Merge OpenSSL 0.9.8m into head.

This also "reverts" some FreeBSD local changes so we should now
be back to using entirely stock OpenSSL.  The local changes were
simple $FreeBSD$ lines additions, which were required in the CVS
days, and the patch for FreeBSD-SA-09:15.ssl which has been
superseded with OpenSSL 0.9.8m's RFC5746 'TLS renegotiation
extension' support.

MFC after:	3 weeks

9 files changed, 64 insertions, 29 deletions

diff --git a/crypto/openssl/util/domd b/crypto/openssl/util/domd
index 560ebea..112044c 100755
--- a/crypto/openssl/util/domd
+++ b/crypto/openssl/util/domd
@@ -14,7 +14,7 @@ if [ "$MAKEDEPEND" = "" ]; then MAKEDEPEND=makedepend; fi
 cp Makefile Makefile.save
 # fake the presence of Kerberos
 touch $TOP/krb5.h
-if [ "$MAKEDEPEND" = "gcc" ]; then
+if expr "$MAKEDEPEND" : '.*gcc$' > /dev/null; then
     args=""
     while [ $# -gt 0 ]; do
 	if [ "$1" != "--" ]; then args="$args $1"; fi
diff --git a/crypto/openssl/util/libeay.num b/crypto/openssl/util/libeay.num
index 74eb337..21f4a8f 100755
--- a/crypto/openssl/util/libeay.num
+++ b/crypto/openssl/util/libeay.num
@@ -1255,8 +1255,8 @@ PKCS12_gen_mac                          1278	EXIST::FUNCTION:
 PKCS12_verify_mac                       1279	EXIST::FUNCTION:
 PKCS12_set_mac                          1280	EXIST::FUNCTION:
 PKCS12_setup_mac                        1281	EXIST::FUNCTION:
-asc2uni                                 1282	EXIST::FUNCTION:
-uni2asc                                 1283	EXIST::FUNCTION:
+asc2uni                                 1282	EXIST:!NETWARE:FUNCTION:
+uni2asc                                 1283	EXIST:!NETWARE:FUNCTION:
 i2d_PKCS12_BAGS                         1284	EXIST::FUNCTION:
 PKCS12_BAGS_new                         1285	EXIST::FUNCTION:
 d2i_PKCS12_BAGS                         1286	EXIST::FUNCTION:
@@ -2869,8 +2869,8 @@ PROXY_POLICY_free                       3308	EXIST::FUNCTION:
 PROXY_POLICY_new                        3309	EXIST::FUNCTION:
 BN_MONT_CTX_set_locked                  3310	EXIST::FUNCTION:
 FIPS_selftest_rng                       3311	EXIST:OPENSSL_FIPS:FUNCTION:
-EVP_sha384                              3312	EXIST::FUNCTION:SHA,SHA512
-EVP_sha512                              3313	EXIST::FUNCTION:SHA,SHA512
+EVP_sha384                              3312	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
+EVP_sha512                              3313	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 EVP_sha224                              3314	EXIST::FUNCTION:SHA,SHA256
 EVP_sha256                              3315	EXIST::FUNCTION:SHA,SHA256
 FIPS_selftest_hmac                      3316	EXIST:OPENSSL_FIPS:FUNCTION:
@@ -2917,7 +2917,7 @@ EC_KEY_new_by_curve_name                3353	EXIST::FUNCTION:EC
 STORE_method_get_update_store_function  3354	EXIST:!VMS:FUNCTION:
 STORE_meth_get_update_store_fn          3354	EXIST:VMS:FUNCTION:
 ENGINE_register_ECDH                    3355	EXIST::FUNCTION:ENGINE
-SHA512_Update                           3356	EXIST::FUNCTION:SHA,SHA512
+SHA512_Update                           3356	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 i2d_ECPrivateKey                        3357	EXIST::FUNCTION:EC
 BN_get0_nist_prime_192                  3358	EXIST::FUNCTION:
 STORE_modify_certificate                3359	EXIST::FUNCTION:
@@ -3128,7 +3128,7 @@ POLICY_CONSTRAINTS_new                  3547	EXIST::FUNCTION:
 BN_GF2m_mod_sqrt                        3548	EXIST::FUNCTION:
 ECDH_set_default_method                 3549	EXIST::FUNCTION:ECDH
 EC_KEY_generate_key                     3550	EXIST::FUNCTION:EC
-SHA384_Update                           3551	EXIST::FUNCTION:SHA,SHA512
+SHA384_Update                           3551	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 BN_GF2m_arr2poly                        3552	EXIST::FUNCTION:
 STORE_method_get_get_function           3553	EXIST::FUNCTION:
 STORE_method_set_cleanup_function       3554	EXIST:!VMS:FUNCTION:
@@ -3161,7 +3161,7 @@ STORE_store_public_key                  3577	EXIST::FUNCTION:
 X509_CERT_PAIR_free                     3578	EXIST::FUNCTION:
 STORE_revoke_private_key                3579	EXIST::FUNCTION:
 BN_nist_mod_224                         3580	EXIST::FUNCTION:
-SHA512_Final                            3581	EXIST::FUNCTION:SHA,SHA512
+SHA512_Final                            3581	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 STORE_ATTR_INFO_modify_dn               3582	EXIST::FUNCTION:
 STORE_method_get_initialise_function    3583	EXIST:!VMS:FUNCTION:
 STORE_meth_get_initialise_fn            3583	EXIST:VMS:FUNCTION:
@@ -3220,7 +3220,7 @@ STORE_method_get_delete_function        3630	EXIST:!VMS:FUNCTION:
 STORE_meth_get_delete_fn                3630	EXIST:VMS:FUNCTION:
 SHA224_Init                             3631	EXIST::FUNCTION:SHA,SHA256
 PEM_read_ECPrivateKey                   3632	EXIST:!WIN16:FUNCTION:EC
-SHA512_Init                             3633	EXIST::FUNCTION:SHA,SHA512
+SHA512_Init                             3633	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 STORE_parse_attrs_endp                  3634	EXIST::FUNCTION:
 BN_set_negative                         3635	EXIST::FUNCTION:
 ERR_load_ECDSA_strings                  3636	EXIST::FUNCTION:ECDSA
@@ -3259,13 +3259,13 @@ EC_KEY_set_enc_flags                    3665	EXIST::FUNCTION:EC
 ECDSA_verify                            3666	EXIST::FUNCTION:ECDSA
 EC_POINT_point2hex                      3667	EXIST::FUNCTION:EC
 ENGINE_get_STORE                        3668	EXIST::FUNCTION:ENGINE
-SHA512                                  3669	EXIST::FUNCTION:SHA,SHA512
+SHA512                                  3669	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 STORE_get_certificate                   3670	EXIST::FUNCTION:
 ECDSA_do_sign_ex                        3671	EXIST::FUNCTION:ECDSA
 ECDSA_do_verify                         3672	EXIST::FUNCTION:ECDSA
 d2i_ECPrivateKey_fp                     3673	EXIST::FUNCTION:EC,FP_API
 STORE_delete_certificate                3674	EXIST::FUNCTION:
-SHA512_Transform                        3675	EXIST::FUNCTION:SHA,SHA512
+SHA512_Transform                        3675	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 X509_STORE_set1_param                   3676	EXIST::FUNCTION:
 STORE_method_get_ctrl_function          3677	EXIST::FUNCTION:
 STORE_free                              3678	EXIST::FUNCTION:
@@ -3331,16 +3331,16 @@ d2i_ECParameters                        3733	EXIST::FUNCTION:EC
 STORE_list_certificate_end              3734	EXIST::FUNCTION:
 STORE_get_crl                           3735	EXIST::FUNCTION:
 X509_POLICY_NODE_print                  3736	EXIST::FUNCTION:
-SHA384_Init                             3737	EXIST::FUNCTION:SHA,SHA512
+SHA384_Init                             3737	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 EC_GF2m_simple_method                   3738	EXIST::FUNCTION:EC
 ECDSA_set_ex_data                       3739	EXIST::FUNCTION:ECDSA
-SHA384_Final                            3740	EXIST::FUNCTION:SHA,SHA512
+SHA384_Final                            3740	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 PKCS7_set_digest                        3741	EXIST::FUNCTION:
 EC_KEY_print                            3742	EXIST::FUNCTION:BIO,EC
 STORE_method_set_lock_store_function    3743	EXIST:!VMS:FUNCTION:
 STORE_meth_set_lock_store_fn            3743	EXIST:VMS:FUNCTION:
 ECDSA_get_ex_new_index                  3744	EXIST::FUNCTION:ECDSA
-SHA384                                  3745	EXIST::FUNCTION:SHA,SHA512
+SHA384                                  3745	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 POLICY_MAPPING_new                      3746	EXIST::FUNCTION:
 STORE_list_certificate_endp             3747	EXIST::FUNCTION:
 X509_STORE_CTX_get0_policy_tree         3748	EXIST::FUNCTION:
@@ -3657,7 +3657,7 @@ ENGINE_set_ld_ssl_clnt_cert_fn          4044	EXIST:VMS:FUNCTION:ENGINE
 ENGINE_get_ssl_client_cert_function     4045	EXIST:!VMS:FUNCTION:ENGINE
 ENGINE_get_ssl_client_cert_fn           4045	EXIST:VMS:FUNCTION:ENGINE
 ENGINE_load_ssl_client_cert             4046	EXIST::FUNCTION:ENGINE
-ENGINE_load_capi                        4047	EXIST::FUNCTION:CAPIENG,ENGINE
+ENGINE_load_capi                        4047	EXIST:WIN32:FUNCTION:CAPIENG,ENGINE
 OPENSSL_isservice                       4048	EXIST::FUNCTION:
 FIPS_dsa_sig_decode                     4049	EXIST:OPENSSL_FIPS:FUNCTION:DSA
 EVP_CIPHER_CTX_clear_flags              4050	EXIST::FUNCTION:
@@ -3725,3 +3725,6 @@ JPAKE_STEP2_release                     4110	EXIST::FUNCTION:JPAKE
 JPAKE_STEP3A_init                       4111	EXIST::FUNCTION:JPAKE
 ERR_load_JPAKE_strings                  4112	EXIST::FUNCTION:JPAKE
 JPAKE_STEP2_init                        4113	EXIST::FUNCTION:JPAKE
+pqueue_size                             4114	EXIST::FUNCTION:
+OPENSSL_uni2asc                         4115	EXIST:NETWARE:FUNCTION:
+OPENSSL_asc2uni                         4116	EXIST:NETWARE:FUNCTION:
diff --git a/crypto/openssl/util/mk1mf.pl b/crypto/openssl/util/mk1mf.pl
index f2b92b2..a21f6f4 100755
--- a/crypto/openssl/util/mk1mf.pl
+++ b/crypto/openssl/util/mk1mf.pl
@@ -863,7 +863,8 @@ foreach (values %lib_nam)
 	}
 
 # hack to add version info on MSVC
-if (($platform eq "VC-WIN32") || ($platform eq "VC-NT")) {
+if (($platform eq "VC-WIN32") || ($platform eq "VC-WIN64A")
+	|| ($platform eq "VC-WIN64I") || ($platform eq "VC-NT")) {
     $rules.= <<"EOF";
 \$(OBJ_D)\\\$(CRYPTO).res: ms\\version32.rc
 	\$(RSC) /fo"\$(OBJ_D)\\\$(CRYPTO).res" /d CRYPTO ms\\version32.rc
@@ -1142,7 +1143,7 @@ sub do_defs
 		$ret.=$t;
 		}
 	# hack to add version info on MSVC
-	if ($shlib && (($platform eq "VC-WIN32") || ($platform eq "VC-NT")))
+	if ($shlib && (($platform eq "VC-WIN32") || ($platfrom eq "VC-WIN64I") || ($platform eq "VC-WIN64A") || ($platform eq "VC-NT")))
 		{
 		if ($var eq "CRYPTOOBJ")
 			{ $ret.="\$(OBJ_D)\\\$(CRYPTO).res "; }
diff --git a/crypto/openssl/util/mkdef.pl b/crypto/openssl/util/mkdef.pl
index 5ae9ebb..93dd251 100755
--- a/crypto/openssl/util/mkdef.pl
+++ b/crypto/openssl/util/mkdef.pl
@@ -69,7 +69,7 @@ my $do_ctestall = 0;
 my $do_checkexist = 0;
 
 my $VMSVAX=0;
-my $VMSAlpha=0;
+my $VMSNonVAX=0;
 my $VMS=0;
 my $W32=0;
 my $W16=0;
@@ -78,7 +78,7 @@ my $OS2=0;
 # Set this to make typesafe STACK definitions appear in DEF
 my $safe_stack_def = 0;
 
-my @known_platforms = ( "__FreeBSD__", "PERL5", "NeXT",
+my @known_platforms = ( "__FreeBSD__", "PERL5", "NeXT", "NETWARE",
 			"EXPORT_VAR_AS_FUNCTION", "ZLIB", "OPENSSL_FIPS"); 
 my @known_ossl_platforms = ( "VMS", "WIN16", "WIN32", "WINNT", "OS2" );
 my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
@@ -141,9 +141,9 @@ foreach (@ARGV, split(/ /, $options))
 		$VMS=1;
 		$VMSVAX=1;
 	}
-	if ($_ eq "VMS-Alpha") {
+	if ($_ eq "VMS-NonVAX") {
 		$VMS=1;
-		$VMSAlpha=1;
+		$VMSNonVAX=1;
 	}
 	$VMS=1 if $_ eq "VMS";
 	$OS2=1 if $_ eq "OS2";
@@ -962,6 +962,19 @@ sub do_defs
 	$platform{"PEM_read_P8_PRIV_KEY_INFO"} = "VMS";
 	$platform{"PEM_write_P8_PRIV_KEY_INFO"} = "VMS";
 
+	$platform{"EVP_sha384"} = "!VMSVAX";
+	$platform{"EVP_sha512"} = "!VMSVAX";
+	$platform{"SHA384_Init"} = "!VMSVAX";
+	$platform{"SHA384_Transform"} = "!VMSVAX";
+	$platform{"SHA384_Update"} = "!VMSVAX";
+	$platform{"SHA384_Final"} = "!VMSVAX";
+	$platform{"SHA384"} = "!VMSVAX";
+	$platform{"SHA512_Init"} = "!VMSVAX";
+	$platform{"SHA512_Transform"} = "!VMSVAX";
+	$platform{"SHA512_Update"} = "!VMSVAX";
+	$platform{"SHA512_Final"} = "!VMSVAX";
+	$platform{"SHA512"} = "!VMSVAX";
+
 	# Info we know about
 
 	push @ret, map { $_."\\".&info_string($_,"EXIST",
@@ -1086,6 +1099,8 @@ sub is_valid
 		if ($platforms) {
 			# platforms
 			if ($keyword eq "VMS" && $VMS) { return 1; }
+			if ($keyword eq "VMSVAX" && $VMSVAX) { return 1; }
+			if ($keyword eq "VMSNonVAX" && $VMSNonVAX) { return 1; }
 			if ($keyword eq "WIN32" && $W32) { return 1; }
 			if ($keyword eq "WIN16" && $W16) { return 1; }
 			if ($keyword eq "WINNT" && $NT) { return 1; }
diff --git a/crypto/openssl/util/mkerr.pl b/crypto/openssl/util/mkerr.pl
index 554bebb..5d2f218 100644
--- a/crypto/openssl/util/mkerr.pl
+++ b/crypto/openssl/util/mkerr.pl
@@ -313,7 +313,7 @@ foreach $lib (keys %csrc)
 	} else {
 	    push @out,
 "/* ====================================================================\n",
-" * Copyright (c) 2001-2008 The OpenSSL Project.  All rights reserved.\n",
+" * Copyright (c) 2001-2010 The OpenSSL Project.  All rights reserved.\n",
 " *\n",
 " * Redistribution and use in source and binary forms, with or without\n",
 " * modification, are permitted provided that the following conditions\n",
@@ -487,7 +487,7 @@ EOF
 	print OUT <<"EOF";
 /* $cfile */
 /* ====================================================================
- * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2010 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/crypto/openssl/util/pl/Mingw32.pl b/crypto/openssl/util/pl/Mingw32.pl
index 6ea5179..8f0483f 100644
--- a/crypto/openssl/util/pl/Mingw32.pl
+++ b/crypto/openssl/util/pl/Mingw32.pl
@@ -1,5 +1,4 @@
 #!/usr/local/bin/perl
-# $FreeBSD$
 #
 # Mingw32.pl -- Mingw
 #
diff --git a/crypto/openssl/util/pl/VC-32.pl b/crypto/openssl/util/pl/VC-32.pl
index 85121c8..ed4a3f9 100644
--- a/crypto/openssl/util/pl/VC-32.pl
+++ b/crypto/openssl/util/pl/VC-32.pl
@@ -27,6 +27,10 @@ $rm='del /Q';
 
 $zlib_lib="zlib1.lib";
 
+# Santize -L options for ms link
+$l_flags =~ s/-L("\[^"]+")/\/libpath:$1/g;
+$l_flags =~ s/-L(\S+)/\/libpath:$1/g;
+
 # C compiler stuff
 $cc='cl';
 if ($FLAVOR =~ /WIN64/)
@@ -145,6 +149,18 @@ if ($no_sock)		{ $ex_libs=''; }
 elsif ($FLAVOR =~ /CE/)	{ $ex_libs='winsock.lib'; }
 else			{ $ex_libs='wsock32.lib'; }
 
+my $oflow;
+
+
+if ($FLAVOR =~ /WIN64/ and `cl 2>&1` =~ /14\.00\.4[0-9]{4}\./)
+	{
+	$oflow=' bufferoverflowu.lib';
+	}
+else
+	{
+	$oflow="";
+	}
+
 if ($FLAVOR =~ /CE/)
 	{
 	$ex_libs.=' $(WCECOMPAT)/lib/wcecompatex.lib';
@@ -153,7 +169,8 @@ if ($FLAVOR =~ /CE/)
 else
 	{
 	$ex_libs.=' gdi32.lib crypt32.lib advapi32.lib user32.lib';
-	$ex_libs.=' bufferoverflowu.lib' if ($FLAVOR =~ /WIN64/);
+	$ex_libs.= $oflow;
+
 	}
 
 # As native NT API is pure UNICODE, our WIN-NT build defaults to UNICODE,
@@ -338,7 +355,7 @@ sub do_lib_rule
 
 		if ($name eq "")
 			{
-			$ex.=' bufferoverflowu.lib' if ($FLAVOR =~ /WIN64/);
+			$ex.= $oflow;
 			if ($target =~ /capi/)
 				{
 				$ex.=' crypt32.lib advapi32.lib';
@@ -353,7 +370,7 @@ sub do_lib_rule
 			$ex.=' unicows.lib' if ($FLAVOR =~ /NT/);
 			$ex.=' wsock32.lib gdi32.lib advapi32.lib user32.lib';
 			$ex.=' crypt32.lib';
-			$ex.=' bufferoverflowu.lib' if ($FLAVOR =~ /WIN64/);
+			$ex.= $oflow;
 			}
 		$ex.=" $zlib_lib" if $zlib_opt == 1 && $target =~ /O_CRYPTO/;
 
diff --git a/crypto/openssl/util/pod2man.pl b/crypto/openssl/util/pod2man.pl
index 546d1ec..025d914 100755
--- a/crypto/openssl/util/pod2man.pl
+++ b/crypto/openssl/util/pod2man.pl
@@ -425,7 +425,7 @@ if ($name ne 'something') {
 	    }
 	    next if /^=cut\b/;	# DB_File and Net::Ping have =cut before NAME
 	    next if /^=pod\b/;  # It is OK to have =pod before NAME
-	    next if /^=for\s+comment\b/;  # It is OK to have =for comment before NAME
+	    next if /^=(for|begin|end)\s+comment\b/;  # It is OK to have =for =begin or =end comment before NAME
 	    die "$0: Invalid man page - 1st pod line is not NAME in $ARGV[0]\n" unless $lax;
 	}
 	die "$0: Invalid man page - no documentation in $ARGV[0]\n" unless $lax;
diff --git a/crypto/openssl/util/shlib_wrap.sh b/crypto/openssl/util/shlib_wrap.sh
index a2f62d6..d744ff3 100755
--- a/crypto/openssl/util/shlib_wrap.sh
+++ b/crypto/openssl/util/shlib_wrap.sh
@@ -80,7 +80,7 @@ if [ -f "$LIBCRYPTOSO" -a -z "$preload_var" ]; then
 	# it into a script makes it possible to do so on multi-ABI
 	# platforms.
 	case "$SYSNAME" in
-	*BSD)	LD_PRELOAD="$LIBCRYPTOSO:$LIBSSLSO" ;;	# *BSD
+	*BSD|QNX)	LD_PRELOAD="$LIBCRYPTOSO:$LIBSSLSO" ;;	# *BSD, QNX
 	*)	LD_PRELOAD="$LIBCRYPTOSO $LIBSSLSO" ;;	# SunOS, Linux, ELF HP-UX
 	esac
 	_RLD_LIST="$LIBCRYPTOSO:$LIBSSLSO:DEFAULT"	# Tru64, o32 IRIX