12 files changed, 856 insertions, 454 deletions
diff --git a/src/lib/libcrypto/util/libeay.num b/src/lib/libcrypto/util/libeay.num
index 4222bef6d6..56fb7446e0 100644
--- a/src/lib/libcrypto/util/libeay.num
+++ b/src/lib/libcrypto/util/libeay.num
@@ -2811,7 +2811,7 @@ EVP_aes_192_cfb8                        3252	EXIST::FUNCTION:AES
 FIPS_mode_set                           3253    EXIST:OPENSSL_FIPS:FUNCTION:
 FIPS_selftest_dsa                       3254    EXIST:OPENSSL_FIPS:FUNCTION:
 EVP_aes_256_cfb8                        3255    EXIST::FUNCTION:AES
-FIPS_allow_md5                          3256    NOEXIST::FUNCTION:
+FIPS_allow_md5                          3256    EXIST:OPENSSL_FIPS:FUNCTION:
 DES_ede3_cfb_encrypt                    3257    EXIST::FUNCTION:DES
 EVP_des_ede3_cfb8                       3258    EXIST::FUNCTION:DES
 FIPS_rand_seeded                        3259    EXIST:OPENSSL_FIPS:FUNCTION:
@@ -2837,7 +2837,7 @@ FIPS_dsa_check                          3278	EXIST:OPENSSL_FIPS:FUNCTION:
 AES_cfb1_encrypt                        3279    EXIST::FUNCTION:AES
 EVP_des_ede3_cfb1                       3280    EXIST::FUNCTION:DES
 FIPS_rand_check                         3281    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_md5_allowed                        3282    NOEXIST::FUNCTION:
+FIPS_md5_allowed                        3282    EXIST:OPENSSL_FIPS:FUNCTION:
 FIPS_mode                               3283    EXIST:OPENSSL_FIPS:FUNCTION:
 FIPS_selftest_failed                    3284    EXIST:OPENSSL_FIPS:FUNCTION:
 sk_is_sorted                            3285    EXIST::FUNCTION:
@@ -2867,41 +2867,3 @@ PROXY_CERT_INFO_EXTENSION_it            3307	EXIST:!EXPORT_VAR_AS_FUNCTION:VARIA
 PROXY_CERT_INFO_EXTENSION_it            3307    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
 PROXY_POLICY_free                       3308    EXIST::FUNCTION:
 PROXY_POLICY_new                        3309    EXIST::FUNCTION:
-BN_MONT_CTX_set_locked                  3310    EXIST::FUNCTION:
-FIPS_selftest_rng                       3311    EXIST:OPENSSL_FIPS:FUNCTION:
-EVP_sha384                              3312    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-EVP_sha512                              3313    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-EVP_sha224                              3314    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-EVP_sha256                              3315    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-FIPS_selftest_hmac                      3316    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_corrupt_rng                        3317    EXIST:OPENSSL_FIPS:FUNCTION:
-BN_mod_exp_mont_consttime               3318    EXIST::FUNCTION:
-RSA_X931_hash_id                        3319    EXIST::FUNCTION:RSA
-RSA_padding_check_X931                  3320    EXIST::FUNCTION:RSA
-RSA_verify_PKCS1_PSS                    3321    EXIST::FUNCTION:RSA
-RSA_padding_add_X931                    3322    EXIST::FUNCTION:RSA
-RSA_padding_add_PKCS1_PSS               3323    EXIST::FUNCTION:RSA
-PKCS1_MGF1                              3324    EXIST::FUNCTION:RSA
-BN_X931_generate_Xpq                    3325    EXIST:OPENSSL_FIPS:FUNCTION:
-RSA_X931_generate_key                   3326    EXIST:OPENSSL_FIPS:FUNCTION:RSA
-BN_X931_derive_prime                    3327    EXIST:OPENSSL_FIPS:FUNCTION:
-BN_X931_generate_prime                  3328    EXIST:OPENSSL_FIPS:FUNCTION:
-RSA_X931_derive                         3329    EXIST:OPENSSL_FIPS:FUNCTION:RSA
-SHA512_Update                           3356    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA256_Init                             3479    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA224                                  3510    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA384_Update                           3551    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA224_Final                            3560    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA224_Update                           3562    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA512_Final                            3581    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA224_Init                             3631    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA512_Init                             3633    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA256                                  3654    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA256_Transform                        3664    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA512                                  3669    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA512_Transform                        3675    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA256_Final                            3712    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA384_Init                             3737    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA384_Final                            3740    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA384                                  3745    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA256_Update                           3765    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
diff --git a/src/lib/libcrypto/util/mk1mf.pl b/src/lib/libcrypto/util/mk1mf.pl
index 05a6086164..957264c6b5 100644
--- a/src/lib/libcrypto/util/mk1mf.pl
+++ b/src/lib/libcrypto/util/mk1mf.pl
@@ -10,20 +10,6 @@ $OPTIONS="";
 $ssl_version="";
 $banner="\t\@echo Building OpenSSL";
-local $zlib_opt = 0;    # 0 = no zlib, 1 = static, 2 = dynamic
-local $zlib_lib = "";
-my $fips_canister_path = "";
-my $fips_premain_dso_exe_path = "";
-my $fips_premain_c_path = "";
-my $fips_sha1_exe_path = "";
-my $fipslibdir = "";
-my $baseaddr = "";
-my $ex_l_libs = "";
 open(IN,"<Makefile") || die "unable to open Makefile!\n";
 while(<IN>) {
    $ssl_version=$1 if (/^VERSION=(.*)$/);
@@ -38,7 +24,6 @@ $infile="MINFO";
 %ops=(
        "VC-WIN32",   "Microsoft Visual C++ [4-6] - Windows NT or 9X",
-        "VC-WIN32-GMAKE", "Microsoft Visual C++ [4-6] - Windows NT or 9X, GNU make",
        "VC-CE",   "Microsoft eMbedded Visual C++ 3.0 - Windows CE ONLY",
        "VC-NT",   "Microsoft Visual C++ [4-6] - Windows NT ONLY",
        "VC-W31-16",  "Microsoft Visual C++ 1.52 - Windows 3.1 - 286",
@@ -58,7 +43,6 @@ $infile="MINFO";
        );
 $platform="";
-my $xcflags="";
 foreach (@ARGV)
        {
        if (!&read_options && !defined($ops{$_}))
@@ -120,12 +104,8 @@ $inc_def="outinc";
 $tmp_def="tmp";
 $mkdir="-mkdir";
-$mkcanister="ld -r -o";
-$ex_build_targets = "";
 ($ssl,$crypto)=("ssl","crypto");
-$cryptocompat = "";
 $ranlib="echo ranlib";
 $cc=(defined($VARS{'CC'}))?$VARS{'CC'}:'cc';
@@ -160,10 +140,6 @@ elsif (($platform eq "VC-WIN32") || ($platform eq "VC-NT"))
        $NT = 1 if $platform eq "VC-NT";
        require 'VC-32.pl';
        }
-elsif ($platform eq "VC-WIN32-GMAKE")
-        {
-        require 'VC-32-GMAKE.pl';
-        }
 elsif ($platform eq "VC-CE")
        {
        require 'VC-CE.pl';
@@ -234,8 +210,6 @@ $inc_dir=(defined($VARS{'INC'}))?$VARS{'INC'}:$inc_def;
 $bin_dir=$bin_dir.$o unless ((substr($bin_dir,-1,1) eq $o) || ($bin_dir eq ''));
-$cflags= "$xcflags$cflags" if $xcflags ne "";
 $cflags.=" -DOPENSSL_NO_IDEA" if $no_idea;
 $cflags.=" -DOPENSSL_NO_AES"  if $no_aes;
 $cflags.=" -DOPENSSL_NO_RC2"  if $no_rc2;
@@ -265,9 +239,6 @@ $cflags.=" -DOPENSSL_NO_HW"   if $no_hw;
 $cflags.=" -DOPENSSL_FIPS"    if $fips;
 #$cflags.=" -DRSAref"  if $rsaref ne "";
-$cflags.= " -DZLIB" if $zlib_opt;
-$cflags.= " -DZLIB_SHARED" if $zlib_opt == 2;
 ## if ($unix)
 ##      { $cflags="$c_flags" if ($c_flags ne ""); }
 ##else
@@ -275,7 +246,6 @@ $cflags.= " -DZLIB_SHARED" if $zlib_opt == 2;
 $ex_libs="$l_flags$ex_libs" if ($l_flags ne "");
 %shlib_ex_cflags=("SSL" => " -DOPENSSL_BUILD_SHLIBSSL",
                  "CRYPTO" => " -DOPENSSL_BUILD_SHLIBCRYPTO");
@@ -292,135 +262,6 @@ $link="$bin_dir$link" if ($link !~ /^\$/);
 $INSTALLTOP =~ s|/|$o|g;
-#############################################
-# We parse in input file and 'store' info for later printing.
-open(IN,"<$infile") || die "unable to open $infile:$!\n";
-$_=<IN>;
-for (;;)
-        {
-        chop;
-        ($key,$val)=/^([^=]+)=(.*)/;
-        if ($key eq "RELATIVE_DIRECTORY")
-                {
-                if ($lib ne "")
-                        {
-                        if ($fips && $dir =~ /^fips/)
-                                {
-                                $uc = "FIPS";
-                                }
-                        else
-                                {
-                                $uc=$lib;
-                                $uc =~ s/^lib(.*)\.a/$1/;
-                                $uc =~ tr/a-z/A-Z/;
-                                }
-                        if (($uc ne "FIPS") || $fips_canister_build)
-                                {
-                                $lib_nam{$uc}=$uc;
-                                $lib_obj{$uc}.=$libobj." ";
-                                }
-                        }
-                last if ($val eq "FINISHED");
-                $lib="";
-                $libobj="";
-                $dir=$val;
-                }
-        if ($key eq "KRB5_INCLUDES")
-                { $cflags .= " $val";}
-        if ($key eq "ZLIB_INCLUDE")
-                { $cflags .= " $val" if $val ne "";}
-        if ($key eq "LIBZLIB")
-                { $zlib_lib = "$val" if $val ne "";}
-        if ($key eq "LIBKRB5")
-                { $ex_libs .= " $val" if $val ne "";}
-        if ($key eq "TEST")
-                { $test.=&var_add($dir,$val); }
-        if (($key eq "PROGS") || ($key eq "E_OBJ"))
-                { $e_exe.=&var_add($dir,$val); }
-        if ($key eq "LIB")
-                {
-                $lib=$val;
-                $lib =~ s/^.*\/([^\/]+)$/$1/;
-                }
-        if ($key eq "EXHEADER")
-                { $exheader.=&var_add($dir,$val); }
-        if ($key eq "HEADER")
-                { $header.=&var_add($dir,$val); }
-        if ($key eq "LIBOBJ")
-                { $libobj=&var_add($dir,$val); }
-        if ($key eq "FIPSLIBDIR")
-                { $fipslibdir=$val;}
-        if ($key eq "BASEADDR")
-                { $baseaddr=$val;}
-        if (!($_=<IN>))
-                { $_="RELATIVE_DIRECTORY=FINISHED\n"; }
-        }
-close(IN);
-if ($fips_canister_path eq "")
-        {
-        $fips_canister_path = "\$(FIPSLIB_D)${o}fipscanister.o";
-        }
-if ($fips_premain_c_path eq "")
-        {
-        $fips_premain_c_path = "\$(FIPSLIB_D)${o}fips_premain.c";
-        }
-if ($fips)
-        {
-        if ($fips_sha1_exe_path eq "")
-                {
-                $fips_sha1_exe_path =
-                        "\$(BIN_D)${o}fips_standalone_sha1$exep";
-                }
-        }
-        else
-        {
-        $fips_sha1_exe_path = "";
-        }
-if ($fips_premain_dso_exe_path eq "")
-        {
-        $fips_premain_dso_exe_path = "\$(BIN_D)${o}fips_premain_dso$exep";
-        }
-#       $ex_build_targets .= "\$(BIN_D)${o}\$(E_PREMAIN_DSO)$exep" if ($fips);
-if ($fips)
-        {
-        if (!$shlib)
-                {
-                $ex_build_targets .= " \$(LIB_D)$o$crypto_compat \$(PREMAIN_DSO_EXE)";
-                $ex_l_libs .= " \$(O_FIPSCANISTER)";
-                }
-        if ($fipslibdir eq "")
-                {
-                open (IN, "util/fipslib_path.txt") || fipslib_error();
-                $fipslibdir = <IN>;
-                chomp $fipslibdir;
-                close IN;
-                }
-        fips_check_files($fipslibdir,
-                        "fipscanister.o", "fipscanister.o.sha1",
-                        "fips_premain.c", "fips_premain.c.sha1");
-        }
-        
 $defs= <<"EOF";
 # This makefile has been automatically generated from the OpenSSL distribution.
 # This single makefile will build the complete OpenSSL distribution and
@@ -445,7 +286,6 @@ if ($platform eq "VC-CE")
 !INCLUDE <\$(WCECOMPAT)/wcedefs.mak>
 EOF
-        $ex_libs .= " $zlib_lib" if $zlib_opt == 1;
        }
 $defs.= <<"EOF";
@@ -468,8 +308,6 @@ EX_LIBS=$ex_libs
 SRC_D=$src_dir
 LINK=$link
-PERL=perl
-FIPSLINK=\$(PERL) util${o}fipslink.pl
 LFLAGS=$lflags
 BN_ASM_OBJ=$bn_asm_obj
@@ -501,9 +339,6 @@ TMP_D=$tmp_dir
 INC_D=$inc_dir
 INCO_D=$inc_dir${o}openssl
-# Directory containing FIPS module
 CP=$cp
 RM=$rm
 RANLIB=$ranlib
@@ -511,18 +346,6 @@ MKDIR=$mkdir
 MKLIB=$bin_dir$mklib
 MLFLAGS=$mlflags
 ASM=$bin_dir$asm
-MKCANISTER=$mkcanister
-# FIPS validated module and support file locations
-E_PREMAIN_DSO=fips_premain_dso
-FIPSLIB_D=$fipslibdir
-BASEADDR=$baseaddr
-FIPS_PREMAIN_SRC=$fips_premain_c_path
-O_FIPSCANISTER=$fips_canister_path
-FIPS_SHA1_EXE=$fips_sha1_exe_path
-PREMAIN_DSO_EXE=$fips_premain_dso_exe_path
 ######################################################
 # You should not need to touch anything below this point
@@ -554,7 +377,7 @@ SO_CRYPTO= $plib\$(CRYPTO)$so_shlibp
 L_SSL=     \$(LIB_D)$o$plib\$(SSL)$libp
 L_CRYPTO=  \$(LIB_D)$o$plib\$(CRYPTO)$libp
-L_LIBS= \$(L_SSL) \$(L_CRYPTO) $ex_l_libs
+L_LIBS= \$(L_SSL) \$(L_CRYPTO)
 ######################################################
 # Don't touch anything below this point
@@ -564,13 +387,13 @@ INC=-I\$(INC_D) -I\$(INCL_D)
 APP_CFLAGS=\$(INC) \$(CFLAG) \$(APP_CFLAG)
 LIB_CFLAGS=\$(INC) \$(CFLAG) \$(LIB_CFLAG)
 SHLIB_CFLAGS=\$(INC) \$(CFLAG) \$(LIB_CFLAG) \$(SHLIB_CFLAG)
-LIBS_DEP=\$(O_CRYPTO) \$(O_SSL) $ex_libs_dep
+LIBS_DEP=\$(O_CRYPTO) \$(O_SSL)
 #############################################
 EOF
 $rules=<<"EOF";
-all: banner \$(TMP_D) \$(BIN_D) \$(TEST_D) \$(LIB_D) \$(INCO_D) headers \$(FIPS_SHA1_EXE) lib exe $ex_build_targets
+all: banner \$(TMP_D) \$(BIN_D) \$(TEST_D) \$(LIB_D) \$(INCO_D) headers lib exe
 banner:
 $banner
@@ -656,6 +479,57 @@ printf OUT "  #define DATE \"%s\"\n", scalar gmtime();
 printf OUT "#endif\n";
 close(OUT);
+#############################################
+# We parse in input file and 'store' info for later printing.
+open(IN,"<$infile") || die "unable to open $infile:$!\n";
+$_=<IN>;
+for (;;)
+        {
+        chop;
+        ($key,$val)=/^([^=]+)=(.*)/;
+        if ($key eq "RELATIVE_DIRECTORY")
+                {
+                if ($lib ne "")
+                        {
+                        $uc=$lib;
+                        $uc =~ s/^lib(.*)\.a/$1/;
+                        $uc =~ tr/a-z/A-Z/;
+                        $lib_nam{$uc}=$uc;
+                        $lib_obj{$uc}.=$libobj." ";
+                        }
+                last if ($val eq "FINISHED");
+                $lib="";
+                $libobj="";
+                $dir=$val;
+                }
+        if ($key eq "TEST")
+                { $test.=&var_add($dir,$val); }
+        if (($key eq "PROGS") || ($key eq "E_OBJ"))
+                { $e_exe.=&var_add($dir,$val); }
+        if ($key eq "LIB")
+                {
+                $lib=$val;
+                $lib =~ s/^.*\/([^\/]+)$/$1/;
+                }
+        if ($key eq "EXHEADER")
+                { $exheader.=&var_add($dir,$val); }
+        if ($key eq "HEADER")
+                { $header.=&var_add($dir,$val); }
+        if ($key eq "LIBOBJ")
+                { $libobj=&var_add($dir,$val); }
+        if (!($_=<IN>))
+                { $_="RELATIVE_DIRECTORY=FINISHED\n"; }
+        }
+close(IN);
 # Strip of trailing ' '
 foreach (keys %lib_obj) { $lib_obj{$_}=&clean_up_ws($lib_obj{$_}); }
 $test=&clean_up_ws($test);
@@ -680,29 +554,6 @@ $rules.=&do_compile_rule("\$(OBJ_D)",$test,"\$(APP_CFLAGS)");
 $defs.=&do_defs("E_OBJ",$e_exe,"\$(OBJ_D)",$obj);
 $rules.=&do_compile_rule("\$(OBJ_D)",$e_exe,'-DMONOLITH $(APP_CFLAGS)');
-# Special case rules for fips_start and fips_end fips_premain_dso
-if ($fips)
-        {
-        if ($fips_canister_build)
-                {
-                $rules.=&cc_compile_target("\$(OBJ_D)${o}fips_start$obj",
-                        "fips-1.0${o}fips_canister.c",
-                        "-DFIPS_START \$(SHLIB_CFLAGS)");
-                $rules.=&cc_compile_target("\$(OBJ_D)${o}fips_end$obj",
-                        "fips-1.0${o}fips_canister.c", "\$(SHLIB_CFLAGS)");
-                }
-        $rules.=&cc_compile_target("\$(OBJ_D)${o}fips_standalone_sha1$obj",
-                "fips-1.0${o}sha${o}fips_standalone_sha1.c",
-                "\$(SHLIB_CFLAGS)");
-        $rules.=&cc_compile_target("\$(OBJ_D)${o}fips_sha1dgst$obj",
-                "fips-1.0${o}sha${o}fips_sha1dgst.c",
-                "\$(SHLIB_CFLAGS)") unless $fips_canister_build;
-        $rules.=&cc_compile_target("\$(OBJ_D)${o}\$(E_PREMAIN_DSO)$obj",
-                "fips-1.0${o}fips_premain.c",
-                "-DFINGERPRINT_PREMAIN_DSO_LOAD \$(SHLIB_CFLAGS)");
-        }
 foreach (values %lib_nam)
        {
        $lib_obj=$lib_obj{$_};
@@ -779,42 +630,16 @@ foreach (split(/\s+/,$test))
        }
 $rules.= &do_lib_rule("\$(SSLOBJ)","\$(O_SSL)",$ssl,$shlib,"\$(SO_SSL)");
+$rules.= &do_lib_rule("\$(CRYPTOOBJ)","\$(O_CRYPTO)",$crypto,$shlib,"\$(SO_CRYPTO)");
 if ($fips)
        {
-        if ($shlib)
+        $rules.=&do_link_rule("\$(BIN_D)$o\$(E_EXE)$exep","\$(E_OBJ)","\$(LIBS_DEP)","\$(L_LIBS) \$(EX_LIBS)","\$(BIN_D)$o.sha1","\$(BIN_D)$o\$(E_EXE)$exep");
-                {
-                $rules.= &do_lib_rule("\$(CRYPTOOBJ) \$(O_FIPSCANISTER)",
-                        "\$(O_CRYPTO)",
-                        "$crypto",
-                        $shlib, "\$(SO_CRYPTO)", "\$(BASEADDR)");
-                }
-        else
-                {
-                $rules.= &do_lib_rule("\$(CRYPTOOBJ)",
-                        "\$(O_CRYPTO)",$crypto,$shlib,"\$(SO_CRYPTO)", "");
-                $rules.= &do_lib_rule("\$(CRYPTOOBJ) \$(O_FIPSCANISTER)",
-                        "\$(LIB_D)$o$crypto_compat",$crypto,$shlib,"\$(SO_CRYPTO)", "");
-                }
        }
-        else
+else
-        {
-        $rules.= &do_lib_rule("\$(CRYPTOOBJ)","\$(O_CRYPTO)",$crypto,$shlib,
-                                                        "\$(SO_CRYPTO)");
-        }
-if ($fips)
        {
-        $rules.= &do_rlink_rule("\$(O_FIPSCANISTER)", "\$(OBJ_D)${o}fips_start$obj \$(FIPSOBJ) \$(OBJ_D)${o}fips_end$obj", "\$(FIPSLIB_D)${o}fips_standalone_sha1$exep", "") if $fips_canister_build;
+        $rules.=&do_link_rule("\$(BIN_D)$o\$(E_EXE)$exep","\$(E_OBJ)","\$(LIBS_DEP)","\$(L_LIBS) \$(EX_LIBS)");
-        $rules.=&do_link_rule("\$(PREMAIN_DSO_EXE)","\$(OBJ_D)${o}\$(E_PREMAIN_DSO)$obj \$(CRYPTOOBJ) \$(O_FIPSCANISTER)","","\$(EX_LIBS)", 1);
-        
-        $rules.=&do_link_rule("\$(FIPS_SHA1_EXE)","\$(OBJ_D)${o}fips_standalone_sha1$obj \$(OBJ_D)${o}fips_sha1dgst$obj","","", 1);
        }
-        $rules.=&do_link_rule("\$(BIN_D)$o\$(E_EXE)$exep","\$(E_OBJ)","\$(LIBS_DEP)","\$(L_LIBS) \$(EX_LIBS)",0);
 print $defs;
 if ($platform eq "linux-elf") {
@@ -1110,24 +935,6 @@ sub read_options
        elsif (/^shlib$/)       { $shlib=1; }
        elsif (/^dll$/)         { $shlib=1; }
        elsif (/^shared$/)      { } # We just need to ignore it for now...
-        elsif (/^zlib$/) { $zlib_opt = 1 if $zlib_opt == 0 }
-        elsif (/^zlib-dynamic$/){ $zlib_opt = 2; }
-        elsif (/^--with-krb5-flavor=(.*)$/)
-                {
-                my $krb5_flavor = $1;
-                if ($krb5_flavor =~ /^force-[Hh]eimdal$/)
-                        {
-                        $xcflags="-DKRB5_HEIMDAL $xcflags";
-                        }
-                elsif ($krb5_flavor =~ /^MIT/i)
-                        {
-                        $xcflags="-DKRB5_MIT $xcflags";
-                        if ($krb5_flavor =~ /^MIT[._-]*1[._-]*[01]/i)
-                                {
-                                $xcflags="-DKRB5_MIT_OLD11 $xcflags"
-                                }
-                        }
-                }
        elsif (/^([^=]*)=(.*)$/){ $VARS{$1}=$2; }
        elsif (/^-[lL].*$/)     { $l_flags.="$_ "; }
        elsif ((!/^-help/) && (!/^-h/) && (!/^-\?/) && /^-.*$/)
@@ -1135,31 +942,3 @@ sub read_options
        else { return(0); }
        return(1);
        }
-sub fipslib_error
-        {
-        print STDERR "***FIPS module directory sanity check failed***\n";
-        print STDERR "FIPS module build failed, or was deleted\n";
-        print STDERR "Please rebuild FIPS module.\n"; 
-        exit 1;
-        }
-sub fips_check_files
-        {
-        my $dir = shift @_;
-        my $ret = 1;
-        if (!-d $dir)
-                {
-                print STDERR "FIPS module directory $dir does not exist\n";
-                fipslib_error();
-                }
-        foreach (@_)
-                {
-                if (!-f "$dir${o}$_")
-                        {
-                        print STDERR "FIPS module file $_ does not exist!\n";
-                        $ret = 0;
-                        }
-                }
-        fipslib_error() if ($ret == 0);
-        }
diff --git a/src/lib/libcrypto/util/mkdef.pl b/src/lib/libcrypto/util/mkdef.pl
index 6c1e53bb14..9918c3d549 100644
--- a/src/lib/libcrypto/util/mkdef.pl
+++ b/src/lib/libcrypto/util/mkdef.pl
@@ -83,7 +83,7 @@ my @known_platforms = ( "__FreeBSD__", "PERL5", "NeXT",
 my @known_ossl_platforms = ( "VMS", "WIN16", "WIN32", "WINNT", "OS2" );
 my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
                         "CAST", "MD2", "MD4", "MD5", "SHA", "SHA0", "SHA1",
-                         "SHA256", "SHA512", "RIPEMD",
+                         "RIPEMD",
                         "MDC2", "RSA", "DSA", "DH", "EC", "HMAC", "AES",
                         # Envelope "algorithms"
                         "EVP", "X509", "ASN1_TYPEDEFS",
@@ -267,7 +267,7 @@ $crypto.=" crypto/ocsp/ocsp.h";
 $crypto.=" crypto/ui/ui.h crypto/ui/ui_compat.h";
 $crypto.=" crypto/krb5/krb5_asn.h";
 $crypto.=" crypto/tmdiff.h";
-$crypto.=" fips-1.0/fips.h fips-1.0/rand/fips_rand.h fips-1.0/sha/fips_sha.h";
+$crypto.=" fips/fips.h fips/rand/fips_rand.h";
 my $symhacks="crypto/symhacks.h";
@@ -864,9 +864,6 @@ sub do_defs
                        $a .= ",RSA" if($s =~ /PEM_Seal(Final|Init|Update)/);
                        $a .= ",RSA" if($s =~ /RSAPrivateKey/);
                        $a .= ",RSA" if($s =~ /SSLv23?_((client|server)_)?method/);
-                        # SHA2 algorithms only defined in FIPS mode for
-                        # OpenSSL 0.9.7
-                        $p .= "OPENSSL_FIPS" if($s =~ /SHA[235]/);
                        $platform{$s} =
                            &reduce_platforms((defined($platform{$s})?$platform{$s}.',':"").$p);
@@ -1014,7 +1011,7 @@ sub is_valid
 {
        my ($keywords_txt,$platforms) = @_;
        my (@keywords) = split /,/,$keywords_txt;
-        my ($falsesum, $truesum) = (0, 1);
+        my ($falsesum, $truesum) = (0, !grep(/^[^!]/,@keywords));
        # Param: one keyword
        sub recognise
@@ -1082,7 +1079,7 @@ sub is_valid
                if ($k =~ /^!(.*)$/) {
                        $falsesum += &recognise($1,$platforms);
                } else {
-                        $truesum *= &recognise($k,$platforms);
+                        $truesum += &recognise($k,$platforms);
                }
        }
        print STDERR "DEBUG: [",$#keywords,",",$#keywords < 0,"] is_valid($keywords_txt) => (\!$falsesum) && $truesum = ",(!$falsesum) && $truesum,"\n" if $debug;
diff --git a/src/lib/libcrypto/util/mkerr.pl b/src/lib/libcrypto/util/mkerr.pl
new file mode 100644
index 0000000000..60e534807e
--- /dev/null
+++ b/src/lib/libcrypto/util/mkerr.pl
@@ -0,0 +1,630 @@
+#!/usr/local/bin/perl -w
+my $config = "crypto/err/openssl.ec";
+my $debug = 0;
+my $rebuild = 0;
+my $static = 1;
+my $recurse = 0;
+my $reindex = 0;
+my $dowrite = 0;
+my $staticloader = "";
+while (@ARGV) {
+        my $arg = $ARGV[0];
+        if($arg eq "-conf") {
+                shift @ARGV;
+                $config = shift @ARGV;
+        } elsif($arg eq "-debug") {
+                $debug = 1;
+                shift @ARGV;
+        } elsif($arg eq "-rebuild") {
+                $rebuild = 1;
+                shift @ARGV;
+        } elsif($arg eq "-recurse") {
+                $recurse = 1;
+                shift @ARGV;
+        } elsif($arg eq "-reindex") {
+                $reindex = 1;
+                shift @ARGV;
+        } elsif($arg eq "-nostatic") {
+                $static = 0;
+                shift @ARGV;
+        } elsif($arg eq "-staticloader") {
+                $staticloader = "static ";
+                shift @ARGV;
+        } elsif($arg eq "-write") {
+                $dowrite = 1;
+                shift @ARGV;
+        } else {
+                last;
+        }
+}
+if($recurse) {
+        @source = (<crypto/*.c>, <crypto/*/*.c>, <ssl/*.c>, <fips/*.c>,
+                   <fips/*/*.c>);
+} else {
+        @source = @ARGV;
+}
+# Read in the config file
+open(IN, "<$config") || die "Can't open config file $config";
+# Parse config file
+while(<IN>)
+{
+        if(/^L\s+(\S+)\s+(\S+)\s+(\S+)/) {
+                $hinc{$1} = $2;
+                $libinc{$2} = $1;
+                $cskip{$3} = $1;
+                if($3 ne "NONE") {
+                        $csrc{$1} = $3;
+                        $fmax{$1} = 99;
+                        $rmax{$1} = 99;
+                        $fnew{$1} = 0;
+                        $rnew{$1} = 0;
+                }
+        } elsif (/^F\s+(\S+)/) {
+        # Add extra function with $1
+        } elsif (/^R\s+(\S+)\s+(\S+)/) {
+                $rextra{$1} = $2;
+                $rcodes{$1} = $2;
+        }
+}
+close IN;
+# Scan each header file in turn and make a list of error codes
+# and function names
+while (($hdr, $lib) = each %libinc)
+{
+        next if($hdr eq "NONE");
+        print STDERR "Scanning header file $hdr\n" if $debug; 
+        my $line = "", $def= "", $linenr = 0, $gotfile = 0;
+        if (open(IN, "<$hdr")) {
+            $gotfile = 1;
+            while(<IN>) {
+                $linenr++;
+                print STDERR "line: $linenr\r" if $debug;
+                last if(/BEGIN\s+ERROR\s+CODES/);
+                if ($line ne '') {
+                    $_ = $line . $_;
+                    $line = '';
+                }
+                if (/\\$/) {
+                    $line = $_;
+                    next;
+                }
+                $cpp = 1 if /^#.*ifdef.*cplusplus/;  # skip "C" declaration
+                if ($cpp) {
+                    $cpp = 0 if /^#.*endif/;
+                    next;
+                }
+                next if (/^\#/);                      # skip preprocessor directives
+                s/\/\*.*?\*\///gs;                   # ignore comments
+                s/{[^{}]*}//gs;                      # ignore {} blocks
+                if (/\{|\/\*/) { # Add a } so editor works...
+                    $line = $_;
+                } else {
+                    $def .= $_;
+                }
+            }
+        }
+        print STDERR "                                  \r" if $debug;
+        $defnr = 0;
+        foreach (split /;/, $def) {
+            $defnr++;
+            print STDERR "def: $defnr\r" if $debug;
+            s/^[\n\s]*//g;
+            s/[\n\s]*$//g;
+            next if(/typedef\W/);
+            if (/\(\*(\w*)\([^\)]+/) {
+                my $name = $1;
+                $name =~ tr/[a-z]/[A-Z]/;
+                $ftrans{$name} = $1;
+            } elsif (/\w+\W+(\w+)\W*\(\s*\)(\s*__attribute__\(.*\)\s*)?$/s){
+                # K&R C
+                next ;
+            } elsif (/\w+\W+\w+\W*\(.*\)(\s*__attribute__\(.*\)\s*)?$/s) {
+                while (not /\(\)(\s*__attribute__\(.*\)\s*)?$/s) {
+                    s/[^\(\)]*\)(\s*__attribute__\(.*\)\s*)?$/\)/s;
+                    s/\([^\(\)]*\)\)(\s*__attribute__\(.*\)\s*)?$/\)/s;
+                }
+                s/\(void\)//;
+                /(\w+(\{[0-9]+\})?)\W*\(\)/s;
+                my $name = $1;
+                $name =~ tr/[a-z]/[A-Z]/;
+                $ftrans{$name} = $1;
+            } elsif (/\(/ and not (/=/ or /DECLARE_STACK/)) {
+                print STDERR "Header $hdr: cannot parse: $_;\n";
+            }
+        }
+        print STDERR "                                  \r" if $debug;
+        next if $reindex;
+        # Scan function and reason codes and store them: keep a note of the
+        # maximum code used.
+        if ($gotfile) {
+            while(<IN>) {
+                if(/^\#define\s+(\S+)\s+(\S+)/) {
+                        $name = $1;
+                        $code = $2;
+                        next if $name =~ /^${lib}err/;
+                        unless($name =~ /^${lib}_([RF])_(\w+)$/) {
+                                print STDERR "Invalid error code $name\n";
+                                next;
+                        }
+                        if($1 eq "R") {
+                                $rcodes{$name} = $code;
+                                if(!(exists $rextra{$name}) &&
+                                         ($code > $rmax{$lib}) ) {
+                                        $rmax{$lib} = $code;
+                                }
+                        } else {
+                                if($code > $fmax{$lib}) {
+                                        $fmax{$lib} = $code;
+                                }
+                                $fcodes{$name} = $code;
+                        }
+                }
+            }
+        }
+        close IN;
+}
+# Scan each C source file and look for function and reason codes
+# This is done by looking for strings that "look like" function or
+# reason codes: basically anything consisting of all upper case and
+# numerics which has _F_ or _R_ in it and which has the name of an
+# error library at the start. This seems to work fine except for the
+# oddly named structure BIO_F_CTX which needs to be ignored.
+# If a code doesn't exist in list compiled from headers then mark it
+# with the value "X" as a place holder to give it a value later.
+# Store all function and reason codes found in %ufcodes and %urcodes
+# so all those unreferenced can be printed out.
+print STDERR "Files loaded: " if $debug;
+foreach $file (@source) {
+        # Don't parse the error source file.
+        next if exists $cskip{$file};
+        print STDERR $file if $debug;
+        open(IN, "<$file") || die "Can't open source file $file\n";
+        while(<IN>) {
+                if(/(([A-Z0-9]+)_F_([A-Z0-9_]+))/) {
+                        next unless exists $csrc{$2};
+                        next if($1 eq "BIO_F_BUFFER_CTX");
+                        $ufcodes{$1} = 1;
+                        if(!exists $fcodes{$1}) {
+                                $fcodes{$1} = "X";
+                                $fnew{$2}++;
+                        }
+                        $notrans{$1} = 1 unless exists $ftrans{$3};
+                }
+                if(/(([A-Z0-9]+)_R_[A-Z0-9_]+)/) {
+                        next unless exists $csrc{$2};
+                        $urcodes{$1} = 1;
+                        if(!exists $rcodes{$1}) {
+                                $rcodes{$1} = "X";
+                                $rnew{$2}++;
+                        }
+                } 
+        }
+        close IN;
+}
+print STDERR "\n" if $debug;
+# Now process each library in turn.
+foreach $lib (keys %csrc)
+{
+        my $hfile = $hinc{$lib};
+        my $cfile = $csrc{$lib};
+        if(!$fnew{$lib} && !$rnew{$lib}) {
+                print STDERR "$lib:\t\tNo new error codes\n";
+                next unless $rebuild;
+        } else {
+                print STDERR "$lib:\t\t$fnew{$lib} New Functions,";
+                print STDERR " $rnew{$lib} New Reasons.\n";
+                next unless $dowrite;
+        }
+        # If we get here then we have some new error codes so we
+        # need to rebuild the header file and C file.
+        # Make a sorted list of error and reason codes for later use.
+        my @function = sort grep(/^${lib}_/,keys %fcodes);
+        my @reasons = sort grep(/^${lib}_/,keys %rcodes);
+        # Rewrite the header file
+        if (open(IN, "<$hfile")) {
+            # Copy across the old file
+            while(<IN>) {
+                push @out, $_;
+                last if (/BEGIN ERROR CODES/);
+            }
+            close IN;
+        } else {
+            push @out,
+"/* ====================================================================\n",
+" * Copyright (c) 2001-2005 The OpenSSL Project.  All rights reserved.\n",
+" *\n",
+" * Redistribution and use in source and binary forms, with or without\n",
+" * modification, are permitted provided that the following conditions\n",
+" * are met:\n",
+" *\n",
+" * 1. Redistributions of source code must retain the above copyright\n",
+" *    notice, this list of conditions and the following disclaimer. \n",
+" *\n",
+" * 2. Redistributions in binary form must reproduce the above copyright\n",
+" *    notice, this list of conditions and the following disclaimer in\n",
+" *    the documentation and/or other materials provided with the\n",
+" *    distribution.\n",
+" *\n",
+" * 3. All advertising materials mentioning features or use of this\n",
+" *    software must display the following acknowledgment:\n",
+" *    \"This product includes software developed by the OpenSSL Project\n",
+" *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)\"\n",
+" *\n",
+" * 4. The names \"OpenSSL Toolkit\" and \"OpenSSL Project\" must not be used to\n",
+" *    endorse or promote products derived from this software without\n",
+" *    prior written permission. For written permission, please contact\n",
+" *    openssl-core\@openssl.org.\n",
+" *\n",
+" * 5. Products derived from this software may not be called \"OpenSSL\"\n",
+" *    nor may \"OpenSSL\" appear in their names without prior written\n",
+" *    permission of the OpenSSL Project.\n",
+" *\n",
+" * 6. Redistributions of any form whatsoever must retain the following\n",
+" *    acknowledgment:\n",
+" *    \"This product includes software developed by the OpenSSL Project\n",
+" *    for use in the OpenSSL Toolkit (http://www.openssl.org/)\"\n",
+" *\n",
+" * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY\n",
+" * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\n",
+" * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n",
+" * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR\n",
+" * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n",
+" * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT\n",
+" * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n",
+" * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)\n",
+" * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\n",
+" * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)\n",
+" * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED\n",
+" * OF THE POSSIBILITY OF SUCH DAMAGE.\n",
+" * ====================================================================\n",
+" *\n",
+" * This product includes cryptographic software written by Eric Young\n",
+" * (eay\@cryptsoft.com).  This product includes software written by Tim\n",
+" * Hudson (tjh\@cryptsoft.com).\n",
+" *\n",
+" */\n",
+"\n",
+"#ifndef HEADER_${lib}_ERR_H\n",
+"#define HEADER_${lib}_ERR_H\n",
+"\n",
+"/* BEGIN ERROR CODES */\n";
+        }
+        open (OUT, ">$hfile") || die "Can't Open File $hfile for writing\n";
+        print OUT @out;
+        undef @out;
+        print OUT <<"EOF";
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+EOF
+        if($static) {
+                print OUT <<"EOF";
+${staticloader}void ERR_load_${lib}_strings(void);
+EOF
+        } else {
+                print OUT <<"EOF";
+${staticloader}void ERR_load_${lib}_strings(void);
+${staticloader}void ERR_unload_${lib}_strings(void);
+${staticloader}void ERR_${lib}_error(int function, int reason, char *file, int line);
+#define ${lib}err(f,r) ERR_${lib}_error((f),(r),__FILE__,__LINE__)
+EOF
+        }
+        print OUT <<"EOF";
+/* Error codes for the $lib functions. */
+/* Function codes. */
+EOF
+        foreach $i (@function) {
+                $z=6-int(length($i)/8);
+                if($fcodes{$i} eq "X") {
+                        $fcodes{$i} = ++$fmax{$lib};
+                        print STDERR "New Function code $i\n" if $debug;
+                }
+                printf OUT "#define $i%s $fcodes{$i}\n","\t" x $z;
+        }
+        print OUT "\n/* Reason codes. */\n";
+        foreach $i (@reasons) {
+                $z=6-int(length($i)/8);
+                if($rcodes{$i} eq "X") {
+                        $rcodes{$i} = ++$rmax{$lib};
+                        print STDERR "New Reason code   $i\n" if $debug;
+                }
+                printf OUT "#define $i%s $rcodes{$i}\n","\t" x $z;
+        }
+        print OUT <<"EOF";
+#ifdef  __cplusplus
+}
+#endif
+#endif
+EOF
+        close OUT;
+        # Rewrite the C source file containing the error details.
+        # First, read any existing reason string definitions:
+        my %err_reason_strings;
+        if (open(IN,"<$cfile")) {
+                while (<IN>) {
+                        if (/\b(${lib}_R_\w*)\b.*\"(.*)\"/) {
+                                $err_reason_strings{$1} = $2;
+                        }
+                }
+                close(IN);
+        }
+        my $hincf;
+        if($static) {
+                $hfile =~ /([^\/]+)$/;
+                $hincf = "<openssl/$1>";
+        } else {
+                $hincf = "\"$hfile\"";
+        }
+        open (OUT,">$cfile") || die "Can't open $cfile for writing";
+        print OUT <<"EOF";
+/* $cfile */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core\@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay\@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh\@cryptsoft.com).
+ *
+ */
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+#include <stdio.h>
+#include <openssl/err.h>
+#include $hincf
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+static ERR_STRING_DATA ${lib}_str_functs[]=
+        {
+EOF
+        # Add each function code: if a function name is found then use it.
+        foreach $i (@function) {
+                my $fn;
+                $i =~ /^${lib}_F_(\S+)$/;
+                $fn = $1;
+                if(exists $ftrans{$fn}) {
+                        $fn = $ftrans{$fn};
+                }
+                print OUT "{ERR_PACK(0,$i,0),\t\"$fn\"},\n";
+        }
+        print OUT <<"EOF";
+{0,NULL}
+        };
+static ERR_STRING_DATA ${lib}_str_reasons[]=
+        {
+EOF
+        # Add each reason code.
+        foreach $i (@reasons) {
+                my $rn;
+                my $nspc = 0;
+                if (exists $err_reason_strings{$i}) {
+                        $rn = $err_reason_strings{$i};
+                } else {
+                        $i =~ /^${lib}_R_(\S+)$/;
+                        $rn = $1;
+                        $rn =~ tr/_[A-Z]/ [a-z]/;
+                }
+                $nspc = 40 - length($i) unless length($i) > 40;
+                $nspc = " " x $nspc;
+                print OUT "{${i}${nspc},\"$rn\"},\n";
+        }
+if($static) {
+        print OUT <<"EOF";
+{0,NULL}
+        };
+#endif
+${staticloader}void ERR_load_${lib}_strings(void)
+        {
+        static int init=1;
+        if (init)
+                {
+                init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(ERR_LIB_${lib},${lib}_str_functs);
+                ERR_load_strings(ERR_LIB_${lib},${lib}_str_reasons);
+#endif
+                }
+        }
+EOF
+} else {
+        print OUT <<"EOF";
+{0,NULL}
+        };
+#endif
+#ifdef ${lib}_LIB_NAME
+static ERR_STRING_DATA ${lib}_lib_name[]=
+        {
+{0      ,${lib}_LIB_NAME},
+{0,NULL}
+        };
+#endif
+static int ${lib}_lib_error_code=0;
+static int ${lib}_error_init=1;
+${staticloader}void ERR_load_${lib}_strings(void)
+        {
+        if (${lib}_lib_error_code == 0)
+                ${lib}_lib_error_code=ERR_get_next_error_library();
+        if (${lib}_error_init)
+                {
+                ${lib}_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(${lib}_lib_error_code,${lib}_str_functs);
+                ERR_load_strings(${lib}_lib_error_code,${lib}_str_reasons);
+#endif
+#ifdef ${lib}_LIB_NAME
+                ${lib}_lib_name->error = ERR_PACK(${lib}_lib_error_code,0,0);
+                ERR_load_strings(0,${lib}_lib_name);
+#endif
+                }
+        }
+${staticloader}void ERR_unload_${lib}_strings(void)
+        {
+        if (${lib}_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(${lib}_lib_error_code,${lib}_str_functs);
+                ERR_unload_strings(${lib}_lib_error_code,${lib}_str_reasons);
+#endif
+#ifdef ${lib}_LIB_NAME
+                ERR_unload_strings(0,${lib}_lib_name);
+#endif
+                ${lib}_error_init=1;
+                }
+        }
+${staticloader}void ERR_${lib}_error(int function, int reason, char *file, int line)
+        {
+        if (${lib}_lib_error_code == 0)
+                ${lib}_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(${lib}_lib_error_code,function,reason,file,line);
+        }
+EOF
+}
+        close OUT;
+        undef %err_reason_strings;
+}
+if($debug && defined(%notrans)) {
+        print STDERR "The following function codes were not translated:\n";
+        foreach(sort keys %notrans)
+        {
+                print STDERR "$_\n";
+        }
+}
+# Make a list of unreferenced function and reason codes
+foreach (keys %fcodes) {
+        push (@funref, $_) unless exists $ufcodes{$_};
+}
+foreach (keys %rcodes) {
+        push (@runref, $_) unless exists $urcodes{$_};
+}
+if($debug && defined(@funref) ) {
+        print STDERR "The following function codes were not referenced:\n";
+        foreach(sort @funref)
+        {
+                print STDERR "$_\n";
+        }
+}
+if($debug && defined(@runref) ) {
+        print STDERR "The following reason codes were not referenced:\n";
+        foreach(sort @runref)
+        {
+                print STDERR "$_\n";
+        }
+}
diff --git a/src/lib/libcrypto/util/mkfiles.pl b/src/lib/libcrypto/util/mkfiles.pl
index bc78510f56..928a274303 100644
--- a/src/lib/libcrypto/util/mkfiles.pl
+++ b/src/lib/libcrypto/util/mkfiles.pl
@@ -51,15 +51,14 @@ my @dirs = (
 "crypto/ocsp",
 "crypto/ui",
 "crypto/krb5",
-"fips-1.0",
+"fips",
-"fips-1.0/aes",
+"fips/aes",
-"fips-1.0/des",
+"fips/des",
-"fips-1.0/dsa",
+"fips/dsa",
-"fips-1.0/dh",
+"fips/dh",
-"fips-1.0/hmac",
+"fips/rand",
-"fips-1.0/rand",
+"fips/rsa",
-"fips-1.0/rsa",
+"fips/sha1",
-"fips-1.0/sha",
 "ssl",
 "apps",
 "test",
diff --git a/src/lib/libcrypto/util/mklink.pl b/src/lib/libcrypto/util/mklink.pl
index 182732d959..c8653cecc3 100644
--- a/src/lib/libcrypto/util/mklink.pl
+++ b/src/lib/libcrypto/util/mklink.pl
@@ -14,16 +14,13 @@
 # not contain symbolic links and that the parent of / is never referenced.
 # Apart from this, this script should be able to handle even the most
 # pathological cases.
-#
-use Cwd;
 my $from = shift;
 my @files = @ARGV;
 my @from_path = split(/[\\\/]/, $from);
-my $pwd = getcwd();
+my $pwd = `pwd`;
-chomp($pwd);
+chop($pwd);
 my @pwd_path = split(/[\\\/]/, $pwd);
 my @to_path = ();
diff --git a/src/lib/libcrypto/util/mkstack.pl b/src/lib/libcrypto/util/mkstack.pl
new file mode 100644
index 0000000000..0ca9eb6a76
--- /dev/null
+++ b/src/lib/libcrypto/util/mkstack.pl
@@ -0,0 +1,125 @@
+#!/usr/local/bin/perl -w
+# This is a utility that searches out "DECLARE_STACK_OF()"
+# declarations in .h and .c files, and updates/creates/replaces
+# the corresponding macro declarations in crypto/stack/safestack.h.
+# As it's not generally possible to have macros that generate macros,
+# we need to control this from the "outside", here in this script.
+#
+# Geoff Thorpe, June, 2000 (with massive Perl-hacking
+#                           help from Steve Robb)
+my $safestack = "crypto/stack/safestack";
+my $do_write;
+while (@ARGV) {
+        my $arg = $ARGV[0];
+        if($arg eq "-write") {
+                $do_write = 1;
+        }
+        shift @ARGV;
+}
+@source = (<crypto/*.[ch]>, <crypto/*/*.[ch]>, <ssl/*.[ch]>);
+foreach $file (@source) {
+        next if -l $file;
+        # Open the .c/.h file for reading
+        open(IN, "< $file") || die "Can't open $file for reading: $!";
+        while(<IN>) {
+                if (/^DECLARE_STACK_OF\(([^)]+)\)/) {
+                        push @stacklst, $1;
+                } if (/^DECLARE_ASN1_SET_OF\(([^)]+)\)/) {
+                        push @asn1setlst, $1;
+                } if (/^DECLARE_PKCS12_STACK_OF\(([^)]+)\)/) {
+                        push @p12stklst, $1;
+                }
+        }
+        close(IN);
+}
+my $old_stackfile = "";
+my $new_stackfile = "";
+my $inside_block = 0;
+my $type_thing;
+open(IN, "< $safestack.h") || die "Can't open input file: $!";
+while(<IN>) {
+        $old_stackfile .= $_;
+        if (m|^/\* This block of defines is updated by util/mkstack.pl, please do not touch! \*/|) {
+                $inside_block = 1;
+        }
+        if (m|^/\* End of util/mkstack.pl block, you may now edit :-\) \*/|) {
+                $inside_block = 0;
+        } elsif ($inside_block == 0) {
+                $new_stackfile .= $_;
+        }
+        next if($inside_block != 1);
+        $new_stackfile .= "/* This block of defines is updated by util/mkstack.pl, please do not touch! */";
+                
+        foreach $type_thing (sort @stacklst) {
+                $new_stackfile .= <<EOF;
+#define sk_${type_thing}_new(st) SKM_sk_new($type_thing, (st))
+#define sk_${type_thing}_new_null() SKM_sk_new_null($type_thing)
+#define sk_${type_thing}_free(st) SKM_sk_free($type_thing, (st))
+#define sk_${type_thing}_num(st) SKM_sk_num($type_thing, (st))
+#define sk_${type_thing}_value(st, i) SKM_sk_value($type_thing, (st), (i))
+#define sk_${type_thing}_set(st, i, val) SKM_sk_set($type_thing, (st), (i), (val))
+#define sk_${type_thing}_zero(st) SKM_sk_zero($type_thing, (st))
+#define sk_${type_thing}_push(st, val) SKM_sk_push($type_thing, (st), (val))
+#define sk_${type_thing}_unshift(st, val) SKM_sk_unshift($type_thing, (st), (val))
+#define sk_${type_thing}_find(st, val) SKM_sk_find($type_thing, (st), (val))
+#define sk_${type_thing}_delete(st, i) SKM_sk_delete($type_thing, (st), (i))
+#define sk_${type_thing}_delete_ptr(st, ptr) SKM_sk_delete_ptr($type_thing, (st), (ptr))
+#define sk_${type_thing}_insert(st, val, i) SKM_sk_insert($type_thing, (st), (val), (i))
+#define sk_${type_thing}_set_cmp_func(st, cmp) SKM_sk_set_cmp_func($type_thing, (st), (cmp))
+#define sk_${type_thing}_dup(st) SKM_sk_dup($type_thing, st)
+#define sk_${type_thing}_pop_free(st, free_func) SKM_sk_pop_free($type_thing, (st), (free_func))
+#define sk_${type_thing}_shift(st) SKM_sk_shift($type_thing, (st))
+#define sk_${type_thing}_pop(st) SKM_sk_pop($type_thing, (st))
+#define sk_${type_thing}_sort(st) SKM_sk_sort($type_thing, (st))
+#define sk_${type_thing}_is_sorted(st) SKM_sk_is_sorted($type_thing, (st))
+EOF
+        }
+        foreach $type_thing (sort @asn1setlst) {
+                $new_stackfile .= <<EOF;
+#define d2i_ASN1_SET_OF_${type_thing}(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \\
+        SKM_ASN1_SET_OF_d2i($type_thing, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class)) 
+#define i2d_ASN1_SET_OF_${type_thing}(st, pp, i2d_func, ex_tag, ex_class, is_set) \\
+        SKM_ASN1_SET_OF_i2d($type_thing, (st), (pp), (i2d_func), (ex_tag), (ex_class), (is_set))
+#define ASN1_seq_pack_${type_thing}(st, i2d_func, buf, len) \\
+        SKM_ASN1_seq_pack($type_thing, (st), (i2d_func), (buf), (len))
+#define ASN1_seq_unpack_${type_thing}(buf, len, d2i_func, free_func) \\
+        SKM_ASN1_seq_unpack($type_thing, (buf), (len), (d2i_func), (free_func))
+EOF
+        }
+        foreach $type_thing (sort @p12stklst) {
+                $new_stackfile .= <<EOF;
+#define PKCS12_decrypt_d2i_${type_thing}(algor, d2i_func, free_func, pass, passlen, oct, seq) \\
+        SKM_PKCS12_decrypt_d2i($type_thing, (algor), (d2i_func), (free_func), (pass), (passlen), (oct), (seq))
+EOF
+        }
+        $new_stackfile .= "/* End of util/mkstack.pl block, you may now edit :-) */\n";
+        $inside_block = 2;
+}
+if ($new_stackfile eq $old_stackfile) {
+        print "No changes to $safestack.h.\n";
+        exit 0; # avoid unnecessary rebuild
+}
+if ($do_write) {
+        print "Writing new $safestack.h.\n";
+        open OUT, ">$safestack.h" || die "Can't open output file";
+        print OUT $new_stackfile;
+        close OUT;
+}
diff --git a/src/lib/libcrypto/util/pl/BC-32.pl b/src/lib/libcrypto/util/pl/BC-32.pl
index 28869c868d..897ae9d824 100644
--- a/src/lib/libcrypto/util/pl/BC-32.pl
+++ b/src/lib/libcrypto/util/pl/BC-32.pl
@@ -18,7 +18,7 @@ $out_def="out32";
 $tmp_def="tmp32";
 $inc_def="inc32";
 #enable max error messages, disable most common warnings
-$cflags="-DWIN32_LEAN_AND_MEAN -q -w-ccc -w-rch -w-pia -w-aus -w-par -w-inl  -c -tWC -tWM -DOPENSSL_SYSNAME_WIN32 -DL_ENDIAN -DDSO_WIN32 -D_stricmp=stricmp -D_strnicmp=strnicmp ";
+$cflags="-DWIN32_LEAN_AND_MEAN -q -w-aus -w-par -w-inl  -c -tWC -tWM -DOPENSSL_SYSNAME_WIN32 -DL_ENDIAN -DDSO_WIN32 -D_stricmp=stricmp ";
 if ($debug)
 {
    $cflags.="-Od -y -v -vi- -D_DEBUG";
@@ -51,7 +51,7 @@ $lfile='';
 $shlib_ex_obj="";
 $app_ex_obj="c0x32.obj"; 
-$asm='nasmw -f obj -d__omf__';
+$asm='nasmw -f obj';
 $asm.=" /Zi" if $debug;
 $afile='-o';
@@ -106,13 +106,9 @@ sub do_lib_rule
        $ret.="$target: $objs\n";
        if (!$shlib)
                {
-                $ret.=<<___;
+                #               $ret.="\t\$(RM) \$(O_$Name)\n";
-        -\$(RM) $lfile$target
+                $ret.="\techo LIB $<\n";    
-        \$(MKLIB) $lfile$target \@&&!
+                $ret.="\t&\$(MKLIB) $lfile$target -+\$**\n";
-+\$(**: = &^
-+)
-!
-___
                }
        else
                {
diff --git a/src/lib/libcrypto/util/pl/OS2-EMX.pl b/src/lib/libcrypto/util/pl/OS2-EMX.pl
index 8dbeaa7a08..75d72ebbcb 100644
--- a/src/lib/libcrypto/util/pl/OS2-EMX.pl
+++ b/src/lib/libcrypto/util/pl/OS2-EMX.pl
@@ -68,7 +68,6 @@ if (!$no_asm && !$fips)
        $sha1_asm_src="crypto/sha/asm/s1-os2.asm";
        $rmd160_asm_obj="crypto/ripemd/asm/rm-os2$obj";
        $rmd160_asm_src="crypto/ripemd/asm/rm-os2.asm";
-        $cflags.=" -DBN_ASM -DMD5_ASM -DSHA1_ASM -DOPENSSL_BN_ASM_PART_WORDS";
        }
 if ($shlib)
diff --git a/src/lib/libcrypto/util/pl/VC-32.pl b/src/lib/libcrypto/util/pl/VC-32.pl
index 4e97dfa9af..cf689b9feb 100644
--- a/src/lib/libcrypto/util/pl/VC-32.pl
+++ b/src/lib/libcrypto/util/pl/VC-32.pl
@@ -3,28 +3,15 @@
 #
 $ssl=   "ssleay32";
+$crypto="libeay32";
-if ($fips && !$shlib)
-        {
-        $crypto="libeayfips32";
-        $crypto_compat = "libeaycompat32.lib";
-        }
-else
-        {
-        $crypto="libeay32";
-        }
 $o='\\';
 $cp='copy nul+';        # Timestamps get stuffed otherwise
 $rm='del';
-$zlib_lib="zlib1.lib";
 # C compiler stuff
 $cc='cl';
-$cflags=' /MD /W3 /WX /Ox /O2 /Ob2 /Gs0 /GF /Gy /nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32';
+$cflags=' /MD /W3 /WX /G5 /Ox /O2 /Ob2 /Gs0 /GF /Gy /nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32';
-$cflags.=' -D_CRT_SECURE_NO_DEPRECATE';         # shut up VC8
-$cflags.=' -D_CRT_NONSTDC_NO_DEPRECATE';        # shut up VC8
 $lflags="/nologo /subsystem:console /machine:I386 /opt:ref";
 $mlflags='';
@@ -113,56 +100,25 @@ $cflags.=" /Fd$out_def";
 sub do_lib_rule
        {
-        local($objs,$target,$name,$shlib,$ign,$base_addr) = @_;
+        local($objs,$target,$name,$shlib)=@_;
        local($ret,$Name);
        $taget =~ s/\//$o/g if $o ne '/';
        ($Name=$name) =~ tr/a-z/A-Z/;
-        my $base_arg;
-        if ($base_addr ne "")
-                {
-                $base_arg= " /base:$base_addr";
-                }
-        else
-                {
-                $base_arg = "";
-                }
 #       $target="\$(LIB_D)$o$target";
+        $ret.="$target: $objs\n";
        if (!$shlib)
                {
 #               $ret.="\t\$(RM) \$(O_$Name)\n";
-                $ret.="$target: $objs\n";
                $ex =' advapi32.lib';
-                $ex.=" \$(FIPSLIB_D)${o}_chkstk.o" if $fips && $target =~ /O_CRYPTO/;
                $ret.="\t\$(MKLIB) $lfile$target @<<\n  $objs $ex\n<<\n";
                }
        else
                {
                local($ex)=($target =~ /O_SSL/)?' $(L_CRYPTO)':'';
-                $ex.=' wsock32.lib gdi32.lib advapi32.lib user32.lib';
+                $ex.=' wsock32.lib gdi32.lib advapi32.lib';
-                $ex.=" $zlib_lib" if $zlib_opt == 1 && $target =~ /O_CRYPTO/;
+                $ret.="\t\$(LINK) \$(MLFLAGS) $efile$target /def:ms/${Name}.def @<<\n  \$(SHLIB_EX_OBJ) $objs $ex\n<<\n";
-                if ($fips && $target =~ /O_CRYPTO/)
-                        {
-                        $ex.=" \$(FIPSLIB_D)${o}_chkstk.o";
-                        $ret.="$target: $objs \$(PREMAIN_DSO_EXE)\n";
-                        $ret.="\tSET FIPS_LINK=\$(LINK)\n";
-                        $ret.="\tSET FIPS_CC=\$(CC)\n";
-                        $ret.="\tSET FIPS_CC_ARGS=/Fo\$(OBJ_D)${o}fips_premain.obj \$(SHLIB_CFLAGS) -c\n";
-                        $ret.="\tSET PREMAIN_DSO_EXE=\$(PREMAIN_DSO_EXE)\n";
-                        $ret.="\tSET FIPS_SHA1_EXE=\$(FIPS_SHA1_EXE)\n";
-                        $ret.="\tSET FIPS_TARGET=$target\n";
-                        $ret.="\tSET FIPSLIB_D=\$(FIPSLIB_D)\n";
-                        $ret.="\t\$(FIPSLINK) \$(MLFLAGS) $base_arg $efile$target ";
-                        $ret.="/def:ms/${Name}.def @<<\n  \$(SHLIB_EX_OBJ) $objs ";
-                        $ret.="\$(OBJ_D)${o}fips_premain.obj $ex\n<<\n";
-                        }
-                else
-                        {
-                        $ret.="$target: $objs\n";
-                        $ret.="\t\$(LINK) \$(MLFLAGS) $base_arg $efile$target /def:ms/${Name}.def @<<\n  \$(SHLIB_EX_OBJ) $objs $ex\n<<\n";
-                        }
                }
        $ret.="\n";
        return($ret);
@@ -170,51 +126,20 @@ sub do_lib_rule
 sub do_link_rule
        {
-        local($target,$files,$dep_libs,$libs,$standalone)=@_;
+        local($target,$files,$dep_libs,$libs,$sha1file,$openssl)=@_;
        local($ret,$_);
+        
        $file =~ s/\//$o/g if $o ne '/';
        $n=&bname($targer);
        $ret.="$target: $files $dep_libs\n";
-        if ($standalone)
+        $ret.="  \$(LINK) \$(LFLAGS) $efile$target @<<\n";
-                {
+        $ret.="  \$(APP_EX_OBJ) $files $libs\n<<\n";
-                $ret.="  \$(LINK) \$(LFLAGS) $efile$target @<<\n\t";
+        if (defined $sha1file)
-                $ret.="\$(FIPSLIB_D)${o}_chkstk.o " if ($files =~ /O_FIPSCANISTER/);
-                $ret.="$files $libs\n<<\n";
-                }
-        elsif ($fips && !$shlib)
                {
-                $ret.="\tSET FIPS_LINK=\$(LINK)\n";
+                $ret.="  $openssl sha1 -hmac etaonrishdlcupfm -binary $target > $sha1file";
-                $ret.="\tSET FIPS_CC=\$(CC)\n";
-                $ret.="\tSET FIPS_CC_ARGS=/Fo\$(OBJ_D)${o}fips_premain.obj \$(SHLIB_CFLAGS) -c\n";
-                $ret.="\tSET PREMAIN_DSO_EXE=\n";
-                $ret.="\tSET FIPS_TARGET=$target\n";
-                $ret.="\tSET FIPS_SHA1_EXE=\$(FIPS_SHA1_EXE)\n";
-                $ret.="\tSET FIPSLIB_D=\$(FIPSLIB_D)\n";
-                $ret.="  \$(FIPSLINK) \$(LFLAGS) $efile$target @<<\n";
-                $ret.="  \$(APP_EX_OBJ) $files \$(OBJ_D)${o}fips_premain.obj $libs\n<<\n";
                }
-        else
-                {
-                $ret.="  \$(LINK) \$(LFLAGS) $efile$target @<<\n";
-                $ret.="  \$(APP_EX_OBJ) $files $libs\n<<\n";
-                }
-        $ret.="\n";
-        return($ret);
-        }
-sub do_rlink_rule
-        {
-        local($target,$files,$dep_libs,$libs)=@_;
-        local($ret,$_);
-        $file =~ s/\//$o/g if $o ne '/';
-        $n=&bname($targer);
-        $ret.="$target: $files $dep_libs\n";
-        $ret.="  \$(MKCANISTER) $target <<\n";
-        $ret.="INPUT($files)\n<<\n";
        $ret.="\n";
        return($ret);
        }
 1;
diff --git a/src/lib/libcrypto/util/pod2man.pl b/src/lib/libcrypto/util/pod2man.pl
index 546d1ec186..657e4e264e 100644
--- a/src/lib/libcrypto/util/pod2man.pl
+++ b/src/lib/libcrypto/util/pod2man.pl
@@ -425,7 +425,6 @@ if ($name ne 'something') {
            }
            next if /^=cut\b/;  # DB_File and Net::Ping have =cut before NAME
            next if /^=pod\b/;  # It is OK to have =pod before NAME
-            next if /^=for\s+comment\b/;  # It is OK to have =for comment before NAME
            die "$0: Invalid man page - 1st pod line is not NAME in $ARGV[0]\n" unless $lax;
        }
        die "$0: Invalid man page - no documentation in $ARGV[0]\n" unless $lax;
diff --git a/src/lib/libcrypto/util/selftest.pl b/src/lib/libcrypto/util/selftest.pl
index 4778c5ab01..e9d5aa8938 100644
--- a/src/lib/libcrypto/util/selftest.pl
+++ b/src/lib/libcrypto/util/selftest.pl
@@ -49,7 +49,7 @@ if (open(IN,"<Makefile")) {
 }
 $cversion=`$cc -v 2>&1`;
-$cversion=`$cc -V 2>&1` if $cversion =~ "[Uu]sage";
+$cversion=`$cc -V 2>&1` if $cversion =~ "usage";
 $cversion=`$cc -V |head -1` if $cversion =~ "Error";
 $cversion=`$cc --version` if $cversion eq "";
 $cversion =~ s/Reading specs.*\n//;
@@ -130,21 +130,15 @@ if (system("make 2>&1 | tee make.log") > 255) {
    goto err;
 }
-# Not sure why this is here.  The tests themselves can detect if their
+$_=$options;
-# particular feature isn't included, and should therefore skip themselves.
+s/no-asm//;
-# To skip *all* tests just because one algorithm isn't included is like
+s/no-shared//;
-# shooting mosquito with an elephant gun...
+s/no-krb5//;
-#                   -- Richard Levitte, inspired by problem report 1089
+if (/no-/)
-#
+{
-#$_=$options;
+    print OUT "Test skipped.\n";
-#s/no-asm//;
+    goto err;
-#s/no-shared//;
+}
-#s/no-krb5//;
-#if (/no-/)
-#{
-#    print OUT "Test skipped.\n";
-#    goto err;
-#}
 print "Running make test...\n";
 if (system("make test 2>&1 | tee maketest.log") > 255)