21 files changed, 427 insertions, 202 deletions

diff --git a/.gitignore b/.gitignore
index 6c70806..471ca3a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,7 +92,6 @@ INSTALL
 /stamp-h2
 
 include/openssl/Makefile.am
-tests/Makefile.am
 
 crypto/VERSION
 ssl/VERSION
diff --git a/ChangeLog b/ChangeLog
index 9c21037..7c1bb29 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -28,6 +28,37 @@ history is also available from Git.
 
 LibreSSL Portable Release Notes:
 
+This release primarily addresses a number of security issues in coordination
+with the OpenSSL project.
+
+2.1.6 - Security update
+
+        * Fixes for the following issues are integrated into LibreSSL 2.1.6:
+          - CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error
+          - CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp
+          - CVE-2015-0287 - ASN.1 structure reuse memory corruption
+          - CVE-2015-0288 - X509_to_X509_REQ NULL pointer deref
+          - CVE-2015-0289 - PKCS7 NULL pointer dereferences
+
+        * The fix for CVE-2015-0207 - Segmentation fault in DTLSv1_listen
+          is integrated for safety, but LibreSSL is not vulnerable.
+
+        * Libtls is now built by default. The --enable-libtls
+          configuration option is no longer required.
+          The libtls API is now stable for the 2.1.x series.
+
+2.1.5 - Bug fixes and a security update
+        * Fix incorrect comparison function in openssl(1) certhash command.
+          Thanks to Christian Neukirchen / Void Linux.
+
+        * Windows port improvements and bug fixes.
+          - Removed a dependency on libgcc in 32-bit dynamic libraries.
+          - Correct a hang in openssl(1) reading from stdin on an connection.
+          - Initialize winsock in openssl(1) earlier, allow 'openssl ocsp' and
+            any other network-related commands to function properly.
+
+        * Reject all server DH keys smaller than 1024 bits.
+
 2.1.4 - Security and feature updates
         * Improvements to libtls:
           - a new API for loading CA chains directly from memory instead of a
diff --git a/Makefile.am b/Makefile.am
index 45aa9cc..d3011ec 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2,10 +2,6 @@ SUBDIRS = crypto ssl tls include apps tests man
 ACLOCAL_AMFLAGS = -I m4
 
 pkgconfigdir = $(libdir)/pkgconfig
-pkgconfig_DATA = libcrypto.pc libssl.pc openssl.pc
-
-if ENABLE_LIBTLS
-pkgconfig_DATA += libtls.pc
-endif
+pkgconfig_DATA = libcrypto.pc libssl.pc libtls.pc openssl.pc
 
 EXTRA_DIST = README README.windows VERSION config scripts
diff --git a/Makefile.am.common b/Makefile.am.common
index af20a0f..7a25d09 100644
--- a/Makefile.am.common
+++ b/Makefile.am.common
@@ -1,2 +1,2 @@
-AM_CPPFLAGS = -I$(top_srcdir)/include
-AM_CPPFLAGS += -DLIBRESSL_INTERNAL
+AM_CFLAGS = -I$(top_srcdir)/include
+AM_CPPFLAGS = -DLIBRESSL_INTERNAL
diff --git a/VERSION b/VERSION
index 7d2ed7c..ccbccc3 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.1.4
+2.2.0
diff --git a/apps/Makefile.am b/apps/Makefile.am
index 30978c1..3604349 100644
--- a/apps/Makefile.am
+++ b/apps/Makefile.am
@@ -2,7 +2,6 @@ include $(top_srcdir)/Makefile.am.common
 
 bin_PROGRAMS = openssl
 
-openssl_CFLAGS = $(USER_CFLAGS)
 openssl_LDADD = $(PLATFORM_LDADD) $(PROG_LDADD)
 openssl_LDADD += $(top_builddir)/ssl/libssl.la
 openssl_LDADD += $(top_builddir)/crypto/libcrypto.la
diff --git a/apps/poll_win.c b/apps/poll_win.c
index bf30ccf..ce47b01 100644
--- a/apps/poll_win.c
+++ b/apps/poll_win.c
@@ -44,6 +44,8 @@ conn_has_oob_data(int fd)
 static int
 is_socket(int fd)
 {
+        if (fd < 3)
+                return 0;
         WSANETWORKEVENTS events;
         return (WSAEnumNetworkEvents((SOCKET)fd, NULL, &events) == 0);
 }
@@ -160,10 +162,6 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
         nfds_t i;
         int timespent_ms, looptime_ms;
 
-#define FD_IS_SOCKET (1 << 0)
-        int fd_state[FD_SETSIZE];
-        int num_fds;
-
         /*
          * select machinery
          */
@@ -190,14 +188,12 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
         FD_ZERO(&rfds);
         FD_ZERO(&wfds);
         FD_ZERO(&efds);
-        num_fds = 0;
         num_sockets = 0;
         num_handles = 0;
 
         for (i = 0; i < nfds; i++) {
-                if ((int)pfds[i].fd < 0) {
+                if ((int)pfds[i].fd < 0)
                         continue;
-                }
 
                 if (is_socket(pfds[i].fd)) {
                         if (num_sockets >= FD_SETSIZE) {
@@ -205,8 +201,6 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
                                 return -1;
                         }
 
-                        fd_state[num_fds] = FD_IS_SOCKET;
-
                         FD_SET(pfds[i].fd, &efds);
 
                         if (pfds[i].events &
@@ -229,8 +223,6 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
                         handles[num_handles++] =
                             (HANDLE)_get_osfhandle(pfds[i].fd);
                 }
-
-                num_fds++;
         }
 
         /*
@@ -254,21 +246,22 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
          * than simply triggering if there is space available.
          */
         timespent_ms = 0;
-        wait_rc = 0;
+        wait_rc = WAIT_FAILED;
 
-        if (timeout_ms < 0) {
+        if (timeout_ms < 0)
                 timeout_ms = INFINITE;
-        }
         looptime_ms = timeout_ms > 100 ? 100 : timeout_ms;
 
         do {
                 struct timeval tv = {0, looptime_ms * 1000};
+                int handle_signaled = 0;
 
                 /*
                  * Check if any file handles have signaled
                  */
                 if (num_handles) {
-                        wait_rc = WaitForMultipleObjects(num_handles, handles, FALSE, 0);
+                        wait_rc = WaitForMultipleObjects(num_handles, handles,
+                                        FALSE, 0);
                         if (wait_rc == WAIT_FAILED) {
                                 /*
                                  * The documentation for WaitForMultipleObjects
@@ -285,18 +278,20 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
                 /*
                  * If we signaled on a file handle, don't wait on the sockets.
                  */
-                if (wait_rc >= WAIT_OBJECT_0)
+                if (wait_rc >= WAIT_OBJECT_0 &&
+                    (wait_rc <= WAIT_OBJECT_0 + num_handles - 1)) {
                         tv.tv_usec = 0;
+                        handle_signaled = 1;
+                }
 
                 /*
                  * Check if any sockets have signaled
                  */
                 rc = select(0, &rfds, &wfds, &efds, &tv);
-                if (rc == SOCKET_ERROR) {
+                if (!handle_signaled && rc == SOCKET_ERROR)
                         return wsa_select_errno(WSAGetLastError());
-                }
 
-                if (wait_rc >= WAIT_OBJECT_0 || (num_sockets && rc > 0))
+                if (handle_signaled || (num_sockets && rc > 0))
                         break;
 
                 timespent_ms += looptime_ms;
@@ -305,14 +300,14 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
 
         rc = 0;
         num_handles = 0;
-        num_fds = 0;
         for (i = 0; i < nfds; i++) {
                 pfds[i].revents = 0;
 
                 if ((int)pfds[i].fd < 0)
                         continue;
 
-                if (fd_state[num_fds] & FD_IS_SOCKET) {
+                if (is_socket(pfds[i].fd)) {
+
                         pfds[i].revents = compute_select_revents(pfds[i].fd,
                             pfds[i].events, &rfds, &wfds, &efds);
 
@@ -323,8 +318,6 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
                         num_handles++;
                 }
 
-                num_fds++;
-
                 if (pfds[i].revents)
                         rc++;
         }
diff --git a/configure.ac b/configure.ac
index bd370d6..b246808 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,10 +9,18 @@ AC_CONFIG_MACRO_DIR([m4])
 
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
-AC_SUBST([USER_CFLAGS], "-O2 $CFLAGS")
-CFLAGS="$CFLAGS -Wall -std=gnu99 -g"
+AC_PROG_CC
+AC_PROG_CC_STDC
+AM_PROG_CC_C_O
+AC_PROG_LIBTOOL
+LT_INIT
+
+CFLAGS="$CFLAGS -Wall -std=gnu99"
 
 case $host_os in
+        *cygwin*)
+                HOST_OS=cygwin
+                ;;
         *darwin*)
                 HOST_OS=darwin
                 HOST_ABI=macosx
@@ -24,13 +32,14 @@ case $host_os in
                 ;;
         *hpux*)
                 HOST_OS=hpux;
-                CFLAGS="$CFLAGS -mlp64 -D_XOPEN_SOURCE=600 -D__STRICT_ALIGNMENT"
+                CFLAGS="$CFLAGS -mlp64"
+                CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D__STRICT_ALIGNMENT"
                 AC_SUBST([PLATFORM_LDADD], ['-lpthread'])
                 ;;
         *linux*)
                 HOST_OS=linux
                 HOST_ABI=elf
-                CFLAGS="$CFLAGS -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -D_GNU_SOURCE"
+                CPPFLAGS="$CPPFLAGS -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -D_GNU_SOURCE"
                 ;;
         *netbsd*)
                 HOST_OS=netbsd
@@ -42,18 +51,24 @@ case $host_os in
                 ;;
         *mingw*)
                 HOST_OS=win
-                CFLAGS="$CFLAGS -D_GNU_SOURCE -D_POSIX -D_POSIX_SOURCE -D_REENTRANT -D_POSIX_THREAD_SAFE_FUNCTIONS -DWIN32_LEAN_AND_MEAN -D_WIN32_WINNT=0x0600 -DOPENSSL_NO_SPEED -DNO_SYSLOG -D__USE_MINGW_ANSI_STDIO"
+                CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE -D_POSIX -D_POSIX_SOURCE -D__USE_MINGW_ANSI_STDIO"
+                CPPFLAGS="$CPPFLAGS -D_REENTRANT -D_POSIX_THREAD_SAFE_FUNCTIONS"
+                CPPFLAGS="$CPPFLAGS -DWIN32_LEAN_AND_MEAN -D_WIN32_WINNT=0x0600"
+                CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_SPEED -DNO_SYSLOG"
+                CFLAGS="$CFLAGS -static-libgcc"
+                LDFLAGS="$LDFLAGS -static-libgcc"
                 AC_SUBST([PLATFORM_LDADD], ['-lws2_32'])
                 ;;
         *solaris*)
                 HOST_OS=solaris
                 HOST_ABI=elf
-                CFLAGS="$CFLAGS -D__EXTENSIONS__ -D_XOPEN_SOURCE=600 -DBSD_COMP"
+                CPPFLAGS="$CPPFLAGS -D__EXTENSIONS__ -D_XOPEN_SOURCE=600 -DBSD_COMP"
                 AC_SUBST([PLATFORM_LDADD], ['-lnsl -lsocket'])
                 ;;
         *) ;;
 esac
 
+AM_CONDITIONAL([HOST_CYGWIN],  [test x$HOST_OS = xcygwin])
 AM_CONDITIONAL([HOST_DARWIN],  [test x$HOST_OS = xdarwin])
 AM_CONDITIONAL([HOST_FREEBSD], [test x$HOST_OS = xfreebsd])
 AM_CONDITIONAL([HOST_HPUX],    [test x$HOST_OS = xhpux])
@@ -68,11 +83,6 @@ AC_CHECK_FUNC([clock_gettime],,
 AC_CHECK_FUNC([dl_iterate_phdr],,
         [AC_SEARCH_LIBS([dl_iterate_phdr],[dl])])
 
-AC_PROG_CC
-AC_PROG_LIBTOOL
-AC_PROG_CC_STDC
-AM_PROG_CC_C_O
-
 AC_MSG_CHECKING([if compiling with clang])
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [[
 #ifndef __clang__
@@ -85,6 +95,9 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [[
 AC_MSG_RESULT([$CLANG])
 AS_IF([test "x$CLANG" = "xyes"], [CLANG_FLAGS=-Qunused-arguments])
 
+CFLAGS="$CFLAGS $CLANG_FLAGS"
+LDFLAGS="$LDFLAGS $CLANG_FLAGS"
+
 # We want to check for compiler flag support. Prior to clang v5.1, there was no
 # way to make clang's "argument unused" warning fatal.  So we invoke the
 # compiler through a wrapper script that greps for this message.
@@ -201,9 +214,6 @@ __asm__(".section .note.GNU-stack,\"\",@progbits");]])],
 CFLAGS="$save_cflags $AM_CFLAGS"
 AM_PROG_AS
 
-CFLAGS="$CFLAGS $CLANG_CFLAGS"
-LDFLAGS="$LDFLAGS $CLANG_FLAGS"
-
 AC_CHECK_FUNCS([arc4random_buf asprintf explicit_bzero funopen getauxval])
 AC_CHECK_FUNCS([getentropy issetugid memmem poll reallocarray])
 AC_CHECK_FUNCS([strlcat strlcpy strndup strnlen strsep strtonum])
@@ -284,20 +294,28 @@ AC_ARG_ENABLE([asm],
         AS_HELP_STRING([--disable-asm], [Disable assembly]))
 AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"])
 
+AC_ARG_ENABLE([extratests],
+        AS_HELP_STRING([--enable-extratests], [Enable extra tests that may be unreliable on some platforms]))
+AM_CONDITIONAL([ENABLE_EXTRATESTS], [test "x$enable_extratests" = xyes])
+
 old_cflags=$CFLAGS
-CFLAGS="$old_cflags -I$srcdir/include"
+CFLAGS="$CFLAGS -I$srcdir/include"
+AC_MSG_CHECKING([if BSWAP4 builds without __STRICT_ALIGNMENT])
 AC_TRY_COMPILE([#include "$srcdir/crypto/modes/modes_lcl.h"],
                [int a = 0; BSWAP4(a);],
-               BSWAP4=yes, BSWAP4=no)
+               AC_MSG_RESULT([yes])
+               BSWAP4=yes,
+               AC_MSG_RESULT([no])
+               BSWAP4=no)
 CFLAGS="$old_cflags"
 
 case $host_cpu in
         *sparc*)
-                CFLAGS="$CFLAGS -D__STRICT_ALIGNMENT"
+                CPPFLAGS="$CPPFLAGS -D__STRICT_ALIGNMENT"
                 ;;
         *arm*)
                 AS_IF([test "x$BSWAP4" = "xyes"],,
-                    CFLAGS="$old_cflags -D__STRICT_ALIGNMENT")
+                    CPPFLAGS="$CPPFLAGS -D__STRICT_ALIGNMENT")
                 ;;
 esac
 
@@ -306,13 +324,6 @@ AM_CONDITIONAL([HOST_ASM_ELF_X86_64],
 AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64],
     [test "x$HOST_ABI" = "xmacosx" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"])
 
-AC_ARG_ENABLE([libtls],
-        AS_HELP_STRING([--enable-libtls], [Enable building the libtls library]))
-AM_CONDITIONAL([ENABLE_LIBTLS], [test "x$enable_libtls" = xyes])
-AM_COND_IF([ENABLE_LIBTLS], [AC_CONFIG_FILES([libtls.pc])])
-
-LT_INIT
-
 AC_CONFIG_FILES([
         Makefile
         include/Makefile
@@ -325,6 +336,7 @@ AC_CONFIG_FILES([
         man/Makefile
         libcrypto.pc
         libssl.pc
+        libtls.pc
         openssl.pc
 ])
 
diff --git a/crypto/Makefile.am b/crypto/Makefile.am
index 5861a55..e350cda 100644
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -1,8 +1,8 @@
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1
-AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp
-AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes
+AM_CFLAGS += -I$(top_srcdir)/crypto/asn1
+AM_CFLAGS += -I$(top_srcdir)/crypto/evp
+AM_CFLAGS += -I$(top_srcdir)/crypto/modes
 
 lib_LTLIBRARIES = libcrypto.la
 
@@ -10,13 +10,12 @@ EXTRA_DIST = VERSION
 
 libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined
 libcrypto_la_LIBADD = libcompat.la libcompatnoopt.la
-libcrypto_la_CFLAGS = $(CFLAGS) $(USER_CFLAGS)
-libcrypto_la_CFLAGS += -DOPENSSL_NO_HW_PADLOCK
+libcrypto_la_CPPFLAGS = -DOPENSSL_NO_HW_PADLOCK
 if OPENSSL_NO_ASM
-libcrypto_la_CFLAGS += -DOPENSSL_NO_ASM
+libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM
 else
 if HOST_WIN
-libcrypto_la_CFLAGS += -DOPENSSL_NO_ASM
+libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM
 endif
 endif
 
@@ -31,7 +30,6 @@ libcompatnoopt_la_SOURCES += compat/explicit_bzero.c
 endif
 
 # other compatibility functions
-libcompat_la_CFLAGS = $(CFLAGS) $(USER_CFLAGS)
 libcompat_la_SOURCES =
 libcompat_la_LIBADD = $(PLATFORM_LDADD)
 
diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64
index 6257c40..44e08a1 100644
--- a/crypto/Makefile.am.elf-x86_64
+++ b/crypto/Makefile.am.elf-x86_64
@@ -22,20 +22,20 @@ ASM_X86_64_ELF += cpuid-elf-x86_64.S
 EXTRA_DIST += $(ASM_X86_64_ELF)
 
 if HOST_ASM_ELF_X86_64
-libcrypto_la_CFLAGS += -DAES_ASM
-libcrypto_la_CFLAGS += -DBSAES_ASM
-libcrypto_la_CFLAGS += -DVPAES_ASM
-libcrypto_la_CFLAGS += -DOPENSSL_IA32_SSE2
-libcrypto_la_CFLAGS += -DOPENSSL_BN_ASM_MONT
-libcrypto_la_CFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CFLAGS += -DOPENSSL_BN_ASM_GF2m
-libcrypto_la_CFLAGS += -DMD5_ASM
-libcrypto_la_CFLAGS += -DGHASH_ASM
-libcrypto_la_CFLAGS += -DRSA_ASM
-libcrypto_la_CFLAGS += -DSHA1_ASM
-libcrypto_la_CFLAGS += -DSHA256_ASM
-libcrypto_la_CFLAGS += -DSHA512_ASM
-libcrypto_la_CFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CFLAGS += -DOPENSSL_CPUID_OBJ
+libcrypto_la_CPPFLAGS += -DAES_ASM
+libcrypto_la_CPPFLAGS += -DBSAES_ASM
+libcrypto_la_CPPFLAGS += -DVPAES_ASM
+libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
+libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
+libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
+libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_GF2m
+libcrypto_la_CPPFLAGS += -DMD5_ASM
+libcrypto_la_CPPFLAGS += -DGHASH_ASM
+libcrypto_la_CPPFLAGS += -DRSA_ASM
+libcrypto_la_CPPFLAGS += -DSHA1_ASM
+libcrypto_la_CPPFLAGS += -DSHA256_ASM
+libcrypto_la_CPPFLAGS += -DSHA512_ASM
+libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
+libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
 libcrypto_la_SOURCES += $(ASM_X86_64_ELF)
 endif
diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64
index e361aae..bc2aaad 100644
--- a/crypto/Makefile.am.macosx-x86_64
+++ b/crypto/Makefile.am.macosx-x86_64
@@ -22,20 +22,20 @@ ASM_X86_64_MACOSX += cpuid-macosx-x86_64.S
 EXTRA_DIST += $(ASM_X86_64_MACOSX)
 
 if HOST_ASM_MACOSX_X86_64
-libcrypto_la_CFLAGS += -DAES_ASM
-libcrypto_la_CFLAGS += -DBSAES_ASM
-libcrypto_la_CFLAGS += -DVPAES_ASM
-libcrypto_la_CFLAGS += -DOPENSSL_IA32_SSE2
-libcrypto_la_CFLAGS += -DOPENSSL_BN_ASM_MONT
-libcrypto_la_CFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CFLAGS += -DOPENSSL_BN_ASM_GF2m
-libcrypto_la_CFLAGS += -DMD5_ASM
-libcrypto_la_CFLAGS += -DGHASH_ASM
-libcrypto_la_CFLAGS += -DRSA_ASM
-libcrypto_la_CFLAGS += -DSHA1_ASM
-libcrypto_la_CFLAGS += -DSHA256_ASM
-libcrypto_la_CFLAGS += -DSHA512_ASM
-libcrypto_la_CFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CFLAGS += -DOPENSSL_CPUID_OBJ
+libcrypto_la_CPPFLAGS += -DAES_ASM
+libcrypto_la_CPPFLAGS += -DBSAES_ASM
+libcrypto_la_CPPFLAGS += -DVPAES_ASM
+libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
+libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
+libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
+libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_GF2m
+libcrypto_la_CPPFLAGS += -DMD5_ASM
+libcrypto_la_CPPFLAGS += -DGHASH_ASM
+libcrypto_la_CPPFLAGS += -DRSA_ASM
+libcrypto_la_CPPFLAGS += -DSHA1_ASM
+libcrypto_la_CPPFLAGS += -DSHA256_ASM
+libcrypto_la_CPPFLAGS += -DSHA512_ASM
+libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
+libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
 libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX)
 endif
diff --git a/dist-win.sh b/dist-win.sh
index d600b97..cfb6414 100755
--- a/dist-win.sh
+++ b/dist-win.sh
@@ -8,6 +8,7 @@ DIST=libressl-$VERSION-windows
 
 rm -fr $DIST
 mkdir -p $DIST
+autoreconf -i
 
 for ARCH in X86 X64; do
 
@@ -21,7 +22,7 @@ for ARCH in X86 X64; do
 
         echo Building for $HOST
 
-        CC=$HOST-gcc ./configure --host=$HOST --enable-libtls
+        CC=$HOST-gcc ./configure --host=$HOST
         make clean
         PATH=$PATH:/usr/$HOST/sys-root/mingw/bin \
            make -j 4 check
diff --git a/dist.sh b/dist.sh
index 27bd40a..ff740b7 100755
--- a/dist.sh
+++ b/dist.sh
@@ -3,5 +3,5 @@ set -e
 
 rm -f man/*.1 man/*.3
 ./autogen.sh
-./configure --enable-libtls
+./configure
 make distcheck
diff --git a/gen-coverage-report.sh b/gen-coverage-report.sh
index f99bd8e..1a199cf 100755
--- a/gen-coverage-report.sh
+++ b/gen-coverage-report.sh
@@ -20,7 +20,7 @@ find -name '*.gcda' -o -name '*.gcno' -delete
 rm -fr $DESTDIR
 
 echo "Configuring to build with code coverage support"
-./configure --enable-libtls CFLAGS='-O0 -fprofile-arcs -ftest-coverage'
+./configure CFLAGS='-O0 -fprofile-arcs -ftest-coverage'
 
 echo "Running all code paths"
 make clean
diff --git a/include/Makefile.am b/include/Makefile.am
index 31cc0ab..7e1ece2 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -28,6 +28,4 @@ noinst_HEADERS += sys/times.h
 noinst_HEADERS += sys/types.h
 noinst_HEADERS += sys/uio.h
 
-if ENABLE_LIBTLS
 include_HEADERS = tls.h
-endif
diff --git a/scripts/travis b/scripts/travis
index c52be79..091f37d 100755
--- a/scripts/travis
+++ b/scripts/travis
@@ -4,7 +4,7 @@ set -e
 ./autogen.sh
 
 if [ "x$ARCH" = "xnative" ]; then
-        ./configure --enable-libtls
+        ./configure
         if [ `uname` = "Darwin" ]; then
                 # OS X runs out of resources if we run 'make -j check'
                 make check
@@ -28,6 +28,6 @@ else
                 export PATH=$PATH:/opt/$ARCH/bin
         fi
 
-        ./configure --host=$CPU-w64-mingw32 --enable-libtls
+        ./configure --host=$CPU-w64-mingw32
         make -j
 fi
diff --git a/ssl/Makefile.am b/ssl/Makefile.am
index 7d66795..db60775 100644
--- a/ssl/Makefile.am
+++ b/ssl/Makefile.am
@@ -5,7 +5,6 @@ lib_LTLIBRARIES = libssl.la
 EXTRA_DIST = VERSION
 
 libssl_la_LDFLAGS = -version-info @LIBSSL_VERSION@ -no-undefined
-libssl_la_CFLAGS = $(CFLAGS) $(USER_CFLAGS)
 libssl_la_LIBADD = ../crypto/libcrypto.la
 
 libssl_la_SOURCES = bio_ssl.c
diff --git a/tests/Makefile.am b/tests/Makefile.am
new file mode 100644
index 0000000..2ed7a44
--- /dev/null
+++ b/tests/Makefile.am
@@ -0,0 +1,282 @@
+include $(top_srcdir)/Makefile.am.common
+
+AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes
+AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1
+AM_CPPFLAGS += -I $(top_srcdir)/ssl
+
+LDADD = $(PLATFORM_LDADD) $(PROG_LDADD)
+LDADD += $(top_builddir)/ssl/libssl.la
+LDADD += $(top_builddir)/crypto/libcrypto.la
+
+TESTS =
+check_PROGRAMS =
+EXTRA_DIST =
+DISTCLEANFILES = pidwraptest.txt
+
+# aeadtest
+TESTS += aeadtest.sh
+check_PROGRAMS += aeadtest
+aeadtest_SOURCES = aeadtest.c
+EXTRA_DIST += aeadtest.sh
+EXTRA_DIST += aeadtests.txt
+
+# aes_wrap
+TESTS += aes_wrap
+check_PROGRAMS += aes_wrap
+aes_wrap_SOURCES = aes_wrap.c
+
+# arc4randomforktest
+# Windows/mingw does not have fork, but Cygwin does.
+if !HOST_WIN
+TESTS += arc4randomforktest.sh
+check_PROGRAMS += arc4randomforktest
+arc4randomforktest_SOURCES = arc4randomforktest.c
+endif
+EXTRA_DIST += arc4randomforktest.sh
+
+# asn1test
+TESTS += asn1test
+check_PROGRAMS += asn1test
+asn1test_SOURCES = asn1test.c
+
+# base64test
+TESTS += base64test
+check_PROGRAMS += base64test
+base64test_SOURCES = base64test.c
+
+# bftest
+TESTS += bftest
+check_PROGRAMS += bftest
+bftest_SOURCES = bftest.c
+
+# biotest
+# the BIO tests rely on resolver results that are OS and environment-specific
+if ENABLE_EXTRATESTS
+TESTS += biotest
+check_PROGRAMS += biotest
+biotest_SOURCES = biotest.c
+endif
+
+# bntest
+TESTS += bntest
+check_PROGRAMS += bntest
+bntest_SOURCES = bntest.c
+
+# bytestringtest
+TESTS += bytestringtest
+check_PROGRAMS += bytestringtest
+bytestringtest_SOURCES = bytestringtest.c
+
+# casttest
+TESTS += casttest
+check_PROGRAMS += casttest
+casttest_SOURCES = casttest.c
+
+# chachatest
+TESTS += chachatest
+check_PROGRAMS += chachatest
+chachatest_SOURCES = chachatest.c
+
+# cipherstest
+TESTS += cipherstest
+check_PROGRAMS += cipherstest
+cipherstest_SOURCES = cipherstest.c
+
+# cts128test
+TESTS += cts128test
+check_PROGRAMS += cts128test
+cts128test_SOURCES = cts128test.c
+
+# destest
+TESTS += destest
+check_PROGRAMS += destest
+destest_SOURCES = destest.c
+
+# dhtest
+TESTS += dhtest
+check_PROGRAMS += dhtest
+dhtest_SOURCES = dhtest.c
+
+# dsatest
+TESTS += dsatest
+check_PROGRAMS += dsatest
+dsatest_SOURCES = dsatest.c
+
+# ecdhtest
+TESTS += ecdhtest
+check_PROGRAMS += ecdhtest
+ecdhtest_SOURCES = ecdhtest.c
+
+# ecdsatest
+TESTS += ecdsatest
+check_PROGRAMS += ecdsatest
+ecdsatest_SOURCES = ecdsatest.c
+
+# ectest
+TESTS += ectest
+check_PROGRAMS += ectest
+ectest_SOURCES = ectest.c
+
+# enginetest
+TESTS += enginetest
+check_PROGRAMS += enginetest
+enginetest_SOURCES = enginetest.c
+
+# evptest
+TESTS += evptest.sh
+check_PROGRAMS += evptest
+evptest_SOURCES = evptest.c
+EXTRA_DIST += evptest.sh
+EXTRA_DIST += evptests.txt
+
+# explicit_bzero
+# explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows
+if !HOST_WIN
+if !HOST_CYGWIN
+TESTS += explicit_bzero
+check_PROGRAMS += explicit_bzero
+explicit_bzero_SOURCES = explicit_bzero.c
+if !HAVE_MEMMEM
+explicit_bzero_SOURCES += memmem.c
+endif
+endif
+endif
+
+# exptest
+TESTS += exptest
+check_PROGRAMS += exptest
+exptest_SOURCES = exptest.c
+
+# gcm128test
+TESTS += gcm128test
+check_PROGRAMS += gcm128test
+gcm128test_SOURCES = gcm128test.c
+
+# gost2814789t
+TESTS += gost2814789t
+check_PROGRAMS += gost2814789t
+gost2814789t_SOURCES = gost2814789t.c
+
+# hmactest
+TESTS += hmactest
+check_PROGRAMS += hmactest
+hmactest_SOURCES = hmactest.c
+
+# ideatest
+TESTS += ideatest
+check_PROGRAMS += ideatest
+ideatest_SOURCES = ideatest.c
+
+# igetest
+TESTS += igetest
+check_PROGRAMS += igetest
+igetest_SOURCES = igetest.c
+
+# md4test
+TESTS += md4test
+check_PROGRAMS += md4test
+md4test_SOURCES = md4test.c
+
+# md5test
+TESTS += md5test
+check_PROGRAMS += md5test
+md5test_SOURCES = md5test.c
+
+# mdc2test
+TESTS += mdc2test
+check_PROGRAMS += mdc2test
+mdc2test_SOURCES = mdc2test.c
+
+# mont
+TESTS += mont
+check_PROGRAMS += mont
+mont_SOURCES = mont.c
+
+# pbkdf2
+TESTS += pbkdf2
+check_PROGRAMS += pbkdf2
+pbkdf2_SOURCES = pbkdf2.c
+
+# pidwraptest
+# pidwraptest relies on an OS-specific way to give out pids and is generally
+# awkward on systems with slow fork
+if ENABLE_EXTRATESTS
+TESTS += pidwraptest
+check_PROGRAMS += pidwraptest
+pidwraptest_SOURCES = pidwraptest.c
+endif
+
+# pkcs7test
+TESTS += pkcs7test
+check_PROGRAMS += pkcs7test
+pkcs7test_SOURCES = pkcs7test.c
+
+# poly1305test
+TESTS += poly1305test
+check_PROGRAMS += poly1305test
+poly1305test_SOURCES = poly1305test.c
+
+# pq_test
+TESTS += pq_test.sh
+check_PROGRAMS += pq_test
+pq_test_SOURCES = pq_test.c
+EXTRA_DIST += pq_test.sh
+EXTRA_DIST += pq_expected.txt
+
+# randtest
+TESTS += randtest
+check_PROGRAMS += randtest
+randtest_SOURCES = randtest.c
+
+# rc2test
+TESTS += rc2test
+check_PROGRAMS += rc2test
+rc2test_SOURCES = rc2test.c
+
+# rc4test
+TESTS += rc4test
+check_PROGRAMS += rc4test
+rc4test_SOURCES = rc4test.c
+
+# rmdtest
+TESTS += rmdtest
+check_PROGRAMS += rmdtest
+rmdtest_SOURCES = rmdtest.c
+
+# sha1test
+TESTS += sha1test
+check_PROGRAMS += sha1test
+sha1test_SOURCES = sha1test.c
+
+# sha256test
+TESTS += sha256test
+check_PROGRAMS += sha256test
+sha256test_SOURCES = sha256test.c
+
+# sha512test
+TESTS += sha512test
+check_PROGRAMS += sha512test
+sha512test_SOURCES = sha512test.c
+
+# shatest
+TESTS += shatest
+check_PROGRAMS += shatest
+shatest_SOURCES = shatest.c
+
+# ssltest
+TESTS += ssltest.sh
+check_PROGRAMS += ssltest
+ssltest_SOURCES = ssltest.c
+EXTRA_DIST += ssltest.sh
+EXTRA_DIST += testssl ca.pem server.pem
+
+# timingsafe
+TESTS += timingsafe
+check_PROGRAMS += timingsafe
+timingsafe_SOURCES = timingsafe.c
+
+# utf8test
+TESTS += utf8test
+check_PROGRAMS += utf8test
+utf8test_SOURCES = utf8test.c
+
diff --git a/tests/Makefile.am.tpl b/tests/Makefile.am.tpl
deleted file mode 100644
index 26334af..0000000
--- a/tests/Makefile.am.tpl
+++ /dev/null
@@ -1,15 +0,0 @@
-include $(top_srcdir)/Makefile.am.common
-
-AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes
-AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1
-AM_CPPFLAGS += -I $(top_srcdir)/ssl
-
-LDADD = $(PLATFORM_LDADD) $(PROG_LDADD)
-LDADD += $(top_builddir)/ssl/libssl.la
-LDADD += $(top_builddir)/crypto/libcrypto.la
-
-TESTS =
-check_PROGRAMS =
-EXTRA_DIST =
-DISTCLEANFILES = pidwraptest.txt
-
diff --git a/tls/Makefile.am b/tls/Makefile.am
index f0919a5..e8c4713 100644
--- a/tls/Makefile.am
+++ b/tls/Makefile.am
@@ -1,12 +1,10 @@
 include $(top_srcdir)/Makefile.am.common
 
-if ENABLE_LIBTLS
 lib_LTLIBRARIES = libtls.la
 
 EXTRA_DIST = VERSION
 
 libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined
-libtls_la_CFLAGS = $(CFLAGS) $(USER_CFLAGS)
 libtls_la_LIBADD = ../crypto/libcrypto.la ../ssl/libssl.la $(PLATFORM_LDADD)
 
 libtls_la_SOURCES = tls.c
@@ -20,5 +18,3 @@ noinst_HEADERS = tls_internal.h
 if !HAVE_STRSEP
 libtls_la_SOURCES += strsep.c
 endif
-
-endif
diff --git a/update.sh b/update.sh
index 29012ad..317b823 100755
--- a/update.sh
+++ b/update.sh
@@ -18,15 +18,15 @@ fi
  git pull --rebase)
 
 # setup source paths
-dir=`pwd`
-libc_src=$dir/openbsd/src/lib/libc
-libc_regress=$dir/openbsd/src/regress/lib/libc
-libcrypto_src=$dir/openbsd/src/lib/libcrypto
-libcrypto_regress=$dir/openbsd/src/regress/lib/libcrypto
-libssl_src=$dir/openbsd/src/lib/libssl
-libssl_regress=$dir/openbsd/src/regress/lib/libssl
-libtls_src=$dir/openbsd/src/lib/libtls
-openssl_app_src=$dir/openbsd/src/usr.bin/openssl
+CWD=`pwd`
+libc_src=$CWD/openbsd/src/lib/libc
+libc_regress=$CWD/openbsd/src/regress/lib/libc
+libcrypto_src=$CWD/openbsd/src/lib/libcrypto
+libcrypto_regress=$CWD/openbsd/src/regress/lib/libcrypto
+libssl_src=$CWD/openbsd/src/lib/libssl
+libssl_regress=$CWD/openbsd/src/regress/lib/libssl
+libtls_src=$CWD/openbsd/src/lib/libtls
+openssl_app_src=$CWD/openbsd/src/usr.bin/openssl
 
 # load library versions
 source $libcrypto_src/crypto/shlib_version
@@ -197,13 +197,14 @@ echo "copying tests"
 for i in `find $libcrypto_regress -name '*.c'`; do
          $CP "$i" tests
 done
-
-# the BIO tests rely on resolver results that are OS and environment-specific
-rm tests/biotest.c
+$CP $libcrypto_regress/evp/evptests.txt tests
+$CP $libcrypto_regress/aead/aeadtests.txt tests
+$CP $libcrypto_regress/pqueue/expected.txt tests/pq_expected.txt
 
 # copy libc tests
 $CP $libc_regress/arc4random-fork/arc4random-fork.c tests/arc4randomforktest.c
 $CP $libc_regress/explicit_bzero/explicit_bzero.c tests
+$CP $libc_src/string/memmem.c tests
 $CP $libc_regress/timingsafe/timingsafe.c tests
 
 # copy libssl tests
@@ -214,68 +215,9 @@ done
 $CP $libssl_regress/certs/ca.pem tests
 $CP $libssl_regress/certs/server.pem tests
 
-# setup test drivers
-# do not directly run all test programs
-test_drivers=(
-        aeadtest
-        evptest
-        pq_test
-        ssltest
-        arc4randomforktest
-        pidwraptest
-)
-tests_posix_only=(
-        arc4randomforktest
-        explicit_bzero
-        pidwraptest
-)
-$CP $libc_src/string/memmem.c tests/
-(cd tests
-        $CP Makefile.am.tpl Makefile.am
-
-        for i in `ls -1 *.c|sort|grep -v memmem.c`; do
-                TEST=`echo $i|sed -e "s/\.c//"`
-                if [[ ${tests_posix_only[*]} =~ "$TEST" ]]; then
-                        echo "if !HOST_WIN" >> Makefile.am
-                fi
-                if ! [[ ${test_drivers[*]} =~ "$TEST" ]]; then
-                        echo "TESTS += $TEST" >> Makefile.am
-                fi
-                echo "check_PROGRAMS += $TEST" >> Makefile.am
-                echo "${TEST}_SOURCES = $i" >> Makefile.am
-                if [[ ${TEST} = "explicit_bzero" ]]; then
-                        echo "if !HAVE_MEMMEM" >> Makefile.am
-                        echo "explicit_bzero_SOURCES += memmem.c" >> Makefile.am
-                        echo "endif" >> Makefile.am
-                fi
-                if [[ ${tests_posix_only[*]} =~ "$TEST" ]]; then
-                        echo "endif" >> Makefile.am
-                fi
-        done
-)
-$CP $libcrypto_regress/evp/evptests.txt tests
-$CP $libcrypto_regress/aead/aeadtests.txt tests
-$CP $libcrypto_regress/pqueue/expected.txt tests/pq_expected.txt
 chmod 755 tests/testssl
-for i in "${test_drivers[@]}"; do
-        if [ -e tests/${i}.sh ]; then
-                if [[ ${tests_posix_only[*]} =~ "$i" ]]; then
-                        echo "if !HOST_WIN" >> tests/Makefile.am
-                fi
-                if ! [[ ${tests_disabled[*]} =~ "$i" ]]; then
-                        echo "TESTS += ${i}.sh" >> tests/Makefile.am
-                fi
-                if [[ ${tests_posix_only[*]} =~ "$i" ]]; then
-                        echo "endif" >> tests/Makefile.am
-                fi
-                echo "EXTRA_DIST += ${i}.sh" >> tests/Makefile.am
-        fi
-done
-echo "EXTRA_DIST += aeadtests.txt" >> tests/Makefile.am
-echo "EXTRA_DIST += evptests.txt" >> tests/Makefile.am
-echo "EXTRA_DIST += pq_expected.txt" >> tests/Makefile.am
-echo "EXTRA_DIST += testssl ca.pem server.pem" >> tests/Makefile.am
 
+# add headers
 (cd include/openssl
         $CP Makefile.am.tpl Makefile.am
         for i in `ls -1 *.h|sort`; do
@@ -283,8 +225,8 @@ echo "EXTRA_DIST += testssl ca.pem server.pem" >> tests/Makefile.am
         done
 )
 
-echo "copying manpages"
 # copy manpages
+echo "copying manpages"
 (cd man
         $CP Makefile.am.tpl Makefile.am
 
@@ -302,9 +244,7 @@ echo "copying manpages"
         $CP $openssl_app_src/openssl.1 .
         echo "dist_man_MANS += openssl.1" >> Makefile.am
         $CP $libtls_src/tls_init.3 .
-        echo "if ENABLE_LIBTLS" >> Makefile.am
         echo "dist_man_MANS += tls_init.3" >> Makefile.am
-        echo "endif" >> Makefile.am
 
         # convert remaining POD manpages
         for i in `ls -1 $libssl_src/src/doc/crypto/*.pod | sort`; do
@@ -326,23 +266,19 @@ echo "copying manpages"
                 echo "  ln -f \$(DESTDIR)\$(mandir)/man3/$1 \\" >> Makefile.am
                 echo "    \$(DESTDIR)\$(mandir)/man3/$2" >> Makefile.am
         done
-        echo "if ENABLE_LIBTLS" >> Makefile.am
         for i in $TLS_MLINKS; do
                 IFS=","; set $i; unset IFS
                 echo "  ln -f \$(DESTDIR)\$(mandir)/man3/$1 \\" >> Makefile.am
                 echo "    \$(DESTDIR)\$(mandir)/man3/$2" >> Makefile.am
         done
-        echo "endif" >> Makefile.am
         echo "" >> Makefile.am
         echo "uninstall-local:" >> Makefile.am
         for i in $SSL_MLINKS; do
                 IFS=","; set $i; unset IFS
                 echo "  -rm -f \$(DESTDIR)\$(mandir)/man3/$2" >> Makefile.am
         done
-        echo "if ENABLE_LIBTLS" >> Makefile.am
         for i in $TLS_MLINKS; do
                 IFS=","; set $i; unset IFS
                 echo "  rm -f \$(DESTDIR)\$(mandir)/man3/$2" >> Makefile.am
         done
-        echo "endif" >> Makefile.am
 )