Import upstream version 0.9+1474479173.6c180c6

31 files changed, 734 insertions, 385 deletions

diff --git a/Cryptlib/Include/OpenSslSupport.h b/Cryptlib/Include/OpenSslSupport.h
index 004c3e8e..f73bbc9b 100644
--- a/Cryptlib/Include/OpenSslSupport.h
+++ b/Cryptlib/Include/OpenSslSupport.h
@@ -26,6 +26,31 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define CONST const

 

 //

+// OpenSSL relies on explicit configuration for word size in crypto/bn,

+// but we want it to be automatically inferred from the target. So we

+// bypass what's in <openssl/opensslconf.h> for OPENSSL_SYS_UEFI, and

+// define our own here.

+//

+#ifdef CONFIG_HEADER_BN_H

+#error CONFIG_HEADER_BN_H already defined

+#endif

+

+#define CONFIG_HEADER_BN_H

+

+#if defined(MDE_CPU_X64) || defined(MDE_CPU_AARCH64) || defined(MDE_CPU_IA64)

+//

+// With GCC we would normally use SIXTY_FOUR_BIT_LONG, but MSVC needs

+// SIXTY_FOUR_BIT, because 'long' is 32-bit and only 'long long' is

+// 64-bit. Since using 'long long' works fine on GCC too, just do that.

+//

+#define SIXTY_FOUR_BIT

+#elif defined(MDE_CPU_IA32) || defined(MDE_CPU_ARM) || defined(MDE_CPU_EBC)

+#define THIRTY_TWO_BIT

+#else

+#error Unknown target architecture

+#endif

+

+//

 // File operations are not required for building Open SSL, 

 // so FILE is mapped to VOID * to pass build

 //

@@ -211,7 +236,7 @@ struct tm {
 struct timeval {

   long tv_sec;      /* time value, in seconds */

   long tv_usec;     /* time value, in microseconds */

-} timeval;

+};

 

 struct dirent {

   UINT32  d_fileno;         /* file number of entry */

diff --git a/Cryptlib/Include/openssl/aes.h b/Cryptlib/Include/openssl/aes.h
index 87bf60f6..faa66c49 100644
--- a/Cryptlib/Include/openssl/aes.h
+++ b/Cryptlib/Include/openssl/aes.h
@@ -1,4 +1,4 @@
-/* crypto/aes/aes.h -*- mode:C; c-file-style: "eay" -*- */
+/* crypto/aes/aes.h */
 /* ====================================================================
  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
  *
diff --git a/Cryptlib/Include/openssl/asn1_mac.h b/Cryptlib/Include/openssl/asn1_mac.h
index abc6dc35..3a672e9a 100644
--- a/Cryptlib/Include/openssl/asn1_mac.h
+++ b/Cryptlib/Include/openssl/asn1_mac.h
@@ -70,7 +70,7 @@ extern "C" {
 # endif
 
 # define ASN1_MAC_H_err(f,r,line) \
-        ERR_PUT_error(ASN1_MAC_ERR_LIB,(f),(r),__FILE__,(line))
+        ERR_PUT_error(ASN1_MAC_ERR_LIB,(f),(r),OPENSSL_FILE,(line))
 
 # define M_ASN1_D2I_vars(a,type,func) \
         ASN1_const_CTX c; \
@@ -81,7 +81,7 @@ extern "C" {
         c.error=ERR_R_NESTED_ASN1_ERROR; \
         if ((a == NULL) || ((*a) == NULL)) \
                 { if ((ret=(type)func()) == NULL) \
-                        { c.line=__LINE__; goto err; } } \
+                        { c.line=OPENSSL_LINE; goto err; } } \
         else    ret=(*a);
 
 # define M_ASN1_D2I_Init() \
@@ -90,7 +90,7 @@ extern "C" {
 
 # define M_ASN1_D2I_Finish_2(a) \
         if (!asn1_const_Finish(&c)) \
-                { c.line=__LINE__; goto err; } \
+                { c.line=OPENSSL_LINE; goto err; } \
         *(const unsigned char **)pp=c.p; \
         if (a != NULL) (*a)=ret; \
         return(ret);
@@ -105,7 +105,7 @@ err:\
 
 # define M_ASN1_D2I_start_sequence() \
         if (!asn1_GetSequence(&c,&length)) \
-                { c.line=__LINE__; goto err; }
+                { c.line=OPENSSL_LINE; goto err; }
 /* Begin reading ASN1 without a surrounding sequence */
 # define M_ASN1_D2I_begin() \
         c.slen = length;
@@ -129,21 +129,21 @@ err:\
 # define M_ASN1_D2I_get(b, func) \
         c.q=c.p; \
         if (func(&(b),&c.p,c.slen) == NULL) \
-                {c.line=__LINE__; goto err; } \
+                {c.line=OPENSSL_LINE; goto err; } \
         c.slen-=(c.p-c.q);
 
 /* Don't use this with d2i_ASN1_BOOLEAN() */
 # define M_ASN1_D2I_get_x(type,b,func) \
         c.q=c.p; \
         if (((D2I_OF(type))func)(&(b),&c.p,c.slen) == NULL) \
-                {c.line=__LINE__; goto err; } \
+                {c.line=OPENSSL_LINE; goto err; } \
         c.slen-=(c.p-c.q);
 
 /* use this instead () */
 # define M_ASN1_D2I_get_int(b,func) \
         c.q=c.p; \
         if (func(&(b),&c.p,c.slen) < 0) \
-                {c.line=__LINE__; goto err; } \
+                {c.line=OPENSSL_LINE; goto err; } \
         c.slen-=(c.p-c.q);
 
 # define M_ASN1_D2I_get_opt(b,func,type) \
@@ -164,7 +164,7 @@ err:\
         M_ASN1_next=(_tmp& V_ASN1_CONSTRUCTED)|type; \
         c.q=c.p; \
         if (func(&(b),&c.p,c.slen) == NULL) \
-                {c.line=__LINE__; M_ASN1_next_prev = _tmp; goto err; } \
+                {c.line=OPENSSL_LINE; M_ASN1_next_prev = _tmp; goto err; } \
         c.slen-=(c.p-c.q);\
         M_ASN1_next_prev=_tmp;
 
@@ -258,20 +258,20 @@ err:\
         c.q=c.p; \
         if (d2i_ASN1_SET(&(r),&c.p,c.slen,(char *(*)())func,\
                 (void (*)())free_func,a,b) == NULL) \
-                { c.line=__LINE__; goto err; } \
+                { c.line=OPENSSL_LINE; goto err; } \
         c.slen-=(c.p-c.q);
 
 # define M_ASN1_D2I_get_imp_set_type(type,r,func,free_func,a,b) \
         c.q=c.p; \
         if (d2i_ASN1_SET_OF_##type(&(r),&c.p,c.slen,func,\
                                    free_func,a,b) == NULL) \
-                { c.line=__LINE__; goto err; } \
+                { c.line=OPENSSL_LINE; goto err; } \
         c.slen-=(c.p-c.q);
 
 # define M_ASN1_D2I_get_set_strings(r,func,a,b) \
         c.q=c.p; \
         if (d2i_ASN1_STRING_SET(&(r),&c.p,c.slen,a,b) == NULL) \
-                { c.line=__LINE__; goto err; } \
+                { c.line=OPENSSL_LINE; goto err; } \
         c.slen-=(c.p-c.q);
 
 # define M_ASN1_D2I_get_EXP_opt(r,func,tag) \
@@ -285,16 +285,16 @@ err:\
                 Tinf=ASN1_get_object(&c.p,&Tlen,&Ttag,&Tclass,c.slen); \
                 if (Tinf & 0x80) \
                         { c.error=ERR_R_BAD_ASN1_OBJECT_HEADER; \
-                        c.line=__LINE__; goto err; } \
+                        c.line=OPENSSL_LINE; goto err; } \
                 if (Tinf == (V_ASN1_CONSTRUCTED+1)) \
                                         Tlen = c.slen - (c.p - c.q) - 2; \
                 if (func(&(r),&c.p,Tlen) == NULL) \
-                        { c.line=__LINE__; goto err; } \
+                        { c.line=OPENSSL_LINE; goto err; } \
                 if (Tinf == (V_ASN1_CONSTRUCTED+1)) { \
                         Tlen = c.slen - (c.p - c.q); \
                         if(!ASN1_const_check_infinite_end(&c.p, Tlen)) \
                                 { c.error=ERR_R_MISSING_ASN1_EOS; \
-                                c.line=__LINE__; goto err; } \
+                                c.line=OPENSSL_LINE; goto err; } \
                 }\
                 c.slen-=(c.p-c.q); \
                 }
@@ -310,18 +310,18 @@ err:\
                 Tinf=ASN1_get_object(&c.p,&Tlen,&Ttag,&Tclass,c.slen); \
                 if (Tinf & 0x80) \
                         { c.error=ERR_R_BAD_ASN1_OBJECT_HEADER; \
-                        c.line=__LINE__; goto err; } \
+                        c.line=OPENSSL_LINE; goto err; } \
                 if (Tinf == (V_ASN1_CONSTRUCTED+1)) \
                                         Tlen = c.slen - (c.p - c.q) - 2; \
                 if (d2i_ASN1_SET(&(r),&c.p,Tlen,(char *(*)())func, \
                         (void (*)())free_func, \
                         b,V_ASN1_UNIVERSAL) == NULL) \
-                        { c.line=__LINE__; goto err; } \
+                        { c.line=OPENSSL_LINE; goto err; } \
                 if (Tinf == (V_ASN1_CONSTRUCTED+1)) { \
                         Tlen = c.slen - (c.p - c.q); \
                         if(!ASN1_check_infinite_end(&c.p, Tlen)) \
                                 { c.error=ERR_R_MISSING_ASN1_EOS; \
-                                c.line=__LINE__; goto err; } \
+                                c.line=OPENSSL_LINE; goto err; } \
                 }\
                 c.slen-=(c.p-c.q); \
                 }
@@ -337,17 +337,17 @@ err:\
                 Tinf=ASN1_get_object(&c.p,&Tlen,&Ttag,&Tclass,c.slen); \
                 if (Tinf & 0x80) \
                         { c.error=ERR_R_BAD_ASN1_OBJECT_HEADER; \
-                        c.line=__LINE__; goto err; } \
+                        c.line=OPENSSL_LINE; goto err; } \
                 if (Tinf == (V_ASN1_CONSTRUCTED+1)) \
                                         Tlen = c.slen - (c.p - c.q) - 2; \
                 if (d2i_ASN1_SET_OF_##type(&(r),&c.p,Tlen,func, \
                         free_func,b,V_ASN1_UNIVERSAL) == NULL) \
-                        { c.line=__LINE__; goto err; } \
+                        { c.line=OPENSSL_LINE; goto err; } \
                 if (Tinf == (V_ASN1_CONSTRUCTED+1)) { \
                         Tlen = c.slen - (c.p - c.q); \
                         if(!ASN1_check_infinite_end(&c.p, Tlen)) \
                                 { c.error=ERR_R_MISSING_ASN1_EOS; \
-                                c.line=__LINE__; goto err; } \
+                                c.line=OPENSSL_LINE; goto err; } \
                 }\
                 c.slen-=(c.p-c.q); \
                 }
@@ -355,7 +355,7 @@ err:\
 /* New macros */
 # define M_ASN1_New_Malloc(ret,type) \
         if ((ret=(type *)OPENSSL_malloc(sizeof(type))) == NULL) \
-                { c.line=__LINE__; goto err2; }
+                { c.line=OPENSSL_LINE; goto err2; }
 
 # define M_ASN1_New(arg,func) \
         if (((arg)=func()) == NULL) return(NULL)
diff --git a/Cryptlib/Include/openssl/bio.h b/Cryptlib/Include/openssl/bio.h
index 69bd48c9..6790aed2 100644
--- a/Cryptlib/Include/openssl/bio.h
+++ b/Cryptlib/Include/openssl/bio.h
@@ -479,11 +479,11 @@ struct bio_dgram_sctp_prinfo {
 # define BIO_get_conn_hostname(b)  BIO_ptr_ctrl(b,BIO_C_GET_CONNECT,0)
 # define BIO_get_conn_port(b)      BIO_ptr_ctrl(b,BIO_C_GET_CONNECT,1)
 # define BIO_get_conn_ip(b)               BIO_ptr_ctrl(b,BIO_C_GET_CONNECT,2)
-# define BIO_get_conn_int_port(b) BIO_int_ctrl(b,BIO_C_GET_CONNECT,3,0)
+# define BIO_get_conn_int_port(b) BIO_ctrl(b,BIO_C_GET_CONNECT,3,NULL)
 
 # define BIO_set_nbio(b,n)       BIO_ctrl(b,BIO_C_SET_NBIO,(n),NULL)
 
-/* BIO_s_accept_socket() */
+/* BIO_s_accept() */
 # define BIO_set_accept_port(b,name) BIO_ctrl(b,BIO_C_SET_ACCEPT,0,(char *)name)
 # define BIO_get_accept_port(b)  BIO_ptr_ctrl(b,BIO_C_GET_ACCEPT,0)
 /* #define BIO_set_nbio(b,n)    BIO_ctrl(b,BIO_C_SET_NBIO,(n),NULL) */
@@ -496,6 +496,7 @@ struct bio_dgram_sctp_prinfo {
 # define BIO_set_bind_mode(b,mode) BIO_ctrl(b,BIO_C_SET_BIND_MODE,mode,NULL)
 # define BIO_get_bind_mode(b,mode) BIO_ctrl(b,BIO_C_GET_BIND_MODE,0,NULL)
 
+/* BIO_s_accept() and BIO_s_connect() */
 # define BIO_do_connect(b)       BIO_do_handshake(b)
 # define BIO_do_accept(b)        BIO_do_handshake(b)
 # define BIO_do_handshake(b)     BIO_ctrl(b,BIO_C_DO_STATE_MACHINE,0,NULL)
@@ -515,12 +516,15 @@ struct bio_dgram_sctp_prinfo {
 # define BIO_get_url(b,url)      BIO_ctrl(b,BIO_C_GET_PROXY_PARAM,2,(char *)(url))
 # define BIO_get_no_connect_return(b)    BIO_ctrl(b,BIO_C_GET_PROXY_PARAM,5,NULL)
 
+/* BIO_s_datagram(), BIO_s_fd(), BIO_s_socket(), BIO_s_accept() and BIO_s_connect() */
 # define BIO_set_fd(b,fd,c)      BIO_int_ctrl(b,BIO_C_SET_FD,c,fd)
 # define BIO_get_fd(b,c)         BIO_ctrl(b,BIO_C_GET_FD,0,(char *)c)
 
+/* BIO_s_file() */
 # define BIO_set_fp(b,fp,c)      BIO_ctrl(b,BIO_C_SET_FILE_PTR,c,(char *)fp)
 # define BIO_get_fp(b,fpp)       BIO_ctrl(b,BIO_C_GET_FILE_PTR,0,(char *)fpp)
 
+/* BIO_s_fd() and BIO_s_file() */
 # define BIO_seek(b,ofs) (int)BIO_ctrl(b,BIO_C_FILE_SEEK,ofs,NULL)
 # define BIO_tell(b)     (int)BIO_ctrl(b,BIO_C_FILE_TELL,0,NULL)
 
@@ -646,10 +650,10 @@ int BIO_asn1_set_suffix(BIO *b, asn1_ps_func *suffix,
 int BIO_asn1_get_suffix(BIO *b, asn1_ps_func **psuffix,
                         asn1_ps_func **psuffix_free);
 
+# ifndef OPENSSL_NO_FP_API
 BIO_METHOD *BIO_s_file(void);
 BIO *BIO_new_file(const char *filename, const char *mode);
 BIO *BIO_new_fp(FILE *stream, int close_flag);
-# ifndef OPENSSL_NO_FP_API
 #  define BIO_s_file_internal    BIO_s_file
 # endif
 BIO *BIO_new(BIO_METHOD *type);
@@ -685,7 +689,7 @@ long BIO_debug_callback(BIO *bio, int cmd, const char *argp, int argi,
                         long argl, long ret);
 
 BIO_METHOD *BIO_s_mem(void);
-BIO *BIO_new_mem_buf(void *buf, int len);
+BIO *BIO_new_mem_buf(const void *buf, int len);
 BIO_METHOD *BIO_s_socket(void);
 BIO_METHOD *BIO_s_connect(void);
 BIO_METHOD *BIO_s_accept(void);
@@ -787,19 +791,11 @@ void BIO_copy_next_retry(BIO *b);
 # else
 #  define __bio_h__attr__(x)
 # endif
-# if defined(OPENSSL_SYS_UEFI)
-int EFIAPI BIO_printf(BIO *bio, const char *format, ...)
-# else
 int BIO_printf(BIO *bio, const char *format, ...)
-# endif
 __bio_h__attr__((__format__(__printf__, 2, 3)));
 int BIO_vprintf(BIO *bio, const char *format, va_list args)
 __bio_h__attr__((__format__(__printf__, 2, 0)));
-# if defined(OPENSSL_SYS_UEFI)
-int EFIAPI BIO_snprintf(char *buf, size_t n, const char *format, ...)
-# else
 int BIO_snprintf(char *buf, size_t n, const char *format, ...)
-# endif
 __bio_h__attr__((__format__(__printf__, 3, 4)));
 int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
 __bio_h__attr__((__format__(__printf__, 3, 0)));
diff --git a/Cryptlib/Include/openssl/bn.h b/Cryptlib/Include/openssl/bn.h
index 5696965e..86264ae6 100644
--- a/Cryptlib/Include/openssl/bn.h
+++ b/Cryptlib/Include/openssl/bn.h
@@ -125,6 +125,7 @@
 #ifndef HEADER_BN_H
 # define HEADER_BN_H
 
+# include <limits.h>
 # include <openssl/e_os2.h>
 # ifndef OPENSSL_NO_FP_API
 #  include <stdio.h>            /* FILE */
@@ -721,8 +722,17 @@ const BIGNUM *BN_get0_nist_prime_521(void);
 
 /* library internal functions */
 
-# define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->dmax)?\
-        (a):bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2))
+# define bn_expand(a,bits) \
+    ( \
+        bits > (INT_MAX - BN_BITS2 + 1) ? \
+            NULL \
+        : \
+            (((bits+BN_BITS2-1)/BN_BITS2) <= (a)->dmax) ? \
+                (a) \
+            : \
+                bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2) \
+    )
+
 # define bn_wexpand(a,words) (((words) <= (a)->dmax)?(a):bn_expand2((a),(words)))
 BIGNUM *bn_expand2(BIGNUM *a, int words);
 # ifndef OPENSSL_NO_DEPRECATED
diff --git a/Cryptlib/Include/openssl/buffer.h b/Cryptlib/Include/openssl/buffer.h
index c343dd77..efd240a5 100644
--- a/Cryptlib/Include/openssl/buffer.h
+++ b/Cryptlib/Include/openssl/buffer.h
@@ -86,7 +86,13 @@ int BUF_MEM_grow(BUF_MEM *str, size_t len);
 int BUF_MEM_grow_clean(BUF_MEM *str, size_t len);
 size_t BUF_strnlen(const char *str, size_t maxlen);
 char *BUF_strdup(const char *str);
+
+/*
+ * Like strndup, but in addition, explicitly guarantees to never read past the
+ * first |siz| bytes of |str|.
+ */
 char *BUF_strndup(const char *str, size_t siz);
+
 void *BUF_memdup(const void *data, size_t siz);
 void BUF_reverse(unsigned char *out, const unsigned char *in, size_t siz);
 
diff --git a/Cryptlib/Include/openssl/camellia.h b/Cryptlib/Include/openssl/camellia.h
index 9be7c0fd..45e8d25b 100644
--- a/Cryptlib/Include/openssl/camellia.h
+++ b/Cryptlib/Include/openssl/camellia.h
@@ -1,4 +1,4 @@
-/* crypto/camellia/camellia.h -*- mode:C; c-file-style: "eay" -*- */
+/* crypto/camellia/camellia.h */
 /* ====================================================================
  * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
  *
diff --git a/Cryptlib/Include/openssl/comp.h b/Cryptlib/Include/openssl/comp.h
index 406c428a..60a07340 100644
--- a/Cryptlib/Include/openssl/comp.h
+++ b/Cryptlib/Include/openssl/comp.h
@@ -4,6 +4,10 @@
 
 # include <openssl/crypto.h>
 
+# ifdef OPENSSL_NO_COMP
+#  error COMP is disabled.
+# endif
+
 #ifdef  __cplusplus
 extern "C" {
 #endif
diff --git a/Cryptlib/Include/openssl/conf.h b/Cryptlib/Include/openssl/conf.h
index 8d926d5d..c29e97dd 100644
--- a/Cryptlib/Include/openssl/conf.h
+++ b/Cryptlib/Include/openssl/conf.h
@@ -118,8 +118,10 @@ typedef void conf_finish_func (CONF_IMODULE *md);
 
 int CONF_set_default_method(CONF_METHOD *meth);
 void CONF_set_nconf(CONF *conf, LHASH_OF(CONF_VALUE) *hash);
+# ifndef OPENSSL_NO_STDIO
 LHASH_OF(CONF_VALUE) *CONF_load(LHASH_OF(CONF_VALUE) *conf, const char *file,
                                 long *eline);
+# endif
 # ifndef OPENSSL_NO_FP_API
 LHASH_OF(CONF_VALUE) *CONF_load_fp(LHASH_OF(CONF_VALUE) *conf, FILE *fp,
                                    long *eline);
@@ -133,7 +135,9 @@ char *CONF_get_string(LHASH_OF(CONF_VALUE) *conf, const char *group,
 long CONF_get_number(LHASH_OF(CONF_VALUE) *conf, const char *group,
                      const char *name);
 void CONF_free(LHASH_OF(CONF_VALUE) *conf);
+# ifndef OPENSSL_NO_FP_API
 int CONF_dump_fp(LHASH_OF(CONF_VALUE) *conf, FILE *out);
+# endif
 int CONF_dump_bio(LHASH_OF(CONF_VALUE) *conf, BIO *out);
 
 void OPENSSL_config(const char *config_name);
@@ -160,7 +164,9 @@ CONF_METHOD *NCONF_XML(void);
 void NCONF_free(CONF *conf);
 void NCONF_free_data(CONF *conf);
 
+# ifndef OPENSSL_NO_STDIO
 int NCONF_load(CONF *conf, const char *file, long *eline);
+# endif
 # ifndef OPENSSL_NO_FP_API
 int NCONF_load_fp(CONF *conf, FILE *fp, long *eline);
 # endif
@@ -170,7 +176,9 @@ STACK_OF(CONF_VALUE) *NCONF_get_section(const CONF *conf,
 char *NCONF_get_string(const CONF *conf, const char *group, const char *name);
 int NCONF_get_number_e(const CONF *conf, const char *group, const char *name,
                        long *result);
+# ifndef OPENSSL_NO_FP_API
 int NCONF_dump_fp(const CONF *conf, FILE *out);
+# endif
 int NCONF_dump_bio(const CONF *conf, BIO *out);
 
 # if 0                          /* The following function has no error
@@ -184,8 +192,10 @@ long NCONF_get_number(CONF *conf, char *group, char *name);
 
 int CONF_modules_load(const CONF *cnf, const char *appname,
                       unsigned long flags);
+# ifndef OPENSSL_NO_STDIO
 int CONF_modules_load_file(const char *filename, const char *appname,
                            unsigned long flags);
+# endif
 void CONF_modules_unload(int all);
 void CONF_modules_finish(void);
 void CONF_modules_free(void);
diff --git a/Cryptlib/Include/openssl/crypto.h b/Cryptlib/Include/openssl/crypto.h
index d6e804e0..bea4ca19 100644
--- a/Cryptlib/Include/openssl/crypto.h
+++ b/Cryptlib/Include/openssl/crypto.h
@@ -235,15 +235,15 @@ typedef struct openssl_item_st {
 # ifndef OPENSSL_NO_LOCKING
 #  ifndef CRYPTO_w_lock
 #   define CRYPTO_w_lock(type)     \
-        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,NULL,0)
+        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,OPENSSL_FILE,OPENSSL_LINE)
 #   define CRYPTO_w_unlock(type)   \
-        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,NULL,0)
+        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,OPENSSL_FILE,OPENSSL_LINE)
 #   define CRYPTO_r_lock(type)     \
-        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,NULL,0)
+        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,OPENSSL_FILE,OPENSSL_LINE)
 #   define CRYPTO_r_unlock(type)   \
-        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,NULL,0)
+        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,OPENSSL_FILE,OPENSSL_LINE)
 #   define CRYPTO_add(addr,amount,type)    \
-        CRYPTO_add_lock(addr,amount,type,NULL,0)
+        CRYPTO_add_lock(addr,amount,type,OPENSSL_FILE,OPENSSL_LINE)
 #  endif
 # else
 #  define CRYPTO_w_lock(a)
@@ -378,19 +378,19 @@ int CRYPTO_is_mem_check_on(void);
 # define MemCheck_off()  CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE)
 # define is_MemCheck_on() CRYPTO_is_mem_check_on()
 
-# define OPENSSL_malloc(num)     CRYPTO_malloc((int)num,NULL,0)
-# define OPENSSL_strdup(str)     CRYPTO_strdup((str),NULL,0)
+# define OPENSSL_malloc(num)     CRYPTO_malloc((int)num,OPENSSL_FILE,OPENSSL_LINE)
+# define OPENSSL_strdup(str)     CRYPTO_strdup((str),OPENSSL_FILE,OPENSSL_LINE)
 # define OPENSSL_realloc(addr,num) \
-        CRYPTO_realloc((char *)addr,(int)num,NULL,0)
+        CRYPTO_realloc((char *)addr,(int)num,OPENSSL_FILE,OPENSSL_LINE)
 # define OPENSSL_realloc_clean(addr,old_num,num) \
-        CRYPTO_realloc_clean(addr,old_num,num,NULL,0)
+        CRYPTO_realloc_clean(addr,old_num,num,OPENSSL_FILE,OPENSSL_LINE)
 # define OPENSSL_remalloc(addr,num) \
-        CRYPTO_remalloc((char **)addr,(int)num,NULL,0)
+        CRYPTO_remalloc((char **)addr,(int)num,OPENSSL_FILE,OPENSSL_LINE)
 # define OPENSSL_freeFunc        CRYPTO_free
 # define OPENSSL_free(addr)      CRYPTO_free(addr)
 
 # define OPENSSL_malloc_locked(num) \
-        CRYPTO_malloc_locked((int)num,NULL,0)
+        CRYPTO_malloc_locked((int)num,OPENSSL_FILE,OPENSSL_LINE)
 # define OPENSSL_free_locked(addr) CRYPTO_free_locked(addr)
 
 const char *SSLeay_version(int type);
@@ -545,7 +545,7 @@ void CRYPTO_set_mem_debug_options(long bits);
 long CRYPTO_get_mem_debug_options(void);
 
 # define CRYPTO_push_info(info) \
-        CRYPTO_push_info_(info, NULL, 0);
+        CRYPTO_push_info_(info, OPENSSL_FILE, OPENSSL_LINE);
 int CRYPTO_push_info_(const char *info, const char *file, int line);
 int CRYPTO_pop_info(void);
 int CRYPTO_remove_all_info(void);
@@ -588,7 +588,7 @@ void CRYPTO_mem_leaks_cb(CRYPTO_MEM_LEAK_CB *cb);
 
 /* die if we have to */
 void OpenSSLDie(const char *file, int line, const char *assertion);
-# define OPENSSL_assert(e)       (void)((e) ? 0 : (OpenSSLDie(NULL, 0, #e),1))
+# define OPENSSL_assert(e)       (void)((e) ? 0 : (OpenSSLDie(OPENSSL_FILE, OPENSSL_LINE, #e),1))
 
 unsigned long *OPENSSL_ia32cap_loc(void);
 # define OPENSSL_ia32cap (*(OPENSSL_ia32cap_loc()))
@@ -605,14 +605,14 @@ void OPENSSL_init(void);
 #  define fips_md_init_ctx(alg, cx) \
         int alg##_Init(cx##_CTX *c) \
         { \
-        if (FIPS_mode()) OpenSSLDie(NULL, 0, \
+        if (FIPS_mode()) OpenSSLDie(OPENSSL_FILE, OPENSSL_LINE, \
                 "Low level API call to digest " #alg " forbidden in FIPS mode!"); \
         return private_##alg##_Init(c); \
         } \
         int private_##alg##_Init(cx##_CTX *c)
 
 #  define fips_cipher_abort(alg) \
-        if (FIPS_mode()) OpenSSLDie(NULL, 0, \
+        if (FIPS_mode()) OpenSSLDie(OPENSSL_FILE, OPENSSL_LINE, \
                 "Low level API call to cipher " #alg " forbidden in FIPS mode!")
 
 # else
@@ -628,7 +628,7 @@ void OPENSSL_init(void);
  * into a defined order as the return value when a != b is undefined, other
  * than to be non-zero.
  */
-int CRYPTO_memcmp(const void *a, const void *b, size_t len);
+int CRYPTO_memcmp(const volatile void *a, const volatile void *b, size_t len);
 
 /* BEGIN ERROR CODES */
 /*
diff --git a/Cryptlib/Include/openssl/des_old.h b/Cryptlib/Include/openssl/des_old.h
index f1e1e2cb..ee7607a2 100644
--- a/Cryptlib/Include/openssl/des_old.h
+++ b/Cryptlib/Include/openssl/des_old.h
@@ -1,4 +1,4 @@
-/* crypto/des/des_old.h -*- mode:C; c-file-style: "eay" -*- */
+/* crypto/des/des_old.h */
 
 /*-
  * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
diff --git a/Cryptlib/Include/openssl/dh.h b/Cryptlib/Include/openssl/dh.h
index 0502f1a9..64888796 100644
--- a/Cryptlib/Include/openssl/dh.h
+++ b/Cryptlib/Include/openssl/dh.h
@@ -142,7 +142,7 @@ struct dh_st {
     BIGNUM *p;
     BIGNUM *g;
     long length;                /* optional */
-    BIGNUM *pub_key;            /* g^x */
+    BIGNUM *pub_key;            /* g^x % p */
     BIGNUM *priv_key;           /* x */
     int flags;
     BN_MONT_CTX *method_mont_p;
@@ -174,6 +174,7 @@ struct dh_st {
 /* DH_check_pub_key error codes */
 # define DH_CHECK_PUBKEY_TOO_SMALL       0x01
 # define DH_CHECK_PUBKEY_TOO_LARGE       0x02
+# define DH_CHECK_PUBKEY_INVALID         0x04
 
 /*
  * primes p where (p-1)/2 is prime too are called "safe"; we define this for
@@ -239,11 +240,13 @@ DH *DH_get_1024_160(void);
 DH *DH_get_2048_224(void);
 DH *DH_get_2048_256(void);
 
+# ifndef OPENSSL_NO_CMS
 /* RFC2631 KDF */
 int DH_KDF_X9_42(unsigned char *out, size_t outlen,
                  const unsigned char *Z, size_t Zlen,
                  ASN1_OBJECT *key_oid,
                  const unsigned char *ukm, size_t ukmlen, const EVP_MD *md);
+# endif
 
 # define EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, len) \
         EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DH, EVP_PKEY_OP_PARAMGEN, \
@@ -336,7 +339,9 @@ int DH_KDF_X9_42(unsigned char *out, size_t outlen,
 
 /* KDF types */
 # define EVP_PKEY_DH_KDF_NONE                            1
+# ifndef OPENSSL_NO_CMS
 # define EVP_PKEY_DH_KDF_X9_42                           2
+# endif
 
 /* BEGIN ERROR CODES */
 /*
diff --git a/Cryptlib/Include/openssl/dso.h b/Cryptlib/Include/openssl/dso.h
index 7c4a1dc4..c9013f5c 100644
--- a/Cryptlib/Include/openssl/dso.h
+++ b/Cryptlib/Include/openssl/dso.h
@@ -1,4 +1,4 @@
-/* dso.h -*- mode:C; c-file-style: "eay" -*- */
+/* dso.h */
 /*
  * Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL project
  * 2000.
diff --git a/Cryptlib/Include/openssl/e_os2.h b/Cryptlib/Include/openssl/e_os2.h
index 7be9989a..909e22f7 100644
--- a/Cryptlib/Include/openssl/e_os2.h
+++ b/Cryptlib/Include/openssl/e_os2.h
@@ -97,7 +97,14 @@ extern "C" {
  * For 32 bit environment, there seems to be the CygWin environment and then
  * all the others that try to do the same thing Microsoft does...
  */
-# if defined(OPENSSL_SYSNAME_UWIN)
+/*
+ * UEFI lives here because it might be built with a Microsoft toolchain and
+ * we need to avoid the false positive match on Windows.
+ */
+# if defined(OPENSSL_SYSNAME_UEFI)
+#  undef OPENSSL_SYS_UNIX
+#  define OPENSSL_SYS_UEFI
+# elif defined(OPENSSL_SYSNAME_UWIN)
 #  undef OPENSSL_SYS_UNIX
 #  define OPENSSL_SYS_WIN32_UWIN
 # else
diff --git a/Cryptlib/Include/openssl/ec.h b/Cryptlib/Include/openssl/ec.h
index 6d3178f6..81e6faf6 100644
--- a/Cryptlib/Include/openssl/ec.h
+++ b/Cryptlib/Include/openssl/ec.h
@@ -106,7 +106,7 @@ typedef enum {
         /** the point is encoded as z||x, where the octet z specifies
          *  which solution of the quadratic equation y is  */
     POINT_CONVERSION_COMPRESSED = 2,
-        /** the point is encoded as z||x||y, where z is the octet 0x02  */
+        /** the point is encoded as z||x||y, where z is the octet 0x04  */
     POINT_CONVERSION_UNCOMPRESSED = 4,
         /** the point is encoded as z||x||y, where the octet z specifies
          *  which solution of the quadratic equation y is  */
diff --git a/Cryptlib/Include/openssl/ecdsa.h b/Cryptlib/Include/openssl/ecdsa.h
index c4016ac3..a6f0930f 100644
--- a/Cryptlib/Include/openssl/ecdsa.h
+++ b/Cryptlib/Include/openssl/ecdsa.h
@@ -233,7 +233,7 @@ void *ECDSA_get_ex_data(EC_KEY *d, int idx);
  *  \return pointer to a ECDSA_METHOD structure or NULL if an error occurred
  */
 
-ECDSA_METHOD *ECDSA_METHOD_new(ECDSA_METHOD *ecdsa_method);
+ECDSA_METHOD *ECDSA_METHOD_new(const ECDSA_METHOD *ecdsa_method);
 
 /** frees a ECDSA_METHOD structure
  *  \param  ecdsa_method  pointer to the ECDSA_METHOD structure
diff --git a/Cryptlib/Include/openssl/err.h b/Cryptlib/Include/openssl/err.h
index bbfdb959..04c6cfc6 100644
--- a/Cryptlib/Include/openssl/err.h
+++ b/Cryptlib/Include/openssl/err.h
@@ -200,39 +200,39 @@ typedef struct err_state_st {
 
 # define ERR_LIB_USER            128
 
-# define SYSerr(f,r)  ERR_PUT_error(ERR_LIB_SYS,(f),(r),__FILE__,__LINE__)
-# define BNerr(f,r)   ERR_PUT_error(ERR_LIB_BN,(f),(r),__FILE__,__LINE__)
-# define RSAerr(f,r)  ERR_PUT_error(ERR_LIB_RSA,(f),(r),__FILE__,__LINE__)
-# define DHerr(f,r)   ERR_PUT_error(ERR_LIB_DH,(f),(r),__FILE__,__LINE__)
-# define EVPerr(f,r)  ERR_PUT_error(ERR_LIB_EVP,(f),(r),__FILE__,__LINE__)
-# define BUFerr(f,r)  ERR_PUT_error(ERR_LIB_BUF,(f),(r),__FILE__,__LINE__)
-# define OBJerr(f,r)  ERR_PUT_error(ERR_LIB_OBJ,(f),(r),__FILE__,__LINE__)
-# define PEMerr(f,r)  ERR_PUT_error(ERR_LIB_PEM,(f),(r),__FILE__,__LINE__)
-# define DSAerr(f,r)  ERR_PUT_error(ERR_LIB_DSA,(f),(r),__FILE__,__LINE__)
-# define X509err(f,r) ERR_PUT_error(ERR_LIB_X509,(f),(r),__FILE__,__LINE__)
-# define ASN1err(f,r) ERR_PUT_error(ERR_LIB_ASN1,(f),(r),__FILE__,__LINE__)
-# define CONFerr(f,r) ERR_PUT_error(ERR_LIB_CONF,(f),(r),__FILE__,__LINE__)
-# define CRYPTOerr(f,r) ERR_PUT_error(ERR_LIB_CRYPTO,(f),(r),__FILE__,__LINE__)
-# define ECerr(f,r)   ERR_PUT_error(ERR_LIB_EC,(f),(r),__FILE__,__LINE__)
-# define SSLerr(f,r)  ERR_PUT_error(ERR_LIB_SSL,(f),(r),__FILE__,__LINE__)
-# define BIOerr(f,r)  ERR_PUT_error(ERR_LIB_BIO,(f),(r),__FILE__,__LINE__)
-# define PKCS7err(f,r) ERR_PUT_error(ERR_LIB_PKCS7,(f),(r),__FILE__,__LINE__)
-# define X509V3err(f,r) ERR_PUT_error(ERR_LIB_X509V3,(f),(r),__FILE__,__LINE__)
-# define PKCS12err(f,r) ERR_PUT_error(ERR_LIB_PKCS12,(f),(r),__FILE__,__LINE__)
-# define RANDerr(f,r) ERR_PUT_error(ERR_LIB_RAND,(f),(r),__FILE__,__LINE__)
-# define DSOerr(f,r) ERR_PUT_error(ERR_LIB_DSO,(f),(r),__FILE__,__LINE__)
-# define ENGINEerr(f,r) ERR_PUT_error(ERR_LIB_ENGINE,(f),(r),__FILE__,__LINE__)
-# define OCSPerr(f,r) ERR_PUT_error(ERR_LIB_OCSP,(f),(r),__FILE__,__LINE__)
-# define UIerr(f,r) ERR_PUT_error(ERR_LIB_UI,(f),(r),__FILE__,__LINE__)
-# define COMPerr(f,r) ERR_PUT_error(ERR_LIB_COMP,(f),(r),__FILE__,__LINE__)
-# define ECDSAerr(f,r)  ERR_PUT_error(ERR_LIB_ECDSA,(f),(r),__FILE__,__LINE__)
-# define ECDHerr(f,r)  ERR_PUT_error(ERR_LIB_ECDH,(f),(r),__FILE__,__LINE__)
-# define STOREerr(f,r) ERR_PUT_error(ERR_LIB_STORE,(f),(r),__FILE__,__LINE__)
-# define FIPSerr(f,r) ERR_PUT_error(ERR_LIB_FIPS,(f),(r),__FILE__,__LINE__)
-# define CMSerr(f,r) ERR_PUT_error(ERR_LIB_CMS,(f),(r),__FILE__,__LINE__)
-# define TSerr(f,r) ERR_PUT_error(ERR_LIB_TS,(f),(r),__FILE__,__LINE__)
-# define HMACerr(f,r) ERR_PUT_error(ERR_LIB_HMAC,(f),(r),__FILE__,__LINE__)
-# define JPAKEerr(f,r) ERR_PUT_error(ERR_LIB_JPAKE,(f),(r),__FILE__,__LINE__)
+# define SYSerr(f,r)  ERR_PUT_error(ERR_LIB_SYS,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define BNerr(f,r)   ERR_PUT_error(ERR_LIB_BN,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define RSAerr(f,r)  ERR_PUT_error(ERR_LIB_RSA,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define DHerr(f,r)   ERR_PUT_error(ERR_LIB_DH,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define EVPerr(f,r)  ERR_PUT_error(ERR_LIB_EVP,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define BUFerr(f,r)  ERR_PUT_error(ERR_LIB_BUF,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define OBJerr(f,r)  ERR_PUT_error(ERR_LIB_OBJ,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define PEMerr(f,r)  ERR_PUT_error(ERR_LIB_PEM,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define DSAerr(f,r)  ERR_PUT_error(ERR_LIB_DSA,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define X509err(f,r) ERR_PUT_error(ERR_LIB_X509,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define ASN1err(f,r) ERR_PUT_error(ERR_LIB_ASN1,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define CONFerr(f,r) ERR_PUT_error(ERR_LIB_CONF,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define CRYPTOerr(f,r) ERR_PUT_error(ERR_LIB_CRYPTO,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define ECerr(f,r)   ERR_PUT_error(ERR_LIB_EC,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define SSLerr(f,r)  ERR_PUT_error(ERR_LIB_SSL,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define BIOerr(f,r)  ERR_PUT_error(ERR_LIB_BIO,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define PKCS7err(f,r) ERR_PUT_error(ERR_LIB_PKCS7,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define X509V3err(f,r) ERR_PUT_error(ERR_LIB_X509V3,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define PKCS12err(f,r) ERR_PUT_error(ERR_LIB_PKCS12,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define RANDerr(f,r) ERR_PUT_error(ERR_LIB_RAND,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define DSOerr(f,r) ERR_PUT_error(ERR_LIB_DSO,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define ENGINEerr(f,r) ERR_PUT_error(ERR_LIB_ENGINE,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define OCSPerr(f,r) ERR_PUT_error(ERR_LIB_OCSP,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define UIerr(f,r) ERR_PUT_error(ERR_LIB_UI,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define COMPerr(f,r) ERR_PUT_error(ERR_LIB_COMP,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define ECDSAerr(f,r)  ERR_PUT_error(ERR_LIB_ECDSA,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define ECDHerr(f,r)  ERR_PUT_error(ERR_LIB_ECDH,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define STOREerr(f,r) ERR_PUT_error(ERR_LIB_STORE,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define FIPSerr(f,r) ERR_PUT_error(ERR_LIB_FIPS,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define CMSerr(f,r) ERR_PUT_error(ERR_LIB_CMS,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define TSerr(f,r) ERR_PUT_error(ERR_LIB_TS,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define HMACerr(f,r) ERR_PUT_error(ERR_LIB_HMAC,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
+# define JPAKEerr(f,r) ERR_PUT_error(ERR_LIB_JPAKE,(f),(r),OPENSSL_FILE,OPENSSL_LINE)
 
 /*
  * Borland C seems too stupid to be able to shift and do longs in the
@@ -344,14 +344,7 @@ void ERR_print_errors_fp(FILE *fp);
 # ifndef OPENSSL_NO_BIO
 void ERR_print_errors(BIO *bp);
 # endif
-
-/* Add EFIAPI for UEFI version. */
-#if defined(OPENSSL_SYS_UEFI)
-void EFIAPI ERR_add_error_data(int num, ...);
-#else
 void ERR_add_error_data(int num, ...);
-#endif
-
 void ERR_add_error_vdata(int num, va_list args);
 void ERR_load_strings(int lib, ERR_STRING_DATA str[]);
 void ERR_unload_strings(int lib, ERR_STRING_DATA str[]);
diff --git a/Cryptlib/Include/openssl/evp.h b/Cryptlib/Include/openssl/evp.h
index 39ab7937..ad1e3508 100644
--- a/Cryptlib/Include/openssl/evp.h
+++ b/Cryptlib/Include/openssl/evp.h
@@ -602,11 +602,13 @@ int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in);
 int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type);
 int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s);
 
+#ifndef OPENSSL_NO_UI
 int EVP_read_pw_string(char *buf, int length, const char *prompt, int verify);
 int EVP_read_pw_string_min(char *buf, int minlen, int maxlen,
                            const char *prompt, int verify);
 void EVP_set_pw_prompt(const char *prompt);
 char *EVP_get_pw_prompt(void);
+#endif
 
 int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
                    const unsigned char *salt, const unsigned char *data,
diff --git a/Cryptlib/Include/openssl/kssl.h b/Cryptlib/Include/openssl/kssl.h
index 9a576728..ae8a51f4 100644
--- a/Cryptlib/Include/openssl/kssl.h
+++ b/Cryptlib/Include/openssl/kssl.h
@@ -1,4 +1,4 @@
-/* ssl/kssl.h -*- mode: C; c-file-style: "eay" -*- */
+/* ssl/kssl.h */
 /*
  * Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project
  * 2000. project 2000.
diff --git a/Cryptlib/Include/openssl/opensslconf.h b/Cryptlib/Include/openssl/opensslconf.h
index 90a4d2c8..adcaa01d 100644
--- a/Cryptlib/Include/openssl/opensslconf.h
+++ b/Cryptlib/Include/openssl/opensslconf.h
@@ -1,256 +1,503 @@
-/* opensslconf.h */
-/* WARNING: Generated automatically from opensslconf.h.in by Configure. */
-
-#ifdef  __cplusplus
-extern "C" {
-#endif
-/* OpenSSL was configured with the following options: */
-#ifndef OPENSSL_DOING_MAKEDEPEND
-
-
-#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
-# define OPENSSL_NO_EC_NISTP_64_GCC_128
-#endif
-#ifndef OPENSSL_NO_GMP
-# define OPENSSL_NO_GMP
-#endif
-#ifndef OPENSSL_NO_JPAKE
-# define OPENSSL_NO_JPAKE
-#endif
-#ifndef OPENSSL_NO_KRB5
-# define OPENSSL_NO_KRB5
-#endif
-#ifndef OPENSSL_NO_LIBUNBOUND
-# define OPENSSL_NO_LIBUNBOUND
-#endif
-#ifndef OPENSSL_NO_MD2
-# define OPENSSL_NO_MD2
-#endif
-#ifndef OPENSSL_NO_RC5
-# define OPENSSL_NO_RC5
-#endif
-#ifndef OPENSSL_NO_RFC3779
-# define OPENSSL_NO_RFC3779
-#endif
-#ifndef OPENSSL_NO_SCTP
-# define OPENSSL_NO_SCTP
-#endif
-#ifndef OPENSSL_NO_SSL_TRACE
-# define OPENSSL_NO_SSL_TRACE
-#endif
-#ifndef OPENSSL_NO_STORE
-# define OPENSSL_NO_STORE
-#endif
-#ifndef OPENSSL_NO_UNIT_TEST
-# define OPENSSL_NO_UNIT_TEST
-#endif
-
-#endif /* OPENSSL_DOING_MAKEDEPEND */
-
-#ifndef OPENSSL_NO_DYNAMIC_ENGINE
-# define OPENSSL_NO_DYNAMIC_ENGINE
-#endif
-
-/* The OPENSSL_NO_* macros are also defined as NO_* if the application
-   asks for it.  This is a transient feature that is provided for those
-   who haven't had the time to do the appropriate changes in their
-   applications.  */
-#ifdef OPENSSL_ALGORITHM_DEFINES
-# if defined(OPENSSL_NO_EC_NISTP_64_GCC_128) && !defined(NO_EC_NISTP_64_GCC_128)
-#  define NO_EC_NISTP_64_GCC_128
-# endif
-# if defined(OPENSSL_NO_GMP) && !defined(NO_GMP)
-#  define NO_GMP
-# endif
-# if defined(OPENSSL_NO_JPAKE) && !defined(NO_JPAKE)
-#  define NO_JPAKE
-# endif
-# if defined(OPENSSL_NO_KRB5) && !defined(NO_KRB5)
-#  define NO_KRB5
-# endif
-# if defined(OPENSSL_NO_LIBUNBOUND) && !defined(NO_LIBUNBOUND)
-#  define NO_LIBUNBOUND
-# endif
-# if defined(OPENSSL_NO_MD2) && !defined(NO_MD2)
-#  define NO_MD2
-# endif
-# if defined(OPENSSL_NO_RC5) && !defined(NO_RC5)
-#  define NO_RC5
-# endif
-# if defined(OPENSSL_NO_RFC3779) && !defined(NO_RFC3779)
-#  define NO_RFC3779
-# endif
-# if defined(OPENSSL_NO_SCTP) && !defined(NO_SCTP)
-#  define NO_SCTP
-# endif
-# if defined(OPENSSL_NO_SSL_TRACE) && !defined(NO_SSL_TRACE)
-#  define NO_SSL_TRACE
-# endif
-# if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
-#  define NO_STORE
-# endif
-# if defined(OPENSSL_NO_UNIT_TEST) && !defined(NO_UNIT_TEST)
-#  define NO_UNIT_TEST
-# endif
-#endif
-
-/* crypto/opensslconf.h.in */
-
-/* Generate 80386 code? */
-#undef I386_ONLY
-
-#if !(defined(VMS) || defined(__VMS)) /* VMS uses logical names instead */
-#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
-#define ENGINESDIR "/usr/local/ssl/lib/engines"
-#define OPENSSLDIR "/usr/local/ssl"
-#endif
-#endif
-
-#undef OPENSSL_UNISTD
-#define OPENSSL_UNISTD <unistd.h>
-
-#undef OPENSSL_EXPORT_VAR_AS_FUNCTION
-
-#if defined(HEADER_IDEA_H) && !defined(IDEA_INT)
-#define IDEA_INT unsigned int
-#endif
-
-#if defined(HEADER_MD2_H) && !defined(MD2_INT)
-#define MD2_INT unsigned int
-#endif
-
-#if defined(HEADER_RC2_H) && !defined(RC2_INT)
-/* I need to put in a mod for the alpha - eay */
-#define RC2_INT unsigned int
-#endif
-
-#if defined(HEADER_RC4_H)
-#if !defined(RC4_INT)
-/* using int types make the structure larger but make the code faster
- * on most boxes I have tested - up to %20 faster. */
-/*
- * I don't know what does "most" mean, but declaring "int" is a must on:
- * - Intel P6 because partial register stalls are very expensive;
- * - elder Alpha because it lacks byte load/store instructions;
- */
-#define RC4_INT unsigned int
-#endif
-#if !defined(RC4_CHUNK)
-/*
- * This enables code handling data aligned at natural CPU word
- * boundary. See crypto/rc4/rc4_enc.c for further details.
- */
-#undef RC4_CHUNK
-#endif
-#endif
-
-#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG)
-/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
- * %20 speed up (longs are 8 bytes, int's are 4). */
-#ifndef DES_LONG
-#define DES_LONG unsigned long
-#endif
-#endif
-
-#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H)
-#define CONFIG_HEADER_BN_H
-#undef BN_LLONG
-
-/* Should we define BN_DIV2W here? */
-
-/* Only one for the following should be defined */
-/* Bypass the following definitions for UEFI version. */
-#if !defined(OPENSSL_SYS_UEFI)
-#undef SIXTY_FOUR_BIT_LONG
-#undef SIXTY_FOUR_BIT
-#define THIRTY_TWO_BIT
-#endif
-#endif
-
-#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
-#define CONFIG_HEADER_RC4_LOCL_H
-/* if this is defined data[i] is used instead of *data, this is a %20
- * speedup on x86 */
-#undef RC4_INDEX
-#endif
-
-#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
-#define CONFIG_HEADER_BF_LOCL_H
-#undef BF_PTR
-#endif /* HEADER_BF_LOCL_H */
-
-#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)
-#define CONFIG_HEADER_DES_LOCL_H
-#ifndef DES_DEFAULT_OPTIONS
-/* the following is tweaked from a config script, that is why it is a
- * protected undef/define */
-#ifndef DES_PTR
-#undef DES_PTR
-#endif
-
-/* This helps C compiler generate the correct code for multiple functional
- * units.  It reduces register dependancies at the expense of 2 more
- * registers */
-#ifndef DES_RISC1
-#undef DES_RISC1
-#endif
-
-#ifndef DES_RISC2
-#undef DES_RISC2
-#endif
-
-#if defined(DES_RISC1) && defined(DES_RISC2)
-#error YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
-#endif
-
-/* Unroll the inner loop, this sometimes helps, sometimes hinders.
- * Very mucy CPU dependant */
-#ifndef DES_UNROLL
-#undef DES_UNROLL
-#endif
-
-/* These default values were supplied by
- * Peter Gutman <pgut001@cs.auckland.ac.nz>
- * They are only used if nothing else has been defined */
-#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL)
-/* Special defines which change the way the code is built depending on the
-   CPU and OS.  For SGI machines you can use _MIPS_SZLONG (32 or 64) to find
-   even newer MIPS CPU's, but at the moment one size fits all for
-   optimization options.  Older Sparc's work better with only UNROLL, but
-   there's no way to tell at compile time what it is you're running on */
- 
-#if defined( sun )		/* Newer Sparc's */
-#  define DES_PTR
-#  define DES_RISC1
-#  define DES_UNROLL
-#elif defined( __ultrix )	/* Older MIPS */
-#  define DES_PTR
-#  define DES_RISC2
-#  define DES_UNROLL
-#elif defined( __osf1__ )	/* Alpha */
-#  define DES_PTR
-#  define DES_RISC2
-#elif defined ( _AIX )		/* RS6000 */
-  /* Unknown */
-#elif defined( __hpux )		/* HP-PA */
-  /* Unknown */
-#elif defined( __aux )		/* 68K */
-  /* Unknown */
-#elif defined( __dgux )		/* 88K (but P6 in latest boxes) */
-#  define DES_UNROLL
-#elif defined( __sgi )		/* Newer MIPS */
-#  define DES_PTR
-#  define DES_RISC2
-#  define DES_UNROLL
-#elif defined(i386) || defined(__i386__)	/* x86 boxes, should be gcc */
-#  define DES_PTR
-#  define DES_RISC1
-#  define DES_UNROLL
-#endif /* Systems-specific speed defines */
-#endif
-
-#endif /* DES_DEFAULT_OPTIONS */
-#endif /* HEADER_DES_LOCL_H */
-#ifdef  __cplusplus
-}
-#endif
+/* opensslconf.h */

+/* WARNING: Generated automatically from opensslconf.h.in by Configure. */

+

+#ifdef  __cplusplus

+extern "C" {

+#endif

+/* OpenSSL was configured with the following options: */

+#ifndef OPENSSL_SYSNAME_UEFI

+# define OPENSSL_SYSNAME_UEFI

+#endif

+#ifndef OPENSSL_DOING_MAKEDEPEND

+

+

+#ifndef OPENSSL_NO_BF

+# define OPENSSL_NO_BF

+#endif

+#ifndef OPENSSL_NO_CAMELLIA

+# define OPENSSL_NO_CAMELLIA

+#endif

+#ifndef OPENSSL_NO_CAPIENG

+# define OPENSSL_NO_CAPIENG

+#endif

+#ifndef OPENSSL_NO_CAST

+# define OPENSSL_NO_CAST

+#endif

+#ifndef OPENSSL_NO_CMS

+# define OPENSSL_NO_CMS

+#endif

+#ifndef OPENSSL_NO_DEPRECATED

+# define OPENSSL_NO_DEPRECATED

+#endif

+#ifndef OPENSSL_NO_DGRAM

+# define OPENSSL_NO_DGRAM

+#endif

+#ifndef OPENSSL_NO_DSA

+# define OPENSSL_NO_DSA

+#endif

+#ifndef OPENSSL_NO_DYNAMIC_ENGINE

+# define OPENSSL_NO_DYNAMIC_ENGINE

+#endif

+#ifndef OPENSSL_NO_EC

+# define OPENSSL_NO_EC

+#endif

+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128

+# define OPENSSL_NO_EC_NISTP_64_GCC_128

+#endif

+#ifndef OPENSSL_NO_ECDH

+# define OPENSSL_NO_ECDH

+#endif

+#ifndef OPENSSL_NO_ECDSA

+# define OPENSSL_NO_ECDSA

+#endif

+#ifndef OPENSSL_NO_ENGINE

+# define OPENSSL_NO_ENGINE

+#endif

+#ifndef OPENSSL_NO_ENGINES

+# define OPENSSL_NO_ENGINES

+#endif

+#ifndef OPENSSL_NO_FILENAMES

+# define OPENSSL_NO_FILENAMES

+#endif

+#ifndef OPENSSL_NO_FP_API

+# define OPENSSL_NO_FP_API

+#endif

+#ifndef OPENSSL_NO_GMP

+# define OPENSSL_NO_GMP

+#endif

+#ifndef OPENSSL_NO_GOST

+# define OPENSSL_NO_GOST

+#endif

+#ifndef OPENSSL_NO_IDEA

+# define OPENSSL_NO_IDEA

+#endif

+#ifndef OPENSSL_NO_JPAKE

+# define OPENSSL_NO_JPAKE

+#endif

+#ifndef OPENSSL_NO_KRB5

+# define OPENSSL_NO_KRB5

+#endif

+#ifndef OPENSSL_NO_LIBUNBOUND

+# define OPENSSL_NO_LIBUNBOUND

+#endif

+#ifndef OPENSSL_NO_LOCKING

+# define OPENSSL_NO_LOCKING

+#endif

+#ifndef OPENSSL_NO_MD2

+# define OPENSSL_NO_MD2

+#endif

+#ifndef OPENSSL_NO_MDC2

+# define OPENSSL_NO_MDC2

+#endif

+#ifndef OPENSSL_NO_POSIX_IO

+# define OPENSSL_NO_POSIX_IO

+#endif

+#ifndef OPENSSL_NO_PQUEUE

+# define OPENSSL_NO_PQUEUE

+#endif

+#ifndef OPENSSL_NO_RC2

+# define OPENSSL_NO_RC2

+#endif

+#ifndef OPENSSL_NO_RC5

+# define OPENSSL_NO_RC5

+#endif

+#ifndef OPENSSL_NO_RCS

+# define OPENSSL_NO_RCS

+#endif

+#ifndef OPENSSL_NO_RFC3779

+# define OPENSSL_NO_RFC3779

+#endif

+#ifndef OPENSSL_NO_RIPEMD

+# define OPENSSL_NO_RIPEMD

+#endif

+#ifndef OPENSSL_NO_SCRYPT

+# define OPENSSL_NO_SCRYPT

+#endif

+#ifndef OPENSSL_NO_SCT

+# define OPENSSL_NO_SCT

+#endif

+#ifndef OPENSSL_NO_SCTP

+# define OPENSSL_NO_SCTP

+#endif

+#ifndef OPENSSL_NO_SEED

+# define OPENSSL_NO_SEED

+#endif

+#ifndef OPENSSL_NO_SHA0

+# define OPENSSL_NO_SHA0

+#endif

+#ifndef OPENSSL_NO_SOCK

+# define OPENSSL_NO_SOCK

+#endif

+#ifndef OPENSSL_NO_SRP

+# define OPENSSL_NO_SRP

+#endif

+#ifndef OPENSSL_NO_SSL_TRACE

+# define OPENSSL_NO_SSL_TRACE

+#endif

+#ifndef OPENSSL_NO_SSL2

+# define OPENSSL_NO_SSL2

+#endif

+#ifndef OPENSSL_NO_SSL3

+# define OPENSSL_NO_SSL3

+#endif

+#ifndef OPENSSL_NO_STDIO

+# define OPENSSL_NO_STDIO

+#endif

+#ifndef OPENSSL_NO_STORE

+# define OPENSSL_NO_STORE

+#endif

+#ifndef OPENSSL_NO_TS

+# define OPENSSL_NO_TS

+#endif

+#ifndef OPENSSL_NO_UI

+# define OPENSSL_NO_UI

+#endif

+#ifndef OPENSSL_NO_UNIT_TEST

+# define OPENSSL_NO_UNIT_TEST

+#endif

+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS

+# define OPENSSL_NO_WEAK_SSL_CIPHERS

+#endif

+#ifndef OPENSSL_NO_WHIRLPOOL

+# define OPENSSL_NO_WHIRLPOOL

+#endif

+

+#endif /* OPENSSL_DOING_MAKEDEPEND */

+

+#ifndef OPENSSL_NO_ASM

+# define OPENSSL_NO_ASM

+#endif

+#ifndef OPENSSL_NO_ERR

+# define OPENSSL_NO_ERR

+#endif

+#ifndef OPENSSL_NO_HW

+# define OPENSSL_NO_HW

+#endif

+#ifndef OPENSSL_NO_DYNAMIC_ENGINE

+# define OPENSSL_NO_DYNAMIC_ENGINE

+#endif

+

+/* The OPENSSL_NO_* macros are also defined as NO_* if the application

+   asks for it.  This is a transient feature that is provided for those

+   who haven't had the time to do the appropriate changes in their

+   applications.  */

+#ifdef OPENSSL_ALGORITHM_DEFINES

+# if defined(OPENSSL_NO_BF) && !defined(NO_BF)

+#  define NO_BF

+# endif

+# if defined(OPENSSL_NO_CAMELLIA) && !defined(NO_CAMELLIA)

+#  define NO_CAMELLIA

+# endif

+# if defined(OPENSSL_NO_CAPIENG) && !defined(NO_CAPIENG)

+#  define NO_CAPIENG

+# endif

+# if defined(OPENSSL_NO_CAST) && !defined(NO_CAST)

+#  define NO_CAST

+# endif

+# if defined(OPENSSL_NO_CMS) && !defined(NO_CMS)

+#  define NO_CMS

+# endif

+# if defined(OPENSSL_NO_DEPRECATED) && !defined(NO_DEPRECATED)

+#  define NO_DEPRECATED

+# endif

+# if defined(OPENSSL_NO_DGRAM) && !defined(NO_DGRAM)

+#  define NO_DGRAM

+# endif

+# if defined(OPENSSL_NO_DSA) && !defined(NO_DSA)

+#  define NO_DSA

+# endif

+# if defined(OPENSSL_NO_DYNAMIC_ENGINE) && !defined(NO_DYNAMIC_ENGINE)

+#  define NO_DYNAMIC_ENGINE

+# endif

+# if defined(OPENSSL_NO_EC) && !defined(NO_EC)

+#  define NO_EC

+# endif

+# if defined(OPENSSL_NO_EC_NISTP_64_GCC_128) && !defined(NO_EC_NISTP_64_GCC_128)

+#  define NO_EC_NISTP_64_GCC_128

+# endif

+# if defined(OPENSSL_NO_ECDH) && !defined(NO_ECDH)

+#  define NO_ECDH

+# endif

+# if defined(OPENSSL_NO_ECDSA) && !defined(NO_ECDSA)

+#  define NO_ECDSA

+# endif

+# if defined(OPENSSL_NO_ENGINE) && !defined(NO_ENGINE)

+#  define NO_ENGINE

+# endif

+# if defined(OPENSSL_NO_ENGINES) && !defined(NO_ENGINES)

+#  define NO_ENGINES

+# endif

+# if defined(OPENSSL_NO_FILENAMES) && !defined(NO_FILENAMES)

+#  define NO_FILENAMES

+# endif

+# if defined(OPENSSL_NO_FP_API) && !defined(NO_FP_API)

+#  define NO_FP_API

+# endif

+# if defined(OPENSSL_NO_GMP) && !defined(NO_GMP)

+#  define NO_GMP

+# endif

+# if defined(OPENSSL_NO_GOST) && !defined(NO_GOST)

+#  define NO_GOST

+# endif

+# if defined(OPENSSL_NO_IDEA) && !defined(NO_IDEA)

+#  define NO_IDEA

+# endif

+# if defined(OPENSSL_NO_JPAKE) && !defined(NO_JPAKE)

+#  define NO_JPAKE

+# endif

+# if defined(OPENSSL_NO_KRB5) && !defined(NO_KRB5)

+#  define NO_KRB5

+# endif

+# if defined(OPENSSL_NO_LIBUNBOUND) && !defined(NO_LIBUNBOUND)

+#  define NO_LIBUNBOUND

+# endif

+# if defined(OPENSSL_NO_LOCKING) && !defined(NO_LOCKING)

+#  define NO_LOCKING

+# endif

+# if defined(OPENSSL_NO_MD2) && !defined(NO_MD2)

+#  define NO_MD2

+# endif

+# if defined(OPENSSL_NO_MDC2) && !defined(NO_MDC2)

+#  define NO_MDC2

+# endif

+# if defined(OPENSSL_NO_POSIX_IO) && !defined(NO_POSIX_IO)

+#  define NO_POSIX_IO

+# endif

+# if defined(OPENSSL_NO_PQUEUE) && !defined(NO_PQUEUE)

+#  define NO_PQUEUE

+# endif

+# if defined(OPENSSL_NO_RC2) && !defined(NO_RC2)

+#  define NO_RC2

+# endif

+# if defined(OPENSSL_NO_RC5) && !defined(NO_RC5)

+#  define NO_RC5

+# endif

+# if defined(OPENSSL_NO_RCS) && !defined(NO_RCS)

+#  define NO_RCS

+# endif

+# if defined(OPENSSL_NO_RFC3779) && !defined(NO_RFC3779)

+#  define NO_RFC3779

+# endif

+# if defined(OPENSSL_NO_RIPEMD) && !defined(NO_RIPEMD)

+#  define NO_RIPEMD

+# endif

+# if defined(OPENSSL_NO_SCRYPT) && !defined(NO_SCRYPT)

+#  define NO_SCRYPT

+# endif

+# if defined(OPENSSL_NO_SCT) && !defined(NO_SCT)

+#  define NO_SCT

+# endif

+# if defined(OPENSSL_NO_SCTP) && !defined(NO_SCTP)

+#  define NO_SCTP

+# endif

+# if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)

+#  define NO_SEED

+# endif

+# if defined(OPENSSL_NO_SHA0) && !defined(NO_SHA0)

+#  define NO_SHA0

+# endif

+# if defined(OPENSSL_NO_SOCK) && !defined(NO_SOCK)

+#  define NO_SOCK

+# endif

+# if defined(OPENSSL_NO_SRP) && !defined(NO_SRP)

+#  define NO_SRP

+# endif

+# if defined(OPENSSL_NO_SSL_TRACE) && !defined(NO_SSL_TRACE)

+#  define NO_SSL_TRACE

+# endif

+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)

+#  define NO_SSL2

+# endif

+# if defined(OPENSSL_NO_SSL3) && !defined(NO_SSL3)

+#  define NO_SSL3

+# endif

+# if defined(OPENSSL_NO_STDIO) && !defined(NO_STDIO)

+#  define NO_STDIO

+# endif

+# if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)

+#  define NO_STORE

+# endif

+# if defined(OPENSSL_NO_TS) && !defined(NO_TS)

+#  define NO_TS

+# endif

+# if defined(OPENSSL_NO_UI) && !defined(NO_UI)

+#  define NO_UI

+# endif

+# if defined(OPENSSL_NO_UNIT_TEST) && !defined(NO_UNIT_TEST)

+#  define NO_UNIT_TEST

+# endif

+# if defined(OPENSSL_NO_WEAK_SSL_CIPHERS) && !defined(NO_WEAK_SSL_CIPHERS)

+#  define NO_WEAK_SSL_CIPHERS

+# endif

+# if defined(OPENSSL_NO_WHIRLPOOL) && !defined(NO_WHIRLPOOL)

+#  define NO_WHIRLPOOL

+# endif

+#endif

+

+/* crypto/opensslconf.h.in */

+

+#ifndef OPENSSL_FILE

+#ifdef OPENSSL_NO_FILENAMES

+#define OPENSSL_FILE ""

+#define OPENSSL_LINE 0

+#else

+#define OPENSSL_FILE __FILE__

+#define OPENSSL_LINE __LINE__

+#endif

+#endif

+

+/* Generate 80386 code? */

+#undef I386_ONLY

+

+#if !(defined(VMS) || defined(__VMS)) /* VMS uses logical names instead */

+#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)

+#define ENGINESDIR "/usr/local/ssl/lib/engines"

+#define OPENSSLDIR "/usr/local/ssl"

+#endif

+#endif

+

+#undef OPENSSL_UNISTD

+#define OPENSSL_UNISTD <unistd.h>

+

+#undef OPENSSL_EXPORT_VAR_AS_FUNCTION

+

+#if defined(HEADER_IDEA_H) && !defined(IDEA_INT)

+#define IDEA_INT unsigned int

+#endif

+

+#if defined(HEADER_MD2_H) && !defined(MD2_INT)

+#define MD2_INT unsigned int

+#endif

+

+#if defined(HEADER_RC2_H) && !defined(RC2_INT)

+/* I need to put in a mod for the alpha - eay */

+#define RC2_INT unsigned int

+#endif

+

+#if defined(HEADER_RC4_H)

+#if !defined(RC4_INT)

+/* using int types make the structure larger but make the code faster

+ * on most boxes I have tested - up to %20 faster. */

+/*

+ * I don't know what does "most" mean, but declaring "int" is a must on:

+ * - Intel P6 because partial register stalls are very expensive;

+ * - elder Alpha because it lacks byte load/store instructions;

+ */

+#define RC4_INT unsigned int

+#endif

+#if !defined(RC4_CHUNK)

+/*

+ * This enables code handling data aligned at natural CPU word

+ * boundary. See crypto/rc4/rc4_enc.c for further details.

+ */

+#undef RC4_CHUNK

+#endif

+#endif

+

+#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG)

+/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a

+ * %20 speed up (longs are 8 bytes, int's are 4). */

+#ifndef DES_LONG

+#define DES_LONG unsigned long

+#endif

+#endif

+

+#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) && !defined(OPENSSL_SYSNAME_UEFI)

+#define CONFIG_HEADER_BN_H

+#undef BN_LLONG

+

+/* Should we define BN_DIV2W here? */

+

+/* Only one for the following should be defined */

+#undef SIXTY_FOUR_BIT_LONG

+#undef SIXTY_FOUR_BIT

+#define THIRTY_TWO_BIT

+#endif

+

+#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)

+#define CONFIG_HEADER_RC4_LOCL_H

+/* if this is defined data[i] is used instead of *data, this is a %20

+ * speedup on x86 */

+#undef RC4_INDEX

+#endif

+

+#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)

+#define CONFIG_HEADER_BF_LOCL_H

+#undef BF_PTR

+#endif /* HEADER_BF_LOCL_H */

+

+#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)

+#define CONFIG_HEADER_DES_LOCL_H

+#ifndef DES_DEFAULT_OPTIONS

+/* the following is tweaked from a config script, that is why it is a

+ * protected undef/define */

+#ifndef DES_PTR

+#undef DES_PTR

+#endif

+

+/* This helps C compiler generate the correct code for multiple functional

+ * units.  It reduces register dependancies at the expense of 2 more

+ * registers */

+#ifndef DES_RISC1

+#undef DES_RISC1

+#endif

+

+#ifndef DES_RISC2

+#undef DES_RISC2

+#endif

+

+#if defined(DES_RISC1) && defined(DES_RISC2)

+#error YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!

+#endif

+

+/* Unroll the inner loop, this sometimes helps, sometimes hinders.

+ * Very mucy CPU dependant */

+#ifndef DES_UNROLL

+#undef DES_UNROLL

+#endif

+

+/* These default values were supplied by

+ * Peter Gutman <pgut001@cs.auckland.ac.nz>

+ * They are only used if nothing else has been defined */

+#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL)

+/* Special defines which change the way the code is built depending on the

+   CPU and OS.  For SGI machines you can use _MIPS_SZLONG (32 or 64) to find

+   even newer MIPS CPU's, but at the moment one size fits all for

+   optimization options.  Older Sparc's work better with only UNROLL, but

+   there's no way to tell at compile time what it is you're running on */

+ 

+#if defined( __sun ) || defined ( sun )		/* Newer Sparc's */

+#  define DES_PTR

+#  define DES_RISC1

+#  define DES_UNROLL

+#elif defined( __ultrix )	/* Older MIPS */

+#  define DES_PTR

+#  define DES_RISC2

+#  define DES_UNROLL

+#elif defined( __osf1__ )	/* Alpha */

+#  define DES_PTR

+#  define DES_RISC2

+#elif defined ( _AIX )		/* RS6000 */

+  /* Unknown */

+#elif defined( __hpux )		/* HP-PA */

+  /* Unknown */

+#elif defined( __aux )		/* 68K */

+  /* Unknown */

+#elif defined( __dgux )		/* 88K (but P6 in latest boxes) */

+#  define DES_UNROLL

+#elif defined( __sgi )		/* Newer MIPS */

+#  define DES_PTR

+#  define DES_RISC2

+#  define DES_UNROLL

+#elif defined(i386) || defined(__i386__)	/* x86 boxes, should be gcc */

+#  define DES_PTR

+#  define DES_RISC1

+#  define DES_UNROLL

+#endif /* Systems-specific speed defines */

+#endif

+

+#endif /* DES_DEFAULT_OPTIONS */

+#endif /* HEADER_DES_LOCL_H */

+#ifdef  __cplusplus

+}

+#endif

diff --git a/Cryptlib/Include/openssl/opensslv.h b/Cryptlib/Include/openssl/opensslv.h
index c06b13ac..13fe4402 100644
--- a/Cryptlib/Include/openssl/opensslv.h
+++ b/Cryptlib/Include/openssl/opensslv.h
@@ -30,11 +30,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x1000204fL
+# define OPENSSL_VERSION_NUMBER  0x1000208fL
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2d-fips 9 Jul 2015"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2h-fips  3 May 2016"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2d 9 Jul 2015"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2h  3 May 2016"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/Cryptlib/Include/openssl/pem.h b/Cryptlib/Include/openssl/pem.h
index d61605b9..5df6ffdf 100644
--- a/Cryptlib/Include/openssl/pem.h
+++ b/Cryptlib/Include/openssl/pem.h
@@ -418,6 +418,7 @@ int PEM_X509_INFO_write_bio(BIO *bp, X509_INFO *xi, EVP_CIPHER *enc,
                             pem_password_cb *cd, void *u);
 # endif
 
+#ifndef OPENSSL_NO_FP_API
 int PEM_read(FILE *fp, char **name, char **header,
              unsigned char **data, long *len);
 int PEM_write(FILE *fp, const char *name, const char *hdr,
@@ -429,6 +430,7 @@ int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp,
                    int klen, pem_password_cb *callback, void *u);
 STACK_OF(X509_INFO) *PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk,
                                         pem_password_cb *cb, void *u);
+#endif
 
 int PEM_SealInit(PEM_ENCODE_SEAL_CTX *ctx, EVP_CIPHER *type,
                  EVP_MD *md_type, unsigned char **ek, int *ekl,
@@ -495,6 +497,7 @@ int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, EVP_PKEY *x, int nid,
 EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
                                   void *u);
 
+#ifndef OPENSSL_NO_FP_API
 int i2d_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
                            char *kstr, int klen,
                            pem_password_cb *cb, void *u);
@@ -511,6 +514,7 @@ EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x, pem_password_cb *cb,
 int PEM_write_PKCS8PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
                               char *kstr, int klen, pem_password_cb *cd,
                               void *u);
+#endif
 
 EVP_PKEY *PEM_read_bio_Parameters(BIO *bp, EVP_PKEY **x);
 int PEM_write_bio_Parameters(BIO *bp, EVP_PKEY *x);
diff --git a/Cryptlib/Include/openssl/srp.h b/Cryptlib/Include/openssl/srp.h
index d072536f..4ed4bfe5 100644
--- a/Cryptlib/Include/openssl/srp.h
+++ b/Cryptlib/Include/openssl/srp.h
@@ -82,16 +82,21 @@ typedef struct SRP_gN_cache_st {
 DECLARE_STACK_OF(SRP_gN_cache)
 
 typedef struct SRP_user_pwd_st {
+    /* Owned by us. */
     char *id;
     BIGNUM *s;
     BIGNUM *v;
+    /* Not owned by us. */
     const BIGNUM *g;
     const BIGNUM *N;
+    /* Owned by us. */
     char *info;
 } SRP_user_pwd;
 
 DECLARE_STACK_OF(SRP_user_pwd)
 
+void SRP_user_pwd_free(SRP_user_pwd *user_pwd);
+
 typedef struct SRP_VBASE_st {
     STACK_OF(SRP_user_pwd) *users_pwd;
     STACK_OF(SRP_gN_cache) *gN_cache;
@@ -114,8 +119,15 @@ DECLARE_STACK_OF(SRP_gN)
 
 SRP_VBASE *SRP_VBASE_new(char *seed_key);
 int SRP_VBASE_free(SRP_VBASE *vb);
+#ifndef OPENSSL_NO_STDIO
 int SRP_VBASE_init(SRP_VBASE *vb, char *verifier_file);
+#endif
+
+/* This method ignores the configured seed and fails for an unknown user. */
 SRP_user_pwd *SRP_VBASE_get_by_user(SRP_VBASE *vb, char *username);
+/* NOTE: unlike in SRP_VBASE_get_by_user, caller owns the returned pointer.*/
+SRP_user_pwd *SRP_VBASE_get1_by_user(SRP_VBASE *vb, char *username);
+
 char *SRP_create_verifier(const char *user, const char *pass, char **salt,
                           char **verifier, const char *N, const char *g);
 int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,
diff --git a/Cryptlib/Include/openssl/ssl.h b/Cryptlib/Include/openssl/ssl.h
index 6fe1a247..5ef56faa 100644
--- a/Cryptlib/Include/openssl/ssl.h
+++ b/Cryptlib/Include/openssl/ssl.h
@@ -338,7 +338,7 @@ extern "C" {
  * The following cipher list is used by default. It also is substituted when
  * an application-defined cipher list string starts with 'DEFAULT'.
  */
-# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!aNULL:!eNULL:!SSLv2"
+# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2"
 /*
  * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
  * starts with a reasonable order, and all we have to do for DEFAULT is
@@ -625,7 +625,7 @@ struct ssl_session_st {
 # define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION        0x00040000L
 /* If set, always create a new key when using tmp_ecdh parameters */
 # define SSL_OP_SINGLE_ECDH_USE                          0x00080000L
-/* If set, always create a new key when using tmp_dh parameters */
+/* Does nothing: retained for compatibility */
 # define SSL_OP_SINGLE_DH_USE                            0x00100000L
 /* Does nothing: retained for compatibiity */
 # define SSL_OP_EPHEMERAL_RSA                            0x0
@@ -2092,7 +2092,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 # define SSL_CTX_set1_sigalgs_list(ctx, s) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SIGALGS_LIST,0,(char *)s)
 # define SSL_set1_sigalgs(ctx, slist, slistlen) \
-        SSL_ctrl(ctx,SSL_CTRL_SET_SIGALGS,clistlen,(int *)slist)
+        SSL_ctrl(ctx,SSL_CTRL_SET_SIGALGS,slistlen,(int *)slist)
 # define SSL_set1_sigalgs_list(ctx, s) \
         SSL_ctrl(ctx,SSL_CTRL_SET_SIGALGS_LIST,0,(char *)s)
 # define SSL_CTX_set1_client_sigalgs(ctx, slist, slistlen) \
@@ -2345,7 +2345,7 @@ const char *SSL_get_version(const SSL *s);
 /* This sets the 'default' SSL version that SSL_new() will create */
 int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth);
 
-# ifndef OPENSSL_NO_SSL2
+# ifndef OPENSSL_NO_SSL2_METHOD
 const SSL_METHOD *SSLv2_method(void); /* SSLv2 */
 const SSL_METHOD *SSLv2_server_method(void); /* SSLv2 */
 const SSL_METHOD *SSLv2_client_method(void); /* SSLv2 */
@@ -2681,6 +2681,7 @@ void ERR_load_SSL_strings(void);
 # define SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC                 292
 # define SSL_F_SSL3_ENC                                   134
 # define SSL_F_SSL3_GENERATE_KEY_BLOCK                    238
+# define SSL_F_SSL3_GENERATE_MASTER_SECRET                388
 # define SSL_F_SSL3_GET_CERTIFICATE_REQUEST               135
 # define SSL_F_SSL3_GET_CERT_STATUS                       289
 # define SSL_F_SSL3_GET_CERT_VERIFY                       136
@@ -2846,8 +2847,11 @@ void ERR_load_SSL_strings(void);
 # define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK              106
 # define SSL_R_BAD_DECOMPRESSION                          107
 # define SSL_R_BAD_DH_G_LENGTH                            108
+# define SSL_R_BAD_DH_G_VALUE                             375
 # define SSL_R_BAD_DH_PUB_KEY_LENGTH                      109
+# define SSL_R_BAD_DH_PUB_KEY_VALUE                       393
 # define SSL_R_BAD_DH_P_LENGTH                            110
+# define SSL_R_BAD_DH_P_VALUE                             395
 # define SSL_R_BAD_DIGEST_LENGTH                          111
 # define SSL_R_BAD_DSA_SIGNATURE                          112
 # define SSL_R_BAD_ECC_CERT                               304
@@ -3052,6 +3056,7 @@ void ERR_load_SSL_strings(void);
 # define SSL_R_SERVERHELLO_TLSEXT                         275
 # define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED           277
 # define SSL_R_SHORT_READ                                 219
+# define SSL_R_SHUTDOWN_WHILE_IN_INIT                     407
 # define SSL_R_SIGNATURE_ALGORITHMS_ERROR                 360
 # define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE      220
 # define SSL_R_SRP_A_CALC                                 361
diff --git a/Cryptlib/Include/openssl/tls1.h b/Cryptlib/Include/openssl/tls1.h
index 5929607f..7e237d06 100644
--- a/Cryptlib/Include/openssl/tls1.h
+++ b/Cryptlib/Include/openssl/tls1.h
@@ -231,13 +231,12 @@ extern "C" {
 /* ExtensionType value from RFC5620 */
 # define TLSEXT_TYPE_heartbeat   15
 
-/* ExtensionType value from draft-ietf-tls-applayerprotoneg-00 */
+/* ExtensionType value from RFC7301 */
 # define TLSEXT_TYPE_application_layer_protocol_negotiation 16
 
 /*
  * ExtensionType value for TLS padding extension.
- * http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
- * http://tools.ietf.org/html/draft-agl-tls-padding-03
+ * http://tools.ietf.org/html/draft-agl-tls-padding
  */
 # define TLSEXT_TYPE_padding     21
 
@@ -262,20 +261,19 @@ extern "C" {
 #  define TLSEXT_TYPE_next_proto_neg              13172
 # endif
 
-/* NameType value from RFC 3546 */
+/* NameType value from RFC3546 */
 # define TLSEXT_NAMETYPE_host_name 0
-/* status request value from RFC 3546 */
+/* status request value from RFC3546 */
 # define TLSEXT_STATUSTYPE_ocsp 1
 
-/* ECPointFormat values from draft-ietf-tls-ecc-12 */
+/* ECPointFormat values from RFC4492 */
 # define TLSEXT_ECPOINTFORMAT_first                      0
 # define TLSEXT_ECPOINTFORMAT_uncompressed               0
 # define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime  1
 # define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2  2
 # define TLSEXT_ECPOINTFORMAT_last                       2
 
-/* Signature and hash algorithms from RFC 5246 */
-
+/* Signature and hash algorithms from RFC5246 */
 # define TLSEXT_signature_anonymous                      0
 # define TLSEXT_signature_rsa                            1
 # define TLSEXT_signature_dsa                            2
@@ -430,7 +428,6 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 # define TLS1_CK_DHE_DSS_WITH_RC4_128_SHA                0x03000066
 
 /* AES ciphersuites from RFC3268 */
-
 # define TLS1_CK_RSA_WITH_AES_128_SHA                    0x0300002F
 # define TLS1_CK_DH_DSS_WITH_AES_128_SHA                 0x03000030
 # define TLS1_CK_DH_RSA_WITH_AES_128_SHA                 0x03000031
@@ -595,7 +592,7 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 # define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA               "DHE-RSA-AES256-SHA"
 # define TLS1_TXT_ADH_WITH_AES_256_SHA                   "ADH-AES256-SHA"
 
-/* ECC ciphersuites from draft-ietf-tls-ecc-01.txt (Mar 15, 2001) */
+/* ECC ciphersuites from RFC4492 */
 # define TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA               "ECDH-ECDSA-NULL-SHA"
 # define TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA            "ECDH-ECDSA-RC4-SHA"
 # define TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA       "ECDH-ECDSA-DES-CBC3-SHA"
diff --git a/Cryptlib/Include/openssl/ts.h b/Cryptlib/Include/openssl/ts.h
index 16eccbb3..a9fe40ed 100644
--- a/Cryptlib/Include/openssl/ts.h
+++ b/Cryptlib/Include/openssl/ts.h
@@ -281,8 +281,10 @@ TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
 
 TS_REQ *TS_REQ_dup(TS_REQ *a);
 
+#ifndef OPENSSL_NO_FP_API
 TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
 int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
+#endif
 TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
 int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
 
@@ -294,10 +296,12 @@ TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
 
 TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
 
+#ifndef OPENSSL_NO_FP_API
 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
 int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
-TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
-int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);
+#endif
+TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *bio, TS_MSG_IMPRINT **a);
+int i2d_TS_MSG_IMPRINT_bio(BIO *bio, TS_MSG_IMPRINT *a);
 
 TS_RESP *TS_RESP_new(void);
 void TS_RESP_free(TS_RESP *a);
@@ -306,10 +310,12 @@ TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
 TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
 TS_RESP *TS_RESP_dup(TS_RESP *a);
 
+#ifndef OPENSSL_NO_FP_API
 TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
 int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
-TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
-int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);
+#endif
+TS_RESP *d2i_TS_RESP_bio(BIO *bio, TS_RESP **a);
+int i2d_TS_RESP_bio(BIO *bio, TS_RESP *a);
 
 TS_STATUS_INFO *TS_STATUS_INFO_new(void);
 void TS_STATUS_INFO_free(TS_STATUS_INFO *a);
@@ -325,10 +331,12 @@ TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
                              long length);
 TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a);
 
+#ifndef OPENSSL_NO_FP_API
 TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
 int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
-TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
-int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);
+#endif
+TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bio, TS_TST_INFO **a);
+int i2d_TS_TST_INFO_bio(BIO *bio, TS_TST_INFO *a);
 
 TS_ACCURACY *TS_ACCURACY_new(void);
 void TS_ACCURACY_free(TS_ACCURACY *a);
@@ -728,15 +736,18 @@ int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
  * ts/ts_conf.c
  */
 
+#ifndef OPENSSL_NO_STDIO
 X509 *TS_CONF_load_cert(const char *file);
 STACK_OF(X509) *TS_CONF_load_certs(const char *file);
 EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
+#endif
 const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
 int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
                        TS_RESP_CTX *ctx);
 int TS_CONF_set_crypto_device(CONF *conf, const char *section,
                               const char *device);
 int TS_CONF_set_default_engine(const char *name);
+#ifndef OPENSSL_NO_STDIO
 int TS_CONF_set_signer_cert(CONF *conf, const char *section,
                             const char *cert, TS_RESP_CTX *ctx);
 int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
@@ -744,6 +755,7 @@ int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
 int TS_CONF_set_signer_key(CONF *conf, const char *section,
                            const char *key, const char *pass,
                            TS_RESP_CTX *ctx);
+#endif
 int TS_CONF_set_def_policy(CONF *conf, const char *section,
                            const char *policy, TS_RESP_CTX *ctx);
 int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
@@ -784,6 +796,11 @@ void ERR_load_TS_strings(void);
 # define TS_F_TS_CHECK_SIGNING_CERTS                      103
 # define TS_F_TS_CHECK_STATUS_INFO                        104
 # define TS_F_TS_COMPUTE_IMPRINT                          145
+# define TS_F_TS_CONF_INVALID                             151
+# define TS_F_TS_CONF_LOAD_CERT                           153
+# define TS_F_TS_CONF_LOAD_CERTS                          154
+# define TS_F_TS_CONF_LOAD_KEY                            155
+# define TS_F_TS_CONF_LOOKUP_FAIL                         152
 # define TS_F_TS_CONF_SET_DEFAULT_ENGINE                  146
 # define TS_F_TS_GET_STATUS_TEXT                          105
 # define TS_F_TS_MSG_IMPRINT_SET_ALGO                     118
@@ -822,6 +839,8 @@ void ERR_load_TS_strings(void);
 /* Reason codes. */
 # define TS_R_BAD_PKCS7_TYPE                              132
 # define TS_R_BAD_TYPE                                    133
+# define TS_R_CANNOT_LOAD_CERT                            137
+# define TS_R_CANNOT_LOAD_KEY                             138
 # define TS_R_CERTIFICATE_VERIFY_ERROR                    100
 # define TS_R_COULD_NOT_SET_ENGINE                        127
 # define TS_R_COULD_NOT_SET_TIME                          115
@@ -854,6 +873,8 @@ void ERR_load_TS_strings(void);
 # define TS_R_UNACCEPTABLE_POLICY                         125
 # define TS_R_UNSUPPORTED_MD_ALGORITHM                    126
 # define TS_R_UNSUPPORTED_VERSION                         113
+# define TS_R_VAR_BAD_VALUE                               135
+# define TS_R_VAR_LOOKUP_FAILURE                          136
 # define TS_R_WRONG_CONTENT_TYPE                          114
 
 #ifdef  __cplusplus
diff --git a/Cryptlib/Include/openssl/ui.h b/Cryptlib/Include/openssl/ui.h
index b917edab..0dc16330 100644
--- a/Cryptlib/Include/openssl/ui.h
+++ b/Cryptlib/Include/openssl/ui.h
@@ -1,4 +1,4 @@
-/* crypto/ui/ui.h -*- mode:C; c-file-style: "eay" -*- */
+/* crypto/ui/ui.h */
 /*
  * Written by Richard Levitte (richard@levitte.org) for the OpenSSL project
  * 2001.
diff --git a/Cryptlib/Include/openssl/ui_compat.h b/Cryptlib/Include/openssl/ui_compat.h
index 42fb9ff6..bf541542 100644
--- a/Cryptlib/Include/openssl/ui_compat.h
+++ b/Cryptlib/Include/openssl/ui_compat.h
@@ -1,4 +1,4 @@
-/* crypto/ui/ui.h -*- mode:C; c-file-style: "eay" -*- */
+/* crypto/ui/ui.h */
 /*
  * Written by Richard Levitte (richard@levitte.org) for the OpenSSL project
  * 2001.
diff --git a/Cryptlib/Include/openssl/x509.h b/Cryptlib/Include/openssl/x509.h
index 99337b84..fc613ce6 100644
--- a/Cryptlib/Include/openssl/x509.h
+++ b/Cryptlib/Include/openssl/x509.h
@@ -1305,6 +1305,7 @@ void ERR_load_X509_strings(void);
 # define X509_R_LOADING_CERT_DIR                          103
 # define X509_R_LOADING_DEFAULTS                          104
 # define X509_R_METHOD_NOT_SUPPORTED                      124
+# define X509_R_NAME_TOO_LONG                             134
 # define X509_R_NEWER_CRL_NOT_NEWER                       132
 # define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY              105
 # define X509_R_NO_CRL_NUMBER                             130
diff --git a/Cryptlib/Include/openssl/x509_vfy.h b/Cryptlib/Include/openssl/x509_vfy.h
index bd8613c6..3790ef5b 100644
--- a/Cryptlib/Include/openssl/x509_vfy.h
+++ b/Cryptlib/Include/openssl/x509_vfy.h
@@ -313,7 +313,7 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
                 X509_LOOKUP_ctrl((x),X509_L_ADD_DIR,(name),(long)(type),NULL)
 
 # define         X509_V_OK                                       0
-/* illegal error (for uninitialized values, to avoid X509_V_OK): 1 */
+# define         X509_V_ERR_UNSPECIFIED                          1
 
 # define         X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT            2
 # define         X509_V_ERR_UNABLE_TO_GET_CRL                    3
@@ -438,6 +438,8 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
  * will force the behaviour to match that of previous versions.
  */
 # define X509_V_FLAG_NO_ALT_CHAINS               0x100000
+/* Do not check certificate/CRL validity against current time */
+# define X509_V_FLAG_NO_CHECK_TIME               0x200000
 
 # define X509_VP_FLAG_DEFAULT                    0x1
 # define X509_VP_FLAG_OVERWRITE                  0x2
@@ -490,9 +492,10 @@ void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
 X509_STORE *X509_STORE_CTX_get0_store(X509_STORE_CTX *ctx);
 
 X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m);
-
+#ifndef OPENSSL_NO_STDIO
 X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void);
 X509_LOOKUP_METHOD *X509_LOOKUP_file(void);
+#endif
 
 int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
 int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
diff --git a/Cryptlib/Include/openssl/x509v3.h b/Cryptlib/Include/openssl/x509v3.h
index f5c61560..a2e78aa3 100644
--- a/Cryptlib/Include/openssl/x509v3.h
+++ b/Cryptlib/Include/openssl/x509v3.h
@@ -688,8 +688,9 @@ void X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent,
                         int ml);
 int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, unsigned long flag,
                      int indent);
+#ifndef OPENSSL_NO_FP_API
 int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
-
+#endif
 int X509V3_extensions_print(BIO *out, char *title,
                             STACK_OF(X509_EXTENSION) *exts,
                             unsigned long flag, int indent);