Merge lp:~nvalcarcel/ubuntu/lucid/openssl/openssl-merge into lp:ubuntu/lucid/openssl

[Nicolas Valcarcel]

[Nicolas Valcarcel (nvalcarcel)]

Merged with debian testing

[lp:~nvalcarcel/ubuntu/lucid/openssl/openssl-merge]

36. By Nicolas Valcarcel on 2009-12-07

* Disable CVE-2009-3555.patch
* Bump the shlibs to require 0.9.8k-1. The following symbols
  to added between g and k: AES_wrap_key, AES_unwrap_key,
  ASN1_TYPE_set1, ASN1_STRING_set0, asn1_output_data_fn,
  SMIME_read_ASN1, BN_X931_generate_Xpq, BN_X931_derive_prime_ex,
  BN_X931_generate_prime_ex, COMP_zlib_cleanup, CRYPTO_malloc_debug_init,
  int_CRYPTO_set_do_dynlock_callback, CRYPTO_set_mem_info_functions,
  CRYPTO_strdup, CRYPTO_dbg_push_info, CRYPTO_dbg_pop_info,
  CRYPTO_dbg_remove_all_info, OPENSSL_isservice, OPENSSL_init,
  ENGINE_set_load_ssl_client_cert_function,
  ENGINE_get_ssl_client_cert_function, ENGINE_load_ssl_client_cert,
  EVP_CIPHER_CTX_set_flags, EVP_CIPHER_CTX_clear_flags,
  EVP_CIPHER_CTX_test_flags, HMAC_CTX_set_flags, OCSP_sendreq_new
  OCSP_sendreq_nbio, OCSP_REQ_CTX_free, RSA_X931_derive_ex,
  RSA_X931_generate_key_ex, X509_ALGOR_set0, X509_ALGOR_get0,
  X509at_get0_data_by_OBJ, X509_get1_ocsp

37. By Nicolas Valcarcel on 2009-12-07

Fix version

38. By Nicolas Valcarcel on 2009-12-07

add disable-sslv2.patch and Bsymbolic-functions.patch

39. By Nicolas Valcarcel on 2009-12-07

Move runtime libraries to /lib, for the benefit of wpasupplicant

[James Westby (james-w)]

Marking as merged as 0.9.8k is in lucid.

Thanks,

James

=== added directory '.pc'
=== added file '.pc/.version'
--- .pc/.version	1970-01-01 00:00:00 +0000
+++ .pc/.version	2009-12-07 19:46:11 +0000
@@ -0,0 +1,1 @@
+2
 
=== modified file 'CHANGES'
--- CHANGES	2007-12-05 00:13:39 +0000
+++ CHANGES	2009-12-07 19:46:11 +0000
@@ -2,6 +2,284 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
+
+  *) Don't set val to NULL when freeing up structures, it is freed up by
+     underlying code. If sizeof(void *) > sizeof(long) this can result in
+     zeroing past the valid field. (CVE-2009-0789)
+     [Paolo Ganci <[e-mail]>]
+
+  *) Fix bug where return value of CMS_SignerInfo_verify_content() was not
+     checked correctly. This would allow some invalid signed attributes to
+     appear to verify correctly. (CVE-2009-0591)
+     [Ivan Nestlerode <[e-mail]>]
+
+  *) Reject UniversalString and BMPString types with invalid lengths. This
+     prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
+     a legal length. (CVE-2009-0590)
+     [Steve Henson]
+
+  *) Set S/MIME signing as the default purpose rather than setting it 
+     unconditionally. This allows applications to override it at the store
+     level.
+     [Steve Henson]
+
+  *) Permit restricted recursion of ASN1 strings. This is needed in practice
+     to handle some structures.
+     [Steve Henson]
+
+  *) Improve efficiency of mem_gets: don't search whole buffer each time
+     for a '\n'
+     [Jeremy Shapiro <[e-mail]>]
+
+  *) New -hex option for openssl rand.
+     [Matthieu Herrb]
+
+  *) Print out UTF8String and NumericString when parsing ASN1.
+     [Steve Henson]
+
+  *) Support NumericString type for name components.
+     [Steve Henson]
+
+  *) Allow CC in the environment to override the automatically chosen
+     compiler. Note that nothing is done to ensure flags work with the
+     chosen compiler.
+     [Ben Laurie]
+
+ Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
+
+  *) Properly check EVP_VerifyFinal() and similar return values
+     (CVE-2008-5077).
+     [Ben Laurie, Bodo Moeller, Google Security Team]
+
+  *) Enable TLS extensions by default.
+     [Ben Laurie]
+
+  *) Allow the CHIL engine to be loaded, whether the application is
+     multithreaded or not. (This does not release the developer from the
+     obligation to set up the dynamic locking callbacks.)
+     [Sander Temme <[e-mail]>]
+
+  *) Use correct exit code if there is an error in dgst command.
+     [Steve Henson; problem pointed out by Roland Dirlewanger]
+
+  *) Tweak Configure so that you need to say "experimental-jpake" to enable
+     JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
+     [Bodo Moeller]
+
+  *) Add experimental JPAKE support, including demo authentication in
+     s_client and s_server.
+     [Ben Laurie]
+
+  *) Set the comparison function in v3_addr_canonize().
+     [Rob Austein <[e-mail]>]
+
+  *) Add support for XMPP STARTTLS in s_client.
+     [Philip Paeps <[e-mail]>]
+
+  *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
+     to ensure that even with this option, only ciphersuites in the
+     server's preference list will be accepted.  (Note that the option
+     applies only when resuming a session, so the earlier behavior was
+     just about the algorithm choice for symmetric cryptography.)
+     [Bodo Moeller]
+
+ Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
+
+  *) Fix a state transitition in s3_srvr.c and d1_srvr.c
+     (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
+     [Nagendra Modadugu]
+
+  *) The fix in 0.9.8c that supposedly got rid of unsafe
+     double-checked locking was incomplete for RSA blinding,
+     addressing just one layer of what turns out to have been
+     doubly unsafe triple-checked locking.
+
+     So now fix this for real by retiring the MONT_HELPER macro
+     in crypto/rsa/rsa_eay.c.
+
+     [Bodo Moeller; problem pointed out by Marius Schilder]
+
+  *) Various precautionary measures:
+
+     - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
+
+     - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
+       (NB: This would require knowledge of the secret session ticket key
+       to exploit, in which case you'd be SOL either way.)
+
+     - Change bn_nist.c so that it will properly handle input BIGNUMs
+       outside the expected range.
+
+     - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
+       builds.
+
+     [Neel Mehta, Bodo Moeller]
+
+  *) Allow engines to be "soft loaded" - i.e. optionally don't die if
+     the load fails. Useful for distros.
+     [Ben Laurie and the FreeBSD team]
+
+  *) Add support for Local Machine Keyset attribute in PKCS#12 files.
+     [Steve Henson]
+
+  *) Fix BN_GF2m_mod_arr() top-bit cleanup code.
+     [Huang Ying]
+
+  *) Expand ENGINE to support engine supplied SSL client certificate functions.
+
+     This work was sponsored by Logica.
+     [Steve Henson]
+
+  *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
+     keystores. Support for SSL/TLS client authentication too.
+     Not compiled unless enable-capieng specified to Configure.
+
+     This work was sponsored by Logica.
+     [Steve Henson]
+
+  *) Fix bug in X509_ATTRIBUTE creation: dont set attribute using
+     ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
+     attribute creation routines such as certifcate requests and PKCS#12
+     files.
+     [Steve Henson]
+
+ Changes between 0.9.8g and 0.9.8h  [28 May 2008]
+
+  *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
+     handshake which could lead to a cilent crash as found using the
+     Codenomicon TLS test suite (CVE-2008-1672) 
+     [Steve Henson, Mark Cox]
+
+  *) Fix double free in TLS server name extensions which could lead to
+     a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) 
+     [Joe Orton]
+
+  *) Clear error queue in SSL_CTX_use_certificate_chain_file()
+
+     Clear the error queue to ensure that error entries left from
+     older function calls do not interfere with the correct operation.
+     [Lutz Jaenicke, Erik de Castro Lopo]
+
+  *) Remove root CA certificates of commercial CAs:
+
+     The OpenSSL project does not recommend any specific CA and does not
+     have any policy with respect to including or excluding any CA.
+     Therefore it does not make any sense to ship an arbitrary selection
+     of root CA certificates with the OpenSSL software.
+     [Lutz Jaenicke]
+
+  *) RSA OAEP patches to fix two separate invalid memory reads.
+     The first one involves inputs when 'lzero' is greater than
+     'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
+     before the beginning of from). The second one involves inputs where
+     the 'db' section contains nothing but zeroes (there is a one-byte
+     invalid read after the end of 'db').
+     [Ivan Nestlerode <[e-mail]>]
+
+  *) Partial backport from 0.9.9-dev:
+
+     Introduce bn_mul_mont (dedicated Montgomery multiplication
+     procedure) as a candidate for BIGNUM assembler implementation.
+     While 0.9.9-dev uses assembler for various architectures, only
+     x86_64 is available by default here in the 0.9.8 branch, and
+     32-bit x86 is available through a compile-time setting.
+
+     To try the 32-bit x86 assembler implementation, use Configure
+     option "enable-montasm" (which exists only for this backport).
+
+     As "enable-montasm" for 32-bit x86 disclaims code stability
+     anyway, in this constellation we activate additional code
+     backported from 0.9.9-dev for further performance improvements,
+     namely BN_from_montgomery_word.  (To enable this otherwise,
+     e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
+
+     [Andy Polyakov (backport partially by Bodo Moeller)]
+
+  *) Add TLS session ticket callback. This allows an application to set
+     TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
+     values. This is useful for key rollover for example where several key
+     sets may exist with different names.
+     [Steve Henson]
+
+  *) Reverse ENGINE-internal logic for caching default ENGINE handles.
+     This was broken until now in 0.9.8 releases, such that the only way
+     a registered ENGINE could be used (assuming it initialises
+     successfully on the host) was to explicitly set it as the default
+     for the relevant algorithms. This is in contradiction with 0.9.7
+     behaviour and the documentation. With this fix, when an ENGINE is
+     registered into a given algorithm's table of implementations, the
+     'uptodate' flag is reset so that auto-discovery will be used next
+     time a new context for that algorithm attempts to select an
+     implementation.
+     [Ian Lister (tweaked by Geoff Thorpe)]
+
+  *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
+     implemention in the following ways:
+
+     Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
+     hard coded.
+
+     Lack of BER streaming support means one pass streaming processing is
+     only supported if data is detached: setting the streaming flag is
+     ignored for embedded content.
+
+     CMS support is disabled by default and must be explicitly enabled
+     with the enable-cms configuration option.
+     [Steve Henson]
+
+  *) Update the GMP engine glue to do direct copies between BIGNUM and
+     mpz_t when openssl and GMP use the same limb size. Otherwise the
+     existing "conversion via a text string export" trick is still used.
+     [Paul Sheer <[e-mail]>]
+
+  *) Zlib compression BIO. This is a filter BIO which compressed and
+     uncompresses any data passed through it.
+     [Steve Henson]
+
+  *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
+     RFC3394 compatible AES key wrapping.
+     [Steve Henson]
+
+  *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
+     sets string data without copying. X509_ALGOR_set0() and
+     X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
+     data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
+     from an X509_ATTRIBUTE structure optionally checking it occurs only
+     once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
+     data.
+     [Steve Henson]
+
+  *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
+     to get the expected BN_FLG_CONSTTIME behavior.
+     [Bodo Moeller (Google)]
+  
+  *) Netware support:
+
+     - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
+     - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
+     - added some more tests to do_tests.pl
+     - fixed RunningProcess usage so that it works with newer LIBC NDKs too
+     - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
+     - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
+       netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
+     - various changes to netware.pl to enable gcc-cross builds on Win32
+       platform
+     - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
+     - various changes to fix missing prototype warnings
+     - fixed x86nasm.pl to create correct asm files for NASM COFF output
+     - added AES, WHIRLPOOL and CPUID assembler code to build files
+     - added missing AES assembler make rules to mk1mf.pl
+     - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
+     [Guenter Knauf <[e-mail]>]
+
+  *) Implement certificate status request TLS extension defined in RFC3546.
+     A client can set the appropriate parameters and receive the encoded
+     OCSP response via a callback. A server can query the supplied parameters
+     and set the encoded OCSP response in the callback. Add simplified examples
+     to s_client and s_server.
+     [Steve Henson]
+
  Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
 
   *) Fix various bugs:
@@ -167,6 +445,10 @@
      authentication-only ciphersuites.
      [Bodo Moeller]
 
+  *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
+     not complete and could lead to a possible single byte overflow
+     (CVE-2007-5135) [Ben Laurie]
+
  Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
 
   *) Since AES128 and AES256 (and similarly Camellia128 and
 
=== removed file 'ChangeLog.0_9_7-stable_not-in-head'
--- ChangeLog.0_9_7-stable_not-in-head	2005-12-13 21:37:42 +0000
+++ ChangeLog.0_9_7-stable_not-in-head	1970-01-01 00:00:00 +0000
@@ -1,163 +0,0 @@
-This file, together with ChangeLog.0_9_7-stable_not-in-head_FIPS,
-provides a collection of those CVS change log entries for the
-0.9.7 branch (OpenSSL_0_9_7-stable) that do not appear similarly in
-0.9.8-dev (CVS head).
-    
-ChangeLog.0_9_7-stable_not-in-head_FIPS  -  "FIPS" related changes
-ChangeLog.0_9_7-stable_not-in-head       -  everything else
-
-Some obvious false positives have been eliminated: e.g., we do not
-care about a simple "make update"; and we don't care about changes
-identified to the 0.9.7 branch that were explicitly identified as
-backports from head.
-    
-Eliminating all other entries (and finally this file and its
-compantion), either as false positives or as things that should go
-into 0.9.8, remains to be done.  Any additional changes to 0.9.7 that
-are not immediately put into 0.9.8, but belong there as well, should
-be added to the end of this file.
-
-
-2002-11-04 17:33  levitte
-
-	Changed:
-		Configure (1.314.2.38), "Exp", lines: +4 -2
-
-	Return my normal debug targets to something not so extreme, and
-	make the extreme ones special (or 'extreme', if you will :-)).
-
-2002-12-16 19:17  appro
-
-	Changed:
-		crypto/bn/bn_lcl.h (1.23.2.3), "Exp", lines: +3 -0
-		crypto/bn/bn_mul.c (1.28.2.4), "Exp", lines: +84 -445
-
-	This is rollback to 0.9.6h bn_mul.c to address problem reported in
-	RT#272.
-
-2003-07-27 15:46  ben
-
-	Changed:
-		crypto/aes/aes.h (1.1.2.5), "Exp", lines: +3 -0
-		crypto/aes/aes_cfb.c (1.1.2.4), "Exp", lines: +57 -0
-
-	Add untested CFB-r mode. Will be tested soon.
-
-2003-07-28 17:07  ben
-
-	Changed:
-		Makefile.org (1.154.2.69), "Exp", lines: +5 -1
-		crypto/aes/aes.h (1.1.2.6), "Exp", lines: +3 -0
-		crypto/aes/aes_cfb.c (1.1.2.5), "Exp", lines: +19 -0
-		crypto/dsa/Makefile.ssl (1.49.2.6), "Exp", lines: +3 -2
-		crypto/err/Makefile.ssl (1.48.2.4), "Exp", lines: +17 -16
-		crypto/evp/e_aes.c (1.6.2.5), "Exp", lines: +8 -0
-		crypto/evp/e_des.c (1.5.2.2), "Exp", lines: +1 -1
-		crypto/evp/e_des3.c (1.8.2.3), "Exp", lines: +2 -2
-		crypto/evp/evp.h (1.86.2.11), "Exp", lines: +28 -11
-		crypto/evp/evp_locl.h (1.7.2.3), "Exp", lines: +2 -2
-		crypto/objects/obj_dat.h (1.49.2.13), "Exp", lines: +10 -5
-		crypto/objects/obj_mac.h (1.19.2.13), "Exp", lines: +5 -0
-		crypto/objects/obj_mac.num (1.15.2.9), "Exp", lines: +1 -0
-		crypto/objects/objects.txt (1.20.2.14), "Exp", lines: +4 -0
-		fips/Makefile.ssl (1.1.2.3), "Exp", lines: +7 -0
-		fips/aes/Makefile.ssl (1.1.2.2), "Exp", lines: +23 -1
-		fips/aes/fips_aesavs.c (1.1.2.3), "Exp", lines: +9 -1
-		test/Makefile.ssl (1.84.2.30), "Exp", lines: +101 -43
-
-	Add support for partial CFB modes, make tests work, update
-	dependencies.
-
-2003-07-29 12:56  ben
-
-	Changed:
-		crypto/aes/aes_cfb.c (1.1.2.6), "Exp", lines: +9 -6
-		crypto/evp/c_allc.c (1.8.2.3), "Exp", lines: +1 -0
-		crypto/evp/evp_test.c (1.14.2.11), "Exp", lines: +17 -8
-		crypto/evp/evptests.txt (1.9.2.2), "Exp", lines: +48 -1
-
-	Working CFB1 and test vectors.
-
-2003-07-29 15:24  ben
-
-	Changed:
-		crypto/evp/e_aes.c (1.6.2.6), "Exp", lines: +14 -0
-		crypto/objects/obj_dat.h (1.49.2.14), "Exp", lines: +15 -5
-		crypto/objects/obj_mac.h (1.19.2.14), "Exp", lines: +10 -0
-		crypto/objects/obj_mac.num (1.15.2.10), "Exp", lines: +2 -0
-		crypto/objects/objects.txt (1.20.2.15), "Exp", lines: +2 -0
-		fips/aes/Makefile.ssl (1.1.2.3), "Exp", lines: +1 -1
-		fips/aes/fips_aesavs.c (1.1.2.4), "Exp", lines: +34 -19
-
-	The rest of the keysizes for CFB1, working AES AVS test for CFB1.
-
-2003-07-29 19:05  ben
-
-	Changed:
-		crypto/aes/aes.h (1.1.2.7), "Exp", lines: +3 -0
-		crypto/aes/aes_cfb.c (1.1.2.7), "Exp", lines: +14 -0
-		crypto/evp/c_allc.c (1.8.2.4), "Exp", lines: +1 -0
-		crypto/evp/e_aes.c (1.6.2.7), "Exp", lines: +4 -9
-		crypto/evp/evptests.txt (1.9.2.3), "Exp", lines: +48 -0
-		crypto/objects/obj_dat.h (1.49.2.15), "Exp", lines: +20 -5
-		crypto/objects/obj_mac.h (1.19.2.15), "Exp", lines: +15 -0
-		crypto/objects/obj_mac.num (1.15.2.11), "Exp", lines: +3 -0
-		crypto/objects/objects.txt (1.20.2.16), "Exp", lines: +3 -0
-		fips/aes/fips_aesavs.c (1.1.2.7), "Exp", lines: +11 -0
-
-	AES CFB8.
-
-2003-07-30 20:30  ben
-
-	Changed:
-		Makefile.org (1.154.2.70), "Exp", lines: +16 -5
-		crypto/des/cfb_enc.c (1.7.2.1), "Exp", lines: +2 -1
-		crypto/des/des_enc.c (1.11.2.2), "Exp", lines: +4 -0
-		crypto/evp/e_aes.c (1.6.2.8), "Exp", lines: +7 -14
-		crypto/evp/e_des.c (1.5.2.3), "Exp", lines: +37 -1
-		crypto/evp/evp.h (1.86.2.12), "Exp", lines: +6 -0
-		crypto/evp/evp_locl.h (1.7.2.4), "Exp", lines: +9 -0
-		crypto/objects/obj_dat.h (1.49.2.16), "Exp", lines: +48 -23
-		crypto/objects/obj_mac.h (1.19.2.16), "Exp", lines: +31 -6
-		crypto/objects/obj_mac.num (1.15.2.12), "Exp", lines: +5 -0
-		crypto/objects/objects.txt (1.20.2.17), "Exp", lines: +12 -6
-		fips/Makefile.ssl (1.1.2.4), "Exp", lines: +8 -1
-		fips/fips_make_sha1 (1.1.2.3), "Exp", lines: +3 -0
-		fips/aes/Makefile.ssl (1.1.2.4), "Exp", lines: +1 -1
-		fips/des/.cvsignore (1.1.2.1), "Exp", lines: +3 -0
-		fips/des/Makefile.ssl (1.1.2.1), "Exp", lines: +96 -0
-		fips/des/fingerprint.sha1 (1.1.2.1), "Exp", lines: +2 -0
-		fips/des/fips_des_enc.c (1.1.2.1), "Exp", lines: +288 -0
-		fips/des/fips_des_locl.h (1.1.2.1), "Exp", lines: +428 -0
-		fips/des/fips_desmovs.c (1.1.2.1), "Exp", lines: +659 -0
-
-	Whoops, forgot FIPS DES, also add EVPs for DES CFB1 and 8.
-
-2003-08-01 12:25  ben
-
-	Changed:
-		crypto/des/cfb_enc.c (1.7.2.2), "Exp", lines: +45 -36
-		crypto/evp/c_allc.c (1.8.2.5), "Exp", lines: +2 -0
-		crypto/evp/e_des.c (1.5.2.4), "Exp", lines: +8 -3
-		crypto/evp/evptests.txt (1.9.2.4), "Exp", lines: +6 -0
-
-	Fix DES CFB-r.
-
-2003-08-01 12:31  ben
-
-	Changed:
-		crypto/evp/evptests.txt (1.9.2.5), "Exp", lines: +4 -0
-
-	DES CFB8 test.
-
-2005-04-19 16:21  appro
-
-	Changed:
-		Configure (1.314.2.117), "Exp", lines: +24 -21
-		Makefile.org (1.154.2.100), "Exp", lines: +1 -11
-		TABLE (1.99.2.52), "Exp", lines: +20 -20
-		apps/Makefile (1.1.4.15), "Exp", lines: +1 -1
-		test/Makefile (1.1.4.12), "Exp", lines: +1 -1
-
-	Enable shared link on HP-UX.
-
 
=== removed file 'ChangeLog.0_9_7-stable_not-in-head_FIPS'
--- ChangeLog.0_9_7-stable_not-in-head_FIPS	2005-12-13 21:37:42 +0000
+++ ChangeLog.0_9_7-stable_not-in-head_FIPS	1970-01-01 00:00:00 +0000
@@ -1,1494 +0,0 @@
-See file ChangeLog.0_9_7-stable_not-in-head for explanations.
-This is the "FIPS"-related part.
-
-
-
-2003-07-27 19:00  ben
-
-	Changed:
-		Configure (1.314.2.85), "Exp", lines: +2 -0
-		Makefile.org (1.154.2.67), "Exp", lines: +12 -3
-		crypto/cryptlib.c (1.32.2.9), "Exp", lines: +5 -0
-		crypto/md32_common.h (1.22.2.4), "Exp", lines: +11 -0
-		crypto/aes/Makefile.ssl (1.4.2.6), "Exp", lines: +2 -1
-		crypto/aes/aes_core.c (1.1.2.4), "Exp", lines: +4 -0
-		crypto/des/des.h (1.40.2.4), "Exp", lines: +1 -1
-		crypto/des/des_old.c (1.11.2.4), "Exp", lines: +1 -1
-		crypto/des/destest.c (1.30.2.6), "Exp", lines: +2 -2
-		crypto/des/ecb3_enc.c (1.8.2.1), "Exp", lines: +1 -3
-		crypto/dsa/Makefile.ssl (1.49.2.5), "Exp", lines: +7 -4
-		crypto/dsa/dsa_ossl.c (1.12.2.4), "Exp", lines: +2 -0
-		crypto/dsa/dsa_sign.c (1.10.2.3), "Exp", lines: +12 -0
-		crypto/dsa/dsa_vrf.c (1.10.2.3), "Exp", lines: +8 -0
-		crypto/engine/engine.h (1.36.2.6), "Exp", lines: +4 -0
-		crypto/err/err.h (1.35.2.3), "Exp", lines: +2 -0
-		crypto/err/err_all.c (1.17.2.2), "Exp", lines: +4 -0
-		crypto/err/openssl.ec (1.11.2.1), "Exp", lines: +1 -0
-		crypto/evp/Makefile.ssl (1.64.2.8), "Exp", lines: +8 -7
-		crypto/evp/c_all.c (1.7.8.7), "Exp", lines: +1 -0
-		crypto/evp/e_aes.c (1.6.2.4), "Exp", lines: +12 -4
-		crypto/evp/e_des3.c (1.8.2.2), "Exp", lines: +1 -1
-		crypto/evp/evp.h (1.86.2.10), "Exp", lines: +2 -0
-		crypto/evp/evp_err.c (1.23.2.1), "Exp", lines: +3 -1
-		crypto/md4/Makefile.ssl (1.6.2.4), "Exp", lines: +7 -4
-		crypto/md5/Makefile.ssl (1.33.2.7), "Exp", lines: +7 -4
-		crypto/rand/Makefile.ssl (1.56.2.4), "Exp", lines: +17 -15
-		crypto/rand/md_rand.c (1.69.2.2), "Exp", lines: +9 -0
-		crypto/rand/rand.h (1.26.2.5), "Exp", lines: +2 -0
-		crypto/rand/rand_err.c (1.6.2.1), "Exp", lines: +3 -1
-		crypto/rand/rand_lib.c (1.15.2.2), "Exp", lines: +11 -0
-		crypto/ripemd/Makefile.ssl (1.25.2.5), "Exp", lines: +7 -2
-		crypto/sha/Makefile.ssl (1.26.2.5), "Exp", lines: +16 -6
-		fips/.cvsignore (1.1.2.1), "Exp", lines: +1 -0
-		fips/Makefile.ssl (1.1.2.1), "Exp", lines: +155 -0
-		fips/fingerprint.sha1 (1.1.2.1), "Exp", lines: +3 -0
-		fips/fips.c (1.1.2.1), "Exp", lines: +74 -0
-		fips/fips.h (1.1.2.1), "Exp", lines: +85 -0
-		fips/fips_check_sha1 (1.1.2.1), "Exp", lines: +7 -0
-		fips/fips_err.c (1.1.2.1), "Exp", lines: +96 -0
-		fips/fips_make_sha1 (1.1.2.1), "Exp", lines: +21 -0
-		fips/lib (1.1.2.1), "Exp", lines: +0 -0
-		fips/aes/.cvsignore (1.1.2.1), "Exp", lines: +4 -0
-		fips/aes/Makefile.ssl (1.1.2.1), "Exp", lines: +95 -0
-		fips/aes/fingerprint.sha1 (1.1.2.1), "Exp", lines: +2 -0
-		fips/aes/fips_aes_core.c (1.1.2.1), "Exp", lines: +1260 -0
-		fips/aes/fips_aes_locl.h (1.1.2.1), "Exp", lines: +85 -0
-		fips/aes/fips_aesavs.c (1.1.2.1), "Exp", lines: +896 -0
-		fips/dsa/.cvsignore (1.1.2.1), "Exp", lines: +2 -0
-		fips/dsa/Makefile.ssl (1.1.2.1), "Exp", lines: +95 -0
-		fips/dsa/fingerprint.sha1 (1.1.2.1), "Exp", lines: +1 -0
-		fips/dsa/fips_dsa_ossl.c (1.1.2.1), "Exp", lines: +366 -0
-		fips/dsa/fips_dsatest.c (1.1.2.1), "Exp", lines: +252 -0
-		fips/rand/.cvsignore (1.1.2.1), "Exp", lines: +2 -0
-		fips/rand/Makefile.ssl (1.1.2.1), "Exp", lines: +94 -0
-		fips/rand/fingerprint.sha1 (1.1.2.1), "Exp", lines: +2 -0
-		fips/rand/fips_rand.c (1.1.2.1), "Exp", lines: +236 -0
-		fips/rand/fips_rand.h (1.1.2.1), "Exp", lines: +55 -0
-		fips/rand/fips_randtest.c (1.1.2.1), "Exp", lines: +348 -0
-		fips/sha1/.cvsignore (1.1.2.1), "Exp", lines: +3 -0
-		fips/sha1/Makefile.ssl (1.1.2.1), "Exp", lines: +94 -0
-		fips/sha1/fingerprint.sha1 (1.1.2.1), "Exp", lines: +3 -0
-		fips/sha1/fips_md32_common.h (1.1.2.1), "Exp", lines: +637 -0
-		fips/sha1/fips_sha1dgst.c (1.1.2.1), "Exp", lines: +76 -0
-		fips/sha1/fips_sha1test.c (1.1.2.1), "Exp", lines: +128 -0
-		fips/sha1/fips_sha_locl.h (1.1.2.1), "Exp", lines: +472 -0
-		fips/sha1/fips_standalone_sha1.c (1.1.2.1), "Exp", lines: +101 -0
-		fips/sha1/standalone.sha1 (1.1.2.1), "Exp", lines: +4 -0
-		test/Makefile.ssl (1.84.2.29), "Exp", lines: +81 -13
-		util/mkerr.pl (1.18.2.4), "Exp", lines: +2 -1
-
-	Unfinished FIPS stuff for review/improvement.
-
-2003-07-27 19:19  ben
-
-	Changed:
-		fips/fips_check_sha1 (1.1.2.2), "Exp", lines: +1 -1
-
-	Use unified diff.
-
-2003-07-27 19:23  ben
-
-	Changed:
-		fips/Makefile.ssl (1.1.2.2), "Exp", lines: +3 -3
-		fips/fingerprint.sha1 (1.1.2.2), "Exp", lines: +2 -1
-		fips/fips_make_sha1 (1.1.2.2), "Exp", lines: +1 -1
-
-	Build in non-FIPS mode.
-
-2003-07-27 23:13  ben
-
-	Changed:
-		Makefile.org (1.154.2.68), "Exp", lines: +1 -1
-		fips/fips_check_sha1 (1.1.2.3), "Exp", lines: +2 -1
-		fips/aes/fips_aesavs.c (1.1.2.2), "Exp", lines: +2 -0
-		fips/dsa/fips_dsa_ossl.c (1.1.2.2), "Exp", lines: +8 -0
-		fips/dsa/fips_dsatest.c (1.1.2.2), "Exp", lines: +2 -1
-		fips/sha1/fingerprint.sha1 (1.1.2.2), "Exp", lines: +1 -1
-		fips/sha1/fips_sha1dgst.c (1.1.2.2), "Exp", lines: +5 -1
-		fips/sha1/fips_standalone_sha1.c (1.1.2.2), "Exp", lines: +2 -0
-		fips/sha1/standalone.sha1 (1.1.2.2), "Exp", lines: +1 -1
-
-	Build when not FIPS.
-
-2003-07-28 11:56  ben
-
-	Changed:
-		fips/dsa/fingerprint.sha1 (1.1.2.2), "Exp", lines: +1 -1
-		fips/sha1/standalone.sha1 (1.1.2.3), "Exp", lines: +1 -1
-
-	New fingerprints.
-
-2003-07-29 16:06  ben
-
-	Changed:
-		fips/aes/fips_aesavs.c (1.1.2.5), "Exp", lines: +295 -303
-
-	Reformat.
-
-2003-07-29 16:34  ben
-
-	Changed:
-		fips/aes/fips_aesavs.c (1.1.2.6), "Exp", lines: +43 -17
-
-	MMT for CFB1
-
-2003-07-29 17:17  ben
-
-	Changed:
-		fips/fips_err_wrapper.c (1.1.2.1), "Exp", lines: +5 -0
-		fips/sha1/sha1hashes.txt (1.1.2.1), "Exp", lines: +342 -0
-		fips/sha1/sha1vectors.txt (1.1.2.1), "Exp", lines: +2293 -0
-
-	Missing files.
-
-2003-07-31 23:30  levitte
-
-	Changed:
-		Makefile.org (1.154.2.71), "Exp", lines: +2 -0
-
-	If FDIRS is to be treated like SDIRS, let's not forget to
-	initialize it in Makefile.org.
-
-2003-07-31 23:41  levitte
-
-	Changed:
-		fips/sha1/fips_sha1test.c (1.1.2.2), "Exp", lines: +3 -3
-
-	No C++ comments in C programs!
-
-2003-08-01 15:07  steve
-
-	Changed:
-		fips/aes/fips_aesavs.c (1.1.2.8), "Exp", lines: +3 -3
-
-	Replace C++ style comments.
-
-2003-08-03 14:22  ben
-
-	Changed:
-		fips/des/fips_desmovs.c (1.1.2.2), "Exp", lines: +55 -37
-
-	Make tests work (CFB1 still doesn't produce the right answers,
-	strangely).
-
-2003-08-08 12:08  levitte
-
-	Changed:
-		fips/des/fips_des_enc.c (1.1.2.2), "Exp", lines: +9 -0
-
-	Avoid clashing with the regular DES functions when not compiling
-	with -DFIPS.  This is basically only visible when building with
-	shared library supoort...
-
-2003-08-11 11:36  levitte
-
-	Deleted:
-		fips/sha1/.cvsignore (1.1.2.2)
-		fips/sha1/Makefile.ssl (1.1.2.3)
-		fips/sha1/fingerprint.sha1 (1.1.2.3)
-		fips/sha1/fips_md32_common.h (1.1.2.2)
-		fips/sha1/fips_sha1dgst.c (1.1.2.3)
-		fips/sha1/fips_sha1test.c (1.1.2.3)
-		fips/sha1/fips_sha_locl.h (1.1.2.2)
-		fips/sha1/fips_standalone_sha1.c (1.1.2.3)
-		fips/sha1/sha1hashes.txt (1.1.2.2)
-		fips/sha1/sha1vectors.txt (1.1.2.2)
-		fips/sha1/standalone.sha1 (1.1.2.4)
-		fips/dsa/.cvsignore (1.1.2.2)
-		fips/dsa/Makefile.ssl (1.1.2.2)
-		fips/dsa/fingerprint.sha1 (1.1.2.3)
-		fips/dsa/fips_dsa_ossl.c (1.1.2.3)
-		fips/dsa/fips_dsatest.c (1.1.2.3)
-		fips/rand/.cvsignore (1.1.2.2)
-		fips/rand/Makefile.ssl (1.1.2.2)
-		fips/rand/fingerprint.sha1 (1.1.2.2)
-		fips/rand/fips_rand.c (1.1.2.2)
-		fips/rand/fips_rand.h (1.1.2.2)
-		fips/rand/fips_randtest.c (1.1.2.2)
-		fips/des/.cvsignore (1.1.2.2)
-		fips/des/Makefile.ssl (1.1.2.3)
-		fips/des/fingerprint.sha1 (1.1.2.2)
-		fips/des/fips_des_enc.c (1.1.2.3)
-		fips/des/fips_des_locl.h (1.1.2.2)
-		fips/des/fips_desmovs.c (1.1.2.3)
-		fips/aes/.cvsignore (1.1.2.2)
-		fips/aes/Makefile.ssl (1.1.2.5)
-		fips/aes/fingerprint.sha1 (1.1.2.2)
-		fips/aes/fips_aes_core.c (1.1.2.2)
-		fips/aes/fips_aes_locl.h (1.1.2.2)
-		fips/aes/fips_aesavs.c (1.1.2.9)
-		fips/.cvsignore (1.1.2.2)
-		fips/Makefile.ssl (1.1.2.6)
-		fips/fingerprint.sha1 (1.1.2.3)
-		fips/fips.c (1.1.2.2)
-		fips/fips.h (1.1.2.2)
-		fips/fips_check_sha1 (1.1.2.4)
-		fips/fips_err.c (1.1.2.2)
-		fips/fips_err_wrapper.c (1.1.2.2)
-		fips/fips_make_sha1 (1.1.2.4)
-		fips/lib (1.1.2.2)
-	Changed:
-		util/libeay.num (1.173.2.16), "Exp", lines: +11 -38
-		util/mkerr.pl (1.18.2.5), "Exp", lines: +1 -2
-		test/Makefile.ssl (1.84.2.31), "Exp", lines: +54 -180
-		crypto/ripemd/Makefile.ssl (1.25.2.6), "Exp", lines: +2 -7
-		crypto/sha/Makefile.ssl (1.26.2.6), "Exp", lines: +6 -16
-		crypto/rand/Makefile.ssl (1.56.2.5), "Exp", lines: +15 -17
-		crypto/rand/md_rand.c (1.69.2.3), "Exp", lines: +0 -9
-		crypto/rand/rand.h (1.26.2.6), "Exp", lines: +0 -2
-		crypto/rand/rand_err.c (1.6.2.2), "Exp", lines: +1 -3
-		crypto/rand/rand_lib.c (1.15.2.3), "Exp", lines: +0 -11
-		crypto/objects/obj_dat.h (1.49.2.18), "Exp", lines: +3 -27
-		crypto/objects/obj_mac.h (1.19.2.18), "Exp", lines: +0 -32
-		crypto/objects/obj_mac.num (1.15.2.14), "Exp", lines: +0 -8
-		crypto/objects/objects.txt (1.20.2.19), "Exp", lines: +0 -11
-		crypto/md4/Makefile.ssl (1.6.2.5), "Exp", lines: +4 -7
-		crypto/md5/Makefile.ssl (1.33.2.8), "Exp", lines: +4 -7
-		crypto/evp/Makefile.ssl (1.64.2.9), "Exp", lines: +7 -8
-		crypto/evp/c_allc.c (1.8.2.6), "Exp", lines: +0 -4
-		crypto/evp/e_aes.c (1.6.2.9), "Exp", lines: +4 -22
-		crypto/evp/e_des.c (1.5.2.5), "Exp", lines: +2 -43
-		crypto/evp/e_des3.c (1.8.2.4), "Exp", lines: +3 -3
-		crypto/evp/evp.h (1.86.2.13), "Exp", lines: +11 -36
-		crypto/evp/evp_err.c (1.23.2.2), "Exp", lines: +1 -3
-		crypto/evp/evp_lib.c (1.6.8.3), "Exp", lines: +0 -24
-		crypto/evp/evp_locl.h (1.7.2.5), "Exp", lines: +2 -11
-		crypto/evp/evp_test.c (1.14.2.12), "Exp", lines: +8 -17
-		crypto/evp/evptests.txt (1.9.2.6), "Exp", lines: +1 -106
-		crypto/dsa/Makefile.ssl (1.49.2.7), "Exp", lines: +6 -10
-		crypto/dsa/dsa_ossl.c (1.12.2.5), "Exp", lines: +0 -2
-		crypto/dsa/dsa_sign.c (1.10.2.4), "Exp", lines: +0 -12
-		crypto/dsa/dsa_vrf.c (1.10.2.4), "Exp", lines: +0 -8
-		crypto/err/Makefile.ssl (1.48.2.5), "Exp", lines: +16 -17
-		crypto/err/err.h (1.35.2.4), "Exp", lines: +0 -2
-		crypto/err/err_all.c (1.17.2.3), "Exp", lines: +0 -4
-		crypto/err/openssl.ec (1.11.2.2), "Exp", lines: +0 -1
-		crypto/des/des.h (1.40.2.5), "Exp", lines: +1 -1
-		crypto/des/des_enc.c (1.11.2.3), "Exp", lines: +0 -4
-		crypto/des/des_old.c (1.11.2.5), "Exp", lines: +1 -1
-		crypto/des/destest.c (1.30.2.7), "Exp", lines: +2 -2
-		crypto/des/ecb3_enc.c (1.8.2.2), "Exp", lines: +3 -1
-		crypto/aes/Makefile.ssl (1.4.2.7), "Exp", lines: +1 -2
-		crypto/aes/aes.h (1.1.2.8), "Exp", lines: +0 -9
-		crypto/aes/aes_cfb.c (1.1.2.8), "Exp", lines: +0 -93
-		crypto/aes/aes_core.c (1.1.2.5), "Exp", lines: +0 -4
-		crypto/cryptlib.c (1.32.2.10), "Exp", lines: +0 -5
-		crypto/md32_common.h (1.22.2.5), "Exp", lines: +0 -11
-		Configure (1.314.2.86), "Exp", lines: +0 -2
-		Makefile.org (1.154.2.72), "Exp", lines: +8 -34
-		TABLE (1.99.2.30), "Exp", lines: +0 -50
-
-	A new branch for FIPS-related changes has been created with the
-	name OpenSSL-fips-0_9_7-stable.
-
-		Since the 0.9.7-stable branch is supposed to be in freeze
-	and should only contain bug corrections, this change removes the
-	FIPS changes from that branch.
-
-2004-05-11 14:44  ben
-
-	Deleted:
-		apps/Makefile.ssl (1.100.2.27)
-		crypto/Makefile.ssl (1.84.2.12)
-		crypto/aes/Makefile.ssl (1.4.2.9)
-		crypto/asn1/Makefile.ssl (1.77.2.7)
-		crypto/bf/Makefile.ssl (1.25.2.6)
-		crypto/bio/Makefile.ssl (1.52.2.4)
-		crypto/bn/Makefile.ssl (1.65.2.9)
-		crypto/buffer/Makefile.ssl (1.32.2.4)
-		crypto/cast/Makefile.ssl (1.31.2.6)
-		crypto/comp/Makefile.ssl (1.32.2.4)
-		crypto/conf/Makefile.ssl (1.38.2.8)
-		crypto/des/Makefile.ssl (1.61.2.13)
-		crypto/dh/Makefile.ssl (1.43.2.5)
-		crypto/dsa/Makefile.ssl (1.49.2.9)
-		crypto/dso/Makefile.ssl (1.11.2.4)
-		crypto/ec/Makefile.ssl (1.7.2.4)
-		crypto/engine/Makefile.ssl (1.30.2.13)
-		crypto/err/Makefile.ssl (1.48.2.7)
-		crypto/evp/Makefile.ssl (1.64.2.12)
-		crypto/hmac/Makefile.ssl (1.33.2.6)
-		crypto/idea/Makefile.ssl (1.20.2.4)
-		crypto/krb5/Makefile.ssl (1.5.2.6)
-		crypto/lhash/Makefile.ssl (1.28.2.4)
-		crypto/md2/Makefile.ssl (1.29.2.5)
-		crypto/md4/Makefile.ssl (1.6.2.7)
-		crypto/md5/Makefile.ssl (1.33.2.10)
-		crypto/mdc2/Makefile.ssl (1.30.2.4)
-		crypto/objects/Makefile.ssl (1.46.2.6)
-		crypto/ocsp/Makefile.ssl (1.19.2.7)
-		crypto/pem/Makefile.ssl (1.51.2.5)
-		crypto/pkcs12/Makefile.ssl (1.37.2.5)
-		crypto/pkcs7/Makefile.ssl (1.47.2.5)
-		crypto/rand/Makefile.ssl (1.56.2.8)
-		crypto/rc2/Makefile.ssl (1.20.2.4)
-		crypto/rc4/Makefile.ssl (1.25.2.6)
-		crypto/rc5/Makefile.ssl (1.22.2.6)
-		crypto/ripemd/Makefile.ssl (1.25.2.9)
-		crypto/rsa/Makefile.ssl (1.53.2.6)
-		crypto/sha/Makefile.ssl (1.26.2.9)
-		crypto/stack/Makefile.ssl (1.28.2.4)
-		crypto/txt_db/Makefile.ssl (1.26.2.4)
-		crypto/ui/Makefile.ssl (1.10.2.6)
-		crypto/x509/Makefile.ssl (1.56.2.5)
-		crypto/x509v3/Makefile.ssl (1.62.2.5)
-		ssl/Makefile.ssl (1.53.2.11)
-		test/Makefile.ssl (1.84.2.36)
-		tools/Makefile.ssl (1.9.2.4)
-	Changed:
-		.cvsignore (1.7.6.2), "Exp", lines: +2 -1
-		Configure (1.314.2.92), "Exp", lines: +38 -8
-		FAQ (1.61.2.31), "Exp", lines: +1 -1
-		INSTALL (1.45.2.9), "Exp", lines: +2 -2
-		INSTALL.W32 (1.30.2.14), "Exp", lines: +9 -4
-		Makefile.org (1.154.2.78), "Exp", lines: +51 -19
-		PROBLEMS (1.4.2.10), "Exp", lines: +2 -2
-		e_os.h (1.56.2.17), "Exp", lines: +20 -1
-		apps/.cvsignore (1.5.8.1), "Exp", lines: +1 -0
-		apps/Makefile (1.1.4.1), "Exp", lines: +1147 -0
-		apps/apps.c (1.49.2.27), "Exp", lines: +0 -10
-		apps/ca.c (1.102.2.31), "Exp", lines: +0 -10
-		apps/dgst.c (1.23.2.10), "Exp", lines: +39 -11
-		apps/openssl.c (1.48.2.9), "Exp", lines: +19 -0
-		crypto/Makefile (1.1.4.1), "Exp", lines: +217 -0
-		crypto/cryptlib.c (1.32.2.11), "Exp", lines: +5 -0
-		crypto/crypto-lib.com (1.53.2.12), "Exp", lines: +1 -1
-		crypto/md32_common.h (1.22.2.6), "Exp", lines: +12 -0
-		crypto/aes/Makefile (1.1.4.1), "Exp", lines: +102 -0
-		crypto/aes/aes.h (1.1.2.9), "Exp", lines: +9 -0
-		crypto/aes/aes_cfb.c (1.1.2.9), "Exp", lines: +93 -0
-		crypto/aes/aes_core.c (1.1.2.6), "Exp", lines: +4 -0
-		crypto/asn1/Makefile (1.1.4.1), "Exp", lines: +1150 -0
-		crypto/bf/Makefile (1.1.4.1), "Exp", lines: +113 -0
-		crypto/bio/Makefile (1.1.4.1), "Exp", lines: +214 -0
-		crypto/bio/bio.h (1.56.2.6), "Exp", lines: +1 -0
-		crypto/bn/Makefile (1.1.4.1), "Exp", lines: +324 -0
-		crypto/bn/bntest.c (1.55.2.4), "Exp", lines: +1 -1
-		crypto/buffer/Makefile (1.1.4.1), "Exp", lines: +92 -0
-		crypto/cast/Makefile (1.1.4.1), "Exp", lines: +118 -0
-		crypto/cast/asm/.cvsignore (1.2.8.1), "Exp", lines: +1 -0
-		crypto/comp/Makefile (1.1.4.1), "Exp", lines: +112 -0
-		crypto/conf/Makefile (1.1.4.1), "Exp", lines: +181 -0
-		crypto/des/Makefile (1.1.4.1), "Exp", lines: +314 -0
-		crypto/des/cfb64ede.c (1.6.2.4), "Exp", lines: +111 -0
-		crypto/des/des.h (1.40.2.6), "Exp", lines: +5 -1
-		crypto/des/des_enc.c (1.11.2.4), "Exp", lines: +8 -0
-		crypto/des/des_old.c (1.11.2.6), "Exp", lines: +1 -1
-		crypto/des/destest.c (1.30.2.8), "Exp", lines: +2 -2
-		crypto/des/ecb3_enc.c (1.8.2.3), "Exp", lines: +1 -3
-		crypto/des/set_key.c (1.18.2.2), "Exp", lines: +4 -0
-		crypto/dh/Makefile (1.1.4.1), "Exp", lines: +131 -0
-		crypto/dsa/Makefile (1.1.4.1), "Exp", lines: +173 -0
-		crypto/dsa/dsa_gen.c (1.19.2.1), "Exp", lines: +4 -1
-		crypto/dsa/dsa_key.c (1.9.2.1), "Exp", lines: +2 -0
-		crypto/dsa/dsa_ossl.c (1.12.2.6), "Exp", lines: +2 -0
-		crypto/dsa/dsa_sign.c (1.10.2.5), "Exp", lines: +12 -0
-		crypto/dsa/dsa_vrf.c (1.10.2.5), "Exp", lines: +8 -0
-		crypto/dso/Makefile (1.1.4.1), "Exp", lines: +140 -0
-		crypto/ec/Makefile (1.1.4.1), "Exp", lines: +126 -0
-		crypto/engine/Makefile (1.1.4.1), "Exp", lines: +536 -0
-		crypto/engine/hw_cryptodev.c (1.1.2.6), "Exp", lines: +6 -2
-		crypto/err/Makefile (1.1.4.1), "Exp", lines: +118 -0
-		crypto/err/err.h (1.35.2.6), "Exp", lines: +2 -0
-		crypto/err/err_all.c (1.17.2.4), "Exp", lines: +4 -0
-		crypto/err/openssl.ec (1.11.2.3), "Exp", lines: +1 -0
-		crypto/evp/Makefile (1.1.4.1), "Exp", lines: +1057 -0
-		crypto/evp/bio_md.c (1.11.2.1), "Exp", lines: +6 -0
-		crypto/evp/c_allc.c (1.8.2.7), "Exp", lines: +8 -0
-		crypto/evp/e_aes.c (1.6.2.10), "Exp", lines: +22 -4
-		crypto/evp/e_des.c (1.5.2.8), "Exp", lines: +36 -3
-		crypto/evp/e_des3.c (1.8.2.7), "Exp", lines: +43 -4
-		crypto/evp/evp.h (1.86.2.15), "Exp", lines: +39 -11
-		crypto/evp/evp_err.c (1.23.2.3), "Exp", lines: +3 -1
-		crypto/evp/evp_lib.c (1.6.8.4), "Exp", lines: +24 -0
-		crypto/evp/evp_locl.h (1.7.2.6), "Exp", lines: +11 -2
-		crypto/evp/evp_test.c (1.14.2.13), "Exp", lines: +17 -8
-		crypto/evp/evptests.txt (1.9.2.7), "Exp", lines: +106 -1
-		crypto/hmac/Makefile (1.1.4.1), "Exp", lines: +99 -0
-		crypto/idea/Makefile (1.1.4.1), "Exp", lines: +89 -0
-		crypto/krb5/Makefile (1.1.4.1), "Exp", lines: +88 -0
-		crypto/lhash/Makefile (1.1.4.1), "Exp", lines: +91 -0
-		crypto/md2/Makefile (1.1.4.1), "Exp", lines: +91 -0
-		crypto/md4/Makefile (1.1.4.1), "Exp", lines: +93 -0
-		crypto/md5/Makefile (1.1.4.1), "Exp", lines: +129 -0
-		crypto/mdc2/Makefile (1.1.4.1), "Exp", lines: +96 -0
-		crypto/objects/Makefile (1.1.4.1), "Exp", lines: +121 -0
-		crypto/objects/obj_dat.h (1.49.2.19), "Exp", lines: +33 -3
-		crypto/objects/obj_mac.h (1.19.2.19), "Exp", lines: +40 -0
-		crypto/objects/obj_mac.num (1.15.2.15), "Exp", lines: +10 -0
-		crypto/objects/objects.txt (1.20.2.20), "Exp", lines: +13 -0
-		crypto/ocsp/Makefile (1.1.4.1), "Exp", lines: +291 -0
-		crypto/pem/Makefile (1.1.4.1), "Exp", lines: +334 -0
-		crypto/pkcs12/Makefile (1.1.4.1), "Exp", lines: +415 -0
-		crypto/pkcs7/Makefile (1.1.4.1), "Exp", lines: +241 -0
-		crypto/rand/Makefile (1.1.4.1), "Exp", lines: +196 -0
-		crypto/rand/md_rand.c (1.69.2.4), "Exp", lines: +9 -0
-		crypto/rand/rand.h (1.26.2.7), "Exp", lines: +3 -0
-		crypto/rand/rand_err.c (1.6.2.3), "Exp", lines: +4 -1
-		crypto/rand/rand_lib.c (1.15.2.4), "Exp", lines: +11 -0
-		crypto/rc2/Makefile (1.1.4.1), "Exp", lines: +89 -0
-		crypto/rc4/Makefile (1.1.4.1), "Exp", lines: +108 -0
-		crypto/rc5/Makefile (1.1.4.1), "Exp", lines: +106 -0
-		crypto/ripemd/Makefile (1.1.4.1), "Exp", lines: +111 -0
-		crypto/rsa/Makefile (1.1.4.1), "Exp", lines: +239 -0
-		crypto/rsa/rsa_eay.c (1.28.2.9), "Exp", lines: +1 -1
-		crypto/rsa/rsa_gen.c (1.8.6.1), "Exp", lines: +3 -0
-		crypto/sha/Makefile (1.1.4.1), "Exp", lines: +118 -0
-		crypto/sha/sha1dgst.c (1.21.2.1), "Exp", lines: +8 -0
-		crypto/stack/Makefile (1.1.4.1), "Exp", lines: +86 -0
-		crypto/txt_db/Makefile (1.1.4.1), "Exp", lines: +86 -0
-		crypto/ui/Makefile (1.1.4.1), "Exp", lines: +115 -0
-		crypto/x509/Makefile (1.1.4.1), "Exp", lines: +592 -0
-		crypto/x509v3/Makefile (1.1.4.1), "Exp", lines: +601 -0
-		fips/Makefile (1.1.4.1), "Exp", lines: +202 -0
-		fips/fingerprint.sha1 (1.1.2.4), "Exp", lines: +4 -4
-		fips/fips.c (1.1.2.3), "Exp", lines: +120 -5
-		fips/fips.h (1.1.2.3), "Exp", lines: +42 -2
-		fips/fips_check_sha1 (1.1.2.5), "Exp", lines: +2 -2
-		fips/fips_err.h (1.1.4.1), "Exp", lines: +117 -0
-		fips/fips_err_wrapper.c (1.1.2.3), "Exp", lines: +4 -2
-		fips/fips_locl.h (1.1.4.1), "Exp", lines: +62 -0
-		fips/fips_make_sha1 (1.1.2.5), "Exp", lines: +9 -6
-		fips/fips_test_suite.c (1.1.4.1), "Exp", lines: +302 -0
-		fips/openssl_fips_fingerprint (1.1.4.1), "Exp", lines: +25 -0
-		fips/aes/Makefile (1.1.4.1), "Exp", lines: +131 -0
-		fips/aes/fingerprint.sha1 (1.1.2.3), "Exp", lines: +3 -2
-		fips/aes/fips_aes_core.c (1.1.2.3), "Exp", lines: +5 -2
-		fips/aes/fips_aes_locl.h (1.1.2.3), "Exp", lines: +0 -0
-		fips/aes/fips_aes_selftest.c (1.1.4.1), "Exp", lines: +112 -0
-		fips/aes/fips_aesavs.c (1.1.2.10), "Exp", lines: +12 -6
-		fips/des/Makefile (1.1.4.1), "Exp", lines: +155 -0
-		fips/des/fingerprint.sha1 (1.1.2.3), "Exp", lines: +5 -2
-		fips/des/fips_des_enc.c (1.1.2.4), "Exp", lines: +16 -3
-		fips/des/fips_des_locl.h (1.1.2.3), "Exp", lines: +1 -1
-		fips/des/fips_des_selftest.c (1.1.4.1), "Exp", lines: +200 -0
-		fips/des/fips_desmovs.c (1.1.2.4), "Exp", lines: +186 -79
-		fips/des/fips_set_key.c (1.1.4.1), "Exp", lines: +415 -0
-		fips/des/asm/fips-dx86-elf.s (1.1.4.1), "Exp", lines: +2697 -0
-		fips/dsa/Makefile (1.1.4.1), "Exp", lines: +159 -0
-		fips/dsa/fingerprint.sha1 (1.1.2.4), "Exp", lines: +3 -1
-		fips/dsa/fips_dsa_gen.c (1.1.4.1), "Exp", lines: +373 -0
-		fips/dsa/fips_dsa_ossl.c (1.1.2.4), "Exp", lines: +16 -3
-		fips/dsa/fips_dsa_selftest.c (1.1.4.1), "Exp", lines: +168 -0
-		fips/dsa/fips_dsatest.c (1.1.2.4), "Exp", lines: +10 -6
-		fips/dsa/fips_dssvs.c (1.1.4.1), "Exp", lines: +306 -0
-		fips/rand/Makefile (1.1.4.1), "Exp", lines: +104 -0
-		fips/rand/fingerprint.sha1 (1.1.2.3), "Exp", lines: +2 -2
-		fips/rand/fips_rand.c (1.1.2.3), "Exp", lines: +60 -10
-		fips/rand/fips_rand.h (1.1.2.3), "Exp", lines: +19 -1
-		fips/rand/fips_randtest.c (1.1.2.3), "Exp", lines: +31 -10
-		fips/rsa/Makefile (1.1.4.1), "Exp", lines: +112 -0
-		fips/rsa/fingerprint.sha1 (1.1.4.1), "Exp", lines: +3 -0
-		fips/rsa/fips_rsa_eay.c (1.1.4.1), "Exp", lines: +735 -0
-		fips/rsa/fips_rsa_gen.c (1.1.4.1), "Exp", lines: +249 -0
-		fips/rsa/fips_rsa_selftest.c (1.1.4.1), "Exp", lines: +207 -0
-		fips/sha1/.cvsignore (1.1.2.3), "Exp", lines: +1 -2
-		fips/sha1/Makefile (1.1.4.1), "Exp", lines: +158 -0
-		fips/sha1/fingerprint.sha1 (1.1.2.4), "Exp", lines: +5 -3
-		fips/sha1/fips_md32_common.h (1.1.2.3), "Exp", lines: +0 -0
-		fips/sha1/fips_sha1_selftest.c (1.1.4.1), "Exp", lines: +97 -0
-		fips/sha1/fips_sha1dgst.c (1.1.2.4), "Exp", lines: +4 -4
-		fips/sha1/fips_sha1test.c (1.1.2.4), "Exp", lines: +17 -0
-		fips/sha1/fips_sha_locl.h (1.1.2.3), "Exp", lines: +7 -0
-		fips/sha1/fips_standalone_sha1.c (1.1.2.4), "Exp", lines: +60 -7
-		fips/sha1/sha1hashes.txt (1.1.2.3), "Exp", lines: +0 -0
-		fips/sha1/sha1vectors.txt (1.1.2.3), "Exp", lines: +0 -0
-		fips/sha1/standalone.sha1 (1.1.2.5), "Exp", lines: +6 -4
-		fips/sha1/asm/sx86-elf.s (1.1.4.1), "Exp", lines: +1568 -0
-		ms/do_masm.bat (1.1.8.2), "Exp", lines: +12 -10
-		ms/do_ms.bat (1.4.8.2), "Exp", lines: +11 -11
-		ms/do_nasm.bat (1.1.8.2), "Exp", lines: +12 -11
-		ms/do_nt.bat (1.2.8.1), "Exp", lines: +4 -4
-		shlib/hpux10-cc.sh (1.3.2.2), "Exp", lines: +3 -3
-		ssl/Makefile (1.1.4.1), "Exp", lines: +1019 -0
-		ssl/s3_clnt.c (1.53.2.16), "Exp", lines: +10 -0
-		ssl/s3_srvr.c (1.85.2.21), "Exp", lines: +9 -0
-		ssl/ssl_cert.c (1.48.2.7), "Exp", lines: +9 -0
-		ssl/ssl_lib.c (1.110.2.12), "Exp", lines: +13 -1
-		ssl/ssltest.c (1.53.2.23), "Exp", lines: +33 -1
-		ssl/t1_enc.c (1.27.2.8), "Exp", lines: +19 -1
-		test/.cvsignore (1.4.8.1), "Exp", lines: +4 -0
-		test/Makefile (1.1.4.1), "Exp", lines: +941 -0
-		test/bctest (1.14.2.1), "Exp", lines: +1 -1
-		test/testenc (1.3.8.1), "Exp", lines: +1 -1
-		test/testfipsssl (1.1.4.1), "Exp", lines: +113 -0
-		tools/Makefile (1.1.4.1), "Exp", lines: +61 -0
-		util/cygwin.sh (1.1.2.5), "Exp", lines: +3 -3
-		util/domd (1.6.2.3), "Exp", lines: +5 -5
-		util/fixNT.sh (1.1.1.2.8.1), "Exp", lines: +3 -3
-		util/libeay.num (1.173.2.19), "Exp", lines: +55 -11
-		util/mk1mf.pl (1.41.2.10), "Exp", lines: +6 -4
-		util/mkdef.pl (1.67.2.7), "Exp", lines: +11 -4
-		util/mkerr.pl (1.18.2.6), "Exp", lines: +2 -1
-		util/mkfiles.pl (1.12.2.1), "Exp", lines: +8 -1
-		util/pod2mantest (1.1.2.7), "Exp", lines: +1 -1
-		util/selftest.pl (1.18.2.1), "Exp", lines: +2 -2
-		util/pl/BC-16.pl (1.2.2.1), "Exp", lines: +1 -1
-		util/pl/BC-32.pl (1.11.2.4), "Exp", lines: +1 -1
-		util/pl/Mingw32.pl (1.12.6.5), "Exp", lines: +1 -1
-		util/pl/OS2-EMX.pl (1.1.2.3), "Exp", lines: +1 -1
-		util/pl/VC-16.pl (1.3.2.1), "Exp", lines: +2 -2
-		util/pl/VC-32.pl (1.11.2.3), "Exp", lines: +2 -2
-		util/pl/VC-CE.pl (1.1.2.5), "Exp", lines: +1 -1
-		util/pl/ultrix.pl (1.2.8.1), "Exp", lines: +1 -1
-
-	Pull FIPS back into stable.
-
-2004-05-12 10:27  levitte
-
-	Changed:
-		apps/Makefile (1.1.4.2), "Exp", lines: +3 -1
-
-	Only check for FIPS signatures when FIPS is enabled.
-
-2004-05-12 10:28  levitte
-
-	Changed:
-		crypto/des/FILES0 (1.1.4.2), "Exp", lines: +1 -1
-
-	Makefile.ssl changed name to Makefile.
-
-2004-05-12 10:28  levitte
-
-	Changed:
-		fips/rand/fips_rand.c (1.1.2.4), "Exp", lines: +5 -1
-
-	Only really build this file when OPENSSL_FIPS is defined.  And oh,
-	let's keep internal variables static.
-
-2004-05-12 10:42  levitte
-
-	Changed:
-		fips/rand/fingerprint.sha1 (1.1.2.4), "Exp", lines: +1 -1
-
-	I forgot to modify the signature for fips_rand.c...
-
-2004-05-12 10:46  levitte
-
-	Changed:
-		fips/rsa/.cvsignore (1.1.4.1), "Exp", lines: +1 -0
-		fips/.cvsignore (1.1.2.3), "Exp", lines: +1 -1
-		fips/aes/.cvsignore (1.1.2.3), "Exp", lines: +0 -3
-		fips/des/.cvsignore (1.1.2.3), "Exp", lines: +0 -2
-		fips/dsa/.cvsignore (1.1.2.3), "Exp", lines: +0 -1
-		fips/rand/.cvsignore (1.1.2.3), "Exp", lines: +0 -1
-
-	Ignore the 'lib' timestamp file.
-
-2004-05-12 12:07  levitte
-
-	Changed:
-		fips/.cvsignore (1.1.2.4), "Exp", lines: +1 -0
-		fips/aes/.cvsignore (1.1.2.4), "Exp", lines: +1 -0
-		fips/des/.cvsignore (1.1.2.4), "Exp", lines: +1 -0
-		fips/dsa/.cvsignore (1.1.2.4), "Exp", lines: +1 -0
-		fips/rand/.cvsignore (1.1.2.4), "Exp", lines: +1 -0
-		fips/rsa/.cvsignore (1.1.4.2), "Exp", lines: +1 -0
-		fips/sha1/.cvsignore (1.1.2.4), "Exp", lines: +1 -0
-
-	Ignore 'Makefile.save'
-
-2004-05-12 16:11  ben
-
-	Changed:
-		crypto/rand/rand.h (1.26.2.8), "Exp", lines: +2 -0
-		crypto/rand/rand_err.c (1.6.2.4), "Exp", lines: +2 -0
-		fips/fingerprint.sha1 (1.1.2.5), "Exp", lines: +1 -1
-		fips/fips.c (1.1.2.4), "Exp", lines: +5 -1
-		fips/rand/fingerprint.sha1 (1.1.2.5), "Exp", lines: +1 -1
-		fips/rand/fips_rand.c (1.1.2.5), "Exp", lines: +29 -0
-
-	Blow up in people's faces if they don't reseed.
-
-2004-05-15 19:51  ben
-
-	Changed:
-		crypto/dh/dh.h (1.23.2.6), "Exp", lines: +1 -0
-		crypto/dh/dh_err.c (1.6.2.3), "Exp", lines: +2 -1
-		crypto/dh/dh_gen.c (1.8.8.2), "Exp", lines: +9 -0
-		fips/fips_test_suite.c (1.1.4.2), "Exp", lines: +4 -3
-		fips/aes/fips_aesavs.c (1.1.2.11), "Exp", lines: +49 -1
-		fips/des/fingerprint.sha1 (1.1.2.4), "Exp", lines: +1 -1
-		fips/des/fips_desmovs.c (1.1.2.5), "Exp", lines: +49 -1
-		fips/des/fips_set_key.c (1.1.4.2), "Exp", lines: +2 -0
-		fips/sha1/fingerprint.sha1 (1.1.2.5), "Exp", lines: +1 -1
-		fips/sha1/fips_md32_common.h (1.1.2.4), "Exp", lines: +3 -0
-		fips/sha1/standalone.sha1 (1.1.2.6), "Exp", lines: +1 -1
-
-	Fix self-tests, ban some things in FIPS mode, fix copyrights.
-
-2004-05-17 06:28  levitte
-
-	Changed:
-		util/mk1mf.pl (1.41.2.11), "Exp", lines: +8 -2
-		util/pl/BC-16.pl (1.2.2.2), "Exp", lines: +9 -4
-		util/pl/BC-32.pl (1.11.2.5), "Exp", lines: +8 -3
-		util/pl/Mingw32.pl (1.12.6.6), "Exp", lines: +7 -2
-		util/pl/OS2-EMX.pl (1.1.2.4), "Exp", lines: +7 -2
-		util/pl/VC-16.pl (1.3.2.2), "Exp", lines: +7 -2
-		util/pl/VC-32.pl (1.11.2.4), "Exp", lines: +7 -2
-		util/pl/VC-CE.pl (1.1.2.6), "Exp", lines: +7 -2
-		util/pl/linux.pl (1.3.6.1), "Exp", lines: +7 -2
-		util/pl/ultrix.pl (1.2.8.2), "Exp", lines: +7 -2
-		util/pl/unix.pl (1.2.8.1), "Exp", lines: +7 -2
-
-	Generate SHA1 files on Windows and other platforms supported by
-	mk1mf.pl, when building in FIPS mode.
-
-		Note: UNTESTED!
-
-2004-05-17 06:30  levitte
-
-	Changed:
-		apps/apps.h (1.44.2.14), "Exp", lines: +3 -0
-		apps/openssl.c (1.48.2.10), "Exp", lines: +9 -5
-
-	Make sure the applications know when we are running in FIPS mode.
-	We can't use the variable in libcrypto, since it's supposedly
-	unknown.
-
-		Note: currently only supported in MONOLITH mode.
-
-2004-05-17 06:31  levitte
-
-	Changed:
-		apps/enc.c (1.35.2.9), "Exp", lines: +10 -1
-
-	When in FIPS mode, use SHA1 to digest the key, rather than MD5, as
-	MD5 isn't a FIPS-approved algorithm.
-
-		Note: this means the user needs to keep track of this, and
-	we need to add support for that...
-
-2004-05-19 16:16  levitte
-
-	Changed:
-		fips/rsa/fingerprint.sha1 (1.1.4.2), "Exp", lines: +2 -2
-		fips/rsa/fips_rsa_eay.c (1.1.4.2), "Exp", lines: +8 -8
-		fips/rsa/fips_rsa_gen.c (1.1.4.2), "Exp", lines: +1 -1
-		fips/dsa/fingerprint.sha1 (1.1.2.5), "Exp", lines: +2 -2
-		fips/dsa/fips_dsa_gen.c (1.1.4.2), "Exp", lines: +2 -2
-		fips/dsa/fips_dsa_ossl.c (1.1.2.5), "Exp", lines: +4 -4
-		fips/aes/fingerprint.sha1 (1.1.2.4), "Exp", lines: +1 -1
-		fips/aes/fips_aes_core.c (1.1.2.4), "Exp", lines: +5 -5
-		crypto/rsa/rsa.h (1.36.2.11), "Exp", lines: +4 -0
-		crypto/aes/aes.h (1.1.2.10), "Exp", lines: +6 -0
-		crypto/dsa/dsa.h (1.26.2.5), "Exp", lines: +4 -0
-
-	Define FIPS_*_SIZE_T for AES, DSA and RSA as well, in preparation
-	for size_t-ification of those algorithms in future version of
-	OpenSSL...
-
-2004-05-27 11:33  levitte
-
-	Changed:
-		makevms.com (1.35.2.3), "Exp", lines: +27 -0
-
-	Copy the FIPS files to the temporary openssl include directory.
-
-2004-05-27 12:04  levitte
-
-	Changed:
-		fips/fips-lib.com (1.1.2.1), "Exp", lines: +1179 -0
-		makevms.com (1.35.2.4), "Exp", lines: +8 -0
-
-	Compile the FIPS directory on VMS as well.  fips-lib.com is
-	essentially a copy of crypto-lib.com, with just a few edits.
-
-2004-05-27 12:07  levitte
-
-	Changed:
-		fips/install.com (1.1.2.1), "Exp", lines: +55 -0
-		install.com (1.4.2.2), "Exp", lines: +6 -6
-
-	Run an installation of FIPS stuff as well.
-
-2004-05-27 12:19  levitte
-
-	Changed:
-		test/maketests.com (1.13.2.5), "Exp", lines: +3 -3
-		apps/makeapps.com (1.18.2.5), "Exp", lines: +3 -3
-
-	Make sure o_str.h is reachable.
-
-2004-06-19 15:15  ben
-
-	Changed:
-		Makefile.org (1.154.2.80), "Exp", lines: +1 -1
-		crypto/dh/dh.h (1.23.2.7), "Exp", lines: +0 -1
-		crypto/dh/dh_check.c (1.6.2.1), "Exp", lines: +4 -0
-		crypto/dh/dh_err.c (1.6.2.4), "Exp", lines: +0 -1
-		crypto/dh/dh_gen.c (1.8.8.3), "Exp", lines: +5 -9
-		crypto/dh/dh_key.c (1.16.2.3), "Exp", lines: +4 -0
-		fips/Makefile (1.1.4.2), "Exp", lines: +13 -14
-		fips/fingerprint.sha1 (1.1.2.6), "Exp", lines: +2 -2
-		fips/fips.h (1.1.2.4), "Exp", lines: +1 -0
-		fips/fips_err.h (1.1.4.2), "Exp", lines: +1 -0
-		fips/fips_make_sha1 (1.1.2.6), "Exp", lines: +3 -0
-		fips/fips_test_suite.c (1.1.4.3), "Exp", lines: +13 -9
-		fips/openssl_fips_fingerprint (1.1.4.2), "Exp", lines: +1 -2
-
-	The version that was actually submitted for FIPS testing.
-
-2004-06-19 15:16  ben
-
-	Changed:
-		fips/dh/Makefile (1.1.2.1), "Exp", lines: +92 -0
-		fips/dh/fingerprint.sha1 (1.1.2.1), "Exp", lines: +3 -0
-		fips/dh/fips_dh_check.c (1.1.2.1), "Exp", lines: +119 -0
-		fips/dh/fips_dh_gen.c (1.1.2.1), "Exp", lines: +182 -0
-		fips/dh/fips_dh_key.c (1.1.2.1), "Exp", lines: +222 -0
-
-	Add Diffie-Hellman to FIPS.
-
-2004-06-19 15:18  ben
-
-	Changed:
-		fips/.cvsignore (1.1.2.5), "Exp", lines: +2 -0
-		fips/dh/.cvsignore (1.1.2.1), "Exp", lines: +1 -0
-
-	Update ignores.
-
-2004-06-21 11:07  levitte
-
-	Changed:
-		fips/aes/Makefile (1.1.4.2), "Exp", lines: +7 -5
-		fips/des/Makefile (1.1.4.2), "Exp", lines: +7 -5
-		fips/dh/Makefile (1.1.2.2), "Exp", lines: +7 -6
-		fips/dsa/Makefile (1.1.4.2), "Exp", lines: +7 -6
-		fips/rsa/Makefile (1.1.4.2), "Exp", lines: +7 -6
-		fips/sha1/Makefile (1.1.4.2), "Exp", lines: +7 -5
-
-	Make sure we don't try to loop over an empty EXHEADER.	In the
-	Makefiles where this was fixed by commenting away code, change it
-	to check for an empty EXHEADER instead, so we have less hassle in a
-	future where EXHEADER changes.
-
-		PR: 900
-
-2004-06-21 20:05  levitte
-
-	Changed:
-		Makefile.org (1.154.2.82), "Exp", lines: +3 -1
-
-	Standard sh doesn't tolerate ! as part of the conditional command.
-
-		PR: 900
-
-2004-06-28 22:33  levitte
-
-	Changed:
-		fips/dh/fips_dh_check.c (1.1.2.2), "Exp", lines: +6 -0
-		fips/dh/fips_dh_gen.c (1.1.2.2), "Exp", lines: +6 -2
-		fips/dh/fips_dh_key.c (1.1.2.2), "Exp", lines: +8 -0
-
-	Make sure the FIPS stuff is only really compiled when in FIPS mode.
-
-2004-07-12 19:59  ben
-
-	Changed:
-		fips/fips_test_suite.c (1.1.4.4), "Exp", lines: +39 -6
-		fips/dh/fingerprint.sha1 (1.1.2.2), "Exp", lines: +3 -3
-
-	Corrected test program.
-
-2004-07-17 14:48  appro
-
-	Changed:
-		fips/des/Makefile (1.1.4.3), "Exp", lines: +1 -1
-
-	Eliminate enforced -g from CFLAGS. It switches off optimization
-	with some compilers, e.g. DEC C.
-
-2004-07-21 19:41  steve
-
-	Changed:
-		crypto/pem/pem_all.c (1.20.2.1), "Exp", lines: +119 -0
-
-	When in FIPS mode write private keys in PKCS#8 and PBES2 format to
-	avoid use of prohibited MD5 algorithm.
-
-2004-07-23 15:20  ben
-
-	Changed:
-		fips/rand/fingerprint.sha1 (1.1.2.7), "Exp", lines: +1 -1
-		fips/rand/fips_rand.c (1.1.2.7), "Exp", lines: +22 -7
-		fips/rand/fips_randtest.c (1.1.2.5), "Exp", lines: +2 -2
-
-	Convert to X9.31.
-
-2004-07-21 19:35  steve
-
-	Changed:
-		fips/fingerprint.sha1 (1.1.2.7), "Exp", lines: +1 -1
-		fips/fips.c (1.1.2.5), "Exp", lines: +3 -3
-		fips/rsa/fingerprint.sha1 (1.1.4.3), "Exp", lines: +1 -1
-		fips/rsa/fips_rsa_selftest.c (1.1.4.2), "Exp", lines: +8 -8
-
-	Avoid compiler warnings.
-
-2004-07-27 02:17  steve
-
-	Changed:
-		fips/fips_test_suite.c (1.1.4.5), "Exp", lines: +9 -8
-
-	Stop compiler warnings.
-
-2004-07-27 02:20  steve
-
-	Changed:
-		crypto/err/err.c (1.51.2.6), "Exp", lines: +1 -0
-
-	Add FIPS name to error library.
-
-2004-07-27 14:22  steve
-
-	Changed:
-		Makefile.org (1.154.2.84), "Exp", lines: +3 -3
-		fips/fips_check_sha1 (1.1.2.6), "Exp", lines: +1 -1
-		fips/openssl_fips_fingerprint (1.1.4.3), "Exp", lines: +1 -1
-
-	Rename libcrypto.sha1 to libcrypto.a.sha1
-
-2004-07-27 20:28  steve
-
-	Changed:
-		ssl/s3_lib.c (1.57.2.11), "Exp", lines: +33 -33
-		ssl/ssl.h (1.126.2.20), "Exp", lines: +1 -0
-		ssl/ssl_ciph.c (1.33.2.9), "Exp", lines: +11 -0
-		ssl/ssl_locl.h (1.47.2.3), "Exp", lines: +2 -1
-
-	New cipher "strength" FIPS which specifies that a cipher suite is
-	FIPS compatible.
-
-		New cipherstring "FIPS" is all FIPS compatible ciphersuites
-	except eNULL.
-
-		Only allow FIPS ciphersuites in FIPS mode.
-
-2004-07-28 04:24  levitte
-
-	Changed:
-		makevms.com (1.35.2.6), "Exp", lines: +2 -2
-
-	From the FIPS directory, darnit!
-
-2004-07-28 15:47  levitte
-
-	Changed:
-		makevms.com (1.35.2.7), "Exp", lines: +5 -1
-
-	Define OPENSSL_FIPS in opensslconf.h if a logical name with the
-	same name is defined.
-
-		Go up one directory level before dealing with FIPS stuff.
-
-2004-07-30 00:26  levitte
-
-	Changed:
-		fips/fips-lib.com (1.1.2.2), "Exp", lines: +3 -3
-
-	We're building crypto stuff, not ssl stuff.  Additionally, we're in
-	the fips subdirectory, not the crypto one...
-
-2004-07-30 16:37  levitte
-
-	Changed:
-		fips/sha1/fingerprint.sha1 (1.1.2.7), "Exp", lines: +2 -2
-		fips/sha1/fips_md32_common.h (1.1.2.6), "Exp", lines: +1 -1
-		fips/sha1/fips_sha_locl.h (1.1.2.5), "Exp", lines: +2 -2
-		fips/sha1/fips_standalone_sha1.c (1.1.2.5), "Exp", lines: +1 -1
-		fips/sha1/standalone.sha1 (1.1.2.8), "Exp", lines: +3 -3
-		ssl/ssl_ciph.c (1.33.2.10), "Exp", lines: +2 -2
-		fips/rsa/fingerprint.sha1 (1.1.4.4), "Exp", lines: +2 -2
-		fips/rsa/fips_rsa_eay.c (1.1.4.3), "Exp", lines: +1 -1
-		fips/rsa/fips_rsa_gen.c (1.1.4.3), "Exp", lines: +1 -1
-		fips/dh/fingerprint.sha1 (1.1.2.3), "Exp", lines: +1 -1
-		fips/dh/fips_dh_gen.c (1.1.2.3), "Exp", lines: +1 -1
-		fips/dsa/fingerprint.sha1 (1.1.2.6), "Exp", lines: +2 -2
-		fips/dsa/fips_dsa_gen.c (1.1.4.3), "Exp", lines: +4 -3
-		fips/dsa/fips_dsa_ossl.c (1.1.2.6), "Exp", lines: +2 -2
-		fips/des/fingerprint.sha1 (1.1.2.5), "Exp", lines: +2 -2
-		fips/des/fips_des_enc.c (1.1.2.5), "Exp", lines: +2 -2
-		fips/des/fips_set_key.c (1.1.4.3), "Exp", lines: +3 -3
-		fips/fingerprint.sha1 (1.1.2.8), "Exp", lines: +2 -2
-		fips/fips.c (1.1.2.6), "Exp", lines: +76 -23
-		fips/fips.h (1.1.2.5), "Exp", lines: +2 -3
-		fips/fips_locl.h (1.1.4.2), "Exp", lines: +7 -2
-		fips/aes/fingerprint.sha1 (1.1.2.5), "Exp", lines: +1 -1
-		fips/aes/fips_aes_core.c (1.1.2.5), "Exp", lines: +1 -1
-		crypto/rand/md_rand.c (1.69.2.5), "Exp", lines: +1 -1
-		crypto/rand/rand_lib.c (1.15.2.5), "Exp", lines: +2 -1
-		crypto/dsa/dsa_sign.c (1.10.2.6), "Exp", lines: +2 -2
-		crypto/dsa/dsa_vrf.c (1.10.2.6), "Exp", lines: +1 -1
-		crypto/pem/pem_all.c (1.20.2.2), "Exp", lines: +2 -2
-		crypto/cryptlib.c (1.32.2.12), "Exp", lines: +122 -6
-		crypto/crypto.h (1.62.2.8), "Exp", lines: +8 -1
-		crypto/md32_common.h (1.22.2.7), "Exp", lines: +2 -2
-
-	To protect FIPS-related global variables, add locking mechanisms
-	around them.
-
-		NOTE: because two new locks are added, this adds potential
-	binary incompatibility with earlier versions in the 0.9.7 series.
-	However, those locks will only ever be touched when FIPS_mode_set()
-	is called and after, thanks to a variable that's only changed from
-	0 to 1 once (when FIPS_mode_set() is called).  So basically, as
-	long as FIPS mode hasn't been engaged explicitely by the calling
-	application, the new locks are treated as if they didn't exist at
-	all, thus not becoming a problem.  Applications that are built or
-	rebuilt to use FIPS functionality will need to be recompiled in any
-	case, thus not being a problem either.
-
-2004-08-02 16:15  levitte
-
-	Changed:
-		crypto/cryptlib.c (1.32.2.13), "Exp", lines: +4 -4
-
-	Let's lock a write lock when changing values, shall we?
-
-		Thanks to Dr Stephen Henson <[e-mail]>
-	for making me aware of this error.
-
-2004-08-05 20:11  steve
-
-	Changed:
-		fips/fingerprint.sha1 (1.1.2.9), "Exp", lines: +1 -1
-		fips/fips.c (1.1.2.7), "Exp", lines: +1 -1
-
-	Stop compiler giving bogus shadow warning.
-
-2004-08-09 14:13  levitte
-
-	Changed:
-		makevms.com (1.35.2.8), "Exp", lines: +1 -1
-
-	In the fips directory, we use FIPS-LIB.COM, not CRYPTO-LIB.COM...
-
-2004-08-09 14:14  levitte
-
-	Changed:
-		fips/fips-lib.com (1.1.2.3), "Exp", lines: +4 -4
-
-	Correct typos and include directory specifications.
-
-2004-08-10 11:11  levitte
-
-	Changed:
-		fips/fips-lib.com (1.1.2.4), "Exp", lines: +2 -1
-
-	Update the VMS fips library builder with the DH library.
-
-2004-08-10 12:04  levitte
-
-	Changed:
-		fips/rand/fingerprint.sha1 (1.1.2.8), "Exp", lines: +1 -1
-		fips/rand/fips_rand.c (1.1.2.8), "Exp", lines: +7 -1
-
-	With DEC C in ANSI C mode, we need to define _XOPEN_SOURCE_EXTENDED
-	to get struct timeval and gettimeofday().
-
-2004-09-06 16:19  levitte
-
-	Changed:
-		fips/fips.c (1.1.2.8), "Exp", lines: +5 -4
-
-	Replace the bogus checks of n with proper uses of feof(), ferror()
-	and clearerr().
-
-2004-09-06 16:21  levitte
-
-	Changed:
-		fips/sha1/fips_sha_locl.h (1.1.2.6), "Exp", lines: +2 -2
-
-	num is an unsigned long, but since it was transfered from
-	crypto/sha/sha_locl.h, where it is in fact an int, we need to check
-	for less-than-zero as if it was an int...
-
-2004-10-08 12:03  ben
-
-	Changed:
-		fips/fingerprint.sha1 (1.1.2.10), "Exp", lines: +1 -1
-		fips/sha1/fingerprint.sha1 (1.1.2.8), "Exp", lines: +1 -1
-		fips/sha1/standalone.sha1 (1.1.2.9), "Exp", lines: +1 -1
-
-	Update fingerprints.
-
-2004-10-14 07:51  levitte
-
-	Changed:
-		VMS/mkshared.com (1.3.2.1), "Exp", lines: +8 -0
-
-	We need to check for OPENSSL_FIPS when building shared libraries,
-	so we get correct transfer vectors for those functions when
-	required.
-
-2004-10-26 13:47  steve
-
-	Changed:
-		util/mkfiles.pl (1.12.2.2), "Exp", lines: +1 -0
-
-	Add fips/dh directory to mkfiles.pl
-
-2004-10-26 14:17  levitte
-
-	Changed:
-		fips/sha1/Makefile (1.1.4.4), "Exp", lines: +3 -1
-		util/mkfiles.pl (1.12.2.3), "Exp", lines: +1 -0
-		fips/Makefile (1.1.4.5), "Exp", lines: +7 -1
-		crypto/sha/Makefile (1.1.4.4), "Exp", lines: +1 -7
-
-	fips/dh was missing in mkfiles.pl.  make update
-
-2004-10-26 15:01  steve
-
-	Changed:
-		util/mkfiles.pl (1.12.2.4), "Exp", lines: +0 -1
-
-	Only add fips/dh once...
-
-2004-11-01 09:20  levitte
-
-	Changed:
-		fips/rand/fingerprint.sha1 (1.1.2.9), "Exp", lines: +1 -1
-		fips/rand/fips_rand.c (1.1.2.9), "Exp", lines: +3 -1
-
-	Make sure _XOPEN_SOURCE_EXTENDED is correctly defined, and only if
-	not already defined.
-
-2004-12-09 19:03  appro
-
-	vChanged:
-		crypto/Makefile (1.1.4.4), "Exp", lines: +2 -0
-
-	Postpone linking of shared libcrypto in FIPS build.
-
-2004-12-09 19:13  appro
-
-	Changed:
-		fips/fingerprint.sha1 (1.1.2.11), "Exp", lines: +1 -1
-		fips/fips.c (1.1.2.9), "Exp", lines: +13 -1
-		fips/openssl_fips_fingerprint (1.1.4.4), "Exp", lines: +4 -2
-
-	Cygwin specific FIPS fix-ups.
-
-2004-12-09 23:43  appro
-
-	Changed:
-		Configure (1.314.2.100), "Exp", lines: +2 -3
-		crypto/des/des_enc.c (1.11.2.5), "Exp", lines: +2 -2
-
-	Eliminate false dependency on 386 config option is FIPS context.
-	At the same time limit assembler support to ELF platforms [that's
-	what is there, ELF modules].
-
-2004-12-10 12:37  appro
-
-	Changed:
-		Configure (1.314.2.101), "Exp", lines: +10 -3
-		crypto/des/des_enc.c (1.11.2.6), "Exp", lines: +2 -2
-
-	Respect no-asm with fips option and disable FIPS DES assembler in
-	shared context [because it's not PIC].
-
-2004-12-10 14:15  appro
-
-	Changed:
-		fips/sha1/fingerprint.sha1 (1.1.2.10), "Exp", lines: +1 -1
-		fips/sha1/standalone.sha1 (1.1.2.11), "Exp", lines: +1 -1
-		fips/sha1/asm/sx86-elf.s (1.1.4.3), "Exp", lines: +32 -32
-
-	Solaris x86 assembler update.
-
-2004-12-10 17:30  appro
-
-	Changed:
-		fips/fips_check_sha1 (1.1.2.7), "Exp", lines: +1 -1
-		fips/openssl_fips_fingerprint (1.1.4.5), "Exp", lines: +1 -1
-		fips/sha1/Makefile (1.1.4.6), "Exp", lines: +1 -1
-
-	Adapt FIPS sub-tree for mingw.
-
-2005-01-03 18:46  steve
-
-	Changed:
-		fips/rsa/fingerprint.sha1 (1.1.4.5), "Exp", lines: +1 -1
-		fips/rsa/fips_rsa_selftest.c (1.1.4.3), "Exp", lines: +55 -11
-
-	RSA KAT.
-
-2005-01-11 17:54  levitte
-
-	Changed:
-		fips/rsa/fingerprint.sha1 (1.1.4.6), "Exp", lines: +1 -1
-		fips/rsa/fips_rsa_selftest.c (1.1.4.4), "Exp", lines: +2 -2
-
-	Clear signed vs. unsigned conflicts.  Change the fingerprint
-	accordingly.
-
-2005-01-11 19:25  levitte
-
-	Changed:
-		ssl/ssltest.c (1.53.2.24), "Exp", lines: +2 -2
-		fips/rand/fips_randtest.c (1.1.2.6), "Exp", lines: +3 -3
-		fips/sha1/fips_sha1test.c (1.1.2.5), "Exp", lines: +10 -4
-		fips/des/fips_desmovs.c (1.1.2.6), "Exp", lines: +8 -7
-		fips/dsa/fips_dsatest.c (1.1.2.5), "Exp", lines: +2 -2
-		apps/openssl.c (1.48.2.12), "Exp", lines: +1 -1
-		fips/aes/fips_aesavs.c (1.1.2.12), "Exp", lines: +8 -7
-
-	Use EXIT() instead of exit().
-
-2005-01-26 21:00  steve
-
-	Changed:
-		apps/dgst.c (1.23.2.13), "Exp", lines: +10 -0
-		apps/pkcs12.c (1.60.2.13), "Exp", lines: +8 -1
-		crypto/crypto.h (1.62.2.9), "Exp", lines: +49 -0
-		crypto/md32_common.h (1.22.2.9), "Exp", lines: +1 -1
-		crypto/bf/bf_skey.c (1.6.2.1), "Exp", lines: +2 -1
-		crypto/bf/blowfish.h (1.9.2.1), "Exp", lines: +4 -1
-		crypto/cast/c_skey.c (1.5.6.1), "Exp", lines: +3 -1
-		crypto/cast/cast.h (1.7.2.1), "Exp", lines: +4 -1
-		crypto/evp/bio_md.c (1.11.2.3), "Exp", lines: +2 -7
-		crypto/evp/digest.c (1.21.2.7), "Exp", lines: +11 -0
-		crypto/evp/e_aes.c (1.6.2.11), "Exp", lines: +11 -11
-		crypto/evp/e_des.c (1.5.2.9), "Exp", lines: +5 -3
-		crypto/evp/e_des3.c (1.8.2.8), "Exp", lines: +6 -6
-		crypto/evp/evp.h (1.86.2.16), "Exp", lines: +17 -0
-		crypto/evp/evp_enc.c (1.28.2.11), "Exp", lines: +15 -1
-		crypto/evp/evp_err.c (1.23.2.4), "Exp", lines: +6 -1
-		crypto/evp/evp_locl.h (1.7.2.7), "Exp", lines: +17 -2
-		crypto/evp/m_dss.c (1.8.2.1), "Exp", lines: +1 -1
-		crypto/evp/m_md2.c (1.9.2.1), "Exp", lines: +1 -0
-		crypto/evp/m_md4.c (1.8.2.1), "Exp", lines: +1 -0
-		crypto/evp/m_md5.c (1.9.2.1), "Exp", lines: +1 -0
-		crypto/evp/m_mdc2.c (1.9.2.1), "Exp", lines: +1 -0
-		crypto/evp/m_sha.c (1.8.2.2), "Exp", lines: +1 -0
-		crypto/evp/m_sha1.c (1.8.2.1), "Exp", lines: +1 -1
-		crypto/evp/names.c (1.7.2.1), "Exp", lines: +3 -0
-		crypto/hmac/hmac.c (1.12.2.3), "Exp", lines: +7 -0
-		crypto/hmac/hmac.h (1.14.2.2), "Exp", lines: +1 -0
-		crypto/idea/i_skey.c (1.5.6.1), "Exp", lines: +13 -0
-		crypto/idea/idea.h (1.10.2.1), "Exp", lines: +4 -0
-		crypto/md2/md2.h (1.11.2.1), "Exp", lines: +3 -0
-		crypto/md2/md2_dgst.c (1.13.2.4), "Exp", lines: +3 -1
-		crypto/md4/md4.h (1.3.2.1), "Exp", lines: +3 -0
-		crypto/md4/md4_dgst.c (1.2.2.2), "Exp", lines: +1 -1
-		crypto/md5/md5.h (1.10.2.3), "Exp", lines: +3 -0
-		crypto/md5/md5_dgst.c (1.16.2.2), "Exp", lines: +1 -1
-		crypto/mdc2/mdc2.h (1.9.2.1), "Exp", lines: +3 -1
-		crypto/mdc2/mdc2dgst.c (1.13.2.1), "Exp", lines: +3 -1
-		crypto/rc2/rc2.h (1.10.2.1), "Exp", lines: +4 -1
-		crypto/rc2/rc2_skey.c (1.4.6.1), "Exp", lines: +13 -0
-		crypto/rc4/rc4.h (1.10.2.2), "Exp", lines: +3 -0
-		crypto/rc4/rc4_skey.c (1.10.8.2), "Exp", lines: +2 -1
-		crypto/rc5/rc5.h (1.5.2.1), "Exp", lines: +4 -1
-		crypto/rc5/rc5_skey.c (1.4.6.1), "Exp", lines: +14 -0
-		crypto/ripemd/ripemd.h (1.8.2.1), "Exp", lines: +3 -0
-		crypto/ripemd/rmd_dgst.c (1.13.2.2), "Exp", lines: +2 -1
-		crypto/sha/sha.h (1.11.2.2), "Exp", lines: +3 -0
-		crypto/sha/sha_locl.h (1.16.2.3), "Exp", lines: +4 -0
-		crypto/x509/x509_cmp.c (1.22.2.4), "Exp", lines: +7 -1
-		crypto/x509/x509_vfy.c (1.56.2.13), "Exp", lines: +1 -1
-		ssl/s3_clnt.c (1.53.2.18), "Exp", lines: +2 -0
-		ssl/s3_enc.c (1.31.2.9), "Exp", lines: +3 -0
-		ssl/s3_srvr.c (1.85.2.23), "Exp", lines: +2 -0
-		ssl/t1_enc.c (1.27.2.9), "Exp", lines: +2 -0
-
-	FIPS algorithm blocking.
-
-		Non FIPS algorithms are not normally allowed in FIPS mode.
-
-		Any attempt to use them via high level functions will
-	return an error.
-
-		The low level non-FIPS algorithm functions cannot return
-	errors so they produce assertion failures. HMAC also has to give an
-	assertion error because it (erroneously) can't return an error
-	either.
-
-		There are exceptions (such as MD5 in TLS and non
-	cryptographic use of algorithms) and applications can override the
-	blocking and use non FIPS algorithms anyway.
-
-		For low level functions the override is perfomed by
-	prefixing the algorithm initalization function with "private_" for
-	example private_MD5_Init().
-
-		For high level functions an override is performed by
-	setting a flag in the context.
-
-2005-01-27 02:49  steve
-
-	Changed:
-		apps/dgst.c (1.23.2.14), "Exp", lines: +9 -5
-		crypto/crypto.h (1.62.2.10), "Exp", lines: +3 -0
-		crypto/evp/digest.c (1.21.2.8), "Exp", lines: +34 -0
-		crypto/hmac/hmac.c (1.12.2.4), "Exp", lines: +9 -0
-
-	More FIPS algorithm blocking.
-
-		Catch attempted use of non FIPS algorithms with HMAC.
-
-		Give an assertion error for applications that ignore FIPS
-	digest errors.
-
-		Make -non-fips-allow work with dgst and HMAC.
-
-2005-01-28 15:03  steve
-
-	Changed:
-		apps/dgst.c (1.23.2.15), "Exp", lines: +2 -1
-		apps/enc.c (1.35.2.13), "Exp", lines: +38 -4
-		crypto/evp/e_rc4.c (1.11.2.2), "Exp", lines: +1 -0
-		crypto/evp/evp.h (1.86.2.17), "Exp", lines: +3 -0
-		crypto/evp/evp_enc.c (1.28.2.12), "Exp", lines: +60 -15
-		crypto/evp/evp_locl.h (1.7.2.8), "Exp", lines: +1 -0
-		test/testenc (1.3.8.2), "Exp", lines: +8 -8
-
-	Further FIPS algorithm blocking.
-
-		Fixes to cipher blocking and enabling code.
-
-		Add option -non-fips-allow to 'enc' and update testenc.
-
-2005-01-31 02:33  steve
-
-	Changed:
-		ssl/s23_clnt.c (1.20.2.7), "Exp", lines: +16 -0
-		ssl/s23_srvr.c (1.41.2.6), "Exp", lines: +9 -0
-		ssl/s3_clnt.c (1.53.2.19), "Exp", lines: +0 -8
-		ssl/s3_enc.c (1.31.2.10), "Exp", lines: +1 -0
-		ssl/s3_srvr.c (1.85.2.24), "Exp", lines: +0 -8
-		ssl/ssl.h (1.126.2.21), "Exp", lines: +1 -0
-		ssl/ssl_cert.c (1.48.2.10), "Exp", lines: +0 -8
-		ssl/ssl_err.c (1.41.2.4), "Exp", lines: +2 -1
-		ssl/ssl_lib.c (1.110.2.13), "Exp", lines: +8 -9
-		ssl/t1_enc.c (1.27.2.10), "Exp", lines: +0 -18
-
-	Only allow TLS is FIPS mode.
-
-		Remove old FIPS_allow_md5() calls.
-
-2005-02-05 19:24  steve
-
-	Changed:
-		apps/req.c (1.88.2.18), "Exp", lines: +8 -1
-		apps/x509.c (1.67.2.20), "Exp", lines: +8 -1
-
-	In FIPS mode use SHA1 as default digest in x509 and req utilities.
-
-2005-03-15 10:46  appro
-
-	Changed:
-		Makefile.org (1.154.2.96), "Exp", lines: +1 -1
-		crypto/Makefile (1.1.4.6), "Exp", lines: +2 -3
-		fips/Makefile (1.1.4.8), "Exp", lines: +4 -1
-
-	Real Bourne shell doesn't accept ! as in "if ! grep ..." Fix this
-	in crypto/Makefile and make Makefile.org and fips/Makefile more
-	discreet.
-
-2005-03-22 18:29  steve
-
-	Changed:
-		fips/fingerprint.sha1 (1.1.2.12), "Exp", lines: +1 -1
-		fips/fips.c (1.1.2.10), "Exp", lines: +1 -0
-
-	Fix memory leak.
-
-2005-03-27 05:36  steve
-
-	Changed:
-		crypto/evp/e_null.c (1.9.2.1), "Exp", lines: +1 -1
-		ssl/s3_lib.c (1.57.2.13), "Exp", lines: +3 -3
-
-	Allow 'null' cipher and appropriate Kerberos ciphersuites in FIPS
-	mode.
-
-2005-04-14 14:44  steve
-
-	Changed:
-		fips/fipshashes.sha1 (1.1.2.1), "Exp", lines: +29 -0
-		util/checkhash.pl (1.1.2.1), "Exp", lines: +181 -0
-
-	Perl script that checks or rebuilds FIPS hash files. This works on
-	both Unix and Windows.
-
-		Merge all FIPS hash files into a single hash file
-	fips/fips.sha1
-
-2005-04-15 05:27  steve
-
-	Changed:
-		fips/Makefile (1.1.4.9), "Exp", lines: +1 -1
-		fips/aes/Makefile (1.1.4.4), "Exp", lines: +1 -4
-		fips/des/Makefile (1.1.4.6), "Exp", lines: +1 -4
-		fips/dh/Makefile (1.1.2.5), "Exp", lines: +1 -4
-		fips/dsa/Makefile (1.1.4.4), "Exp", lines: +1 -4
-		fips/rand/Makefile (1.1.4.3), "Exp", lines: +1 -4
-		fips/rsa/Makefile (1.1.4.5), "Exp", lines: +1 -4
-		fips/sha1/Makefile (1.1.4.9), "Exp", lines: +1 -7
-
-	Update hash checking in makefiles to use new perl script.
-
-2005-04-17 06:37  steve
-
-	Changed:
-		util/checkhash.pl (1.1.2.2), "Exp", lines: +163 -127
-
-	Modify checkhash.pl so it can be run standalone or included as a
-	funtion in another perl script.
-
-2005-04-17 16:00  appro
-
-	Changed:
-		fips/sha1/Makefile (1.1.4.10), "Exp", lines: +9 -5
-
-	Bring back fips_standalone_sha1.
-
-2005-04-17 16:17  appro
-
-	Deleted:
-		fips/sha1/asm/sx86-elf.s (1.1.4.4)
-	Changed:
-		Configure (1.314.2.114), "Exp", lines: +1 -1
-		fips/fipshashes.sha1 (1.1.2.2), "Exp", lines: +1 -1
-		fips/sha1/Makefile (1.1.4.11), "Exp", lines: +1 -1
-		fips/sha1/standalone.sha1 (1.1.2.13), "Exp", lines: +1 -1
-		fips/sha1/asm/fips-sx86-elf.s (1.1.2.1), "Exp", lines: +1568 -0
-
-	Rename fips/sha1/sx86-elf.s to fips/sha1/fips-sx86-elf.s.
-
-2005-04-17 16:21  steve
-
-	Changed:
-		util/checkhash.pl (1.1.2.3), "Exp", lines: +2 -0
-
-	Return 0 for successful hash check.
-
-2005-04-17 16:54  appro
-
-	Changed:
-		Configure (1.314.2.116), "Exp", lines: +8 -1
-		Makefile.org (1.154.2.99), "Exp", lines: +3 -2
-		crypto/aes/aes_cbc.c (1.1.2.11), "Exp", lines: +2 -0
-		fips/fipshashes.sha1 (1.1.2.4), "Exp", lines: +1 -0
-		fips/aes/Makefile (1.1.4.5), "Exp", lines: +4 -2
-		fips/aes/asm/fips-ax86-elf.s (1.1.2.1), "Exp", lines: +1822 -0
-
-	Throw in fips/aes/asm/fips-ax86-elf.s.
-
-2005-04-17 16:35  appro
-
-	Changed:
-		Configure (1.314.2.115), "Exp", lines: +1 -1
-		fips/fipshashes.sha1 (1.1.2.3), "Exp", lines: +1 -1
-		fips/des/asm/fips-dx86-elf.s (1.1.4.2), "Exp", lines: +108 -98
-
-	Regenerate fips/des/asm/fips-dx86-elf.s with -fPIC flag.
-
-2005-04-17 17:26  appro
-
-	Changed:
-		crypto/cryptlib.c (1.32.2.18), "Exp", lines: +6 -55
-		crypto/crypto.h (1.62.2.11), "Exp", lines: +0 -3
-		fips/fips.c (1.1.2.11), "Exp", lines: +62 -8
-		fips/fips.h (1.1.2.7), "Exp", lines: +2 -3
-		fips/fips_locl.h (1.1.4.3), "Exp", lines: +6 -3
-		fips/fipshashes.sha1 (1.1.2.5), "Exp", lines: +4 -4
-		fips/rand/fips_rand.c (1.1.2.10), "Exp", lines: +3 -1
-		fips/rsa/fips_rsa_gen.c (1.1.4.4), "Exp", lines: +4 -2
-
-	Resolve minor binary compatibility issues in fips.
-
-2005-04-17 18:22  appro
-
-	Changed:
-		fips/fipshashes.sha1 (1.1.2.6), "Exp", lines: +12 -12
-		fips/des/fips_des_locl.h (1.1.2.4), "Exp", lines: +1 -1
-		fips/des/fips_set_key.c (1.1.4.4), "Exp", lines: +2 -2
-		fips/dh/fips_dh_key.c (1.1.2.3), "Exp", lines: +1 -1
-		fips/dsa/fips_dsa_ossl.c (1.1.2.7), "Exp", lines: +1 -1
-		fips/dsa/fips_dsa_selftest.c (1.1.4.2), "Exp", lines: +3 -3
-		fips/rand/fips_rand.c (1.1.2.11), "Exp", lines: +2 -2
-		fips/rand/fips_rand.h (1.1.2.5), "Exp", lines: +1 -1
-		fips/rsa/fips_rsa_eay.c (1.1.4.4), "Exp", lines: +1 -1
-		fips/rsa/fips_rsa_gen.c (1.1.4.5), "Exp", lines: +1 -1
-		fips/rsa/fips_rsa_selftest.c (1.1.4.5), "Exp", lines: +11 -11
-		fips/sha1/fips_sha1_selftest.c (1.1.4.2), "Exp", lines: +1 -1
-		fips/sha1/fips_sha1dgst.c (1.1.2.5), "Exp", lines: +1 -1
-		fips/sha1/standalone.sha1 (1.1.2.14), "Exp", lines: +2 -2
-
-	Minor fips const-ification.
-
-2005-04-18 07:02  steve
-
-	Changed:
-		crypto/bf/bf_skey.c (1.6.2.2), "Exp", lines: +1 -0
-		crypto/cast/c_skey.c (1.5.6.2), "Exp", lines: +1 -0
-		crypto/idea/i_skey.c (1.5.6.2), "Exp", lines: +1 -0
-		crypto/rc2/rc2_skey.c (1.4.6.2), "Exp", lines: +1 -0
-		crypto/rc4/rc4_skey.c (1.10.8.3), "Exp", lines: +1 -0
-		crypto/rc5/rc5_skey.c (1.4.6.2), "Exp", lines: +1 -0
-
-	Pick up definition of FIPS_mode() in fips.h to avoid warnings.
-
-2005-04-18 10:34  steve
-
-	Deleted:
-		fips/fingerprint.sha1 (1.1.2.14)
-		fips/fips_check_sha1 (1.1.2.8)
-		fips/fips_make_sha1 (1.1.2.7)
-		fips/aes/fingerprint.sha1 (1.1.2.7)
-		fips/des/fingerprint.sha1 (1.1.2.6)
-		fips/dh/fingerprint.sha1 (1.1.2.4)
-		fips/dsa/fingerprint.sha1 (1.1.2.7)
-		fips/rand/fingerprint.sha1 (1.1.2.10)
-		fips/rsa/fingerprint.sha1 (1.1.4.7)
-		fips/sha1/fingerprint.sha1 (1.1.2.12)
-	Changed:
-		fips/sha1/Makefile (1.1.4.12), "Exp", lines: +1 -4
-
-	Remove obsolete fingerprint.sha1 files and associated scripts.
-	Delete test in fips/sha1/Makefile: the top level test checks the
-	same files.
-
-2005-04-19 09:11  appro
-
-	Deleted:
-		fips/fipshashes.sha1 (1.1.2.7)
-		fips/sha1/standalone.sha1 (1.1.2.15)
-	Changed:
-		fips/fipshashes.c (1.1.2.1), "Exp", lines: +32 -0
-		util/checkhash.pl (1.1.2.4), "Exp", lines: +7 -4
-
-	Maintain fingerprint hashes as C source.
-
-2005-04-19 09:17  appro
-
-	Changed:
-		util/checkhash.pl (1.1.2.5), "Exp", lines: +1 -1
-
-	Complete the transition C-code hashes.
-
-2005-04-21 19:06  steve
-
-	Changed:
-		apps/openssl.c (1.48.2.13), "Exp", lines: +0 -2
-		fips/fips.c (1.1.2.12), "Exp", lines: +0 -27
-		fips/fips.h (1.1.2.8), "Exp", lines: +0 -2
-		fips/fipshashes.c (1.1.2.2), "Exp", lines: +2 -2
-
-	Remove defunct FIPS_allow_md5() and related functions.
-
-2005-04-22 06:15  appro
-
-	Changed:
-		fips/fips.c (1.1.2.13), "Exp", lines: +3 -3
-		fips/fips_err.h (1.1.4.4), "Exp", lines: +3 -3
-		fips/fipshashes.c (1.1.2.4), "Exp", lines: +2 -2
-
-	Move some variables to .bss.
-
 
=== modified file 'Configure'
--- Configure	2008-11-11 17:24:44 +0000
+++ Configure	2009-12-07 19:46:11 +0000
@@ -6,11 +6,13 @@
 ##
 
 require 5.000;
-use strict;
+eval 'use strict;';
+
+print STDERR "Warning: perl module strict not found.\n" if ($@);
 
 # see INSTALL for instructions.
 
-my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-krb5] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags]\n";
+my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [enable-montasm] [no-asm] [no-dso] [no-krb5] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags]\n";
 
 # Options:
 #
@@ -54,6 +56,8 @@
 # [no-]zlib     [don't] compile support for zlib compression.
 # zlib-dynamic	Like "zlib", but the zlib library is expected to be a shared
 #		library and will be loaded in run-time by the OpenSSL library.
+# enable-montasm 0.9.8 branch only: enable Montgomery x86 assembler backport
+#               from 0.9.9
 # 386           generate 80386 code
 # no-sse2	disables IA-32 SSE2 code, above option implies no-sse2
 # no-<cipher>   build without specified algorithm (rsa, idea, rc5, ...)
@@ -97,6 +101,11 @@
 # SHA512_ASM	sha512_block is implemented in assembler
 # AES_ASM	ASE_[en|de]crypt is implemented in assembler
 
+# Minimum warning options... any contributions to OpenSSL should at least get
+# past these. 
+
+my $gcc_devteam_warn = "-Wall -pedantic -DPEDANTIC -Wno-long-long -Wsign-compare -Wmissing-prototypes -Wshadow -Wformat -Werror -DCRYPTO_MDEBUG_ALL -DCRYPTO_MDEBUG_ABORT -DREF_CHECK -DOPENSSL_NO_DEPRECATED";
+
 my $x86_gcc_des="DES_PTR DES_RISC1 DES_UNROLL";
 
 # MD2_CHAR slags pentium pros
@@ -114,13 +123,12 @@
 my $bits1="THIRTY_TWO_BIT ";
 my $bits2="SIXTY_FOUR_BIT ";
 
-my $x86_elf_asm="x86cpuid-elf.o:bn86-elf.o co86-elf.o:dx86-elf.o yx86-elf.o:ax86-elf.o:bx86-elf.o:mx86-elf.o:sx86-elf.o s512sse2-elf.o:cx86-elf.o:rx86-elf.o:rm86-elf.o:r586-elf.o";
-my $x86_coff_asm="x86cpuid-cof.o:bn86-cof.o co86-cof.o:dx86-cof.o yx86-cof.o:ax86-cof.o:bx86-cof.o:mx86-cof.o:sx86-cof.o s512sse2-cof.o:cx86-cof.o:rx86-cof.o:rm86-cof.o:r586-cof.o";
-my $x86_out_asm="x86cpuid-out.o:bn86-out.o co86-out.o:dx86-out.o yx86-out.o:ax86-out.o:bx86-out.o:mx86-out.o:sx86-out.o s512sse2-out.o:cx86-out.o:rx86-out.o:rm86-out.o:r586-out.o";
+my $x86_elf_asm="x86cpuid-elf.o:bn86-elf.o co86-elf.o MAYBE-MO86-elf.o:dx86-elf.o yx86-elf.o:ax86-elf.o:bx86-elf.o:mx86-elf.o:sx86-elf.o s512sse2-elf.o:cx86-elf.o:rx86-elf.o rc4_skey.o:rm86-elf.o:r586-elf.o";
+my $x86_coff_asm="x86cpuid-cof.o:bn86-cof.o co86-cof.o MAYBE-MO86-cof.o:dx86-cof.o yx86-cof.o:ax86-cof.o:bx86-cof.o:mx86-cof.o:sx86-cof.o s512sse2-cof.o:cx86-cof.o:rx86-cof.o rc4_skey.o:rm86-cof.o:r586-cof.o";
+my $x86_out_asm="x86cpuid-out.o:bn86-out.o co86-out.o MAYBE-MO86-out.o:dx86-out.o yx86-out.o:ax86-out.o:bx86-out.o:mx86-out.o:sx86-out.o s512sse2-out.o:cx86-out.o:rx86-out.o rc4_skey.o:rm86-out.o:r586-out.o";
 
-#my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o::::md5-x86_64.o:::rc4-x86_64.o::";
-my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o::::md5-x86_64.o:::::";
-my $ia64_asm=":bn-ia64.o::aes_core.o aes_cbc.o aes-ia64.o:::sha1-ia64.o sha256-ia64.o sha512-ia64.o::rc4-ia64.o::";
+my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o x86_64-mont.o::aes-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o::";
+my $ia64_asm=":bn-ia64.o::aes_core.o aes_cbc.o aes-ia64.o:::sha1-ia64.o sha256-ia64.o sha512-ia64.o::rc4-ia64.o rc4_skey.o::";
 
 my $no_asm="::::::::::";
 
@@ -151,11 +159,14 @@
 "debug-ben",	"gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::bn86-elf.o co86-elf.o",
 "debug-ben-openbsd","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
 "debug-ben-openbsd-debug","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
-"debug-ben-debug",	"gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::::",
+"debug-ben-debug",	"gcc:$gcc_devteam_warn -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG  -DDEBUG_SAFESTACK -g3 -O2 -pipe::(unknown)::::::",
 "debug-ben-strict",	"gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DCONST_STRICT -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe::(unknown)::::::",
 "debug-rse","cc:-DTERMIOS -DL_ENDIAN -pipe -O -g -ggdb3 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
-"debug-bodo",	"gcc:-DL_ENDIAN -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBIO_PAIR_DEBUG -DPEDANTIC -g -march=i486 -pedantic -Wshadow -Wall::-D_REENTRANT:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
+"debug-bodo",	"gcc:-DL_ENDIAN -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBIO_PAIR_DEBUG -DPEDANTIC -g -march=i486 -pedantic -Wshadow -Wall -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
 "debug-ulf", "gcc:-DTERMIOS -DL_ENDIAN -march=i486 -Wall -DBN_DEBUG -DBN_DEBUG_RAND -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -g -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations:::CYGWIN32:::${no_asm}:win32:cygwin-shared:::.dll",
+"debug-steve64", "gcc:$gcc_devteam_warn -m64 -DL_ENDIAN -DTERMIO -DCONF_DEBUG -DDEBUG_SAFESTACK -g -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-steve32", "gcc:$gcc_devteam_warn -m32 -DL_ENDIAN -DCONF_DEBUG -DDEBUG_SAFESTACK -g -pipe::-D_REENTRANT::-rdynamic -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-steve-opt", "gcc:$gcc_devteam_warn -m64 -O3 -DL_ENDIAN -DTERMIO -DCONF_DEBUG -DDEBUG_SAFESTACK -g -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "debug-steve",	"gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DPEDANTIC -m32 -g -pedantic -Wno-long-long -Wall -Werror -Wshadow -pipe::-D_REENTRANT::-rdynamic -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared",
 "debug-steve-linux-pseudo64",	"gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DOPENSSL_NO_ASM -g -mcpu=i486 -Wall -Werror -Wshadow -pipe::-D_REENTRANT::-rdynamic -ldl:SIXTY_FOUR_BIT:${no_asm}:dlfcn:linux-shared",
 "debug-levitte-linux-elf","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_DEBUG -DBN_DEBUG_RAND -DCRYPTO_MDEBUG -DENGINE_CONF_DEBUG -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -Wshadow -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
@@ -202,11 +213,11 @@
 "solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "solaris-sparcv8-gcc","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 # -m32 should be safe to add as long as driver recognizes -mcpu=ultrasparc
-"solaris-sparcv9-gcc","gcc:-m32 -mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::md5-sparcv8plus.o::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris64-sparcv9-gcc","gcc:-m64 -mcpu=ultrasparc -O3 -Wall -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:::des_enc-sparc.o fcrypt_b.o:::md5-sparcv9.o::::::dlfcn:solaris-shared:-fPIC:-m64 -shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris-sparcv9-gcc","gcc:-m32 -mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris64-sparcv9-gcc","gcc:-m64 -mcpu=ultrasparc -O3 -Wall -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:::des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-fPIC:-m64 -shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 ####
 "debug-solaris-sparcv8-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -O -g -mv8 -Wall -DB_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8.o::::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-solaris-sparcv9-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -DPEDANTIC -O -g -mcpu=ultrasparc -pedantic -ansi -Wall -Wshadow -Wno-long-long -D__EXTENSIONS__ -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::md5-sparcv8plus.o::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-solaris-sparcv9-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -DPEDANTIC -O -g -mcpu=ultrasparc -pedantic -ansi -Wall -Wshadow -Wno-long-long -D__EXTENSIONS__ -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
 #### SPARC Solaris with Sun C setups
 # SC4.0 doesn't pass 'make test', upgrade to SC5.0 or SC4.2.
@@ -214,11 +225,11 @@
 # SC5.0 note: Compiler common patch 107357-01 or later is required!
 "solaris-sparcv7-cc","cc:-xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "solaris-sparcv8-cc","cc:-xarch=v8 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris-sparcv9-cc","cc:-xtarget=ultra -xarch=v8plus -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::md5-sparcv8plus.o::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris64-sparcv9-cc","cc:-xtarget=ultra -xarch=v9 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:::des_enc-sparc.o fcrypt_b.o:::md5-sparcv9.o::::::dlfcn:solaris-shared:-KPIC:-xarch=v9 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):/usr/ccs/bin/ar rs",
+"solaris-sparcv9-cc","cc:-xtarget=ultra -xarch=v8plus -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris64-sparcv9-cc","cc:-xtarget=ultra -xarch=v9 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:::des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-KPIC:-xarch=v9 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):/usr/ccs/bin/ar rs",
 ####
 "debug-solaris-sparcv8-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -xarch=v8 -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8.o::::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-solaris-sparcv9-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -xtarget=ultra -xarch=v8plus -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8plus.o::::md5-sparcv8plus.o::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", 
+"debug-solaris-sparcv9-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -xtarget=ultra -xarch=v8plus -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8plus.o::::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", 
 
 #### SunOS configs, assuming sparc for the gcc one.
 #"sunos-cc", "cc:-O4 -DNOPROTO -DNOCONST::(unknown):SUNOS::DES_UNROLL:${no_asm}::",
@@ -309,48 +320,6 @@
 "osf1-alpha-cc",  "cc:-std1 -tune host -O4 -readonly_strings::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared:::.so",
 "tru64-alpha-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared::-msym:.so",
 
-# Debian GNU/* (various architectures)
-"debian-alpha","gcc:-DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-alpha-ev4","gcc:-DTERMIO -O3 -Wa,--noexecstack -mcpu=ev4 -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-alpha-ev5","gcc:-DTERMIO -O3 -Wa,--noexecstack -mcpu=ev5 -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-arm","gcc:-DL_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG DES_RISC1::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-armeb","gcc:-DB_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG DES_RISC1::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-armel","gcc:-DL_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG DES_RISC1::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-#"debian-amd64","gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-amd64", "gcc:-m64 -DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-kfreebsd-amd64","gcc:-m64 -DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-#"debian-freebsd-alpha","gcc:-DTERMIOS -O -Wa,--noexecstack -fomit-frame-pointer::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-kfreebsd-i386","gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-hppa","gcc:-DB_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:BN_LLONG MD2_CHAR RC4_INDEX::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-hurd-i386","gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -m486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-ia64","gcc:-DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-#"debian-i386","gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -fomit-frame-pointer -m486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::dlfcn:linux-shared:-fPIC",
-"debian-i386","gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-i386-i486","gcc:-DL_ENDIAN -DTERMIO -O3 -march=i486 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-i386-i586","gcc:-DL_ENDIAN -DTERMIO -O3 -march=i586 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-i386-i686/cmov","gcc:-DL_ENDIAN -DTERMIO -O3 -march=i686 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-lpia","gcc:-DL_ENDIAN -DTERMIO -O3 -march=i686 -mtune=i586 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-m68k","gcc:-DB_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG MD2_CHAR RC4_INDEX::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-mips",   "gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-mipsel",   "gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-netbsd-i386",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -m486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-netbsd-m68k",	"gcc:-DB_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-netbsd-sparc",	"gcc:-DB_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -mv8 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-openbsd-alpha","gcc:-DTERMIOS -O3 -Wa,--noexecstack -g::(unknown):::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-openbsd-i386",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -m486::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-openbsd-mips","gcc:-O2 -Wa,--noexecstack -g -DL_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC2 DES_PTR BF_PTR:::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-powerpc","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:BN_LLONG DES_UNROLL DES_RISC2 DES_PTR MD2_CHAR RC4_INDEX::linux_ppc32.o::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-ppc64","gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL::linux_ppc64.o::::::::::dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-s390","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", 
-"debian-sh3",   "gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-sh4",   "gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-sh3eb",   "gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-sh4eb",   "gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-m32r","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-sparc","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl -Wl,-Bsymbolic-functions:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-sparc-v8","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -mcpu=v8 -g -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debian-sparc-v9","gcc:-DB_ENDIAN -DTERMIO -O3 -mcpu=v9 -Wa,--noexecstack -Wa,-Av8plus -g -Wall -DULTRASPARC -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::md5-sparcv8plus.o::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
 ####
 #### Variety of LINUX:-)
 ####
@@ -375,9 +344,9 @@
 "linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 # it's a real mess with -mcpu=ultrasparc option under Linux, but
 # -Wa,-Av8plus should do the trick no matter what.
-"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::md5-sparcv8plus.o::::::dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 # GCC 3.1 is a requirement
-"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::::md5-sparcv9.o::::::dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::::::::::dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 #### Alpha Linux with GNU C and Compaq C setups
 # Special notes:
 # - linux-alpha+bwx-gcc is ment to be used from ./config only. If you
@@ -407,7 +376,7 @@
 # -DMD32_REG_T=int doesn't actually belong in sparc64 target, it
 # simply *happens* to work around a compiler bug in gcc 3.3.3,
 # triggered by RIPEMD160 code.
-"BSD-sparc64",	"gcc:-DB_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC2_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC2 BF_PTR:::des_enc-sparc.o fcrypt_b.o:::md5-sparcv9.o::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"BSD-sparc64",	"gcc:-DB_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC2_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC2 BF_PTR:::des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "BSD-ia64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${ia64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "BSD-x86_64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
@@ -445,12 +414,12 @@
 
 #### IBM's AIX.
 "aix3-cc",  "cc:-O -DB_ENDIAN -qmaxmem=16384::(unknown):AIX::BN_LLONG RC4_CHAR:::",
-"aix-gcc",  "gcc:-O -DB_ENDIAN::-D_THREAD_SAFE:AIX::BN_LLONG RC4_CHAR::aix_ppc32.o::::::::::dlfcn:aix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 32",
-"aix64-gcc","gcc:-maix64 -O -DB_ENDIAN::-D_THREAD_SAFE:AIX::SIXTY_FOUR_BIT_LONG RC4_CHAR::aix_ppc64.o::::::::::dlfcn:aix-shared::-maix64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X64",
+"aix-gcc",  "gcc:-O -DB_ENDIAN::-pthread:AIX::BN_LLONG RC4_CHAR::aix_ppc32.o::::::::::dlfcn:aix-shared::-shared -Wl,-G:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 32",
+"aix64-gcc","gcc:-maix64 -O -DB_ENDIAN::-pthread:AIX::SIXTY_FOUR_BIT_LONG RC4_CHAR::aix_ppc64.o::::::::::dlfcn:aix-shared::-maix64 -shared -Wl,-G:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X64",
 # Below targets assume AIX 5. Idea is to effectively disregard $OBJECT_MODE
 # at build time. $OBJECT_MODE is respected at ./config stage!
-"aix-cc",   "cc:-q32 -O -DB_ENDIAN -qmaxmem=16384 -qro -qroconst::-qthreaded:AIX::BN_LLONG RC4_CHAR::aix_ppc32.o::::::::::dlfcn:aix-shared::-q32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 32",
-"aix64-cc", "cc:-q64 -O -DB_ENDIAN -qmaxmem=16384 -qro -qroconst::-qthreaded:AIX::SIXTY_FOUR_BIT_LONG RC4_CHAR::aix_ppc64.o::::::::::dlfcn:aix-shared::-q64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 64",
+"aix-cc",   "cc:-q32 -O -DB_ENDIAN -qmaxmem=16384 -qro -qroconst::-qthreaded:AIX::BN_LLONG RC4_CHAR::aix_ppc32.o::::::::::dlfcn:aix-shared::-q32 -G:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 32",
+"aix64-cc", "cc:-q64 -O -DB_ENDIAN -qmaxmem=16384 -qro -qroconst::-qthreaded:AIX::SIXTY_FOUR_BIT_LONG RC4_CHAR::aix_ppc64.o::::::::::dlfcn:aix-shared::-q64 -G:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 64",
 
 #
 # Cray T90 and similar (SDSC)
@@ -519,17 +488,22 @@
 # Cygwin
 "Cygwin-pre1.3", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown):CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:win32",
 "Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall:::CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_coff_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
--"debug-Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -march=i486 -Wall -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -g -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror:::CYGWIN32:::${no_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
+"debug-Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -march=i486 -Wall -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -g -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror:::CYGWIN32:::${no_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
 
-# NetWare from David Ward ([e-mail]) - requires MetroWerks NLM development tools
+# NetWare from David Ward ([e-mail])
+# requires either MetroWerks NLM development tools, or gcc / nlmconv
+# NetWare defaults socket bio to WinSock sockets. However,
+# the builds can be configured to use BSD sockets instead.
 # netware-clib => legacy CLib c-runtime support
-"netware-clib", "mwccnlm::::::BN_LLONG ${x86_gcc_opts}::",
+"netware-clib", "mwccnlm::::::${x86_gcc_opts}::",
+"netware-clib-bsdsock", "mwccnlm::::::${x86_gcc_opts}::",
+"netware-clib-gcc", "i586-netware-gcc:-nostdinc -I/ndk/nwsdk/include/nlm -I/ndk/ws295sdk/include -DL_ENDIAN -DNETWARE_CLIB -DOPENSSL_SYSNAME_NETWARE -O2 -Wall:::::${x86_gcc_opts}::",
+"netware-clib-bsdsock-gcc", "i586-netware-gcc:-nostdinc -I/ndk/nwsdk/include/nlm -DNETWARE_BSDSOCK -DNETDB_USE_INTERNET -DL_ENDIAN -DNETWARE_CLIB -DOPENSSL_SYSNAME_NETWARE -O2 -Wall:::::${x86_gcc_opts}::",
 # netware-libc => LibC/NKS support
-# NetWare defaults socket bio to WinSock sockets. However, the LibC build can be
-# configured to use BSD sockets instead.
 "netware-libc", "mwccnlm::::::BN_LLONG ${x86_gcc_opts}::",
 "netware-libc-bsdsock", "mwccnlm::::::BN_LLONG ${x86_gcc_opts}::",
 "netware-libc-gcc", "i586-netware-gcc:-nostdinc -I/ndk/libc/include -I/ndk/libc/include/winsock -DL_ENDIAN -DNETWARE_LIBC -DOPENSSL_SYSNAME_NETWARE -DTERMIO -O2 -Wall:::::BN_LLONG ${x86_gcc_opts}::",
+"netware-libc-bsdsock-gcc", "i586-netware-gcc:-nostdinc -I/ndk/libc/include -DNETWARE_BSDSOCK -DL_ENDIAN -DNETWARE_LIBC -DOPENSSL_SYSNAME_NETWARE -DTERMIO -O2 -Wall:::::BN_LLONG ${x86_gcc_opts}::",
 
 # DJGPP
 "DJGPP", "gcc:-I/dev/env/WATT_ROOT/inc -DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O2 -Wall:::MSDOS:-L/dev/env/WATT_ROOT/lib -lwatt:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:",
@@ -543,8 +517,9 @@
 ##### MacOS X (a.k.a. Rhapsody or Darwin) setup
 "rhapsody-ppc-cc","cc:-O3 -DB_ENDIAN::(unknown):MACOSX_RHAPSODY::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}::",
 "darwin-ppc-cc","cc:-arch ppc -O3 -DB_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::osx_ppc32.o::::::::::dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
-"darwin64-ppc-cc","cc:-arch ppc64 -O3 -DB_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:ppccpuid_osx64.o:osx_ppc64.o osx_ppc64-mont.o:::::sha1-ppc_osx64.o sha256-ppc_osx64.o sha512-ppc_osx64.o:::::::dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
-"darwin-i386-cc","cc:-arch i386 -O3 -fomit-frame-pointer -fno-common::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-arch i386 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+"darwin64-ppc-cc","cc:-arch ppc64 -O3 -DB_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::osx_ppc64.o::::::::::dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+"darwin-i386-cc","cc:-arch i386 -O3 -fomit-frame-pointer -DL_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-arch i386 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+"debug-darwin-i386-cc","cc:-arch i386 -g3 -DL_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-arch i386 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
 "darwin64-x86_64-cc","cc:-arch x86_64 -O3 -fomit-frame-pointer -DL_ENDIAN -DMD32_REG_T=int -Wall::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-arch x86_64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
 "debug-darwin-ppc-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DB_ENDIAN -g -Wall -O::-D_REENTRANT:MACOSX::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::osx_ppc32.o::::::::::dlfcn:darwin-shared:-fPIC -fno-common:-dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
 
@@ -574,7 +549,9 @@
 
 my @MK1MF_Builds=qw(VC-WIN64I VC-WIN64A
 		    VC-NT VC-CE VC-WIN32
-		    BC-32 OS2-EMX netware-clib netware-libc netware-libc-bsdsock);
+		    BC-32 OS2-EMX
+		    netware-clib netware-clib-bsdsock
+		    netware-libc netware-libc-bsdsock);
 
 my $idx = 0;
 my $idx_cc = $idx++;
@@ -607,12 +584,18 @@
 my $openssldir="";
 my $exe_ext="";
 my $install_prefix="";
+my $fipslibdir="/usr/local/ssl/fips-1.0/lib/";
+my $nofipscanistercheck=0;
+my $fipsdso=0;
+my $fipscanisterinternal="n";
+my $baseaddr="0xFB00000";
 my $no_threads=0;
 my $threads=0;
 my $no_shared=0; # but "no-shared" is default
 my $zlib=1;      # but "no-zlib" is default
 my $no_krb5=0;   # but "no-krb5" is implied unless "--with-krb5-..." is used
 my $no_rfc3779=1; # but "no-rfc3779" is default
+my $montasm=1;   # but "no-montasm" is default
 my $no_asm=0;
 my $no_dso=0;
 my $no_gmp=0;
@@ -629,10 +612,11 @@
 my $bf	="crypto/bf/bf_locl.h";
 my $bn_asm	="bn_asm.o";
 my $des_enc="des_enc.o fcrypt_b.o";
+my $fips_des_enc="fips_des_enc.o";
 my $aes_enc="aes_core.o aes_cbc.o";
 my $bf_enc	="bf_enc.o";
 my $cast_enc="c_enc.o";
-my $rc4_enc="rc4_enc.o";
+my $rc4_enc="rc4_enc.o rc4_skey.o";
 my $rc5_enc="rc5_enc.o";
 my $md5_obj="";
 my $sha1_obj="";
@@ -640,29 +624,40 @@
 my $processor="";
 my $default_ranlib;
 my $perl;
+my $fips=0;
 
 
 # All of the following is disabled by default (RC5 was enabled before 0.9.8):
 
-my %disabled = ( # "what"         => "comment"
+my %disabled = ( # "what"         => "comment" [or special keyword "experimental"]
                  "camellia"       => "default",
+                 "capieng"        => "default",
+                 "cms"            => "default",
                  "gmp"            => "default",
+                 "jpake"          => "experimental",
                  "mdc2"           => "default",
+                 "montasm"        => "default", # explicit option in 0.9.8 only (implicitly enabled in 0.9.9)
                  "rc5"            => "default",
                  "rfc3779"        => "default",
                  "seed"           => "default",
                  "shared"         => "default",
-                 "tlsext"         => "default",
                  "zlib"           => "default",
                  "zlib-dynamic"   => "default"
                );
-
-# Additional "no-..." options will be collected in %disabled.
-# To remove something from %disabled, use e.g. "enable-rc5".
-# For symmetry, "disable-..." is a synonym for "no-...".
-
-# This is what $depflags will look like with the above default:
-my $default_depflags = "-DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_GMP -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED -DOPENSSL_NO_TLSEXT ";
+my @experimental = ();
+
+# This is what $depflags will look like with the above defaults
+# (we need this to see if we should advise the user to run "make depend"):
+my $default_depflags = " -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_CAPIENG -DOPENSSL_NO_CMS -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED";
+
+
+# Explicit "no-..." options will be collected in %disabled along with the defaults.
+# To remove something from %disabled, use "enable-foo" (unless it's experimental).
+# For symmetry, "disable-foo" is a synonym for "no-foo".
+
+# For features called "experimental" here, a more explicit "experimental-foo" is needed to enable.
+# We will collect such requests in @experimental.
+# To avoid accidental use of experimental features, applications will have to use -DOPENSSL_EXPERIMENTAL_FOO.
 
 
 my $no_sse2=0;
@@ -671,6 +666,7 @@
 
 my $flags;
 my $depflags;
+my $openssl_experimental_defines;
 my $openssl_algorithm_defines;
 my $openssl_thread_defines;
 my $openssl_sys_defines="";
@@ -691,6 +687,7 @@
 	{
 	$flags="";
 	$depflags="";
+	$openssl_experimental_defines="";
 	$openssl_algorithm_defines="";
 	$openssl_thread_defines="";
 	$openssl_sys_defines="";
@@ -716,25 +713,35 @@
 
 		if (/^no-(.+)$/ || /^disable-(.+)$/)
 			{
-			if ($1 eq "ssl")
-				{
-				$disabled{"ssl2"} = "option(ssl)";
-				$disabled{"ssl3"} = "option(ssl)";
-				}
-			elsif ($1 eq "tls")
-				{
-				$disabled{"tls1"} = "option(tls)"
-				}
-			else
-				{
-				$disabled{$1} = "option";
+			if (!($disabled{$1} eq "experimental"))
+				{
+				if ($1 eq "ssl")
+					{
+					$disabled{"ssl2"} = "option(ssl)";
+					$disabled{"ssl3"} = "option(ssl)";
+					}
+				elsif ($1 eq "tls")
+					{
+					$disabled{"tls1"} = "option(tls)"
+					}
+				else
+					{
+					$disabled{$1} = "option";
+					}
 				}
 			}			
-		elsif (/^enable-(.+)$/)
+		elsif (/^enable-(.+)$/ || /^experimental-(.+)$/)
 			{
-			delete $disabled{$1};
+			my $algo = $1;
+			if ($disabled{$algo} eq "experimental")
+				{
+				die "You are requesting an experimental feature; please say 'experimental-$algo' if you are sure\n"
+					unless (/^experimental-/);
+				push @experimental, $algo;
+				}
+			delete $disabled{$algo};
 
-			$threads = 1 if ($1 eq "threads");
+			$threads = 1 if ($algo eq "threads");
 			}
 		elsif (/^--test-sanity$/)
 			{
@@ -765,12 +772,36 @@
 			}
 		elsif (/^386$/)
 			{ $processor=386; }
+		elsif (/^fips$/)
+			{
+			$fips=1;
+		        }
 		elsif (/^rsaref$/)
 			{
 			# No RSAref support any more since it's not needed.
 			# The check for the option is there so scripts aren't
 			# broken
 			}
+		elsif (/^nofipscanistercheck$/)
+			{
+			$fips = 1;
+			$nofipscanistercheck = 1;
+			}
+		elsif (/^fipscanisterbuild$/)
+			{
+			$fips = 1;
+			$nofipscanistercheck = 1;
+			$fipslibdir="";
+			$fipscanisterinternal="y";
+			}
+		elsif (/^fipsdso$/)
+			{
+			$fips = 1;
+			$nofipscanistercheck = 1;
+			$fipslibdir="";
+			$fipscanisterinternal="y";
+			$fipsdso = 1;
+			}
 		elsif (/^[-+]/)
 			{
 			if (/^-[lL](.*)$/)
@@ -805,6 +836,14 @@
 				{
 				$withargs{"zlib-include"}="-I$1";
 				}
+			elsif (/^--with-fipslibdir=(.*)$/)
+				{
+				$fipslibdir="$1/";
+				}
+			elsif (/^--with-baseaddr=(.*)$/)
+				{
+				$baseaddr="$1";
+				}
 			else
 				{
 				print STDERR $usage;
@@ -912,6 +951,54 @@
 
 &usage if (!defined($table{$target}));
 
+my @fields = split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
+my $cc = $fields[$idx_cc];
+# Allow environment CC to override compiler...
+if($ENV{CC}) {
+    $cc = $ENV{CC};
+}
+my $cflags = $fields[$idx_cflags];
+my $unistd = $fields[$idx_unistd];
+my $thread_cflag = $fields[$idx_thread_cflag];
+my $sys_id = $fields[$idx_sys_id];
+my $lflags = $fields[$idx_lflags];
+my $bn_ops = $fields[$idx_bn_ops];
+my $cpuid_obj = $fields[$idx_cpuid_obj];
+my $bn_obj = $fields[$idx_bn_obj];
+my $des_obj = $fields[$idx_des_obj];
+my $aes_obj = $fields[$idx_aes_obj];
+my $bf_obj = $fields[$idx_bf_obj];
+my $md5_obj = $fields[$idx_md5_obj];
+my $sha1_obj = $fields[$idx_sha1_obj];
+my $cast_obj = $fields[$idx_cast_obj];
+my $rc4_obj = $fields[$idx_rc4_obj];
+my $rmd160_obj = $fields[$idx_rmd160_obj];
+my $rc5_obj = $fields[$idx_rc5_obj];
+my $dso_scheme = $fields[$idx_dso_scheme];
+my $shared_target = $fields[$idx_shared_target];
+my $shared_cflag = $fields[$idx_shared_cflag];
+my $shared_ldflag = $fields[$idx_shared_ldflag];
+my $shared_extension = $fields[$idx_shared_extension];
+my $ranlib = $fields[$idx_ranlib];
+my $arflags = $fields[$idx_arflags];
+
+if ($fips)
+	{
+	delete $disabled{"shared"} if ($disabled{"shared"} eq "default");
+	$disabled{"asm"}="forced"
+		if ($target !~ "VC\-.*" &&
+		    "$cpuid_obj:$bn_obj:$aes_obj:$des_obj:$sha1_obj" eq "::::");
+	}
+
+foreach (sort @experimental)
+	{
+	my $ALGO;
+	($ALGO = $_) =~ tr/[a-z]/[A-Z]/;
+
+	# opensslconf.h will set OPENSSL_NO_... unless OPENSSL_EXPERIMENTAL_... is defined
+	$openssl_experimental_defines .= "#define OPENSSL_NO_$ALGO\n";
+	$cflags .= " -DOPENSSL_EXPERIMENTAL_$ALGO";
+	}
 
 foreach (sort (keys %disabled))
 	{
@@ -927,6 +1014,8 @@
 		{ $no_shared = 1; }
 	elsif (/^zlib$/)
 		{ $zlib = 0; }
+	elsif (/^montasm$/)
+		{ $montasm = 0; }
 	elsif (/^static-engine$/)
 		{ }
 	elsif (/^zlib-dynamic$/)
@@ -960,7 +1049,7 @@
 				push @skip, $algo;
 				print " (skip dir)";
 
-				$depflags .="-DOPENSSL_NO_$ALGO ";
+				$depflags .= " -DOPENSSL_NO_$ALGO";
 				}
 			}
 		}
@@ -968,14 +1057,26 @@
 	print "\n";
 	}
 
-
 my $IsMK1MF=scalar grep /^$target$/,@MK1MF_Builds;
 
 $IsMK1MF=1 if ($target eq "mingw" && $^O ne "cygwin" && !is_msys());
 
+$no_shared = 0 if ($fipsdso && !$IsMK1MF);
+
 $exe_ext=".exe" if ($target eq "Cygwin" || $target eq "DJGPP" || $target eq "mingw");
+$exe_ext=".nlm" if ($target =~ /netware/);
 $exe_ext=".pm"  if ($target =~ /vos/);
-$openssldir="/usr/local/ssl" if ($openssldir eq "" and $prefix eq "");
+if ($openssldir eq "" and $prefix eq "")
+	{
+	if ($fips)
+		{
+		$openssldir="/usr/local/ssl/fips";
+		}
+	else
+		{
+		$openssldir="/usr/local/ssl";
+		}
+	}
 $prefix=$openssldir if $prefix eq "";
 
 $default_ranlib= &which("ranlib") or $default_ranlib="true";
@@ -983,7 +1084,7 @@
   or $perl="perl";
 
 chop $openssldir if $openssldir =~ /\/$/;
-chop $prefix if $prefix =~ /\/$/;
+chop $prefix if $prefix =~ /.\/$/;
 
 $openssldir=$prefix . "/ssl" if $openssldir eq "";
 $openssldir=$prefix . "/" . $openssldir if $openssldir !~ /(^\/|^[a-zA-Z]:[\\\/])/;
@@ -991,33 +1092,6 @@
 
 print "IsMK1MF=$IsMK1MF\n";
 
-my @fields = split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
-my $cc = $fields[$idx_cc];
-my $cflags = $fields[$idx_cflags];
-my $unistd = $fields[$idx_unistd];
-my $thread_cflag = $fields[$idx_thread_cflag];
-my $sys_id = $fields[$idx_sys_id];
-my $lflags = $fields[$idx_lflags];
-my $bn_ops = $fields[$idx_bn_ops];
-my $cpuid_obj = $fields[$idx_cpuid_obj];
-my $bn_obj = $fields[$idx_bn_obj];
-my $des_obj = $fields[$idx_des_obj];
-my $aes_obj = $fields[$idx_aes_obj];
-my $bf_obj = $fields[$idx_bf_obj];
-my $md5_obj = $fields[$idx_md5_obj];
-my $sha1_obj = $fields[$idx_sha1_obj];
-my $cast_obj = $fields[$idx_cast_obj];
-my $rc4_obj = $fields[$idx_rc4_obj];
-my $rmd160_obj = $fields[$idx_rmd160_obj];
-my $rc5_obj = $fields[$idx_rc5_obj];
-my $dso_scheme = $fields[$idx_dso_scheme];
-my $shared_target = $fields[$idx_shared_target];
-my $shared_cflag = $fields[$idx_shared_cflag];
-my $shared_ldflag = $fields[$idx_shared_ldflag];
-my $shared_extension = $fields[$idx_shared_extension];
-my $ranlib = $fields[$idx_ranlib];
-my $arflags = $fields[$idx_arflags];
-
 # '%' in $lflags is used to split flags to "pre-" and post-flags
 my ($prelflags,$postlflags)=split('%',$lflags);
 if (defined($postlflags))	{ $lflags=$postlflags;  }
@@ -1151,6 +1225,16 @@
 	{
 	$cpuid_obj=$bn_obj=$des_obj=$aes_obj=$bf_obj=$cast_obj=$rc4_obj=$rc5_obj="";
 	$sha1_obj=$md5_obj=$rmd160_obj="";
+	$cflags=~s/\-D[BL]_ENDIAN//		if ($fips);
+	$thread_cflags=~s/\-D[BL]_ENDIAN//	if ($fips);
+	}
+if ($montasm)
+	{
+	$bn_obj =~ s/MAYBE-MO86-/mo86-/;
+	}
+else
+	{
+	$bn_obj =~ s/MAYBE-MO86-[a-z.]*//;
 	}
 
 if (!$no_shared)
@@ -1181,7 +1265,7 @@
 my $shared_mark = "";
 if ($shared_target eq "")
 	{
-	$no_shared_warn = 1 if !$no_shared;
+	$no_shared_warn = 1 if !$no_shared && !$fips;
 	$no_shared = 1;
 	}
 if (!$no_shared)
@@ -1271,6 +1355,13 @@
 $cflags.=" -DOPENSSL_BN_ASM_PART_WORDS" if ($bn_obj =~ /bn86/);
 $cflags.=" -DOPENSSL_IA32_SSE2" if (!$no_sse2 && $bn_obj =~ /bn86/);
 
+$cflags.=" -DOPENSSL_BN_ASM_MONT" if ($bn_obj =~ /\-mont|mo86\-/);
+
+if ($fips)
+	{
+	$openssl_other_defines.="#define OPENSSL_FIPS\n";
+	}
+
 $des_obj=$des_enc	unless ($des_obj =~ /\.o$/);
 $bf_obj=$bf_enc		unless ($bf_obj =~ /\.o$/);
 $cast_obj=$cast_enc	unless ($cast_obj =~ /\.o$/);
@@ -1343,8 +1434,6 @@
 	$shlib_minor=$2;
 	}
 
-$shared_ldflag .= " -Wl,--version-script=openssl.ld";
-
 open(IN,'<Makefile.org') || die "unable to read Makefile.org:$!\n";
 unlink("$Makefile.new") || die "unable to remove old $Makefile.new:$!\n" if -e "$Makefile.new";
 open(OUT,">$Makefile.new") || die "unable to create $Makefile.new:$!\n";
@@ -1357,10 +1446,13 @@
 	if ($sdirs) {
 		my $dir;
 		foreach $dir (@skip) {
-			s/([ 	])$dir /\1/;
+			s/(\s)$dir\s/$1/;
+			s/\s$dir$//;
 			}
 		}
 	$sdirs = 0 unless /\\$/;
+        s/fips // if (/^DIRS=/ && !$fips);
+        s/engines // if (/^DIRS=/ && $disabled{"engine"});
 	s/^VERSION=.*/VERSION=$version/;
 	s/^MAJOR=.*/MAJOR=$major/;
 	s/^MINOR=.*/MINOR=$minor/;
@@ -1378,7 +1470,7 @@
 	s/^CC=.*$/CC= $cc/;
 	s/^MAKEDEPPROG=.*$/MAKEDEPPROG= $cc/ if $cc eq "gcc";
 	s/^CFLAG=.*$/CFLAG= $cflags/;
-	s/^DEPFLAG=.*$/DEPFLAG= $depflags/;
+	s/^DEPFLAG=.*$/DEPFLAG=$depflags/;
 	s/^PEX_LIBS=.*$/PEX_LIBS= $prelflags/;
 	s/^EX_LIBS=.*$/EX_LIBS= $lflags/;
 	s/^EXE_EXT=.*$/EXE_EXT= $exe_ext/;
@@ -1401,9 +1493,24 @@
 	s/^LIBKRB5=.*/LIBKRB5=$withargs{"krb5-lib"}/;
 	s/^LIBZLIB=.*/LIBZLIB=$withargs{"zlib-lib"}/;
 	s/^ZLIB_INCLUDE=.*/ZLIB_INCLUDE=$withargs{"zlib-include"}/;
+	s/^FIPSLIBDIR=.*/FIPSLIBDIR=$fipslibdir/;
+	if ($fipsdso)
+		{
+		s/^FIPSCANLIB=.*/FIPSCANLIB=libfips/;
+		s/^SHARED_FIPS=.*/SHARED_FIPS=libfips\$(SHLIB_EXT)/;
+		s/^SHLIBDIRS=.*/SHLIBDIRS= crypto ssl fips/;
+		}
+	else
+		{
+		s/^FIPSCANLIB=.*/FIPSCANLIB=libcrypto/ if $fips;
+		s/^SHARED_FIPS=.*/SHARED_FIPS=/;
+		s/^SHLIBDIRS=.*/SHLIBDIRS= crypto ssl/;
+		}
+	s/^FIPSCANISTERINTERNAL=.*/FIPSCANISTERINTERNAL=$fipscanisterinternal/;
+	s/^BASEADDR=.*/BASEADDR=$baseaddr/;
 	s/^SHLIB_TARGET=.*/SHLIB_TARGET=$shared_target/;
 	s/^SHLIB_MARK=.*/SHLIB_MARK=$shared_mark/;
-	s/^SHARED_LIBS=.*/SHARED_LIBS=\$(SHARED_CRYPTO) \$(SHARED_SSL)/ if (!$no_shared);
+	s/^SHARED_LIBS=.*/SHARED_LIBS=\$(SHARED_FIPS) \$(SHARED_CRYPTO) \$(SHARED_SSL)/ if (!$no_shared);
 	if ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*$/)
 		{
 		my $sotmp = $1;
@@ -1416,8 +1523,7 @@
 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
 		{
 		my $sotmp = $1;
-#		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
-		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp/;
+		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
 		}
 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
 		{
@@ -1508,6 +1614,7 @@
 
 print OUT "/* OpenSSL was configured with the following options: */\n";
 my $openssl_algorithm_defines_trans = $openssl_algorithm_defines;
+$openssl_experimental_defines =~ s/^\s*#\s*define\s+OPENSSL_NO_(.*)/#ifndef OPENSSL_EXPERIMENTAL_$1\n# ifndef OPENSSL_NO_$1\n#  define OPENSSL_NO_$1\n# endif\n#endif/mg;
 $openssl_algorithm_defines_trans =~ s/^\s*#\s*define\s+OPENSSL_(.*)/# if defined(OPENSSL_$1) \&\& !defined($1)\n#  define $1\n# endif/mg;
 $openssl_algorithm_defines =~ s/^\s*#\s*define\s+(.*)/#ifndef $1\n# define $1\n#endif/mg;
 $openssl_algorithm_defines = "   /* no ciphers excluded */\n" if $openssl_algorithm_defines eq "";
@@ -1516,8 +1623,10 @@
 $openssl_other_defines =~ s/^\s*#\s*define\s+(.*)/#ifndef $1\n# define $1\n#endif/mg;
 print OUT $openssl_sys_defines;
 print OUT "#ifndef OPENSSL_DOING_MAKEDEPEND\n\n";
+print OUT $openssl_experimental_defines;
+print OUT "\n";
 print OUT $openssl_algorithm_defines;
-print OUT "\n#endif /* OPENSSL_DOING_MAKEDEPEND */\n";
+print OUT "\n#endif /* OPENSSL_DOING_MAKEDEPEND */\n\n";
 print OUT $openssl_thread_defines;
 print OUT $openssl_other_defines,"\n";
 
@@ -1536,7 +1645,7 @@
 	if	(/^#define\s+OPENSSLDIR/)
 		{ print OUT "#define OPENSSLDIR \"$openssldir\"\n"; }
 	elsif	(/^#define\s+ENGINESDIR/)
-		{ print OUT "#define ENGINESDIR \"$prefix/lib/ssl/engines\"\n"; }
+		{ print OUT "#define ENGINESDIR \"$prefix/lib/engines\"\n"; }
 	elsif	(/^#((define)|(undef))\s+OPENSSL_EXPORT_VAR_AS_FUNCTION/)
 		{ printf OUT "#undef OPENSSL_EXPORT_VAR_AS_FUNCTION\n"
 			if $export_var_as_fn;
@@ -1668,7 +1777,7 @@
 }
 
 # create the ms/version32.rc file if needed
-if ($IsMK1MF) {
+if ($IsMK1MF && ($target !~ /^netware/)) {
 	my ($v1, $v2, $v3, $v4);
 	if ($version_num =~ /(^[0-9a-f]{1})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})/i) {
 		$v1=hex $1;
@@ -1699,9 +1808,16 @@
     BEGIN
 	BLOCK "040904b0"
 	BEGIN
+#if defined(FIPS)
+	    VALUE "Comments", "WARNING: TEST VERSION ONLY ***NOT*** FIPS 140-2 VALIDATED.\\0"
+#endif
 	    // Required:	    
 	    VALUE "CompanyName", "The OpenSSL Project, http://www.openssl.org/\\0"
+#if defined(FIPS)
+	    VALUE "FileDescription", "TEST UNVALIDATED FIPS140-2 DLL\\0"
+#else
 	    VALUE "FileDescription", "OpenSSL Shared Library\\0"
+#endif
 	    VALUE "FileVersion", "$version\\0"
 #if defined(CRYPTO)
 	    VALUE "InternalName", "libeay32\\0"
@@ -1709,12 +1825,15 @@
 #elif defined(SSL)
 	    VALUE "InternalName", "ssleay32\\0"
 	    VALUE "OriginalFilename", "ssleay32.dll\\0"
+#elif defined(FIPS)
+	    VALUE "InternalName", "libosslfips\\0"
+	    VALUE "OriginalFilename", "libosslfips.dll\\0"
 #endif
 	    VALUE "ProductName", "The OpenSSL Toolkit\\0"
 	    VALUE "ProductVersion", "$version\\0"
 	    // Optional:
 	    //VALUE "Comments", "\\0"
-	    VALUE "LegalCopyright", "Copyright © 1998-2005 The OpenSSL Project. Copyright © 1995-1998 Eric A. Young, Tim J. Hudson. All rights reserved.\\0"
+	    VALUE "LegalCopyright", "Copyright © 1998-2007 The OpenSSL Project. Copyright © 1995-1998 Eric A. Young, Tim J. Hudson. All rights reserved.\\0"
 	    //VALUE "LegalTrademarks", "\\0"
 	    //VALUE "PrivateBuild", "\\0"
 	    //VALUE "SpecialBuild", "\\0"
@@ -1751,6 +1870,21 @@
 (but please first make sure you have tried with a current version of OpenSSL).
 EOF
 
+print <<\EOF if ($fipscanisterinternal eq "y");
+
+WARNING: OpenSSL has been configured using unsupported option(s) to internally
+generate a fipscanister.o object module for TESTING PURPOSES ONLY; that
+compiled module is NOT FIPS 140-2 validated and CANNOT be used to replace the
+OpenSSL FIPS Object Module as identified by the CMVP
+(http://csrc.nist.gov/cryptval/) in any application requiring the use of FIPS
+140-2 validated software. 
+
+This is an OpenSSL 0.9.8 test version.
+
+See the file README.FIPS for details of how to build a test library.
+
+EOF
+
 exit(0);
 
 sub usage
 
=== modified file 'FAQ'
--- FAQ	2007-12-05 00:13:39 +0000
+++ FAQ	2009-12-07 19:46:11 +0000
@@ -32,6 +32,8 @@
 * How do I install a CA certificate into a browser?
 * Why is OpenSSL x509 DN output not conformant to RFC2253?
 * What is a "128 bit certificate"? Can I create one with OpenSSL?
+* Why does OpenSSL set the authority key identifier extension incorrectly?
+* How can I set up a bundle of commercial root CA certificates?
 
 [BUILD] Questions about building and testing OpenSSL
 
@@ -67,6 +69,7 @@
 * Why does compilation fail due to an undefined symbol NID_uniqueIdentifier?
 * I think I've detected a memory leak, is this a bug?
 * Why does Valgrind complain about the use of uninitialized data?
+* Why doesn't a memory BIO work when a file does?
 
 ===============================================================================
 
@@ -75,7 +78,7 @@
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.
-OpenSSL 0.9.8g was released on October 19th, 2007.
+OpenSSL 0.9.8k was released on Mar 25th, 2009.
 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:
@@ -402,10 +405,10 @@
 need to any more. Nowadays web browsers using unrestricted strong encryption
 are generally available.
 
-When there were tight export restrictions on the export of strong encryption
+When there were tight restrictions on the export of strong encryption
 software from the US only weak encryption algorithms could be freely exported
 (initially 40 bit and then 56 bit). It was widely recognised that this was
-inadequate. A relaxation the rules allowed the use of strong encryption but
+inadequate. A relaxation of the rules allowed the use of strong encryption but
 only to an authorised server.
 
 Two slighly different techniques were developed to support this, one used by
@@ -426,6 +429,39 @@
 encryption so these certificates are now obsolete.
 
 
+* Why does OpenSSL set the authority key identifier (AKID) extension incorrectly?
+
+It doesn't: this extension is often the cause of confusion.
+
+Consider a certificate chain A->B->C so that A signs B and B signs C. Suppose
+certificate C contains AKID.
+
+The purpose of this extension is to identify the authority certificate B. This
+can be done either by including the subject key identifier of B or its issuer
+name and serial number.
+
+In this latter case because it is identifying certifcate B it must contain the
+issuer name and serial number of B.
+
+It is often wrongly assumed that it should contain the subject name of B. If it
+did this would be redundant information because it would duplicate the issuer
+name of C.
+
+
+* How can I set up a bundle of commercial root CA certificates?
+
+The OpenSSL software is shipped without any root CA certificate as the
+OpenSSL project does not have any policy on including or excluding
+any specific CA and does not intend to set up such a policy. Deciding
+about which CAs to support is up to application developers or
+administrators.
+
+Other projects do have other policies so you can for example extract the CA
+bundle used by Mozilla and/or modssl as described in this article:
+
+  http://www.mail-archive.com/[e-mail]/msg16980.html
+
+
 [BUILD] =======================================================================
 
 * Why does the linker complain about undefined symbols?
@@ -823,11 +859,11 @@
 
 * Why do I get errors about unknown algorithms?
 
-This can happen under several circumstances such as reading in an
-encrypted private key or attempting to decrypt a PKCS#12 file. The cause
-is forgetting to load OpenSSL's table of algorithms with
-OpenSSL_add_all_algorithms(). See the manual page for more information.
-
+The cause is forgetting to load OpenSSL's table of algorithms with
+OpenSSL_add_all_algorithms(). See the manual page for more information. This
+can cause several problems such as being unable to read in an encrypted
+PEM file, unable to decrypt a PKCS#12 file or signature failure when
+verifying certificates.
 
 * Why can't the OpenSSH configure script detect OpenSSL?
 
@@ -905,5 +941,25 @@
 to get rid of these warnings.
 
 
+* Why doesn't a memory BIO work when a file does?
+
+This can occur in several cases for example reading an S/MIME email message.
+The reason is that a memory BIO can do one of two things when all the data
+has been read from it.
+
+The default behaviour is to indicate that no more data is available and that
+the call should be retried, this is to allow the application to fill up the BIO
+again if necessary.
+
+Alternatively it can indicate that no more data is available and that EOF has
+been reached.
+
+If a memory BIO is to behave in the same way as a file this second behaviour
+is needed. This must be done by calling:
+
+   BIO_set_mem_eof_return(bio, 0);
+
+See the manual pages for more details.
+
+
 ===============================================================================
-
 
=== modified file 'INSTALL'
--- INSTALL	2007-03-10 17:11:46 +0000
+++ INSTALL	2009-12-07 19:46:11 +0000
@@ -158,7 +158,7 @@
      standard headers).  If it is a problem with OpenSSL itself, please
      report the problem to <[e-mail]> (note that your
      message will be recorded in the request tracker publicly readable
-     via http://www.openssl.org/support/rt2.html and will be forwarded to a
+     via http://www.openssl.org/support/rt.html and will be forwarded to a
      public mailing list). Include the output of "make report" in your message.
      Please check out the request tracker. Maybe the bug was already
      reported or has already been fixed.
@@ -180,7 +180,7 @@
      in Makefile.ssl and run "make clean; make". Please send a bug
      report to <[e-mail]>, including the output of
      "make report" in order to be added to the request tracker at
-     http://www.openssl.org/support/rt2.html.
+     http://www.openssl.org/support/rt.html.
 
   4. If everything tests ok, install OpenSSL with
 
 
=== modified file 'INSTALL.NW'
--- INSTALL.NW	2005-12-13 21:37:42 +0000
+++ INSTALL.NW	2009-12-07 19:46:11 +0000
@@ -8,58 +8,62 @@
 BUILD PLATFORM:
 ---------------
 The build scripts (batch files, perl scripts, etc) have been developed and
-tested on W2K.  The scripts should run fine on other Windows
-platforms (NT, Win9x, WinXP) but they haven't been tested.  They may require 
-some modifications.
+tested on W2K.  The scripts should run fine on other Windows platforms
+(NT, Win9x, WinXP) but they have not been tested.  They may require some
+modifications.
 
 
 Supported NetWare Platforms - NetWare 5.x, NetWare 6.x:
-------------------------------------------
-OpenSSL uses the WinSock interfaces introduced in NetWare 5.  Therefore,
-previous versions of NetWare, 4.x and 3.x, are not supported.
+-------------------------------------------------------
+OpenSSL can either use the WinSock interfaces introduced in NetWare 5,
+or the BSD socket interface.  Previous versions of NetWare, 4.x and 3.x,
+are only supported if OpenSSL is build for CLIB and BSD sockets;
+WinSock builds only support NetWare 5 and up.
 
 On NetWare there are two c-runtime libraries.  There is the legacy CLIB 
-interfaces and the newer LibC interfaces.  Being ANSI-C libraries, the 
-functionality in CLIB and LibC is similar but the LibC interfaces are built 
+interfaces and the newer LIBC interfaces.  Being ANSI-C libraries, the 
+functionality in CLIB and LIBC is similar but the LIBC interfaces are built 
 using Novell Kernal Services (NKS) which is designed to leverage 
 multi-processor environments.
 
-The NetWare port of OpenSSL can configured to build using CLIB or LibC.  The 
-CLIB build was developed and tested using NetWare 5.0 sp6.0a.  The LibC 
+The NetWare port of OpenSSL can be configured to build using CLIB or LIBC.
+The CLIB build was developed and tested using NetWare 5.0 sp6.0a.  The LIBC 
 build was developed and tested using the NetWare 6.0 FCS.  
 
-The necessary LibC functionality ships with NetWare 6.  However, earlier 
-NetWare 5.x versions will require updates in order to run the OpenSSL LibC
-build.
+The necessary LIBC functionality ships with NetWare 6.  However, earlier 
+NetWare 5.x versions will require updates in order to run the OpenSSL LIBC
+build (NetWare 5.1 SP8 is known to work).
 
-As of June 2005, the LibC build can be configured to use BSD sockets instead
+As of June 2005, the LIBC build can be configured to use BSD sockets instead
 of WinSock sockets. Call Configure (usually through netware\build.bat) using
 a target of "netware-libc-bsdsock" instead of "netware-libc".
 
+As of June 2007, support for CLIB and BSD sockets is also now available
+using a target of "netware-clib-bsdsock" instead of "netware-clib";
+also gcc builds are now supported on both Linux and Win32 (post 0.9.8e).
 
 REQUIRED TOOLS:
 ---------------
 Based upon the configuration and build options used, some or all of the
 following tools may be required:
 
-
 * Perl for Win32 - required (http://www.activestate.com/ActivePerl)
    Used to run the various perl scripts on the build platform.
 
-
 * Perl 5.8.0 for NetWare v3.20 (or later) - required 
    (http://developer.novell.com) Used to run the test script on NetWare 
    after building.
 
-
-* Metrowerks CodeWarrior PDK 2.1 (or later) for NetWare - required:
-   Provides command line tools used for building.
-
-   Tools:
-   mwccnlm.exe  - C/C++ Compiler for NetWare
-   mwldnlm.exe  - Linker for NetWare
-   mwasmnlm.exe - x86 assembler for NetWare (if using assembly option)
-
+* Compiler / Linker - required:
+   Metrowerks CodeWarrior PDK 2.1 (or later) for NetWare (commercial):
+      Provides command line tools used for building.
+      Tools:
+      mwccnlm.exe  - C/C++ Compiler for NetWare
+      mwldnlm.exe  - Linker for NetWare
+      mwasmnlm.exe - x86 assembler for NetWare (if using assembly option)
+
+   gcc / nlmconv Cross-Compiler, available from Novell Forge (free):
+         http://forge.novell.com/modules/xfmod/project/?aunixnw
 
 * Assemblers - optional:
    If you intend to build using the assembly options you will need an
@@ -79,11 +83,11 @@
    In order to build you will need a make tool.  Two make tools are
    supported, GNU make (gmake.exe) or Microsoft nmake.exe.
 
-   gmake.exe - GNU make for Windows (version 3.75 used for development)
-         http://www.gnu.org/software/make/make.html
+   make.exe - GNU make for Windows (version 3.75 used for development)
+         http://gnuwin32.sourceforge.net/packages/make.htm
 
    nmake.exe - Microsoft make (Version 6.00.8168.0 used for development)
-
+         http://support.microsoft.com/kb/132084/EN-US/
 
 * Novell Developer Kit (NDK) - required: (http://developer.novell.com)
 
@@ -123,14 +127,14 @@
 
    LIBC - BUILDS:
    
-      Libraries for C (LibC) - LibC headers and import files
-         If you are going to build a LibC version of OpenSSL, you will
-         need the LibC headers and imports.  The March 14, 2002 NDK release or
+      Libraries for C (LIBC) - LIBC headers and import files
+         If you are going to build a LIBC version of OpenSSL, you will
+         need the LIBC headers and imports.  The March 14, 2002 NDK release or
          later is required.  
          
-         NOTE: The LibC SDK includes the necessary WinSock2 support.  It
-         It is not necessary to download the WinSock2 Developer when building
-         for LibC. The LibC SDK also includes the appropriate BSD socket support
+         NOTE: The LIBC SDK includes the necessary WinSock2 support.
+         It is not necessary to download the WinSock2 NDK when building for
+         LIBC. The LIBC SDK also includes the appropriate BSD socket support
          if configuring to use BSD sockets.
 
 
@@ -143,33 +147,36 @@
 and environment variables you will need to build.  Modify the
 various lines to point to YOUR tools and run set_env.bat.
 
-   netware\set_env.bat [target]
-
-      target        - "netware-clib" - CLib NetWare build
-                    - "netware-libc" - LibC NetWare build
+   netware\set_env.bat <target> [compiler]
+
+      target        - "netware-clib" - CLIB NetWare build
+                    - "netware-libc" - LIBC NetWare build
+
+      compiler      - "gnuc"         - GNU GCC Compiler
+                    - "codewarrior"  - MetroWerks CodeWarrior (default)
 
 If you don't use set_env.bat, you will need to set up the following
 environment variables:
 
-   path - Set path to point to the tools you will use.
+   PATH - Set PATH to point to the tools you will use.
 
-   MWCIncludes - The location of the NDK include files.
+   INCLUDE - The location of the NDK include files.
          
-            CLIB ex: set MWCIncludes=c:\ndk\nwsdk\include\nlm
-            LibC ex: set MWCIncludes=c:\ndk\libc\include
+            CLIB ex: set INCLUDE=c:\ndk\nwsdk\include\nlm
+            LIBC ex: set INCLUDE=c:\ndk\libc\include
 
    PRELUDE - The absolute path of the prelude object to link with.  For
             a CLIB build it is recommended you use the "clibpre.o" files shipped
-            with the Metrowerks PDK for NetWare.  For a LibC build you should 
-            use the "libcpre.o" file delivered with the LibC NDK components.
+            with the Metrowerks PDK for NetWare.  For a LIBC build you should 
+            use the "libcpre.o" file delivered with the LIBC NDK components.
 
             CLIB ex: set PRELUDE=c:\ndk\nwsdk\imports\clibpre.o
-            LibC ex: set PRELUDE=c:\ndk\libc\imports\libcpre.o
+            LIBC ex: set PRELUDE=c:\ndk\libc\imports\libcpre.o
 
    IMPORTS - The locaton of the NDK import files.
 
             CLIB ex: set IMPORTS=c:\ndk\nwsdk\imports
-            LibC ex: set IMPORTS=c:\ndk\libc\imports
+            LIBC ex: set IMPORTS=c:\ndk\libc\imports
 
 
 In order to build, you need to run the Perl scripts to configure the build
@@ -182,9 +189,10 @@
 
    netware\build [target] [debug opts] [assembly opts] [configure opts]
 
-      target        - "netware-clib" - CLib NetWare build (WinSock Sockets)
-                    - "netware-libc" - LibC NetWare build (WinSock Sockets)
-                    - "netware-libc-bsdsock" - LibC NetWare build (BSD Sockets)
+      target        - "netware-clib" - CLIB NetWare build (WinSock Sockets)
+                    - "netware-clib-bsdsock" - CLIB NetWare build (BSD Sockets)
+                    - "netware-libc" - LIBC NetWare build (WinSock Sockets)
+                    - "netware-libc-bsdsock" - LIBC NetWare build (BSD Sockets)
  
       debug opts    - "debug"  - build debug
 
@@ -193,25 +201,27 @@
                       "no-asm"   - don't use assembly
 
       configure opts- all unrecognized arguments are passed to the
-                      perl configure script
+                      perl 'configure' script. See that script for
+                      internal documentation regarding options that
+                      are available.
 
    examples:
 
       CLIB build, debug, without assembly:
          netware\build.bat netware-clib debug no-asm
 
-      LibC build, non-debug, using NASM assembly:
-         netware\build.bat netware-libc nw-nasm
+      LIBC build, non-debug, using NASM assembly, add mdc2 support:
+         netware\build.bat netware-libc nw-nasm enable-mdc2
 
-      LibC build, BSD sockets, non-debug, without assembly:
+      LIBC build, BSD sockets, non-debug, without assembly:
          netware\build.bat netware-libc-bsdsock no-asm
 
 Running build.bat generates a make file to be processed by your make 
 tool (gmake or nmake):
 
    CLIB ex: gmake -f netware\nlm_clib_dbg.mak 
-   LibC ex: gmake -f netware\nlm_libc.mak 
-   LibC ex: gmake -f netware\nlm_libc_bsdsock.mak 
+   LIBC ex: gmake -f netware\nlm_libc.mak 
+   LIBC ex: gmake -f netware\nlm_libc_bsdsock.mak 
 
 
 You can also run the build scripts manually if you do not want to use the
@@ -220,7 +230,7 @@
 
    perl configure no-asm [other config opts] [netware-clib|netware-libc|netware-libc-bsdsock]
       configures no assembly build for specified netware environment
-      (CLIB or LibC).
+      (CLIB or LIBC).
 
    perl util\mkfiles.pl >MINFO
       generates a listing of source files (used by mk1mf)
@@ -250,12 +260,12 @@
       tmp_nw_clib         - temporary build files
       outinc_nw_clib      - necesary include files
 
-   LibC Debug build:
+   LIBC Debug build:
       out_nw_libc.dbg     - static libs & test nlm(s)
       tmp_nw_libc.dbg     - temporary build files
       outinc_nw_libc      - necessary include files
 
-   LibC Non-debug build:
+   LIBC Non-debug build:
       out_nw_libc         - static libs & test nlm(s)
       tmp_nw_libc         - temporary build files
       outinc_nw_libc      - necesary include files
@@ -281,7 +291,7 @@
       NetWare drive    - drive letter of mapped drive
 
       CLIB ex: netware\cpy_tests out_nw_clib m:
-      LibC ex: netware\cpy_tests out_nw_libc m:
+      LIBC ex: netware\cpy_tests out_nw_libc m:
 
 
 The Perl script, "do_tests.pl", in the "OpenSSL" directory on the server
@@ -356,9 +366,9 @@
 
 Multi-threaded Development
 ---------------------------
-The NetWare version of OpenSSL is thread-safe however, multi-threaded
+The NetWare version of OpenSSL is thread-safe, however multi-threaded
 applications must provide the necessary locking function callbacks.  This
-is described in doc\threads.doc.  The file "openssl\crypto\threads\mttest.c"
+is described in doc\threads.doc.  The file "openssl-x.x.x\crypto\threads\mttest.c"
 is a multi-threaded test program and demonstrates the locking functions.
 
 
@@ -428,7 +438,7 @@
 ------------------
 The generated makefile has a "vclean" target which cleans up the build
 directories.  If you have been building successfully and suddenly
-experience problems, use "vclean" (gmake -f netware\nlm.mak vclean) and retry.
+experience problems, use "vclean" (gmake -f netware\nlm_xxxx.mak vclean) and retry.
 
 
 "Undefined Symbol" Linker errors
 
=== modified file 'LICENSE'
--- LICENSE	2007-03-10 17:11:46 +0000
+++ LICENSE	2009-12-07 19:46:11 +0000
@@ -12,7 +12,7 @@
   ---------------
 
 /* ====================================================================
- * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2008 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
 
=== modified file 'MacOS/GetHTTPS.src/ErrorHandling.hpp'
--- MacOS/GetHTTPS.src/ErrorHandling.hpp	2004-05-24 17:02:29 +0000
+++ MacOS/GetHTTPS.src/ErrorHandling.hpp	2009-12-07 19:46:11 +0000
@@ -29,7 +29,7 @@
 
 
 
-//	A bunch of evil macros that would be uneccessary if I were always using C++ !
+//	A bunch of evil macros that would be unnecessary if I were always using C++ !
 
 #define SetErrorMessageAndBailIfNil(theArg,theMessage)								\
 {																					\
 
=== modified file 'Makefile'
--- Makefile	2009-03-27 08:23:35 +0000
+++ Makefile	2009-12-07 19:46:11 +0000
@@ -4,7 +4,7 @@
 ## Makefile for OpenSSL
 ##
 
-VERSION=0.9.8g
+VERSION=0.9.8k
 MAJOR=0
 MINOR=9.8
 SHLIB_VERSION_NUMBER=0.9.8
@@ -13,8 +13,8 @@
 SHLIB_MINOR=9.8
 SHLIB_EXT=.so.$(SHLIB_MAJOR).$(SHLIB_MINOR)
 PLATFORM=debian-amd64
-OPTIONS=--prefix=/usr --openssldir=/usr/lib/ssl enable-zlib enable-tlsext no-camellia no-gmp no-idea no-krb5 no-mdc2 no-rc5 no-rfc3779 no-seed no-shared no-sslv2 no-zlib-dynamic
-CONFIGURE_ARGS=--prefix=/usr --openssldir=/usr/lib/ssl no-idea no-mdc2 no-rc5 zlib enable-tlsext no-sslv2 debian-amd64
+OPTIONS=--prefix=/usr --openssldir=/usr/lib/ssl enable-zlib enable-tlsext no-camellia no-capieng no-cms no-gmp no-idea no-jpake no-krb5 no-mdc2 no-montasm no-rc5 no-rfc3779 no-seed no-shared no-zlib-dynamic
+CONFIGURE_ARGS=--prefix=/usr --openssldir=/usr/lib/ssl no-idea no-mdc2 no-rc5 zlib enable-tlsext debian-amd64
 SHLIB_TARGET=linux-shared
 
 # HERE indicates where this Makefile lives.  This can be used to indicate
@@ -60,13 +60,14 @@
 # PKCS1_CHECK - pkcs1 tests.
 
 CC= gcc
-CFLAG= -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall -DMD32_REG_T=int -DMD5_ASM
-DEPFLAG= -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_GMP -DOPENSSL_NO_IDEA -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED -DOPENSSL_NO_SSLV2 
+CFLAG= -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall -DMD32_REG_T=int -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM
+DEPFLAG= -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_CAPIENG -DOPENSSL_NO_CMS -DOPENSSL_NO_GMP -DOPENSSL_NO_IDEA -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED
 PEX_LIBS= 
-EX_LIBS= -ldl -Wl,-Bsymbolic-functions -lz
+EX_LIBS= -ldl -lz
 EXE_EXT= 
 ARFLAGS= 
 AR=ar $(ARFLAGS) r
+ARD=ar $(ARFLAGS) d
 RANLIB= /usr/bin/ranlib
 PERL= /usr/bin/perl
 TAR= tar
@@ -87,15 +88,15 @@
 
 # CPUID module collects small commonly used assembler snippets
 CPUID_OBJ= x86_64cpuid.o
-BN_ASM= x86_64-gcc.o
+BN_ASM= x86_64-gcc.o x86_64-mont.o
 DES_ENC= des_enc.o fcrypt_b.o
-AES_ASM_OBJ= aes_core.o aes_cbc.o
+AES_ASM_OBJ= aes-x86_64.o
 BF_ENC= bf_enc.o
 CAST_ENC= c_enc.o
-RC4_ENC= rc4_enc.o
+RC4_ENC= rc4_enc.o rc4_skey.o
 RC5_ENC= rc5_enc.o
 MD5_ASM_OBJ= md5-x86_64.o
-SHA1_ASM_OBJ= 
+SHA1_ASM_OBJ= sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o
 RMD160_ASM_OBJ= 
 
 # KRB5 stuff
@@ -106,6 +107,32 @@
 ZLIB_INCLUDE=
 LIBZLIB=
 
+# This is the location of fipscanister.o and friends.
+# The FIPS module build will place it $(INSTALLTOP)/lib
+# but since $(INSTALLTOP) can only take the default value
+# when the module is built it will be in /usr/local/ssl/lib
+# $(INSTALLTOP) for this build make be different so hard
+# code the path.
+
+FIPSLIBDIR=/usr/local/ssl/fips-1.0/lib/
+
+# This is set to "y" if fipscanister.o is compiled internally as
+# opposed to coming from an external validated location.
+
+FIPSCANISTERINTERNAL=n
+
+# The location of the library which contains fipscanister.o
+# normally it will be libcrypto unless fipsdso is set in which
+# case it will be libfips. If not compiling in FIPS mode at all
+# this is empty making it a useful test for a FIPS compile.
+
+FIPSCANLIB=
+
+# Shared library base address. Currently only used on Windows.
+#
+
+BASEADDR=0xFB00000
+
 DIRS=   crypto ssl engines apps tools
 SHLIBDIRS= crypto ssl
 
@@ -141,6 +168,7 @@
 LIBS=   libcrypto.a libssl.a
 SHARED_CRYPTO=libcrypto$(SHLIB_EXT)
 SHARED_SSL=libssl$(SHLIB_EXT)
+SHARED_FIPS=
 SHARED_LIBS=
 SHARED_LIBS_LINK_EXTS=.so
 SHARED_LDFLAGS=-m64 -Wl,--version-script=openssl.ld
@@ -194,6 +222,10 @@
 		SHA1_ASM_OBJ='${SHA1_ASM_OBJ}'			\
 		MD5_ASM_OBJ='${MD5_ASM_OBJ}'			\
 		RMD160_ASM_OBJ='${RMD160_ASM_OBJ}'		\
+		FIPSLIBDIR='${FIPSLIBDIR}'			\
+		FIPSCANLIB="$${FIPSCANLIB:-$(FIPSCANLIB)}"	\
+		FIPSCANISTERINTERNAL='${FIPSCANISTERINTERNAL}'	\
+		FIPS_EX_OBJ='${FIPS_EX_OBJ}'	\
 		THIS=$${THIS:-$@} MAKEFILE=Makefile MAKEOVERRIDES=
 # MAKEOVERRIDES= effectively "equalizes" GNU-ish and SysV-ish make flavors,
 # which in turn eliminates ambiguities in variable treatment with -e.
@@ -212,7 +244,8 @@
 # subdirectories defined in $(DIRS).  It requires that the target
 # is given through the shell variable `target'.
 BUILD_CMD=  if [ -d "$$dir" ]; then \
-	    (	cd $$dir && echo "making $$target in $$dir..." && \
+	    (	[ $$target != all -a -z "$(FIPSCANLIB)" ] && FIPSCANLIB=/dev/null; \
+		cd $$dir && echo "making $$target in $$dir..." && \
 		$(CLEARENV) && $(MAKE) -e $(BUILDENV) TOP=.. DIR=$$dir $$target \
 	    ) || exit 1; \
 	    fi
@@ -225,13 +258,84 @@
 reflect:
 	@[ -n "$(THIS)" ] && $(CLEARENV) && $(MAKE) $(THIS) -e $(BUILDENV)
 
+FIPS_EX_OBJ= ../crypto/aes/aes_cfb.o \
+	../crypto/aes/aes_ecb.o \
+	../crypto/aes/aes_ofb.o \
+	../crypto/bn/bn_add.o \
+	../crypto/bn/bn_blind.o \
+	../crypto/bn/bn_ctx.o \
+	../crypto/bn/bn_div.o \
+	../crypto/bn/bn_exp2.o \
+	../crypto/bn/bn_exp.o \
+	../crypto/bn/bn_gcd.o \
+	../crypto/bn/bn_lib.o \
+	../crypto/bn/bn_mod.o \
+	../crypto/bn/bn_mont.o \
+	../crypto/bn/bn_mul.o \
+	../crypto/bn/bn_prime.o \
+	../crypto/bn/bn_rand.o \
+	../crypto/bn/bn_recp.o \
+	../crypto/bn/bn_shift.o \
+	../crypto/bn/bn_sqr.o \
+	../crypto/bn/bn_word.o \
+	../crypto/bn/bn_x931p.o \
+	../crypto/buffer/buf_str.o \
+	../crypto/cryptlib.o \
+	../crypto/des/cfb64ede.o \
+	../crypto/des/cfb64enc.o \
+	../crypto/des/cfb_enc.o \
+	../crypto/des/ecb3_enc.o \
+	../crypto/des/ecb_enc.o \
+	../crypto/des/ofb64ede.o \
+	../crypto/des/ofb64enc.o \
+	../crypto/des/fcrypt.o \
+	../crypto/des/set_key.o \
+	../crypto/dsa/dsa_utl.o \
+	../crypto/dsa/dsa_sign.o \
+	../crypto/dsa/dsa_vrf.o \
+	../crypto/err/err.o \
+	../crypto/evp/digest.o \
+	../crypto/evp/enc_min.o \
+	../crypto/evp/e_aes.o \
+	../crypto/evp/e_des3.o \
+	../crypto/evp/p_sign.o \
+	../crypto/evp/p_verify.o \
+	../crypto/mem_clr.o \
+	../crypto/mem.o \
+	../crypto/rand/md_rand.o \
+	../crypto/rand/rand_egd.o \
+	../crypto/rand/randfile.o \
+	../crypto/rand/rand_lib.o \
+	../crypto/rand/rand_os2.o \
+	../crypto/rand/rand_unix.o \
+	../crypto/rand/rand_win.o \
+	../crypto/rsa/rsa_lib.o \
+	../crypto/rsa/rsa_none.o \
+	../crypto/rsa/rsa_oaep.o \
+	../crypto/rsa/rsa_pk1.o \
+	../crypto/rsa/rsa_pss.o \
+	../crypto/rsa/rsa_ssl.o \
+	../crypto/rsa/rsa_x931.o \
+	../crypto/sha/sha1dgst.o \
+	../crypto/sha/sha256.o \
+	../crypto/sha/sha512.o \
+	../crypto/uid.o
+
 sub_all: build_all
 build_all: build_libs build_apps build_tests build_tools
 
-build_libs: build_crypto build_ssl build_engines
+build_libs: build_crypto build_fips build_ssl build_shared build_engines
 
 build_crypto:
-	@dir=crypto; target=all; $(BUILD_ONE_CMD)
+	if [ -n "$(FIPSCANLIB)" ]; then \
+		EXCL_OBJ='$(AES_ASM_OBJ) $(BN_ASM) $(DES_ENC) $(CPUID_OBJ) $(SHA1_ASM_OBJ) $(FIPS_EX_OBJ)' ; export EXCL_OBJ ; \
+		ARX='$(PERL) $${TOP}/util/arx.pl $(AR)' ; \
+	else \
+		ARX='${AR}' ; \
+	fi ; export ARX ; \
+		dir=crypto; target=all; $(BUILD_ONE_CMD)
+build_fips:
+	@dir=fips; target=all; [ -z "$(FIPSCANLIB)" ] || $(BUILD_ONE_CMD)
 build_ssl:
 	@dir=ssl; target=all; $(BUILD_ONE_CMD)
 build_engines:
@@ -247,9 +351,20 @@
 build_testapps:
 	@dir=crypto; target=testapps; $(BUILD_ONE_CMD)
 
-libcrypto$(SHLIB_EXT): libcrypto.a
+build_shared:	$(SHARED_LIBS)
+libcrypto$(SHLIB_EXT): libcrypto.a $(SHARED_FIPS)
 	@if [ "$(SHLIB_TARGET)" != "" ]; then \
-		$(MAKE) SHLIBDIRS=crypto build-shared; \
+		if [ "$(FIPSCANLIB)" = "libfips" ]; then \
+			$(ARD) libcrypto.a fipscanister.o ; \
+			$(MAKE) SHLIBDIRS='crypto' SHLIBDEPS='-lfips' build-shared; \
+			$(AR) libcrypto.a fips/fipscanister.o ; \
+		else \
+			if [ "$(FIPSCANLIB)" = "libcrypto" ]; then \
+				FIPSLD_CC=$(CC); CC=fips/fipsld; \
+				export CC FIPSLD_CC; \
+			fi; \
+			$(MAKE) -e SHLIBDIRS='crypto' build-shared; \
+		fi \
 	else \
 		echo "There's no support for shared libraries on this platform" >&2; \
 		exit 1; \
@@ -257,12 +372,32 @@
 
 libssl$(SHLIB_EXT): libcrypto$(SHLIB_EXT) libssl.a
 	@if [ "$(SHLIB_TARGET)" != "" ]; then \
-		$(MAKE) SHLIBDIRS=ssl SHLIBDEPS='-lcrypto' build-shared; \
+		shlibdeps=-lcrypto; \
+		[ "$(FIPSCANLIB)" = "libfips" ] && shlibdeps="$$shlibdeps -lfips"; \
+		$(MAKE) SHLIBDIRS=ssl SHLIBDEPS="$$shlibdeps" build-shared; \
+	else \
+		echo "There's no support for shared libraries on this platform" >&2 ; \
+		exit 1; \
+	fi
+
+fips/fipscanister.o:	build_fips
+libfips$(SHLIB_EXT):		fips/fipscanister.o
+	@if [ "$(SHLIB_TARGET)" != "" ]; then \
+		FIPSLD_CC=$(CC); CC=fips/fipsld; export CC FIPSLD_CC; \
+		$(MAKE) -f Makefile.shared -e $(BUILDENV) \
+			CC=$${CC} LIBNAME=fips THIS=$@ \
+			LIBEXTRAS=fips/fipscanister.o \
+			LIBDEPS="$(EX_LIBS)" \
+			LIBVERSION=${SHLIB_MAJOR}.${SHLIB_MINOR} \
+			link_o.$(SHLIB_TARGET) || { rm -f $@; exit 1; } \
 	else \
 		echo "There's no support for shared libraries on this platform" >&2; \
 		exit 1; \
 	fi
 
+libfips.a:
+	dir=fips; target=all; $(BUILD_ONE_CMD)
+
 clean-shared:
 	@set -e; for i in $(SHLIBDIRS); do \
 		if [ -n "$(SHARED_LIBS_LINK_EXTS)" ]; then \
@@ -375,6 +510,9 @@
 	@$(PERL) $(TOP)/util/mkdir-p.pl include/openssl
 	@$(PERL) $(TOP)/util/mklink.pl include/openssl $(EXHEADER)
 	@set -e; target=links; $(RECURSIVE_BUILD_CMD)
+	@if [ -z "$(FIPSCANLIB)" ]; then \
+		set -e; target=links; dir=fips ; $(BUILD_CMD) ; \
+	fi
 
 gentests:
 	@(cd test && echo "generating dummy tests (if needed)..." && \
 
=== modified file 'Makefile.org'
--- Makefile.org	2008-11-11 17:24:44 +0000
+++ Makefile.org	2009-12-07 19:46:11 +0000
@@ -65,6 +65,7 @@
 EXE_EXT= 
 ARFLAGS=
 AR=ar $(ARFLAGS) r
+ARD=ar $(ARFLAGS) d
 RANLIB= ranlib
 PERL= perl
 TAR= tar
@@ -104,8 +105,34 @@
 ZLIB_INCLUDE=
 LIBZLIB=
 
-DIRS=   crypto ssl engines apps tools
-SHLIBDIRS= crypto ssl
+# This is the location of fipscanister.o and friends.
+# The FIPS module build will place it $(INSTALLTOP)/lib
+# but since $(INSTALLTOP) can only take the default value
+# when the module is built it will be in /usr/local/ssl/lib
+# $(INSTALLTOP) for this build make be different so hard
+# code the path.
+
+FIPSLIBDIR=/usr/local/ssl/lib/
+
+# This is set to "y" if fipscanister.o is compiled internally as
+# opposed to coming from an external validated location.
+
+FIPSCANISTERINTERNAL=n
+
+# The location of the library which contains fipscanister.o
+# normally it will be libcrypto unless fipsdso is set in which
+# case it will be libfips. If not compiling in FIPS mode at all
+# this is empty making it a useful test for a FIPS compile.
+
+FIPSCANLIB=
+
+# Shared library base address. Currently only used on Windows.
+#
+
+BASEADDR=
+
+DIRS=   crypto fips ssl engines apps test tools
+SHLIBDIRS= crypto ssl fips
 
 # dirs in crypto to build
 SDIRS=  \
@@ -115,7 +142,7 @@
 	bn ec rsa dsa ecdsa dh ecdh dso engine \
 	buffer bio stack lhash rand err \
 	evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5 \
-	store pqueue
+	store cms pqueue jpake
 # keep in mind that the above list is adjusted by ./Configure
 # according to no-xxx arguments...
 
@@ -125,11 +152,10 @@
 
 MAKEFILE= Makefile
 
-MANDIR=/usr/share/man
+MANDIR=$(OPENSSLDIR)/man
 MAN1=1
 MAN3=3
-MANSUFFIX=ssl
-MANSECTION=SSL
+MANSUFFIX=
 SHELL=/bin/sh
 
 TOP=    .
@@ -139,6 +165,7 @@
 LIBS=   libcrypto.a libssl.a
 SHARED_CRYPTO=libcrypto$(SHLIB_EXT)
 SHARED_SSL=libssl$(SHLIB_EXT)
+SHARED_FIPS=
 SHARED_LIBS=
 SHARED_LIBS_LINK_EXTS=
 SHARED_LDFLAGS=
@@ -192,6 +219,10 @@
 		SHA1_ASM_OBJ='${SHA1_ASM_OBJ}'			\
 		MD5_ASM_OBJ='${MD5_ASM_OBJ}'			\
 		RMD160_ASM_OBJ='${RMD160_ASM_OBJ}'		\
+		FIPSLIBDIR='${FIPSLIBDIR}'			\
+		FIPSCANLIB="$${FIPSCANLIB:-$(FIPSCANLIB)}"	\
+		FIPSCANISTERINTERNAL='${FIPSCANISTERINTERNAL}'	\
+		FIPS_EX_OBJ='${FIPS_EX_OBJ}'	\
 		THIS=$${THIS:-$@} MAKEFILE=Makefile MAKEOVERRIDES=
 # MAKEOVERRIDES= effectively "equalizes" GNU-ish and SysV-ish make flavors,
 # which in turn eliminates ambiguities in variable treatment with -e.
@@ -210,7 +241,8 @@
 # subdirectories defined in $(DIRS).  It requires that the target
 # is given through the shell variable `target'.
 BUILD_CMD=  if [ -d "$$dir" ]; then \
-	    (	cd $$dir && echo "making $$target in $$dir..." && \
+	    (	[ $$target != all -a -z "$(FIPSCANLIB)" ] && FIPSCANLIB=/dev/null; \
+		cd $$dir && echo "making $$target in $$dir..." && \
 		$(CLEARENV) && $(MAKE) -e $(BUILDENV) TOP=.. DIR=$$dir $$target \
 	    ) || exit 1; \
 	    fi
@@ -223,13 +255,84 @@
 reflect:
 	@[ -n "$(THIS)" ] && $(CLEARENV) && $(MAKE) $(THIS) -e $(BUILDENV)
 
+FIPS_EX_OBJ= ../crypto/aes/aes_cfb.o \
+	../crypto/aes/aes_ecb.o \
+	../crypto/aes/aes_ofb.o \
+	../crypto/bn/bn_add.o \
+	../crypto/bn/bn_blind.o \
+	../crypto/bn/bn_ctx.o \
+	../crypto/bn/bn_div.o \
+	../crypto/bn/bn_exp2.o \
+	../crypto/bn/bn_exp.o \
+	../crypto/bn/bn_gcd.o \
+	../crypto/bn/bn_lib.o \
+	../crypto/bn/bn_mod.o \
+	../crypto/bn/bn_mont.o \
+	../crypto/bn/bn_mul.o \
+	../crypto/bn/bn_prime.o \
+	../crypto/bn/bn_rand.o \
+	../crypto/bn/bn_recp.o \
+	../crypto/bn/bn_shift.o \
+	../crypto/bn/bn_sqr.o \
+	../crypto/bn/bn_word.o \
+	../crypto/bn/bn_x931p.o \
+	../crypto/buffer/buf_str.o \
+	../crypto/cryptlib.o \
+	../crypto/des/cfb64ede.o \
+	../crypto/des/cfb64enc.o \
+	../crypto/des/cfb_enc.o \
+	../crypto/des/ecb3_enc.o \
+	../crypto/des/ecb_enc.o \
+	../crypto/des/ofb64ede.o \
+	../crypto/des/ofb64enc.o \
+	../crypto/des/fcrypt.o \
+	../crypto/des/set_key.o \
+	../crypto/dsa/dsa_utl.o \
+	../crypto/dsa/dsa_sign.o \
+	../crypto/dsa/dsa_vrf.o \
+	../crypto/err/err.o \
+	../crypto/evp/digest.o \
+	../crypto/evp/enc_min.o \
+	../crypto/evp/e_aes.o \
+	../crypto/evp/e_des3.o \
+	../crypto/evp/p_sign.o \
+	../crypto/evp/p_verify.o \
+	../crypto/mem_clr.o \
+	../crypto/mem.o \
+	../crypto/rand/md_rand.o \
+	../crypto/rand/rand_egd.o \
+	../crypto/rand/randfile.o \
+	../crypto/rand/rand_lib.o \
+	../crypto/rand/rand_os2.o \
+	../crypto/rand/rand_unix.o \
+	../crypto/rand/rand_win.o \
+	../crypto/rsa/rsa_lib.o \
+	../crypto/rsa/rsa_none.o \
+	../crypto/rsa/rsa_oaep.o \
+	../crypto/rsa/rsa_pk1.o \
+	../crypto/rsa/rsa_pss.o \
+	../crypto/rsa/rsa_ssl.o \
+	../crypto/rsa/rsa_x931.o \
+	../crypto/sha/sha1dgst.o \
+	../crypto/sha/sha256.o \
+	../crypto/sha/sha512.o \
+	../crypto/uid.o
+
 sub_all: build_all
 build_all: build_libs build_apps build_tests build_tools
 
-build_libs: build_crypto build_ssl build_engines
+build_libs: build_crypto build_fips build_ssl build_shared build_engines
 
 build_crypto:
-	@dir=crypto; target=all; $(BUILD_ONE_CMD)
+	if [ -n "$(FIPSCANLIB)" ]; then \
+		EXCL_OBJ='$(AES_ASM_OBJ) $(BN_ASM) $(DES_ENC) $(CPUID_OBJ) $(SHA1_ASM_OBJ) $(FIPS_EX_OBJ)' ; export EXCL_OBJ ; \
+		ARX='$(PERL) $${TOP}/util/arx.pl $(AR)' ; \
+	else \
+		ARX='${AR}' ; \
+	fi ; export ARX ; \
+		dir=crypto; target=all; $(BUILD_ONE_CMD)
+build_fips:
+	@dir=fips; target=all; [ -z "$(FIPSCANLIB)" ] || $(BUILD_ONE_CMD)
 build_ssl:
 	@dir=ssl; target=all; $(BUILD_ONE_CMD)
 build_engines:
@@ -245,9 +348,20 @@
 build_testapps:
 	@dir=crypto; target=testapps; $(BUILD_ONE_CMD)
 
-libcrypto$(SHLIB_EXT): libcrypto.a
+build_shared:	$(SHARED_LIBS)
+libcrypto$(SHLIB_EXT): libcrypto.a $(SHARED_FIPS)
 	@if [ "$(SHLIB_TARGET)" != "" ]; then \
-		$(MAKE) SHLIBDIRS=crypto build-shared; \
+		if [ "$(FIPSCANLIB)" = "libfips" ]; then \
+			$(ARD) libcrypto.a fipscanister.o ; \
+			$(MAKE) SHLIBDIRS='crypto' SHLIBDEPS='-lfips' build-shared; \
+			$(AR) libcrypto.a fips/fipscanister.o ; \
+		else \
+			if [ "$(FIPSCANLIB)" = "libcrypto" ]; then \
+				FIPSLD_CC=$(CC); CC=fips/fipsld; \
+				export CC FIPSLD_CC; \
+			fi; \
+			$(MAKE) -e SHLIBDIRS='crypto' build-shared; \
+		fi \
 	else \
 		echo "There's no support for shared libraries on this platform" >&2; \
 		exit 1; \
@@ -255,12 +369,32 @@
 
 libssl$(SHLIB_EXT): libcrypto$(SHLIB_EXT) libssl.a
 	@if [ "$(SHLIB_TARGET)" != "" ]; then \
-		$(MAKE) SHLIBDIRS=ssl SHLIBDEPS='-lcrypto' build-shared; \
+		shlibdeps=-lcrypto; \
+		[ "$(FIPSCANLIB)" = "libfips" ] && shlibdeps="$$shlibdeps -lfips"; \
+		$(MAKE) SHLIBDIRS=ssl SHLIBDEPS="$$shlibdeps" build-shared; \
+	else \
+		echo "There's no support for shared libraries on this platform" >&2 ; \
+		exit 1; \
+	fi
+
+fips/fipscanister.o:	build_fips
+libfips$(SHLIB_EXT):		fips/fipscanister.o
+	@if [ "$(SHLIB_TARGET)" != "" ]; then \
+		FIPSLD_CC=$(CC); CC=fips/fipsld; export CC FIPSLD_CC; \
+		$(MAKE) -f Makefile.shared -e $(BUILDENV) \
+			CC=$${CC} LIBNAME=fips THIS=$@ \
+			LIBEXTRAS=fips/fipscanister.o \
+			LIBDEPS="$(EX_LIBS)" \
+			LIBVERSION=${SHLIB_MAJOR}.${SHLIB_MINOR} \
+			link_o.$(SHLIB_TARGET) || { rm -f $@; exit 1; } \
 	else \
 		echo "There's no support for shared libraries on this platform" >&2; \
 		exit 1; \
 	fi
 
+libfips.a:
+	dir=fips; target=all; $(BUILD_ONE_CMD)
+
 clean-shared:
 	@set -e; for i in $(SHLIBDIRS); do \
 		if [ -n "$(SHARED_LIBS_LINK_EXTS)" ]; then \
@@ -309,8 +443,7 @@
 	    echo 'Description: OpenSSL cryptography library'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lcrypto'; \
-	    echo 'Libs.private: $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lcrypto $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libcrypto.pc
 
 libssl.pc: Makefile
@@ -323,8 +456,7 @@
 	    echo 'Description: Secure Sockets Layer and cryptography libraries'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lssl'; \
-	    echo 'Libs.private: -lcrypto $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libssl.pc
 
 openssl.pc: Makefile
@@ -337,8 +469,7 @@
 	    echo 'Description: Secure Sockets Layer and cryptography libraries and tools'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lssl -lcrypto'; \
-	    echo 'Libs.private: $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > openssl.pc
 
 Makefile: Makefile.org Configure config
@@ -373,6 +504,9 @@
 	@$(PERL) $(TOP)/util/mkdir-p.pl include/openssl
 	@$(PERL) $(TOP)/util/mklink.pl include/openssl $(EXHEADER)
 	@set -e; target=links; $(RECURSIVE_BUILD_CMD)
+	@if [ -z "$(FIPSCANLIB)" ]; then \
+		set -e; target=links; dir=fips ; $(BUILD_CMD) ; \
+	fi
 
 gentests:
 	@(cd test && echo "generating dummy tests (if needed)..." && \
@@ -482,7 +616,7 @@
 install_sw:
 	@$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/lib \
-		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/ssl/engines \
+		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl \
 		$(INSTALL_PREFIX)$(OPENSSLDIR)/misc \
@@ -560,7 +694,7 @@
 		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
 		(cd `$(PERL) util/dirname.pl $$i`; \
 		sh -c "$$pod2man \
-			--section=$${sec}$(MANSECTION) --center=OpenSSL \
+			--section=$$sec --center=OpenSSL \
 			--release=$(VERSION) `basename $$i`") \
 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
 		$(PERL) util/extract-names.pl < $$i | \
@@ -577,7 +711,7 @@
 		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
 		(cd `$(PERL) util/dirname.pl $$i`; \
 		sh -c "$$pod2man \
-			--section=$${sec}$(MANSECTION) --center=OpenSSL \
+			--section=$$sec --center=OpenSSL \
 			--release=$(VERSION) `basename $$i`") \
 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
 		$(PERL) util/extract-names.pl < $$i | \
 
=== modified file 'Makefile.shared'
--- Makefile.shared	2008-11-11 17:24:44 +0000
+++ Makefile.shared	2009-12-07 19:46:11 +0000
@@ -101,15 +101,13 @@
     LIBDEPS="$${LIBDEPS:-$(LIBDEPS)}"; \
     SHAREDCMD="$${SHAREDCMD:-$(CC)}"; \
     SHAREDFLAGS="$${SHAREDFLAGS:-$(CFLAGS) $(SHARED_LDFLAGS)}"; \
-    nm -Pg $$SHOBJECTS | grep ' [BDT] ' | cut -f1 -d' ' > lib$(LIBNAME).exp; \
     LIBPATH=`for x in $$LIBDEPS; do if echo $$x | grep '^ *-L' > /dev/null 2>&1; then echo $$x | sed -e 's/^ *-L//'; fi; done | uniq`; \
     LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
     LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
     $${SHAREDCMD} $${SHAREDFLAGS} \
 	-o $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX \
 	$$ALLSYMSFLAGS $$SHOBJECTS $$NOALLSYMSFLAGS $$LIBDEPS \
-  ) && $(SYMLINK_SO); \
-  ( $(SET_X); rm -f lib$(LIBNAME).exp )
+  ) && $(SYMLINK_SO)
 
 SYMLINK_SO=	\
 	if [ -n "$$INHIBIT_SYMLINKS" ]; then :; else \
@@ -151,9 +149,9 @@
 	SHLIB_SUFFIX=; \
 	ALLSYMSFLAGS='-Wl,--whole-archive'; \
 	NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
-	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
+	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
 
-DO_GNU_APP=LDFLAGS="$(CFLAGS)"
+DO_GNU_APP=LDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBRPATH)"
 
 #This is rather special.  It's a special target with which one can link
 #applications without bothering with any features that have anything to
@@ -202,8 +200,10 @@
 # to use native NSModule(3) API and refers to dlfcn as termporary hack.
 link_o.darwin:
 	@ $(CALC_VERSIONS); \
-	SHLIB=lib$(LIBNAME); \
-	SHLIB_SUFFIX=.so; \
+	SHLIB=`expr "$$THIS" : '.*/\([^/\.]*\)\.'`; \
+	SHLIB=$${SHLIB:-lib$(LIBNAME)}; \
+	SHLIB_SUFFIX=`expr "$$THIS" : '.*\(\.[^\.]*\)$$'`; \
+	SHLIB_SUFFIX=$${SHLIB_SUFFIX:-.so}; \
 	ALLSYMSFLAGS='-all_load'; \
 	NOALLSYMSFLAGS=''; \
 	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS)"; \
@@ -491,23 +491,23 @@
 
 link_o.aix:
 	@ $(CALC_VERSIONS); \
-	OBJECT_MODE=`expr x$(SHARED_LDFLAGS) : 'x\-[a-z]*\(64\)'` || :; \
+	OBJECT_MODE=`expr "x$(SHARED_LDFLAGS)" : 'x\-[a-z]*\(64\)'` || :; \
 	OBJECT_MODE=$${OBJECT_MODE:-32}; export OBJECT_MODE; \
 	SHLIB=lib$(LIBNAME).so; \
 	SHLIB_SUFFIX=; \
 	ALLSYMSFLAGS=''; \
 	NOALLSYMSFLAGS=''; \
-	SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-G,-bexpall,-bnolibpath,-bM:SRE'; \
+	SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-bexpall,-bnolibpath,-bM:SRE'; \
 	$(LINK_SO_O);
 link_a.aix:
 	@ $(CALC_VERSIONS); \
-	OBJECT_MODE=`expr x$(SHARED_LDFLAGS) : 'x\-[a-z]*\(64\)'` || : ; \
+	OBJECT_MODE=`expr "x$(SHARED_LDFLAGS)" : 'x\-[a-z]*\(64\)'` || : ; \
 	OBJECT_MODE=$${OBJECT_MODE:-32}; export OBJECT_MODE; \
 	SHLIB=lib$(LIBNAME).so; \
 	SHLIB_SUFFIX=; \
 	ALLSYMSFLAGS='-bnogc'; \
 	NOALLSYMSFLAGS=''; \
-	SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-G,-bexpall,-bnolibpath,-bM:SRE'; \
+	SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-bexpall,-bnolibpath,-bM:SRE'; \
 	$(LINK_SO_A_VIA_O)
 link_app.aix:
 	LDFLAGS="$(CFLAGS) -Wl,-brtl,-blibpath:$(LIBRPATH):$${LIBPATH:-/usr/lib:/lib}"; \
 
=== modified file 'NEWS'
--- NEWS	2007-12-05 00:13:39 +0000
+++ NEWS	2009-12-07 19:46:11 +0000
@@ -5,8 +5,26 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
+  Major changes between OpenSSL 0.9.8j and OpenSSL 0.9.8k:
+
+      o Fix various build issues.
+      o Fix security issues (CVE-2009-0590, CVE-2009-0591, CVE-2009-0789)
+
+  Major changes between OpenSSL 0.9.8i and OpenSSL 0.9.8j:
+
+      o Fix security issue (CVE-2008-5077)
+      o Merge FIPS 140-2 branch code.
+
+  Major changes between OpenSSL 0.9.8g and OpenSSL 0.9.8h:
+
+      o CryptoAPI ENGINE support.
+      o Various precautionary measures.
+      o Fix for bugs affecting certificate request creation.
+      o Support for local machine keyset attribute in PKCS#12 files.
+
   Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g:
 
+      o Backport of CMS functionality to 0.9.8.
       o Fixes for bugs introduced with 0.9.8f.
 
   Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f:
 
=== modified file 'Netware/build.bat'
--- Netware/build.bat	2005-12-13 21:37:42 +0000
+++ Netware/build.bat	2009-12-07 19:46:11 +0000
@@ -7,8 +7,9 @@
 rem      build [target] [debug opts] [assembly opts] [configure opts]
 rem
 rem      target        - "netware-clib" - CLib NetWare build (WinSock Sockets)
-rem                    - "netware-libc" - LibC NKS NetWare build (WinSock Sockets)
-rem                    - "netware-libc-bsdsock" - LibC NKS NetWare build (BSD Sockets)
+rem                    - "netware-clib-bsdsock" - CLib NetWare build (BSD Sockets)
+rem                    - "netware-libc" - LibC NetWare build (WinSock Sockets)
+rem                    - "netware-libc-bsdsock" - LibC NetWare build (BSD Sockets)
 rem 
 rem      debug opts    - "debug"  - build debug
 rem
@@ -71,10 +72,12 @@
 if "%1" == "nw-nasm"  set ARG_PROCESSED=YES
 if "%1" == "nw-mwasm" set ASM_MODE=nw-mwasm
 if "%1" == "nw-mwasm" set ASSEMBLER=Metrowerks
-if "%1" == "nw-mwasm"  set NO_ASM=
+if "%1" == "nw-mwasm" set NO_ASM=
 if "%1" == "nw-mwasm" set ARG_PROCESSED=YES
 if "%1" == "netware-clib" set BLD_TARGET=netware-clib
 if "%1" == "netware-clib" set ARG_PROCESSED=YES
+if "%1" == "netware-clib-bsdsock" set BLD_TARGET=netware-clib-bsdsock
+if "%1" == "netware-clib-bsdsock" set ARG_PROCESSED=YES
 if "%1" == "netware-libc" set BLD_TARGET=netware-libc
 if "%1" == "netware-libc" set ARG_PROCESSED=YES
 if "%1" == "netware-libc-bsdsock" set BLD_TARGET=netware-libc-bsdsock
@@ -94,6 +97,7 @@
 rem build the nlm make file name which includes target and debug info
 set NLM_MAKE=
 if "%BLD_TARGET%" == "netware-clib" set NLM_MAKE=netware\nlm_clib
+if "%BLD_TARGET%" == "netware-clib-bsdsock" set NLM_MAKE=netware\nlm_clib_bsdsock
 if "%BLD_TARGET%" == "netware-libc" set NLM_MAKE=netware\nlm_libc
 if "%BLD_TARGET%" == "netware-libc-bsdsock" set NLM_MAKE=netware\nlm_libc_bsdsock
 if "%DEBUG%" == "" set NLM_MAKE=%NLM_MAKE%.mak
@@ -110,7 +114,14 @@
 
 echo Bignum
 cd crypto\bn\asm
-perl x86.pl %ASM_MODE% > bn-nw.asm
+rem perl x86.pl %ASM_MODE% > bn-nw.asm
+perl bn-586.pl %ASM_MODE% > bn-nw.asm
+perl co-586.pl %ASM_MODE% > co-nw.asm
+cd ..\..\..
+
+echo AES
+cd crypto\aes\asm
+perl aes-586.pl %ASM_MODE% > a-nw.asm
 cd ..\..\..
 
 echo DES
@@ -160,6 +171,11 @@
 perl rc5-586.pl %ASM_MODE% > r5-nw.asm
 cd ..\..\..
 
+echo CPUID
+cd crypto
+perl x86cpuid.pl %ASM_MODE% > x86cpuid-nw.asm
+cd ..\
+
 rem ===============================================================
 rem
 :do_config
@@ -176,8 +192,10 @@
 echo .
 perl util\mk1mf.pl %DEBUG% %ASM_MODE% %CONFIG_OPTS% %BLD_TARGET% >%NLM_MAKE%
 
+make -f %NLM_MAKE% vclean
+echo .
 echo The makefile "%NLM_MAKE%" has been created use your maketool to
-echo build (ex: gmake -f %NLM_MAKE%)
+echo build (ex: make -f %NLM_MAKE%)
 goto end
 
 rem ===============================================================
@@ -189,8 +207,9 @@
 echo .  usage: build [target] [debug opts] [assembly opts] [configure opts]
 echo .
 echo .     target        - "netware-clib" - CLib NetWare build (WinSock Sockets)
-echo .                   - "netware-libc" - LibC NKS NetWare build (WinSock Sockets)
-echo .                   - "netware-libc-bsdsock" - LibC NKS NetWare build (BSD Sockets)
+echo .                   - "netware-clib-bsdsock" - CLib NetWare build (BSD Sockets)
+echo .                   - "netware-libc" - LibC NetWare build (WinSock Sockets)
+echo .                   - "netware-libc-bsdsock" - LibC NetWare build (BSD Sockets)
 echo .
 echo .     debug opts    - "debug"  - build debug
 echo .
 
=== modified file 'Netware/cpy_tests.bat'
--- Netware/cpy_tests.bat	2005-12-13 21:37:42 +0000
+++ Netware/cpy_tests.bat	2009-12-07 19:46:11 +0000
@@ -73,6 +73,7 @@
 copy %loc%\test\testx509.pem  %2\openssl\test\
 copy %loc%\test\v3-cert1.pem  %2\openssl\test\
 copy %loc%\test\v3-cert2.pem  %2\openssl\test\
+copy %loc%\crypto\evp\evptests.txt %2\openssl\test\
 
 rem   copy the apps directory stuff
 copy %loc%\apps\client.pem    %2\openssl\apps\
 
=== modified file 'Netware/do_tests.pl'
--- Netware/do_tests.pl	2009-05-14 14:11:05 +0000
+++ Netware/do_tests.pl	2009-12-07 19:46:11 +0000
@@ -34,12 +34,17 @@
    # delete all the output files in the output directory
    unlink <$output_path\\*.*>;
 
-   # open the main log file 
+   # open the main log file
    open(OUT, ">$log_file") || die "unable to open $log_file\n";
 
-   
+   print( OUT "========================================================\n");
+   my $outFile = "$output_path\\version.out";
+   system("openssl2 version (CLIB_OPT)/>$outFile");
+   log_output("CHECKING FOR OPENSSL VERSION:", $outFile);
+
    algorithm_tests();
    encryption_tests();
+   evp_tests();
    pem_tests();
    verify_tests();
    ca_tests();
@@ -56,9 +61,10 @@
 {
    my $i;
    my $outFile;
-   my @tests = ( rsa_test, destest, ideatest, bftest, shatest, sha1test,
-                 md5test, dsatest, md2test, mdc2test, rc2test, rc4test, randtest,
-                 dhtest, exptest );
+   my @tests = ( rsa_test, destest, ideatest, bftest, bntest, shatest, sha1test,
+                 sha256t, sha512t, dsatest, md2test, md4test, md5test, mdc2test,
+                 rc2test, rc4test, rc5test, randtest, rmdtest, dhtest, ecdhtest,
+                 ecdsatest, ectest, exptest, casttest, hmactest );
 
    print( "\nRUNNING CRYPTO ALGORITHM TESTS:\n\n");
 
@@ -68,16 +74,16 @@
    foreach $i (@tests)
    {
       if (-e "$base_path\\$i.nlm")
-	  {
+      {
          $outFile = "$output_path\\$i.out";
-         system("$i > $outFile");
+         system("$i (CLIB_OPT)/>$outFile");
          log_desc("Test: $i\.nlm:");
          log_output("", $outFile );
-	  }
-	  else
-	  {
+      }
+      else
+      {
          log_desc("Test: $i\.nlm: file not found");
-	  }
+      }
    }
 }
 
@@ -109,24 +115,24 @@
 
       # do encryption
       $outFile = "$output_path\\enc.out";
-      system("openssl2 $i -e -bufsize 113 -k test -in $input -out $cipher > $outFile" );
+      system("openssl2 $i -e -bufsize 113 -k test -in $input -out $cipher (CLIB_OPT)/>$outFile" );
       log_output("Encrypting: $input --> $cipher", $outFile);
 
       # do decryption
       $outFile = "$output_path\\dec.out";
-      system("openssl2 $i -d -bufsize 157 -k test -in $cipher -out $clear > $outFile");
+      system("openssl2 $i -d -bufsize 157 -k test -in $cipher -out $clear (CLIB_OPT)/>$outFile");
       log_output("Decrypting: $cipher --> $clear", $outFile);
 
       # compare files
       $x = compare_files( $input, $clear, 1);
       if ( $x == 0 )
       {
-         print( "SUCCESS - files match: $input, $clear\n");
+         print( "\rSUCCESS - files match: $input, $clear\n");
          print( OUT "SUCCESS - files match: $input, $clear\n");
       }
       else
       {
-         print( "ERROR: files don't match\n");
+         print( "\rERROR: files don't match\n");
          print( OUT "ERROR: files don't match\n");
       }
 
@@ -136,24 +142,24 @@
 
       # do encryption B64
       $outFile = "$output_path\\B64enc.out";
-      system("openssl2 $i -a -e -bufsize 113 -k test -in $input -out $cipher > $outFile");
+      system("openssl2 $i -a -e -bufsize 113 -k test -in $input -out $cipher (CLIB_OPT)/>$outFile");
       log_output("Encrypting(B64): $cipher --> $clear", $outFile);
 
       # do decryption B64
       $outFile = "$output_path\\B64dec.out";
-      system("openssl2 $i -a -d -bufsize 157 -k test -in $cipher -out $clear > $outFile");
+      system("openssl2 $i -a -d -bufsize 157 -k test -in $cipher -out $clear (CLIB_OPT)/>$outFile");
       log_output("Decrypting(B64): $cipher --> $clear", $outFile);
 
       # compare files
       $x = compare_files( $input, $clear, 1);
       if ( $x == 0 )
       {
-         print( "SUCCESS - files match: $input, $clear\n");
+         print( "\rSUCCESS - files match: $input, $clear\n");
          print( OUT "SUCCESS - files match: $input, $clear\n");
       }
       else
       {
-         print( "ERROR: files don't match\n");
+         print( "\rERROR: files don't match\n");
          print( OUT "ERROR: files don't match\n");
       }
 
@@ -199,24 +205,24 @@
 
       if ($i ne "req" )
       {
-         system("openssl2 $i -in $input -out $tmp_out > $outFile");
+         system("openssl2 $i -in $input -out $tmp_out (CLIB_OPT)/>$outFile");
          log_output( "openssl2 $i -in $input -out $tmp_out", $outFile);
       }
       else
       {
-         system("openssl2 $i -in $input -out $tmp_out -config $OpenSSL_config > $outFile");
+         system("openssl2 $i -in $input -out $tmp_out -config $OpenSSL_config (CLIB_OPT)/>$outFile");
          log_output( "openssl2 $i -in $input -out $tmp_out -config $OpenSSL_config", $outFile );
       }
 
       $x = compare_files( $input, $tmp_out);
       if ( $x == 0 )
       {
-         print( "SUCCESS - files match: $input, $tmp_out\n");
+         print( "\rSUCCESS - files match: $input, $tmp_out\n");
          print( OUT "SUCCESS - files match: $input, $tmp_out\n");
       }
       else
       {
-         print( "ERROR: files don't match\n");
+         print( "\rERROR: files don't match\n");
          print( OUT "ERROR: files don't match\n");
       }
       do_wait();
@@ -231,7 +237,8 @@
    my $i;
    my $outFile = "$output_path\\verify.out";
 
-   my @cert_files = <$cert_path\\*.pem>;
+   $cert_path =~ s/\\/\//g;
+   my @cert_files = <$cert_path/*.pem>;
 
    print( "\nRUNNING VERIFY TESTS:\n\n");
 
@@ -242,7 +249,7 @@
 
    foreach $i (@cert_files)
    {
-      system("openssl2 verify -CAfile $tmp_cert $i >$outFile");
+      system("openssl2 verify -CAfile $tmp_cert $i (CLIB_OPT)/>$outFile");
       log_desc("Verifying cert: $i");
       log_output("openssl2 verify -CAfile $tmp_cert $i", $outFile);
    }
@@ -263,103 +270,103 @@
    print( OUT "\n========================================================\n");
    print( OUT "SSL TESTS:\n\n");
 
-   system("ssltest -ssl2 >$outFile");
+   system("ssltest -ssl2 (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2:");
    log_output("ssltest -ssl2", $outFile);
 
-   system("$ssltest -ssl2 -server_auth >$outFile");
+   system("$ssltest -ssl2 -server_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2 with server authentication:");
    log_output("$ssltest -ssl2 -server_auth", $outFile);
 
-   system("$ssltest -ssl2 -client_auth >$outFile");
+   system("$ssltest -ssl2 -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2 with client authentication:");
    log_output("$ssltest -ssl2 -client_auth", $outFile);
 
-   system("$ssltest -ssl2 -server_auth -client_auth >$outFile");
+   system("$ssltest -ssl2 -server_auth -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2 with both client and server authentication:");
    log_output("$ssltest -ssl2 -server_auth -client_auth", $outFile);
 
-   system("ssltest -ssl3 >$outFile");
+   system("ssltest -ssl3 (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv3:");
    log_output("ssltest -ssl3", $outFile);
 
-   system("$ssltest -ssl3 -server_auth >$outFile");
+   system("$ssltest -ssl3 -server_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv3 with server authentication:");
    log_output("$ssltest -ssl3 -server_auth", $outFile);
 
-   system("$ssltest -ssl3 -client_auth >$outFile");
+   system("$ssltest -ssl3 -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv3 with client authentication:");
    log_output("$ssltest -ssl3 -client_auth", $outFile);
 
-   system("$ssltest -ssl3 -server_auth -client_auth >$outFile");
+   system("$ssltest -ssl3 -server_auth -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv3 with both client and server authentication:");
    log_output("$ssltest -ssl3 -server_auth -client_auth", $outFile);
 
-   system("ssltest >$outFile");
+   system("ssltest (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3:");
    log_output("ssltest", $outFile);
 
-   system("$ssltest -server_auth >$outFile");
+   system("$ssltest -server_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3 with server authentication:");
    log_output("$ssltest -server_auth", $outFile);
 
-   system("$ssltest -client_auth >$outFile");
+   system("$ssltest -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3 with client authentication:");
    log_output("$ssltest -client_auth ", $outFile);
 
-   system("$ssltest -server_auth -client_auth >$outFile");
+   system("$ssltest -server_auth -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3 with both client and server authentication:");
    log_output("$ssltest -server_auth -client_auth", $outFile);
 
-   system("ssltest -bio_pair -ssl2 >$outFile");
+   system("ssltest -bio_pair -ssl2 (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2 via BIO pair:");
    log_output("ssltest -bio_pair -ssl2", $outFile);
 
-   system("ssltest -bio_pair -dhe1024dsa -v >$outFile");
+   system("ssltest -bio_pair -dhe1024dsa -v (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3 with 1024 bit DHE via BIO pair:");
    log_output("ssltest -bio_pair -dhe1024dsa -v", $outFile);
 
-   system("$ssltest -bio_pair -ssl2 -server_auth >$outFile");
+   system("$ssltest -bio_pair -ssl2 -server_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2 with server authentication via BIO pair:");
    log_output("$ssltest -bio_pair -ssl2 -server_auth", $outFile);
 
-   system("$ssltest -bio_pair -ssl2 -client_auth >$outFile");
+   system("$ssltest -bio_pair -ssl2 -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2 with client authentication via BIO pair:");
    log_output("$ssltest -bio_pair -ssl2 -client_auth", $outFile);
 
-   system("$ssltest -bio_pair -ssl2 -server_auth -client_auth >$outFile");
+   system("$ssltest -bio_pair -ssl2 -server_auth -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2 with both client and server authentication via BIO pair:");
    log_output("$ssltest -bio_pair -ssl2 -server_auth -client_auth", $outFile);
 
-   system("ssltest -bio_pair -ssl3 >$outFile");
+   system("ssltest -bio_pair -ssl3 (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv3 via BIO pair:");
    log_output("ssltest -bio_pair -ssl3", $outFile);
 
-   system("$ssltest -bio_pair -ssl3 -server_auth >$outFile");
+   system("$ssltest -bio_pair -ssl3 -server_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv3 with server authentication via BIO pair:");
    log_output("$ssltest -bio_pair -ssl3 -server_auth", $outFile);
 
-   system("$ssltest -bio_pair -ssl3 -client_auth >$outFile");
+   system("$ssltest -bio_pair -ssl3 -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv3 with client authentication  via BIO pair:");
    log_output("$ssltest -bio_pair -ssl3 -client_auth", $outFile);
 
-   system("$ssltest -bio_pair -ssl3 -server_auth -client_auth >$outFile");
+   system("$ssltest -bio_pair -ssl3 -server_auth -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv3 with both client and server authentication via BIO pair:");
    log_output("$ssltest -bio_pair -ssl3 -server_auth -client_auth", $outFile);
 
-   system("ssltest -bio_pair >$outFile");
+   system("ssltest -bio_pair (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3 via BIO pair:");
    log_output("ssltest -bio_pair", $outFile);
 
-   system("$ssltest -bio_pair -server_auth >$outFile");
+   system("$ssltest -bio_pair -server_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3 with server authentication via BIO pair:");
    log_output("$ssltest -bio_pair -server_auth", $outFile);
 
-   system("$ssltest -bio_pair -client_auth >$outFile");
+   system("$ssltest -bio_pair -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3 with client authentication via BIO pair:");
    log_output("$ssltest -bio_pair -client_auth", $outFile);
 
-   system("$ssltest -bio_pair -server_auth -client_auth >$outFile");
+   system("$ssltest -bio_pair -server_auth -client_auth (CLIB_OPT)/>$outFile");
    log_desc("Testing sslv2/sslv3 with both client and server authentication via BIO pair:");
    log_output("$ssltest -bio_pair -server_auth -client_auth", $outFile);
 }
@@ -389,43 +396,43 @@
    print( OUT "\n========================================================\n");
    print( OUT "CA TESTS:\n");
 
-   system("openssl2 req -config $CAconf -out $CAreq -keyout $CAkey -new >$outFile");
+   system("openssl2 req -config $CAconf -out $CAreq -keyout $CAkey -new (CLIB_OPT)/>$outFile");
    log_desc("Make a certificate request using req:");
    log_output("openssl2 req -config $CAconf -out $CAreq -keyout $CAkey -new", $outFile);
 
-   system("openssl2 x509 -CAcreateserial -in $CAreq -days 30 -req -out $CAcert -signkey $CAkey >$outFile");
+   system("openssl2 x509 -CAcreateserial -in $CAreq -days 30 -req -out $CAcert -signkey $CAkey (CLIB_OPT)/>$outFile");
    log_desc("Convert the certificate request into a self signed certificate using x509:");
    log_output("openssl2 x509 -CAcreateserial -in $CAreq -days 30 -req -out $CAcert -signkey $CAkey", $outFile);
 
-   system("openssl2 x509 -in $CAcert -x509toreq -signkey $CAkey -out $CAreq2 >$outFile");
+   system("openssl2 x509 -in $CAcert -x509toreq -signkey $CAkey -out $CAreq2 (CLIB_OPT)/>$outFile");
    log_desc("Convert a certificate into a certificate request using 'x509':");
    log_output("openssl2 x509 -in $CAcert -x509toreq -signkey $CAkey -out $CAreq2", $outFile);
 
-   system("openssl2 req -config $OpenSSL_config -verify -in $CAreq -noout >$outFile");
+   system("openssl2 req -config $OpenSSL_config -verify -in $CAreq -noout (CLIB_OPT)/>$outFile");
    log_output("openssl2 req -config $OpenSSL_config -verify -in $CAreq -noout", $outFile);
 
-   system("openssl2 req -config $OpenSSL_config -verify -in $CAreq2 -noout >$outFile");
+   system("openssl2 req -config $OpenSSL_config -verify -in $CAreq2 -noout (CLIB_OPT)/>$outFile");
    log_output( "openssl2 req -config $OpenSSL_config -verify -in $CAreq2 -noout", $outFile);
 
-   system("openssl2 verify -CAfile $CAcert $CAcert >$outFile");
+   system("openssl2 verify -CAfile $CAcert $CAcert (CLIB_OPT)/>$outFile");
    log_output("openssl2 verify -CAfile $CAcert $CAcert", $outFile);
 
-   system("openssl2 req -config $Uconf -out $Ureq -keyout $Ukey -new >$outFile");
+   system("openssl2 req -config $Uconf -out $Ureq -keyout $Ukey -new (CLIB_OPT)/>$outFile");
    log_desc("Make another certificate request using req:");
    log_output("openssl2 req -config $Uconf -out $Ureq -keyout $Ukey -new", $outFile);
 
-   system("openssl2 x509 -CAcreateserial -in $Ureq -days 30 -req -out $Ucert -CA $CAcert -CAkey $CAkey -CAserial $CAserial >$outFile");
+   system("openssl2 x509 -CAcreateserial -in $Ureq -days 30 -req -out $Ucert -CA $CAcert -CAkey $CAkey -CAserial $CAserial (CLIB_OPT)/>$outFile");
    log_desc("Sign certificate request with the just created CA via x509:");
    log_output("openssl2 x509 -CAcreateserial -in $Ureq -days 30 -req -out $Ucert -CA $CAcert -CAkey $CAkey -CAserial $CAserial", $outFile);
 
-   system("openssl2 verify -CAfile $CAcert $Ucert >$outFile");
+   system("openssl2 verify -CAfile $CAcert $Ucert (CLIB_OPT)/>$outFile");
    log_output("openssl2 verify -CAfile $CAcert $Ucert", $outFile);
 
-   system("openssl2 x509 -subject -issuer -startdate -enddate -noout -in $Ucert >$outFile");
+   system("openssl2 x509 -subject -issuer -startdate -enddate -noout -in $Ucert (CLIB_OPT)/>$outFile");
    log_desc("Certificate details");
    log_output("openssl2 x509 -subject -issuer -startdate -enddate -noout -in $Ucert", $outFile);
 
-   print(OUT "-- \n");
+   print(OUT "--\n");
    print(OUT "The generated CA certificate is $CAcert\n");
    print(OUT "The generated CA private key is $CAkey\n");
    print(OUT "The current CA signing serial number is in $CAserial\n");
@@ -436,6 +443,29 @@
 }
 
 ############################################################################
+sub evp_tests
+{
+   my $i = 'evp_test';
+
+   print( "\nRUNNING EVP TESTS:\n\n");
+
+   print( OUT "\n========================================================\n");
+   print( OUT "EVP TESTS:\n\n");
+
+   if (-e "$base_path\\$i.nlm")
+   {
+       my $outFile = "$output_path\\$i.out";
+       system("$i $test_path\\evptests.txt (CLIB_OPT)/>$outFile");
+       log_desc("Test: $i\.nlm:");
+       log_output("", $outFile );
+   }
+   else
+   {
+       log_desc("Test: $i\.nlm: file not found");
+   }
+}
+
+############################################################################
 sub log_output( $ $ )
 {
    my( $desc, $file ) = @_;
@@ -445,7 +475,7 @@
 
    if ($desc)
    {
-      print("$desc\n");
+      print("\r$desc\n");
       print(OUT "$desc\n");
    }
 
@@ -457,8 +487,8 @@
       # copy test output to log file
    open(IN, "<$file");
    while (<IN>)
-   { 
-      print(OUT $_); 
+   {
+      print(OUT $_);
       if ( $_ =~ /ERROR/ )
       {
          $error = 1;
@@ -485,13 +515,13 @@
       $key = getc;
       print("\n");
    }
-      
-      # Several of the testing scripts run a loop loading the 
+
+      # Several of the testing scripts run a loop loading the
       # same NLM with different options.
-      # On slow NetWare machines there appears to be some delay in the 
+      # On slow NetWare machines there appears to be some delay in the
       # OS actually unloading the test nlms and the OS complains about.
-      # the NLM already being loaded.  This additional pause is to 
-      # to help provide a little more time for unloading before trying to 
+      # the NLM already being loaded.  This additional pause is to
+      # to help provide a little more time for unloading before trying to
       # load again.
    sleep(1);
 }
@@ -562,7 +592,7 @@
 ############################################################################
 sub make_tmp_cert_file()
 {
-   my @cert_files = <$cert_path\\*.pem>;
+   my @cert_files = <$cert_path/*.pem>;
 
       # delete the file if it already exists
    unlink($tmp_cert);
@@ -570,7 +600,7 @@
    open( TMP_CERT, ">$tmp_cert") || die "\nunable to open $tmp_cert\n";
 
    print("building temporary cert file\n");
-   
+
    # create a temporary cert file that contains all the certs
    foreach $i (@cert_files)
    {
 
=== modified file 'Netware/set_env.bat'
--- Netware/set_env.bat	2005-12-13 21:37:42 +0000
+++ Netware/set_env.bat	2009-12-07 19:46:11 +0000
@@ -16,75 +16,97 @@
                
 set LIBC_BUILD=
 set CLIB_BUILD=
+set GNUC=
 
 if "%1" == "netware-clib" set CLIB_BUILD=Y
 if "%1" == "netware-clib" set LIBC_BUILD=
 
-if "%1" == "netware-libc"  set LIBC_BUILD=Y
-if "%1" == "netware-libc"  set CLIB_BUILD=
+if "%1" == "netware-libc" set LIBC_BUILD=Y
+if "%1" == "netware-libc" set CLIB_BUILD=
+
+if "%2" == "gnuc" set GNUC=Y
+if "%2" == "codewarrior" set GNUC=
 
 rem   Location of tools (compiler, linker, etc)
-set TOOLS=d:\i_drive\tools
+if "%NDKBASE%" == "" set NDKBASE=c:\Novell
 
 rem   If Perl for Win32 is not already in your path, add it here
 set PERL_PATH=
 
 rem   Define path to the Metrowerks command line tools
+rem   or GNU Crosscompiler gcc / nlmconv
 rem   ( compiler, assembler, linker)
-set METROWERKS_PATH=%TOOLS%\codewar\pdk_21\tools\command line tools
-rem set METROWERKS_PATH=%TOOLS%\codewar\PDK_40\Other Metrowerks Tools\Command Line Tools
+if "%GNUC%" == "Y" set COMPILER_PATH=c:\usr\i586-netware\bin;c:\usr\bin
+if "%GNUC%" == "" set COMPILER_PATH=c:\prg\cwcmdl40
 
 rem   If using gnu make define path to utility
-set GNU_MAKE_PATH=%TOOLS%\gnu
+rem set GNU_MAKE_PATH=%NDKBASE%\gnu
+set GNU_MAKE_PATH=c:\prg\tools
 
 rem   If using ms nmake define path to nmake
-set MS_NMAKE_PATH=%TOOLS%\msvc\600\bin
+rem set MS_NMAKE_PATH=%NDKBASE%\msvc\600\bin
 
 rem   If using NASM assembler define path
-set NASM_PATH=%TOOLS%\nasm
+rem set NASM_PATH=%NDKBASE%\nasm
+set NASM_PATH=c:\prg\tools
 
 rem   Update path to include tool paths
-set path=%path%;%METROWERKS_PATH%
+set path=%path%;%COMPILER_PATH%
 if not "%GNU_MAKE_PATH%" == "" set path=%path%;%GNU_MAKE_PATH%
 if not "%MS_NMAKE_PATH%" == "" set path=%path%;%MS_NMAKE_PATH%
 if not "%NASM_PATH%"     == "" set path=%path%;%NASM_PATH%
 if not "%PERL_PATH%"     == "" set path=%path%;%PERL_PATH%
 
-rem   Set MWCIncludes to location of Novell NDK includes
-if "%LIBC_BUILD%" == "Y" set MWCIncludes=%TOOLS%\ndk\libc\include;%TOOLS%\ndk\libc\include\winsock;.\engines
-if "%CLIB_BUILD%" == "Y" set MWCIncludes=%TOOLS%\ndk\nwsdk\include\nlm;.\engines
-set include=
+rem   Set INCLUDES to location of Novell NDK includes
+if "%LIBC_BUILD%" == "Y" set INCLUDE=%NDKBASE%\ndk\libc\include;%NDKBASE%\ndk\libc\include\winsock
+if "%CLIB_BUILD%" == "Y" set INCLUDE=%NDKBASE%\ndk\nwsdk\include\nlm;%NDKBASE%\ws295sdk\include
 
 rem   Set Imports to location of Novell NDK import files
-if "%LIBC_BUILD%" == "Y" set IMPORTS=%TOOLS%\ndk\libc\imports
-if "%CLIB_BUILD%" == "Y" set IMPORTS=%TOOLS%\ndk\nwsdk\imports
+if "%LIBC_BUILD%" == "Y" set IMPORTS=%NDKBASE%\ndk\libc\imports
+if "%CLIB_BUILD%" == "Y" set IMPORTS=%NDKBASE%\ndk\nwsdk\imports
 
 rem   Set PRELUDE to the absolute path of the prelude object to link with in
 rem   the Metrowerks NetWare PDK - NOTE: for Clib builds "clibpre.o" is 
 rem   recommended, for LibC NKS builds libcpre.o must be used
+if "%GNUC%" == "Y" goto gnuc
 if "%LIBC_BUILD%" == "Y" set PRELUDE=%IMPORTS%\libcpre.o
-if "%CLIB_BUILD%" == "Y" set PRELUDE=%IMPORTS%\clibpre.o
-
+rem if "%CLIB_BUILD%" == "Y" set PRELUDE=%IMPORTS%\clibpre.o
+if "%CLIB_BUILD%" == "Y" set PRELUDE=%IMPORTS%\prelude.o
+echo using MetroWerks CodeWarrior 
+goto info
+
+:gnuc
+if "%LIBC_BUILD%" == "Y" set PRELUDE=%IMPORTS%\libcpre.gcc.o
+rem if "%CLIB_BUILD%" == "Y" set PRELUDE=%IMPORTS%\clibpre.gcc.o
+if "%CLIB_BUILD%" == "Y" set PRELUDE=%IMPORTS%\prelude.gcc.o
+echo using GNU GCC Compiler 
+
+:info
+echo.
 
 if "%LIBC_BUILD%" == "Y" echo Enviroment configured for LibC build
 if "%LIBC_BUILD%" == "Y" echo use "netware\build.bat netware-libc ..." 
 
 if "%CLIB_BUILD%" == "Y" echo Enviroment configured for CLib build
 if "%CLIB_BUILD%" == "Y" echo use "netware\build.bat netware-clib ..." 
+
 goto end
 
 :usage
 rem ===============================================================
-echo .
-echo . No target build specified!
-echo .
-echo . usage: set_env [target]
-echo .
-echo .   target      - "netware-clib" - Clib build
-echo .               - "netware-libc" - LibC build
-echo .
-
-
+echo.
+echo No target build specified!
+echo.
+echo usage: set_env [target] [compiler]
+echo.
+echo target      - "netware-clib" - Clib build
+echo             - "netware-libc" - LibC build
+echo.
+echo compiler    - "gnuc"         - GNU GCC Compiler
+echo             - "codewarrior"  - MetroWerks CodeWarrior (default)
+echo.
 
 :end
+echo.
+
 
 
=== modified file 'README'
--- README	2007-12-05 00:13:39 +0000
+++ README	2009-12-07 19:46:11 +0000
@@ -1,7 +1,7 @@
 
- OpenSSL 0.9.8g
+ OpenSSL 0.9.8k
 
- Copyright (c) 1998-2007 The OpenSSL Project
+ Copyright (c) 1998-2008 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
  All rights reserved.
 
@@ -161,7 +161,7 @@
     - Stack Traceback (if the application dumps core)
 
  Report the bug to the OpenSSL project via the Request Tracker
- (http://www.openssl.org/support/rt2.html) by mail to:
+ (http://www.openssl.org/support/rt.html) by mail to:
 
     [e-mail]
 
 
=== modified file 'apps/CA.pl.in'
--- apps/CA.pl.in	2006-05-15 16:00:58 +0000
+++ apps/CA.pl.in	2009-12-07 19:46:11 +0000
@@ -65,7 +65,6 @@
 foreach (@ARGV) {
 	if ( /^(-\?|-h|-help)$/ ) {
 	    print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
-	    print STDERR "usage: CA -signcert certfile keyfile|-newcert|-newreq|-newca|-sign|-verify\n";
 	    exit 0;
 	} elsif (/^-newcert$/) {
 	    # create a certificate
@@ -166,7 +165,6 @@
 	} else {
 	    print STDERR "Unknown arg $_\n";
 	    print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
-	    print STDERR "usage: CA -signcert certfile keyfile|-newcert|-newreq|-newca|-sign|-verify\n";
 	    exit 1;
 	}
 }
 
=== modified file 'apps/CA.sh'
--- apps/CA.sh	2008-11-11 17:24:44 +0000
+++ apps/CA.sh	2009-12-07 19:46:11 +0000
@@ -91,7 +91,6 @@
 			   -out ${CATOP}/$CAREQ
 	    $CA -out ${CATOP}/$CACERT $CADAYS -batch \
 			   -keyfile ${CATOP}/private/$CAKEY -selfsign \
-			   -extensions v3_ca \
 			   -infiles ${CATOP}/$CAREQ 
 	    RET=$?
 	fi
 
=== modified file 'apps/Makefile'
--- apps/Makefile	2007-12-05 00:13:39 +0000
+++ apps/Makefile	2009-12-07 19:46:11 +0000
@@ -38,7 +38,7 @@
 E_EXE=	verify asn1pars req dgst dh dhparam enc passwd gendh errstr \
 	ca crl rsa rsautl dsa dsaparam ec ecparam \
 	x509 genrsa gendsa s_server s_client speed \
-	s_time version pkcs7 crl2pkcs7 sess_id ciphers nseq pkcs12 \
+	s_time version pkcs7 cms crl2pkcs7 sess_id ciphers nseq pkcs12 \
 	pkcs8 spkac smime rand engine ocsp prime
 
 PROGS= $(PROGRAM).c
@@ -56,7 +56,7 @@
 	x509.o genrsa.o gendsa.o s_server.o s_client.o speed.o \
 	s_time.o $(A_OBJ) $(S_OBJ) $(RAND_OBJ) version.o sess_id.o \
 	ciphers.o nseq.o pkcs12.o pkcs8.o spkac.o smime.o rand.o engine.o \
-	ocsp.o prime.o
+	ocsp.o prime.o cms.o
 
 E_SRC=	verify.c asn1pars.c req.c dgst.c dh.c enc.c passwd.c gendh.c errstr.c ca.c \
 	pkcs7.c crl2p7.c crl.c \
@@ -64,7 +64,7 @@
 	x509.c genrsa.c gendsa.c s_server.c s_client.c speed.c \
 	s_time.c $(A_SRC) $(S_SRC) $(RAND_SRC) version.c sess_id.c \
 	ciphers.c nseq.c pkcs12.c pkcs8.c spkac.c smime.c rand.c engine.c \
-	ocsp.c prime.c
+	ocsp.c prime.c cms.c
 
 SRC=$(E_SRC)
 
@@ -152,10 +152,13 @@
 	$(RM) $(EXE)
 	shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \
 		shlib_target="$(SHLIB_TARGET)"; \
+	elif [ -n "$(FIPSCANLIB)" ]; then \
+	  FIPSLD_CC=$(CC); CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
 	fi; \
 	LIBRARIES="$(LIBSSL) $(LIBKRB5) $(LIBCRYPTO)" ; \
+	[ "x$(FIPSCANLIB)" = "xlibfips" ] && LIBRARIES="$$LIBRARIES -lfips"; \
 	$(MAKE) -f $(TOP)/Makefile.shared -e \
-		APPNAME=$(EXE) OBJECTS="$(PROGRAM).o $(E_OBJ)" \
+		CC=$${CC} APPNAME=$(EXE) OBJECTS="$(PROGRAM).o $(E_OBJ)" \
 		LIBDEPS="$(PEX_LIBS) $$LIBRARIES $(EX_LIBS)" \
 		link_app.$${shlib_target}
 	-(cd ..; \
@@ -173,23 +176,25 @@
 app_rand.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
 app_rand.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 app_rand.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
-app_rand.o: ../include/openssl/evp.h ../include/openssl/lhash.h
-app_rand.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+app_rand.o: ../include/openssl/evp.h ../include/openssl/fips.h
+app_rand.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+app_rand.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
 app_rand.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 app_rand.o: ../include/openssl/ossl_typ.h ../include/openssl/pkcs7.h
 app_rand.o: ../include/openssl/rand.h ../include/openssl/safestack.h
 app_rand.o: ../include/openssl/sha.h ../include/openssl/stack.h
 app_rand.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
-app_rand.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h app_rand.c
-app_rand.o: apps.h
+app_rand.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+app_rand.o: ../include/openssl/x509v3.h app_rand.c apps.h
 apps.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 apps.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 apps.o: ../include/openssl/conf.h ../include/openssl/crypto.h
 apps.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
 apps.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
 apps.o: ../include/openssl/engine.h ../include/openssl/err.h
-apps.o: ../include/openssl/evp.h ../include/openssl/lhash.h
-apps.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+apps.o: ../include/openssl/evp.h ../include/openssl/fips.h
+apps.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+apps.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
 apps.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 apps.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
 apps.o: ../include/openssl/pem2.h ../include/openssl/pkcs12.h
@@ -205,31 +210,32 @@
 asn1pars.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 asn1pars.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
 asn1pars.o: ../include/openssl/err.h ../include/openssl/evp.h
-asn1pars.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-asn1pars.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+asn1pars.o: ../include/openssl/fips.h ../include/openssl/lhash.h
+asn1pars.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+asn1pars.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
 asn1pars.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
 asn1pars.o: ../include/openssl/pem.h ../include/openssl/pem2.h
 asn1pars.o: ../include/openssl/pkcs7.h ../include/openssl/safestack.h
 asn1pars.o: ../include/openssl/sha.h ../include/openssl/stack.h
 asn1pars.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
-asn1pars.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-asn1pars.o: asn1pars.c
+asn1pars.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+asn1pars.o: ../include/openssl/x509v3.h apps.h asn1pars.c
 ca.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 ca.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 ca.o: ../include/openssl/conf.h ../include/openssl/crypto.h
 ca.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
 ca.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
 ca.o: ../include/openssl/engine.h ../include/openssl/err.h
-ca.o: ../include/openssl/evp.h ../include/openssl/lhash.h
-ca.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
-ca.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
-ca.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
-ca.o: ../include/openssl/pem.h ../include/openssl/pem2.h
-ca.o: ../include/openssl/pkcs7.h ../include/openssl/safestack.h
-ca.o: ../include/openssl/sha.h ../include/openssl/stack.h
-ca.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
-ca.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
-ca.o: ../include/openssl/x509v3.h apps.h ca.c
+ca.o: ../include/openssl/evp.h ../include/openssl/fips.h
+ca.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+ca.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
+ca.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+ca.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
+ca.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
+ca.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+ca.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
+ca.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
+ca.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h ca.c
 ciphers.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 ciphers.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 ciphers.o: ../include/openssl/comp.h ../include/openssl/conf.h
@@ -237,27 +243,44 @@
 ciphers.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
 ciphers.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
 ciphers.o: ../include/openssl/engine.h ../include/openssl/err.h
-ciphers.o: ../include/openssl/evp.h ../include/openssl/kssl.h
+ciphers.o: ../include/openssl/evp.h ../include/openssl/fips.h
+ciphers.o: ../include/openssl/hmac.h ../include/openssl/kssl.h
 ciphers.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-ciphers.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
-ciphers.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
-ciphers.o: ../include/openssl/pem.h ../include/openssl/pem2.h
-ciphers.o: ../include/openssl/pkcs7.h ../include/openssl/pq_compat.h
-ciphers.o: ../include/openssl/pqueue.h ../include/openssl/safestack.h
-ciphers.o: ../include/openssl/sha.h ../include/openssl/ssl.h
-ciphers.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
-ciphers.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
-ciphers.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h
-ciphers.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
-ciphers.o: ../include/openssl/x509_vfy.h apps.h ciphers.c
+ciphers.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
+ciphers.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+ciphers.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
+ciphers.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
+ciphers.o: ../include/openssl/pq_compat.h ../include/openssl/pqueue.h
+ciphers.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+ciphers.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
+ciphers.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
+ciphers.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
+ciphers.o: ../include/openssl/tls1.h ../include/openssl/txt_db.h
+ciphers.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+ciphers.o: ../include/openssl/x509v3.h apps.h ciphers.c
+cms.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
+cms.o: ../include/openssl/buffer.h ../include/openssl/conf.h
+cms.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
+cms.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
+cms.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
+cms.o: ../include/openssl/evp.h ../include/openssl/fips.h
+cms.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+cms.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
+cms.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+cms.o: ../include/openssl/ossl_typ.h ../include/openssl/pkcs7.h
+cms.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+cms.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
+cms.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
+cms.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h cms.c
 crl.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 crl.o: ../include/openssl/buffer.h ../include/openssl/conf.h
 crl.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
 crl.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 crl.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
 crl.o: ../include/openssl/err.h ../include/openssl/evp.h
-crl.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-crl.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+crl.o: ../include/openssl/fips.h ../include/openssl/lhash.h
+crl.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+crl.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
 crl.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
 crl.o: ../include/openssl/pem.h ../include/openssl/pem2.h
 crl.o: ../include/openssl/pkcs7.h ../include/openssl/safestack.h
@@ -271,30 +294,32 @@
 crl2p7.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 crl2p7.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
 crl2p7.o: ../include/openssl/err.h ../include/openssl/evp.h
-crl2p7.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-crl2p7.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+crl2p7.o: ../include/openssl/fips.h ../include/openssl/lhash.h
+crl2p7.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+crl2p7.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
 crl2p7.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
 crl2p7.o: ../include/openssl/pem.h ../include/openssl/pem2.h
 crl2p7.o: ../include/openssl/pkcs7.h ../include/openssl/safestack.h
 crl2p7.o: ../include/openssl/sha.h ../include/openssl/stack.h
 crl2p7.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
-crl2p7.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h
-crl2p7.o: crl2p7.c
+crl2p7.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+crl2p7.o: ../include/openssl/x509v3.h apps.h crl2p7.c
 dgst.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 dgst.o: ../include/openssl/buffer.h ../include/openssl/conf.h
 dgst.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
 dgst.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 dgst.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
 dgst.o: ../include/openssl/err.h ../include/openssl/evp.h
-dgst.o: ../include/openssl/hmac.h ../include/openssl/lhash.h
-dgst.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+dgst.o: ../include/openssl/fips.h ../include/openssl/hmac.h
+dgst.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+dgst.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
 dgst.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 dgst.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
 dgst.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
 dgst.o: ../include/openssl/safestack.h ../include/openssl/sha.h
 dgst.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
 dgst.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
-dgst.o: ../include/openssl/x509_vfy.h apps.h dgst.c
+dgst.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h dgst.c
 dh.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 dh.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 dh.o: ../include/openssl/conf.h ../include/openssl/crypto.h
@@ -302,14 +327,16 @@
 dh.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 dh.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
 dh.o: ../include/openssl/err.h ../include/openssl/evp.h
-dh.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-dh.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+dh.o: ../include/openssl/fips.h ../include/openssl/lhash.h
+dh.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+dh.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
 dh.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
 dh.o: ../include/openssl/pem.h ../include/openssl/pem2.h
 dh.o: ../include/openssl/pkcs7.h ../include/openssl/safestack.h
 dh.o: ../include/openssl/sha.h ../include/openssl/stack.h
 dh.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
-dh.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h dh.c
+dh.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+dh.o: ../include/openssl/x509v3.h apps.h dh.c
 dsa.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 dsa.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 dsa.o: ../include/openssl/conf.h ../include/openssl/crypto.h
@@ -317,14 +344,16 @@
 dsa.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 dsa.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
 dsa.o: ../include/openssl/err.h ../include/openssl/evp.h
-dsa.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-dsa.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+dsa.o: ../include/openssl/fips.h ../include/openssl/lhash.h
+dsa.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+dsa.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
 dsa.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
 dsa.o: ../include/openssl/pem.h ../include/openssl/pem2.h
 dsa.o: ../include/openssl/pkcs7.h ../include/openssl/safestack.h
 dsa.o: ../include/openssl/sha.h ../include/openssl/stack.h
 dsa.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
-dsa.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h dsa.c
+dsa.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+dsa.o: ../include/openssl/x509v3.h apps.h dsa.c
 dsaparam.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 dsaparam.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 dsaparam.o: ../include/openssl/conf.h ../include/openssl/crypto.h
@@ -332,8 +361,9 @@
 dsaparam.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
 dsaparam.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
 dsaparam.o: ../include/openssl/engine.h ../include/openssl/err.h
-dsaparam.o: ../include/openssl/evp.h ../include/openssl/lhash.h
-dsaparam.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+dsaparam.o: ../include/openssl/evp.h ../include/openssl/fips.h
+dsaparam.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+dsaparam.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
 dsaparam.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 dsaparam.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
 dsaparam.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
@@ -342,51 +372,57 @@
 dsaparam.o: ../include/openssl/stack.h ../include/openssl/store.h
 dsaparam.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
 dsaparam.o: ../include/openssl/ui.h ../include/openssl/x509.h
-dsaparam.o: ../include/openssl/x509_vfy.h apps.h dsaparam.c
+dsaparam.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h
+dsaparam.o: dsaparam.c
 ec.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 ec.o: ../include/openssl/buffer.h ../include/openssl/conf.h
 ec.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
 ec.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 ec.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
 ec.o: ../include/openssl/err.h ../include/openssl/evp.h
-ec.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-ec.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+ec.o: ../include/openssl/fips.h ../include/openssl/lhash.h
+ec.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+ec.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
 ec.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
 ec.o: ../include/openssl/pem.h ../include/openssl/pem2.h
 ec.o: ../include/openssl/pkcs7.h ../include/openssl/safestack.h
 ec.o: ../include/openssl/sha.h ../include/openssl/stack.h
 ec.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
-ec.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h ec.c
+ec.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+ec.o: ../include/openssl/x509v3.h apps.h ec.c
 ecparam.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 ecparam.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 ecparam.o: ../include/openssl/conf.h ../include/openssl/crypto.h
 ecparam.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
 ecparam.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
 ecparam.o: ../include/openssl/engine.h ../include/openssl/err.h
-ecparam.o: ../include/openssl/evp.h ../include/openssl/lhash.h
-ecparam.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+ecparam.o: ../include/openssl/evp.h ../include/openssl/fips.h
+ecparam.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+ecparam.o: ../include/openssl/objects.h ../include/openssl/ocsp.h
 ecparam.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 ecparam.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
 ecparam.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
 ecparam.o: ../include/openssl/safestack.h ../include/openssl/sha.h
 ecparam.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
 ecparam.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
-ecparam.o: ../include/openssl/x509_vfy.h apps.h ecparam.c
+ecparam.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h
+ecparam.o: ecparam.c
 enc.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 enc.o: ../include/openssl/buffer.h ../include/openssl/conf.h
 enc.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
 enc.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
 enc.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
 enc.o: ../include/openssl/err.h ../include/openssl/evp.h
-enc.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-enc.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+enc.o: ../include/openssl/fips.h ../include/openssl/lhash.h
+enc.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+enc.o: ../include/openssl/ocsp.h ../include/openssl/opensslconf.h
 enc.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
 enc.o: ../include/openssl/pem.h ../include/openssl/pem2.h
 enc.o: ../include/openssl/pkcs7.h ../include/openssl/rand.h
 enc.o: ../include/openssl/safestack.h ../include/openssl/sha.h
 enc.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
 enc.o: ../include/openssl/txt_db.h ../include/openssl/x509.h
-enc.o: ../include/openssl/x509_vfy.h apps.h enc.c
+enc.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h enc.c
 engine.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 engine.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 engine.o: ../include/openssl/comp.h ../include/openssl/conf.h
@@ -394,19 +430,21 @@
 engine.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
 engine.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
 engine.o: ../include/openssl/engine.h ../include/openssl/err.h
-engine.o: ../include/openssl/evp.h ../include/openssl/kssl.h
+engine.o: ../include/openssl/evp.h ../include/openssl/fips.h
+engine.o: ../include/openssl/hmac.h ../include/openssl/kssl.h
 engine.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
-engine.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
-engine.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
-engine.o: ../include/openssl/pem.h ../include/openssl/pem2.h
-engine.o: ../include/openssl/pkcs7.h ../include/openssl/pq_compat.h
-engine.o: ../include/openssl/pqueue.h ../include/openssl/safestack.h
-engine.o: ../include/openssl/sha.h ../include/openssl/ssl.h
-engine.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
-engine.o: ../include/openssl/ssl3.h ../include/openssl/stack.h