital O, acute accent
+    "oacute"    =>      "o\\*'",        #   small o, acute accent
+    "Ocirc"     =>      "O\\*^",        #   capital O, circumflex accent
+    "ocirc"     =>      "o\\*^",        #   small o, circumflex accent
+    "Ograve"    =>      "O\\*`",        #   capital O, grave accent
+    "ograve"    =>      "o\\*`",        #   small o, grave accent
+    "Oslash"    =>      "O\\*/",        #   capital O, slash
+    "oslash"    =>      "o\\*/",        #   small o, slash
+    "Otilde"    =>      "O\\*~",        #   capital O, tilde
+    "otilde"    =>      "o\\*~",        #   small o, tilde
+    "Ouml"      =>      "O\\*:",        #   capital O, dieresis or umlaut mark
+    "ouml"      =>      "o\\*:",        #   small o, dieresis or umlaut mark
+    "szlig"     =>      '\*8',          #   small sharp s, German (sz ligature)
+    "THORN"     =>      '\\*(Th',       #   capital THORN, Icelandic
+    "thorn"     =>      '\\*(th',,      #   small thorn, Icelandic
+    "Uacute"    =>      "U\\*'",        #   capital U, acute accent
+    "uacute"    =>      "u\\*'",        #   small u, acute accent
+    "Ucirc"     =>      "U\\*^",        #   capital U, circumflex accent
+    "ucirc"     =>      "u\\*^",        #   small u, circumflex accent
+    "Ugrave"    =>      "U\\*`",        #   capital U, grave accent
+    "ugrave"    =>      "u\\*`",        #   small u, grave accent
+    "Uuml"      =>      "U\\*:",        #   capital U, dieresis or umlaut mark
+    "uuml"      =>      "u\\*:",        #   small u, dieresis or umlaut mark
+    "Yacute"    =>      "Y\\*'",        #   capital Y, acute accent
+    "yacute"    =>      "y\\*'",        #   small y, acute accent
+    "yuml"      =>      "y\\*:",        #   small y, dieresis or umlaut mark
+);
+}
+
diff --git a/src/lib/libssl/src/util/selftest.pl b/src/lib/libssl/src/util/selftest.pl
new file mode 100644
index 0000000000..91e962a312
--- /dev/null
+++ b/src/lib/libssl/src/util/selftest.pl
@@ -0,0 +1,174 @@
+#!/usr/local/bin/perl -w
+#
+# Run the test suite and generate a report
+#
+
+if (! -f "Configure") {
+    print "Please run perl util/selftest.pl in the OpenSSL directory.\n";
+    exit 1;
+}
+
+my $report="testlog";
+my $os="??";
+my $version="??";
+my $platform0="??";
+my $platform="??";
+my $options="??";
+my $last="??";
+my $ok=0;
+my $cc="cc";
+my $cversion="??";
+my $sep="-----------------------------------------------------------------------------\n";
+
+open(OUT,">$report") or die;
+
+print OUT "OpenSSL self-test report:\n\n";
+
+$uname=`uname -a`;
+$uname="??" if $uname eq "";
+
+$c=`sh config -t`;
+foreach $_ (split("\n",$c)) {
+    $os=$1 if (/Operating system: (.*)$/);
+    $platform0=$1 if (/Configuring for (.*)$/);
+}
+
+system "sh config" if (! -f "Makefile.ssl");
+
+if (open(IN,"<Makefile.ssl")) {
+    while (<IN>) {
+        $version=$1 if (/^VERSION=(.*)$/);
+        $platform=$1 if (/^PLATFORM=(.*)$/);
+        $options=$1 if (/^OPTIONS=(.*)$/);
+        $cc=$1 if (/^CC= *(.*)$/);
+    }
+    close(IN);
+} else {
+    print OUT "Error running config!\n";
+}
+
+$cversion=`$cc -v 2>&1`;
+$cversion=`$cc -V 2>&1` if $cversion =~ "usage";
+$cversion=`$cc --version` if $cversion eq "";
+$cversion =~ s/Reading specs.*\n//;
+$cversion =~ s/usage.*\n//;
+chomp $cversion;
+
+if (open(IN,"<CHANGES")) {
+    while(<IN>) {
+        if (/\*\) (.{0,55})/) {
+            $last=$1;
+            last;
+        }
+    }
+    close(IN);
+}
+
+print OUT "OpenSSL version:  $version\n";
+print OUT "Last change:      $last...\n";
+print OUT "Options:          $options\n" if $options ne "";
+print OUT "OS (uname):       $uname";
+print OUT "OS (config):      $os\n";
+print OUT "Target (default): $platform0\n";
+print OUT "Target:           $platform\n";
+print OUT "Compiler:         $cversion\n";
+print OUT "\n";
+
+print "Checking compiler...\n";
+if (open(TEST,">cctest.c")) {
+    print TEST "#include <stdio.h>\nmain(){printf(\"Hello world\\n\");}\n";
+    close(TEST);
+    system("$cc -o cctest cctest.c");
+    if (`./cctest` !~ /Hello world/) {
+        print OUT "Compiler doesn't work.\n";
+        goto err;
+    }
+} else {
+    print OUT "Can't create cctest.c\n";
+}
+if (open(TEST,">cctest.c")) {
+    print TEST "#include <openssl/opensslv.h>\nmain(){printf(OPENSSL_VERSION_TEXT);}\n";
+    close(TEST);
+    system("$cc -o cctest -Iinclude cctest.c");
+    $cctest = `./cctest`;
+    if ($cctest !~ /OpenSSL $version/) {
+        if ($cctest =~ /OpenSSL/) {
+            print OUT "#include uses headers from different OpenSSL version!\n";
+        } else {
+            print OUT "Can't compile test program!\n";
+        }
+        goto err;
+    }
+} else {
+    print OUT "Can't create cctest.c\n";
+}
+
+print "Running make...\n";
+if (system("make 2>&1 | tee make.log") > 255) {
+
+    print OUT "make failed!\n";
+    if (open(IN,"<make.log")) {
+        print OUT $sep;
+        while (<IN>) {
+            print OUT;
+        }
+        close(IN);
+        print OUT $sep;
+    } else {
+        print OUT "make.log not found!\n";
+    }
+    goto err;
+}
+
+$_=$options;
+s/no-asm//;
+if (/no-/)
+{
+    print OUT "Test skipped.\n";
+    goto err;
+}
+
+print "Running make test...\n";
+if (system("make test 2>&1 | tee make.log") > 255)
+ {
+    print OUT "make test failed!\n";
+} else {
+    $ok=1;
+}
+
+if ($ok and open(IN,"<make.log")) {
+    while (<IN>) {
+        $ok=2 if /^platform: $platform/;
+    }
+    close(IN);
+}
+
+if ($ok != 2) {
+    print OUT "Failure!\n";
+    if (open(IN,"<make.log")) {
+        print OUT $sep;
+        while (<IN>) {
+            print OUT;
+        }
+        close(IN);
+        print OUT $sep;
+    } else {
+        print OUT "make.log not found!\n";
+    }
+} else {
+    print OUT "Test passed.\n";
+}
+err:
+close(OUT);
+
+print "\n";
+open(IN,"<$report") or die;
+while (<IN>) {
+    if (/$sep/) {
+        print "[...]\n";
+        last;
+    }
+    print;
+}
+print "\nTest report in file $report\n";
+
diff --git a/src/lib/libssl/src/util/ssleay.num b/src/lib/libssl/src/util/ssleay.num
index 8121738bd6..32b2e960c4 100644
--- a/src/lib/libssl/src/util/ssleay.num
+++ b/src/lib/libssl/src/util/ssleay.num
@@ -215,3 +215,13 @@ SSL_CTX_set_cert_verify_callback        232
 sk_SSL_COMP_sort                        233
 sk_SSL_CIPHER_sort                      234
 SSL_CTX_set_default_passwd_cb_userdata  235
+SSL_set_purpose                         236
+SSL_CTX_set_trust                       237
+SSL_CTX_set_purpose                     238
+SSL_set_trust                           239
+SSL_get_finished                        240
+SSL_get_peer_finished                   241
+SSL_get1_session                        242
+SSL_CTX_callback_ctrl                   243
+SSL_callback_ctrl                       244
+SSL_CTX_sessions                        245
diff --git a/src/lib/libssl/ssl-patent/shlib_version b/src/lib/libssl/ssl-patent/shlib_version
index c6e3f4d3fc..b363be4447 100644
--- a/src/lib/libssl/ssl-patent/shlib_version
+++ b/src/lib/libssl/ssl-patent/shlib_version
@@ -1,2 +1,2 @@
 major=2
-minor=1
+minor=3
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index fbe4f667fa..f29f775347 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -123,8 +123,9 @@ extern "C" {
 #define SSL_TXT_MD5             "MD5"
 #define SSL_TXT_SHA1            "SHA1"
 #define SSL_TXT_SHA             "SHA"
-#define SSL_TXT_EXP40           "EXP"
+#define SSL_TXT_EXP             "EXP"
 #define SSL_TXT_EXPORT          "EXPORT"
+#define SSL_TXT_EXP40           "EXPORT40"
 #define SSL_TXT_EXP56           "EXPORT56"
 #define SSL_TXT_SSLV2           "SSLv2"
 #define SSL_TXT_SSLV3           "SSLv3"
@@ -133,12 +134,7 @@ extern "C" {
 
 /* 'DEFAULT' at the start of the cipher list insert the following string
  * in addition to this being the default cipher string */
-#ifndef NO_RSA
-#define SSL_DEFAULT_CIPHER_LIST "ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
-#else
-#define SSL_ALLOW_ADH
-#define SSL_DEFAULT_CIPHER_LIST "HIGH:MEDIUM:LOW:ADH+3DES:ADH+RC4:ADH+DES:+EXP"
-#endif
+#define SSL_DEFAULT_CIPHER_LIST "ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH"
 
 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */
 #define SSL_SENT_SHUTDOWN       1
@@ -151,6 +147,10 @@ extern "C" {
 #include <openssl/pem.h>
 #include <openssl/x509.h>
 
+#if (defined(NO_RSA) || defined(NO_MD5)) && !defined(NO_SSL2)
+#define NO_SSL2
+#endif
+
 #define SSL_FILETYPE_ASN1       X509_FILETYPE_ASN1
 #define SSL_FILETYPE_PEM        X509_FILETYPE_PEM
 
@@ -166,8 +166,12 @@ typedef struct ssl_cipher_st
         const char *name;               /* text name */
         unsigned long id;               /* id, 4 bytes, first is version */
         unsigned long algorithms;       /* what ciphers are used */
+        unsigned long algo_strength;    /* strength and export flags */
         unsigned long algorithm2;       /* Extra flags */
+        int strength_bits;              /* Number of bits really used */
+        int alg_bits;                   /* Number of bits for algorithm */
         unsigned long mask;             /* used for matching */
+        unsigned long mask_strength;    /* also used for matching */
         } SSL_CIPHER;
 
 DECLARE_STACK_OF(SSL_CIPHER)
@@ -201,6 +205,8 @@ typedef struct ssl_method_st
         long (*get_timeout)(void);
         struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
         int (*ssl_version)();
+        long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)());
+        long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)());
         } SSL_METHOD;
 
 /* Lets make this into an ASN.1 type structure as follows
@@ -215,7 +221,8 @@ typedef struct ssl_method_st
  *      Timeout [ 2 ] EXPLICIT  INTEGER,        -- optional Timeout ins seconds
  *      Peer [ 3 ] EXPLICIT     X509,           -- optional Peer Certificate
  *      Session_ID_context [ 4 ] EXPLICIT OCTET_STRING,   -- the Session ID context
- *      Compression [5] IMPLICIT ASN1_OBJECT    -- compression OID XXXXX
+ *      Verify_result [ 5 ] EXPLICIT INTEGER    -- X509_V_... code for `Peer'
+ *      Compression [6] IMPLICIT ASN1_OBJECT    -- compression OID XXXXX
  *      }
  * Look in ssl/ssl_asn1.c for more details
  * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).
@@ -249,6 +256,9 @@ typedef struct ssl_session_st
          * (the latter is not enough as sess_cert is not retained
          * in the external representation of sessions, see ssl_asn1.c). */
         X509 *peer;
+        /* when app_verify_callback accepts a session where the peer's certificate
+         * is not ok, we must remember the error for session reuse: */
+        long verify_result; /* only for servers */
 
         int references;
         long timeout;
@@ -291,6 +301,7 @@ typedef struct ssl_session_st
 #define SSL_OP_PKCS1_CHECK_1                            0x08000000L
 #define SSL_OP_PKCS1_CHECK_2                            0x10000000L
 #define SSL_OP_NETSCAPE_CA_DN_BUG                       0x20000000L
+/* SSL_OP_NON_EXPORT_FIRST looks utterly broken .. */
 #define SSL_OP_NON_EXPORT_FIRST                         0x40000000L
 #define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG          0x80000000L
 #define SSL_OP_ALL                                      0x000FFFFFL
@@ -355,9 +366,9 @@ struct ssl_ctx_st
         STACK_OF(SSL_CIPHER) *cipher_list_by_id;
 
         struct x509_store_st /* X509_STORE */ *cert_store;
-        struct lhash_st /* LHASH */ *sessions;  /* a set of SSL_SESSION's */
+        struct lhash_st /* LHASH */ *sessions;  /* a set of SSL_SESSIONs */
         /* Most session-ids that will be cached, default is
-         * SSL_SESSION_CACHE_SIZE_DEFAULT. 0 is unlimited. */
+         * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited. */
         unsigned long session_cache_size;
         struct ssl_session_st *session_cache_head;
         struct ssl_session_st *session_cache_tail;
@@ -424,6 +435,9 @@ struct ssl_ctx_st
 /**/    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
 /**/    int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx);
 
+        int purpose;            /* Purpose setting */
+        int trust;              /* Trust setting */
+
         /* Default password callback. */
 /**/    pem_password_cb *default_passwd_callback;
 
@@ -433,7 +447,7 @@ struct ssl_ctx_st
         /* get client cert callback */
 /**/    int (*client_cert_cb)(/* SSL *ssl, X509 **x509, EVP_PKEY **pkey */);
 
-        /* what we put in client requests */
+        /* what we put in client cert requests */
         STACK_OF(X509_NAME) *client_CA;
 
 /**/    int quiet_shutdown;
@@ -458,6 +472,7 @@ struct ssl_ctx_st
  * defined, this will still get called. */
 #define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP       0x0100
 
+  struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx);
 #define SSL_CTX_sess_number(ctx) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL)
 #define SSL_CTX_sess_connect(ctx) \
@@ -564,17 +579,21 @@ struct ssl_st
         unsigned char *packet;
         unsigned int packet_length;
 
-        struct ssl2_ctx_st *s2; /* SSLv2 variables */
-        struct ssl3_ctx_st *s3; /* SSLv3 variables */
+        struct ssl2_state_st *s2; /* SSLv2 variables */
+        struct ssl3_state_st *s3; /* SSLv3 variables */
 
-        int read_ahead;         /* Read as many input bytes as possible */
+        int read_ahead;         /* Read as many input bytes as possible
+                                 * (for non-blocking reads) */
         int hit;                /* reusing a previous session */
 
+        int purpose;            /* Purpose setting */
+        int trust;              /* Trust setting */
+
         /* crypto */
         STACK_OF(SSL_CIPHER) *cipher_list;
         STACK_OF(SSL_CIPHER) *cipher_list_by_id;
 
-        /* These are the ones being used, the ones is SSL_SESSION are
+        /* These are the ones being used, the ones in SSL_SESSION are
          * the ones to be 'copied' into these ones */
 
         EVP_CIPHER_CTX *enc_read_ctx;           /* cryptographic state */
@@ -634,7 +653,7 @@ struct ssl_st
         unsigned long mode; /* API behaviour */
         int first_packet;
         int client_version;     /* what was passed, used for
-                                 * SSLv3/TLS rolback check */
+                                 * SSLv3/TLS rollback check */
         };
 
 #include <openssl/ssl2.h>
@@ -642,7 +661,7 @@ struct ssl_st
 #include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */
 #include <openssl/ssl23.h>
 
-/* compatablity */
+/* compatibility */
 #define SSL_set_app_data(s,arg)         (SSL_set_ex_data(s,0,(char *)arg))
 #define SSL_get_app_data(s)             (SSL_get_ex_data(s,0))
 #define SSL_SESSION_set_app_data(s,a)   (SSL_SESSION_set_ex_data(s,0,(char *)a))
@@ -651,7 +670,7 @@ struct ssl_st
 #define SSL_CTX_set_app_data(ctx,arg)   (SSL_CTX_set_ex_data(ctx,0,(char *)arg))
 
 /* The following are the possible values for ssl->state are are
- * used to indicate where we are upto in the SSL connection establishment.
+ * used to indicate where we are up to in the SSL connection establishment.
  * The macros that follow are about the only things you should need to use
  * and even then, only when using non-blocking IO.
  * It can also be useful to work out where you were when the connection
@@ -693,6 +712,13 @@ struct ssl_st
 #define SSL_ST_READ_BODY                        0xF1
 #define SSL_ST_READ_DONE                        0xF2
 
+/* Obtain latest Finished message
+ *   -- that we sent (SSL_get_finished)
+ *   -- that we expected from peer (SSL_get_peer_finished).
+ * Returns length (0 == no Finished so far), copies up to 'count' bytes. */
+size_t SSL_get_finished(SSL *s, void *buf, size_t count);
+size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count);
+
 /* use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options
  * are 'ored' with SSL_VERIFY_PEER if they are desired */
 #define SSL_VERIFY_NONE                 0x00
@@ -700,9 +726,10 @@ struct ssl_st
 #define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02
 #define SSL_VERIFY_CLIENT_ONCE          0x04
 
+#define OpenSSL_add_ssl_algorithms()    SSL_library_init()
 #define SSLeay_add_ssl_algorithms()     SSL_library_init()
 
-/* this is for backward compatablility */
+/* this is for backward compatibility */
 #if 0 /* NEW_SSLEAY */
 #define SSL_CTX_set_default_verify(a,b,c) SSL_CTX_set_verify(a,b,c)
 #define SSL_set_pref_cipher(c,n)        SSL_set_cipher_list(c,n)
@@ -710,7 +737,7 @@ struct ssl_st
 #define SSL_remove_session(a,b)         SSL_CTX_remove_session((a),(b))
 #define SSL_flush_sessions(a,b)         SSL_CTX_flush_sessions((a),(b))
 #endif
-/* More backward compatablity */
+/* More backward compatibility */
 #define SSL_get_cipher(s) \
                 SSL_CIPHER_get_name(SSL_get_current_cipher(s))
 #define SSL_get_cipher_bits(s,np) \
@@ -762,11 +789,11 @@ struct ssl_st
 #define SSL_AD_ACCESS_DENIED            TLS1_AD_ACCESS_DENIED   /* fatal */
 #define SSL_AD_DECODE_ERROR             TLS1_AD_DECODE_ERROR    /* fatal */
 #define SSL_AD_DECRYPT_ERROR            TLS1_AD_DECRYPT_ERROR
-#define SSL_AD_EXPORT_RESTRICION        TLS1_AD_EXPORT_RESTRICION/* fatal */
+#define SSL_AD_EXPORT_RESTRICTION       TLS1_AD_EXPORT_RESTRICTION/* fatal */
 #define SSL_AD_PROTOCOL_VERSION         TLS1_AD_PROTOCOL_VERSION /* fatal */
 #define SSL_AD_INSUFFICIENT_SECURITY    TLS1_AD_INSUFFICIENT_SECURITY/* fatal */
 #define SSL_AD_INTERNAL_ERROR           TLS1_AD_INTERNAL_ERROR  /* fatal */
-#define SSL_AD_USER_CANCLED             TLS1_AD_USER_CANCLED
+#define SSL_AD_USER_CANCELLED           TLS1_AD_USER_CANCELLED
 #define SSL_AD_NO_RENEGOTIATION         TLS1_AD_NO_RENEGOTIATION
 
 #define SSL_ERROR_NONE                  0
@@ -867,7 +894,7 @@ void BIO_ssl_shutdown(BIO *ssl_bio);
 
 #endif
 
-int     SSL_CTX_set_cipher_list(SSL_CTX *,char *str);
+int     SSL_CTX_set_cipher_list(SSL_CTX *,const char *str);
 SSL_CTX *SSL_CTX_new(SSL_METHOD *meth);
 void    SSL_CTX_free(SSL_CTX *);
 long SSL_CTX_set_timeout(SSL_CTX *ctx,long t);
@@ -899,7 +926,7 @@ void	SSL_set_bio(SSL *s, BIO *rbio,BIO *wbio);
 BIO *   SSL_get_rbio(SSL *s);
 BIO *   SSL_get_wbio(SSL *s);
 #endif
-int     SSL_set_cipher_list(SSL *s, char *str);
+int     SSL_set_cipher_list(SSL *s, const char *str);
 void    SSL_set_read_ahead(SSL *s, int yes);
 int     SSL_get_verify_mode(SSL *s);
 int     SSL_get_verify_depth(SSL *s);
@@ -998,6 +1025,12 @@ int	SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
 SSL *   SSL_new(SSL_CTX *ctx);
 int     SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
                                    unsigned int sid_ctx_len);
+
+int SSL_CTX_set_purpose(SSL_CTX *s, int purpose);
+int SSL_set_purpose(SSL *s, int purpose);
+int SSL_CTX_set_trust(SSL_CTX *s, int trust);
+int SSL_set_trust(SSL *s, int trust);
+
 void    SSL_free(SSL *ssl);
 int     SSL_accept(SSL *ssl);
 int     SSL_connect(SSL *ssl);
@@ -1005,10 +1038,12 @@ int 	SSL_read(SSL *ssl,char *buf,int num);
 int     SSL_peek(SSL *ssl,char *buf,int num);
 int     SSL_write(SSL *ssl,const char *buf,int num);
 long    SSL_ctrl(SSL *ssl,int cmd, long larg, char *parg);
+long    SSL_callback_ctrl(SSL *, int, void (*)());
 long    SSL_CTX_ctrl(SSL_CTX *ctx,int cmd, long larg, char *parg);
+long    SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)());
 
 int     SSL_get_error(SSL *s,int ret_code);
-char *  SSL_get_version(SSL *s);
+const char *SSL_get_version(SSL *s);
 
 /* This sets the 'default' SSL version that SSL_new() will create */
 int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth);
@@ -1074,7 +1109,9 @@ int SSL_version(SSL *ssl);
 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx);
 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
         const char *CApath);
+#define SSL_get0_session SSL_get_session /* just peek at pointer */
 SSL_SESSION *SSL_get_session(SSL *ssl);
+SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */
 SSL_CTX *SSL_get_SSL_CTX(SSL *ssl);
 void SSL_set_info_callback(SSL *ssl,void (*cb)());
 void (*SSL_get_info_callback(SSL *ssl))();
@@ -1085,18 +1122,18 @@ long SSL_get_verify_result(SSL *ssl);
 
 int SSL_set_ex_data(SSL *ssl,int idx,void *data);
 void *SSL_get_ex_data(SSL *ssl,int idx);
-int SSL_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 
 int SSL_SESSION_set_ex_data(SSL_SESSION *ss,int idx,void *data);
 void *SSL_SESSION_get_ex_data(SSL_SESSION *ss,int idx);
-int SSL_SESSION_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 
 int SSL_CTX_set_ex_data(SSL_CTX *ssl,int idx,void *data);
 void *SSL_CTX_get_ex_data(SSL_CTX *ssl,int idx);
-int SSL_CTX_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-        int (*dup_func)(), void (*free_func)());
+int SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 
 int SSL_get_ex_data_X509_STORE_CTX_idx(void );
 
@@ -1219,13 +1256,18 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_F_SSL_CERT_INSTANTIATE                       214
 #define SSL_F_SSL_CERT_NEW                               162
 #define SSL_F_SSL_CHECK_PRIVATE_KEY                      163
+#define SSL_F_SSL_CIPHER_PROCESS_RULESTR                 230
+#define SSL_F_SSL_CIPHER_STRENGTH_SORT                   231
 #define SSL_F_SSL_CLEAR                                  164
 #define SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD            165
 #define SSL_F_SSL_CREATE_CIPHER_LIST                     166
+#define SSL_F_SSL_CTRL                                   232
 #define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY                  168
 #define SSL_F_SSL_CTX_NEW                                169
+#define SSL_F_SSL_CTX_SET_PURPOSE                        226
 #define SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT             219
 #define SSL_F_SSL_CTX_SET_SSL_VERSION                    170
+#define SSL_F_SSL_CTX_SET_TRUST                          229
 #define SSL_F_SSL_CTX_USE_CERTIFICATE                    171
 #define SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1               172
 #define SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE         220
@@ -1253,9 +1295,11 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_F_SSL_SET_CERT                               191
 #define SSL_F_SSL_SET_FD                                 192
 #define SSL_F_SSL_SET_PKEY                               193
+#define SSL_F_SSL_SET_PURPOSE                            227
 #define SSL_F_SSL_SET_RFD                                194
 #define SSL_F_SSL_SET_SESSION                            195
 #define SSL_F_SSL_SET_SESSION_ID_CONTEXT                 218
+#define SSL_F_SSL_SET_TRUST                              228
 #define SSL_F_SSL_SET_WFD                                196
 #define SSL_F_SSL_SHUTDOWN                               224
 #define SSL_F_SSL_UNDEFINED_FUNCTION                     197
@@ -1282,7 +1326,6 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_BAD_AUTHENTICATION_TYPE                    102
 #define SSL_R_BAD_CHANGE_CIPHER_SPEC                     103
 #define SSL_R_BAD_CHECKSUM                               104
-#define SSL_R_BAD_CLIENT_REQUEST                         105
 #define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK              106
 #define SSL_R_BAD_DECOMPRESSION                          107
 #define SSL_R_BAD_DH_G_LENGTH                            108
@@ -1290,6 +1333,7 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_BAD_DH_P_LENGTH                            110
 #define SSL_R_BAD_DIGEST_LENGTH                          111
 #define SSL_R_BAD_DSA_SIGNATURE                          112
+#define SSL_R_BAD_HELLO_REQUEST                          105
 #define SSL_R_BAD_LENGTH                                 271
 #define SSL_R_BAD_MAC_DECODE                             113
 #define SSL_R_BAD_MESSAGE_TYPE                           114
@@ -1329,6 +1373,7 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG            148
 #define SSL_R_DIGEST_CHECK_FAILED                        149
 #define SSL_R_ENCRYPTED_LENGTH_TOO_LONG                  150
+#define SSL_R_ERROR_GENERATING_TMP_RSA_KEY               1092
 #define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST              151
 #define SSL_R_EXCESSIVE_MESSAGE_SIZE                     152
 #define SSL_R_EXTRA_DATA_IN_MESSAGE                      153
@@ -1337,6 +1382,9 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_HTTP_REQUEST                               156
 #define SSL_R_INTERNAL_ERROR                             157
 #define SSL_R_INVALID_CHALLENGE_LENGTH                   158
+#define SSL_R_INVALID_COMMAND                            280
+#define SSL_R_INVALID_PURPOSE                            278
+#define SSL_R_INVALID_TRUST                              279
 #define SSL_R_LENGTH_MISMATCH                            159
 #define SSL_R_LENGTH_TOO_SHORT                           160
 #define SSL_R_LIBRARY_BUG                                274
@@ -1429,14 +1477,14 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_TLSV1_ALERT_DECODE_ERROR                   1050
 #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED              1021
 #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR                  1051
-#define SSL_R_TLSV1_ALERT_EXPORT_RESTRICION              1060
+#define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION             1060
 #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY          1071
 #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR                 1080
 #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION               1100
 #define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION               1070
 #define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW                1022
 #define SSL_R_TLSV1_ALERT_UNKNOWN_CA                     1048
-#define SSL_R_TLSV1_ALERT_USER_CANCLED                   1090
+#define SSL_R_TLSV1_ALERT_USER_CANCELLED                 1090
 #define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER       232
 #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
 #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG    234
@@ -1464,6 +1512,7 @@ int SSL_COMP_add_compression_method(int id,char *cm);
 #define SSL_R_UNKNOWN_STATE                              255
 #define SSL_R_UNSUPPORTED_CIPHER                         256
 #define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM          257
+#define SSL_R_UNSUPPORTED_OPTION                         1091
 #define SSL_R_UNSUPPORTED_PROTOCOL                       258
 #define SSL_R_UNSUPPORTED_SSL_VERSION                    259
 #define SSL_R_WRITE_BIO_NOT_SET                          260
diff --git a/src/lib/libssl/ssl/shlib_version b/src/lib/libssl/ssl/shlib_version
index b52599a164..ba5a3fee58 100644
--- a/src/lib/libssl/ssl/shlib_version
+++ b/src/lib/libssl/ssl/shlib_version
@@ -1,2 +1,2 @@
 major=2
-minor=0
+minor=2
diff --git a/src/lib/libssl/ssl2.h b/src/lib/libssl/ssl2.h
index d7f24ac1b4..01d41c88c5 100644
--- a/src/lib/libssl/ssl2.h
+++ b/src/lib/libssl/ssl2.h
@@ -151,7 +151,7 @@ extern "C" {
 #define  CERT           char
 #endif
 
-typedef struct ssl2_ctx_st
+typedef struct ssl2_state_st
         {
         int three_byte_header;
         int clear_text;         /* clear text */
@@ -214,7 +214,7 @@ typedef struct ssl2_ctx_st
                 unsigned int clen;
                 unsigned int rlen;
                 } tmp;
-        } SSL2_CTX;
+        } SSL2_STATE;
 
 /* SSLv2 */
 /* client */
diff --git a/src/lib/libssl/ssl3.h b/src/lib/libssl/ssl3.h
index 2a9714fc19..f616763830 100644
--- a/src/lib/libssl/ssl3.h
+++ b/src/lib/libssl/ssl3.h
@@ -158,24 +158,8 @@ extern "C" {
 #define SSL3_RT_MAX_PACKET_SIZE         (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH)
 #define SSL3_RT_MAX_DATA_SIZE                   (1024*1024)
 
-/* the states that a SSL3_RECORD can be in
- * For SSL_read it goes
- * rbuf->ENCODED        -> read 
- * ENCODED              -> we need to decode everything - call decode_record
- */
- 
-#define SSL3_RS_BLANK                   1
-#define SSL3_RS_DATA
-
-#define SSL3_RS_ENCODED                 2
-#define SSL3_RS_READ_MORE               3
-#define SSL3_RS_WRITE_MORE
-#define SSL3_RS_PLAIN                   3
-#define SSL3_RS_PART_READ               4
-#define SSL3_RS_PART_WRITE              5
-
-#define SSL3_MD_CLIENT_FINISHED_CONST   {0x43,0x4C,0x4E,0x54}
-#define SSL3_MD_SERVER_FINISHED_CONST   {0x53,0x52,0x56,0x52}
+#define SSL3_MD_CLIENT_FINISHED_CONST   "\x43\x4C\x4E\x54"
+#define SSL3_MD_SERVER_FINISHED_CONST   "\x53\x52\x56\x52"
 
 #define SSL3_VERSION                    0x0300
 #define SSL3_VERSION_MAJOR              0x03
@@ -204,22 +188,20 @@ extern "C" {
 
 typedef struct ssl3_record_st
         {
-/*r */  int type;               /* type of record */
-/*  */  /*int state;*/          /* any data in it? */
-/*rw*/  unsigned int length;    /* How many bytes available */
-/*r */  unsigned int off;       /* read/write offset into 'buf' */
-/*rw*/  unsigned char *data;    /* pointer to the record data */
-/*rw*/  unsigned char *input;   /* where the decode bytes are */
-/*r */  unsigned char *comp;    /* only used with decompression - malloc()ed */
+/*r */  int type;               /* type of record */
+/*rw*/  unsigned int length;    /* How many bytes available */
+/*r */  unsigned int off;       /* read/write offset into 'buf' */
+/*rw*/  unsigned char *data;    /* pointer to the record data */
+/*rw*/  unsigned char *input;   /* where the decode bytes are */
+/*r */  unsigned char *comp;    /* only used with decompression - malloc()ed */
         } SSL3_RECORD;
 
 typedef struct ssl3_buffer_st
         {
-/*r */  int total;              /* used in non-blocking writes */
-/*r */  int wanted;             /* how many more bytes we need */
-/*rw*/  int left;               /* how many bytes left */
-/*rw*/  int offset;             /* where to 'copy from' */
-/*rw*/  unsigned char *buf;     /* SSL3_RT_MAX_PACKET_SIZE bytes */
+        unsigned char *buf;     /* SSL3_RT_MAX_PACKET_SIZE bytes (more if
+                                 * SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER is set) */
+        int offset;             /* where to 'copy from' */
+        int left;               /* how many bytes left */
         } SSL3_BUFFER;
 
 #define SSL3_CT_RSA_SIGN                        1
@@ -236,34 +218,7 @@ typedef struct ssl3_buffer_st
 #define SSL3_FLAGS_POP_BUFFER                   0x0004
 #define TLS1_FLAGS_TLS_PADDING_BUG              0x0008
 
-#if 0
-#define AD_CLOSE_NOTIFY                 0
-#define AD_UNEXPECTED_MESSAGE           1
-#define AD_BAD_RECORD_MAC               2
-#define AD_DECRYPTION_FAILED            3
-#define AD_RECORD_OVERFLOW              4
-#define AD_DECOMPRESSION_FAILURE        5       /* fatal */
-#define AD_HANDSHAKE_FAILURE            6       /* fatal */
-#define AD_NO_CERTIFICATE               7       /* Not under TLS */
-#define AD_BAD_CERTIFICATE              8
-#define AD_UNSUPPORTED_CERTIFICATE      9
-#define AD_CERTIFICATE_REVOKED          10      
-#define AD_CERTIFICATE_EXPIRED          11
-#define AD_CERTIFICATE_UNKNOWN          12
-#define AD_ILLEGAL_PARAMETER            13      /* fatal */
-#define AD_UNKNOWN_CA                   14      /* fatal */
-#define AD_ACCESS_DENIED                15      /* fatal */
-#define AD_DECODE_ERROR                 16      /* fatal */
-#define AD_DECRYPT_ERROR                17
-#define AD_EXPORT_RESTRICION            18      /* fatal */
-#define AD_PROTOCOL_VERSION             19      /* fatal */
-#define AD_INSUFFICIENT_SECURITY        20      /* fatal */
-#define AD_INTERNAL_ERROR               21      /* fatal */
-#define AD_USER_CANCLED                 22
-#define AD_NO_RENEGOTIATION             23
-#endif
-
-typedef struct ssl3_ctx_st
+typedef struct ssl3_state_st
         {
         long flags;
         int delay_buf_pop_ret;
@@ -278,10 +233,16 @@ typedef struct ssl3_ctx_st
 
         SSL3_BUFFER rbuf;       /* read IO goes into here */
         SSL3_BUFFER wbuf;       /* write IO goes into here */
+
         SSL3_RECORD rrec;       /* each decoded record goes in here */
         SSL3_RECORD wrec;       /* goes out from here */
-                                /* Used by ssl3_read_n to point
-                                 * to input data packet */
+
+        /* storage for Alert/Handshake protocol data received but not
+         * yet processed by ssl3_read_bytes: */
+        unsigned char alert_fragment[2];
+        unsigned int alert_fragment_len;
+        unsigned char handshake_fragment[4];
+        unsigned int handshake_fragment_len;
 
         /* partial write - check the numbers match */
         unsigned int wnum;      /* number of bytes sent so far */
@@ -300,7 +261,7 @@ typedef struct ssl3_ctx_st
 
         int warn_alert;
         int fatal_alert;
-        /* we alow one fatal and one warning alert to be outstanding,
+        /* we allow one fatal and one warning alert to be outstanding,
          * send close alert via the warning alert */
         int alert_dispatch;
         unsigned char send_alert[2];
@@ -314,8 +275,14 @@ typedef struct ssl3_ctx_st
         int in_read_app_data;
 
         struct  {
-                /* Actually only needs to be 16+20 for SSLv3 and 12 for TLS */
+                /* actually only needs to be 16+20 */
+                unsigned char cert_verify_md[EVP_MAX_MD_SIZE*2];
+
+                /* actually only need to be 16+20 for SSLv3 and 12 for TLS */
                 unsigned char finish_md[EVP_MAX_MD_SIZE*2];
+                int finish_md_len;
+                unsigned char peer_finish_md[EVP_MAX_MD_SIZE*2];
+                int peer_finish_md_len;
                 
                 unsigned long message_size;
                 int message_type;
@@ -351,7 +318,7 @@ typedef struct ssl3_ctx_st
                 int cert_request;
                 } tmp;
 
-        } SSL3_CTX;
+        } SSL3_STATE;
 
 /* SSLv3 */
 /*client */
@@ -429,7 +396,7 @@ typedef struct ssl3_ctx_st
 #define SSL3_ST_SW_FINISHED_A           (0x1E0|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_FINISHED_B           (0x1E1|SSL_ST_ACCEPT)
 
-#define SSL3_MT_CLIENT_REQUEST                  0
+#define SSL3_MT_HELLO_REQUEST                   0
 #define SSL3_MT_CLIENT_HELLO                    1
 #define SSL3_MT_SERVER_HELLO                    2
 #define SSL3_MT_CERTIFICATE                     11
diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c
index 0f6a0884e4..e77cdddfd3 100644
--- a/src/lib/libssl/ssl_asn1.c
+++ b/src/lib/libssl/ssl_asn1.c
@@ -60,6 +60,7 @@
 #include <stdlib.h>
 #include <openssl/asn1_mac.h>
 #include <openssl/objects.h>
+#include <openssl/x509.h>
 #include "ssl_locl.h"
 
 typedef struct ssl_session_asn1_st
@@ -73,14 +74,15 @@ typedef struct ssl_session_asn1_st
         ASN1_OCTET_STRING key_arg;
         ASN1_INTEGER time;
         ASN1_INTEGER timeout;
+        ASN1_INTEGER verify_result;
         } SSL_SESSION_ASN1;
 
 int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
         {
 #define LSIZE2 (sizeof(long)*2)
-        int v1=0,v2=0,v3=0,v4=0;
+        int v1=0,v2=0,v3=0,v4=0,v5=0;
         unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2];
-        unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2];
+        unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2],ibuf5[LSIZE2];
         long l;
         SSL_SESSION_ASN1 a;
         M_ASN1_I2D_vars(in);
@@ -89,7 +91,7 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                 return(0);
 
         /* Note that I cheat in the following 2 assignments.  I know
-         * that if the ASN1_INTERGER passed to ASN1_INTEGER_set
+         * that if the ASN1_INTEGER passed to ASN1_INTEGER_set
          * is > sizeof(long)+1, the buffer will not be re-Malloc()ed.
          * This is a bit evil but makes things simple, no dynamic allocation
          * to clean up :-) */
@@ -156,6 +158,14 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                 ASN1_INTEGER_set(&(a.timeout),in->timeout);
                 }
 
+        if (in->verify_result != X509_V_OK)
+                {
+                a.verify_result.length=LSIZE2;
+                a.verify_result.type=V_ASN1_INTEGER;
+                a.verify_result.data=ibuf5;
+                ASN1_INTEGER_set(&a.verify_result,in->verify_result);
+                }
+
         M_ASN1_I2D_len(&(a.version),            i2d_ASN1_INTEGER);
         M_ASN1_I2D_len(&(a.ssl_version),        i2d_ASN1_INTEGER);
         M_ASN1_I2D_len(&(a.cipher),             i2d_ASN1_OCTET_STRING);
@@ -170,6 +180,8 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
         if (in->peer != NULL)
                 M_ASN1_I2D_len_EXP_opt(in->peer,i2d_X509,3,v3);
         M_ASN1_I2D_len_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,v4);
+        if (in->verify_result != X509_V_OK)
+                M_ASN1_I2D_len_EXP_opt(&(a.verify_result),i2d_ASN1_INTEGER,5,v5);
 
         M_ASN1_I2D_seq_total();
 
@@ -188,7 +200,8 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                 M_ASN1_I2D_put_EXP_opt(in->peer,i2d_X509,3,v3);
         M_ASN1_I2D_put_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,
                                v4);
-
+        if (in->verify_result != X509_V_OK)
+                M_ASN1_I2D_put_EXP_opt(&a.verify_result,i2d_ASN1_INTEGER,5,v5);
         M_ASN1_I2D_finish();
         }
 
@@ -322,6 +335,15 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, unsigned char **pp,
         else
             ret->sid_ctx_length=0;
 
+        ai.length=0;
+        M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,5);
+        if (ai.data != NULL)
+                {
+                ret->verify_result=ASN1_INTEGER_get(aip);
+                Free(ai.data); ai.data=NULL; ai.length=0;
+                }
+        else
+                ret->verify_result=X509_V_OK;
+
         M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION);
         }
-
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
index 6d2511f76c..48f247ceac 100644
--- a/src/lib/libssl/ssl_cert.c
+++ b/src/lib/libssl/ssl_cert.c
@@ -105,17 +105,26 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#if !defined(WIN32) && !defined(VSM) && !defined(NeXT)
+
+#include "openssl/e_os.h"
+
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
+#if !defined(WIN32) && !defined(VSM) && !defined(NeXT) && !defined(MAC_OS_pre_X)
 #include <dirent.h>
 #endif
+
 #ifdef NeXT
 #include <sys/dir.h>
 #define dirent direct
 #endif
+
 #include <openssl/objects.h>
 #include <openssl/bio.h>
 #include <openssl/pem.h>
+#include <openssl/x509v3.h>
 #include "ssl_locl.h"
 
 int SSL_get_ex_data_X509_STORE_CTX_idx(void)
@@ -422,8 +431,16 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
         X509_STORE_CTX_init(&ctx,s->ctx->cert_store,x,sk);
         if (SSL_get_verify_depth(s) >= 0)
                 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
-        X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),
-                (char *)s);
+        X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),s);
+        /* We need to set the verify purpose. The purpose can be determined by
+         * the context: if its a server it will verify SSL client certificates
+         * or vice versa.
+         */
+
+        if(s->server) i = X509_PURPOSE_SSL_CLIENT;
+        else i = X509_PURPOSE_SSL_SERVER;
+
+        X509_STORE_CTX_purpose_inherit(&ctx, i, s->purpose, s->trust);
 
         if (s->ctx->app_verify_callback != NULL)
                 i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */
@@ -534,7 +551,7 @@ int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x)
         return(add_client_CA(&(ctx->client_CA),x));
         }
 
-static int name_cmp(X509_NAME **a,X509_NAME **b)
+static int xname_cmp(X509_NAME **a,X509_NAME **b)
         {
         return(X509_NAME_cmp(*a,*b));
         }
@@ -556,7 +573,7 @@ STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file)
         STACK_OF(X509_NAME) *ret,*sk;
 
         ret=sk_X509_NAME_new(NULL);
-        sk=sk_X509_NAME_new(name_cmp);
+        sk=sk_X509_NAME_new(xname_cmp);
 
         in=BIO_new(BIO_s_file_internal());
 
@@ -617,7 +634,7 @@ int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
     int ret=1;
     int (*oldcmp)(X509_NAME **a, X509_NAME **b);
 
-    oldcmp=sk_X509_NAME_set_cmp_func(stack,name_cmp);
+    oldcmp=sk_X509_NAME_set_cmp_func(stack,xname_cmp);
 
     in=BIO_new(BIO_s_file_internal());
 
@@ -671,6 +688,7 @@ err:
 
 #ifndef WIN32
 #ifndef VMS                     /* XXXX This may be fixed in the future */
+#ifndef MAC_OS_pre_X
 
 int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
                                        const char *dir)
@@ -714,3 +732,4 @@ err:
 
 #endif
 #endif
+#endif
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index 4c2989c47a..1cbc2886e9 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -83,24 +83,11 @@ static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={
         NULL,NULL,
         };
 
-typedef struct cipher_sort_st
-        {
-        SSL_CIPHER *cipher;
-        int pref;
-        } CIPHER_SORT;
-
 #define CIPHER_ADD      1
 #define CIPHER_KILL     2
 #define CIPHER_DEL      3
 #define CIPHER_ORD      4
-
-typedef struct cipher_choice_st
-        {
-        int type;
-        unsigned long algorithms;
-        unsigned long mask;
-        long top;
-        } CIPHER_CHOICE;
+#define CIPHER_SPECIAL  5
 
 typedef struct cipher_order_st
         {
@@ -110,59 +97,55 @@ typedef struct cipher_order_st
         struct cipher_order_st *next,*prev;
         } CIPHER_ORDER;
 
-static SSL_CIPHER cipher_aliases[]={
+static const SSL_CIPHER cipher_aliases[]={
         /* Don't include eNULL unless specifically enabled */
-        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, 0,SSL_ALL}, /* must be first */
-        {0,SSL_TXT_kRSA,0,SSL_kRSA,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_kDHr,0,SSL_kDHr,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_kDHd,0,SSL_kDHd,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_kEDH,0,SSL_kEDH,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_kFZA,0,SSL_kFZA,  0,SSL_MKEY_MASK},
-        {0,SSL_TXT_DH,  0,SSL_DH,    0,SSL_MKEY_MASK},
-        {0,SSL_TXT_EDH, 0,SSL_EDH,   0,SSL_MKEY_MASK|SSL_AUTH_MASK},
-
-        {0,SSL_TXT_aRSA,0,SSL_aRSA,  0,SSL_AUTH_MASK},
-        {0,SSL_TXT_aDSS,0,SSL_aDSS,  0,SSL_AUTH_MASK},
-        {0,SSL_TXT_aFZA,0,SSL_aFZA,  0,SSL_AUTH_MASK},
-        {0,SSL_TXT_aNULL,0,SSL_aNULL,0,SSL_AUTH_MASK},
-        {0,SSL_TXT_aDH, 0,SSL_aDH,   0,SSL_AUTH_MASK},
-        {0,SSL_TXT_DSS, 0,SSL_DSS,   0,SSL_AUTH_MASK},
-
-        {0,SSL_TXT_DES, 0,SSL_DES,   0,SSL_ENC_MASK},
-        {0,SSL_TXT_3DES,0,SSL_3DES,  0,SSL_ENC_MASK},
-        {0,SSL_TXT_RC4, 0,SSL_RC4,   0,SSL_ENC_MASK},
-        {0,SSL_TXT_RC2, 0,SSL_RC2,   0,SSL_ENC_MASK},
-        {0,SSL_TXT_IDEA,0,SSL_IDEA,  0,SSL_ENC_MASK},
-        {0,SSL_TXT_eNULL,0,SSL_eNULL,0,SSL_ENC_MASK},
-        {0,SSL_TXT_eFZA,0,SSL_eFZA,  0,SSL_ENC_MASK},
-
-        {0,SSL_TXT_MD5, 0,SSL_MD5,   0,SSL_MAC_MASK},
-        {0,SSL_TXT_SHA1,0,SSL_SHA1,  0,SSL_MAC_MASK},
-        {0,SSL_TXT_SHA, 0,SSL_SHA,   0,SSL_MAC_MASK},
-
-        {0,SSL_TXT_NULL,0,SSL_NULL,  0,SSL_ENC_MASK},
-        {0,SSL_TXT_RSA, 0,SSL_RSA,   0,SSL_AUTH_MASK|SSL_MKEY_MASK},
-        {0,SSL_TXT_ADH, 0,SSL_ADH,   0,SSL_AUTH_MASK|SSL_MKEY_MASK},
-        {0,SSL_TXT_FZA, 0,SSL_FZA,   0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK},
-
-        {0,SSL_TXT_EXP40, 0,SSL_EXP40, 0,SSL_EXP_MASK},
-        {0,SSL_TXT_EXPORT,0,SSL_EXP40, 0,SSL_EXP_MASK},
-        {0,SSL_TXT_EXP56, 0,SSL_EXP56, 0,SSL_EXP_MASK},
-        {0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,SSL_SSL_MASK},
-        {0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,SSL_SSL_MASK},
-        {0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,SSL_SSL_MASK},
-        {0,SSL_TXT_LOW,   0,SSL_LOW,   0,SSL_STRONG_MASK},
-        {0,SSL_TXT_MEDIUM,0,SSL_MEDIUM,0,SSL_STRONG_MASK},
-        {0,SSL_TXT_HIGH,  0,SSL_HIGH,  0,SSL_STRONG_MASK},
+        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
+        {0,SSL_TXT_kRSA,0,SSL_kRSA,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_kDHr,0,SSL_kDHr,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_kDHd,0,SSL_kDHd,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_kEDH,0,SSL_kEDH,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_kFZA,0,SSL_kFZA,  0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_DH,  0,SSL_DH,    0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_EDH, 0,SSL_EDH,   0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0},
+
+        {0,SSL_TXT_aRSA,0,SSL_aRSA,  0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_aDSS,0,SSL_aDSS,  0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_aFZA,0,SSL_aFZA,  0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_aNULL,0,SSL_aNULL,0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_aDH, 0,SSL_aDH,   0,0,0,0,SSL_AUTH_MASK,0},
+        {0,SSL_TXT_DSS, 0,SSL_DSS,   0,0,0,0,SSL_AUTH_MASK,0},
+
+        {0,SSL_TXT_DES, 0,SSL_DES,   0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_3DES,0,SSL_3DES,  0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_RC4, 0,SSL_RC4,   0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_RC2, 0,SSL_RC2,   0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_IDEA,0,SSL_IDEA,  0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_eFZA,0,SSL_eFZA,  0,0,0,0,SSL_ENC_MASK,0},
+
+        {0,SSL_TXT_MD5, 0,SSL_MD5,   0,0,0,0,SSL_MAC_MASK,0},
+        {0,SSL_TXT_SHA1,0,SSL_SHA1,  0,0,0,0,SSL_MAC_MASK,0},
+        {0,SSL_TXT_SHA, 0,SSL_SHA,   0,0,0,0,SSL_MAC_MASK,0},
+
+        {0,SSL_TXT_NULL,0,SSL_NULL,  0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_RSA, 0,SSL_RSA,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
+        {0,SSL_TXT_ADH, 0,SSL_ADH,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
+        {0,SSL_TXT_FZA, 0,SSL_FZA,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK,0},
+
+        {0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,0,0,0,SSL_SSL_MASK,0},
+        {0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,0,0,0,SSL_SSL_MASK,0},
+        {0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,0,0,0,SSL_SSL_MASK,0},
+
+        {0,SSL_TXT_EXP   ,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK},
+        {0,SSL_TXT_EXPORT,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK},
+        {0,SSL_TXT_EXP40, 0, 0, SSL_EXP40, 0,0,0,0,SSL_STRONG_MASK},
+        {0,SSL_TXT_EXP56, 0, 0, SSL_EXP56, 0,0,0,0,SSL_STRONG_MASK},
+        {0,SSL_TXT_LOW,   0, 0,   SSL_LOW, 0,0,0,0,SSL_STRONG_MASK},
+        {0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK},
+        {0,SSL_TXT_HIGH,  0, 0,  SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK},
         };
 
 static int init_ciphers=1;
-static void load_ciphers();
-
-static int cmp_by_name(SSL_CIPHER **a, SSL_CIPHER **b)
-        {
-        return(strcmp((*a)->name,(*b)->name));
-        }
 
 static void load_ciphers(void)
         {
@@ -294,170 +277,320 @@ static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
         *tail=curr;
         }
 
-STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *ssl_method,
-                STACK_OF(SSL_CIPHER) **cipher_list,
-                STACK_OF(SSL_CIPHER) **cipher_list_by_id,
-                char *str)
+static unsigned long ssl_cipher_get_disabled(void)
         {
-        SSL_CIPHER *c;
-        char *l;
-        STACK_OF(SSL_CIPHER) *ret=NULL,*ok=NULL;
-#define CL_BUF  40
-        char buf[CL_BUF];
-        char *tmp_str=NULL;
-        unsigned long mask,algorithms,ma;
-        char *start;
-        int i,j,k,num=0,ch,multi;
-        unsigned long al;
-        STACK *ca_list=NULL;
-        int current_x,num_x;
-        CIPHER_CHOICE *ops=NULL;
-        CIPHER_ORDER *list=NULL,*head=NULL,*tail=NULL,*curr,*tail2,*curr2;
-        int list_num;
-        int type;
-        SSL_CIPHER c_tmp,*cp;
-
-        if (str == NULL) return(NULL);
-
-        if (strncmp(str,"DEFAULT",7) == 0)
-                {
-                i=strlen(str)+2+strlen(SSL_DEFAULT_CIPHER_LIST);
-                if ((tmp_str=Malloc(i)) == NULL)
-                        {
-                        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
-                        goto err;
-                        }
-                strcpy(tmp_str,SSL_DEFAULT_CIPHER_LIST);
-                strcat(tmp_str,":");
-                strcat(tmp_str,&(str[7]));
-                str=tmp_str;
-                }
-        if (init_ciphers) load_ciphers();
-
-        num=ssl_method->num_ciphers();
-
-        if ((ret=sk_SSL_CIPHER_new(NULL)) == NULL) goto err;
-        if ((ca_list=(STACK *)sk_new(cmp_by_name)) == NULL) goto err;
+        unsigned long mask;
 
-        mask =SSL_kFZA;
+        mask = SSL_kFZA;
 #ifdef NO_RSA
-        mask|=SSL_aRSA|SSL_kRSA;
+        mask |= SSL_aRSA|SSL_kRSA;
 #endif
 #ifdef NO_DSA
-        mask|=SSL_aDSS;
+        mask |= SSL_aDSS;
 #endif
 #ifdef NO_DH
-        mask|=SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
+        mask |= SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
 #endif
 
 #ifdef SSL_FORBID_ENULL
-        mask|=SSL_eNULL;
+        mask |= SSL_eNULL;
 #endif
 
-        mask|=(ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL)?SSL_DES :0;
-        mask|=(ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL)?SSL_3DES:0;
-        mask|=(ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL)?SSL_RC4 :0;
-        mask|=(ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL)?SSL_RC2 :0;
-        mask|=(ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL)?SSL_IDEA:0;
-        mask|=(ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL)?SSL_eFZA:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL) ? SSL_DES :0;
+        mask |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL) ? SSL_RC4 :0;
+        mask |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0;
+        mask |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL) ? SSL_eFZA:0;
+
+        mask |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0;
+        mask |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0;
 
-        mask|=(ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL)?SSL_MD5 :0;
-        mask|=(ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL)?SSL_SHA1:0;
+        return(mask);
+        }
+
+static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
+                int num_of_ciphers, unsigned long mask, CIPHER_ORDER *list,
+                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
+        {
+        int i, list_num;
+        SSL_CIPHER *c;
 
-        if ((list=(CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER)*num)) == NULL)
-                goto err;
+        /*
+         * We have num_of_ciphers descriptions compiled in, depending on the
+         * method selected (SSLv2 and/or SSLv3, TLSv1 etc).
+         * These will later be sorted in a linked list with at most num
+         * entries.
+         */
 
         /* Get the initial list of ciphers */
-        list_num=0;
-        for (i=0; i<num; i++)
+        list_num = 0;   /* actual count of ciphers */
+        for (i = 0; i < num_of_ciphers; i++)
                 {
-                c=ssl_method->get_cipher((unsigned int)i);
+                c = ssl_method->get_cipher(i);
                 /* drop those that use any of that is not available */
                 if ((c != NULL) && c->valid && !(c->algorithms & mask))
                         {
-                        list[list_num].cipher=c;
-                        list[list_num].next=NULL;
-                        list[list_num].prev=NULL;
-                        list[list_num].active=0;
+                        list[list_num].cipher = c;
+                        list[list_num].next = NULL;
+                        list[list_num].prev = NULL;
+                        list[list_num].active = 0;
                         list_num++;
+                        /*
                         if (!sk_push(ca_list,(char *)c)) goto err;
+                        */
                         }
                 }
-        
-        for (i=1; i<list_num-1; i++)
+
+        /*
+         * Prepare linked list from list entries
+         */     
+        for (i = 1; i < list_num - 1; i++)
                 {
-                list[i].prev= &(list[i-1]);
-                list[i].next= &(list[i+1]);
+                list[i].prev = &(list[i-1]);
+                list[i].next = &(list[i+1]);
                 }
         if (list_num > 0)
                 {
-                head= &(list[0]);
-                head->prev=NULL;
-                head->next= &(list[1]);
-                tail= &(list[list_num-1]);
-                tail->prev= &(list[list_num-2]);
-                tail->next=NULL;
+                (*head_p) = &(list[0]);
+                (*head_p)->prev = NULL;
+                (*head_p)->next = &(list[1]);
+                (*tail_p) = &(list[list_num - 1]);
+                (*tail_p)->prev = &(list[list_num - 2]);
+                (*tail_p)->next = NULL;
                 }
+        }
 
-        /* special case */
-        cipher_aliases[0].algorithms &= ~mask;
+static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list,
+                        int num_of_group_aliases, unsigned long mask,
+                        CIPHER_ORDER *head)
+        {
+        CIPHER_ORDER *ciph_curr;
+        SSL_CIPHER **ca_curr;
+        int i;
 
-        /* get the aliases */
-        k=sizeof(cipher_aliases)/sizeof(SSL_CIPHER);
-        for (j=0; j<k; j++)
+        /*
+         * First, add the real ciphers as already collected
+         */
+        ciph_curr = head;
+        ca_curr = ca_list;
+        while (ciph_curr != NULL)
                 {
-                al=cipher_aliases[j].algorithms;
-                /* Drop those that are not relevent */
-                if ((al & mask) == al) continue;
-                if (!sk_push(ca_list,(char *)&(cipher_aliases[j]))) goto err;
+                *ca_curr = ciph_curr->cipher;
+                ca_curr++;
+                ciph_curr = ciph_curr->next;
                 }
 
-        /* ca_list now holds a 'stack' of SSL_CIPHERS, some real, some
-         * 'aliases' */
+        /*
+         * Now we add the available ones from the cipher_aliases[] table.
+         * They represent either an algorithm, that must be fully
+         * supported (not match any bit in mask) or represent a cipher
+         * strength value (will be added in any case because algorithms=0).
+         */
+        for (i = 0; i < num_of_group_aliases; i++)
+                {
+                if ((i == 0) ||         /* always fetch "ALL" */
+                    !(cipher_aliases[i].algorithms & mask))
+                        {
+                        *ca_curr = (SSL_CIPHER *)(cipher_aliases + i);
+                        ca_curr++;
+                        }
+                }
 
-        /* how many parameters are there? */
-        num=1;
-        for (l=str; *l; l++)
-                if (ITEM_SEP(*l))
-                        num++;
-        ops=(CIPHER_CHOICE *)Malloc(sizeof(CIPHER_CHOICE)*num);
-        if (ops == NULL) goto err;
-        memset(ops,0,sizeof(CIPHER_CHOICE)*num);
+        *ca_curr = NULL;        /* end of list */
+        }
 
-        /* we now parse the input string and create our operations */
-        l=str;
-        i=0;
-        current_x=0;
+static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
+                unsigned long algo_strength, unsigned long mask_strength,
+                int rule, int strength_bits, CIPHER_ORDER *list,
+                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
+        {
+        CIPHER_ORDER *head, *tail, *curr, *curr2, *tail2;
+        SSL_CIPHER *cp;
+        unsigned long ma, ma_s;
 
+#ifdef CIPHER_DEBUG
+        printf("Applying rule %d with %08lx %08lx %08lx %08lx (%d)\n",
+                rule, algorithms, mask, algo_strength, mask_strength,
+                strength_bits);
+#endif
+
+        curr = head = *head_p;
+        curr2 = head;
+        tail2 = tail = *tail_p;
         for (;;)
                 {
-                ch= *l;
+                if ((curr == NULL) || (curr == tail2)) break;
+                curr = curr2;
+                curr2 = curr->next;
+
+                cp = curr->cipher;
+
+                /*
+                 * Selection criteria is either the number of strength_bits
+                 * or the algorithm used.
+                 */
+                if (strength_bits == -1)
+                        {
+                        ma = mask & cp->algorithms;
+                        ma_s = mask_strength & cp->algo_strength;
+
+#ifdef CIPHER_DEBUG
+                        printf("\nName: %s:\nAlgo = %08lx Algo_strength = %08lx\nMask = %08lx Mask_strength %08lx\n", cp->name, cp->algorithms, cp->algo_strength, mask, mask_strength);
+                        printf("ma = %08lx ma_s %08lx, ma&algo=%08lx, ma_s&algos=%08lx\n", ma, ma_s, ma&algorithms, ma_s&algo_strength);
+#endif
+                        /*
+                         * Select: if none of the mask bit was met from the
+                         * cipher or not all of the bits were met, the
+                         * selection does not apply.
+                         */
+                        if (((ma == 0) && (ma_s == 0)) ||
+                            ((ma & algorithms) != ma) ||
+                            ((ma_s & algo_strength) != ma_s))
+                                continue; /* does not apply */
+                        }
+                else if (strength_bits != cp->strength_bits)
+                        continue;       /* does not apply */
+
+#ifdef CIPHER_DEBUG
+                printf("Action = %d\n", rule);
+#endif
+
+                /* add the cipher if it has not been added yet. */
+                if (rule == CIPHER_ADD)
+                        {
+                        if (!curr->active)
+                                {
+                                ll_append_tail(&head, curr, &tail);
+                                curr->active = 1;
+                                }
+                        }
+                /* Move the added cipher to this location */
+                else if (rule == CIPHER_ORD)
+                        {
+                        if (curr->active)
+                                {
+                                ll_append_tail(&head, curr, &tail);
+                                }
+                        }
+                else if (rule == CIPHER_DEL)
+                        curr->active = 0;
+                else if (rule == CIPHER_KILL)
+                        {
+                        if (head == curr)
+                                head = curr->next;
+                        else
+                                curr->prev->next = curr->next;
+                        if (tail == curr)
+                                tail = curr->prev;
+                        curr->active = 0;
+                        if (curr->next != NULL)
+                                curr->next->prev = curr->prev;
+                        if (curr->prev != NULL)
+                                curr->prev->next = curr->next;
+                        curr->next = NULL;
+                        curr->prev = NULL;
+                        }
+                }
+
+        *head_p = head;
+        *tail_p = tail;
+        }
+
+static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p,
+                                     CIPHER_ORDER **tail_p)
+        {
+        int max_strength_bits, i, *number_uses;
+        CIPHER_ORDER *curr;
+
+        /*
+         * This routine sorts the ciphers with descending strength. The sorting
+         * must keep the pre-sorted sequence, so we apply the normal sorting
+         * routine as '+' movement to the end of the list.
+         */
+        max_strength_bits = 0;
+        curr = *head_p;
+        while (curr != NULL)
+                {
+                if (curr->active &&
+                    (curr->cipher->strength_bits > max_strength_bits))
+                    max_strength_bits = curr->cipher->strength_bits;
+                curr = curr->next;
+                }
+
+        number_uses = Malloc((max_strength_bits + 1) * sizeof(int));
+        if (!number_uses)
+        {
+                SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT,ERR_R_MALLOC_FAILURE);
+                return(0);
+        }
+        memset(number_uses, 0, (max_strength_bits + 1) * sizeof(int));
+
+        /*
+         * Now find the strength_bits values actually used
+         */
+        curr = *head_p;
+        while (curr != NULL)
+                {
+                if (curr->active)
+                        number_uses[curr->cipher->strength_bits]++;
+                curr = curr->next;
+                }
+        /*
+         * Go through the list of used strength_bits values in descending
+         * order.
+         */
+        for (i = max_strength_bits; i >= 0; i--)
+                if (number_uses[i] > 0)
+                        ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
+                                        list, head_p, tail_p);
+
+        Free(number_uses);
+        return(1);
+        }
 
-                if (ch == '\0') break;
+static int ssl_cipher_process_rulestr(const char *rule_str,
+                CIPHER_ORDER *list, CIPHER_ORDER **head_p,
+                CIPHER_ORDER **tail_p, SSL_CIPHER **ca_list)
+        {
+        unsigned long algorithms, mask, algo_strength, mask_strength;
+        const char *l, *start, *buf;
+        int j, multi, found, rule, retval, ok, buflen;
+        char ch;
+
+        retval = 1;
+        l = rule_str;
+        for (;;)
+                {
+                ch = *l;
 
+                if (ch == '\0')
+                        break;          /* done */
                 if (ch == '-')
-                        { j=CIPHER_DEL; l++; }
+                        { rule = CIPHER_DEL; l++; }
                 else if (ch == '+')
-                        { j=CIPHER_ORD; l++; }
+                        { rule = CIPHER_ORD; l++; }
                 else if (ch == '!')
-                        { j=CIPHER_KILL; l++; }
-                else    
-                        { j=CIPHER_ADD; }
+                        { rule = CIPHER_KILL; l++; }
+                else if (ch == '@')
+                        { rule = CIPHER_SPECIAL; l++; }
+                else
+                        { rule = CIPHER_ADD; }
 
                 if (ITEM_SEP(ch))
                         {
                         l++;
                         continue;
                         }
-                ops[current_x].type=j;
-                ops[current_x].algorithms=0;
-                ops[current_x].mask=0;
+
+                algorithms = mask = algo_strength = mask_strength = 0;
 
                 start=l;
                 for (;;)
                         {
-                        ch= *l;
-                        i=0;
+                        ch = *l;
+                        buf = l;
+                        buflen = 0;
 #ifndef CHARSET_EBCDIC
                         while ( ((ch >= 'A') && (ch <= 'Z')) ||
                                 ((ch >= '0') && (ch <= '9')) ||
@@ -467,12 +600,28 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *ssl_method,
                         while ( isalnum(ch) || (ch == '-'))
 #endif
                                  {
-                                 buf[i]=ch;
-                                 ch= *(++l);
-                                 i++;
-                                 if (i >= (CL_BUF-2)) break;
+                                 ch = *(++l);
+                                 buflen++;
                                  }
-                        buf[i]='\0';
+
+                        if (buflen == 0)
+                                {
+                                /*
+                                 * We hit something, we cannot deal with,
+                                 * it is no command or separator nor
+                                 * alphanumeric, so we call this an error.
+                                 */
+                                SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
+                                       SSL_R_INVALID_COMMAND);
+                                retval = found = 0;
+                                l++;
+                                break;
+                                }
+
+                        if (rule == CIPHER_SPECIAL)
+                                {
+                                break;  /* special treatment */
+                                }
 
                         /* check for multi-part specification */
                         if (ch == '+')
@@ -483,133 +632,237 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *ssl_method,
                         else
                                 multi=0;
 
-                        c_tmp.name=buf;
-                        j=sk_find(ca_list,(char *)&c_tmp);
-                        if (j < 0)
-                                goto end_loop;
+                        /*
+                         * Now search for the name in the ca_list. Be careful
+                         * with the strncmp, because the "buflen" limitation
+                         * will make the rule "ADH:SOME" and the cipher
+                         * "ADH-MY-CIPHER" look like a match for buflen=3.
+                         * So additionally check, whether the cipher name found
+                         * has the correct length. We can save a strlen() call,
+                         * just checking for the '\0' at the right place is
+                         * sufficient, we have to strncmp() anyway.
+                         */
+                         j = found = 0;
+                         while (ca_list[j])
+                                {
+                                if ((ca_list[j]->name[buflen] == '\0') &&
+                                    !strncmp(buf, ca_list[j]->name, buflen))
+                                        {
+                                        found = 1;
+                                        break;
+                                        }
+                                else
+                                        j++;
+                                }
+                        if (!found)
+                                break;  /* ignore this entry */
+
+                        algorithms |= ca_list[j]->algorithms;
+                        mask |= ca_list[j]->mask;
+                        algo_strength |= ca_list[j]->algo_strength;
+                        mask_strength |= ca_list[j]->mask_strength;
 
-                        cp=(SSL_CIPHER *)sk_value(ca_list,j);
-                        ops[current_x].algorithms|=cp->algorithms;
-                        /* We add the SSL_SSL_MASK so we can match the
-                         * SSLv2 and SSLv3 versions of RC4-MD5 */
-                        ops[current_x].mask|=cp->mask;
                         if (!multi) break;
                         }
-                current_x++;
-                if (ch == '\0') break;
-end_loop:
-                /* Make sure we scan until the next valid start point */
-                while ((*l != '\0') && ITEM_SEP(*l))
-                        l++;
+
+                        /*
+                         * Ok, we have the rule, now apply it
+                         */
+                        if (rule == CIPHER_SPECIAL)
+                                {       /* special command */
+                                ok = 0;
+                                if ((buflen == 8) &&
+                                        !strncmp(buf, "STRENGTH", 8))
+                                        ok = ssl_cipher_strength_sort(list,
+                                                        head_p, tail_p);
+                                else
+                                        SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
+                                                SSL_R_INVALID_COMMAND);
+                                if (ok == 0)
+                                        retval = 0;
+                                /*
+                                 * We do not support any "multi" options
+                                 * together with "@", so throw away the
+                                 * rest of the command, if any left, until
+                                 * end or ':' is found.
+                                 */
+                                while ((*l != '\0') && ITEM_SEP(*l))
+                                        l++;
+                                }
+                        else if (found)
+                                {
+                                ssl_cipher_apply_rule(algorithms, mask,
+                                        algo_strength, mask_strength, rule, -1,
+                                        list, head_p, tail_p);
+                                }
+                        else
+                                {
+                                while ((*l != '\0') && ITEM_SEP(*l))
+                                        l++;
+                                }
+                        if (*l == '\0') break; /* done */
                 }
 
-        num_x=current_x;
-        current_x=0;
+        return(retval);
+        }
 
-        /* We will now process the list of ciphers, once for each category, to
-         * decide what we should do with it. */
-        for (j=0; j<num_x; j++)
+STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
+                STACK_OF(SSL_CIPHER) **cipher_list,
+                STACK_OF(SSL_CIPHER) **cipher_list_by_id,
+                const char *rule_str)
+        {
+        int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
+        unsigned long disabled_mask;
+        STACK_OF(SSL_CIPHER) *cipherstack;
+        const char *rule_p;
+        CIPHER_ORDER *list = NULL, *head = NULL, *tail = NULL, *curr;
+        SSL_CIPHER **ca_list = NULL;
+
+        /*
+         * Return with error if nothing to do.
+         */
+        if (rule_str == NULL) return(NULL);
+
+        if (init_ciphers) load_ciphers();
+
+        /*
+         * To reduce the work to do we only want to process the compiled
+         * in algorithms, so we first get the mask of disabled ciphers.
+         */
+        disabled_mask = ssl_cipher_get_disabled();
+
+        /*
+         * Now we have to collect the available ciphers from the compiled
+         * in ciphers. We cannot get more than the number compiled in, so
+         * it is used for allocation.
+         */
+        num_of_ciphers = ssl_method->num_ciphers();
+        list = (CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
+        if (list == NULL)
                 {
-                algorithms=ops[j].algorithms;
-                type=ops[j].type;
-                mask=ops[j].mask;
+                SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
+                return(NULL);   /* Failure */
+                }
 
-                curr=head;
-                curr2=head;
-                tail2=tail;
-                for (;;)
-                        {
-                        if ((curr == NULL) || (curr == tail2)) break;
-                        curr=curr2;
-                        curr2=curr->next;
+        ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask,
+                                   list, &head, &tail);
+
+        /*
+         * We also need cipher aliases for selecting based on the rule_str.
+         * There might be two types of entries in the rule_str: 1) names
+         * of ciphers themselves 2) aliases for groups of ciphers.
+         * For 1) we need the available ciphers and for 2) the cipher
+         * groups of cipher_aliases added together in one list (otherwise
+         * we would be happy with just the cipher_aliases table).
+         */
+        num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
+        num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
+        ca_list =
+                (SSL_CIPHER **)Malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
+        if (ca_list == NULL)
+                {
+                Free(list);
+                SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
+                return(NULL);   /* Failure */
+                }
+        ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mask,
+                                   head);
+
+        /*
+         * If the rule_string begins with DEFAULT, apply the default rule
+         * before using the (possibly available) additional rules.
+         */
+        ok = 1;
+        rule_p = rule_str;
+        if (strncmp(rule_str,"DEFAULT",7) == 0)
+                {
+                ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
+                        list, &head, &tail, ca_list);
+                rule_p += 7;
+                if (*rule_p == ':')
+                        rule_p++;
+                }
 
-                        cp=curr->cipher;
-                        ma=mask & cp->algorithms;
-                        if ((ma == 0) || ((ma & algorithms) != ma))
-                                {
-                                /* does not apply */
-                                continue;
-                                }
+        if (ok && (strlen(rule_p) > 0))
+                ok = ssl_cipher_process_rulestr(rule_p, list, &head, &tail,
+                                                ca_list);
 
-                        /* add the cipher if it has not been added yet. */
-                        if (type == CIPHER_ADD)
-                                {
-                                if (!curr->active)
-                                        {
-                                        ll_append_tail(&head,curr,&tail);
-                                        curr->active=1;
-                                        }
-                                }
-                        /* Move the added cipher to this location */
-                        else if (type == CIPHER_ORD)
-                                {
-                                if (curr->active)
-                                        {
-                                        ll_append_tail(&head,curr,&tail);
-                                        }
-                                }
-                        else if (type == CIPHER_DEL)
-                                curr->active=0;
-                        if (type == CIPHER_KILL)
-                                {
-                                if (head == curr)
-                                        head=curr->next;
-                                else
-                                        curr->prev->next=curr->next;
-                                if (tail == curr)
-                                        tail=curr->prev;
-                                curr->active=0;
-                                if (curr->next != NULL)
-                                        curr->next->prev=curr->prev;
-                                if (curr->prev != NULL)
-                                        curr->prev->next=curr->next;
-                                curr->next=NULL;
-                                curr->prev=NULL;
-                                }
-                        }
+        Free(ca_list);  /* Not needed anymore */
+
+        if (!ok)
+                {       /* Rule processing failure */
+                Free(list);
+                return(NULL);
+                }
+        /*
+         * Allocate new "cipherstack" for the result, return with error
+         * if we cannot get one.
+         */
+        if ((cipherstack = sk_SSL_CIPHER_new(NULL)) == NULL)
+                {
+                Free(list);
+                return(NULL);
                 }
 
-        for (curr=head; curr != NULL; curr=curr->next)
+        /*
+         * The cipher selection for the list is done. The ciphers are added
+         * to the resulting precedence to the STACK_OF(SSL_CIPHER).
+         */
+        for (curr = head; curr != NULL; curr = curr->next)
                 {
                 if (curr->active)
                         {
-                        sk_SSL_CIPHER_push(ret,curr->cipher);
+                        sk_SSL_CIPHER_push(cipherstack, curr->cipher);
 #ifdef CIPHER_DEBUG
                         printf("<%s>\n",curr->cipher->name);
 #endif
                         }
                 }
-
+        Free(list);     /* Not needed any longer */
+
+        /*
+         * The following passage is a little bit odd. If pointer variables
+         * were supplied to hold STACK_OF(SSL_CIPHER) return information,
+         * the old memory pointed to is free()ed. Then, however, the
+         * cipher_list entry will be assigned just a copy of the returned
+         * cipher stack. For cipher_list_by_id a copy of the cipher stack
+         * will be created. See next comment...
+         */
         if (cipher_list != NULL)
                 {
                 if (*cipher_list != NULL)
                         sk_SSL_CIPHER_free(*cipher_list);
-                *cipher_list=ret;
+                *cipher_list = cipherstack;
                 }
 
         if (cipher_list_by_id != NULL)
                 {
                 if (*cipher_list_by_id != NULL)
                         sk_SSL_CIPHER_free(*cipher_list_by_id);
-                *cipher_list_by_id=sk_SSL_CIPHER_dup(ret);
+                *cipher_list_by_id = sk_SSL_CIPHER_dup(cipherstack);
                 }
 
+        /*
+         * Now it is getting really strange. If something failed during
+         * the previous pointer assignment or if one of the pointers was
+         * not requested, the error condition is met. That might be
+         * discussable. The strange thing is however that in this case
+         * the memory "ret" pointed to is "free()ed" and hence the pointer
+         * cipher_list becomes wild. The memory reserved for
+         * cipher_list_by_id however is not "free()ed" and stays intact.
+         */
         if (    (cipher_list_by_id == NULL) ||
                 (*cipher_list_by_id == NULL) ||
                 (cipher_list == NULL) ||
                 (*cipher_list == NULL))
-                goto err;
+                {
+                sk_SSL_CIPHER_free(cipherstack);
+                return(NULL);
+                }
+
         sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
 
-        ok=ret;
-        ret=NULL;
-err:
-        if (tmp_str) Free(tmp_str);
-        if (ops != NULL) Free(ops);
-        if (ret != NULL) sk_SSL_CIPHER_free(ret);
-        if (ca_list != NULL) sk_free(ca_list);
-        if (list != NULL) Free(list);
-        return(ok);
+        return(cipherstack);
         }
 
 char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
@@ -617,15 +870,16 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         int is_export,pkl,kl;
         char *ver,*exp;
         char *kx,*au,*enc,*mac;
-        unsigned long alg,alg2;
+        unsigned long alg,alg2,alg_s;
         static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
         
         alg=cipher->algorithms;
+        alg_s=cipher->algo_strength;
         alg2=cipher->algorithm2;
 
-        is_export=SSL_IS_EXPORT(alg);
-        pkl=SSL_EXPORT_PKEYLENGTH(alg);
-        kl=SSL_EXPORT_KEYLENGTH(alg);
+        is_export=SSL_C_IS_EXPORT(cipher);
+        pkl=SSL_C_EXPORT_PKEYLENGTH(cipher);
+        kl=SSL_C_EXPORT_KEYLENGTH(cipher);
         exp=is_export?" export":"";
 
         if (alg & SSL_SSLV2)
@@ -752,37 +1006,16 @@ const char *SSL_CIPHER_get_name(SSL_CIPHER *c)
         return("(NONE)");
         }
 
-/* number of bits for symetric cipher */
+/* number of bits for symmetric cipher */
 int SSL_CIPHER_get_bits(SSL_CIPHER *c, int *alg_bits)
         {
-        int ret=0,a=0;
-        const EVP_CIPHER *enc;
-        const EVP_MD *md;
-        SSL_SESSION ss;
+        int ret=0;
 
         if (c != NULL)
                 {
-                ss.cipher=c;
-                if (!ssl_cipher_get_evp(&ss,&enc,&md,NULL))
-                        return(0);
-
-                a=EVP_CIPHER_key_length(enc)*8;
-
-                if (SSL_C_IS_EXPORT(c))
-                        {
-                        ret=SSL_C_EXPORT_KEYLENGTH(c)*8;
-                        }
-                else
-                        {
-                        if (c->algorithm2 & SSL2_CF_8_BYTE_ENC)
-                                ret=64;
-                        else
-                                ret=a;
-                        }
+                if (alg_bits != NULL) *alg_bits = c->alg_bits;
+                ret = c->strength_bits;
                 }
-
-        if (alg_bits != NULL) *alg_bits=a;
-        
         return(ret);
         }
 
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c
index 3ddc805b53..5618e34a30 100644
--- a/src/lib/libssl/ssl_err.c
+++ b/src/lib/libssl/ssl_err.c
@@ -135,13 +135,18 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_PACK(0,SSL_F_SSL_CERT_INSTANTIATE,0),      "SSL_CERT_INSTANTIATE"},
 {ERR_PACK(0,SSL_F_SSL_CERT_NEW,0),      "SSL_CERT_NEW"},
 {ERR_PACK(0,SSL_F_SSL_CHECK_PRIVATE_KEY,0),     "SSL_check_private_key"},
+{ERR_PACK(0,SSL_F_SSL_CIPHER_PROCESS_RULESTR,0),        "SSL_CIPHER_PROCESS_RULESTR"},
+{ERR_PACK(0,SSL_F_SSL_CIPHER_STRENGTH_SORT,0),  "SSL_CIPHER_STRENGTH_SORT"},
 {ERR_PACK(0,SSL_F_SSL_CLEAR,0), "SSL_clear"},
 {ERR_PACK(0,SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,0),   "SSL_COMP_add_compression_method"},
 {ERR_PACK(0,SSL_F_SSL_CREATE_CIPHER_LIST,0),    "SSL_CREATE_CIPHER_LIST"},
+{ERR_PACK(0,SSL_F_SSL_CTRL,0),  "SSL_ctrl"},
 {ERR_PACK(0,SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,0), "SSL_CTX_check_private_key"},
 {ERR_PACK(0,SSL_F_SSL_CTX_NEW,0),       "SSL_CTX_new"},
+{ERR_PACK(0,SSL_F_SSL_CTX_SET_PURPOSE,0),       "SSL_CTX_set_purpose"},
 {ERR_PACK(0,SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,0),    "SSL_CTX_set_session_id_context"},
 {ERR_PACK(0,SSL_F_SSL_CTX_SET_SSL_VERSION,0),   "SSL_CTX_set_ssl_version"},
+{ERR_PACK(0,SSL_F_SSL_CTX_SET_TRUST,0), "SSL_CTX_set_trust"},
 {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE,0),   "SSL_CTX_use_certificate"},
 {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,0),      "SSL_CTX_use_certificate_ASN1"},
 {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,0),        "SSL_CTX_use_certificate_chain_file"},
@@ -169,9 +174,11 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_PACK(0,SSL_F_SSL_SET_CERT,0),      "SSL_SET_CERT"},
 {ERR_PACK(0,SSL_F_SSL_SET_FD,0),        "SSL_set_fd"},
 {ERR_PACK(0,SSL_F_SSL_SET_PKEY,0),      "SSL_SET_PKEY"},
+{ERR_PACK(0,SSL_F_SSL_SET_PURPOSE,0),   "SSL_set_purpose"},
 {ERR_PACK(0,SSL_F_SSL_SET_RFD,0),       "SSL_set_rfd"},
 {ERR_PACK(0,SSL_F_SSL_SET_SESSION,0),   "SSL_set_session"},
 {ERR_PACK(0,SSL_F_SSL_SET_SESSION_ID_CONTEXT,0),        "SSL_set_session_id_context"},
+{ERR_PACK(0,SSL_F_SSL_SET_TRUST,0),     "SSL_set_trust"},
 {ERR_PACK(0,SSL_F_SSL_SET_WFD,0),       "SSL_set_wfd"},
 {ERR_PACK(0,SSL_F_SSL_SHUTDOWN,0),      "SSL_shutdown"},
 {ERR_PACK(0,SSL_F_SSL_UNDEFINED_FUNCTION,0),    "SSL_UNDEFINED_FUNCTION"},
@@ -201,7 +208,6 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_BAD_AUTHENTICATION_TYPE           ,"bad authentication type"},
 {SSL_R_BAD_CHANGE_CIPHER_SPEC            ,"bad change cipher spec"},
 {SSL_R_BAD_CHECKSUM                      ,"bad checksum"},
-{SSL_R_BAD_CLIENT_REQUEST                ,"bad client request"},
 {SSL_R_BAD_DATA_RETURNED_BY_CALLBACK     ,"bad data returned by callback"},
 {SSL_R_BAD_DECOMPRESSION                 ,"bad decompression"},
 {SSL_R_BAD_DH_G_LENGTH                   ,"bad dh g length"},
@@ -209,6 +215,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_BAD_DH_P_LENGTH                   ,"bad dh p length"},
 {SSL_R_BAD_DIGEST_LENGTH                 ,"bad digest length"},
 {SSL_R_BAD_DSA_SIGNATURE                 ,"bad dsa signature"},
+{SSL_R_BAD_HELLO_REQUEST                 ,"bad hello request"},
 {SSL_R_BAD_LENGTH                        ,"bad length"},
 {SSL_R_BAD_MAC_DECODE                    ,"bad mac decode"},
 {SSL_R_BAD_MESSAGE_TYPE                  ,"bad message type"},
@@ -248,6 +255,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG   ,"dh public value length is wrong"},
 {SSL_R_DIGEST_CHECK_FAILED               ,"digest check failed"},
 {SSL_R_ENCRYPTED_LENGTH_TOO_LONG         ,"encrypted length too long"},
+{SSL_R_ERROR_GENERATING_TMP_RSA_KEY      ,"error generating tmp rsa key"},
 {SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST     ,"error in received cipher list"},
 {SSL_R_EXCESSIVE_MESSAGE_SIZE            ,"excessive message size"},
 {SSL_R_EXTRA_DATA_IN_MESSAGE             ,"extra data in message"},
@@ -256,6 +264,9 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_HTTP_REQUEST                      ,"http request"},
 {SSL_R_INTERNAL_ERROR                    ,"internal error"},
 {SSL_R_INVALID_CHALLENGE_LENGTH          ,"invalid challenge length"},
+{SSL_R_INVALID_COMMAND                   ,"invalid command"},
+{SSL_R_INVALID_PURPOSE                   ,"invalid purpose"},
+{SSL_R_INVALID_TRUST                     ,"invalid trust"},
 {SSL_R_LENGTH_MISMATCH                   ,"length mismatch"},
 {SSL_R_LENGTH_TOO_SHORT                  ,"length too short"},
 {SSL_R_LIBRARY_BUG                       ,"library bug"},
@@ -348,14 +359,14 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_TLSV1_ALERT_DECODE_ERROR          ,"tlsv1 alert decode error"},
 {SSL_R_TLSV1_ALERT_DECRYPTION_FAILED     ,"tlsv1 alert decryption failed"},
 {SSL_R_TLSV1_ALERT_DECRYPT_ERROR         ,"tlsv1 alert decrypt error"},
-{SSL_R_TLSV1_ALERT_EXPORT_RESTRICION     ,"tlsv1 alert export restricion"},
+{SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION    ,"tlsv1 alert export restriction"},
 {SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY ,"tlsv1 alert insufficient security"},
 {SSL_R_TLSV1_ALERT_INTERNAL_ERROR        ,"tlsv1 alert internal error"},
 {SSL_R_TLSV1_ALERT_NO_RENEGOTIATION      ,"tlsv1 alert no renegotiation"},
 {SSL_R_TLSV1_ALERT_PROTOCOL_VERSION      ,"tlsv1 alert protocol version"},
 {SSL_R_TLSV1_ALERT_RECORD_OVERFLOW       ,"tlsv1 alert record overflow"},
 {SSL_R_TLSV1_ALERT_UNKNOWN_CA            ,"tlsv1 alert unknown ca"},
-{SSL_R_TLSV1_ALERT_USER_CANCLED          ,"tlsv1 alert user cancled"},
+{SSL_R_TLSV1_ALERT_USER_CANCELLED        ,"tlsv1 alert user cancelled"},
 {SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER,"tls client cert req with anon cipher"},
 {SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST,"tls peer did not respond with certificate list"},
 {SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG,"tls rsa encrypted value length is wrong"},
@@ -383,6 +394,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_UNKNOWN_STATE                     ,"unknown state"},
 {SSL_R_UNSUPPORTED_CIPHER                ,"unsupported cipher"},
 {SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM ,"unsupported compression algorithm"},
+{SSL_R_UNSUPPORTED_OPTION                ,"unsupported option"},
 {SSL_R_UNSUPPORTED_PROTOCOL              ,"unsupported protocol"},
 {SSL_R_UNSUPPORTED_SSL_VERSION           ,"unsupported ssl version"},
 {SSL_R_WRITE_BIO_NOT_SET                 ,"write bio not set"},
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index e192fc4cac..3109708480 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -61,22 +61,24 @@
 #include <stdio.h>
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
+#include <openssl/x509v3.h>
 #include "ssl_locl.h"
 
-char *SSL_version_str=OPENSSL_VERSION_TEXT;
+const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 
-static STACK *ssl_meth=NULL;
-static STACK *ssl_ctx_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_ctx_meth=NULL;
 static int ssl_meth_num=0;
 static int ssl_ctx_meth_num=0;
 
 OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={
+        /* evil casts, but these functions are only called if there's a library bug */
+        (int (*)(SSL *,int))ssl_undefined_function,
+        (int (*)(SSL *, unsigned char *, int))ssl_undefined_function,
         ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_undefined_function,
+        (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
+        (int (*)(SSL*, int))ssl_undefined_function,
+        (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function
         };
 
 int SSL_clear(SSL *s)
@@ -93,10 +95,17 @@ int SSL_clear(SSL *s)
         s->hit=0;
         s->shutdown=0;
 
-#if 0
+#if 0 /* Disabled since version 1.10 of this file (early return not
+       * needed because SSL_clear is not called when doing renegotiation) */
         /* This is set if we are doing dynamic renegotiation so keep
          * the old cipher.  It is sort of a SSL_clear_lite :-) */
         if (s->new_session) return(1);
+#else
+        if (s->new_session)
+                {
+                SSLerr(SSL_F_SSL_CLEAR,SSL_R_INTERNAL_ERROR);
+                return 0;
+                }
 #endif
 
         state=s->state; /* Keep to check if we throw away the session-id */
@@ -201,6 +210,8 @@ SSL *SSL_new(SSL_CTX *ctx)
         s->verify_mode=ctx->verify_mode;
         s->verify_depth=ctx->verify_depth;
         s->verify_callback=ctx->default_verify_callback;
+        s->purpose = ctx->purpose;
+        s->trust = ctx->trust;
         CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
         s->ctx=ctx;
 
@@ -218,7 +229,7 @@ SSL *SSL_new(SSL_CTX *ctx)
         s->mode=ctx->mode;
         SSL_clear(s);
 
-        CRYPTO_new_ex_data(ssl_meth,(char *)s,&s->ex_data);
+        CRYPTO_new_ex_data(ssl_meth,s,&s->ex_data);
 
         return(s);
 err:
@@ -262,6 +273,46 @@ int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
     return 1;
     }
 
+int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
+{
+        if(X509_PURPOSE_get_by_id(purpose) == -1) {
+                SSLerr(SSL_F_SSL_CTX_SET_PURPOSE, SSL_R_INVALID_PURPOSE);
+                return 0;
+        }
+        s->purpose = purpose;
+        return 1;
+}
+
+int SSL_set_purpose(SSL *s, int purpose)
+{
+        if(X509_PURPOSE_get_by_id(purpose) == -1) {
+                SSLerr(SSL_F_SSL_SET_PURPOSE, SSL_R_INVALID_PURPOSE);
+                return 0;
+        }
+        s->purpose = purpose;
+        return 1;
+}
+        
+int SSL_CTX_set_trust(SSL_CTX *s, int trust)
+{
+        if(X509_TRUST_get_by_id(trust) == -1) {
+                SSLerr(SSL_F_SSL_CTX_SET_TRUST, SSL_R_INVALID_TRUST);
+                return 0;
+        }
+        s->trust = trust;
+        return 1;
+}
+
+int SSL_set_trust(SSL *s, int trust)
+{
+        if(X509_TRUST_get_by_id(trust) == -1) {
+                SSLerr(SSL_F_SSL_SET_TRUST, SSL_R_INVALID_TRUST);
+                return 0;
+        }
+        s->trust = trust;
+        return 1;
+}
+
 void SSL_free(SSL *s)
         {
         int i;
@@ -324,7 +375,7 @@ void SSL_free(SSL *s)
 
         if (s->method != NULL) s->method->ssl_free(s);
 
-        Free((char *)s);
+        Free(s);
         }
 
 void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio)
@@ -433,6 +484,38 @@ err:
         }
 #endif
 
+
+/* return length of latest Finished message we sent, copy to 'buf' */
+size_t SSL_get_finished(SSL *s, void *buf, size_t count)
+        {
+        size_t ret = 0;
+        
+        if (s->s3 != NULL)
+                {
+                ret = s->s3->tmp.finish_md_len;
+                if (count > ret)
+                        count = ret;
+                memcpy(buf, s->s3->tmp.finish_md, count);
+                }
+        return ret;
+        }
+
+/* return length of latest Finished message we expected, copy to 'buf' */
+size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count)
+        {
+        size_t ret = 0;
+        
+        if (s->s3 != NULL)
+                {
+                ret = s->s3->tmp.peer_finish_md_len;
+                if (count > ret)
+                        count = ret;
+                memcpy(buf, s->s3->tmp.peer_finish_md, count);
+                }
+        return ret;
+        }
+
+
 int SSL_get_verify_mode(SSL *s)
         {
         return(s->verify_mode);
@@ -706,6 +789,20 @@ long SSL_ctrl(SSL *s,int cmd,long larg,char *parg)
                 }
         }
 
+long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)())
+        {
+        switch(cmd)
+                {
+        default:
+                return(s->method->ssl_callback_ctrl(s,cmd,fp));
+                }
+        }
+
+struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx)
+        {
+        return ctx->sessions;
+        }
+
 long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,char *parg)
         {
         long l;
@@ -765,6 +862,15 @@ long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,char *parg)
                 }
         }
 
+long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+        {
+        switch(cmd)
+                {
+        default:
+                return(ctx->method->ssl_ctx_callback_ctrl(ctx,cmd,fp));
+                }
+        }
+
 int ssl_cipher_id_cmp(SSL_CIPHER *a,SSL_CIPHER *b)
         {
         long l;
@@ -834,8 +940,8 @@ const char *SSL_get_cipher_list(SSL *s,int n)
         return(c->name);
         }
 
-/** specify the ciphers to be used by defaut by the SSL_CTX */
-int SSL_CTX_set_cipher_list(SSL_CTX *ctx,char *str)
+/** specify the ciphers to be used by default by the SSL_CTX */
+int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
         {
         STACK_OF(SSL_CIPHER) *sk;
         
@@ -846,7 +952,7 @@ int SSL_CTX_set_cipher_list(SSL_CTX *ctx,char *str)
         }
 
 /** specify the ciphers to be used by the SSL */
-int SSL_set_cipher_list(SSL *s,char *str)
+int SSL_set_cipher_list(SSL *s,const char *str)
         {
         STACK_OF(SSL_CIPHER) *sk;
         
@@ -1127,7 +1233,7 @@ void SSL_CTX_free(SSL_CTX *a)
                 sk_X509_pop_free(a->extra_certs,X509_free);
         if (a->comp_methods != NULL)
                 sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free);
-        Free((char *)a);
+        Free(a);
         }
 
 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
@@ -1254,10 +1360,8 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
                 emask|=SSL_aDSS;
                 }
 
-#ifdef SSL_ALLOW_ADH
         mask|=SSL_aNULL;
         emask|=SSL_aNULL;
-#endif
 
         c->mask=mask;
         c->export_mask=emask;
@@ -1274,7 +1378,7 @@ X509 *ssl_get_server_send_cert(SSL *s)
         c=s->cert;
         ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
         alg=s->s3->tmp.new_cipher->algorithms;
-        is_export=SSL_IS_EXPORT(alg);
+        is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
         mask=is_export?c->export_mask:c->mask;
         kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK);
 
@@ -1527,7 +1631,7 @@ SSL_METHOD *ssl_bad_method(int ver)
         return(NULL);
         }
 
-char *SSL_get_version(SSL *s)
+const char *SSL_get_version(SSL *s)
         {
         if (s->version == TLS1_VERSION)
                 return("TLSv1");
@@ -1831,8 +1935,8 @@ long SSL_get_verify_result(SSL *ssl)
         return(ssl->verify_result);
         }
 
-int SSL_get_ex_new_index(long argl,char *argp,int (*new_func)(),
-                         int (*dup_func)(),void (*free_func)())
+int SSL_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func,
+                         CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func)
         {
         ssl_meth_num++;
         return(CRYPTO_get_ex_new_index(ssl_meth_num-1,
@@ -1849,8 +1953,8 @@ void *SSL_get_ex_data(SSL *s,int idx)
         return(CRYPTO_get_ex_data(&s->ex_data,idx));
         }
 
-int SSL_CTX_get_ex_new_index(long argl,char *argp,int (*new_func)(),
-                             int (*dup_func)(),void (*free_func)())
+int SSL_CTX_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func,
+                             CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func)
         {
         ssl_ctx_meth_num++;
         return(CRYPTO_get_ex_new_index(ssl_ctx_meth_num-1,
@@ -1899,13 +2003,16 @@ int SSL_want(SSL *s)
 void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,
                                                           int is_export,
                                                           int keylength))
-    { SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,0,(char *)cb); }
-#endif
+    {
+    SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
+    }
 
-#ifndef NO_RSA
-void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,int is_export,
-                                                          int keylength))
-    { SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,0,(char *)cb); }
+void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,
+                                                  int is_export,
+                                                  int keylength))
+    {
+    SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
+    }
 #endif
 
 #ifdef DOXYGEN
@@ -1932,11 +2039,15 @@ RSA *cb(SSL *ssl,int is_export,int keylength)
 #ifndef NO_DH
 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export,
                                                         int keylength))
-    { SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,0,(char *)dh); }
+    {
+    SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
+    }
 
 void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export,
-                                                        int keylength))
-    { SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,0,(char *)dh); }
+                                                int keylength))
+    {
+    SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
+    }
 #endif
 
 #if defined(_WINDLL) && defined(WIN16)
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index 0bfd57db32..9a52bab254 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -155,6 +155,19 @@
 #define DEC32(a)        ((a)=((a)-1)&0xffffffffL)
 #define MAX_MAC_SIZE    20 /* up from 16 for SSLv3 */
 
+/*
+ * Define the Bitmasks for SSL_CIPHER.algorithms.
+ * This bits are used packed as dense as possible. If new methods/ciphers
+ * etc will be added, the bits a likely to change, so this information
+ * is for internal library use only, even though SSL_CIPHER.algorithms
+ * can be publicly accessed.
+ * Use the according functions for cipher management instead.
+ *
+ * The bit mask handling in the selection and sorting scheme in
+ * ssl_create_cipher_list() has only limited capabilities, reflecting
+ * that the different entities within are mutually exclusive:
+ * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
+ */
 #define SSL_MKEY_MASK           0x0000001FL
 #define SSL_kRSA                0x00000001L /* RSA key exchange */
 #define SSL_kDHr                0x00000002L /* DH cert RSA CA cert */
@@ -191,36 +204,75 @@
 #define SSL_SHA1                0x00040000L
 #define SSL_SHA                 (SSL_SHA1)
 
-#define SSL_EXP_MASK            0x00300000L
-#define SSL_EXP40               0x00100000L
-#define SSL_NOT_EXP             0x00200000L
-#define SSL_EXP56               0x00300000L
-#define SSL_IS_EXPORT(a)        ((a)&SSL_EXP40)
-#define SSL_IS_EXPORT56(a)      (((a)&SSL_EXP_MASK) == SSL_EXP56)
-#define SSL_IS_EXPORT40(a)      (((a)&SSL_EXP_MASK) == SSL_EXP40)
-#define SSL_C_IS_EXPORT(c)      SSL_IS_EXPORT((c)->algorithms)
-#define SSL_C_IS_EXPORT56(c)    SSL_IS_EXPORT56((c)->algorithms)
-#define SSL_C_IS_EXPORT40(c)    SSL_IS_EXPORT40((c)->algorithms)
-#define SSL_EXPORT_KEYLENGTH(a) (SSL_IS_EXPORT40(a) ? 5 : \
+#define SSL_SSL_MASK            0x00180000L
+#define SSL_SSLV2               0x00080000L
+#define SSL_SSLV3               0x00100000L
+#define SSL_TLSV1               SSL_SSLV3       /* for now */
+
+/* we have used 001fffff - 11 bits left to go */
+
+/*
+ * Export and cipher strength information. For each cipher we have to decide
+ * whether it is exportable or not. This information is likely to change
+ * over time, since the export control rules are no static technical issue.
+ *
+ * Independent of the export flag the cipher strength is sorted into classes.
+ * SSL_EXP40 was denoting the 40bit US export limit of past times, which now
+ * is at 56bit (SSL_EXP56). If the exportable cipher class is going to change
+ * again (eg. to 64bit) the use of "SSL_EXP*" becomes blurred even more,
+ * since SSL_EXP64 could be similar to SSL_LOW.
+ * For this reason SSL_MICRO and SSL_MINI macros are included to widen the
+ * namespace of SSL_LOW-SSL_HIGH to lower values. As development of speed
+ * and ciphers goes, another extension to SSL_SUPER and/or SSL_ULTRA would
+ * be possible.
+ */
+#define SSL_EXP_MASK            0x00000003L
+#define SSL_NOT_EXP             0x00000001L
+#define SSL_EXPORT              0x00000002L
+
+#define SSL_STRONG_MASK         0x0000007cL
+#define SSL_EXP40               0x00000004L
+#define SSL_MICRO               (SSL_EXP40)
+#define SSL_EXP56               0x00000008L
+#define SSL_MINI                (SSL_EXP56)
+#define SSL_LOW                 0x00000010L
+#define SSL_MEDIUM              0x00000020L
+#define SSL_HIGH                0x00000040L
+
+/* we have used 0000007f - 25 bits left to go */
+
+/*
+ * Macros to check the export status and cipher strength for export ciphers.
+ * Even though the macros for EXPORT and EXPORT40/56 have similar names,
+ * their meaning is different:
+ * *_EXPORT macros check the 'exportable' status.
+ * *_EXPORT40/56 macros are used to check whether a certain cipher strength
+ *          is given.
+ * Since the SSL_IS_EXPORT* and SSL_EXPORT* macros depend on the correct
+ * algorithm structure element to be passed (algorithms, algo_strength) and no
+ * typechecking can be done as they are all of type unsigned long, their
+ * direct usage is discouraged.
+ * Use the SSL_C_* macros instead.
+ */
+#define SSL_IS_EXPORT(a)        ((a)&SSL_EXPORT)
+#define SSL_IS_EXPORT56(a)      ((a)&SSL_EXP56)
+#define SSL_IS_EXPORT40(a)      ((a)&SSL_EXP40)
+#define SSL_C_IS_EXPORT(c)      SSL_IS_EXPORT((c)->algo_strength)
+#define SSL_C_IS_EXPORT56(c)    SSL_IS_EXPORT56((c)->algo_strength)
+#define SSL_C_IS_EXPORT40(c)    SSL_IS_EXPORT40((c)->algo_strength)
+
+#define SSL_EXPORT_KEYLENGTH(a,s)       (SSL_IS_EXPORT40(s) ? 5 : \
                                  ((a)&SSL_ENC_MASK) == SSL_DES ? 8 : 7)
 #define SSL_EXPORT_PKEYLENGTH(a) (SSL_IS_EXPORT40(a) ? 512 : 1024)
-#define SSL_C_EXPORT_KEYLENGTH(c)       SSL_EXPORT_KEYLENGTH((c)->algorithms)
-#define SSL_C_EXPORT_PKEYLENGTH(c)      SSL_EXPORT_PKEYLENGTH((c)->algorithms)
-
-#define SSL_SSL_MASK            0x00c00000L
-#define SSL_SSLV2               0x00400000L
-#define SSL_SSLV3               0x00800000L
-#define SSL_TLSV1               SSL_SSLV3       /* for now */
+#define SSL_C_EXPORT_KEYLENGTH(c)       SSL_EXPORT_KEYLENGTH((c)->algorithms, \
+                                (c)->algo_strength)
+#define SSL_C_EXPORT_PKEYLENGTH(c)      SSL_EXPORT_PKEYLENGTH((c)->algo_strength)
 
-#define SSL_STRONG_MASK         0x07000000L
-#define SSL_LOW                 0x01000000L
-#define SSL_MEDIUM              0x02000000L
-#define SSL_HIGH                0x04000000L
 
-/* we have used 0fffffff - 4 bits left to go */
 #define SSL_ALL                 0xffffffffL
 #define SSL_ALL_CIPHERS         (SSL_MKEY_MASK|SSL_AUTH_MASK|SSL_ENC_MASK|\
-                                SSL_MAC_MASK|SSL_EXP_MASK)
+                                SSL_MAC_MASK)
+#define SSL_ALL_STRENGTHS       (SSL_EXP_MASK|SSL_STRONG_MASK)
 
 /* Mostly for SSLv3 */
 #define SSL_PKEY_RSA_ENC        0
@@ -254,9 +306,9 @@ typedef struct cert_st
         {
         /* Current active set */
         CERT_PKEY *key; /* ALWAYS points to an element of the pkeys array
-                                         * Probably it would make more sense to store
-                                         * an index, not a pointer. */
-
+                         * Probably it would make more sense to store
+                         * an index, not a pointer. */
+ 
         /* The following masks are for the key and auth
          * algorithms that are supported by the certs below */
         int valid;
@@ -319,28 +371,28 @@ typedef struct sess_cert_st
 
 /* This is for the SSLv3/TLSv1.0 differences in crypto/hash stuff
  * It is a bit of a mess of functions, but hell, think of it as
- * an opaque strucute :-) */
+ * an opaque structure :-) */
 typedef struct ssl3_enc_method
         {
-        int (*enc)();
-        int (*mac)();
-        int (*setup_key_block)();
-        int (*generate_master_secret)();
-        int (*change_cipher_state)();
-        int (*final_finish_mac)();
+        int (*enc)(SSL *, int);
+        int (*mac)(SSL *, unsigned char *, int);
+        int (*setup_key_block)(SSL *);
+        int (*generate_master_secret)(SSL *, unsigned char *, unsigned char *, int);
+        int (*change_cipher_state)(SSL *, int);
+        int (*final_finish_mac)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char *, int, unsigned char *);
         int finish_mac_length;
-        int (*cert_verify_mac)();
-        unsigned char client_finished[20];
-        int client_finished_len;
-        unsigned char server_finished[20];
-        int server_finished_len;
-        int (*alert_value)();
+        int (*cert_verify_mac)(SSL *, EVP_MD_CTX *, unsigned char *);
+        const char *client_finished_label;
+        int client_finished_label_len;
+        const char *server_finished_label;
+        int server_finished_label_len;
+        int (*alert_value)(int);
         } SSL3_ENC_METHOD;
 
 /* Used for holding the relevant compression methods loaded into SSL_CTX */
 typedef struct ssl3_comp_st
         {
-        int comp_id;    /* The identifer byte for this compression type */
+        int comp_id;    /* The identifier byte for this compression type */
         char *name;     /* Text name used for the compression type */
         COMP_METHOD *method; /* The method :-) */
         } SSL3_COMP;
@@ -376,10 +428,10 @@ int ssl_cipher_ptr_id_cmp(SSL_CIPHER **ap,SSL_CIPHER **bp);
 STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
                                                STACK_OF(SSL_CIPHER) **skp);
 int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p);
-STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *meth,
+STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth,
                                              STACK_OF(SSL_CIPHER) **pref,
                                              STACK_OF(SSL_CIPHER) **sorted,
-                                             char *str);
+                                             const char *rule_str);
 void ssl_update_cache(SSL *s, int mode);
 int ssl_cipher_get_evp(SSL_SESSION *s,const EVP_CIPHER **enc,const EVP_MD **md,
                        SSL_COMP **comp);
@@ -416,6 +468,8 @@ int	ssl2_shutdown(SSL *s);
 void    ssl2_clear(SSL *s);
 long    ssl2_ctrl(SSL *s,int cmd, long larg, char *parg);
 long    ssl2_ctx_ctrl(SSL_CTX *s,int cmd, long larg, char *parg);
+long    ssl2_callback_ctrl(SSL *s,int cmd, void (*fp)());
+long    ssl2_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)());
 int     ssl2_pending(SSL *s);
 
 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
@@ -433,17 +487,16 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out,
         unsigned char *p, int len);
 int ssl3_get_req_cert_type(SSL *s,unsigned char *p);
 long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok);
-int ssl3_send_finished(SSL *s, int a, int b, unsigned char *sender,int slen);
+int ssl3_send_finished(SSL *s, int a, int b, const char *sender,int slen);
 int ssl3_num_ciphers(void);
 SSL_CIPHER *ssl3_get_cipher(unsigned int u);
 int ssl3_renegotiate(SSL *ssl); 
 int ssl3_renegotiate_check(SSL *ssl); 
 int ssl3_dispatch_alert(SSL *s);
 int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len);
-int ssl3_part_read(SSL *s, int i);
 int ssl3_write_bytes(SSL *s, int type, const void *buf, int len);
-int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1,EVP_MD_CTX *ctx2,
-        unsigned char *sender, int slen,unsigned char *p);
+int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1, EVP_MD_CTX *ctx2,
+        const char *sender, int slen,unsigned char *p);
 int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p);
 void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len);
 int ssl3_enc(SSL *s, int send_data);
@@ -463,6 +516,8 @@ int	ssl3_shutdown(SSL *s);
 void    ssl3_clear(SSL *s);
 long    ssl3_ctrl(SSL *s,int cmd, long larg, char *parg);
 long    ssl3_ctx_ctrl(SSL_CTX *s,int cmd, long larg, char *parg);
+long    ssl3_callback_ctrl(SSL *s,int cmd, void (*fp)());
+long    ssl3_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)());
 int     ssl3_pending(SSL *s);
 
 int ssl23_accept(SSL *s);
@@ -474,6 +529,7 @@ int tls1_new(SSL *s);
 void tls1_free(SSL *s);
 void tls1_clear(SSL *s);
 long tls1_ctrl(SSL *s,int cmd, long larg, char *parg);
+long tls1_callback_ctrl(SSL *s,int cmd, void (*fp)());
 SSL_METHOD *tlsv1_base_method(void );
 
 int ssl_init_wbio_buffer(SSL *s, int push);
@@ -483,7 +539,7 @@ int tls1_change_cipher_state(SSL *s, int which);
 int tls1_setup_key_block(SSL *s);
 int tls1_enc(SSL *s, int snd);
 int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx,
-        unsigned char *str, int slen, unsigned char *p);
+        const char *str, int slen, unsigned char *p);
 int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p);
 int tls1_mac(SSL *ssl, unsigned char *md, int snd);
 int tls1_generate_master_secret(SSL *s, unsigned char *out,
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
index 681499f08a..9e01f72753 100644
--- a/src/lib/libssl/ssl_sess.c
+++ b/src/lib/libssl/ssl_sess.c
@@ -65,15 +65,31 @@ static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
 static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s);
 static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
 static int ssl_session_num=0;
-static STACK *ssl_session_meth=NULL;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_session_meth=NULL;
 
 SSL_SESSION *SSL_get_session(SSL *ssl)
+/* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */
         {
         return(ssl->session);
         }
 
-int SSL_SESSION_get_ex_new_index(long argl, char *argp, int (*new_func)(),
-             int (*dup_func)(), void (*free_func)())
+SSL_SESSION *SSL_get1_session(SSL *ssl)
+/* variant of SSL_get_session: caller really gets something */
+        {
+        SSL_SESSION *sess;
+        /* Need to lock this all up rather than just use CRYPTO_add so that
+         * somebody doesn't free ssl->session between when we check it's
+         * non-null and when we up the reference count. */
+        CRYPTO_r_lock(CRYPTO_LOCK_SSL_SESSION);
+        sess = ssl->session;
+        if(sess)
+                sess->references++;
+        CRYPTO_r_unlock(CRYPTO_LOCK_SSL_SESSION);
+        return(sess);
+        }
+
+int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
         {
         ssl_session_num++;
         return(CRYPTO_get_ex_new_index(ssl_session_num-1,
@@ -103,13 +119,14 @@ SSL_SESSION *SSL_SESSION_new(void)
                 }
         memset(ss,0,sizeof(SSL_SESSION));
 
+        ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
         ss->references=1;
         ss->timeout=60*5+4; /* 5 minute timeout by default */
         ss->time=time(NULL);
         ss->prev=NULL;
         ss->next=NULL;
         ss->compress_meth=0;
-        CRYPTO_new_ex_data(ssl_session_meth,(char *)ss,&ss->ex_data);
+        CRYPTO_new_ex_data(ssl_session_meth,ss,&ss->ex_data);
         return(ss);
         }
 
@@ -161,15 +178,20 @@ int ssl_get_new_session(SSL *s, int session)
                         {
                         SSL_SESSION *r;
 
-                        RAND_bytes(ss->session_id,ss->session_id_length);
+                        RAND_pseudo_bytes(ss->session_id,ss->session_id_length);
                         CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
-                        r=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,
-                                (char *)ss);
+                        r=(SSL_SESSION *)lh_retrieve(s->ctx->sessions, ss);
                         CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
                         if (r == NULL) break;
                         /* else - woops a session_id match */
-                        /* XXX should also check external cache!
-                         * (But the probability of a collision is negligible, anyway...) */
+                        /* XXX We should also check the external cache --
+                         * but the probability of a collision is negligible, and
+                         * we could not prevent the concurrent creation of sessions
+                         * with identical IDs since we currently don't have means
+                         * to atomically check whether a session ID already exists
+                         * and make a reservation for it if it does not
+                         * (this problem applies to the internal cache as well).
+                         */
                         }
                 }
         else
@@ -181,6 +203,7 @@ int ssl_get_new_session(SSL *s, int session)
         ss->sid_ctx_length=s->sid_ctx_length;
         s->session=ss;
         ss->ssl_version=s->version;
+        ss->verify_result = X509_V_OK;
 
         return(1);
         }
@@ -192,7 +215,6 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
         SSL_SESSION *ret=NULL,data;
         int fatal = 0;
 
-        /* conn_init();*/
         data.ssl_version=s->version;
         data.session_id_length=len;
         if (len > SSL_MAX_SSL_SESSION_ID_LENGTH)
@@ -202,7 +224,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
         if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
                 {
                 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
-                ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,(char *)&data);
+                ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,&data);
                 if (ret != NULL)
                     /* don't allow other threads to steal it: */
                     CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION);
@@ -311,6 +333,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
         if (s->session != NULL)
                 SSL_SESSION_free(s->session);
         s->session=ret;
+        s->verify_result = s->session->verify_result;
         return(1);
 
  err:
@@ -327,27 +350,47 @@ int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
         int ret=0;
         SSL_SESSION *s;
 
-        /* conn_init(); */
+        /* add just 1 reference count for the SSL_CTX's session cache
+         * even though it has two ways of access: each session is in a
+         * doubly linked list and an lhash */
         CRYPTO_add(&c->references,1,CRYPTO_LOCK_SSL_SESSION);
+        /* if session c is in already in cache, we take back the increment later */
 
         CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
-        s=(SSL_SESSION *)lh_insert(ctx->sessions,(char *)c);
+        s=(SSL_SESSION *)lh_insert(ctx->sessions,c);
         
-        /* Put on the end of the queue unless it is already in the cache */
+        /* s != NULL iff we already had a session with the given PID.
+         * In this case, s == c should hold (then we did not really modify
+         * ctx->sessions), or we're in trouble. */
+        if (s != NULL && s != c)
+                {
+                /* We *are* in trouble ... */
+                SSL_SESSION_list_remove(ctx,s);
+                SSL_SESSION_free(s);
+                /* ... so pretend the other session did not exist in cache
+                 * (we cannot handle two SSL_SESSION structures with identical
+                 * session ID in the same cache, which could happen e.g. when
+                 * two threads concurrently obtain the same session from an external
+                 * cache) */
+                s = NULL;
+                }
+
+        /* Put at the head of the queue unless it is already in the cache */
         if (s == NULL)
                 SSL_SESSION_list_add(ctx,c);
 
-        /* If the same session if is being 're-added', Free the old
-         * one when the last person stops using it.
-         * This will also work if it is alread in the cache.
-         * The references will go up and then down :-) */
         if (s != NULL)
                 {
-                SSL_SESSION_free(s);
+                /* existing cache entry -- decrement previously incremented reference
+                 * count because it already takes into account the cache */
+
+                SSL_SESSION_free(s); /* s == c */
                 ret=0;
                 }
         else
                 {
+                /* new cache entry -- remove old ones if cache has become too large */
+                
                 ret=1;
 
                 if (SSL_CTX_sess_get_cache_size(ctx) > 0)
@@ -380,7 +423,7 @@ static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
         if ((c != NULL) && (c->session_id_length != 0))
                 {
                 if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
-                r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
+                r=(SSL_SESSION *)lh_delete(ctx->sessions,c);
                 if (r != NULL)
                         {
                         ret=1;
@@ -422,7 +465,7 @@ void SSL_SESSION_free(SSL_SESSION *ss)
                 }
 #endif
 
-        CRYPTO_free_ex_data(ssl_session_meth,(char *)ss,&ss->ex_data);
+        CRYPTO_free_ex_data(ssl_session_meth,ss,&ss->ex_data);
 
         memset(ss->key_arg,0,SSL_MAX_KEY_ARG_LENGTH);
         memset(ss->master_key,0,SSL_MAX_MASTER_KEY_LENGTH);
@@ -541,7 +584,7 @@ static void timeout(SSL_SESSION *s, TIMEOUT_PARAM *p)
                 {
                 /* The reason we don't call SSL_CTX_remove_session() is to
                  * save on locking overhead */
-                lh_delete(p->cache,(char *)s);
+                lh_delete(p->cache,s);
                 SSL_SESSION_list_remove(p->ctx,s);
                 s->not_resumable=1;
                 if (p->ctx->remove_session_cb != NULL)
@@ -562,7 +605,7 @@ void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
         CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
         i=tp.cache->down_load;
         tp.cache->down_load=0;
-        lh_doall_arg(tp.cache,(void (*)())timeout,(char *)&tp);
+        lh_doall_arg(tp.cache,(void (*)())timeout,&tp);
         tp.cache->down_load=i;
         CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
         }
diff --git a/src/lib/libssl/ssl_stat.c b/src/lib/libssl/ssl_stat.c
index 3eca4ee601..8e12461f3b 100644
--- a/src/lib/libssl/ssl_stat.c
+++ b/src/lib/libssl/ssl_stat.c
@@ -183,7 +183,7 @@ case SSL3_ST_SR_CERT_VRFY_B:	str="SSLv3 read certificate verify B"; break;
 #endif
 
 #if !defined(NO_SSL2) && !defined(NO_SSL3)
-/* SSLv2/v3 compatablitity states */
+/* SSLv2/v3 compatibility states */
 /* client */
 case SSL23_ST_CW_CLNT_HELLO_A:  str="SSLv2/v3 write client hello A"; break;
 case SSL23_ST_CW_CLNT_HELLO_B:  str="SSLv2/v3 write client hello B"; break;
@@ -331,7 +331,7 @@ case SSL3_ST_SR_CERT_VRFY_B:			str="3RCV_B"; break;
 #endif
 
 #if !defined(NO_SSL2) && !defined(NO_SSL3)
-/* SSLv2/v3 compatablitity states */
+/* SSLv2/v3 compatibility states */
 /* client */
 case SSL23_ST_CW_CLNT_HELLO_A:                  str="23WCHA"; break;
 case SSL23_ST_CW_CLNT_HELLO_B:                  str="23WCHB"; break;
@@ -402,7 +402,7 @@ char *SSL_alert_desc_string_long(int value)
                 str="close notify";
                 break;
         case SSL3_AD_UNEXPECTED_MESSAGE:
-                str="unexected_message";
+                str="unexpected_message";
                 break;
         case SSL3_AD_BAD_RECORD_MAC:
                 str="bad record mac";
@@ -429,7 +429,7 @@ char *SSL_alert_desc_string_long(int value)
                 str="certificate expired";
                 break;
         case SSL3_AD_CERTIFICATE_UNKNOWN:
-                str="certifcate unknown";
+                str="certificate unknown";
                 break;
         case SSL3_AD_ILLEGAL_PARAMETER:
                 str="illegal parameter";
diff --git a/src/lib/libssl/ssl_txt.c b/src/lib/libssl/ssl_txt.c
index ca67a98d89..7e27857bcf 100644
--- a/src/lib/libssl/ssl_txt.c
+++ b/src/lib/libssl/ssl_txt.c
@@ -112,7 +112,7 @@ int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
                 sprintf(str,"%02X",x->session_id[i]);
                 if (BIO_puts(bp,str) <= 0) goto err;
                 }
-        if (BIO_puts(bp,"\nSession-ID-ctx: ") <= 0) goto err;
+        if (BIO_puts(bp,"\n    Session-ID-ctx: ") <= 0) goto err;
         for (i=0; i<x->sid_ctx_length; i++)
                 {
                 sprintf(str,"%02X",x->sid_ctx[i]);
@@ -163,6 +163,11 @@ int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
                 if (BIO_puts(bp,str) <= 0) goto err;
                 }
         if (BIO_puts(bp,"\n") <= 0) goto err;
+
+        if (BIO_puts(bp, "    Verify return code ") <= 0) goto err;
+        sprintf(str, "%ld (%s)\n", x->verify_result, 
+                        X509_verify_cert_error_string(x->verify_result));
+        if (BIO_puts(bp,str) <= 0) goto err;
                 
         return(1);
 err:
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index 914b743498..279e45db5d 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -494,7 +494,7 @@ int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in_ctx, unsigned char *out)
         }
 
 int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx,
-             unsigned char *str, int slen, unsigned char *out)
+             const char *str, int slen, unsigned char *out)
         {
         unsigned int i;
         EVP_MD_CTX ctx;
@@ -621,11 +621,11 @@ int tls1_alert_code(int code)
         case SSL_AD_ACCESS_DENIED:      return(TLS1_AD_ACCESS_DENIED);
         case SSL_AD_DECODE_ERROR:       return(TLS1_AD_DECODE_ERROR);
         case SSL_AD_DECRYPT_ERROR:      return(TLS1_AD_DECRYPT_ERROR);
-        case SSL_AD_EXPORT_RESTRICION:  return(TLS1_AD_EXPORT_RESTRICION);
+        case SSL_AD_EXPORT_RESTRICTION: return(TLS1_AD_EXPORT_RESTRICTION);
         case SSL_AD_PROTOCOL_VERSION:   return(TLS1_AD_PROTOCOL_VERSION);
         case SSL_AD_INSUFFICIENT_SECURITY:return(TLS1_AD_INSUFFICIENT_SECURITY);
         case SSL_AD_INTERNAL_ERROR:     return(TLS1_AD_INTERNAL_ERROR);
-        case SSL_AD_USER_CANCLED:       return(TLS1_AD_USER_CANCLED);
+        case SSL_AD_USER_CANCELLED:     return(TLS1_AD_USER_CANCELLED);
         case SSL_AD_NO_RENEGOTIATION:   return(TLS1_AD_NO_RENEGOTIATION);
         default:                        return(-1);
                 }
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index ddf5c15799..ca6c03d5af 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -60,13 +60,9 @@
 #include <openssl/objects.h>
 #include "ssl_locl.h"
 
-char *tls1_version_str="TLSv1" OPENSSL_VERSION_PTEXT;
+const char *tls1_version_str="TLSv1" OPENSSL_VERSION_PTEXT;
 
-#ifndef NO_PROTO
 static long tls1_default_timeout(void);
-#else
-static long tls1_default_timeout();
-#endif
 
 static SSL3_ENC_METHOD TLSv1_enc_data={
         tls1_enc,
@@ -105,6 +101,9 @@ static SSL_METHOD TLSv1_data= {
         ssl_bad_method,
         tls1_default_timeout,
         &TLSv1_enc_data,
+        ssl_undefined_function,
+        ssl3_callback_ctrl,
+        ssl3_ctx_callback_ctrl,
         };
 
 static long tls1_default_timeout(void)
@@ -142,4 +141,9 @@ long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
         {
         return(0);
         }
+
+long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
+        {
+        return(0);
+        }
 #endif
diff --git a/src/lib/libssl/test/Makefile.ssl b/src/lib/libssl/test/Makefile.ssl
index ea86520128..dbb523bf15 100644
--- a/src/lib/libssl/test/Makefile.ssl
+++ b/src/lib/libssl/test/Makefile.ssl
@@ -13,6 +13,7 @@ INSTALLTOP=	/usr/local/ssl
 MAKEFILE=       Makefile.ssl
 MAKE=           make -f $(MAKEFILE)
 MAKEDEPEND=     $(TOP)/util/domd $(TOP)
+PERL=           perl
 
 PEX_LIBS=
 EX_LIBS= #-lnsl -lsocket
@@ -50,7 +51,7 @@ DHTEST=		dhtest
 DSATEST=        dsatest
 METHTEST=       methtest
 SSLTEST=        ssltest
-RSATEST=        rsa_oaep_test
+RSATEST=        rsa_test
 
 EXE=    $(BNTEST) $(IDEATEST) $(MD2TEST)  $(MD5TEST) $(HMACTEST) \
         $(RC2TEST) $(RC4TEST) $(RC5TEST) \
@@ -98,9 +99,9 @@ tags:
 
 tests:  exe apps \
         test_des test_idea test_sha test_md5 test_hmac test_md2 test_mdc2 \
-        test_rc2 test_rc4 test_rc5 test_bf test_cast \
+        test_rmd test_rc2 test_rc4 test_rc5 test_bf test_cast \
         test_rand test_bn test_enc test_x509 test_rsa test_crl test_sid \
-        test_reqgen test_req test_pkcs7 test_verify test_dh test_dsa \
+        test_gen test_req test_pkcs7 test_verify test_dh test_dsa \
         test_ss test_ssl test_ca
 
 apps:
@@ -180,9 +181,10 @@ test_pkcs7:
 
 test_bn:
         @echo starting big number library test, could take a while...
-        @(./$(BNTEST)|bc) | awk '{ \
-if ($$0 != "0") {print "error"; exit(1); } \
-if (((NR+1)%64) == 0) print NR+1," tests done"; }'
+        @./$(BNTEST) >tmp.bntest
+        @echo quit >>tmp.bntest
+        @echo "running bc"
+        @bc tmp.bntest 2>&1 | $(PERL) -e 'while (<STDIN>) {if (/^test (.*)/) {print STDERR "\nverify $$1";} elsif (!/^0$$/) {die "\nFailed! bc: $$_";} print STDERR "."; $$i++;} print STDERR "\n$$i tests passed\n"'
         @echo 'test a^b%c implementations'
         ./$(EXPTEST)
 
@@ -192,14 +194,15 @@ test_verify:
         ../apps/openssl verify -CApath ../certs ../certs/*.pem
 
 test_dh:
-        @echo "Generate as set of DH parameters"
+        @echo "Generate a set of DH parameters"
         ./$(DHTEST)
 
 test_dsa:
-        @echo "Generate as set of DSA parameters"
+        @echo "Generate a set of DSA parameters"
         ./$(DSATEST)
+        ./$(DSATEST) -app2_1
 
-test_reqgen:
+test_gen:
         @echo "Generate and verify a certificate request"
         @sh ./testgen
 
@@ -226,7 +229,7 @@ dclean:
         mv -f Makefile.new $(MAKEFILE)
 
 clean:
-        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff $(EXE) *.ss log
+        rm -f .rnd tmp.bntest *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff $(EXE) *.ss log
 
 $(DLIBSSL):
         (cd ../ssl; $(MAKE))
@@ -325,16 +328,19 @@ destest.o: ../include/openssl/opensslconf.h
 dhtest.o: ../include/openssl/bio.h ../include/openssl/bn.h
 dhtest.o: ../include/openssl/crypto.h ../include/openssl/dh.h
 dhtest.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+dhtest.o: ../include/openssl/rand.h ../include/openssl/safestack.h
 dhtest.o: ../include/openssl/stack.h
 dsatest.o: ../include/openssl/bio.h ../include/openssl/bn.h
 dsatest.o: ../include/openssl/crypto.h ../include/openssl/dh.h
 dsatest.o: ../include/openssl/dsa.h ../include/openssl/err.h
 dsatest.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-dsatest.o: ../include/openssl/rand.h ../include/openssl/stack.h
+dsatest.o: ../include/openssl/rand.h ../include/openssl/safestack.h
+dsatest.o: ../include/openssl/stack.h
 exptest.o: ../include/openssl/bio.h ../include/openssl/bn.h
 exptest.o: ../include/openssl/crypto.h ../include/openssl/err.h
 exptest.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-exptest.o: ../include/openssl/rand.h ../include/openssl/stack.h
+exptest.o: ../include/openssl/rand.h ../include/openssl/safestack.h
+exptest.o: ../include/openssl/stack.h
 hmactest.o: ../include/openssl/asn1.h ../include/openssl/bio.h
 hmactest.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
 hmactest.o: ../include/openssl/cast.h ../include/openssl/crypto.h
@@ -359,11 +365,12 @@ rc2test.o: ../include/openssl/opensslconf.h ../include/openssl/rc2.h
 rc4test.o: ../include/openssl/opensslconf.h ../include/openssl/rc4.h
 rc5test.o: ../include/openssl/rc5.h
 rmdtest.o: ../include/openssl/ripemd.h
-rsa_oaep_test.o: ../include/openssl/bn.h ../include/openssl/crypto.h
-rsa_oaep_test.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
-rsa_oaep_test.o: ../include/openssl/err.h ../include/openssl/opensslconf.h
-rsa_oaep_test.o: ../include/openssl/opensslv.h ../include/openssl/rsa.h
-rsa_oaep_test.o: ../include/openssl/stack.h
+rsa_test.o: ../include/openssl/bn.h ../include/openssl/crypto.h
+rsa_test.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+rsa_test.o: ../include/openssl/err.h ../include/openssl/opensslconf.h
+rsa_test.o: ../include/openssl/opensslv.h ../include/openssl/rand.h
+rsa_test.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+rsa_test.o: ../include/openssl/stack.h
 sha1test.o: ../include/openssl/sha.h
 shatest.o: ../include/openssl/sha.h
 ssltest.o: ../include/openssl/asn1.h ../include/openssl/bio.h
@@ -378,11 +385,12 @@ ssltest.o: ../include/openssl/md2.h ../include/openssl/md5.h
 ssltest.o: ../include/openssl/mdc2.h ../include/openssl/objects.h
 ssltest.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 ssltest.o: ../include/openssl/pem.h ../include/openssl/pem2.h
-ssltest.o: ../include/openssl/pkcs7.h ../include/openssl/rc2.h
-ssltest.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
-ssltest.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
-ssltest.o: ../include/openssl/safestack.h ../include/openssl/sha.h
-ssltest.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
-ssltest.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
-ssltest.o: ../include/openssl/stack.h ../include/openssl/tls1.h
-ssltest.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+ssltest.o: ../include/openssl/pkcs7.h ../include/openssl/rand.h
+ssltest.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+ssltest.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+ssltest.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+ssltest.o: ../include/openssl/sha.h ../include/openssl/ssl.h
+ssltest.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
+ssltest.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
+ssltest.o: ../include/openssl/tls1.h ../include/openssl/x509.h
+ssltest.o: ../include/openssl/x509_vfy.h
diff --git a/src/lib/libssl/test/dsa-ca.pem b/src/lib/libssl/test/dsa-ca.pem
index 9eb08f3ddd..e69de29bb2 100644
--- a/src/lib/libssl/test/dsa-ca.pem
+++ b/src/lib/libssl/test/dsa-ca.pem
@@ -1,43 +0,0 @@
------BEGIN DSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,C5B6C7CC9E1FE2C0
-
-svCXBcBRhMuU22UXOfiKZA+thmz6KYXpt1Yg5Rd+TYQcQ1MdvNy0B0tkP1SxzDq0
-Xh1eMeTML9/9/0rKakgNXXXbpi5RB8t6BmwRSyej89F7nn1mtR3qzoyPRpp15SDl
-Tn67C+2v+HDF3MFk88hiNCYkNbcmi7TWvChsl8N1r7wdZwtIox56yXdgxw6ZIpa/
-par0oUCzN7fiavPgCWz1kfPNSaBQSdxwH7TZi5tMHAr0J3C7a7QRnZfE09R59Uqr
-zslrq+ndIw1BZAxoY0SlBu+iFOVaBVlwToC4AsHkv7j7l8ITtr7f42YbBa44D9TO
-uOhONmkk/v3Fso4RaOEzdKZC+hnmmzvHs6TiTWm6yzJgSFwyOUK0eGmKEeVxpcH5
-rUOlHOwzen+FFtocZDZAfdFnb7QY7L/boQvyA5A+ZbRG4DUpmBQeQsSaICHM5Rxx
-1QaLF413VNPXTLPbW0ilSc2H8x2iZTIVKfd33oSO6NhXPtSYQgfecEF4BvNHY5c4
-HovjT4mckbK95bcBzoCHu43vuSQkmZzdYo/ydSZt6zoPavbBLueTpgSbdXiDi827
-MVqOsYxGCb+kez0FoDSTgw==
------END DSA PRIVATE KEY-----
------BEGIN CERTIFICATE REQUEST-----
-MIICUjCCAhECAQAwUjELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUx
-ITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAxMCQ0Ew
-ggG0MIIBKQYFKw4DAgwwggEeAoGBAKc/boW/QWopffCfRxkwkJoJHdpqMx7FPYaW
-sxXgUy6P4FmCc5A+dTGZR3pS+4Xk2aZ7OJtoioSbh8YetX6GS1NbWc9xZRmIbs5m
-rmuINvvsKNzC16W75Sw5JkvamnAYlTeVEFYj9hXtugRe3jlP/bdDH7WkZW/NgBHk
-cJVbUM1JAhUA9wcx7fpsBgPVhYocrJxl51BmZW8CgYBN30wDppGK9RlvUEYlmeVo
-bzDjaeHls12YuyiGSPzemQQ/X4gMnHMkDSBduSqaPxiWJ+Rih8F7dGJT/GEnqHqR
-CZ228U2cVA9YBu5JdAfOVX4jzhb2ytxaYQF+yXG1TfbcNCmHaPZeIJOz2/XkCWxB
-F5WS6wG1c6Vqftgy7Q4CuAOBhAACgYAapll6iqz9XrZFlk2GCVcB+KihxWnH7IuH
-vSLw9YUrJahcBHmbpvt494lF4gC5w3WPM+vXJofbusk4GoQEEsQNMDaah4m49uUq
-AylOVFJJJXuirVJ+o+0TtOFDITEAl+YZZariXOD7tdOSOl9RLMPC6+daHKS9e68u
-3enxhqnDGaAAMAkGBSsOAwIbBQADMAAwLQIVAJGVuFsG/0DBuSZ0jF7ypdU0/G0v
-AhQfeF5BoMMDbX/kidUVpQ6gadPlZA==
------END CERTIFICATE REQUEST-----
------BEGIN CERTIFICATE-----
-MIIBrjCCAWwCAQswCQYFKw4DAhsFADBTMQswCQYDVQQGEwJBVTETMBEGA1UECBMK
-U29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQww
-CgYDVQQDEwNQQ0EwHhcNOTcwNjE1MDIxNDI5WhcNOTcwNzE1MDIxNDI5WjBSMQsw
-CQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJu
-ZXQgV2lkZ2l0cyBQdHkgTHRkMQswCQYDVQQDEwJDQTCBkjAJBgUrDgMCDAUAA4GE
-AAKBgBqmWXqKrP1etkWWTYYJVwH4qKHFacfsi4e9IvD1hSslqFwEeZum+3j3iUXi
-ALnDdY8z69cmh9u6yTgahAQSxA0wNpqHibj25SoDKU5UUkkle6KtUn6j7RO04UMh
-MQCX5hllquJc4Pu105I6X1Esw8Lr51ocpL17ry7d6fGGqcMZMAkGBSsOAwIbBQAD
-MQAwLgIVAJ4wtQsANPxHo7Q4IQZYsL12SKdbAhUAjJ9n38zxT+iai2164xS+LIfa
-C1Q=
------END CERTIFICATE-----
-
diff --git a/src/lib/libssl/test/dsa-pca.pem b/src/lib/libssl/test/dsa-pca.pem
index e3641ad47e..e69de29bb2 100644
--- a/src/lib/libssl/test/dsa-pca.pem
+++ b/src/lib/libssl/test/dsa-pca.pem
@@ -1,49 +0,0 @@
------BEGIN DSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,F80EEEBEEA7386C4
-
-GZ9zgFcHOlnhPoiSbVi/yXc9mGoj44A6IveD4UlpSEUt6Xbse3Fr0KHIUyQ3oGnS
-mClKoAp/eOTb5Frhto85SzdsxYtac+X1v5XwdzAMy2KowHVk1N8A5jmE2OlkNPNt
-of132MNlo2cyIRYaa35PPYBGNCmUm7YcYS8O90YtkrQZZTf4+2C4kllhMcdkQwkr
-FWSWC8YOQ7w0LHb4cX1FejHHom9Nd/0PN3vn3UyySvfOqoR7nbXkrpHXmPIr0hxX
-RcF0aXcV/CzZ1/nfXWQf4o3+oD0T22SDoVcZY60IzI0oIc3pNCbDV3uKNmgekrFd
-qOUJ+QW8oWp7oefRx62iBfIeC8DZunohMXaWAQCU0sLQOR4yEdeUCnzCSywe0bG1
-diD0KYaEe+Yub1BQH4aLsBgDjardgpJRTQLq0DUvw0/QGO1irKTJzegEDNVBKrVn
-V4AHOKT1CUKqvGNRP1UnccUDTF6miOAtaj/qpzra7sSk7dkGBvIEeFoAg84kfh9h
-hVvF1YyzC9bwZepruoqoUwke/WdNIR5ymOVZ/4Liw0JdIOcq+atbdRX08niqIRkf
-dsZrUj4leo3zdefYUQ7w4N2Ns37yDFq7
------END DSA PRIVATE KEY-----
------BEGIN CERTIFICATE REQUEST-----
-MIICVTCCAhMCAQAwUzELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUx
-ITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEMMAoGA1UEAxMDUENB
-MIIBtTCCASkGBSsOAwIMMIIBHgKBgQCnP26Fv0FqKX3wn0cZMJCaCR3aajMexT2G
-lrMV4FMuj+BZgnOQPnUxmUd6UvuF5NmmezibaIqEm4fGHrV+hktTW1nPcWUZiG7O
-Zq5riDb77Cjcwtelu+UsOSZL2ppwGJU3lRBWI/YV7boEXt45T/23Qx+1pGVvzYAR
-5HCVW1DNSQIVAPcHMe36bAYD1YWKHKycZedQZmVvAoGATd9MA6aRivUZb1BGJZnl
-aG8w42nh5bNdmLsohkj83pkEP1+IDJxzJA0gXbkqmj8YlifkYofBe3RiU/xhJ6h6
-kQmdtvFNnFQPWAbuSXQHzlV+I84W9srcWmEBfslxtU323DQph2j2XiCTs9v15Als
-QReVkusBtXOlan7YMu0OArgDgYUAAoGBAKbtuR5AdW+ICjCFe2ixjUiJJzM2IKwe
-6NZEMXg39+HQ1UTPTmfLZLps+rZfolHDXuRKMXbGFdSF0nXYzotPCzi7GauwEJTZ
-yr27ZZjA1C6apGSQ9GzuwNvZ4rCXystVEagAS8OQ4H3D4dWS17Zg31ICb5o4E5r0
-z09o/Uz46u0VoAAwCQYFKw4DAhsFAAMxADAuAhUArRubTxsbIXy3AhtjQ943AbNB
-nSICFQCu+g1iW3jwF+gOcbroD4S/ZcvB3w==
------END CERTIFICATE REQUEST-----
------BEGIN CERTIFICATE-----
-MIIC0zCCApECAQAwCQYFKw4DAhsFADBTMQswCQYDVQQGEwJBVTETMBEGA1UECBMK
-U29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQww
-CgYDVQQDEwNQQ0EwHhcNOTcwNjE0MjI1NDQ1WhcNOTcwNzE0MjI1NDQ1WjBTMQsw
-CQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJu
-ZXQgV2lkZ2l0cyBQdHkgTHRkMQwwCgYDVQQDEwNQQ0EwggG1MIIBKQYFKw4DAgww
-ggEeAoGBAKc/boW/QWopffCfRxkwkJoJHdpqMx7FPYaWsxXgUy6P4FmCc5A+dTGZ
-R3pS+4Xk2aZ7OJtoioSbh8YetX6GS1NbWc9xZRmIbs5mrmuINvvsKNzC16W75Sw5
-JkvamnAYlTeVEFYj9hXtugRe3jlP/bdDH7WkZW/NgBHkcJVbUM1JAhUA9wcx7fps
-BgPVhYocrJxl51BmZW8CgYBN30wDppGK9RlvUEYlmeVobzDjaeHls12YuyiGSPze
-mQQ/X4gMnHMkDSBduSqaPxiWJ+Rih8F7dGJT/GEnqHqRCZ228U2cVA9YBu5JdAfO
-VX4jzhb2ytxaYQF+yXG1TfbcNCmHaPZeIJOz2/XkCWxBF5WS6wG1c6Vqftgy7Q4C
-uAOBhQACgYEApu25HkB1b4gKMIV7aLGNSIknMzYgrB7o1kQxeDf34dDVRM9OZ8tk
-umz6tl+iUcNe5EoxdsYV1IXSddjOi08LOLsZq7AQlNnKvbtlmMDULpqkZJD0bO7A
-29nisJfKy1URqABLw5DgfcPh1ZLXtmDfUgJvmjgTmvTPT2j9TPjq7RUwCQYFKw4D
-AhsFAAMxADAuAhUAvtv6AkMolix1Jvy3UnVEIUqdCUICFQC+jq8P49mwrY9oJ24n
-5rKUjNBhSg==
------END CERTIFICATE-----
-
diff --git a/src/lib/libssl/test/maketests.com b/src/lib/libssl/test/maketests.com
index e4b052e688..1246d9a077 100644
--- a/src/lib/libssl/test/maketests.com
+++ b/src/lib/libssl/test/maketests.com
@@ -147,7 +147,7 @@ $ TEST_FILES = "BNTEST,IDEATEST,MD2TEST,MD5TEST,HMACTEST,"+ -
                "RC2TEST,RC4TEST,RC5TEST,"+ -
                "DESTEST,SHATEST,SHA1TEST,MDC2TEST,RMDTEST,"+ -
                "RANDTEST,DHTEST,"+ -
-               "BFTEST,CASTTEST,SSLTEST,EXPTEST,DSATEST,RSA_OAEP_TEST"
+               "BFTEST,CASTTEST,SSLTEST,EXPTEST,DSATEST,RSA_TEST"
 $ TCPIP_PROGRAMS = ",,"
 $ IF COMPILER .EQS. "VAXC" THEN -
      TCPIP_PROGRAMS = ",SSLTEST,"
@@ -730,12 +730,36 @@ $!
 $! Set Up Initial CC Definitions, Possibly With User Ones
 $!
 $ CCDEFS = "VMS=1,TCPIP_TYPE_''P4'"
+$ IF F$TRNLNM("OPENSSL_NO_ASM") THEN CCDEFS = CCDEFS + ",NO_ASM"
+$ IF F$TRNLNM("OPENSSL_NO_RSA") THEN CCDEFS = CCDEFS + ",NO_RSA"
+$ IF F$TRNLNM("OPENSSL_NO_DSA") THEN CCDEFS = CCDEFS + ",NO_DSA"
+$ IF F$TRNLNM("OPENSSL_NO_DH") THEN CCDEFS = CCDEFS + ",NO_DH"
+$ IF F$TRNLNM("OPENSSL_NO_MD2") THEN CCDEFS = CCDEFS + ",NO_MD2"
+$ IF F$TRNLNM("OPENSSL_NO_MD5") THEN CCDEFS = CCDEFS + ",NO_MD5"
+$ IF F$TRNLNM("OPENSSL_NO_RIPEMD") THEN CCDEFS = CCDEFS + ",NO_RIPEMD"
+$ IF F$TRNLNM("OPENSSL_NO_SHA") THEN CCDEFS = CCDEFS + ",NO_SHA"
+$ IF F$TRNLNM("OPENSSL_NO_SHA0") THEN CCDEFS = CCDEFS + ",NO_SHA0"
+$ IF F$TRNLNM("OPENSSL_NO_SHA1") THEN CCDEFS = CCDEFS + ",NO_SHA1"
+$ IF F$TRNLNM("OPENSSL_NO_DES")
+$ THEN
+$   CCDEFS = CCDEFS + ",NO_DES,NO_MDC2"
+$ ELSE
+$   IF F$TRNLNM("OPENSSL_NO_MDC2") THEN CCDEFS = CCDEFS + ",NO_MDC2"
+$ ENDIF
+$ IF F$TRNLNM("OPENSSL_NO_RC2") THEN CCDEFS = CCDEFS + ",NO_RC2"
+$ IF F$TRNLNM("OPENSSL_NO_RC4") THEN CCDEFS = CCDEFS + ",NO_RC4"
+$ IF F$TRNLNM("OPENSSL_NO_RC5") THEN CCDEFS = CCDEFS + ",NO_RC5"
+$ IF F$TRNLNM("OPENSSL_NO_IDEA") THEN CCDEFS = CCDEFS + ",NO_IDEA"
+$ IF F$TRNLNM("OPENSSL_NO_BF") THEN CCDEFS = CCDEFS + ",NO_BF"
+$ IF F$TRNLNM("OPENSSL_NO_CAST") THEN CCDEFS = CCDEFS + ",NO_CAST"
+$ IF F$TRNLNM("OPENSSL_NO_HMAC") THEN CCDEFS = CCDEFS + ",NO_HMAC"
+$ IF F$TRNLNM("OPENSSL_NO_SSL2") THEN CCDEFS = CCDEFS + ",NO_SSL2"
 $ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS
 $ CCEXTRAFLAGS = ""
 $ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS
-$ CCDISABLEWARNINGS = ""
+$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"
 $ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -
-        CCDISABLEWARNINGS = USER_CCDISABLEWARNINGS
+        CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS
 $!
 $!  Check To See If The User Entered A Valid Paramter.
 $!
diff --git a/src/lib/libssl/test/rsa_test.c b/src/lib/libssl/test/rsa_test.c
new file mode 100644
index 0000000000..e5ae0c1f69
--- /dev/null
+++ b/src/lib/libssl/test/rsa_test.c
@@ -0,0 +1,314 @@
+/* test vectors from p1ovect1.txt */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "openssl/e_os.h"
+
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+#ifdef NO_RSA
+int main(int argc, char *argv[])
+{
+    printf("No RSA support\n");
+    return(0);
+}
+#else
+#include <openssl/rsa.h>
+
+#define SetKey \
+  key->n = BN_bin2bn(n, sizeof(n)-1, key->n); \
+  key->e = BN_bin2bn(e, sizeof(e)-1, key->e); \
+  key->d = BN_bin2bn(d, sizeof(d)-1, key->d); \
+  key->p = BN_bin2bn(p, sizeof(p)-1, key->p); \
+  key->q = BN_bin2bn(q, sizeof(q)-1, key->q); \
+  key->dmp1 = BN_bin2bn(dmp1, sizeof(dmp1)-1, key->dmp1); \
+  key->dmq1 = BN_bin2bn(dmq1, sizeof(dmq1)-1, key->dmq1); \
+  key->iqmp = BN_bin2bn(iqmp, sizeof(iqmp)-1, key->iqmp); \
+  memcpy(c, ctext_ex, sizeof(ctext_ex) - 1); \
+  return (sizeof(ctext_ex) - 1);
+
+static int key1(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F"
+"\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5"
+"\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93"
+"\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1"
+"\xF5";
+
+    static unsigned char e[] = "\x11";
+
+    static unsigned char d[] =
+"\x0A\x03\x37\x48\x62\x64\x87\x69\x5F\x5F\x30\xBC\x38\xB9\x8B\x44"
+"\xC2\xCD\x2D\xFF\x43\x40\x98\xCD\x20\xD8\xA1\x38\xD0\x90\xBF\x64"
+"\x79\x7C\x3F\xA7\xA2\xCD\xCB\x3C\xD1\xE0\xBD\xBA\x26\x54\xB4\xF9"
+"\xDF\x8E\x8A\xE5\x9D\x73\x3D\x9F\x33\xB3\x01\x62\x4A\xFD\x1D\x51";
+
+    static unsigned char p[] =
+"\x00\xD8\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
+"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x12"
+"\x0D";
+    
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
+"\x89";
+
+    static unsigned char dmp1[] =
+"\x59\x0B\x95\x72\xA2\xC2\xA9\xC4\x06\x05\x9D\xC2\xAB\x2F\x1D\xAF"
+"\xEB\x7E\x8B\x4F\x10\xA7\x54\x9E\x8E\xED\xF5\xB4\xFC\xE0\x9E\x05";
+
+    static unsigned char dmq1[] =
+"\x00\x8E\x3C\x05\x21\xFE\x15\xE0\xEA\x06\xA3\x6F\xF0\xF1\x0C\x99"
+"\x52\xC3\x5B\x7A\x75\x14\xFD\x32\x38\xB8\x0A\xAD\x52\x98\x62\x8D"
+"\x51";
+
+    static unsigned char iqmp[] =
+"\x36\x3F\xF7\x18\x9D\xA8\xE9\x0B\x1D\x34\x1F\x71\xD0\x9B\x76\xA8"
+"\xA9\x43\xE1\x1D\x10\xB2\x4D\x24\x9F\x2D\xEA\xFE\xF8\x0C\x18\x26";
+
+    static unsigned char ctext_ex[] =
+"\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89"
+"\x2b\xfb\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52"
+"\x33\x89\x5c\x74\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44"
+"\xb0\x05\xc3\x9e\xd8\x27\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";
+
+    SetKey;
+    }
+
+static int key2(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xA3\x07\x9A\x90\xDF\x0D\xFD\x72\xAC\x09\x0C\xCC\x2A\x78\xB8"
+"\x74\x13\x13\x3E\x40\x75\x9C\x98\xFA\xF8\x20\x4F\x35\x8A\x0B\x26"
+"\x3C\x67\x70\xE7\x83\xA9\x3B\x69\x71\xB7\x37\x79\xD2\x71\x7B\xE8"
+"\x34\x77\xCF";
+
+    static unsigned char e[] = "\x3";
+
+    static unsigned char d[] =
+"\x6C\xAF\xBC\x60\x94\xB3\xFE\x4C\x72\xB0\xB3\x32\xC6\xFB\x25\xA2"
+"\xB7\x62\x29\x80\x4E\x68\x65\xFC\xA4\x5A\x74\xDF\x0F\x8F\xB8\x41"
+"\x3B\x52\xC0\xD0\xE5\x3D\x9B\x59\x0F\xF1\x9B\xE7\x9F\x49\xDD\x21"
+"\xE5\xEB";
+
+    static unsigned char p[] =
+"\x00\xCF\x20\x35\x02\x8B\x9D\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92"
+"\xEA\x0D\xA3\xB4\x32\x04\xB5\xCF\xCE\x91";
+
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5F";
+    
+    static unsigned char dmp1[] =
+"\x00\x8A\x15\x78\xAC\x5D\x13\xAF\x10\x2B\x22\xB9\x99\xCD\x74\x61"
+"\xF1\x5E\x6D\x22\xCC\x03\x23\xDF\xDF\x0B";
+
+    static unsigned char dmq1[] =
+"\x00\x86\x55\x21\x4A\xC5\x4D\x8D\x4E\xCD\x61\x77\xF1\xC7\x36\x90"
+"\xCE\x2A\x48\x2C\x8B\x05\x99\xCB\xE0\x3F";
+
+    static unsigned char iqmp[] =
+"\x00\x83\xEF\xEF\xB8\xA9\xA4\x0D\x1D\xB6\xED\x98\xAD\x84\xED\x13"
+"\x35\xDC\xC1\x08\xF3\x22\xD0\x57\xCF\x8D";
+
+    static unsigned char ctext_ex[] =
+"\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a"
+"\x8b\x40\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4"
+"\x17\x53\x03\x29\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52"
+"\x62\x51";
+
+    SetKey;
+    }
+
+static int key3(RSA *key, unsigned char *c)
+    {
+    static unsigned char n[] =
+"\x00\xBB\xF8\x2F\x09\x06\x82\xCE\x9C\x23\x38\xAC\x2B\x9D\xA8\x71"
+"\xF7\x36\x8D\x07\xEE\xD4\x10\x43\xA4\x40\xD6\xB6\xF0\x74\x54\xF5"
+"\x1F\xB8\xDF\xBA\xAF\x03\x5C\x02\xAB\x61\xEA\x48\xCE\xEB\x6F\xCD"
+"\x48\x76\xED\x52\x0D\x60\xE1\xEC\x46\x19\x71\x9D\x8A\x5B\x8B\x80"
+"\x7F\xAF\xB8\xE0\xA3\xDF\xC7\x37\x72\x3E\xE6\xB4\xB7\xD9\x3A\x25"
+"\x84\xEE\x6A\x64\x9D\x06\x09\x53\x74\x88\x34\xB2\x45\x45\x98\x39"
+"\x4E\xE0\xAA\xB1\x2D\x7B\x61\xA5\x1F\x52\x7A\x9A\x41\xF6\xC1\x68"
+"\x7F\xE2\x53\x72\x98\xCA\x2A\x8F\x59\x46\xF8\xE5\xFD\x09\x1D\xBD"
+"\xCB";
+
+    static unsigned char e[] = "\x11";
+
+    static unsigned char d[] =
+"\x00\xA5\xDA\xFC\x53\x41\xFA\xF2\x89\xC4\xB9\x88\xDB\x30\xC1\xCD"
+"\xF8\x3F\x31\x25\x1E\x06\x68\xB4\x27\x84\x81\x38\x01\x57\x96\x41"
+"\xB2\x94\x10\xB3\xC7\x99\x8D\x6B\xC4\x65\x74\x5E\x5C\x39\x26\x69"
+"\xD6\x87\x0D\xA2\xC0\x82\xA9\x39\xE3\x7F\xDC\xB8\x2E\xC9\x3E\xDA"
+"\xC9\x7F\xF3\xAD\x59\x50\xAC\xCF\xBC\x11\x1C\x76\xF1\xA9\x52\x94"
+"\x44\xE5\x6A\xAF\x68\xC5\x6C\x09\x2C\xD3\x8D\xC3\xBE\xF5\xD2\x0A"
+"\x93\x99\x26\xED\x4F\x74\xA1\x3E\xDD\xFB\xE1\xA1\xCE\xCC\x48\x94"
+"\xAF\x94\x28\xC2\xB7\xB8\x88\x3F\xE4\x46\x3A\x4B\xC8\x5B\x1C\xB3"
+"\xC1";
+
+    static unsigned char p[] =
+"\x00\xEE\xCF\xAE\x81\xB1\xB9\xB3\xC9\x08\x81\x0B\x10\xA1\xB5\x60"
+"\x01\x99\xEB\x9F\x44\xAE\xF4\xFD\xA4\x93\xB8\x1A\x9E\x3D\x84\xF6"
+"\x32\x12\x4E\xF0\x23\x6E\x5D\x1E\x3B\x7E\x28\xFA\xE7\xAA\x04\x0A"
+"\x2D\x5B\x25\x21\x76\x45\x9D\x1F\x39\x75\x41\xBA\x2A\x58\xFB\x65"
+"\x99";
+
+    static unsigned char q[] =
+"\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
+"\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
+"\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
+"\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x15"
+"\x03";
+
+    static unsigned char dmp1[] =
+"\x54\x49\x4C\xA6\x3E\xBA\x03\x37\xE4\xE2\x40\x23\xFC\xD6\x9A\x5A"
+"\xEB\x07\xDD\xDC\x01\x83\xA4\xD0\xAC\x9B\x54\xB0\x51\xF2\xB1\x3E"
+"\xD9\x49\x09\x75\xEA\xB7\x74\x14\xFF\x59\xC1\xF7\x69\x2E\x9A\x2E"
+"\x20\x2B\x38\xFC\x91\x0A\x47\x41\x74\xAD\xC9\x3C\x1F\x67\xC9\x81";
+
+    static unsigned char dmq1[] =
+"\x47\x1E\x02\x90\xFF\x0A\xF0\x75\x03\x51\xB7\xF8\x78\x86\x4C\xA9"
+"\x61\xAD\xBD\x3A\x8A\x7E\x99\x1C\x5C\x05\x56\xA9\x4C\x31\x46\xA7"
+"\xF9\x80\x3F\x8F\x6F\x8A\xE3\x42\xE9\x31\xFD\x8A\xE4\x7A\x22\x0D"
+"\x1B\x99\xA4\x95\x84\x98\x07\xFE\x39\xF9\x24\x5A\x98\x36\xDA\x3D";
+    
+    static unsigned char iqmp[] =
+"\x00\xB0\x6C\x4F\xDA\xBB\x63\x01\x19\x8D\x26\x5B\xDB\xAE\x94\x23"
+"\xB3\x80\xF2\x71\xF7\x34\x53\x88\x50\x93\x07\x7F\xCD\x39\xE2\x11"
+"\x9F\xC9\x86\x32\x15\x4F\x58\x83\xB1\x67\xA9\x67\xBF\x40\x2B\x4E"
+"\x9E\x2E\x0F\x96\x56\xE6\x98\xEA\x36\x66\xED\xFB\x25\x79\x80\x39"
+"\xF7";
+
+    static unsigned char ctext_ex[] =
+"\xb8\x24\x6b\x56\xa6\xed\x58\x81\xae\xb5\x85\xd9\xa2\x5b\x2a\xd7"
+"\x90\xc4\x17\xe0\x80\x68\x1b\xf1\xac\x2b\xc3\xde\xb6\x9d\x8b\xce"
+"\xf0\xc4\x36\x6f\xec\x40\x0a\xf0\x52\xa7\x2e\x9b\x0e\xff\xb5\xb3"
+"\xf2\xf1\x92\xdb\xea\xca\x03\xc1\x27\x40\x05\x71\x13\xbf\x1f\x06"
+"\x69\xac\x22\xe9\xf3\xa7\x85\x2e\x3c\x15\xd9\x13\xca\xb0\xb8\x86"
+"\x3a\x95\xc9\x92\x94\xce\x86\x74\x21\x49\x54\x61\x03\x46\xf4\xd4"
+"\x74\xb2\x6f\x7c\x48\xb4\x2e\xe6\x8e\x1f\x57\x2a\x1f\xc4\x02\x6a"
+"\xc4\x56\xb4\xf5\x9f\x7b\x62\x1e\xa1\xb9\xd8\x8f\x64\x20\x2f\xb1";
+
+    SetKey;
+    }
+
+static int pad_unknown(void)
+{
+    unsigned long l;
+    while ((l = ERR_get_error()) != 0)
+      if (ERR_GET_REASON(l) == RSA_R_UNKNOWN_PADDING_TYPE)
+        return(1);
+    return(0);
+}
+
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
+int main(int argc, char *argv[])
+    {
+    int err=0;
+    int v;
+    RSA *key;
+    unsigned char ptext[256];
+    unsigned char ctext[256];
+    static unsigned char ptext_ex[] = "\x54\x85\x9b\x34\x2c\x49\xea\x2a";
+    unsigned char ctext_ex[256];
+    int plen;
+    int clen = 0;
+    int num;
+
+    RAND_seed(rnd_seed, sizeof rnd_seed); /* or OAEP may fail */
+
+    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+        
+    plen = sizeof(ptext_ex) - 1;
+
+    for (v = 0; v < 3; v++)
+        {
+        key = RSA_new();
+        switch (v) {
+    case 0:
+        clen = key1(key, ctext_ex);
+        break;
+    case 1:
+        clen = key2(key, ctext_ex);
+        break;
+    case 2:
+        clen = key3(key, ctext_ex);
+        break;
+        }
+
+        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
+                                 RSA_PKCS1_PADDING);
+        if (num != clen)
+            {
+            printf("PKCS#1 v1.5 encryption failed!\n");
+            err=1;
+            goto oaep;
+            }
+  
+        num = RSA_private_decrypt(num, ctext, ptext, key,
+                                  RSA_PKCS1_PADDING);
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("PKCS#1 v1.5 decryption failed!\n");
+            err=1;
+            }
+        else
+            printf("PKCS #1 v1.5 encryption/decryption ok\n");
+
+    oaep:
+        ERR_clear_error();
+        num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
+                                 RSA_PKCS1_OAEP_PADDING);
+        if (num == -1 && pad_unknown())
+            {
+            printf("No OAEP support\n");
+            goto next;
+            }
+        if (num != clen)
+            {
+            printf("OAEP encryption failed!\n");
+            err=1;
+            goto next;
+            }
+  
+        num = RSA_private_decrypt(num, ctext, ptext, key,
+                                  RSA_PKCS1_OAEP_PADDING);
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("OAEP decryption (encrypted data) failed!\n");
+            err=1;
+            }
+        else if (memcmp(ctext, ctext_ex, num) == 0)
+            {
+            printf("OAEP test vector %d passed!\n", v);
+            goto next;
+            }
+    
+        /* Different ciphertexts (rsa_oaep.c without -DPKCS_TESTVECT).
+           Try decrypting ctext_ex */
+
+        num = RSA_private_decrypt(clen, ctext_ex, ptext, key,
+                                  RSA_PKCS1_OAEP_PADDING);
+
+        if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
+            {
+            printf("OAEP decryption (test vector data) failed!\n");
+            err=1;
+            }
+        else
+            printf("OAEP encryption/decryption ok\n");
+    next:
+        RSA_free(key);
+        }
+
+    ERR_remove_state(0);
+
+    CRYPTO_mem_leaks_fp(stdout);
+
+    return err;
+    }
+#endif
diff --git a/src/lib/libssl/test/tcrl.com b/src/lib/libssl/test/tcrl.com
index cef21467bb..2e6ab2814d 100644
--- a/src/lib/libssl/test/tcrl.com
+++ b/src/lib/libssl/test/tcrl.com
@@ -10,6 +10,9 @@ $	t := testcrl.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing CRL conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: fff.p ff.p2
+$!      backup/compare fff.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$!      difference/output=nl: f.t ff.t1
+$!      backup/compare f.t ff.t1
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t2
+$!      backup/compare f.t ff.t2
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t3
+$!      backup/compare f.t ff.t3
 $!      if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.p ff.p2
+$!      backup/compare f.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/test/testca.com b/src/lib/libssl/test/testca.com
index ea75479cd5..c670f2bf5f 100644
--- a/src/lib/libssl/test/testca.com
+++ b/src/lib/libssl/test/testca.com
@@ -40,7 +40,9 @@ $
 $       set noon
 $       call deltree [.demoCA]*.*
 $       set file/prot=(S:RWED,O:RWED,G:RWED,W:RWED) demoCA.dir;*
-$       delete demoCA.dir;*,newcert.pem;*,newreq.pem;*
+$       delete demoCA.dir;*
+$       if f$search("newcert.pem") .nes. "" then delete newcert.pem;*
+$       if f$search("newcert.pem") .nes. "" then delete newreq.pem;*
 $       set on
 $!      #usage: CA -newcert|-newreq|-newca|-sign|-verify
 $
diff --git a/src/lib/libssl/test/testenc.com b/src/lib/libssl/test/testenc.com
index 0756e8bada..3b66f2e0d0 100644
--- a/src/lib/libssl/test/testenc.com
+++ b/src/lib/libssl/test/testenc.com
@@ -8,19 +8,23 @@ $	testsrc := makefile.ssl
 $       test := p.txt
 $       cmd := mcr 'exe_dir'openssl
 $
+$       if f$search(test) .nes. "" then delete 'test';*
 $       copy 'testsrc' 'test'
 $
+$       if f$search(test+"-cipher") .nes. "" then delete 'test'-cipher;*
+$       if f$search(test+"-clear") .nes. "" then delete 'test'-clear;*
+$
 $       write sys$output "cat"
 $       'cmd' enc -in 'test' -out 'test'-cipher
 $       'cmd' enc -in 'test'-cipher -out 'test'-clear
-$       difference/output=nl: 'test' 'test'-clear
+$       backup/compare 'test' 'test'-clear
 $       if $severity .ne. 1 then exit 3
 $       delete 'test'-cipher;*,'test'-clear;*
 $
 $       write sys$output "base64"
 $       'cmd' enc -a -e -in 'test' -out 'test'-cipher
 $       'cmd' enc -a -d -in 'test'-cipher -out 'test'-clear
-$       difference/output=nl: 'test' 'test'-clear
+$       backup/compare 'test' 'test'-clear
 $       if $severity .ne. 1 then exit 3
 $       delete 'test'-cipher;*,'test'-clear;*
 $
@@ -30,16 +34,22 @@ $	open/read f 'test'-cipher-commands
 $ loop_cipher_commands:
 $       read/end=loop_cipher_commands_end f i
 $       write sys$output i
+$
+$       if f$search(test+"-"+i+"-cipher") .nes. "" then -
+                delete 'test'-'i'-cipher;*
+$       if f$search(test+"-"+i+"-clear") .nes. "" then -
+                delete 'test'-'i'-clear;*
+$
 $       'cmd' 'i' -bufsize 113 -e -k test -in 'test' -out 'test'-'i'-cipher
 $       'cmd' 'i' -bufsize 157 -d -k test -in 'test'-'i'-cipher -out 'test'-'i'-clear
-$       difference/output=nl: 'test' 'test'-'i'-clear
+$       backup/compare 'test' 'test'-'i'-clear
 $       if $severity .ne. 1 then exit 3
 $       delete 'test'-'i'-cipher;*,'test'-'i'-clear;*
 $
 $       write sys$output i," base64"
 $       'cmd' 'i' -bufsize 113 -a -e -k test -in 'test' -out 'test'-'i'-cipher
 $       'cmd' 'i' -bufsize 157 -a -d -k test -in 'test'-'i'-cipher -out 'test'-'i'-clear
-$       difference/output=nl: 'test' 'test'-'i'-clear
+$       backup/compare 'test' 'test'-'i'-clear
 $       if $severity .ne. 1 then exit 3
 $       delete 'test'-'i'-cipher;*,'test'-'i'-clear;*
 $
diff --git a/src/lib/libssl/test/testgen b/src/lib/libssl/test/testgen
index 3534f5821f..c5f61b582b 100644
--- a/src/lib/libssl/test/testgen
+++ b/src/lib/libssl/test/testgen
@@ -15,6 +15,8 @@ echo "There should be a 2 sequences of .'s and some +'s."
 echo "There should not be more that at most 80 per line"
 echo "This could take some time."
 
+echo "string to make the random number generator think it has entropy" >> ./.rnd
+
 ../apps/openssl req -config test.cnf -new -out testreq.pem
 if [ $? != 0 ]; then
 echo problems creating request
diff --git a/src/lib/libssl/test/testgen.com b/src/lib/libssl/test/testgen.com
index ec302f524a..0e9029371a 100644
--- a/src/lib/libssl/test/testgen.com
+++ b/src/lib/libssl/test/testgen.com
@@ -20,6 +20,11 @@ $	write sys$output "There should be a 2 sequences of .'s and some +'s."
 $       write sys$output "There should not be more that at most 80 per line"
 $       write sys$output "This could take some time."
 $
+$       append/new nl: .rnd
+$       open/append random_file .rnd
+$       write random_file "string to make the random number generator think it has entropy"
+$       close random_file
+$
 $       mcr 'exe_dir'openssl req -config test.cnf -new -out testreq.pem
 $       if $severity .ne. 1
 $       then
diff --git a/src/lib/libssl/test/tests.com b/src/lib/libssl/test/tests.com
index 147b8aa838..040dafab8d 100644
--- a/src/lib/libssl/test/tests.com
+++ b/src/lib/libssl/test/tests.com
@@ -20,9 +20,9 @@ $	    tests = p1
 $       else
 $           tests := -
         test_des,test_idea,test_sha,test_md5,test_hmac,test_md2,test_mdc2,-
-        test_rc2,test_rc4,test_rc5,test_bf,test_cast,-
+        test_rmd,test_rc2,test_rc4,test_rc5,test_bf,test_cast,-
         test_rand,test_bn,test_enc,test_x509,test_rsa,test_crl,test_sid,-
-        test_reqgen,test_req,test_pkcs7,test_verify,test_dh,test_dsa,-
+        test_gen,test_req,test_pkcs7,test_verify,test_dh,test_dsa,-
         test_ss,test_ssl,test_ca
 $       endif
 $       tests = f$edit(tests,"COLLAPSE")
@@ -48,7 +48,7 @@ $	DHTEST :=	dhtest
 $       DSATEST :=      dsatest
 $       METHTEST :=     methtest
 $       SSLTEST :=      ssltest
-$       RSATEST :=      rsa_oaep_test
+$       RSATEST :=      rsa_test
 $
 $       tests_i = 0
 $ loop_tests:
@@ -151,9 +151,7 @@ RECORD
 $       create/fdl=bntest-vms.fdl bntest-vms.sh
 $       open/append foo bntest-vms.sh
 $       type/output=foo: sys$input:
-<< __FOO__ bc | awk '{ \
-if ($$0 != "0") {print "error"; exit(1); } \
-if (((NR+1)%64) == 0) print NR+1," tests done"; }'
+<< __FOO__ bc | perl -e 'while (<STDIN>) {if (/^test (.*)/) {print STDERR "\nverify $1";} elsif (!/^0$/) {die "\nFailed! bc: $_";} print STDERR "."; $i++;} print STDERR "\n$i tests passed\n"'
 $       define/user sys$output bntest-vms.tmp
 $       mcr 'texe_dir''bntest'
 $       copy bntest-vms.tmp foo:
@@ -173,14 +171,14 @@ $	write sys$output "There are definitly a few expired certificates"
 $       @tverify.com
 $       goto loop_tests
 $ test_dh:
-$       write sys$output "Generate as set of DH parameters"
+$       write sys$output "Generate a set of DH parameters"
 $       mcr 'texe_dir''dhtest'
 $       goto loop_tests
 $ test_dsa:
-$       write sys$output "Generate as set of DSA parameters"
+$       write sys$output "Generate a set of DSA parameters"
 $       mcr 'texe_dir''dsatest'
 $       goto loop_tests
-$ test_reqgen:
+$ test_gen:
 $       write sys$output "Generate and verify a certificate request"
 $       @testgen.com
 $       goto loop_tests
diff --git a/src/lib/libssl/test/testssl b/src/lib/libssl/test/testssl
index 255ae5e976..a88e290c57 100644
--- a/src/lib/libssl/test/testssl
+++ b/src/lib/libssl/test/testssl
@@ -63,6 +63,12 @@ echo test sslv3 with both client and server authentication via BIO pair
 echo test sslv2/sslv3 via BIO pair
 ./ssltest || exit 1
 
+echo test sslv2/sslv3 w/o DHE via BIO pair
+./ssltest -bio_pair -no_dhe || exit 1
+
+echo test sslv2/sslv3 with 1024bit DHE
+./ssltest -bio_pair -dhe1024 -v || exit 1
+
 echo test sslv2/sslv3 with server authentication
 ./ssltest -bio_pair -server_auth -CApath ../certs || exit 1
 
diff --git a/src/lib/libssl/test/testssl.com b/src/lib/libssl/test/testssl.com
index 93a9aef802..0b4b0a0ad3 100644
--- a/src/lib/libssl/test/testssl.com
+++ b/src/lib/libssl/test/testssl.com
@@ -58,6 +58,10 @@ $	write sys$output "test sslv2 via BIO pair"
 $       mcr 'exe_dir'ssltest -bio_pair -ssl2 
 $       if $severity .ne. 1 then goto exit3
 $
+$       write sys$output "test sslv2/sslv3 with 1024 bit DHE via BIO pair"
+$       mcr 'exe_dir'ssltest -bio_pair -dhe1024 -v
+$       if $severity .ne. 1 then goto exit3
+$
 $       write sys$output "test sslv2 with server authentication via BIO pair"
 $       mcr 'exe_dir'ssltest -bio_pair -ssl2 -server_auth "-CAfile" certs.tmp 
 $       if $severity .ne. 1 then goto exit3
@@ -90,6 +94,10 @@ $	write sys$output "test sslv2/sslv3 via BIO pair"
 $       mcr 'exe_dir'ssltest 
 $       if $severity .ne. 1 then goto exit3
 $
+$       write sys$output "test sslv2/sslv3 w/o DHE via BIO pair"
+$       mcr 'exe_dir'ssltest -bio_pair -no_dhe
+$       if $severity .ne. 1 then goto exit3
+$
 $       write sys$output "test sslv2/sslv3 with server authentication"
 $       mcr 'exe_dir'ssltest -bio_pair -server_auth "-CAfile" certs.tmp 
 $       if $severity .ne. 1 then goto exit3
diff --git a/src/lib/libssl/test/tpkcs7.com b/src/lib/libssl/test/tpkcs7.com
index 5ed920ac34..9e345937c6 100644
--- a/src/lib/libssl/test/tpkcs7.com
+++ b/src/lib/libssl/test/tpkcs7.com
@@ -10,6 +10,9 @@ $	t := testp7.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing PKCS7 conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -34,16 +37,16 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/test/tpkcs7d.com b/src/lib/libssl/test/tpkcs7d.com
index 08d33eaa69..7d4f8794a4 100644
--- a/src/lib/libssl/test/tpkcs7d.com
+++ b/src/lib/libssl/test/tpkcs7d.com
@@ -10,6 +10,9 @@ $	t := pkcs7-1.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing PKCS7 conversions (2)"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -34,9 +37,9 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/test/treq.com b/src/lib/libssl/test/treq.com
index 9eb1d26f6e..22c22c3aa9 100644
--- a/src/lib/libssl/test/treq.com
+++ b/src/lib/libssl/test/treq.com
@@ -10,6 +10,9 @@ $	t := testreq.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing req conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: fff.p ff.p2
+$!      backup/compare fff.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$!      difference/output=nl: f.t ff.t1
+$!      backup/compare f.t ff.t1
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t2
+$!      backup/compare f.t ff.t2
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t3
+$!      backup/compare f.t ff.t3
 $!      if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.p ff.p2
+$!      backup/compare f.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/test/trsa.com b/src/lib/libssl/test/trsa.com
index 9c9083d02b..28add5eefd 100644
--- a/src/lib/libssl/test/trsa.com
+++ b/src/lib/libssl/test/trsa.com
@@ -10,6 +10,9 @@ $	t := testrsa.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing RSA conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: fff.p ff.p2
+$!      backup/compare fff.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$!      difference/output=nl: f.t ff.t1
+$!      backup/compare f.t ff.t1
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t2
+$!      backup/compare f.t ff.t2
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t3
+$!      backup/compare f.t ff.t3
 $!      if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.p ff.p2
+$!      backup/compare f.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/test/tsid.com b/src/lib/libssl/test/tsid.com
index 28d83e5c4e..bde23f9bb9 100644
--- a/src/lib/libssl/test/tsid.com
+++ b/src/lib/libssl/test/tsid.com
@@ -10,6 +10,9 @@ $	t := testsid.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing session-id conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: fff.p ff.p2
+$!      backup/compare fff.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$!      difference/output=nl: f.t ff.t1
+$!      backup/compare f.t ff.t1
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t2
+$!      backup/compare f.t ff.t2
 $!      if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.t ff.t3
+$!      backup/compare f.t ff.t3
 $!      if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$!      difference/output=nl: f.p ff.p2
+$!      backup/compare f.p ff.p2
 $!      if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/test/tx509.com b/src/lib/libssl/test/tx509.com
index bbcf0a384b..985969c566 100644
--- a/src/lib/libssl/test/tx509.com
+++ b/src/lib/libssl/test/tx509.com
@@ -10,6 +10,9 @@ $	t := testx509.pem
 $       if p1 .nes. "" then t = p1
 $
 $       write sys$output "testing X509 conversions"
+$       if f$search("fff.*") .nes "" then delete fff.*;*
+$       if f$search("ff.*") .nes "" then delete ff.*;*
+$       if f$search("f.*") .nes "" then delete f.*;*
 $       copy 't' fff.p
 $
 $       write sys$output "p -> d"
@@ -52,27 +55,27 @@ $	write sys$output "p -> p"
 $       'cmd' -in f.p -inform p -outform p -out ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: fff.p f.p
+$       backup/compare fff.p f.p
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p1
+$       backup/compare fff.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p2
+$       backup/compare fff.p ff.p2
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: fff.p ff.p3
+$       backup/compare fff.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.n ff.n1
+$       backup/compare f.n ff.n1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.n ff.n2
+$       backup/compare f.n ff.n2
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.n ff.n3
+$       backup/compare f.n ff.n3
 $       if $severity .ne. 1 then exit 3
 $
-$       difference/output=nl: f.p ff.p1
+$       backup/compare f.p ff.p1
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p2
+$       backup/compare f.p ff.p2
 $       if $severity .ne. 1 then exit 3
-$       difference/output=nl: f.p ff.p3
+$       backup/compare f.p ff.p3
 $       if $severity .ne. 1 then exit 3
 $
 $       delete f.*;*,ff.*;*,fff.*;*
diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h
index a931efa936..6e2b06d34f 100644
--- a/src/lib/libssl/tls1.h
+++ b/src/lib/libssl/tls1.h
@@ -65,7 +65,7 @@
 extern "C" {
 #endif
 
-#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES    0
+#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES    1
 
 #define TLS1_VERSION                    0x0301
 #define TLS1_VERSION_MAJOR              0x03
@@ -77,11 +77,11 @@ extern "C" {
 #define TLS1_AD_ACCESS_DENIED           49      /* fatal */
 #define TLS1_AD_DECODE_ERROR            50      /* fatal */
 #define TLS1_AD_DECRYPT_ERROR           51
-#define TLS1_AD_EXPORT_RESTRICION       60      /* fatal */
+#define TLS1_AD_EXPORT_RESTRICTION      60      /* fatal */
 #define TLS1_AD_PROTOCOL_VERSION        70      /* fatal */
 #define TLS1_AD_INSUFFICIENT_SECURITY   71      /* fatal */
 #define TLS1_AD_INTERNAL_ERROR          80      /* fatal */
-#define TLS1_AD_USER_CANCLED            90
+#define TLS1_AD_USER_CANCELLED          90
 #define TLS1_AD_NO_RENEGOTIATION        100
 
 #define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5          0x03000060