Import rpm: c8s

.gitignore

@@ -0,0 +1,2 @@
+SOURCES/openssl-1.0.2o-hobbled.tar.xz
+/openssl-1.0.2o-hobbled.tar.xz

Makefile.certificate

@@ -0,0 +1,82 @@
+UTF8 := $(shell locale -c LC_CTYPE -k | grep -q charmap.*UTF-8 && echo -utf8)
+DAYS=365
+KEYLEN=2048
+TYPE=rsa:$(KEYLEN)
+EXTRA_FLAGS=
+ifdef SERIAL
+	EXTRA_FLAGS+=-set_serial $(SERIAL)
+endif
+
+.PHONY: usage
+.SUFFIXES: .key .csr .crt .pem
+.PRECIOUS: %.key %.csr %.crt %.pem
+
+usage:
+	@echo "This makefile allows you to create:"
+	@echo "  o public/private key pairs"
+	@echo "  o SSL certificate signing requests (CSRs)"
+	@echo "  o self-signed SSL test certificates"
+	@echo
+	@echo "To create a key pair, run \"make SOMETHING.key\"."
+	@echo "To create a CSR, run \"make SOMETHING.csr\"."
+	@echo "To create a test certificate, run \"make SOMETHING.crt\"."
+	@echo "To create a key and a test certificate in one file, run \"make SOMETHING.pem\"."
+	@echo
+	@echo "To create a key for use with Apache, run \"make genkey\"."
+	@echo "To create a CSR for use with Apache, run \"make certreq\"."
+	@echo "To create a test certificate for use with Apache, run \"make testcert\"."
+	@echo
+	@echo "To create a test certificate with serial number other than random, add SERIAL=num"
+	@echo "You can also specify key length with KEYLEN=n and expiration in days with DAYS=n"
+	@echo "Any additional options can be passed to openssl req via EXTRA_FLAGS"
+	@echo
+	@echo Examples:
+	@echo "  make server.key"
+	@echo "  make server.csr"
+	@echo "  make server.crt"
+	@echo "  make stunnel.pem"
+	@echo "  make genkey"
+	@echo "  make certreq"
+	@echo "  make testcert"
+	@echo "  make server.crt SERIAL=1"
+	@echo "  make stunnel.pem EXTRA_FLAGS=-sha384"
+	@echo "  make testcert DAYS=600"
+
+%.pem:
+	umask 77 ; \
+	PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
+	PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
+	/usr/bin/openssl req $(UTF8) -newkey $(TYPE) -keyout $$PEM1 -nodes -x509 -days $(DAYS) -out $$PEM2 $(EXTRA_FLAGS) ; \
+	cat $$PEM1 >  $@ ; \
+	echo ""    >> $@ ; \
+	cat $$PEM2 >> $@ ; \
+	$(RM) $$PEM1 $$PEM2
+
+%.key:
+	umask 77 ; \
+	/usr/bin/openssl genrsa -aes128 $(KEYLEN) > $@
+
+%.csr: %.key
+	umask 77 ; \
+	/usr/bin/openssl req $(UTF8) -new -key $^ -out $@
+
+%.crt: %.key
+	umask 77 ; \
+	/usr/bin/openssl req $(UTF8) -new -key $^ -x509 -days $(DAYS) -out $@ $(EXTRA_FLAGS)
+
+TLSROOT=/etc/pki/tls
+KEY=$(TLSROOT)/private/localhost.key
+CSR=$(TLSROOT)/certs/localhost.csr
+CRT=$(TLSROOT)/certs/localhost.crt
+
+genkey: $(KEY)
+certreq: $(CSR)
+testcert: $(CRT)
+
+$(CSR): $(KEY)
+	umask 77 ; \
+	/usr/bin/openssl req $(UTF8) -new -key $(KEY) -out $(CSR)
+
+$(CRT): $(KEY)
+	umask 77 ; \
+	/usr/bin/openssl req $(UTF8) -new -key $(KEY) -x509 -days $(DAYS) -out $(CRT) $(EXTRA_FLAGS)

README.FIPS

@@ -0,0 +1,75 @@
+User guide for the FIPS Red Hat Enterprise Linux - OpenSSL Module
+=================================================================
+
+This package contains libraries which comprise the FIPS 140-2
+Red Hat Enterprise Linux - OPENSSL Module.
+
+The module files
+================
+/usr/lib[64]/libcrypto.so.1.0.1e
+/usr/lib[64]/libssl.so.1.0.1e
+/usr/lib[64]/.libcrypto.so.1.0.1e.hmac
+/usr/lib[64]/.libssl.so.1.0.1e.hmac
+
+Dependencies
+============
+
+The approved mode of operation requires kernel with /dev/urandom RNG running
+with properties as defined in the security policy of the module. This is
+provided by kernel packages with validated Red Hat Enterprise Linux - IPSec
+Crytographic Module.
+
+Installation
+============
+
+The RPM package of the module can be installed by standard tools recommended
+for installation of RPM packages on the Red Hat Enterprise Linux system (yum,
+rpm, RHN remote management tool).
+
+For proper operation of the in-module integrity verification the prelink has to
+be disabled. This can be done with setting PRELINKING=no in the
+/etc/sysconfig/prelink configuration file. If the libraries were already
+prelinked the prelink should be undone on all the system files with the
+'prelink -u -a' command.
+
+Usage and API
+=============
+
+The module respects kernel command line FIPS setting. If the kernel command
+line contains option fips=1 the module will initialize in the FIPS approved
+mode of operation automatically. To allow for the automatic initialization the
+application using the module has to call one of the following API calls:
+
+- void OPENSSL_init_library(void) - this will do only a basic initialization
+of the library and does initialization of the FIPS approved mode without setting
+up EVP API with supported algorithms.
+
+- void OPENSSL_add_all_algorithms(void) - this API function calls
+OPENSSL_init() implicitly and also adds all approved algorithms to the EVP API
+in the approved mode 
+
+- void SSL_library_init(void) - it calls OPENSSL_init() implicitly and also
+adds algorithms which are necessary for TLS protocol support and initializes
+the SSL library.
+
+To explicitely put the library to the approved mode the application can call
+the following function:
+
+- int FIPS_mode_set(int on) - if called with 1 as a parameter it will switch
+the library from the non-approved to the approved mode. If any of the selftests
+and integrity verification tests fail, the library is put into the error state
+and 0 is returned. If they succeed the return value is 1.
+
+To query the module whether it is in the approved mode or not:
+
+- int FIPS_mode(void) - returns 1 if the module is in the approved mode,
+0 otherwise.
+
+To query whether the module is in the error state:
+
+- int FIPS_selftest_failed(void) - returns 1 if the module is in the error
+state, 0 otherwise.
+
+To zeroize the FIPS RNG key and internal state the application calls:
+
+- void RAND_cleanup(void)

README.legacy-settings

@@ -0,0 +1,53 @@
+Guide for legacy support enablement
+===================================
+
+To improve security provided by use of OpenSSL especially in context of
+TLS connections we regularly review and deprecate algorithms and algorithm
+settings which are no longer viewed as secure.
+
+For some of these deprecated algorithms we provide a way for the
+system administrator to reenable them.
+
+Deprecated algorithms, protocols and settings in OpenSSL
+========================================================
+
+Previous Red Hat Enterprise Linux 7 update releases:
+
+* SSL2 protocol disabled by default.
+* Minimum DH group size accepted by SSL/TLS client 768 bits.
+* Verification of certificates and signatures using MD5 hash
+  disabled.
+
+Red Hat Enterprise Linux 7.4:
+
+* SSL2 protocol support completely disabled (cannot be re-enabled).
+* All SSL/TLS export ciphers disabled.
+* All SSL/TLS ciphersuites with keys smaller than 128 bits disabled.
+* Minimum DH group size accepted by SSL/TLS client 1024 bits.
+* Disabled support for verification of certificates and signatures
+  using MD2, MD4, MD5, and SHA0 hashes.
+
+Legacy support enablement
+=========================
+
+The OpenSSL now supports /etc/pki/tls/legacy-settings configuration file
+which can be created by the system administrator which contains lines with
+simple Key Value pairs.
+
+The library recognizes the following possible configuration settings in
+that file:
+
+LegacySigningMDs md2 md5
+MinimumDHBits 512
+
+The LegacySigningMDs option allows reenabling support for verification of
+signatures with the specified hash algorithms. These can be any combination
+of md2, md4, md5 and sha. (sha represents SHA0 algorithm, not SHA1.) Any
+unrecognized algorithms are ignored.
+
+The MinimumDHBits option allows setting of the minimum bit size of DH group
+accepted by SSL/TLS client. It can be any value between 512 and 10000.
+
+If the configuration file is not present the built-in defaults (that is the
+secure defaults) are used. Any unrecognized lines (with other parameter
+names or comments) are ignored.

compat-openssl10.spec

@@ -0,0 +1,480 @@
+# For the curious:
+# 0.9.5a soversion = 0
+# 0.9.6  soversion = 1
+# 0.9.6a soversion = 2
+# 0.9.6c soversion = 3
+# 0.9.7a soversion = 4
+# 0.9.7ef soversion = 5
+# 0.9.8ab soversion = 6
+# 0.9.8g soversion = 7
+# 0.9.8jk + EAP-FAST soversion = 8
+# 1.0.0 soversion = 10
+%global soversion 10
+# Number of threads to spawn when testing some threading fixes.
+%global thread_test_threads %{?threads:%{threads}}%{!?threads:1}
+
+# Arches on which we need to prevent arch conflicts on opensslconf.h, must
+# also be handled in opensslconf-new.h.
+%global multilib_arches %{ix86} ia64 %{mips} ppc %{power64} s390 s390x sparcv9 sparc64 x86_64
+
+%global _performance_build 1
+
+Summary: Compatibility version of the OpenSSL library
+Name: compat-openssl10
+Version: 1.0.2o
+Release: 4%{?dist}
+Epoch: 1
+# We have to remove certain patented algorithms from the openssl source
+# tarball with the hobble-openssl script which is included below.
+# The original openssl upstream tarball cannot be shipped in the .src.rpm.
+Source: openssl-%{version}-hobbled.tar.xz
+Source1: hobble-openssl
+Source2: Makefile.certificate
+Source5: README.legacy-settings
+Source6: make-dummy-cert
+Source7: renew-dummy-cert
+Source8: openssl-thread-test.c
+Source9: opensslconf-new.h
+Source10: opensslconf-new-warning.h
+Source11: README.FIPS
+Source12: ec_curve.c
+Source13: ectest.c
+# Build changes
+Patch1: openssl-1.0.2e-rpmbuild.patch
+Patch2: openssl-1.0.2a-defaults.patch
+Patch4: openssl-1.0.2i-enginesdir.patch
+Patch5: openssl-1.0.2a-no-rpath.patch
+Patch6: openssl-1.0.2o-test-use-localhost.patch
+Patch7: openssl-1.0.0-timezone.patch
+Patch8: openssl-1.0.1c-perlfind.patch
+Patch9: openssl-1.0.1c-aliasing.patch
+Patch10: openssl-1.0.2o-conf-10.patch
+# Bug fixes
+Patch23: openssl-1.0.2c-default-paths.patch
+Patch24: openssl-1.0.2a-issuer-hash.patch
+# Functionality changes
+Patch33: openssl-1.0.0-beta4-ca-dir.patch
+Patch34: openssl-1.0.2a-x509.patch
+Patch35: openssl-1.0.2a-version-add-engines.patch
+Patch39: openssl-1.0.2o-ipv6-apps.patch
+Patch40: openssl-1.0.2o-fips.patch
+Patch45: openssl-1.0.2a-env-zlib.patch
+Patch47: openssl-1.0.2a-readme-warning.patch
+Patch49: openssl-1.0.1i-algo-doc.patch
+Patch50: openssl-1.0.2a-dtls1-abi.patch
+Patch51: openssl-1.0.2a-version.patch
+Patch56: openssl-1.0.2a-rsa-x931.patch
+Patch58: openssl-1.0.2a-fips-md5-allow.patch
+Patch60: openssl-1.0.2a-apps-dgst.patch
+Patch63: openssl-1.0.2a-xmpp-starttls.patch
+Patch65: openssl-1.0.2i-chil-fixes.patch
+Patch66: openssl-1.0.2h-pkgconfig.patch
+Patch68: openssl-1.0.2m-secure-getenv.patch
+Patch70: openssl-1.0.2a-fips-ec.patch
+Patch71: openssl-1.0.2m-manfix.patch
+Patch72: openssl-1.0.2a-fips-ctor.patch
+Patch73: openssl-1.0.2c-ecc-suiteb.patch
+Patch74: openssl-1.0.2j-deprecate-algos.patch
+Patch75: openssl-1.0.2a-compat-symbols.patch
+Patch76: openssl-1.0.2o-new-fips-reqs.patch
+Patch77: openssl-1.0.2j-downgrade-strength.patch
+Patch78: openssl-1.0.2o-cc-reqs.patch
+Patch90: openssl-1.0.2i-enc-fail.patch
+Patch92: openssl-1.0.2o-system-cipherlist.patch
+Patch93: openssl-1.0.2g-disable-sslv2v3.patch
+Patch94: openssl-1.0.2d-secp256k1.patch
+Patch95: openssl-1.0.2e-remove-nistp224.patch
+Patch96: openssl-1.0.2e-speed-doc.patch
+Patch97: openssl-1.0.2j-nokrb5-abi.patch
+Patch98: openssl-1.0.2k-long-hello.patch
+Patch99: openssl-1.0.2k-fips-randlock.patch
+# Backported fixes including security fixes
+Patch80: openssl-1.0.2o-wrap-pad.patch
+Patch81: openssl-1.0.2a-padlock64.patch
+Patch82: openssl-1.0.2m-trusted-first-doc.patch
+Patch83: openssl-1.0.2o-cve-2022-0778.patch
+
+License: OpenSSL
+Group: System Environment/Libraries
+URL: http://www.openssl.org/
+BuildRequires: gcc
+BuildRequires: coreutils, perl-interpreter, perl-generators, sed, zlib-devel, /usr/bin/cmp
+BuildRequires: lksctp-tools-devel
+BuildRequires: /usr/bin/rename
+BuildRequires: /usr/bin/pod2man
+Requires: coreutils, make
+Requires: crypto-policies
+Conflicts: openssl < 1:1.1.0, openssl-libs < 1:1.1.0
+
+%description
+The OpenSSL toolkit provides support for secure communications between
+machines. This version of OpenSSL package contains only the libraries
+and is provided for compatibility with previous releases and software
+that does not support compilation with OpenSSL-1.1.
+
+%if 0%{?fedora} < 30 && 0%{?rhel} == 0
+%package devel
+Summary: Files for development of applications which have to use OpenSSL-1.0.2
+Group: Development/Libraries
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: zlib-devel%{?_isa}
+Requires: pkgconfig
+# The devel subpackage intentionally conflicts with main openssl-devel
+# as simultaneous use of both openssl package cannot be encouraged.
+# Making the packages non-conflicting would also require further
+# changes in the dependent packages.
+Conflicts: openssl-devel
+
+%description devel
+The OpenSSL toolkit provides support for secure communications between
+machines. This version of OpenSSL package contains only the libraries
+and is provided for compatibility with previous releases and software
+that does not support compilation with OpenSSL-1.1. This package
+contains include files needed to develop applications which
+support various cryptographic algorithms and protocols.
+%endif
+
+%prep
+%setup -q -n openssl-%{version}
+
+# The hobble_openssl is called here redundantly, just to be sure.
+# The tarball has already the sources removed.
+%{SOURCE1} > /dev/null
+
+cp %{SOURCE12} %{SOURCE13} crypto/ec/
+
+%patch1 -p1 -b .rpmbuild
+%patch2 -p1 -b .defaults
+%patch4 -p1 -b .enginesdir %{?_rawbuild}
+%patch5 -p1 -b .no-rpath
+%patch6 -p1 -b .use-localhost
+%patch7 -p1 -b .timezone
+%patch8 -p1 -b .perlfind %{?_rawbuild}
+%patch9 -p1 -b .aliasing
+%patch10 -p1 -b .conf-10
+
+%patch23 -p1 -b .default-paths
+%patch24 -p1 -b .issuer-hash
+
+%patch33 -p1 -b .ca-dir
+%patch34 -p1 -b .x509
+%patch35 -p1 -b .version-add-engines
+%patch39 -p1 -b .ipv6-apps
+%patch40 -p1 -b .fips
+%patch45 -p1 -b .env-zlib
+%patch47 -p1 -b .warning
+%patch49 -p1 -b .algo-doc
+%patch50 -p1 -b .dtls1-abi
+%patch51 -p1 -b .version
+%patch56 -p1 -b .x931
+%patch58 -p1 -b .md5-allow
+%patch60 -p1 -b .dgst
+%patch63 -p1 -b .starttls
+%patch65 -p1 -b .chil
+%patch66 -p1 -b .pkgconfig
+%patch68 -p1 -b .secure-getenv
+%patch70 -p1 -b .fips-ec
+%patch71 -p1 -b .manfix
+%patch72 -p1 -b .fips-ctor
+%patch73 -p1 -b .suiteb
+%patch74 -p1 -b .deprecate-algos
+%patch75 -p1 -b .compat
+%patch76 -p1 -b .fips-reqs
+%patch77 -p1 -b .strength
+%patch78 -p1 -b .cc-reqs
+%patch90 -p1 -b .enc-fail
+%patch92 -p1 -b .system
+%patch93 -p1 -b .v2v3
+%patch94 -p1 -b .secp256k1
+%patch95 -p1 -b .nistp224
+%patch96 -p1 -b .speed-doc
+%patch97 -p1 -b .nokrb5-abi
+%patch98 -p1 -b .long-hello
+%patch99 -p1 -b .randlock
+
+%patch80 -p1 -b .wrap
+%patch81 -p1 -b .padlock64
+%patch82 -p1 -b .trusted-first
+%patch83 -p1 -b .cve-2022-0778
+
+sed -i 's/SHLIB_VERSION_NUMBER "1.0.0"/SHLIB_VERSION_NUMBER "%{version}"/' crypto/opensslv.h
+
+# Modify the various perl scripts to reference perl in the right location.
+perl util/perlpath.pl `dirname %{__perl}`
+
+# Generate a table with the compile settings for my perusal.
+touch Makefile
+make TABLE PERL=%{__perl}
+
+cp apps/openssl.cnf apps/openssl10.cnf
+
+%build
+# Figure out which flags we want to use.
+# default
+sslarch=%{_os}-%{_target_cpu}
+%ifarch %ix86
+sslarch=linux-elf
+if ! echo %{_target} | grep -q i686 ; then
+    sslflags="no-asm 386"
+fi
+%endif
+%ifarch x86_64
+sslflags=enable-ec_nistp_64_gcc_128
+%endif
+%ifarch sparcv9
+sslarch=linux-sparcv9
+sslflags=no-asm
+%endif
+%ifarch sparc64
+sslarch=linux64-sparcv9
+sslflags=no-asm
+%endif
+%ifarch alpha alphaev56 alphaev6 alphaev67
+sslarch=linux-alpha-gcc
+%endif
+%ifarch s390 sh3eb sh4eb
+sslarch="linux-generic32 -DB_ENDIAN"
+%endif
+%ifarch s390x
+sslarch="linux64-s390x"
+%endif
+%ifarch %{arm}
+sslarch=linux-armv4
+%endif
+%ifarch aarch64
+sslarch=linux-aarch64
+sslflags=enable-ec_nistp_64_gcc_128
+%endif
+%ifarch sh3 sh4
+sslarch=linux-generic32
+%endif
+%ifarch ppc64 ppc64p7
+sslarch=linux-ppc64
+%endif
+%ifarch ppc64le
+sslarch="linux-ppc64le"
+sslflags=enable-ec_nistp_64_gcc_128
+%endif
+%ifarch mips mipsel
+sslarch="linux-mips32 -mips32r2"
+%endif
+%ifarch mips64 mips64el
+sslarch="linux64-mips64 -mips64r2"
+%endif
+%ifarch mips64el
+sslflags=enable-ec_nistp_64_gcc_128
+%endif
+%ifarch riscv64
+sslarch=linux-generic64
+%endif
+
+# ia64, x86_64, ppc are OK by default
+# Configure the build tree.  Override OpenSSL defaults with known-good defaults
+# usable on all platforms.  The Configure script already knows to use -fPIC and
+# RPM_OPT_FLAGS, so we can skip specifiying them here.
+./Configure \
+    --prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
+    --system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \
+    zlib sctp enable-camellia enable-seed enable-tlsext enable-rfc3779 \
+    enable-cms enable-md2 enable-rc5 \
+    no-mdc2 no-ec2m no-gost no-srp no-krb5 \
+    --enginesdir=%{_libdir}/openssl/engines \
+    shared  ${sslarch} %{?!nofips:fips}
+
+# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
+# marked as not requiring an executable stack.
+# Also add -DPURIFY to make using valgrind with openssl easier as we do not
+# want to depend on the uninitialized memory as a source of entropy anyway.
+RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DPURIFY"
+make depend
+make all
+
+# Generate hashes for the included certs.
+make rehash
+
+# Overwrite FIPS README and copy README.legacy-settings
+cp -f %{SOURCE5} %{SOURCE11} .
+
+# Clean up the .pc files
+for i in libcrypto.pc libssl.pc openssl.pc ; do
+  sed -i '/^Libs.private:/{s/-L[^ ]* //;s/-Wl[^ ]* //}' $i
+done
+
+%check
+# Verify that what was compiled actually works.
+
+# We must revert patch33 before tests otherwise they will fail
+patch -p1 -R < %{PATCH33}
+cp apps/openssl.cnf apps/openssl10.cnf
+
+LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
+export LD_LIBRARY_PATH
+OPENSSL_ENABLE_MD5_VERIFY=
+export OPENSSL_ENABLE_MD5_VERIFY
+make -C test apps tests
+%{__cc} -o openssl-thread-test \
+    -I./include \
+    $RPM_OPT_FLAGS \
+    %{SOURCE8} \
+    -L. \
+    -lssl -lcrypto \
+    -lpthread -lz -ldl
+./openssl-thread-test --threads %{thread_test_threads}
+
+# Add generation of HMAC checksum of the final stripped library
+%define __spec_install_post \
+    %{?__debug_package:%{__debug_install_post}} \
+    %{__arch_install_post} \
+    %{__os_install_post} \
+    crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libcrypto.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{version}.hmac \
+    ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{soversion}.hmac \
+    crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libssl.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{version}.hmac \
+    ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{soversion}.hmac \
+%{nil}
+
+%define __provides_exclude_from %{_libdir}/openssl
+
+%install
+[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
+# Install OpenSSL.
+install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl}
+make INSTALL_PREFIX=$RPM_BUILD_ROOT install
+make INSTALL_PREFIX=$RPM_BUILD_ROOT install_docs
+mv $RPM_BUILD_ROOT%{_libdir}/engines $RPM_BUILD_ROOT%{_libdir}/openssl
+mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man/* $RPM_BUILD_ROOT%{_mandir}/
+rmdir $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man
+rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT%{_libdir}/*.so.%{soversion}
+for lib in $RPM_BUILD_ROOT%{_libdir}/*.so.%{version} ; do
+    chmod 755 ${lib}
+    ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
+done
+
+# Delete static library
+rm -f $RPM_BUILD_ROOT%{_libdir}/*.a || :
+
+# Rename man pages so that they don't conflict with other system man pages.
+pushd $RPM_BUILD_ROOT%{_mandir}
+for manpage in man*/* ; do
+	if [ -L ${manpage} ]; then
+		TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
+		ln -snf ${TARGET}ssl ${manpage}ssl
+		rm -f ${manpage}
+	else
+		mv ${manpage} ${manpage}ssl
+	fi
+done
+popd
+
+# Delete non-devel man pages in the compat package
+rm -rf $RPM_BUILD_ROOT%{_mandir}/man[157]*
+
+# Delete configuration files
+rm -rf  $RPM_BUILD_ROOT%{_sysconfdir}/pki/*
+
+# Remove binaries
+rm -rf $RPM_BUILD_ROOT/%{_bindir}
+
+# Remove engines
+rm -rf $RPM_BUILD_ROOT/%{_libdir}/openssl
+
+%if 0%{?fedora} >= 30 || 0%{?rhel} != 0
+# Delete devel files
+rm -rf $RPM_BUILD_ROOT%{_includedir}/openssl
+rm -rf $RPM_BUILD_ROOT%{_mandir}/man3*
+rm -rf $RPM_BUILD_ROOT%{_libdir}/*.so
+rm -rf $RPM_BUILD_ROOT%{_libdir}/pkgconfig
+%endif
+
+# Install compat config file
+install -m 644 apps/openssl10.cnf $RPM_BUILD_ROOT%{_sysconfdir}/pki/openssl10.cnf
+
+%files
+%license LICENSE
+%doc FAQ NEWS README
+%doc README.FIPS
+%doc README.legacy-settings
+
+%attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}
+%attr(0755,root,root) %{_libdir}/libcrypto.so.%{soversion}
+%attr(0755,root,root) %{_libdir}/libssl.so.%{version}
+%attr(0755,root,root) %{_libdir}/libssl.so.%{soversion}
+%attr(0644,root,root) %{_libdir}/.libcrypto.so.*.hmac
+%attr(0644,root,root) %{_libdir}/.libssl.so.*.hmac
+
+%dir %{_sysconfdir}/pki
+%attr(0644,root,root) %{_sysconfdir}/pki/openssl10.cnf
+
+%if 0%{?fedora} < 30 && 0%{?rhel} == 0
+%files devel
+%doc doc/c-indentation.el doc/openssl.txt CHANGES
+%{_prefix}/include/openssl
+%attr(0755,root,root) %{_libdir}/*.so
+%attr(0644,root,root) %{_mandir}/man3*/*
+%attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
+%endif
+
+%post -p /sbin/ldconfig
+
+%postun -p /sbin/ldconfig
+
+%changelog
+* Wed May 04 2022 Clemens Lang <cllang@redhat.com> - 1:1.0.2o-4
+- Fix CVE-2022-0778: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
+  Resolves: rhbz#2077417
+
+* Fri Aug  3 2018 Tomáš Mráz <tmraz@redhat.com> 1.0.2o-3
+- provide and use compat openssl10.cnf as the non-compat one is incompatible
+
+* Thu Apr  5 2018 Tomáš Mráz <tmraz@redhat.com> 1.0.2o-1
+- minor upstream release 1.0.2o fixing security issues
+
+* Sun Mar 11 2018 Stefan O'Rear <sorear2@gmail.com> 1:1.0.2n-4
+- Add flags for riscv64.
+
+* Fri Feb 23 2018 Tomáš Mráz <tmraz@redhat.com> 1.0.2n-3
+- apply RPM_LD_FLAGS properly (#1548117)
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.0.2n-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Jan 18 2018 Tomáš Mráz <tmraz@redhat.com> 1.0.2n-1
+- minor upstream release 1.0.2n fixing security issues
+
+* Mon Nov 13 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2m-1
+- minor upstream release 1.0.2m fixing security issues
+- fix locking of RNG in FIPS mode for some obscure use-cases
+
+* Mon Aug 21 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-9
+- add missing ldconfig call to post script
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.0.2j-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.0.2j-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.0.2j-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Thu Oct 20 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-5
+- fix -devel subpackage conflict with man-pages package (#1387175)
+
+* Fri Oct 14 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-4
+- correct wrong Requires in -devel subpackage
+
+* Fri Oct 14 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-3
+- add back -devel subpackage as a stop-gap measure for software
+  that cannot be ported to new API easily
+
+* Fri Oct  7 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-2
+- removed Buildroot and clean section
+- added Conflicts with old openssl
+
+* Thu Oct  6 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-1
+- updated to 1.0.2j and modified Summary
+
+* Thu Oct  6 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2i-3
+- renamed to compat-openssl10, additional cleanups
+
+* Fri Sep 23 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2i-2
+- compat package created

ec_curve.c

@@ -0,0 +1,455 @@
+/* crypto/ec/ec_curve.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project.
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2010 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+
+#include <string.h>
+#include "ec_lcl.h"
+#include <openssl/err.h>
+#include <openssl/obj_mac.h>
+#include <openssl/opensslconf.h>
+
+#ifdef OPENSSL_FIPS
+# include <openssl/fips.h>
+#endif
+
+typedef struct {
+    int field_type,             /* either NID_X9_62_prime_field or
+                                 * NID_X9_62_characteristic_two_field */
+     seed_len, param_len;
+    unsigned int cofactor;      /* promoted to BN_ULONG */
+} EC_CURVE_DATA;
+
+/* the nist prime curves */
+static const struct {
+    EC_CURVE_DATA h;
+    unsigned char data[20 + 48 * 6];
+} _EC_NIST_PRIME_384 = {
+    {
+        NID_X9_62_prime_field, 20, 48, 1
+    },
+    {
+        /* seed */
+        0xA3, 0x35, 0x92, 0x6A, 0xA3, 0x19, 0xA2, 0x7A, 0x1D, 0x00, 0x89, 0x6A,
+        0x67, 0x73, 0xA4, 0x82, 0x7A, 0xCD, 0xAC, 0x73,
+        /* p */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        /* a */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFC,
+        /* b */
+        0xB3, 0x31, 0x2F, 0xA7, 0xE2, 0x3E, 0xE7, 0xE4, 0x98, 0x8E, 0x05, 0x6B,
+        0xE3, 0xF8, 0x2D, 0x19, 0x18, 0x1D, 0x9C, 0x6E, 0xFE, 0x81, 0x41, 0x12,
+        0x03, 0x14, 0x08, 0x8F, 0x50, 0x13, 0x87, 0x5A, 0xC6, 0x56, 0x39, 0x8D,
+        0x8A, 0x2E, 0xD1, 0x9D, 0x2A, 0x85, 0xC8, 0xED, 0xD3, 0xEC, 0x2A, 0xEF,
+        /* x */
+        0xAA, 0x87, 0xCA, 0x22, 0xBE, 0x8B, 0x05, 0x37, 0x8E, 0xB1, 0xC7, 0x1E,
+        0xF3, 0x20, 0xAD, 0x74, 0x6E, 0x1D, 0x3B, 0x62, 0x8B, 0xA7, 0x9B, 0x98,
+        0x59, 0xF7, 0x41, 0xE0, 0x82, 0x54, 0x2A, 0x38, 0x55, 0x02, 0xF2, 0x5D,
+        0xBF, 0x55, 0x29, 0x6C, 0x3A, 0x54, 0x5E, 0x38, 0x72, 0x76, 0x0A, 0xB7,
+        /* y */
+        0x36, 0x17, 0xde, 0x4a, 0x96, 0x26, 0x2c, 0x6f, 0x5d, 0x9e, 0x98, 0xbf,
+        0x92, 0x92, 0xdc, 0x29, 0xf8, 0xf4, 0x1d, 0xbd, 0x28, 0x9a, 0x14, 0x7c,
+        0xe9, 0xda, 0x31, 0x13, 0xb5, 0xf0, 0xb8, 0xc0, 0x0a, 0x60, 0xb1, 0xce,
+        0x1d, 0x7e, 0x81, 0x9d, 0x7a, 0x43, 0x1d, 0x7c, 0x90, 0xea, 0x0e, 0x5f,
+        /* order */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xC7, 0x63, 0x4D, 0x81, 0xF4, 0x37, 0x2D, 0xDF, 0x58, 0x1A, 0x0D, 0xB2,
+        0x48, 0xB0, 0xA7, 0x7A, 0xEC, 0xEC, 0x19, 0x6A, 0xCC, 0xC5, 0x29, 0x73
+    }
+};
+
+static const struct {
+    EC_CURVE_DATA h;
+    unsigned char data[20 + 66 * 6];
+} _EC_NIST_PRIME_521 = {
+    {
+        NID_X9_62_prime_field, 20, 66, 1
+    },
+    {
+        /* seed */
+        0xD0, 0x9E, 0x88, 0x00, 0x29, 0x1C, 0xB8, 0x53, 0x96, 0xCC, 0x67, 0x17,
+        0x39, 0x32, 0x84, 0xAA, 0xA0, 0xDA, 0x64, 0xBA,
+        /* p */
+        0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        /* a */
+        0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
+        /* b */
+        0x00, 0x51, 0x95, 0x3E, 0xB9, 0x61, 0x8E, 0x1C, 0x9A, 0x1F, 0x92, 0x9A,
+        0x21, 0xA0, 0xB6, 0x85, 0x40, 0xEE, 0xA2, 0xDA, 0x72, 0x5B, 0x99, 0xB3,
+        0x15, 0xF3, 0xB8, 0xB4, 0x89, 0x91, 0x8E, 0xF1, 0x09, 0xE1, 0x56, 0x19,
+        0x39, 0x51, 0xEC, 0x7E, 0x93, 0x7B, 0x16, 0x52, 0xC0, 0xBD, 0x3B, 0xB1,
+        0xBF, 0x07, 0x35, 0x73, 0xDF, 0x88, 0x3D, 0x2C, 0x34, 0xF1, 0xEF, 0x45,
+        0x1F, 0xD4, 0x6B, 0x50, 0x3F, 0x00,
+        /* x */
+        0x00, 0xC6, 0x85, 0x8E, 0x06, 0xB7, 0x04, 0x04, 0xE9, 0xCD, 0x9E, 0x3E,
+        0xCB, 0x66, 0x23, 0x95, 0xB4, 0x42, 0x9C, 0x64, 0x81, 0x39, 0x05, 0x3F,
+        0xB5, 0x21, 0xF8, 0x28, 0xAF, 0x60, 0x6B, 0x4D, 0x3D, 0xBA, 0xA1, 0x4B,
+        0x5E, 0x77, 0xEF, 0xE7, 0x59, 0x28, 0xFE, 0x1D, 0xC1, 0x27, 0xA2, 0xFF,
+        0xA8, 0xDE, 0x33, 0x48, 0xB3, 0xC1, 0x85, 0x6A, 0x42, 0x9B, 0xF9, 0x7E,
+        0x7E, 0x31, 0xC2, 0xE5, 0xBD, 0x66,
+        /* y */
+        0x01, 0x18, 0x39, 0x29, 0x6a, 0x78, 0x9a, 0x3b, 0xc0, 0x04, 0x5c, 0x8a,
+        0x5f, 0xb4, 0x2c, 0x7d, 0x1b, 0xd9, 0x98, 0xf5, 0x44, 0x49, 0x57, 0x9b,
+        0x44, 0x68, 0x17, 0xaf, 0xbd, 0x17, 0x27, 0x3e, 0x66, 0x2c, 0x97, 0xee,
+        0x72, 0x99, 0x5e, 0xf4, 0x26, 0x40, 0xc5, 0x50, 0xb9, 0x01, 0x3f, 0xad,
+        0x07, 0x61, 0x35, 0x3c, 0x70, 0x86, 0xa2, 0x72, 0xc2, 0x40, 0x88, 0xbe,
+        0x94, 0x76, 0x9f, 0xd1, 0x66, 0x50,
+        /* order */
+        0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFA, 0x51, 0x86,
+        0x87, 0x83, 0xBF, 0x2F, 0x96, 0x6B, 0x7F, 0xCC, 0x01, 0x48, 0xF7, 0x09,
+        0xA5, 0xD0, 0x3B, 0xB5, 0xC9, 0xB8, 0x89, 0x9C, 0x47, 0xAE, 0xBB, 0x6F,
+        0xB7, 0x1E, 0x91, 0x38, 0x64, 0x09
+    }
+};
+
+static const struct {
+    EC_CURVE_DATA h;
+    unsigned char data[20 + 32 * 6];
+} _EC_X9_62_PRIME_256V1 = {
+    {
+        NID_X9_62_prime_field, 20, 32, 1
+    },
+    {
+        /* seed */
+        0xC4, 0x9D, 0x36, 0x08, 0x86, 0xE7, 0x04, 0x93, 0x6A, 0x66, 0x78, 0xE1,
+        0x13, 0x9D, 0x26, 0xB7, 0x81, 0x9F, 0x7E, 0x90,
+        /* p */
+        0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        /* a */
+        0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
+        /* b */
+        0x5A, 0xC6, 0x35, 0xD8, 0xAA, 0x3A, 0x93, 0xE7, 0xB3, 0xEB, 0xBD, 0x55,
+        0x76, 0x98, 0x86, 0xBC, 0x65, 0x1D, 0x06, 0xB0, 0xCC, 0x53, 0xB0, 0xF6,
+        0x3B, 0xCE, 0x3C, 0x3E, 0x27, 0xD2, 0x60, 0x4B,
+        /* x */
+        0x6B, 0x17, 0xD1, 0xF2, 0xE1, 0x2C, 0x42, 0x47, 0xF8, 0xBC, 0xE6, 0xE5,
+        0x63, 0xA4, 0x40, 0xF2, 0x77, 0x03, 0x7D, 0x81, 0x2D, 0xEB, 0x33, 0xA0,
+        0xF4, 0xA1, 0x39, 0x45, 0xD8, 0x98, 0xC2, 0x96,
+        /* y */
+        0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb, 0x4a,
+        0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce,
+        0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5,
+        /* order */
+        0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84,
+        0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51
+    }
+};
+
+typedef struct _ec_list_element_st {
+    int nid;
+    const EC_CURVE_DATA *data;
+    const EC_METHOD *(*meth) (void);
+    const char *comment;
+} ec_list_element;
+
+static const ec_list_element curve_list[] = {
+    /* prime field curves */
+    /* secg curves */
+    /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */
+    {NID_secp384r1, &_EC_NIST_PRIME_384.h, 0,
+     "NIST/SECG curve over a 384 bit prime field"},
+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+    {NID_secp521r1, &_EC_NIST_PRIME_521.h, EC_GFp_nistp521_method,
+     "NIST/SECG curve over a 521 bit prime field"},
+#else
+    {NID_secp521r1, &_EC_NIST_PRIME_521.h, 0,
+     "NIST/SECG curve over a 521 bit prime field"},
+#endif
+    /* X9.62 curves */
+    {NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h,
+#if defined(ECP_NISTZ256_ASM)
+     EC_GFp_nistz256_method,
+#elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128)
+     EC_GFp_nistp256_method,
+#else
+     0,
+#endif
+     "X9.62/SECG curve over a 256 bit prime field"},
+};
+
+#define curve_list_length (sizeof(curve_list)/sizeof(ec_list_element))
+
+static EC_GROUP *ec_group_new_from_data(const ec_list_element curve)
+{
+    EC_GROUP *group = NULL;
+    EC_POINT *P = NULL;
+    BN_CTX *ctx = NULL;
+    BIGNUM *p = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL, *order =
+        NULL;
+    int ok = 0;
+    int seed_len, param_len;
+    const EC_METHOD *meth;
+    const EC_CURVE_DATA *data;
+    const unsigned char *params;
+
+    if ((ctx = BN_CTX_new()) == NULL) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    data = curve.data;
+    seed_len = data->seed_len;
+    param_len = data->param_len;
+    params = (const unsigned char *)(data + 1); /* skip header */
+    params += seed_len;         /* skip seed */
+
+    if (!(p = BN_bin2bn(params + 0 * param_len, param_len, NULL))
+        || !(a = BN_bin2bn(params + 1 * param_len, param_len, NULL))
+        || !(b = BN_bin2bn(params + 2 * param_len, param_len, NULL))) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+        goto err;
+    }
+
+    if (curve.meth != 0) {
+        meth = curve.meth();
+        if (((group = EC_GROUP_new(meth)) == NULL) ||
+            (!(group->meth->group_set_curve(group, p, a, b, ctx)))) {
+            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+            goto err;
+        }
+    } else if (data->field_type == NID_X9_62_prime_field) {
+        if ((group = EC_GROUP_new_curve_GFp(p, a, b, ctx)) == NULL) {
+            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+            goto err;
+        }
+    }
+#ifndef OPENSSL_NO_EC2M
+    else {                      /* field_type ==
+                                 * NID_X9_62_characteristic_two_field */
+
+        if ((group = EC_GROUP_new_curve_GF2m(p, a, b, ctx)) == NULL) {
+            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+            goto err;
+        }
+    }
+#endif
+
+    if ((P = EC_POINT_new(group)) == NULL) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+        goto err;
+    }
+
+    if (!(x = BN_bin2bn(params + 3 * param_len, param_len, NULL))
+        || !(y = BN_bin2bn(params + 4 * param_len, param_len, NULL))) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+        goto err;
+    }
+    if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx)) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+        goto err;
+    }
+    if (!(order = BN_bin2bn(params + 5 * param_len, param_len, NULL))
+        || !BN_set_word(x, (BN_ULONG)data->cofactor)) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+        goto err;
+    }
+    if (!EC_GROUP_set_generator(group, P, order, x)) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+        goto err;
+    }
+    if (seed_len) {
+        if (!EC_GROUP_set_seed(group, params - seed_len, seed_len)) {
+            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+            goto err;
+        }
+    }
+    ok = 1;
+ err:
+    if (!ok) {
+        EC_GROUP_free(group);
+        group = NULL;
+    }
+    if (P)
+        EC_POINT_free(P);
+    if (ctx)
+        BN_CTX_free(ctx);
+    if (p)
+        BN_free(p);
+    if (a)
+        BN_free(a);
+    if (b)
+        BN_free(b);
+    if (order)
+        BN_free(order);
+    if (x)
+        BN_free(x);
+    if (y)
+        BN_free(y);
+    return group;
+}
+
+EC_GROUP *EC_GROUP_new_by_curve_name(int nid)
+{
+    size_t i;
+    EC_GROUP *ret = NULL;
+
+    if (nid <= 0)
+        return NULL;
+
+    for (i = 0; i < curve_list_length; i++)
+        if (curve_list[i].nid == nid) {
+            ret = ec_group_new_from_data(curve_list[i]);
+            break;
+        }
+
+    if (ret == NULL) {
+        ECerr(EC_F_EC_GROUP_NEW_BY_CURVE_NAME, EC_R_UNKNOWN_GROUP);
+        return NULL;
+    }
+
+    EC_GROUP_set_curve_name(ret, nid);
+
+    return ret;
+}
+
+size_t EC_get_builtin_curves(EC_builtin_curve *r, size_t nitems)
+{
+    size_t i, min;
+
+    if (r == NULL || nitems == 0)
+        return curve_list_length;
+
+    min = nitems < curve_list_length ? nitems : curve_list_length;
+
+    for (i = 0; i < min; i++) {
+        r[i].nid = curve_list[i].nid;
+        r[i].comment = curve_list[i].comment;
+    }
+
+    return curve_list_length;
+}
+
+/* Functions to translate between common NIST curve names and NIDs */
+
+typedef struct {
+    const char *name;           /* NIST Name of curve */
+    int nid;                    /* Curve NID */
+} EC_NIST_NAME;
+
+static EC_NIST_NAME nist_curves[] = {
+    {"B-163", NID_sect163r2},
+    {"B-233", NID_sect233r1},
+    {"B-283", NID_sect283r1},
+    {"B-409", NID_sect409r1},
+    {"B-571", NID_sect571r1},
+    {"K-163", NID_sect163k1},
+    {"K-233", NID_sect233k1},
+    {"K-283", NID_sect283k1},
+    {"K-409", NID_sect409k1},
+    {"K-571", NID_sect571k1},
+    {"P-192", NID_X9_62_prime192v1},
+    {"P-224", NID_secp224r1},
+    {"P-256", NID_X9_62_prime256v1},
+    {"P-384", NID_secp384r1},
+    {"P-521", NID_secp521r1}
+};
+
+const char *EC_curve_nid2nist(int nid)
+{
+    size_t i;
+    for (i = 0; i < sizeof(nist_curves) / sizeof(EC_NIST_NAME); i++) {
+        if (nist_curves[i].nid == nid)
+            return nist_curves[i].name;
+    }
+    return NULL;
+}
+
+int EC_curve_nist2nid(const char *name)
+{
+    size_t i;
+    for (i = 0; i < sizeof(nist_curves) / sizeof(EC_NIST_NAME); i++) {
+        if (!strcmp(nist_curves[i].name, name))
+            return nist_curves[i].nid;
+    }
+    return NID_undef;
+}

ectest.c

@@ -0,0 +1,994 @@
+/* crypto/ec/ectest.c */
+/*
+ * Originally written by Bodo Moeller for the OpenSSL project.
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#ifdef FLAT_INC
+# include "e_os.h"
+#else
+# include "../e_os.h"
+#endif
+#include <string.h>
+#include <time.h>
+
+#ifdef OPENSSL_NO_EC
+int main(int argc, char *argv[])
+{
+    puts("Elliptic curves are disabled.");
+    return 0;
+}
+#else
+
+# include <openssl/ec.h>
+# ifndef OPENSSL_NO_ENGINE
+#  include <openssl/engine.h>
+# endif
+# include <openssl/err.h>
+# include <openssl/obj_mac.h>
+# include <openssl/objects.h>
+# include <openssl/rand.h>
+# include <openssl/bn.h>
+# include <openssl/opensslconf.h>
+
+# if defined(_MSC_VER) && defined(_MIPS_) && (_MSC_VER/100==12)
+/* suppress "too big too optimize" warning */
+#  pragma warning(disable:4959)
+# endif
+
+# define ABORT do { \
+        fflush(stdout); \
+        fprintf(stderr, "%s:%d: ABORT\n", __FILE__, __LINE__); \
+        ERR_print_errors_fp(stderr); \
+        EXIT(1); \
+} while (0)
+
+# define TIMING_BASE_PT 0
+# define TIMING_RAND_PT 1
+# define TIMING_SIMUL 2
+
+# if 0
+static void timings(EC_GROUP *group, int type, BN_CTX *ctx)
+{
+    clock_t clck;
+    int i, j;
+    BIGNUM *s;
+    BIGNUM *r[10], *r0[10];
+    EC_POINT *P;
+
+    s = BN_new();
+    if (s == NULL)
+        ABORT;
+
+    fprintf(stdout, "Timings for %d-bit field, ", EC_GROUP_get_degree(group));
+    if (!EC_GROUP_get_order(group, s, ctx))
+        ABORT;
+    fprintf(stdout, "%d-bit scalars ", (int)BN_num_bits(s));
+    fflush(stdout);
+
+    P = EC_POINT_new(group);
+    if (P == NULL)
+        ABORT;
+    EC_POINT_copy(P, EC_GROUP_get0_generator(group));
+
+    for (i = 0; i < 10; i++) {
+        if ((r[i] = BN_new()) == NULL)
+            ABORT;
+        if (!BN_pseudo_rand(r[i], BN_num_bits(s), 0, 0))
+            ABORT;
+        if (type != TIMING_BASE_PT) {
+            if ((r0[i] = BN_new()) == NULL)
+                ABORT;
+            if (!BN_pseudo_rand(r0[i], BN_num_bits(s), 0, 0))
+                ABORT;
+        }
+    }
+
+    clck = clock();
+    for (i = 0; i < 10; i++) {
+        for (j = 0; j < 10; j++) {
+            if (!EC_POINT_mul
+                (group, P, (type != TIMING_RAND_PT) ? r[i] : NULL,
+                 (type != TIMING_BASE_PT) ? P : NULL,
+                 (type != TIMING_BASE_PT) ? r0[i] : NULL, ctx))
+                ABORT;
+        }
+    }
+    clck = clock() - clck;
+
+    fprintf(stdout, "\n");
+
+#  ifdef CLOCKS_PER_SEC
+    /*
+     * "To determine the time in seconds, the value returned by the clock
+     * function should be divided by the value of the macro CLOCKS_PER_SEC."
+     * -- ISO/IEC 9899
+     */
+#   define UNIT "s"
+#  else
+    /*
+     * "`CLOCKS_PER_SEC' undeclared (first use this function)" -- cc on
+     * NeXTstep/OpenStep
+     */
+#   define UNIT "units"
+#   define CLOCKS_PER_SEC 1
+#  endif
+
+    if (type == TIMING_BASE_PT) {
+        fprintf(stdout, "%i %s in %.2f " UNIT "\n", i * j,
+                "base point multiplications", (double)clck / CLOCKS_PER_SEC);
+    } else if (type == TIMING_RAND_PT) {
+        fprintf(stdout, "%i %s in %.2f " UNIT "\n", i * j,
+                "random point multiplications",
+                (double)clck / CLOCKS_PER_SEC);
+    } else if (type == TIMING_SIMUL) {
+        fprintf(stdout, "%i %s in %.2f " UNIT "\n", i * j,
+                "s*P+t*Q operations", (double)clck / CLOCKS_PER_SEC);
+    }
+    fprintf(stdout, "average: %.4f " UNIT "\n",
+            (double)clck / (CLOCKS_PER_SEC * i * j));
+
+    EC_POINT_free(P);
+    BN_free(s);
+    for (i = 0; i < 10; i++) {
+        BN_free(r[i]);
+        if (type != TIMING_BASE_PT)
+            BN_free(r0[i]);
+    }
+}
+# endif
+
+/* test multiplication with group order, long and negative scalars */
+static void group_order_tests(EC_GROUP *group)
+{
+    BIGNUM *n1, *n2, *order;
+    EC_POINT *P = EC_POINT_new(group);
+    EC_POINT *Q = EC_POINT_new(group);
+    BN_CTX *ctx = BN_CTX_new();
+    int i;
+
+    n1 = BN_new();
+    n2 = BN_new();
+    order = BN_new();
+    fprintf(stdout, "verify group order ...");
+    fflush(stdout);
+    if (!EC_GROUP_get_order(group, order, ctx))
+        ABORT;
+    if (!EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
+        ABORT;
+    if (!EC_POINT_is_at_infinity(group, Q))
+        ABORT;
+    fprintf(stdout, ".");
+    fflush(stdout);
+    if (!EC_GROUP_precompute_mult(group, ctx))
+        ABORT;
+    if (!EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
+        ABORT;
+    if (!EC_POINT_is_at_infinity(group, Q))
+        ABORT;
+    fprintf(stdout, " ok\n");
+    fprintf(stdout, "long/negative scalar tests ");
+    for (i = 1; i <= 2; i++) {
+        const BIGNUM *scalars[6];
+        const EC_POINT *points[6];
+
+        fprintf(stdout, i == 1 ?
+                "allowing precomputation ... " :
+                "without precomputation ... ");
+        if (!BN_set_word(n1, i))
+            ABORT;
+        /*
+         * If i == 1, P will be the predefined generator for which
+         * EC_GROUP_precompute_mult has set up precomputation.
+         */
+        if (!EC_POINT_mul(group, P, n1, NULL, NULL, ctx))
+            ABORT;
+
+        if (!BN_one(n1))
+            ABORT;
+        /* n1 = 1 - order */
+        if (!BN_sub(n1, n1, order))
+            ABORT;
+        if (!EC_POINT_mul(group, Q, NULL, P, n1, ctx))
+            ABORT;
+        if (0 != EC_POINT_cmp(group, Q, P, ctx))
+            ABORT;
+
+        /* n2 = 1 + order */
+        if (!BN_add(n2, order, BN_value_one()))
+            ABORT;
+        if (!EC_POINT_mul(group, Q, NULL, P, n2, ctx))
+            ABORT;
+        if (0 != EC_POINT_cmp(group, Q, P, ctx))
+            ABORT;
+
+        /* n2 = (1 - order) * (1 + order) = 1 - order^2 */
+        if (!BN_mul(n2, n1, n2, ctx))
+            ABORT;
+        if (!EC_POINT_mul(group, Q, NULL, P, n2, ctx))
+            ABORT;
+        if (0 != EC_POINT_cmp(group, Q, P, ctx))
+            ABORT;
+
+        /* n2 = order^2 - 1 */
+        BN_set_negative(n2, 0);
+        if (!EC_POINT_mul(group, Q, NULL, P, n2, ctx))
+            ABORT;
+        /* Add P to verify the result. */
+        if (!EC_POINT_add(group, Q, Q, P, ctx))
+            ABORT;
+        if (!EC_POINT_is_at_infinity(group, Q))
+            ABORT;
+
+        /* Exercise EC_POINTs_mul, including corner cases. */
+        if (EC_POINT_is_at_infinity(group, P))
+            ABORT;
+        scalars[0] = n1;
+        points[0] = Q;          /* => infinity */
+        scalars[1] = n2;
+        points[1] = P;          /* => -P */
+        scalars[2] = n1;
+        points[2] = Q;          /* => infinity */
+        scalars[3] = n2;
+        points[3] = Q;          /* => infinity */
+        scalars[4] = n1;
+        points[4] = P;          /* => P */
+        scalars[5] = n2;
+        points[5] = Q;          /* => infinity */
+        if (!EC_POINTs_mul(group, P, NULL, 6, points, scalars, ctx))
+            ABORT;
+        if (!EC_POINT_is_at_infinity(group, P))
+            ABORT;
+    }
+    fprintf(stdout, "ok\n");
+
+    EC_POINT_free(P);
+    EC_POINT_free(Q);
+    BN_free(n1);
+    BN_free(n2);
+    BN_free(order);
+    BN_CTX_free(ctx);
+}
+
+static void prime_field_tests(void)
+{
+    BN_CTX *ctx = NULL;
+    BIGNUM *p, *a, *b;
+    EC_GROUP *group;
+    EC_GROUP *P_160 = NULL, *P_192 = NULL, *P_224 = NULL, *P_256 =
+        NULL, *P_384 = NULL, *P_521 = NULL;
+    EC_POINT *P, *Q, *R;
+    BIGNUM *x, *y, *z;
+    unsigned char buf[100];
+    size_t i, len;
+    int k;
+
+# if 1                          /* optional */
+    ctx = BN_CTX_new();
+    if (!ctx)
+        ABORT;
+# endif
+
+    p = BN_new();
+    a = BN_new();
+    b = BN_new();
+    if (!p || !a || !b)
+        ABORT;
+
+    group = EC_GROUP_new(EC_GFp_mont_method()); /* applications should use
+                                                 * EC_GROUP_new_curve_GFp so
+                                                 * that the library gets to
+                                                 * choose the EC_METHOD */
+    if (!group)
+        ABORT;
+
+    P = EC_POINT_new(group);
+    Q = EC_POINT_new(group);
+    R = EC_POINT_new(group);
+    if (!P || !Q || !R)
+        ABORT;
+
+    x = BN_new();
+    y = BN_new();
+    z = BN_new();
+    if (!x || !y || !z)
+        ABORT;
+
+    /* Curve P-256 (FIPS PUB 186-2, App. 6) */
+
+    if (!BN_hex2bn
+        (&p,
+         "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF"))
+        ABORT;
+    if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        ABORT;
+    if (!BN_hex2bn
+        (&a,
+         "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC"))
+        ABORT;
+    if (!BN_hex2bn
+        (&b,
+         "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B"))
+        ABORT;
+    if (!EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
+        ABORT;
+
+    if (!BN_hex2bn
+        (&x,
+         "6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296"))
+        ABORT;
+    if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
+        ABORT;
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
+        ABORT;
+    if (!BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E"
+                   "84F3B9CAC2FC632551"))
+        ABORT;
+    if (!EC_GROUP_set_generator(group, P, z, BN_value_one()))
+        ABORT;
+
+    if (!EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx))
+        ABORT;
+    fprintf(stdout, "\nNIST curve P-256 -- Generator:\n     x = 0x");
+    BN_print_fp(stdout, x);
+    fprintf(stdout, "\n     y = 0x");
+    BN_print_fp(stdout, y);
+    fprintf(stdout, "\n");
+    /* G_y value taken from the standard: */
+    if (!BN_hex2bn
+        (&z,
+         "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5"))
+        ABORT;
+    if (0 != BN_cmp(y, z))
+        ABORT;
+
+    fprintf(stdout, "verify degree ...");
+    if (EC_GROUP_get_degree(group) != 256)
+        ABORT;
+    fprintf(stdout, " ok\n");
+
+    group_order_tests(group);
+
+    if (!(P_256 = EC_GROUP_new(EC_GROUP_method_of(group))))
+        ABORT;
+    if (!EC_GROUP_copy(P_256, group))
+        ABORT;
+
+    /* Curve P-384 (FIPS PUB 186-2, App. 6) */
+
+    if (!BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                   "FFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF"))
+        ABORT;
+    if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        ABORT;
+    if (!BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                   "FFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC"))
+        ABORT;
+    if (!BN_hex2bn(&b, "B3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141"
+                   "120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF"))
+        ABORT;
+    if (!EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
+        ABORT;
+
+    if (!BN_hex2bn(&x, "AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B"
+                   "9859F741E082542A385502F25DBF55296C3A545E3872760AB7"))
+        ABORT;
+    if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1, ctx))
+        ABORT;
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
+        ABORT;
+    if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                   "FFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"))
+        ABORT;
+    if (!EC_GROUP_set_generator(group, P, z, BN_value_one()))
+        ABORT;
+
+    if (!EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx))
+        ABORT;
+    fprintf(stdout, "\nNIST curve P-384 -- Generator:\n     x = 0x");
+    BN_print_fp(stdout, x);
+    fprintf(stdout, "\n     y = 0x");
+    BN_print_fp(stdout, y);
+    fprintf(stdout, "\n");
+    /* G_y value taken from the standard: */
+    if (!BN_hex2bn(&z, "3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A14"
+                   "7CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F"))
+        ABORT;
+    if (0 != BN_cmp(y, z))
+        ABORT;
+
+    fprintf(stdout, "verify degree ...");
+    if (EC_GROUP_get_degree(group) != 384)
+        ABORT;
+    fprintf(stdout, " ok\n");
+
+    group_order_tests(group);
+
+    if (!(P_384 = EC_GROUP_new(EC_GROUP_method_of(group))))
+        ABORT;
+    if (!EC_GROUP_copy(P_384, group))
+        ABORT;
+
+    /* Curve P-521 (FIPS PUB 186-2, App. 6) */
+
+    if (!BN_hex2bn(&p, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                   "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                   "FFFFFFFFFFFFFFFFFFFFFFFFFFFF"))
+        ABORT;
+    if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        ABORT;
+    if (!BN_hex2bn(&a, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                   "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                   "FFFFFFFFFFFFFFFFFFFFFFFFFFFC"))
+        ABORT;
+    if (!BN_hex2bn(&b, "051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B"
+                   "315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573"
+                   "DF883D2C34F1EF451FD46B503F00"))
+        ABORT;
+    if (!EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
+        ABORT;
+
+    if (!BN_hex2bn(&x, "C6858E06B70404E9CD9E3ECB662395B4429C648139053F"
+                   "B521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B"
+                   "3C1856A429BF97E7E31C2E5BD66"))
+        ABORT;
+    if (!EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0, ctx))
+        ABORT;
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
+        ABORT;
+    if (!BN_hex2bn(&z, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                   "FFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5"
+                   "C9B8899C47AEBB6FB71E91386409"))
+        ABORT;
+    if (!EC_GROUP_set_generator(group, P, z, BN_value_one()))
+        ABORT;
+
+    if (!EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx))
+        ABORT;
+    fprintf(stdout, "\nNIST curve P-521 -- Generator:\n     x = 0x");
+    BN_print_fp(stdout, x);
+    fprintf(stdout, "\n     y = 0x");
+    BN_print_fp(stdout, y);
+    fprintf(stdout, "\n");
+    /* G_y value taken from the standard: */
+    if (!BN_hex2bn(&z, "11839296A789A3BC0045C8A5FB42C7D1BD998F54449579"
+                   "B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C"
+                   "7086A272C24088BE94769FD16650"))
+        ABORT;
+    if (0 != BN_cmp(y, z))
+        ABORT;
+
+    fprintf(stdout, "verify degree ...");
+    if (EC_GROUP_get_degree(group) != 521)
+        ABORT;
+    fprintf(stdout, " ok\n");
+
+    group_order_tests(group);
+
+    if (!(P_521 = EC_GROUP_new(EC_GROUP_method_of(group))))
+        ABORT;
+    if (!EC_GROUP_copy(P_521, group))
+        ABORT;
+
+    /* more tests using the last curve */
+
+    if (!EC_POINT_copy(Q, P))
+        ABORT;
+    if (EC_POINT_is_at_infinity(group, Q))
+        ABORT;
+    if (!EC_POINT_dbl(group, P, P, ctx))
+        ABORT;
+    if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
+        ABORT;
+    if (!EC_POINT_invert(group, Q, ctx))
+        ABORT;                  /* P = -2Q */
+
+    if (!EC_POINT_add(group, R, P, Q, ctx))
+        ABORT;
+    if (!EC_POINT_add(group, R, R, Q, ctx))
+        ABORT;
+    if (!EC_POINT_is_at_infinity(group, R))
+        ABORT;                  /* R = P + 2Q */
+
+    {
+        const EC_POINT *points[4];
+        const BIGNUM *scalars[4];
+        BIGNUM scalar3;
+
+        if (EC_POINT_is_at_infinity(group, Q))
+            ABORT;
+        points[0] = Q;
+        points[1] = Q;
+        points[2] = Q;
+        points[3] = Q;
+
+        if (!EC_GROUP_get_order(group, z, ctx))
+            ABORT;
+        if (!BN_add(y, z, BN_value_one()))
+            ABORT;
+        if (BN_is_odd(y))
+            ABORT;
+        if (!BN_rshift1(y, y))
+            ABORT;
+        scalars[0] = y;         /* (group order + 1)/2, so y*Q + y*Q = Q */
+        scalars[1] = y;
+
+        fprintf(stdout, "combined multiplication ...");
+        fflush(stdout);
+
+        /* z is still the group order */
+        if (!EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
+            ABORT;
+        if (!EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
+            ABORT;
+        if (0 != EC_POINT_cmp(group, P, R, ctx))
+            ABORT;
+        if (0 != EC_POINT_cmp(group, R, Q, ctx))
+            ABORT;
+
+        fprintf(stdout, ".");
+        fflush(stdout);
+
+        if (!BN_pseudo_rand(y, BN_num_bits(y), 0, 0))
+            ABORT;
+        if (!BN_add(z, z, y))
+            ABORT;
+        BN_set_negative(z, 1);
+        scalars[0] = y;
+        scalars[1] = z;         /* z = -(order + y) */
+
+        if (!EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
+            ABORT;
+        if (!EC_POINT_is_at_infinity(group, P))
+            ABORT;
+
+        fprintf(stdout, ".");
+        fflush(stdout);
+
+        if (!BN_pseudo_rand(x, BN_num_bits(y) - 1, 0, 0))
+            ABORT;
+        if (!BN_add(z, x, y))
+            ABORT;
+        BN_set_negative(z, 1);
+        scalars[0] = x;
+        scalars[1] = y;
+        scalars[2] = z;         /* z = -(x+y) */
+
+        BN_init(&scalar3);
+        BN_zero(&scalar3);
+        scalars[3] = &scalar3;
+
+        if (!EC_POINTs_mul(group, P, NULL, 4, points, scalars, ctx))
+            ABORT;
+        if (!EC_POINT_is_at_infinity(group, P))
+            ABORT;
+
+        fprintf(stdout, " ok\n\n");
+
+        BN_free(&scalar3);
+    }
+
+# if 0
+    timings(P_256, TIMING_BASE_PT, ctx);
+    timings(P_256, TIMING_RAND_PT, ctx);
+    timings(P_256, TIMING_SIMUL, ctx);
+    timings(P_384, TIMING_BASE_PT, ctx);
+    timings(P_384, TIMING_RAND_PT, ctx);
+    timings(P_384, TIMING_SIMUL, ctx);
+    timings(P_521, TIMING_BASE_PT, ctx);
+    timings(P_521, TIMING_RAND_PT, ctx);
+    timings(P_521, TIMING_SIMUL, ctx);
+# endif
+
+    if (ctx)
+        BN_CTX_free(ctx);
+    BN_free(p);
+    BN_free(a);
+    BN_free(b);
+    EC_GROUP_free(group);
+    EC_POINT_free(P);
+    EC_POINT_free(Q);
+    EC_POINT_free(R);
+    BN_free(x);
+    BN_free(y);
+    BN_free(z);
+
+    if (P_160)
+        EC_GROUP_free(P_160);
+    if (P_192)
+        EC_GROUP_free(P_192);
+    if (P_224)
+        EC_GROUP_free(P_224);
+    if (P_256)
+        EC_GROUP_free(P_256);
+    if (P_384)
+        EC_GROUP_free(P_384);
+    if (P_521)
+        EC_GROUP_free(P_521);
+
+}
+
+
+static void internal_curve_test(void)
+{
+    EC_builtin_curve *curves = NULL;
+    size_t crv_len = 0, n = 0;
+    int ok = 1;
+
+    crv_len = EC_get_builtin_curves(NULL, 0);
+
+    curves = OPENSSL_malloc(sizeof(EC_builtin_curve) * crv_len);
+
+    if (curves == NULL)
+        return;
+
+    if (!EC_get_builtin_curves(curves, crv_len)) {
+        OPENSSL_free(curves);
+        return;
+    }
+
+    fprintf(stdout, "testing internal curves: ");
+
+    for (n = 0; n < crv_len; n++) {
+        EC_GROUP *group = NULL;
+        int nid = curves[n].nid;
+        if ((group = EC_GROUP_new_by_curve_name(nid)) == NULL) {
+            ok = 0;
+            fprintf(stdout, "\nEC_GROUP_new_curve_name() failed with"
+                    " curve %s\n", OBJ_nid2sn(nid));
+            /* try next curve */
+            continue;
+        }
+        if (!EC_GROUP_check(group, NULL)) {
+            ok = 0;
+            fprintf(stdout, "\nEC_GROUP_check() failed with"
+                    " curve %s\n", OBJ_nid2sn(nid));
+            EC_GROUP_free(group);
+            /* try the next curve */
+            continue;
+        }
+        fprintf(stdout, ".");
+        fflush(stdout);
+        EC_GROUP_free(group);
+    }
+    if (ok)
+        fprintf(stdout, " ok\n\n");
+    else {
+        fprintf(stdout, " failed\n\n");
+        ABORT;
+    }
+    OPENSSL_free(curves);
+    return;
+}
+
+# ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+/*
+ * nistp_test_params contains magic numbers for testing our optimized
+ * implementations of several NIST curves with characteristic > 3.
+ */
+struct nistp_test_params {
+    const EC_METHOD *(*meth) ();
+    int degree;
+    /*
+     * Qx, Qy and D are taken from
+     * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/ECDSA_Prime.pdf
+     * Otherwise, values are standard curve parameters from FIPS 180-3
+     */
+    const char *p, *a, *b, *Qx, *Qy, *Gx, *Gy, *order, *d;
+};
+
+static const struct nistp_test_params nistp_tests_params[] = {
+    {
+     /* P-256 */
+     EC_GFp_nistp256_method,
+     256,
+     /* p */
+     "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
+     /* a */
+     "ffffffff00000001000000000000000000000000fffffffffffffffffffffffc",
+     /* b */
+     "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
+     /* Qx */
+     "b7e08afdfe94bad3f1dc8c734798ba1c62b3a0ad1e9ea2a38201cd0889bc7a19",
+     /* Qy */
+     "3603f747959dbf7a4bb226e41928729063adc7ae43529e61b563bbc606cc5e09",
+     /* Gx */
+     "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
+     /* Gy */
+     "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
+     /* order */
+     "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
+     /* d */
+     "c477f9f65c22cce20657faa5b2d1d8122336f851a508a1ed04e479c34985bf96",
+     },
+    {
+     /* P-521 */
+     EC_GFp_nistp521_method,
+     521,
+     /* p */
+     "1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+     /* a */
+     "1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc",
+     /* b */
+     "051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
+     /* Qx */
+     "0098e91eef9a68452822309c52fab453f5f117c1da8ed796b255e9ab8f6410cca16e59df403a6bdc6ca467a37056b1e54b3005d8ac030decfeb68df18b171885d5c4",
+     /* Qy */
+     "0164350c321aecfc1cca1ba4364c9b15656150b4b78d6a48d7d28e7f31985ef17be8554376b72900712c4b83ad668327231526e313f5f092999a4632fd50d946bc2e",
+     /* Gx */
+     "c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
+     /* Gy */
+     "11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
+     /* order */
+     "1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
+     /* d */
+     "0100085f47b8e1b8b11b7eb33028c0b2888e304bfc98501955b45bba1478dc184eeedf09b86a5f7c21994406072787205e69a63709fe35aa93ba333514b24f961722",
+     },
+};
+
+static void nistp_single_test(const struct nistp_test_params *test)
+{
+    BN_CTX *ctx;
+    BIGNUM *p, *a, *b, *x, *y, *n, *m, *order;
+    EC_GROUP *NISTP;
+    EC_POINT *G, *P, *Q, *Q_CHECK;
+
+    fprintf(stdout, "\nNIST curve P-%d (optimised implementation):\n",
+            test->degree);
+    ctx = BN_CTX_new();
+    p = BN_new();
+    a = BN_new();
+    b = BN_new();
+    x = BN_new();
+    y = BN_new();
+    m = BN_new();
+    n = BN_new();
+    order = BN_new();
+
+    NISTP = EC_GROUP_new(test->meth());
+    if (!NISTP)
+        ABORT;
+    if (!BN_hex2bn(&p, test->p))
+        ABORT;
+    if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        ABORT;
+    if (!BN_hex2bn(&a, test->a))
+        ABORT;
+    if (!BN_hex2bn(&b, test->b))
+        ABORT;
+    if (!EC_GROUP_set_curve_GFp(NISTP, p, a, b, ctx))
+        ABORT;
+    G = EC_POINT_new(NISTP);
+    P = EC_POINT_new(NISTP);
+    Q = EC_POINT_new(NISTP);
+    Q_CHECK = EC_POINT_new(NISTP);
+    if (!BN_hex2bn(&x, test->Qx))
+        ABORT;
+    if (!BN_hex2bn(&y, test->Qy))
+        ABORT;
+    if (!EC_POINT_set_affine_coordinates_GFp(NISTP, Q_CHECK, x, y, ctx))
+        ABORT;
+    if (!BN_hex2bn(&x, test->Gx))
+        ABORT;
+    if (!BN_hex2bn(&y, test->Gy))
+        ABORT;
+    if (!EC_POINT_set_affine_coordinates_GFp(NISTP, G, x, y, ctx))
+        ABORT;
+    if (!BN_hex2bn(&order, test->order))
+        ABORT;
+    if (!EC_GROUP_set_generator(NISTP, G, order, BN_value_one()))
+        ABORT;
+
+    fprintf(stdout, "verify degree ... ");
+    if (EC_GROUP_get_degree(NISTP) != test->degree)
+        ABORT;
+    fprintf(stdout, "ok\n");
+
+    fprintf(stdout, "NIST test vectors ... ");
+    if (!BN_hex2bn(&n, test->d))
+        ABORT;
+    /* fixed point multiplication */
+    EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
+    if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+        ABORT;
+    /* random point multiplication */
+    EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
+    if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+        ABORT;
+
+    /* set generator to P = 2*G, where G is the standard generator */
+    if (!EC_POINT_dbl(NISTP, P, G, ctx))
+        ABORT;
+    if (!EC_GROUP_set_generator(NISTP, P, order, BN_value_one()))
+        ABORT;
+    /* set the scalar to m=n/2, where n is the NIST test scalar */
+    if (!BN_rshift(m, n, 1))
+        ABORT;
+
+    /* test the non-standard generator */
+    /* fixed point multiplication */
+    EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
+    if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+        ABORT;
+    /* random point multiplication */
+    EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
+    if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+        ABORT;
+
+    /*
+     * We have not performed precomputation so have_precompute mult should be
+     * false
+     */
+    if (EC_GROUP_have_precompute_mult(NISTP))
+        ABORT;
+
+    /* now repeat all tests with precomputation */
+    if (!EC_GROUP_precompute_mult(NISTP, ctx))
+        ABORT;
+    if (!EC_GROUP_have_precompute_mult(NISTP))
+        ABORT;
+
+    /* fixed point multiplication */
+    EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
+    if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+        ABORT;
+    /* random point multiplication */
+    EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
+    if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+        ABORT;
+
+    /* reset generator */
+    if (!EC_GROUP_set_generator(NISTP, G, order, BN_value_one()))
+        ABORT;
+    /* fixed point multiplication */
+    EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
+    if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+        ABORT;
+    /* random point multiplication */
+    EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
+    if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+        ABORT;
+
+    fprintf(stdout, "ok\n");
+    group_order_tests(NISTP);
+#  if 0
+    timings(NISTP, TIMING_BASE_PT, ctx);
+    timings(NISTP, TIMING_RAND_PT, ctx);
+#  endif
+    EC_GROUP_free(NISTP);
+    EC_POINT_free(G);
+    EC_POINT_free(P);
+    EC_POINT_free(Q);
+    EC_POINT_free(Q_CHECK);
+    BN_free(n);
+    BN_free(m);
+    BN_free(p);
+    BN_free(a);
+    BN_free(b);
+    BN_free(x);
+    BN_free(y);
+    BN_free(order);
+    BN_CTX_free(ctx);
+}
+
+static void nistp_tests()
+{
+    unsigned i;
+
+    for (i = 0;
+         i < sizeof(nistp_tests_params) / sizeof(struct nistp_test_params);
+         i++) {
+        nistp_single_test(&nistp_tests_params[i]);
+    }
+}
+# endif
+
+static const char rnd_seed[] =
+    "string to make the random number generator think it has entropy";
+
+int main(int argc, char *argv[])
+{
+
+    /* enable memory leak checking unless explicitly disabled */
+    if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL)
+          && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off")))) {
+        CRYPTO_malloc_debug_init();
+        CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
+    } else {
+        /* OPENSSL_DEBUG_MEMORY=off */
+        CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
+    }
+    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+    ERR_load_crypto_strings();
+
+    RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_generate_prime may fail */
+
+    prime_field_tests();
+    puts("");
+# ifndef OPENSSL_NO_EC2M
+    char2_field_tests();
+# endif
+# ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+    nistp_tests();
+# endif
+    /* test the internal curves */
+    internal_curve_test();
+
+# ifndef OPENSSL_NO_ENGINE
+    ENGINE_cleanup();
+# endif
+    CRYPTO_cleanup_all_ex_data();
+    ERR_free_strings();
+    ERR_remove_thread_state(NULL);
+    CRYPTO_mem_leaks_fp(stderr);
+
+    return 0;
+}
+#endif

hobble-openssl

@@ -0,0 +1,47 @@
+#!/bin/sh
+
+# Quit out if anything fails.
+set -e
+
+# Clean out patent-or-otherwise-encumbered code.
+# MDC-2: 4,908,861 13/03/2007 - expired, we do not remove it but do not enable it anyway
+# IDEA:  5,214,703 07/01/2012 - expired, we do not remove it anymore
+# RC5:   5,724,428 01/11/2015 - expired, we do not remove it anymore
+# EC:    ????????? ??/??/2020
+# SRP:   ????????? ??/??/20??
+
+# Remove assembler portions of IDEA, MDC2, and RC5.
+# (find crypto/rc5/asm -type f | xargs -r rm -fv)
+
+# SRP.
+for a in srp; do
+  for c in `find crypto/$a -name "*.c" -a \! -name "*test*" -type f` ; do
+	echo Destroying $c
+	> $c
+  done
+done
+
+for c in `find crypto/bn -name "*gf2m.c"`; do
+	echo Destroying $c
+	> $c
+done
+
+for c in `find crypto/ec -name "ec2*.c" -o -name "ec_curve.c" -o -name "ecp_nistp22?.c" -o -name "ectest.c"`; do
+	echo Destroying $c
+	> $c
+done
+
+for h in `find crypto ssl apps test -name "*.h"` ; do
+	echo Removing SRP and EC2M references from $h
+	cat $h | \
+	awk    'BEGIN {ech=1;} \
+		/^#[ \t]*ifndef.*NO_SRP/ {ech--; next;} \
+		/^#[ \t]*ifndef.*NO_EC2M/ {ech--; next;} \
+                /^#[ \t]*if/ {if(ech < 1) ech--;} \
+		{if(ech>0) {;print $0};} \
+		/^#[ \t]*endif/ {if(ech < 1) ech++;}' > $h.hobbled && \
+	mv $h.hobbled $h
+done
+
+# Make the makefiles happy.
+# touch crypto/rc5/asm/rc5-586.pl

make-dummy-cert

@@ -0,0 +1,28 @@
+#!/bin/sh
+umask 077
+
+answers() {
+	echo --
+	echo SomeState
+	echo SomeCity
+	echo SomeOrganization
+	echo SomeOrganizationalUnit
+	echo localhost.localdomain
+	echo root@localhost.localdomain
+}
+
+if [ $# -eq 0 ] ; then
+	echo $"Usage: `basename $0` filename [...]"
+	exit 0
+fi
+
+for target in $@ ; do
+	PEM1=`/bin/mktemp /tmp/openssl.XXXXXX`
+	PEM2=`/bin/mktemp /tmp/openssl.XXXXXX`
+	trap "rm -f $PEM1 $PEM2" SIGINT
+	answers | /usr/bin/openssl req -newkey rsa:2048 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 2> /dev/null
+	cat $PEM1 >  ${target}
+	echo ""   >> ${target}
+	cat $PEM2 >> ${target}
+	rm -f $PEM1 $PEM2
+done

openssl-1.0.0-beta4-ca-dir.patch

@@ -0,0 +1,36 @@
+diff -up openssl-1.0.0-beta4/apps/CA.pl.in.ca-dir openssl-1.0.0-beta4/apps/CA.pl.in
+--- openssl-1.0.0-beta4/apps/CA.pl.in.ca-dir	2006-04-28 02:30:49.000000000 +0200
++++ openssl-1.0.0-beta4/apps/CA.pl.in	2009-11-12 12:33:13.000000000 +0100
+@@ -53,7 +53,7 @@ $VERIFY="$openssl verify";
+ $X509="$openssl x509";
+ $PKCS12="$openssl pkcs12";
+ 
+-$CATOP="./demoCA";
++$CATOP="/etc/pki/CA";
+ $CAKEY="cakey.pem";
+ $CAREQ="careq.pem";
+ $CACERT="cacert.pem";
+diff -up openssl-1.0.0-beta4/apps/CA.sh.ca-dir openssl-1.0.0-beta4/apps/CA.sh
+--- openssl-1.0.0-beta4/apps/CA.sh.ca-dir	2009-10-15 19:27:47.000000000 +0200
++++ openssl-1.0.0-beta4/apps/CA.sh	2009-11-12 12:35:14.000000000 +0100
+@@ -68,7 +68,7 @@ VERIFY="$OPENSSL verify"
+ X509="$OPENSSL x509"
+ PKCS12="openssl pkcs12"
+ 
+-if [ -z "$CATOP" ] ; then CATOP=./demoCA ; fi
++if [ -z "$CATOP" ] ; then CATOP=/etc/pki/CA ; fi
+ CAKEY=./cakey.pem
+ CAREQ=./careq.pem
+ CACERT=./cacert.pem
+diff -up openssl-1.0.0-beta4/apps/openssl.cnf.ca-dir openssl-1.0.0-beta4/apps/openssl.cnf
+--- openssl-1.0.0-beta4/apps/openssl.cnf.ca-dir	2009-11-12 12:33:13.000000000 +0100
++++ openssl-1.0.0-beta4/apps/openssl.cnf	2009-11-12 12:33:13.000000000 +0100
+@@ -39,7 +39,7 @@ default_ca	= CA_default		# The default c
+ ####################################################################
+ [ CA_default ]
+ 
+-dir		= ./demoCA		# Where everything is kept
++dir		= /etc/pki/CA		# Where everything is kept
+ certs		= $dir/certs		# Where the issued certs are kept
+ crl_dir		= $dir/crl		# Where the issued crl are kept
+ database	= $dir/index.txt	# database index file.

openssl-1.0.0-timezone.patch

@@ -0,0 +1,21 @@
+diff -up openssl-1.0.0/Makefile.org.timezone openssl-1.0.0/Makefile.org
+--- openssl-1.0.0/Makefile.org.timezone	2010-03-30 11:08:40.000000000 +0200
++++ openssl-1.0.0/Makefile.org	2010-04-06 12:49:21.000000000 +0200
+@@ -609,7 +609,7 @@ install_docs:
+ 		sec=`$(PERL) util/extract-section.pl 1 < $$i`; \
+ 		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
+ 		(cd `$(PERL) util/dirname.pl $$i`; \
+-		sh -c "$$pod2man \
++		sh -c "TZ=UTC $$pod2man \
+ 			--section=$$sec --center=OpenSSL \
+ 			--release=$(VERSION) `basename $$i`") \
+ 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
+@@ -626,7 +626,7 @@ install_docs:
+ 		sec=`$(PERL) util/extract-section.pl 3 < $$i`; \
+ 		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
+ 		(cd `$(PERL) util/dirname.pl $$i`; \
+-		sh -c "$$pod2man \
++		sh -c "TZ=UTC $$pod2man \
+ 			--section=$$sec --center=OpenSSL \
+ 			--release=$(VERSION) `basename $$i`") \
+ 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \

openssl-1.0.1c-aliasing.patch

@@ -0,0 +1,12 @@
+diff -up openssl-1.0.1c/crypto/modes/Makefile.aliasing openssl-1.0.1c/crypto/modes/Makefile
+--- openssl-1.0.1c/crypto/modes/Makefile.aliasing	2011-08-12 00:36:17.000000000 +0200
++++ openssl-1.0.1c/crypto/modes/Makefile	2012-07-13 11:32:10.767829077 +0200
+@@ -12,7 +12,7 @@ AR=		ar r
+ 
+ MODES_ASM_OBJ=
+ 
+-CFLAGS= $(INCLUDES) $(CFLAG)
++CFLAGS= $(INCLUDES) $(CFLAG) -fno-strict-aliasing
+ ASFLAGS= $(INCLUDES) $(ASFLAG)
+ AFLAGS= $(ASFLAGS)
+ 

openssl-1.0.1c-perlfind.patch

@@ -0,0 +1,16 @@
+diff -up openssl-1.0.1c/util/perlpath.pl.perlfind openssl-1.0.1c/util/perlpath.pl
+--- openssl-1.0.1c/util/perlpath.pl.perlfind	2012-07-11 22:57:33.000000000 +0200
++++ openssl-1.0.1c/util/perlpath.pl	2012-07-12 00:31:12.102156275 +0200
+@@ -4,10 +4,10 @@
+ # line in all scripts that rely on perl.
+ #
+ 
+-require "find.pl";
++use File::Find;
+ 
+ $#ARGV == 0 || print STDERR "usage: perlpath newpath  (eg /usr/bin)\n";
+-&find(".");
++find(\&wanted, ".");
+ 
+ sub wanted
+ 	{

openssl-1.0.1i-algo-doc.patch

@@ -0,0 +1,77 @@
+diff -up openssl-1.0.1i/doc/crypto/EVP_DigestInit.pod.algo-doc openssl-1.0.1i/doc/crypto/EVP_DigestInit.pod
+--- openssl-1.0.1i/doc/crypto/EVP_DigestInit.pod.algo-doc	2014-08-06 23:10:56.000000000 +0200
++++ openssl-1.0.1i/doc/crypto/EVP_DigestInit.pod	2014-08-07 11:18:01.290773970 +0200
+@@ -75,7 +75,7 @@ EVP_MD_CTX_create() allocates, initializ
+ 
+ EVP_DigestInit_ex() sets up digest context B<ctx> to use a digest
+ B<type> from ENGINE B<impl>. B<ctx> must be initialized before calling this
+-function. B<type> will typically be supplied by a functionsuch as EVP_sha1().
++function. B<type> will typically be supplied by a function such as EVP_sha1().
+ If B<impl> is NULL then the default implementation of digest B<type> is used.
+ 
+ EVP_DigestUpdate() hashes B<cnt> bytes of data at B<d> into the
+@@ -164,7 +164,8 @@ corresponding OBJECT IDENTIFIER or NID_u
+ EVP_MD_size(), EVP_MD_block_size(), EVP_MD_CTX_size() and
+ EVP_MD_CTX_block_size() return the digest or block size in bytes.
+ 
+-EVP_md_null(), EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_dss(),
++EVP_md_null(), EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(),
++EVP_sha224(), EVP_sha256(), EVP_sha384(), EVP_sha512(), EVP_dss(),
+ EVP_dss1(), EVP_mdc2() and EVP_ripemd160() return pointers to the
+ corresponding EVP_MD structures.
+ 
+diff -up openssl-1.0.1i/doc/crypto/EVP_EncryptInit.pod.algo-doc openssl-1.0.1i/doc/crypto/EVP_EncryptInit.pod
+--- openssl-1.0.1i/doc/crypto/EVP_EncryptInit.pod.algo-doc	2014-08-06 23:10:56.000000000 +0200
++++ openssl-1.0.1i/doc/crypto/EVP_EncryptInit.pod	2014-08-07 10:55:25.100638252 +0200
+@@ -91,6 +91,32 @@ EVP_CIPHER_CTX_set_padding - EVP cipher
+  int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
+  int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
+ 
++ const EVP_CIPHER *EVP_des_ede3(void);
++ const EVP_CIPHER *EVP_des_ede3_ecb(void);
++ const EVP_CIPHER *EVP_des_ede3_cfb64(void);
++ const EVP_CIPHER *EVP_des_ede3_cfb1(void);
++ const EVP_CIPHER *EVP_des_ede3_cfb8(void);
++ const EVP_CIPHER *EVP_des_ede3_ofb(void);
++ const EVP_CIPHER *EVP_des_ede3_cbc(void);
++ const EVP_CIPHER *EVP_aes_128_ecb(void);
++ const EVP_CIPHER *EVP_aes_128_cbc(void);
++ const EVP_CIPHER *EVP_aes_128_cfb1(void);
++ const EVP_CIPHER *EVP_aes_128_cfb8(void);
++ const EVP_CIPHER *EVP_aes_128_cfb128(void);
++ const EVP_CIPHER *EVP_aes_128_ofb(void);
++ const EVP_CIPHER *EVP_aes_192_ecb(void);
++ const EVP_CIPHER *EVP_aes_192_cbc(void);
++ const EVP_CIPHER *EVP_aes_192_cfb1(void);
++ const EVP_CIPHER *EVP_aes_192_cfb8(void);
++ const EVP_CIPHER *EVP_aes_192_cfb128(void);
++ const EVP_CIPHER *EVP_aes_192_ofb(void);
++ const EVP_CIPHER *EVP_aes_256_ecb(void);
++ const EVP_CIPHER *EVP_aes_256_cbc(void);
++ const EVP_CIPHER *EVP_aes_256_cfb1(void);
++ const EVP_CIPHER *EVP_aes_256_cfb8(void);
++ const EVP_CIPHER *EVP_aes_256_cfb128(void);
++ const EVP_CIPHER *EVP_aes_256_ofb(void);
++
+ =head1 DESCRIPTION
+ 
+ The EVP cipher routines are a high level interface to certain
+@@ -297,6 +323,18 @@ Three key triple DES in CBC, ECB, CFB an
+ 
+ DESX algorithm in CBC mode.
+ 
++=item EVP_aes_128_cbc(void), EVP_aes_128_ecb(), EVP_aes_128_ofb(void), EVP_aes_128_cfb1(void), EVP_aes_128_cfb8(void), EVP_aes_128_cfb128(void)
++
++AES with 128 bit key length in CBC, ECB, OFB and CFB modes respectively.
++
++=item EVP_aes_192_cbc(void), EVP_aes_192_ecb(), EVP_aes_192_ofb(void), EVP_aes_192_cfb1(void), EVP_aes_192_cfb8(void), EVP_aes_192_cfb128(void)
++
++AES with 192 bit key length in CBC, ECB, OFB and CFB modes respectively.
++
++=item EVP_aes_256_cbc(void), EVP_aes_256_ecb(), EVP_aes_256_ofb(void), EVP_aes_256_cfb1(void), EVP_aes_256_cfb8(void), EVP_aes_256_cfb128(void)
++
++AES with 256 bit key length in CBC, ECB, OFB and CFB modes respectively.
++
+ =item EVP_rc4(void)
+ 
+ RC4 stream cipher. This is a variable key length cipher with default key length 128 bits.

openssl-1.0.2a-apps-dgst.patch

@@ -0,0 +1,110 @@
+diff -up openssl-1.0.2a/apps/ca.c.dgst openssl-1.0.2a/apps/ca.c
+--- openssl-1.0.2a/apps/ca.c.dgst	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/apps/ca.c	2015-04-21 17:01:38.841551616 +0200
+@@ -157,7 +157,7 @@ static const char *ca_usage[] = {
+     " -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
+     " -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
+     " -days arg       - number of days to certify the certificate for\n",
+-    " -md arg         - md to use, one of md2, md5, sha or sha1\n",
++    " -md arg         - md to use, see openssl dgst -h for list\n",
+     " -policy arg     - The CA 'policy' to support\n",
+     " -keyfile arg    - private key file\n",
+     " -keyform arg    - private key file format (PEM or ENGINE)\n",
+diff -up openssl-1.0.2a/apps/enc.c.dgst openssl-1.0.2a/apps/enc.c
+--- openssl-1.0.2a/apps/enc.c.dgst	2015-03-19 14:19:00.000000000 +0100
++++ openssl-1.0.2a/apps/enc.c	2015-04-21 17:01:38.841551616 +0200
+@@ -294,7 +294,7 @@ int MAIN(int argc, char **argv)
+                        "%-14s the next argument is the md to use to create a key\n",
+                        "-md");
+             BIO_printf(bio_err,
+-                       "%-14s   from a passphrase.  One of md2, md5, sha or sha1\n",
++                       "%-14s   from a passphrase. See openssl dgst -h for list.\n",
+                        "");
+             BIO_printf(bio_err, "%-14s salt in hex is the next argument\n",
+                        "-S");
+diff -up openssl-1.0.2a/apps/req.c.dgst openssl-1.0.2a/apps/req.c
+--- openssl-1.0.2a/apps/req.c.dgst	2015-03-19 14:19:00.000000000 +0100
++++ openssl-1.0.2a/apps/req.c	2015-04-21 17:01:38.842551640 +0200
+@@ -414,7 +414,7 @@ int MAIN(int argc, char **argv)
+                    " -newkey ec:file generate a new EC key, parameters taken from CA in 'file'\n");
+ #endif
+         BIO_printf(bio_err,
+-                   " -[digest]      Digest to sign with (md5, sha1, md2, mdc2, md4)\n");
++                   " -[digest]      Digest to sign with (see openssl dgst -h for list)\n");
+         BIO_printf(bio_err, " -config file   request template file.\n");
+         BIO_printf(bio_err,
+                    " -subj arg      set or modify request subject\n");
+diff -up openssl-1.0.2a/apps/ts.c.dgst openssl-1.0.2a/apps/ts.c
+--- openssl-1.0.2a/apps/ts.c.dgst	2015-03-19 14:19:00.000000000 +0100
++++ openssl-1.0.2a/apps/ts.c	2015-04-21 17:01:38.842551640 +0200
+@@ -337,7 +337,7 @@ int MAIN(int argc, char **argv)
+     BIO_printf(bio_err, "usage:\n"
+                "ts -query [-rand file%cfile%c...] [-config configfile] "
+                "[-data file_to_hash] [-digest digest_bytes]"
+-               "[-md2|-md4|-md5|-sha|-sha1|-mdc2|-ripemd160] "
++               "[-<hashalg>] "
+                "[-policy object_id] [-no_nonce] [-cert] "
+                "[-in request.tsq] [-out request.tsq] [-text]\n",
+                LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
+diff -up openssl-1.0.2a/apps/x509.c.dgst openssl-1.0.2a/apps/x509.c
+--- openssl-1.0.2a/apps/x509.c.dgst	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/apps/x509.c	2015-04-21 17:01:38.842551640 +0200
+@@ -141,7 +141,7 @@ static const char *x509_usage[] = {
+     " -set_serial     - serial number to use\n",
+     " -text           - print the certificate in text form\n",
+     " -C              - print out C code forms\n",
+-    " -md2/-md5/-sha1/-mdc2 - digest to use\n",
++    " -<dgst>         - digest to use, see openssl dgst -h output for list\n",
+     " -extfile        - configuration file with X509V3 extensions to add\n",
+     " -extensions     - section from config file with X509V3 extensions to add\n",
+     " -clrext         - delete extensions before signing and input certificate\n",
+diff -up openssl-1.0.2a/doc/apps/ca.pod.dgst openssl-1.0.2a/doc/apps/ca.pod
+--- openssl-1.0.2a/doc/apps/ca.pod.dgst	2015-01-20 13:33:36.000000000 +0100
++++ openssl-1.0.2a/doc/apps/ca.pod	2015-04-21 17:01:38.842551640 +0200
+@@ -168,7 +168,8 @@ the number of days to certify the certif
+ =item B<-md alg>
+ 
+ the message digest to use. Possible values include md5, sha1 and mdc2.
+-This option also applies to CRLs.
++For full list of digests see openssl dgst -h output. This option also
++applies to CRLs.
+ 
+ =item B<-policy arg>
+ 
+diff -up openssl-1.0.2a/doc/apps/ocsp.pod.dgst openssl-1.0.2a/doc/apps/ocsp.pod
+--- openssl-1.0.2a/doc/apps/ocsp.pod.dgst	2015-03-19 14:19:00.000000000 +0100
++++ openssl-1.0.2a/doc/apps/ocsp.pod	2015-04-21 17:01:38.842551640 +0200
+@@ -219,7 +219,8 @@ check is not performed.
+ =item B<-md5|-sha1|-sha256|-ripemod160|...>
+ 
+ this option sets digest algorithm to use for certificate identification
+-in the OCSP request. By default SHA-1 is used. 
++in the OCSP request. By default SHA-1 is used. See openssl dgst -h output for
++the list of available algorithms.
+ 
+ =back
+ 
+diff -up openssl-1.0.2a/doc/apps/req.pod.dgst openssl-1.0.2a/doc/apps/req.pod
+--- openssl-1.0.2a/doc/apps/req.pod.dgst	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/doc/apps/req.pod	2015-04-21 17:01:38.843551664 +0200
+@@ -201,7 +201,8 @@ will not be encrypted.
+ 
+ this specifies the message digest to sign the request with (such as
+ B<-md5>, B<-sha1>). This overrides the digest algorithm specified in
+-the configuration file.
++the configuration file. For full list of possible digests see openssl
++dgst -h output.
+ 
+ Some public key algorithms may override this choice. For instance, DSA
+ signatures always use SHA1, GOST R 34.10 signatures always use
+diff -up openssl-1.0.2a/doc/apps/x509.pod.dgst openssl-1.0.2a/doc/apps/x509.pod
+--- openssl-1.0.2a/doc/apps/x509.pod.dgst	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/doc/apps/x509.pod	2015-04-21 17:01:38.843551664 +0200
+@@ -107,6 +107,7 @@ the digest to use. This affects any sign
+ digest, such as the B<-fingerprint>, B<-signkey> and B<-CA> options. If not
+ specified then SHA1 is used. If the key being used to sign with is a DSA key
+ then this option has no effect: SHA1 is always used with DSA keys.
++For full list of digests see openssl dgst -h output.
+ 
+ =item B<-engine id>
+ 

openssl-1.0.2a-compat-symbols.patch

@@ -0,0 +1,46 @@
+diff -up openssl-1.0.2a/crypto/dsa/dsa_key.c.compat openssl-1.0.2a/crypto/dsa/dsa_key.c
+--- openssl-1.0.2a/crypto/dsa/dsa_key.c.compat	2015-04-09 18:21:11.687977858 +0200
++++ openssl-1.0.2a/crypto/dsa/dsa_key.c	2015-04-09 18:21:07.869889659 +0200
+@@ -68,6 +68,11 @@
+ #  include <openssl/fips.h>
+ #  include <openssl/evp.h>
+ 
++/* just a compatibility symbol - no-op */
++void FIPS_corrupt_dsa_keygen(void)
++{
++}
++
+ static int fips_check_dsa(DSA *dsa)
+ {
+     EVP_PKEY *pk;
+diff -up openssl-1.0.2a/crypto/engine/eng_all.c.compat openssl-1.0.2a/crypto/engine/eng_all.c
+--- openssl-1.0.2a/crypto/engine/eng_all.c.compat	2015-04-09 18:21:11.688977881 +0200
++++ openssl-1.0.2a/crypto/engine/eng_all.c	2015-04-09 18:21:09.159919459 +0200
+@@ -63,6 +63,11 @@
+ # include <openssl/fips.h>
+ #endif
+ 
++/* just backwards compatibility symbol - no-op */
++void ENGINE_load_aesni(void)
++{
++}
++
+ void ENGINE_load_builtin_engines(void)
+ {
+     /* Some ENGINEs need this */
+diff -up openssl-1.0.2a/crypto/fips/fips.c.compat openssl-1.0.2a/crypto/fips/fips.c
+--- openssl-1.0.2a/crypto/fips/fips.c.compat	2015-04-09 18:21:11.689977904 +0200
++++ openssl-1.0.2a/crypto/fips/fips.c	2015-04-09 18:21:09.925937154 +0200
+@@ -113,6 +113,12 @@ int FIPS_module_mode(void)
+     return ret;
+ }
+ 
++/* just a compat symbol - return NULL */
++const void *FIPS_rand_check(void)
++{
++    return NULL;
++}
++
+ int FIPS_selftest_failed(void)
+ {
+     int ret = 0;

openssl-1.0.2a-defaults.patch

@@ -0,0 +1,60 @@
+diff -up openssl-1.0.2a/apps/openssl.cnf.defaults openssl-1.0.2a/apps/openssl.cnf
+--- openssl-1.0.2a/apps/openssl.cnf.defaults	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/apps/openssl.cnf	2015-04-20 14:37:10.112271850 +0200
+@@ -72,7 +72,7 @@ cert_opt 	= ca_default		# Certificate fi
+ 
+ default_days	= 365			# how long to certify for
+ default_crl_days= 30			# how long before next CRL
+-default_md	= default		# use public key default MD
++default_md	= sha256		# use SHA-256 by default
+ preserve	= no			# keep passed DN ordering
+ 
+ # A few difference way of specifying how similar the request should look
+@@ -104,6 +104,7 @@ emailAddress		= optional
+ ####################################################################
+ [ req ]
+ default_bits		= 2048
++default_md		= sha256
+ default_keyfile 	= privkey.pem
+ distinguished_name	= req_distinguished_name
+ attributes		= req_attributes
+@@ -126,17 +127,18 @@ string_mask = utf8only
+ 
+ [ req_distinguished_name ]
+ countryName			= Country Name (2 letter code)
+-countryName_default		= AU
++countryName_default		= XX
+ countryName_min			= 2
+ countryName_max			= 2
+ 
+ stateOrProvinceName		= State or Province Name (full name)
+-stateOrProvinceName_default	= Some-State
++#stateOrProvinceName_default	= Default Province
+ 
+ localityName			= Locality Name (eg, city)
++localityName_default		= Default City
+ 
+ 0.organizationName		= Organization Name (eg, company)
+-0.organizationName_default	= Internet Widgits Pty Ltd
++0.organizationName_default	= Default Company Ltd
+ 
+ # we can do this but it is not needed normally :-)
+ #1.organizationName		= Second Organization Name (eg, company)
+@@ -145,7 +147,7 @@ localityName			= Locality Name (eg, city
+ organizationalUnitName		= Organizational Unit Name (eg, section)
+ #organizationalUnitName_default	=
+ 
+-commonName			= Common Name (e.g. server FQDN or YOUR name)
++commonName			= Common Name (eg, your name or your server\'s hostname)
+ commonName_max			= 64
+ 
+ emailAddress			= Email Address
+@@ -339,7 +341,7 @@ signer_key	= $dir/private/tsakey.pem # T
+ default_policy	= tsa_policy1		# Policy if request did not specify it
+ 					# (optional)
+ other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
+-digests		= md5, sha1		# Acceptable message digests (mandatory)
++digests		= sha1, sha256, sha384, sha512	# Acceptable message digests (mandatory)
+ accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
+ clock_precision_digits  = 0	# number of digits after dot. (optional)
+ ordering		= yes	# Is ordering defined for timestamps?

openssl-1.0.2a-dtls1-abi.patch

@@ -0,0 +1,23 @@
+diff -up openssl-1.0.2a/ssl/dtls1.h.dtls1-abi openssl-1.0.2a/ssl/dtls1.h
+--- openssl-1.0.2a/ssl/dtls1.h.dtls1-abi	2015-04-21 10:49:57.984781143 +0200
++++ openssl-1.0.2a/ssl/dtls1.h	2015-04-21 16:41:37.835164264 +0200
+@@ -214,9 +214,6 @@ typedef struct dtls1_state_st {
+      * loss.
+      */
+     record_pqueue buffered_app_data;
+-    /* Is set when listening for new connections with dtls1_listen() */
+-    unsigned int listen;
+-    unsigned int link_mtu;      /* max on-the-wire DTLS packet size */
+     unsigned int mtu;           /* max DTLS packet size */
+     struct hm_header_st w_msg_hdr;
+     struct hm_header_st r_msg_hdr;
+@@ -241,6 +238,9 @@ typedef struct dtls1_state_st {
+      * Cleared after the message has been processed.
+      */
+     unsigned int change_cipher_spec_ok;
++    /* Is set when listening for new connections with dtls1_listen() */
++    unsigned int listen;
++    unsigned int link_mtu;      /* max on-the-wire DTLS packet size */
+ #  ifndef OPENSSL_NO_SCTP
+     /* used when SSL_ST_XX_FLUSH is entered */
+     int next_state;

openssl-1.0.2a-env-zlib.patch

@@ -0,0 +1,39 @@
+diff -up openssl-1.0.2a/doc/ssl/SSL_COMP_add_compression_method.pod.env-zlib openssl-1.0.2a/doc/ssl/SSL_COMP_add_compression_method.pod
+--- openssl-1.0.2a/doc/ssl/SSL_COMP_add_compression_method.pod.env-zlib	2015-04-09 18:17:20.509637597 +0200
++++ openssl-1.0.2a/doc/ssl/SSL_COMP_add_compression_method.pod	2015-04-09 18:17:14.767504953 +0200
+@@ -47,6 +47,13 @@ Once the identities of the compression m
+ been standardized, the compression API will most likely be changed. Using
+ it in the current state is not recommended.
+ 
++It is also not recommended to use compression if data transfered contain
++untrusted parts that can be manipulated by an attacker as he could then
++get information about the encrypted data. See the CRIME attack. For
++that reason the default loading of the zlib compression method is
++disabled and enabled only if the environment variable B<OPENSSL_DEFAULT_ZLIB>
++is present during the library initialization.
++
+ =head1 RETURN VALUES
+ 
+ SSL_COMP_add_compression_method() may return the following values:
+diff -up openssl-1.0.2a/ssl/ssl_ciph.c.env-zlib openssl-1.0.2a/ssl/ssl_ciph.c
+--- openssl-1.0.2a/ssl/ssl_ciph.c.env-zlib	2015-04-09 18:17:20.510637620 +0200
++++ openssl-1.0.2a/ssl/ssl_ciph.c	2015-04-09 18:17:20.264631937 +0200
+@@ -140,6 +140,8 @@
+  * OTHERWISE.
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <openssl/objects.h>
+ #ifndef OPENSSL_NO_COMP
+@@ -450,7 +452,8 @@ static void load_builtin_compressions(vo
+ 
+             MemCheck_off();
+             ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
+-            if (ssl_comp_methods != NULL) {
++            if (ssl_comp_methods != NULL
++                && secure_getenv("OPENSSL_DEFAULT_ZLIB") != NULL) {
+                 comp = (SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
+                 if (comp != NULL) {
+                     comp->method = COMP_zlib();

openssl-1.0.2a-fips-ctor.patch

@@ -0,0 +1,174 @@
+diff -up openssl-1.0.2a/crypto/fips/fips.c.fips-ctor openssl-1.0.2a/crypto/fips/fips.c
+--- openssl-1.0.2a/crypto/fips/fips.c.fips-ctor	2015-04-21 17:42:18.702765856 +0200
++++ openssl-1.0.2a/crypto/fips/fips.c	2015-04-21 17:42:18.742766794 +0200
+@@ -60,6 +60,8 @@
+ #include <dlfcn.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <unistd.h>
++#include <errno.h>
+ #include "fips_locl.h"
+ 
+ #ifdef OPENSSL_FIPS
+@@ -201,7 +203,9 @@ static char *bin2hex(void *buf, size_t l
+ }
+ 
+ # define HMAC_PREFIX "."
+-# define HMAC_SUFFIX ".hmac"
++# ifndef HMAC_SUFFIX
++#  define HMAC_SUFFIX ".hmac"
++# endif
+ # define READ_BUFFER_LENGTH 16384
+ 
+ static char *make_hmac_path(const char *origpath)
+@@ -279,20 +283,14 @@ static int compute_file_hmac(const char
+     return rv;
+ }
+ 
+-static int FIPSCHECK_verify(const char *libname, const char *symbolname)
++static int FIPSCHECK_verify(const char *path)
+ {
+-    char path[PATH_MAX + 1];
+-    int rv;
++    int rv = 0;
+     FILE *hf;
+     char *hmacpath, *p;
+     char *hmac = NULL;
+     size_t n;
+ 
+-    rv = get_library_path(libname, symbolname, path, sizeof(path));
+-
+-    if (rv < 0)
+-        return 0;
+-
+     hmacpath = make_hmac_path(path);
+     if (hmacpath == NULL)
+         return 0;
+@@ -343,6 +341,51 @@ static int FIPSCHECK_verify(const char *
+     return 1;
+ }
+ 
++static int verify_checksums(void)
++{
++    int rv;
++    char path[PATH_MAX + 1];
++    char *p;
++
++    /* we need to avoid dlopening libssl, assume both libcrypto and libssl
++       are in the same directory */
++
++    rv = get_library_path("libcrypto.so." SHLIB_VERSION_NUMBER,
++                          "FIPS_mode_set", path, sizeof(path));
++    if (rv < 0)
++        return 0;
++
++    rv = FIPSCHECK_verify(path);
++    if (!rv)
++        return 0;
++
++    /* replace libcrypto with libssl */
++    while ((p = strstr(path, "libcrypto.so")) != NULL) {
++        p = stpcpy(p, "libssl");
++        memmove(p, p + 3, strlen(p + 2));
++    }
++
++    rv = FIPSCHECK_verify(path);
++    if (!rv)
++        return 0;
++    return 1;
++}
++
++# ifndef FIPS_MODULE_PATH
++#  define FIPS_MODULE_PATH "/etc/system-fips"
++# endif
++
++int FIPS_module_installed(void)
++{
++    int rv;
++    rv = access(FIPS_MODULE_PATH, F_OK);
++    if (rv < 0 && errno != ENOENT)
++        rv = 0;
++
++    /* Installed == true */
++    return !rv;
++}
++
+ int FIPS_module_mode_set(int onoff, const char *auth)
+ {
+     int ret = 0;
+@@ -380,17 +423,7 @@ int FIPS_module_mode_set(int onoff, cons
+         }
+ # endif
+ 
+-        if (!FIPSCHECK_verify
+-            ("libcrypto.so." SHLIB_VERSION_NUMBER, "FIPS_mode_set")) {
+-            FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,
+-                    FIPS_R_FINGERPRINT_DOES_NOT_MATCH);
+-            fips_selftest_fail = 1;
+-            ret = 0;
+-            goto end;
+-        }
+-
+-        if (!FIPSCHECK_verify
+-            ("libssl.so." SHLIB_VERSION_NUMBER, "SSL_CTX_new")) {
++        if (!verify_checksums()) {
+             FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,
+                     FIPS_R_FINGERPRINT_DOES_NOT_MATCH);
+             fips_selftest_fail = 1;
+diff -up openssl-1.0.2a/crypto/fips/fips.h.fips-ctor openssl-1.0.2a/crypto/fips/fips.h
+--- openssl-1.0.2a/crypto/fips/fips.h.fips-ctor	2015-04-21 17:42:18.739766724 +0200
++++ openssl-1.0.2a/crypto/fips/fips.h	2015-04-21 17:42:18.743766818 +0200
+@@ -74,6 +74,7 @@ extern "C" {
+ 
+     int FIPS_module_mode_set(int onoff, const char *auth);
+     int FIPS_module_mode(void);
++    int FIPS_module_installed(void);
+     const void *FIPS_rand_check(void);
+     int FIPS_selftest(void);
+     int FIPS_selftest_failed(void);
+diff -up openssl-1.0.2a/crypto/o_init.c.fips-ctor openssl-1.0.2a/crypto/o_init.c
+--- openssl-1.0.2a/crypto/o_init.c.fips-ctor	2015-04-21 17:42:18.732766559 +0200
++++ openssl-1.0.2a/crypto/o_init.c	2015-04-21 17:45:02.662613173 +0200
+@@ -74,6 +74,9 @@ static void init_fips_mode(void)
+     char buf[2] = "0";
+     int fd;
+ 
++    /* Ensure the selftests always run */
++    FIPS_mode_set(1);
++
+     if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) {
+         buf[0] = '1';
+     } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) {
+@@ -85,8 +88,12 @@ static void init_fips_mode(void)
+      * otherwise..
+      */
+ 
+-    if (buf[0] == '1') {
+-        FIPS_mode_set(1);
++    if (buf[0] != '1') {
++        /* drop down to non-FIPS mode if it is not requested */
++        FIPS_mode_set(0);
++    } else {
++        /* abort if selftest failed */
++        FIPS_selftest_check();
+     }
+ }
+ #endif
+@@ -96,13 +103,16 @@ static void init_fips_mode(void)
+  * sets FIPS callbacks
+  */
+ 
+-void OPENSSL_init_library(void)
++void __attribute__ ((constructor)) OPENSSL_init_library(void)
+ {
+     static int done = 0;
+     if (done)
+         return;
+     done = 1;
+ #ifdef OPENSSL_FIPS
++    if (!FIPS_module_installed()) {
++        return;
++    }
+     RAND_init_fips();
+     init_fips_mode();
+     if (!FIPS_mode()) {

openssl-1.0.2a-fips-md5-allow.patch

@@ -0,0 +1,21 @@
+diff -up openssl-1.0.2a/crypto/md5/md5_dgst.c.md5-allow openssl-1.0.2a/crypto/md5/md5_dgst.c
+--- openssl-1.0.2a/crypto/md5/md5_dgst.c.md5-allow	2015-04-09 18:18:36.505393113 +0200
++++ openssl-1.0.2a/crypto/md5/md5_dgst.c	2015-04-09 18:18:32.408298469 +0200
+@@ -72,7 +72,16 @@ const char MD5_version[] = "MD5" OPENSSL
+ #define INIT_DATA_C (unsigned long)0x98badcfeL
+ #define INIT_DATA_D (unsigned long)0x10325476L
+ 
+-nonfips_md_init(MD5)
++int MD5_Init(MD5_CTX *c)
++#ifdef OPENSSL_FIPS
++{
++    if (FIPS_mode() && getenv("OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW") == NULL)
++        OpenSSLDie(__FILE__, __LINE__, "Digest MD5 forbidden in FIPS mode!");
++    return private_MD5_Init(c);
++}
++
++int private_MD5_Init(MD5_CTX *c)
++#endif
+ {
+     memset(c, 0, sizeof(*c));
+     c->A = INIT_DATA_A;

openssl-1.0.2a-issuer-hash.patch

@@ -0,0 +1,11 @@
+diff -up openssl-1.0.1k/crypto/x509/x509_cmp.c.issuer-hash openssl-1.0.1k/crypto/x509/x509_cmp.c
+--- openssl-1.0.1k/crypto/x509/x509_cmp.c.issuer-hash	2015-04-09 18:16:03.349855193 +0200
++++ openssl-1.0.1k/crypto/x509/x509_cmp.c	2015-04-09 18:16:00.616792058 +0200
+@@ -86,6 +86,7 @@ unsigned long X509_issuer_and_serial_has
+     char *f;
+ 
+     EVP_MD_CTX_init(&ctx);
++    EVP_MD_CTX_set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+     f = X509_NAME_oneline(a->cert_info->issuer, NULL, 0);
+     if (!EVP_DigestInit_ex(&ctx, EVP_md5(), NULL))
+         goto err;

openssl-1.0.2a-no-rpath.patch

@@ -0,0 +1,12 @@
+diff -up openssl-1.0.2a/Makefile.shared.no-rpath openssl-1.0.2a/Makefile.shared
+--- openssl-1.0.2a/Makefile.shared.no-rpath	2015-04-09 18:14:39.647921663 +0200
++++ openssl-1.0.2a/Makefile.shared	2015-04-09 18:14:34.423800985 +0200
+@@ -153,7 +153,7 @@ DO_GNU_SO=$(CALC_VERSIONS); \
+ 	NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
+ 	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
+ 
+-DO_GNU_APP=LDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBRPATH)"
++DO_GNU_APP=LDFLAGS="$(CFLAGS)"
+ 
+ #This is rather special.  It's a special target with which one can link
+ #applications without bothering with any features that have anything to

openssl-1.0.2a-padlock64.patch

@@ -0,0 +1,198 @@
+diff -up openssl-1.0.2a/engines/e_padlock.c.padlock64 openssl-1.0.2a/engines/e_padlock.c
+--- openssl-1.0.2a/engines/e_padlock.c.padlock64	2015-03-19 14:19:00.000000000 +0100
++++ openssl-1.0.2a/engines/e_padlock.c	2015-04-22 16:23:44.105617468 +0200
+@@ -101,7 +101,10 @@
+  */
+ #  undef COMPILE_HW_PADLOCK
+ #  if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM)
+-#   if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \
++#  if (defined(__GNUC__) && __GNUC__>=2 && \
++       (defined(__i386__) || defined(__i386) || \
++        defined(__x86_64__) || defined(__x86_64)) \
++     ) || \
+      (defined(_MSC_VER) && defined(_M_IX86))
+ #    define COMPILE_HW_PADLOCK
+ #   endif
+@@ -140,7 +143,7 @@ void ENGINE_load_padlock(void)
+ #    endif
+ #   elif defined(__GNUC__)
+ #    ifndef alloca
+-#     define alloca(s) __builtin_alloca(s)
++#     define alloca(s) __builtin_alloca((s))
+ #    endif
+ #   endif
+ 
+@@ -303,6 +306,7 @@ static volatile struct padlock_cipher_da
+  * =======================================================
+  */
+ #   if defined(__GNUC__) && __GNUC__>=2
++#    if defined(__i386__) || defined(__i386)
+ /*
+  * As for excessive "push %ebx"/"pop %ebx" found all over.
+  * When generating position-independent code GCC won't let
+@@ -379,22 +383,6 @@ static int padlock_available(void)
+     return padlock_use_ace + padlock_use_rng;
+ }
+ 
+-#    ifndef OPENSSL_NO_AES
+-#     ifndef AES_ASM
+-/* Our own htonl()/ntohl() */
+-static inline void padlock_bswapl(AES_KEY *ks)
+-{
+-    size_t i = sizeof(ks->rd_key) / sizeof(ks->rd_key[0]);
+-    unsigned int *key = ks->rd_key;
+-
+-    while (i--) {
+-        asm volatile ("bswapl %0":"+r" (*key));
+-        key++;
+-    }
+-}
+-#     endif
+-#    endif
+-
+ /*
+  * Force key reload from memory to the CPU microcode. Loading EFLAGS from the
+  * stack clears EFLAGS[30] which does the trick.
+@@ -404,7 +392,7 @@ static inline void padlock_reload_key(vo
+     asm volatile ("pushfl; popfl");
+ }
+ 
+-#    ifndef OPENSSL_NO_AES
++#     ifndef OPENSSL_NO_AES
+ /*
+  * This is heuristic key context tracing. At first one
+  * believes that one should use atomic swap instructions,
+@@ -448,6 +436,101 @@ static inline void *name(size_t cnt,
+                 : "edx", "cc", "memory");       \
+         return iv;                              \
+ }
++#     endif
++
++#    elif defined(__x86_64__) || defined(__x86_64)
++
++/* Load supported features of the CPU to see if
++   the PadLock is available. */
++static int padlock_available(void)
++{
++    char vendor_string[16];
++    unsigned int eax, edx;
++
++    /* Are we running on the Centaur (VIA) CPU? */
++    eax = 0x00000000;
++    vendor_string[12] = 0;
++    asm volatile ("cpuid\n"
++                  "movl   %%ebx,(%1)\n"
++                  "movl   %%edx,4(%1)\n"
++                  "movl   %%ecx,8(%1)\n":"+a" (eax):"r"(vendor_string):"rbx",
++                  "rcx", "rdx");
++    if (strcmp(vendor_string, "CentaurHauls") != 0)
++        return 0;
++
++    /* Check for Centaur Extended Feature Flags presence */
++    eax = 0xC0000000;
++    asm volatile ("cpuid":"+a" (eax)::"rbx", "rcx", "rdx");
++    if (eax < 0xC0000001)
++        return 0;
++
++    /* Read the Centaur Extended Feature Flags */
++    eax = 0xC0000001;
++    asm volatile ("cpuid":"+a" (eax), "=d"(edx)::"rbx", "rcx");
++
++    /* Fill up some flags */
++    padlock_use_ace = ((edx & (0x3 << 6)) == (0x3 << 6));
++    padlock_use_rng = ((edx & (0x3 << 2)) == (0x3 << 2));
++
++    return padlock_use_ace + padlock_use_rng;
++}
++
++/* Force key reload from memory to the CPU microcode.
++   Loading EFLAGS from the stack clears EFLAGS[30]
++   which does the trick. */
++static inline void padlock_reload_key(void)
++{
++    asm volatile ("pushfq; popfq");
++}
++
++#     ifndef OPENSSL_NO_AES
++/*
++ * This is heuristic key context tracing. At first one
++ * believes that one should use atomic swap instructions,
++ * but it's not actually necessary. Point is that if
++ * padlock_saved_context was changed by another thread
++ * after we've read it and before we compare it with cdata,
++ * our key *shall* be reloaded upon thread context switch
++ * and we are therefore set in either case...
++ */
++static inline void padlock_verify_context(struct padlock_cipher_data *cdata)
++{
++    asm volatile ("pushfq\n"
++                  "       btl     $30,(%%rsp)\n"
++                  "       jnc     1f\n"
++                  "       cmpq    %2,%1\n"
++                  "       je      1f\n"
++                  "       popfq\n"
++                  "       subq    $8,%%rsp\n"
++                  "1:     addq    $8,%%rsp\n"
++                  "       movq    %2,%0":"+m" (padlock_saved_context)
++                  :"r"(padlock_saved_context), "r"(cdata):"cc");
++}
++
++/* Template for padlock_xcrypt_* modes */
++/* BIG FAT WARNING:
++ *      The offsets used with 'leal' instructions
++ *      describe items of the 'padlock_cipher_data'
++ *      structure.
++ */
++#      define PADLOCK_XCRYPT_ASM(name,rep_xcrypt)     \
++static inline void *name(size_t cnt,            \
++        struct padlock_cipher_data *cdata,      \
++        void *out, const void *inp)             \
++{       void *iv;                               \
++        asm volatile ( "leaq    16(%0),%%rdx\n" \
++                "       leaq    32(%0),%%rbx\n" \
++                        rep_xcrypt "\n"         \
++                : "=a"(iv), "=c"(cnt), "=D"(out), "=S"(inp) \
++                : "0"(cdata), "1"(cnt), "2"(out), "3"(inp)  \
++                : "rbx", "rdx", "cc", "memory");        \
++        return iv;                              \
++}
++#     endif
++
++#    endif                      /* cpu */
++
++#    ifndef OPENSSL_NO_AES
+ 
+ /* Generate all functions with appropriate opcodes */
+ /* rep xcryptecb */
+@@ -458,6 +541,20 @@ PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb, "
+     PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb, ".byte 0xf3,0x0f,0xa7,0xe0")
+ /* rep xcryptofb */
+     PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb, ".byte 0xf3,0x0f,0xa7,0xe8")
++
++#     ifndef AES_ASM
++/* Our own htonl()/ntohl() */
++static inline void padlock_bswapl(AES_KEY *ks)
++{
++    size_t i = sizeof(ks->rd_key) / sizeof(ks->rd_key[0]);
++    unsigned int *key = ks->rd_key;
++
++    while (i--) {
++        asm volatile ("bswapl %0":"+r" (*key));
++        key++;
++    }
++}
++#     endif
+ #    endif
+ /* The RNG call itself */
+ static inline unsigned int padlock_xstore(void *addr, unsigned int edx_in)
+@@ -485,8 +582,8 @@ static inline unsigned int padlock_xstor
+ static inline unsigned char *padlock_memcpy(void *dst, const void *src,
+                                             size_t n)
+ {
+-    long *d = dst;
+-    const long *s = src;
++    size_t *d = dst;
++    const size_t *s = src;
+ 
+     n /= sizeof(*d);
+     do {

openssl-1.0.2a-readme-warning.patch

@@ -0,0 +1,50 @@
+diff -up openssl-1.0.2a/README.warning openssl-1.0.2a/README
+--- openssl-1.0.2a/README.warning	2015-03-20 16:00:47.000000000 +0100
++++ openssl-1.0.2a/README	2015-03-21 09:06:11.000000000 +0100
+@@ -5,6 +5,46 @@
+  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
+  All rights reserved.
+ 
++ WARNING
++ -------
++
++ This version of OpenSSL is built in a way that supports operation in
++ the so called FIPS mode. Note though that the library as we build it
++ is not FIPS 140-2 validated and the FIPS mode is present for testing
++ purposes only.
++
++ This version also contains a few differences from the upstream code
++ some of which are:
++   * The FIPS validation support is significantly different from the
++     upstream FIPS support. For example the FIPS integrity verification
++     check is implemented differently as the FIPS module is built inside
++     the shared library. The HMAC-SHA256 checksums of the whole shared
++     libraries are verified. Also note that the FIPS integrity
++     verification check requires that the libcrypto and libssl shared
++     library files are unmodified which means that it will fail if these
++     files are changed for example by prelink.
++   * If the file /etc/system-fips is present the integrity verification
++     and selftests of the crypto algorithms are run inside the library
++     constructor code.
++   * With the /etc/system-fips present the module respects the kernel
++     FIPS flag /proc/sys/crypto/fips and tries to initialize the FIPS mode
++     if it is set to 1 aborting if the FIPS mode could not be initialized.
++     With the /etc/system-fips present it is also possible to force the
++     OpenSSL library to FIPS mode especially for debugging purposes by
++     setting the environment variable OPENSSL_FORCE_FIPS_MODE.
++   * If the environment variable OPENSSL_NO_DEFAULT_ZLIB is set the module
++     will not automatically load the built in compression method ZLIB
++     when initialized. Applications can still explicitely ask for ZLIB
++     compression method.
++   * The library was patched so the certificates, CRLs and other objects
++     signed with use of MD5 fail verification as the MD5 is too insecure
++     to be used for signatures. If the environment variable
++     OPENSSL_ENABLE_MD5_VERIFY is set, the verification can proceed
++     normally.
++   * If the OPENSSL_ENFORCE_MODULUS_BITS environment variable is set,
++     the library will not allow generation of DSA and RSA keys with
++     other lengths than specified in the FIPS 186-4 standard.
++
+  DESCRIPTION
+  -----------
+ 

openssl-1.0.2a-rsa-x931.patch

@@ -0,0 +1,35 @@
+diff -up openssl-1.0.2a/apps/genrsa.c.x931 openssl-1.0.2a/apps/genrsa.c
+--- openssl-1.0.2a/apps/genrsa.c.x931	2015-04-09 18:18:24.132107287 +0200
++++ openssl-1.0.2a/apps/genrsa.c	2015-04-09 18:18:18.852985339 +0200
+@@ -97,6 +97,7 @@ int MAIN(int argc, char **argv)
+     int ret = 1;
+     int i, num = DEFBITS;
+     long l;
++    int use_x931 = 0;
+     const EVP_CIPHER *enc = NULL;
+     unsigned long f4 = RSA_F4;
+     char *outfile = NULL;
+@@ -139,6 +140,8 @@ int MAIN(int argc, char **argv)
+             f4 = 3;
+         else if (strcmp(*argv, "-F4") == 0 || strcmp(*argv, "-f4") == 0)
+             f4 = RSA_F4;
++        else if (strcmp(*argv, "-x931") == 0)
++            use_x931 = 1;
+ # ifndef OPENSSL_NO_ENGINE
+         else if (strcmp(*argv, "-engine") == 0) {
+             if (--argc < 1)
+@@ -278,7 +281,13 @@ int MAIN(int argc, char **argv)
+     if (!rsa)
+         goto err;
+ 
+-    if (!BN_set_word(bn, f4) || !RSA_generate_key_ex(rsa, num, bn, &cb))
++    if (use_x931) {
++        if (!BN_set_word(bn, f4))
++            goto err;
++        if (!RSA_X931_generate_key_ex(rsa, num, bn, &cb))
++            goto err;
++    } else if (!BN_set_word(bn, f4)
++               || !RSA_generate_key_ex(rsa, num, bn, &cb))
+         goto err;
+ 
+     app_RAND_write_file(NULL, bio_err);

openssl-1.0.2a-version-add-engines.patch

@@ -0,0 +1,47 @@
+diff -up openssl-1.0.2a/apps/version.c.version-add-engines openssl-1.0.2a/apps/version.c
+--- openssl-1.0.2a/apps/version.c.version-add-engines	2015-04-09 18:16:42.345756005 +0200
++++ openssl-1.0.2a/apps/version.c	2015-04-09 18:16:36.573622667 +0200
+@@ -131,6 +131,7 @@
+ #ifndef OPENSSL_NO_BF
+ # include <openssl/blowfish.h>
+ #endif
++#include <openssl/engine.h>
+ 
+ #undef PROG
+ #define PROG    version_main
+@@ -140,7 +141,8 @@ int MAIN(int, char **);
+ int MAIN(int argc, char **argv)
+ {
+     int i, ret = 0;
+-    int cflags = 0, version = 0, date = 0, options = 0, platform = 0, dir = 0;
++    int cflags = 0, version = 0, date = 0, options = 0, platform = 0, dir =
++        0, engines = 0;
+ 
+     apps_startup();
+ 
+@@ -164,7 +166,7 @@ int MAIN(int argc, char **argv)
+         else if (strcmp(argv[i], "-d") == 0)
+             dir = 1;
+         else if (strcmp(argv[i], "-a") == 0)
+-            date = version = cflags = options = platform = dir = 1;
++            date = version = cflags = options = platform = dir = engines = 1;
+         else {
+             BIO_printf(bio_err, "usage:version -[avbofpd]\n");
+             ret = 1;
+@@ -208,6 +210,16 @@ int MAIN(int argc, char **argv)
+         printf("%s\n", SSLeay_version(SSLEAY_CFLAGS));
+     if (dir)
+         printf("%s\n", SSLeay_version(SSLEAY_DIR));
++    if (engines) {
++        ENGINE *e;
++        printf("engines:  ");
++        e = ENGINE_get_first();
++        while (e) {
++            printf("%s ", ENGINE_get_id(e));
++            e = ENGINE_get_next(e);
++        }
++        printf("\n");
++    }
+  end:
+     apps_shutdown();
+     OPENSSL_EXIT(ret);

openssl-1.0.2a-version.patch

@@ -0,0 +1,83 @@
+diff -up openssl-1.0.2a/crypto/cversion.c.version openssl-1.0.2a/crypto/cversion.c
+--- openssl-1.0.2a/crypto/cversion.c.version	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/crypto/cversion.c	2015-04-21 16:48:56.285535316 +0200
+@@ -62,7 +62,7 @@
+ # include "buildinf.h"
+ #endif
+ 
+-const char *SSLeay_version(int t)
++const char *_current_SSLeay_version(int t)
+ {
+     if (t == SSLEAY_VERSION)
+         return OPENSSL_VERSION_TEXT;
+@@ -101,7 +101,40 @@ const char *SSLeay_version(int t)
+     return ("not available");
+ }
+ 
+-unsigned long SSLeay(void)
++const char *_original_SSLeay_version(int t)
++{
++    if (t == SSLEAY_VERSION)
++        return "OpenSSL 1.0.0-fips 29 Mar 2010";
++    else
++        return _current_SSLeay_version(t);
++}
++
++const char *_original101_SSLeay_version(int t)
++{
++    if (t == SSLEAY_VERSION)
++        return "OpenSSL 1.0.1e-fips 11 Feb 2013";
++    else
++        return _current_SSLeay_version(t);
++}
++
++unsigned long _original_SSLeay(void)
++{
++    return (0x10000003L);
++}
++
++unsigned long _original101_SSLeay(void)
++{
++    return (0x1000105fL);
++}
++
++unsigned long _current_SSLeay(void)
+ {
+     return (SSLEAY_VERSION_NUMBER);
+ }
++
++__asm__(".symver _original_SSLeay,SSLeay@");
++__asm__(".symver _original_SSLeay_version,SSLeay_version@");
++__asm__(".symver _original101_SSLeay,SSLeay@OPENSSL_1.0.1");
++__asm__(".symver _original101_SSLeay_version,SSLeay_version@OPENSSL_1.0.1");
++__asm__(".symver _current_SSLeay,SSLeay@@OPENSSL_1.0.2");
++__asm__(".symver _current_SSLeay_version,SSLeay_version@@OPENSSL_1.0.2");
+diff -up openssl-1.0.2a/Makefile.shared.version openssl-1.0.2a/Makefile.shared
+--- openssl-1.0.2a/Makefile.shared.version	2015-04-21 16:43:02.624170648 +0200
++++ openssl-1.0.2a/Makefile.shared	2015-04-21 16:43:02.676171879 +0200
+@@ -151,7 +151,7 @@ DO_GNU_SO=$(CALC_VERSIONS); \
+ 	SHLIB_SUFFIX=; \
+ 	ALLSYMSFLAGS='-Wl,--whole-archive'; \
+ 	NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
+-	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
++	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,--default-symver,--version-script=version.map -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
+ 
+ DO_GNU_APP=LDFLAGS="$(CFLAGS)"
+ 
+diff -up openssl-1.0.2a/version.map.version openssl-1.0.2a/version.map
+--- openssl-1.0.2a/version.map.version	2015-04-21 16:43:02.676171879 +0200
++++ openssl-1.0.2a/version.map	2015-04-21 16:51:49.621630589 +0200
+@@ -0,0 +1,13 @@
++OPENSSL_1.0.1 {
++    global:
++	    SSLeay;
++	    SSLeay_version;
++    local:
++	    _original*;
++	    _current*;
++};
++OPENSSL_1.0.2 {
++    global:
++	    SSLeay;
++	    SSLeay_version;
++} OPENSSL_1.0.1;

openssl-1.0.2a-x509.patch

@@ -0,0 +1,28 @@
+diff -up openssl-1.0.2a/crypto/x509/by_file.c.x509 openssl-1.0.2a/crypto/x509/by_file.c
+--- openssl-1.0.2a/crypto/x509/by_file.c.x509	2015-04-09 18:16:29.365456157 +0200
++++ openssl-1.0.2a/crypto/x509/by_file.c	2015-04-09 18:16:26.398387618 +0200
+@@ -152,9 +152,12 @@ int X509_load_cert_file(X509_LOOKUP *ctx
+                 }
+             }
+             i = X509_STORE_add_cert(ctx->store_ctx, x);
+-            if (!i)
+-                goto err;
+-            count++;
++            /* ignore any problems with current certificate 
++               and continue with the next one */
++            if (i)
++                count++;
++            else
++                ERR_clear_error();
+             X509_free(x);
+             x = NULL;
+         }
+@@ -167,7 +170,7 @@ int X509_load_cert_file(X509_LOOKUP *ctx
+         }
+         i = X509_STORE_add_cert(ctx->store_ctx, x);
+         if (!i)
+-            goto err;
++            ERR_clear_error();
+         ret = i;
+     } else {
+         X509err(X509_F_X509_LOAD_CERT_FILE, X509_R_BAD_X509_FILETYPE);

openssl-1.0.2a-xmpp-starttls.patch

@@ -0,0 +1,27 @@
+diff -up openssl-1.0.2a/apps/s_client.c.starttls openssl-1.0.2a/apps/s_client.c
+--- openssl-1.0.2a/apps/s_client.c.starttls	2015-04-22 18:23:12.964387157 +0200
++++ openssl-1.0.2a/apps/s_client.c	2015-04-22 18:23:56.496414820 +0200
+@@ -134,7 +134,8 @@
+  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
+  * OTHERWISE.
+  */
+-
++/* for strcasestr */
++#define _GNU_SOURCE
+ #include <assert.h>
+ #include <ctype.h>
+ #include <stdio.h>
+@@ -1626,8 +1627,11 @@ int MAIN(int argc, char **argv)
+                    "xmlns='jabber:client' to='%s' version='1.0'>", host);
+         seen = BIO_read(sbio, mbuf, BUFSIZZ);
+         mbuf[seen] = 0;
+-        while (!strstr
+-               (mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'")) {
++        while (!strcasestr
++               (mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'")
++               && !strcasestr(mbuf,
++                              "<starttls xmlns=\"urn:ietf:params:xml:ns:xmpp-tls\""))
++        {
+             if (strstr(mbuf, "/stream:features>"))
+                 goto shut;
+             seen = BIO_read(sbio, mbuf, BUFSIZZ);

openssl-1.0.2c-default-paths.patch

@@ -0,0 +1,63 @@
+diff -up openssl-1.0.2c/apps/s_server.c.default-paths openssl-1.0.2c/apps/s_server.c
+--- openssl-1.0.2c/apps/s_server.c.default-paths	2015-06-12 16:51:21.000000000 +0200
++++ openssl-1.0.2c/apps/s_server.c	2015-06-15 17:24:17.747446515 +0200
+@@ -1788,12 +1788,16 @@ int MAIN(int argc, char *argv[])
+     }
+ #endif
+ 
+-    if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) ||
+-        (!SSL_CTX_set_default_verify_paths(ctx))) {
+-        /* BIO_printf(bio_err,"X509_load_verify_locations\n"); */
+-        ERR_print_errors(bio_err);
+-        /* goto end; */
++    if (CAfile == NULL && CApath == NULL) {
++        if (!SSL_CTX_set_default_verify_paths(ctx)) {
++            ERR_print_errors(bio_err);
++        }
++    } else {
++        if (!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) {
++            ERR_print_errors(bio_err);
++        }
+     }
++
+     if (vpm)
+         SSL_CTX_set1_param(ctx, vpm);
+ 
+@@ -1850,8 +1854,10 @@ int MAIN(int argc, char *argv[])
+         else
+             SSL_CTX_sess_set_cache_size(ctx2, 128);
+ 
+-        if ((!SSL_CTX_load_verify_locations(ctx2, CAfile, CApath)) ||
+-            (!SSL_CTX_set_default_verify_paths(ctx2))) {
++        if (!SSL_CTX_load_verify_locations(ctx2, CAfile, CApath)) {
++            ERR_print_errors(bio_err);
++        }
++        if (!SSL_CTX_set_default_verify_paths(ctx2)) {
+             ERR_print_errors(bio_err);
+         }
+         if (vpm)
+diff -up openssl-1.0.2c/apps/s_time.c.default-paths openssl-1.0.2c/apps/s_time.c
+--- openssl-1.0.2c/apps/s_time.c.default-paths	2015-06-12 16:51:21.000000000 +0200
++++ openssl-1.0.2c/apps/s_time.c	2015-06-15 17:24:17.747446515 +0200
+@@ -381,13 +381,14 @@ int MAIN(int argc, char **argv)
+ 
+     SSL_load_error_strings();
+ 
+-    if ((!SSL_CTX_load_verify_locations(tm_ctx, CAfile, CApath)) ||
+-        (!SSL_CTX_set_default_verify_paths(tm_ctx))) {
+-        /*
+-         * BIO_printf(bio_err,"error setting default verify locations\n");
+-         */
+-        ERR_print_errors(bio_err);
+-        /* goto end; */
++    if (CAfile == NULL && CApath == NULL) {
++        if (!SSL_CTX_set_default_verify_paths(tm_ctx)) {
++            ERR_print_errors(bio_err);
++        }
++    } else {
++        if (!SSL_CTX_load_verify_locations(tm_ctx, CAfile, CApath)) {
++            ERR_print_errors(bio_err);
++        }
+     }
+ 
+     if (tm_cipher == NULL)

openssl-1.0.2c-ecc-suiteb.patch

@@ -0,0 +1,195 @@
+diff -up openssl-1.0.2c/apps/speed.c.suiteb openssl-1.0.2c/apps/speed.c
+--- openssl-1.0.2c/apps/speed.c.suiteb	2015-06-15 17:37:06.285083685 +0200
++++ openssl-1.0.2c/apps/speed.c	2015-06-15 17:37:06.335084836 +0200
+@@ -996,78 +996,26 @@ int MAIN(int argc, char **argv)
+         } else
+ # endif
+ # ifndef OPENSSL_NO_ECDSA
+-        if (strcmp(*argv, "ecdsap160") == 0)
+-            ecdsa_doit[R_EC_P160] = 2;
+-        else if (strcmp(*argv, "ecdsap192") == 0)
+-            ecdsa_doit[R_EC_P192] = 2;
+-        else if (strcmp(*argv, "ecdsap224") == 0)
+-            ecdsa_doit[R_EC_P224] = 2;
+-        else if (strcmp(*argv, "ecdsap256") == 0)
++        if (strcmp(*argv, "ecdsap256") == 0)
+             ecdsa_doit[R_EC_P256] = 2;
+         else if (strcmp(*argv, "ecdsap384") == 0)
+             ecdsa_doit[R_EC_P384] = 2;
+         else if (strcmp(*argv, "ecdsap521") == 0)
+             ecdsa_doit[R_EC_P521] = 2;
+-        else if (strcmp(*argv, "ecdsak163") == 0)
+-            ecdsa_doit[R_EC_K163] = 2;
+-        else if (strcmp(*argv, "ecdsak233") == 0)
+-            ecdsa_doit[R_EC_K233] = 2;
+-        else if (strcmp(*argv, "ecdsak283") == 0)
+-            ecdsa_doit[R_EC_K283] = 2;
+-        else if (strcmp(*argv, "ecdsak409") == 0)
+-            ecdsa_doit[R_EC_K409] = 2;
+-        else if (strcmp(*argv, "ecdsak571") == 0)
+-            ecdsa_doit[R_EC_K571] = 2;
+-        else if (strcmp(*argv, "ecdsab163") == 0)
+-            ecdsa_doit[R_EC_B163] = 2;
+-        else if (strcmp(*argv, "ecdsab233") == 0)
+-            ecdsa_doit[R_EC_B233] = 2;
+-        else if (strcmp(*argv, "ecdsab283") == 0)
+-            ecdsa_doit[R_EC_B283] = 2;
+-        else if (strcmp(*argv, "ecdsab409") == 0)
+-            ecdsa_doit[R_EC_B409] = 2;
+-        else if (strcmp(*argv, "ecdsab571") == 0)
+-            ecdsa_doit[R_EC_B571] = 2;
+         else if (strcmp(*argv, "ecdsa") == 0) {
+-            for (i = 0; i < EC_NUM; i++)
++            for (i = R_EC_P256; i <= R_EC_P521; i++)
+                 ecdsa_doit[i] = 1;
+         } else
+ # endif
+ # ifndef OPENSSL_NO_ECDH
+-        if (strcmp(*argv, "ecdhp160") == 0)
+-            ecdh_doit[R_EC_P160] = 2;
+-        else if (strcmp(*argv, "ecdhp192") == 0)
+-            ecdh_doit[R_EC_P192] = 2;
+-        else if (strcmp(*argv, "ecdhp224") == 0)
+-            ecdh_doit[R_EC_P224] = 2;
+-        else if (strcmp(*argv, "ecdhp256") == 0)
++        if (strcmp(*argv, "ecdhp256") == 0)
+             ecdh_doit[R_EC_P256] = 2;
+         else if (strcmp(*argv, "ecdhp384") == 0)
+             ecdh_doit[R_EC_P384] = 2;
+         else if (strcmp(*argv, "ecdhp521") == 0)
+             ecdh_doit[R_EC_P521] = 2;
+-        else if (strcmp(*argv, "ecdhk163") == 0)
+-            ecdh_doit[R_EC_K163] = 2;
+-        else if (strcmp(*argv, "ecdhk233") == 0)
+-            ecdh_doit[R_EC_K233] = 2;
+-        else if (strcmp(*argv, "ecdhk283") == 0)
+-            ecdh_doit[R_EC_K283] = 2;
+-        else if (strcmp(*argv, "ecdhk409") == 0)
+-            ecdh_doit[R_EC_K409] = 2;
+-        else if (strcmp(*argv, "ecdhk571") == 0)
+-            ecdh_doit[R_EC_K571] = 2;
+-        else if (strcmp(*argv, "ecdhb163") == 0)
+-            ecdh_doit[R_EC_B163] = 2;
+-        else if (strcmp(*argv, "ecdhb233") == 0)
+-            ecdh_doit[R_EC_B233] = 2;
+-        else if (strcmp(*argv, "ecdhb283") == 0)
+-            ecdh_doit[R_EC_B283] = 2;
+-        else if (strcmp(*argv, "ecdhb409") == 0)
+-            ecdh_doit[R_EC_B409] = 2;
+-        else if (strcmp(*argv, "ecdhb571") == 0)
+-            ecdh_doit[R_EC_B571] = 2;
+         else if (strcmp(*argv, "ecdh") == 0) {
+-            for (i = 0; i < EC_NUM; i++)
++            for (i = R_EC_P256; i <= R_EC_P521; i++)
+                 ecdh_doit[i] = 1;
+         } else
+ # endif
+@@ -1156,21 +1104,11 @@ int MAIN(int argc, char **argv)
+             BIO_printf(bio_err, "dsa512   dsa1024  dsa2048\n");
+ # endif
+ # ifndef OPENSSL_NO_ECDSA
+-            BIO_printf(bio_err, "ecdsap160 ecdsap192 ecdsap224 "
+-                       "ecdsap256 ecdsap384 ecdsap521\n");
+-            BIO_printf(bio_err,
+-                       "ecdsak163 ecdsak233 ecdsak283 ecdsak409 ecdsak571\n");
+-            BIO_printf(bio_err,
+-                       "ecdsab163 ecdsab233 ecdsab283 ecdsab409 ecdsab571\n");
++            BIO_printf(bio_err, "ecdsap256 ecdsap384 ecdsap521\n");
+             BIO_printf(bio_err, "ecdsa\n");
+ # endif
+ # ifndef OPENSSL_NO_ECDH
+-            BIO_printf(bio_err, "ecdhp160  ecdhp192  ecdhp224 "
+-                       "ecdhp256  ecdhp384  ecdhp521\n");
+-            BIO_printf(bio_err,
+-                       "ecdhk163  ecdhk233  ecdhk283  ecdhk409  ecdhk571\n");
+-            BIO_printf(bio_err,
+-                       "ecdhb163  ecdhb233  ecdhb283  ecdhb409  ecdhb571\n");
++            BIO_printf(bio_err, "ecdhp256  ecdhp384  ecdhp521\n");
+             BIO_printf(bio_err, "ecdh\n");
+ # endif
+ 
+@@ -1255,11 +1193,11 @@ int MAIN(int argc, char **argv)
+             if (!FIPS_mode() || i != R_DSA_512)
+                 dsa_doit[i] = 1;
+ # ifndef OPENSSL_NO_ECDSA
+-        for (i = 0; i < EC_NUM; i++)
++        for (i = R_EC_P256; i <= R_EC_P521; i++)
+             ecdsa_doit[i] = 1;
+ # endif
+ # ifndef OPENSSL_NO_ECDH
+-        for (i = 0; i < EC_NUM; i++)
++        for (i = R_EC_P256; i <= R_EC_P521; i++)
+             ecdh_doit[i] = 1;
+ # endif
+     }
+diff -up openssl-1.0.2c/ssl/t1_lib.c.suiteb openssl-1.0.2c/ssl/t1_lib.c
+--- openssl-1.0.2c/ssl/t1_lib.c.suiteb	2015-06-12 16:51:27.000000000 +0200
++++ openssl-1.0.2c/ssl/t1_lib.c	2015-06-15 17:44:03.578681271 +0200
+@@ -268,11 +268,7 @@ static const unsigned char eccurves_auto
+     0, 23,                      /* secp256r1 (23) */
+     /* Other >= 256-bit prime curves. */
+     0, 25,                      /* secp521r1 (25) */
+-    0, 28,                      /* brainpool512r1 (28) */
+-    0, 27,                      /* brainpoolP384r1 (27) */
+     0, 24,                      /* secp384r1 (24) */
+-    0, 26,                      /* brainpoolP256r1 (26) */
+-    0, 22,                      /* secp256k1 (22) */
+ # ifndef OPENSSL_NO_EC2M
+     /* >= 256-bit binary curves. */
+     0, 14,                      /* sect571r1 (14) */
+@@ -289,11 +285,7 @@ static const unsigned char eccurves_all[
+     0, 23,                      /* secp256r1 (23) */
+     /* Other >= 256-bit prime curves. */
+     0, 25,                      /* secp521r1 (25) */
+-    0, 28,                      /* brainpool512r1 (28) */
+-    0, 27,                      /* brainpoolP384r1 (27) */
+     0, 24,                      /* secp384r1 (24) */
+-    0, 26,                      /* brainpoolP256r1 (26) */
+-    0, 22,                      /* secp256k1 (22) */
+ # ifndef OPENSSL_NO_EC2M
+     /* >= 256-bit binary curves. */
+     0, 14,                      /* sect571r1 (14) */
+@@ -307,13 +299,6 @@ static const unsigned char eccurves_all[
+      * Remaining curves disabled by default but still permitted if set
+      * via an explicit callback or parameters.
+      */
+-    0, 20,                      /* secp224k1 (20) */
+-    0, 21,                      /* secp224r1 (21) */
+-    0, 18,                      /* secp192k1 (18) */
+-    0, 19,                      /* secp192r1 (19) */
+-    0, 15,                      /* secp160k1 (15) */
+-    0, 16,                      /* secp160r1 (16) */
+-    0, 17,                      /* secp160r2 (17) */
+ # ifndef OPENSSL_NO_EC2M
+     0, 8,                       /* sect239k1 (8) */
+     0, 6,                       /* sect233k1 (6) */
+@@ -348,29 +333,21 @@ static const unsigned char fips_curves_d
+     0, 9,                       /* sect283k1 (9) */
+     0, 10,                      /* sect283r1 (10) */
+ #  endif
+-    0, 22,                      /* secp256k1 (22) */
+     0, 23,                      /* secp256r1 (23) */
+ #  ifndef OPENSSL_NO_EC2M
+     0, 8,                       /* sect239k1 (8) */
+     0, 6,                       /* sect233k1 (6) */
+     0, 7,                       /* sect233r1 (7) */
+ #  endif
+-    0, 20,                      /* secp224k1 (20) */
+-    0, 21,                      /* secp224r1 (21) */
+ #  ifndef OPENSSL_NO_EC2M
+     0, 4,                       /* sect193r1 (4) */
+     0, 5,                       /* sect193r2 (5) */
+ #  endif
+-    0, 18,                      /* secp192k1 (18) */
+-    0, 19,                      /* secp192r1 (19) */
+ #  ifndef OPENSSL_NO_EC2M
+     0, 1,                       /* sect163k1 (1) */
+     0, 2,                       /* sect163r1 (2) */
+     0, 3,                       /* sect163r2 (3) */
+ #  endif
+-    0, 15,                      /* secp160k1 (15) */
+-    0, 16,                      /* secp160r1 (16) */
+-    0, 17,                      /* secp160r2 (17) */
+ };
+ # endif
+ 

openssl-1.0.2d-secp256k1.patch

@@ -0,0 +1,82 @@
+diff -up openssl-1.0.2d/crypto/ec/ec_curve.c.secp256k1 openssl-1.0.2d/crypto/ec/ec_curve.c
+--- openssl-1.0.2d/crypto/ec/ec_curve.c.secp256k1	2015-08-12 14:55:15.203415420 -0400
++++ openssl-1.0.2d/crypto/ec/ec_curve.c	2015-08-12 15:07:12.659113262 -0400
+@@ -86,6 +86,42 @@ typedef struct {
+     unsigned int cofactor;      /* promoted to BN_ULONG */
+ } EC_CURVE_DATA;
+ 
++static const struct {
++    EC_CURVE_DATA h;
++    unsigned char data[0 + 32 * 6];
++} _EC_SECG_PRIME_256K1 = {
++    {
++        NID_X9_62_prime_field, 0, 32, 1
++    },
++    {
++        /* no seed */
++        /* p */
++        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++        0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x2F,
++        /* a */
++        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++        /* b */
++        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07,
++        /* x */
++        0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC, 0x55, 0xA0, 0x62, 0x95,
++        0xCE, 0x87, 0x0B, 0x07, 0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE, 0x28, 0xD9,
++        0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17, 0x98,
++        /* y */
++        0x48, 0x3a, 0xda, 0x77, 0x26, 0xa3, 0xc4, 0x65, 0x5d, 0xa4, 0xfb, 0xfc,
++        0x0e, 0x11, 0x08, 0xa8, 0xfd, 0x17, 0xb4, 0x48, 0xa6, 0x85, 0x54, 0x19,
++        0x9c, 0x47, 0xd0, 0x8f, 0xfb, 0x10, 0xd4, 0xb8,
++        /* order */
++        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++        0xFF, 0xFF, 0xFF, 0xFE, 0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,
++        0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41
++    }
++};
++
+ /* the nist prime curves */
+ static const struct {
+     EC_CURVE_DATA h;
+@@ -235,6 +271,8 @@ typedef struct _ec_list_element_st {
+ static const ec_list_element curve_list[] = {
+     /* prime field curves */
+     /* secg curves */
++    {NID_secp256k1, &_EC_SECG_PRIME_256K1.h, 0,
++     "SECG curve over a 256 bit prime field"},
+     /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */
+     {NID_secp384r1, &_EC_NIST_PRIME_384.h, 0,
+      "NIST/SECG curve over a 384 bit prime field"},
+diff -up openssl-1.0.2d/ssl/t1_lib.c.secp256k1 openssl-1.0.2d/ssl/t1_lib.c
+--- openssl-1.0.2d/ssl/t1_lib.c.secp256k1	2015-08-12 15:04:42.876925441 -0400
++++ openssl-1.0.2d/ssl/t1_lib.c	2015-08-12 15:04:47.837699822 -0400
+@@ -269,6 +269,7 @@ static const unsigned char eccurves_auto
+     /* Other >= 256-bit prime curves. */
+     0, 25,                      /* secp521r1 (25) */
+     0, 24,                      /* secp384r1 (24) */
++    0, 22,                      /* secp256k1 (22) */
+ # ifndef OPENSSL_NO_EC2M
+     /* >= 256-bit binary curves. */
+     0, 14,                      /* sect571r1 (14) */
+@@ -286,6 +287,7 @@ static const unsigned char eccurves_all[
+     /* Other >= 256-bit prime curves. */
+     0, 25,                      /* secp521r1 (25) */
+     0, 24,                      /* secp384r1 (24) */
++    0, 22,                      /* secp256k1 (22) */
+ # ifndef OPENSSL_NO_EC2M
+     /* >= 256-bit binary curves. */
+     0, 14,                      /* sect571r1 (14) */
+@@ -333,6 +335,7 @@ static const unsigned char fips_curves_d
+     0, 9,                       /* sect283k1 (9) */
+     0, 10,                      /* sect283r1 (10) */
+ #  endif
++    0, 22,                      /* secp256k1 (22) */
+     0, 23,                      /* secp256r1 (23) */
+ #  ifndef OPENSSL_NO_EC2M
+     0, 8,                       /* sect239k1 (8) */

openssl-1.0.2e-remove-nistp224.patch

@@ -0,0 +1,15 @@
+diff -up openssl-1.0.2e/crypto/ec/ec.h.nistp224 openssl-1.0.2e/crypto/ec/ec.h
+--- openssl-1.0.2e/crypto/ec/ec.h.nistp224	2015-12-04 14:00:57.000000000 +0100
++++ openssl-1.0.2e/crypto/ec/ec.h	2015-12-08 15:51:37.046747916 +0100
+@@ -149,11 +149,6 @@ const EC_METHOD *EC_GFp_mont_method(void
+ const EC_METHOD *EC_GFp_nist_method(void);
+ 
+ # ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+-/** Returns 64-bit optimized methods for nistp224
+- *  \return  EC_METHOD object
+- */
+-const EC_METHOD *EC_GFp_nistp224_method(void);
+-
+ /** Returns 64-bit optimized methods for nistp256
+  *  \return  EC_METHOD object
+  */

openssl-1.0.2e-rpmbuild.patch

@@ -0,0 +1,115 @@
+diff -up openssl-1.0.2e/Configure.rpmbuild openssl-1.0.2e/Configure
+--- openssl-1.0.2e/Configure.rpmbuild	2015-12-03 15:04:23.000000000 +0100
++++ openssl-1.0.2e/Configure	2015-12-04 13:20:22.996835604 +0100
+@@ -365,8 +365,8 @@ my %table=(
+ ####
+ # *-generic* is endian-neutral target, but ./config is free to
+ # throw in -D[BL]_ENDIAN, whichever appropriate...
+-"linux-generic32","gcc:-O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-ppc",	"gcc:-DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-generic32","gcc:-Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
++"linux-ppc",	"gcc:-DB_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
+ 
+ #######################################################################
+ # Note that -march is not among compiler options in below linux-armv4
+@@ -395,31 +395,31 @@ my %table=(
+ #
+ #       ./Configure linux-armv4 -march=armv6 -D__ARM_MAX_ARCH__=8
+ #
+-"linux-armv4",	"gcc: -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-aarch64","gcc: -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${aarch64_asm}:linux64:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-armv4",	"gcc:-Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
++"linux-aarch64","gcc:-DL_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${aarch64_asm}:linux64:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
+ # Configure script adds minimally required -march for assembly support,
+ # if no -march was specified at command line. mips32 and mips64 below
+ # refer to contemporary MIPS Architecture specifications, MIPS32 and
+ # MIPS64, rather than to kernel bitness.
+-"linux-mips32",	"gcc:-mabi=32 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips32_asm}:o32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-mips64",   "gcc:-mabi=n32 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:n32:dlfcn:linux-shared:-fPIC:-mabi=n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::32",
+-"linux64-mips64",   "gcc:-mabi=64 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:64:dlfcn:linux-shared:-fPIC:-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"linux-mips32",	"gcc:-mabi=32 -Wall \$(RPM_OPT_FLAGS) -DBN_DIV3W::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips32_asm}:o32:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
++"linux-mips64",   "gcc:-mabi=n32 -Wall \$(RPM_OPT_FLAGS) -DBN_DIV3W::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:n32:dlfcn:linux-shared:-fPIC:-mabi=n32 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::32",
++"linux64-mips64",   "gcc:-mabi=64 -Wall \$(RPM_OPT_FLAGS) -DBN_DIV3W::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:64:dlfcn:linux-shared:-fPIC:-mabi=64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
+ #### IA-32 targets...
+ "linux-ia32-icc",	"icc:-DL_ENDIAN -O2::-D_REENTRANT::-ldl -no_cpprt:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-elf",	"gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-elf",	"gcc:-DL_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
+ "linux-aout",	"gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -march=i486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out",
+ ####
+-"linux-generic64","gcc:-O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-ppc64",	"gcc:-m64 -DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+-"linux-ppc64le","gcc:-m64 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:$ppc64_asm:linux64le:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::",
+-"linux-ia64",	"gcc:-DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-generic64","gcc:-Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
++"linux-ppc64",	"gcc:-m64 -DB_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
++"linux-ppc64le","gcc:-m64 -DL_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:$ppc64_asm:linux64le:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
++"linux-ia64",	"gcc:-DL_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
+ "linux-ia64-icc","icc:-DL_ENDIAN -O2 -Wall::-D_REENTRANT::-ldl -no_cpprt:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-x86_64",	"gcc:-m64 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"linux-x86_64",	"gcc:-m64 -DL_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
+ "linux-x86_64-clang",	"clang: -m64 -DL_ENDIAN -O3 -Wall -Wextra $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+ "debug-linux-x86_64-clang",	"clang: -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -m64 -DL_ENDIAN -g -Wall -Wextra $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+ "linux-x86_64-icc", "icc:-DL_ENDIAN -O2::-D_REENTRANT::-ldl -no_cpprt:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+ "linux-x32",	"gcc:-mx32 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-mx32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::x32",
+-"linux64-s390x",	"gcc:-m64 -DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"linux64-s390x",	"gcc:-m64 -DB_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
+ #### So called "highgprs" target for z/Architecture CPUs
+ # "Highgprs" is kernel feature first implemented in Linux 2.6.32, see
+ # /proc/cpuinfo. The idea is to preserve most significant bits of
+@@ -437,12 +437,12 @@ my %table=(
+ #### SPARC Linux setups
+ # Ray Miller <ray.miller@computing-services.oxford.ac.uk> has patiently
+ # assisted with debugging of following two configs.
+-"linux-sparcv8","gcc:-mcpu=v8 -DB_ENDIAN -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-sparcv8","gcc:-mcpu=v8 -DB_ENDIAN -Wall \$(RPM_OPT_FLAGS) -DBN_DIV2W::-D_REENTRANT::\$(RPM_LD_FLAGS) -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
+ # it's a real mess with -mcpu=ultrasparc option under Linux, but
+ # -Wa,-Av8plus should do the trick no matter what.
+-"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -Wall \$(RPM_OPT_FLAGS) -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:\$(RPM_LD_FLAGS) -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m32 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
+ # GCC 3.1 is a requirement
+-"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT:ULTRASPARC:\$(RPM_LD_FLAGS) -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
+ #### Alpha Linux with GNU C and Compaq C setups
+ # Special notes:
+ # - linux-alpha+bwx-gcc is ment to be used from ./config only. If you
+@@ -1767,7 +1767,7 @@ while (<IN>)
+ 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
+ 		{
+ 		my $sotmp = $1;
+-		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
++		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SONAMEVER) .s$sotmp/;
+ 		}
+ 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
+ 		{
+diff -up openssl-1.0.2e/Makefile.org.rpmbuild openssl-1.0.2e/Makefile.org
+--- openssl-1.0.2e/Makefile.org.rpmbuild	2015-12-03 15:04:23.000000000 +0100
++++ openssl-1.0.2e/Makefile.org	2015-12-04 13:18:44.913538616 +0100
+@@ -10,6 +10,7 @@ SHLIB_VERSION_HISTORY=
+ SHLIB_MAJOR=
+ SHLIB_MINOR=
+ SHLIB_EXT=
++SHLIB_SONAMEVER=10
+ PLATFORM=dist
+ OPTIONS=
+ CONFIGURE_ARGS=
+@@ -341,10 +342,9 @@ clean-shared:
+ link-shared:
+ 	@ set -e; for i in $(SHLIBDIRS); do \
+ 		$(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \
+-			LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
++			LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
+ 			LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
+ 			symlink.$(SHLIB_TARGET); \
+-		libs="$$libs -l$$i"; \
+ 	done
+ 
+ build-shared: do_$(SHLIB_TARGET) link-shared
+@@ -355,7 +355,7 @@ do_$(SHLIB_TARGET):
+ 			libs="$(LIBKRB5) $$libs"; \
+ 		fi; \
+ 		$(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \
+-			LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
++			LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
+ 			LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
+ 			LIBDEPS="$$libs $(EX_LIBS)" \
+ 			link_a.$(SHLIB_TARGET); \

openssl-1.0.2e-speed-doc.patch

@@ -0,0 +1,58 @@
+diff -up openssl-1.0.2e/apps/speed.c.speed-doc openssl-1.0.2e/apps/speed.c
+--- openssl-1.0.2e/apps/speed.c.speed-doc	2015-12-04 14:00:58.000000000 +0100
++++ openssl-1.0.2e/apps/speed.c	2016-01-15 14:15:56.482343557 +0100
+@@ -648,10 +648,6 @@ int MAIN(int argc, char **argv)
+ # endif
+     int multiblock = 0;
+ 
+-# ifndef TIMES
+-    usertime = -1;
+-# endif
+-
+     apps_startup();
+     memset(results, 0, sizeof(results));
+ # ifndef OPENSSL_NO_DSA
+@@ -1145,10 +1141,8 @@ int MAIN(int argc, char **argv)
+ 
+             BIO_printf(bio_err, "\n");
+             BIO_printf(bio_err, "Available options:\n");
+-# if defined(TIMES) || defined(USE_TOD)
+             BIO_printf(bio_err, "-elapsed        "
+                        "measure time in real time instead of CPU user time.\n");
+-# endif
+ # ifndef OPENSSL_NO_ENGINE
+             BIO_printf(bio_err,
+                        "-engine e       "
+diff -up openssl-1.0.2e/doc/apps/speed.pod.speed-doc openssl-1.0.2e/doc/apps/speed.pod
+--- openssl-1.0.2e/doc/apps/speed.pod.speed-doc	2015-12-03 14:42:07.000000000 +0100
++++ openssl-1.0.2e/doc/apps/speed.pod	2016-01-15 14:05:23.044222376 +0100
+@@ -8,6 +8,9 @@ speed - test library performance
+ 
+ B<openssl speed>
+ [B<-engine id>]
++[B<-elapsed>]
++[B<-evp algo>]
++[B<-decrypt>]
+ [B<md2>]
+ [B<mdc2>]
+ [B<md5>]
+@@ -49,6 +52,19 @@ to attempt to obtain a functional refere
+ thus initialising it if needed. The engine will then be set as the default
+ for all available algorithms.
+ 
++=item B<-elapsed>
++
++Measure time in real time instead of CPU time. It can be useful when testing
++speed of hardware engines.
++
++=item B<-evp algo>
++
++Use the specified cipher or message digest algorithm via the EVP interface.
++
++=item B<-decrypt>
++
++Time the decryption instead of encryption. Affects only the EVP testing.
++
+ =item B<[zero or more test algorithms]>
+ 
+ If any options are given, B<speed> tests those algorithms, otherwise all of

openssl-1.0.2g-disable-sslv2v3.patch

@@ -0,0 +1,18 @@
+diff -up openssl-1.0.2g/ssl/ssl_lib.c.v2v3 openssl-1.0.2g/ssl/ssl_lib.c
+--- openssl-1.0.2g/ssl/ssl_lib.c.v2v3	2016-03-01 16:38:26.879142021 +0100
++++ openssl-1.0.2g/ssl/ssl_lib.c	2016-03-01 16:41:32.977353769 +0100
+@@ -2055,11 +2055,11 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *m
+     ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
+ 
+     /*
+-     * Disable SSLv2 by default, callers that want to enable SSLv2 will have to
+-     * explicitly clear this option via either of SSL_CTX_clear_options() or
++     * Disable SSLv2 and SSLv3 by default, callers that want to enable these will have to
++     * explicitly clear these options via either of SSL_CTX_clear_options() or
+      * SSL_clear_options().
+      */
+-    ret->options |= SSL_OP_NO_SSLv2;
++    ret->options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
+ 
+     return (ret);
+  err:

openssl-1.0.2h-pkgconfig.patch

@@ -0,0 +1,24 @@
+diff -up openssl-1.0.2h/Makefile.org.pkgconfig openssl-1.0.2h/Makefile.org
+--- openssl-1.0.2h/Makefile.org.pkgconfig	2016-05-03 18:06:45.869834730 +0200
++++ openssl-1.0.2h/Makefile.org	2016-06-27 12:04:15.444245018 +0200
+@@ -377,7 +377,7 @@ libcrypto.pc: Makefile
+ 	    echo 'Requires: '; \
+ 	    echo 'Libs: -L$${libdir} -lcrypto'; \
+ 	    echo 'Libs.private: $(EX_LIBS)'; \
+-	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libcrypto.pc
++	    echo 'Cflags: -I$${includedir}' ) > libcrypto.pc
+ 
+ libssl.pc: Makefile
+ 	@ ( echo 'prefix=$(INSTALLTOP)'; \
+@@ -388,9 +388,9 @@ libssl.pc: Makefile
+ 	    echo 'Name: OpenSSL-libssl'; \
+ 	    echo 'Description: Secure Sockets Layer and cryptography libraries'; \
+ 	    echo 'Version: '$(VERSION); \
+-	    echo 'Requires.private: libcrypto'; \
++	    echo 'Requires: libcrypto'; \
+ 	    echo 'Libs: -L$${libdir} -lssl'; \
+-	    echo 'Libs.private: $(EX_LIBS)'; \
++	    echo 'Libs.private: $(EX_LIBS) $(LIBKRB5)'; \
+ 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libssl.pc
+ 
+ openssl.pc: Makefile

openssl-1.0.2i-chil-fixes.patch

@@ -0,0 +1,15 @@
+diff -up openssl-1.0.2i/engines/e_chil.c.chil openssl-1.0.2i/engines/e_chil.c
+--- openssl-1.0.2i/engines/e_chil.c.chil	2016-09-22 12:23:06.000000000 +0200
++++ openssl-1.0.2i/engines/e_chil.c	2016-09-22 13:49:32.532017102 +0200
+@@ -1274,6 +1274,11 @@ static int hwcrhk_insert_card(const char
+     UI *ui;
+     void *callback_data = NULL;
+     UI_METHOD *ui_method = NULL;
++    /* Despite what the documentation says prompt_info can be
++     * an empty string.
++     */
++    if (prompt_info && !*prompt_info)
++        prompt_info = NULL;
+ 
+     if (cactx) {
+         if (cactx->ui_method)

openssl-1.0.2i-enc-fail.patch

@@ -0,0 +1,25 @@
+diff -up openssl-1.0.2i/crypto/evp/bio_enc.c.enc-fail openssl-1.0.2i/crypto/evp/bio_enc.c
+--- openssl-1.0.2i/crypto/evp/bio_enc.c.enc-fail	2016-09-22 12:23:06.000000000 +0200
++++ openssl-1.0.2i/crypto/evp/bio_enc.c	2016-09-22 13:58:24.592381002 +0200
+@@ -307,8 +307,9 @@ static long enc_ctrl(BIO *b, int cmd, lo
+     case BIO_CTRL_RESET:
+         ctx->ok = 1;
+         ctx->finished = 0;
+-        EVP_CipherInit_ex(&(ctx->cipher), NULL, NULL, NULL, NULL,
+-                          ctx->cipher.encrypt);
++        if (!EVP_CipherInit_ex(&(ctx->cipher), NULL, NULL, NULL, NULL,
++                               ctx->cipher.encrypt))
++             ctx->ok = 0;
+         ret = BIO_ctrl(b->next_bio, cmd, num, ptr);
+         break;
+     case BIO_CTRL_EOF:         /* More to read */
+@@ -430,7 +431,8 @@ void BIO_set_cipher(BIO *b, const EVP_CI
+ 
+     b->init = 1;
+     ctx = (BIO_ENC_CTX *)b->ptr;
+-    EVP_CipherInit_ex(&(ctx->cipher), c, NULL, k, i, e);
++    if (!EVP_CipherInit_ex(&(ctx->cipher), c, NULL, k, i, e))
++        ctx->ok = 0;
+ 
+     if (b->callback != NULL)
+         b->callback(b, BIO_CB_CTRL, (const char *)c, BIO_CTRL_SET, e, 1L);

openssl-1.0.2i-enginesdir.patch

@@ -0,0 +1,83 @@
+diff --git a/Configure b/Configure
+index c39f71a..7f3d905 100755
+--- a/Configure
++++ b/Configure
+@@ -727,6 +727,7 @@ my $idx_multilib = $idx++;
+ my $prefix="";
+ my $libdir="";
+ my $openssldir="";
++my $enginesdir="";
+ my $exe_ext="";
+ my $install_prefix= "$ENV{'INSTALL_PREFIX'}";
+ my $cross_compile_prefix="";
+@@ -956,6 +957,10 @@ PROCESS_ARGS:
+ 				{
+ 				$openssldir=$1;
+ 				}
++			elsif (/^--enginesdir=(.*)$/)
++				{
++				$enginesdir=$1;
++				}
+ 			elsif (/^--install.prefix=(.*)$/)
+ 				{
+ 				$install_prefix=$1;
+@@ -1207,7 +1212,7 @@ chop $prefix if $prefix =~ /.\/$/;
+ 
+ $openssldir=$prefix . "/ssl" if $openssldir eq "";
+ $openssldir=$prefix . "/" . $openssldir if $openssldir !~ /(^\/|^[a-zA-Z]:[\\\/])/;
+-
++$enginesdir="$prefix/lib/engines" if $enginesdir eq "";
+ 
+ print "IsMK1MF=$IsMK1MF\n";
+ 
+@@ -1709,6 +1714,7 @@ while (<IN>)
+ 	s/^INSTALLTOP=.*$/INSTALLTOP=$prefix/;
+ 	s/^MULTILIB=.*$/MULTILIB=$multilib/;
+ 	s/^OPENSSLDIR=.*$/OPENSSLDIR=$openssldir/;
++	s/^ENGINESDIR=.*$/ENGINESDIR=$enginesdir/;
+ 	s/^LIBDIR=.*$/LIBDIR=$libdir/;
+ 	s/^INSTALL_PREFIX=.*$/INSTALL_PREFIX=$install_prefix/;
+ 	s/^PLATFORM=.*$/PLATFORM=$target/;
+@@ -1915,7 +1921,7 @@ while (<IN>)
+ 		}
+ 	elsif	(/^#define\s+ENGINESDIR/)
+ 		{
+-		my $foo = "$prefix/$libdir/engines";
++		my $foo = "$enginesdir";
+ 		$foo =~ s/\\/\\\\/g;
+ 		print OUT "#define ENGINESDIR \"$foo\"\n";
+ 		}
+diff --git a/Makefile.org b/Makefile.org
+index 2377f50..fe8d54c 100644
+--- a/Makefile.org
++++ b/Makefile.org
+@@ -28,6 +28,7 @@ INSTALLTOP=/usr/local/ssl
+ 
+ # Do not edit this manually. Use Configure --openssldir=DIR do change this!
+ OPENSSLDIR=/usr/local/ssl
++ENGINESDIR=$${libdir}/engines
+ 
+ # NO_IDEA - Define to build without the IDEA algorithm
+ # NO_RC4  - Define to build without the RC4 algorithm
+@@ -368,7 +369,7 @@ libcrypto.pc: Makefile
+ 	    echo 'exec_prefix=$${prefix}'; \
+ 	    echo 'libdir=$${exec_prefix}/$(LIBDIR)'; \
+ 	    echo 'includedir=$${prefix}/include'; \
+-	    echo 'enginesdir=$${libdir}/engines'; \
++	    echo 'enginesdir=$(ENGINESDIR)'; \
+ 	    echo ''; \
+ 	    echo 'Name: OpenSSL-libcrypto'; \
+ 	    echo 'Description: OpenSSL cryptography library'; \
+diff --git a/engines/Makefile b/engines/Makefile
+index 2058ff4..a2c407b 100644
+--- a/engines/Makefile
++++ b/engines/Makefile
+@@ -124,7 +124,7 @@ install:
+ 				esac; \
+ 				cp $$pfx$$l$$sfx $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
+ 			  fi; \
+-			  chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
++			  chmod 755 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
+ 			  mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx ); \
+ 		done; \
+ 	fi

openssl-1.0.2j-deprecate-algos.patch

@@ -0,0 +1,226 @@
+diff -up openssl-1.0.2j/crypto/asn1/a_verify.c.deprecate-algos openssl-1.0.2j/crypto/asn1/a_verify.c
+--- openssl-1.0.2j/crypto/asn1/a_verify.c.deprecate-algos	2016-09-26 11:49:07.000000000 +0200
++++ openssl-1.0.2j/crypto/asn1/a_verify.c	2017-01-09 16:47:11.666994197 +0100
+@@ -56,6 +56,9 @@
+  * [including the GNU Public Licence.]
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
++
+ #include <stdio.h>
+ #include <time.h>
+ 
+@@ -133,6 +136,30 @@ int ASN1_verify(i2d_of_void *i2d, X509_A
+ 
+ #endif
+ 
++static int legacy_mds[] = { NID_md5, NID_sha, NID_md4, NID_md2, 0 };
++extern int private_ossl_allowed_legacy_mds[];
++
++static int is_md_legacy_disallowed(int mdnid)
++{
++    int i;
++
++    if (mdnid == NID_md5 && secure_getenv("OPENSSL_ENABLE_MD5_VERIFY") != NULL)
++        return 0;
++
++    for (i = 0; legacy_mds[i] != 0; ++i) {
++         if (mdnid == legacy_mds[i]) {
++            int j;
++
++            for (j = 0; private_ossl_allowed_legacy_mds[j] != 0; ++j) {
++                 if (mdnid == private_ossl_allowed_legacy_mds[j])
++                     return 0;
++            }
++            return 1;
++        }
++     }
++     return 0;
++}
++
+ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a,
+                      ASN1_BIT_STRING *signature, void *asn, EVP_PKEY *pkey)
+ {
+@@ -174,6 +201,10 @@ int ASN1_item_verify(const ASN1_ITEM *it
+         if (ret != 2)
+             goto err;
+         ret = -1;
++    } else if (is_md_legacy_disallowed(mdnid)) {
++        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,
++                ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
++        goto err;
+     } else {
+         const EVP_MD *type;
+         type = EVP_get_digestbynid(mdnid);
+diff -up openssl-1.0.2j/crypto/o_init.c.deprecate-algos openssl-1.0.2j/crypto/o_init.c
+--- openssl-1.0.2j/crypto/o_init.c.deprecate-algos	2017-01-05 17:49:00.000000000 +0100
++++ openssl-1.0.2j/crypto/o_init.c	2017-01-09 16:52:29.018298611 +0100
+@@ -64,11 +64,21 @@
+ # include <unistd.h>
+ # include <errno.h>
+ # include <stdlib.h>
++# include <stdio.h>
++# include <string.h>
++# include <strings.h>
++# include <ctype.h>
+ # include <openssl/fips.h>
+ # include <openssl/rand.h>
++# include <openssl/dh.h>
++# include <openssl/objects.h>
+ 
+ # define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled"
+ 
++# define LEGACY_SETTINGS_FILE "/etc/pki/tls/legacy-settings"
++
++# define NUM_MAX_LEGACY_MDS 8
++
+ static void init_fips_mode(void)
+ {
+     char buf[2] = "0";
+@@ -98,6 +108,115 @@ static void init_fips_mode(void)
+ }
+ #endif
+ 
++int private_ossl_allowed_legacy_mds[NUM_MAX_LEGACY_MDS + 1]; /* zero terminated */
++
++int private_ossl_minimum_dh_bits;
++
++static void parse_legacy_mds(char *p)
++{
++    int idx = 0;
++    char *e = p;
++
++    while (p[0] != '\0') {
++        while (e[0] != '\0' && !isspace(e[0]) && e[0] != ',') {
++            ++e;
++        }
++        if (e[0] != '\0') {
++            e[0] = '\0';
++            ++e;
++        }
++
++        if (strcasecmp(p, "md5") == 0) {
++            private_ossl_allowed_legacy_mds[idx++] = NID_md5;
++        } else if (strcasecmp(p, "md4") == 0) {
++            private_ossl_allowed_legacy_mds[idx++] = NID_md4;
++        } else if (strcasecmp(p, "sha") == 0) {
++            private_ossl_allowed_legacy_mds[idx++] = NID_sha;
++        } else if (strcasecmp(p, "md2") == 0) {
++            private_ossl_allowed_legacy_mds[idx++] = NID_md2;
++        }
++
++        if (idx >=
++            sizeof(private_ossl_allowed_legacy_mds) /
++            sizeof(private_ossl_allowed_legacy_mds[0])) {
++            break;
++        }
++
++        while (e[0] == ',' || isspace(e[0])) {
++            ++e;
++        }
++
++        p = e;
++    }
++}
++
++static void parse_minimum_dh_bits(char *p)
++{
++    private_ossl_minimum_dh_bits = strtol(p, NULL, 10);
++    if (private_ossl_minimum_dh_bits < 512
++        || private_ossl_minimum_dh_bits > OPENSSL_DH_MAX_MODULUS_BITS) {
++        /* use default */
++        private_ossl_minimum_dh_bits = 0;
++    }
++}
++
++static void load_legacy_settings(void)
++{
++    FILE *f;
++    char *line = NULL;
++    size_t len = 0;
++
++    if ((f = fopen(LEGACY_SETTINGS_FILE, "r")) == NULL) {
++        return;
++    }
++
++    while (getline(&line, &len, f) > 0) {
++        char *p = line, *e, *val;
++
++        /* skip initial whitespace */
++        while (isspace(p[0])) {
++            ++p;
++        }
++
++        e = p;
++
++        while (e[0] != '\0' && !isspace(e[0])) {
++            ++e;
++        }
++
++        /* terminate name, skip whitespace between name and value */
++        if (e[0] != '\0') {
++            e[0] = '\0';
++            ++e;
++            while (isspace(e[0])) {
++                ++e;
++            }
++        }
++
++        val = e;
++
++        e = e + strlen(val);
++
++        /* trim terminating whitespace */
++        while (e > val) {
++            --e;
++            if (isspace(e[0])) {
++                e[0] = '\0';
++            } else {
++                break;
++            }
++        }
++
++        if (strcasecmp(p, "LegacySigningMDs") == 0) {
++            parse_legacy_mds(val);
++        } else if (strcasecmp(line, "MinimumDHBits") == 0) {
++            parse_minimum_dh_bits(val);
++        }
++        /* simply skip other unrecognized lines */
++    }
++    (void)fclose(f);
++}
++
+ /*
+  * Perform any essential OpenSSL initialization operations. Currently only
+  * sets FIPS callbacks
+@@ -109,6 +228,7 @@ void __attribute__ ((constructor)) OPENS
+     if (done)
+         return;
+     done = 1;
++    load_legacy_settings();
+ #ifdef OPENSSL_FIPS
+     if (!FIPS_module_installed()) {
+         return;
+diff -up openssl-1.0.2j/ssl/s3_clnt.c.deprecate-algos openssl-1.0.2j/ssl/s3_clnt.c
+--- openssl-1.0.2j/ssl/s3_clnt.c.deprecate-algos	2016-09-26 11:49:07.000000000 +0200
++++ openssl-1.0.2j/ssl/s3_clnt.c	2017-01-09 17:01:19.428506961 +0100
+@@ -3478,6 +3478,8 @@ int ssl3_send_client_certificate(SSL *s)
+ 
+ #define has_bits(i,m)   (((i)&(m)) == (m))
+ 
++extern int private_ossl_minimum_dh_bits;
++
+ int ssl3_check_cert_and_algorithm(SSL *s)
+ {
+     int i, idx;
+@@ -3608,8 +3610,7 @@ int ssl3_check_cert_and_algorithm(SSL *s
+             DH_free(dh_srvr);
+         }
+ 
+-        if ((!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && dh_size < 1024)
+-            || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && dh_size < 512)) {
++        if (dh_size < (private_ossl_minimum_dh_bits ? private_ossl_minimum_dh_bits : 1024)) {
+             SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_DH_KEY_TOO_SMALL);
+             goto f_err;
+         }

openssl-1.0.2j-downgrade-strength.patch

@@ -0,0 +1,138 @@
+diff -up openssl-1.0.2j/ssl/s3_lib.c.downgrade-strength openssl-1.0.2j/ssl/s3_lib.c
+--- openssl-1.0.2j/ssl/s3_lib.c.downgrade-strength	2017-01-05 17:23:21.091203023 +0100
++++ openssl-1.0.2j/ssl/s3_lib.c	2017-01-05 17:36:37.250194225 +0100
+@@ -227,7 +227,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_SSLV3,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -243,7 +243,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_SSLV3,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -278,7 +278,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_SSLV3,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ #endif
+@@ -575,7 +575,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_SSLV3,
+      SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -730,7 +730,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_SSLV3,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -746,7 +746,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_SSLV3,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -796,7 +796,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_SSLV3,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -812,7 +812,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_SSLV3,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -1429,7 +1429,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_TLSV1,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ #endif
+@@ -1714,7 +1714,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_TLSV1,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -2106,7 +2106,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_TLSV1,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -2186,7 +2186,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_TLSV1,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -2266,7 +2266,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_TLSV1,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -2346,7 +2346,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_TLSV1,
+      SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 
+@@ -2426,7 +2426,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
+      SSL_TLSV1,
+      SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
+-     128,
++     112,
+      128,
+      },
+ 

openssl-1.0.2j-nokrb5-abi.patch

@@ -0,0 +1,22 @@
+diff -up openssl-1.0.2j/ssl/ssl.h.nokrb5-abi openssl-1.0.2j/ssl/ssl.h
+--- openssl-1.0.2j/ssl/ssl.h.nokrb5-abi	2016-10-07 11:33:36.000000000 +0200
++++ openssl-1.0.2j/ssl/ssl.h	2016-10-14 13:26:29.767624676 +0200
+@@ -521,6 +521,9 @@ struct ssl_session_st {
+ #  ifndef OPENSSL_NO_KRB5
+     unsigned int krb5_client_princ_len;
+     unsigned char krb5_client_princ[SSL_MAX_KRB5_PRINCIPAL_LENGTH];
++#  else
++    unsigned int unused_krb5_client_princ_len;
++    unsigned char unused_krb5_client_princ[SSL_MAX_KRB5_PRINCIPAL_LENGTH];
+ #  endif                        /* OPENSSL_NO_KRB5 */
+ #  ifndef OPENSSL_NO_PSK
+     char *psk_identity_hint;
+@@ -1521,6 +1524,8 @@ struct ssl_st {
+ #  ifndef OPENSSL_NO_KRB5
+     /* Kerberos 5 context */
+     KSSL_CTX *kssl_ctx;
++#  else
++    void *unused_kssl_ctx;
+ #  endif                        /* OPENSSL_NO_KRB5 */
+ #  ifndef OPENSSL_NO_PSK
+     unsigned int (*psk_client_callback) (SSL *ssl, const char *hint,

openssl-1.0.2k-fips-randlock.patch

@@ -0,0 +1,65 @@
+diff -up openssl-1.0.2k/crypto/fips/fips_drbg_lib.c.fips-randlock openssl-1.0.2k/crypto/fips/fips_drbg_lib.c
+--- openssl-1.0.2k/crypto/fips/fips_drbg_lib.c.fips-randlock	2017-03-09 17:59:26.249231181 +0100
++++ openssl-1.0.2k/crypto/fips/fips_drbg_lib.c	2017-11-16 09:16:06.188098078 +0100
+@@ -338,6 +338,12 @@ int FIPS_drbg_reseed(DRBG_CTX *dctx,
+     return drbg_reseed(dctx, adin, adinlen, 1);
+ }
+ 
++void FIPS_drbg_set_reseed(DRBG_CTX *dctx)
++{
++    if (dctx->status == DRBG_STATUS_READY)
++        dctx->reseed_counter = dctx->reseed_interval;
++}
++
+ static int fips_drbg_check(DRBG_CTX *dctx)
+ {
+     if (dctx->xflags & DRBG_FLAG_TEST)
+diff -up openssl-1.0.2k/crypto/fips/fips_rand.h.fips-randlock openssl-1.0.2k/crypto/fips/fips_rand.h
+--- openssl-1.0.2k/crypto/fips/fips_rand.h.fips-randlock	2017-03-09 17:59:26.252231250 +0100
++++ openssl-1.0.2k/crypto/fips/fips_rand.h	2017-11-07 10:06:40.241450151 +0100
+@@ -86,6 +86,7 @@ extern "C" {
+                               const unsigned char *pers, size_t perslen);
+     int FIPS_drbg_reseed(DRBG_CTX *dctx, const unsigned char *adin,
+                          size_t adinlen);
++    void FIPS_drbg_set_reseed(DRBG_CTX *dctx);
+     int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
+                            int prediction_resistance,
+                            const unsigned char *adin, size_t adinlen);
+diff -up openssl-1.0.2k/crypto/rand/md_rand.c.fips-randlock openssl-1.0.2k/crypto/rand/md_rand.c
+--- openssl-1.0.2k/crypto/rand/md_rand.c.fips-randlock	2017-03-09 17:59:26.255231320 +0100
++++ openssl-1.0.2k/crypto/rand/md_rand.c	2017-12-06 09:20:23.615879425 +0100
+@@ -391,10 +391,10 @@ int ssleay_rand_bytes(unsigned char *buf
+     CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
+     crypto_lock_rand = 1;
+ 
+-    /* always poll for external entropy in FIPS mode, drbg provides the 
+-     * expansion
++    /* always poll for external entropy in FIPS mode, if run as seed
++     * source, drbg provides the expansion
+      */
+-    if (!initialized || FIPS_module_mode()) {
++    if (!initialized || (!lock && FIPS_module_mode())) {
+         RAND_poll();
+         initialized = 1;
+     }
+diff -up openssl-1.0.2k/crypto/rand/rand_lib.c.fips-randlock openssl-1.0.2k/crypto/rand/rand_lib.c
+--- openssl-1.0.2k/crypto/rand/rand_lib.c.fips-randlock	2017-03-09 17:59:26.292232183 +0100
++++ openssl-1.0.2k/crypto/rand/rand_lib.c	2017-11-07 10:20:08.050403861 +0100
+@@ -238,7 +238,7 @@ static int drbg_rand_add(DRBG_CTX *ctx,
+     RAND_SSLeay()->add(in, inlen, entropy);
+     if (FIPS_rand_status()) {
+         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+-        FIPS_drbg_reseed(ctx, NULL, 0);
++        FIPS_drbg_set_reseed(ctx);
+         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+     }
+     return 1;
+@@ -249,7 +249,7 @@ static int drbg_rand_seed(DRBG_CTX *ctx,
+     RAND_SSLeay()->seed(in, inlen);
+     if (FIPS_rand_status()) {
+         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+-        FIPS_drbg_reseed(ctx, NULL, 0);
++        FIPS_drbg_set_reseed(ctx);
+         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+     }
+     return 1;

openssl-1.0.2k-long-hello.patch

@@ -0,0 +1,36 @@
+diff -up openssl-1.0.2k/ssl/s3_srvr.c.long-hello openssl-1.0.2k/ssl/s3_srvr.c
+--- openssl-1.0.2k/ssl/s3_srvr.c.long-hello	2017-03-09 17:59:26.000000000 +0100
++++ openssl-1.0.2k/ssl/s3_srvr.c	2017-03-30 09:11:35.639338753 +0200
+@@ -899,6 +899,23 @@ int ssl3_send_hello_request(SSL *s)
+     return ssl_do_write(s);
+ }
+ 
++/*
++ * Maximum size (excluding the Handshake header) of a ClientHello message,
++ * calculated as follows:
++ *
++ *  2 + # client_version
++ *  32 + # only valid length for random
++ *  1 + # length of session_id
++ *  32 + # maximum size for session_id
++ *  2 + # length of cipher suites
++ *  2^16-2 + # maximum length of cipher suites array
++ *  1 + # length of compression_methods
++ *  2^8-1 + # maximum length of compression methods
++ *  2 + # length of extensions
++ *  2^16-1 # maximum length of extensions
++ */
++#define CLIENT_HELLO_MAX_LENGTH         131396
++
+ int ssl3_get_client_hello(SSL *s)
+ {
+     int i, j, ok, al = SSL_AD_INTERNAL_ERROR, ret = -1, cookie_valid = 0;
+@@ -930,7 +947,7 @@ int ssl3_get_client_hello(SSL *s)
+                                    SSL3_ST_SR_CLNT_HELLO_B,
+                                    SSL3_ST_SR_CLNT_HELLO_C,
+                                    SSL3_MT_CLIENT_HELLO,
+-                                   SSL3_RT_MAX_PLAIN_LENGTH, &ok);
++                                   CLIENT_HELLO_MAX_LENGTH, &ok);
+ 
+     if (!ok)
+         return ((int)n);

openssl-1.0.2m-manfix.patch

@@ -0,0 +1,90 @@
+diff -up openssl-1.0.2m/doc/apps/ec.pod.manfix openssl-1.0.2m/doc/apps/ec.pod
+--- openssl-1.0.2m/doc/apps/ec.pod.manfix	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/doc/apps/ec.pod	2017-11-13 09:06:06.372591988 +0100
+@@ -94,10 +94,6 @@ prints out the public, private key compo
+ 
+ this option prevents output of the encoded version of the key.
+ 
+-=item B<-modulus>
+-
+-this option prints out the value of the public key component of the key.
+-
+ =item B<-pubin>
+ 
+ by default a private key is read from the input file: with this option a
+diff -up openssl-1.0.2m/doc/apps/openssl.pod.manfix openssl-1.0.2m/doc/apps/openssl.pod
+--- openssl-1.0.2m/doc/apps/openssl.pod.manfix	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/doc/apps/openssl.pod	2017-11-13 09:06:06.372591988 +0100
+@@ -163,7 +163,7 @@ Create or examine a netscape certificate
+ 
+ Online Certificate Status Protocol utility.
+ 
+-=item L<B<passwd>|passwd(1)>
++=item L<B<passwd>|sslpasswd(1)>
+ 
+ Generation of hashed passwords.
+ 
+@@ -187,7 +187,7 @@ Public key algorithm parameter managemen
+ 
+ Public key algorithm cryptographic operation utility.
+ 
+-=item L<B<rand>|rand(1)>
++=item L<B<rand>|sslrand(1)>
+ 
+ Generate pseudo-random bytes.
+ 
+@@ -401,9 +401,9 @@ L<crl(1)|crl(1)>, L<crl2pkcs7(1)|crl2pkc
+ L<dhparam(1)|dhparam(1)>, L<dsa(1)|dsa(1)>, L<dsaparam(1)|dsaparam(1)>,
+ L<enc(1)|enc(1)>, L<gendsa(1)|gendsa(1)>, L<genpkey(1)|genpkey(1)>,
+ L<genrsa(1)|genrsa(1)>, L<nseq(1)|nseq(1)>, L<openssl(1)|openssl(1)>,
+-L<passwd(1)|passwd(1)>,
++L<sslpasswd(1)|sslpasswd(1)>,
+ L<pkcs12(1)|pkcs12(1)>, L<pkcs7(1)|pkcs7(1)>, L<pkcs8(1)|pkcs8(1)>,
+-L<rand(1)|rand(1)>, L<req(1)|req(1)>, L<rsa(1)|rsa(1)>,
++L<sslrand(1)|sslrand(1)>, L<req(1)|req(1)>, L<rsa(1)|rsa(1)>,
+ L<rsautl(1)|rsautl(1)>, L<s_client(1)|s_client(1)>,
+ L<s_server(1)|s_server(1)>, L<s_time(1)|s_time(1)>,
+ L<smime(1)|smime(1)>, L<spkac(1)|spkac(1)>,
+diff -up openssl-1.0.2m/doc/apps/s_client.pod.manfix openssl-1.0.2m/doc/apps/s_client.pod
+--- openssl-1.0.2m/doc/apps/s_client.pod.manfix	2017-11-13 09:06:06.346591381 +0100
++++ openssl-1.0.2m/doc/apps/s_client.pod	2017-11-13 09:07:05.273965939 +0100
+@@ -36,6 +36,9 @@ B<openssl> B<s_client>
+ [B<-ssl2>]
+ [B<-ssl3>]
+ [B<-tls1>]
++[B<-tls1_1>]
++[B<-tls1_2>]
++[B<-dtls1>]
+ [B<-no_ssl2>]
+ [B<-no_ssl3>]
+ [B<-no_tls1>]
+@@ -208,7 +211,7 @@ given as a hexadecimal number without le
+ 1a2b3c4d.
+ This option must be provided in order to use a PSK cipher.
+ 
+-=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
++=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-dtls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
+ 
+ These options require or disable the use of the specified SSL or TLS protocols.
+ By default the initial handshake uses a I<version-flexible> method which will
+diff -up openssl-1.0.2m/doc/apps/s_server.pod.manfix openssl-1.0.2m/doc/apps/s_server.pod
+--- openssl-1.0.2m/doc/apps/s_server.pod.manfix	2017-11-13 09:06:06.346591381 +0100
++++ openssl-1.0.2m/doc/apps/s_server.pod	2017-11-13 09:07:24.481413978 +0100
+@@ -47,6 +47,8 @@ B<openssl> B<s_server>
+ [B<-ssl2>]
+ [B<-ssl3>]
+ [B<-tls1>]
++[B<-tls1_1>]
++[B<-tls1_2>]
+ [B<-no_ssl2>]
+ [B<-no_ssl3>]
+ [B<-no_tls1>]
+@@ -224,7 +226,7 @@ given as a hexadecimal number without le
+ 1a2b3c4d.
+ This option must be provided in order to use a PSK cipher.
+ 
+-=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
++=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-dtls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
+ 
+ These options require or disable the use of the specified SSL or TLS protocols.
+ By default the initial handshake uses a I<version-flexible> method which will

openssl-1.0.2m-secure-getenv.patch

@@ -0,0 +1,241 @@
+diff -up openssl-1.0.2m/crypto/conf/conf_api.c.secure-getenv openssl-1.0.2m/crypto/conf/conf_api.c
+--- openssl-1.0.2m/crypto/conf/conf_api.c.secure-getenv	2017-11-02 15:32:57.000000000 +0100
++++ openssl-1.0.2m/crypto/conf/conf_api.c	2017-11-13 09:04:24.456214656 +0100
+@@ -63,6 +63,8 @@
+ # define NDEBUG
+ #endif
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <assert.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -141,7 +143,7 @@ char *_CONF_get_string(const CONF *conf,
+             if (v != NULL)
+                 return (v->value);
+             if (strcmp(section, "ENV") == 0) {
+-                p = getenv(name);
++                p = secure_getenv(name);
+                 if (p != NULL)
+                     return (p);
+             }
+@@ -154,7 +156,7 @@ char *_CONF_get_string(const CONF *conf,
+         else
+             return (NULL);
+     } else
+-        return (getenv(name));
++        return (secure_getenv(name));
+ }
+ 
+ #if 0                           /* There's no way to provide error checking
+diff -up openssl-1.0.2m/crypto/conf/conf_mod.c.secure-getenv openssl-1.0.2m/crypto/conf/conf_mod.c
+--- openssl-1.0.2m/crypto/conf/conf_mod.c.secure-getenv	2017-11-02 15:32:57.000000000 +0100
++++ openssl-1.0.2m/crypto/conf/conf_mod.c	2017-11-13 09:04:24.456214656 +0100
+@@ -57,6 +57,8 @@
+  *
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <ctype.h>
+ #include <openssl/crypto.h>
+@@ -530,7 +532,7 @@ char *CONF_get1_default_config_file(void
+     char *file;
+     int len;
+ 
+-    file = getenv("OPENSSL_CONF");
++    file = secure_getenv("OPENSSL_CONF");
+     if (file)
+         return BUF_strdup(file);
+ 
+diff -up openssl-1.0.2m/crypto/engine/eng_list.c.secure-getenv openssl-1.0.2m/crypto/engine/eng_list.c
+--- openssl-1.0.2m/crypto/engine/eng_list.c.secure-getenv	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/crypto/engine/eng_list.c	2017-11-13 09:04:24.456214656 +0100
+@@ -62,6 +62,8 @@
+  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include "eng_int.h"
+ 
+ /*
+@@ -369,10 +371,10 @@ ENGINE *ENGINE_by_id(const char *id)
+      */
+     if (strcmp(id, "dynamic")) {
+ # ifdef OPENSSL_SYS_VMS
+-        if ((load_dir = getenv("OPENSSL_ENGINES")) == 0)
++        if (OPENSSL_issetugid() || (load_dir = getenv("OPENSSL_ENGINES")) == 0)
+             load_dir = "SSLROOT:[ENGINES]";
+ # else
+-        if ((load_dir = getenv("OPENSSL_ENGINES")) == 0)
++        if ((load_dir = secure_getenv("OPENSSL_ENGINES")) == 0)
+             load_dir = ENGINESDIR;
+ # endif
+         iterator = ENGINE_by_id("dynamic");
+diff -up openssl-1.0.2m/crypto/md5/md5_dgst.c.secure-getenv openssl-1.0.2m/crypto/md5/md5_dgst.c
+--- openssl-1.0.2m/crypto/md5/md5_dgst.c.secure-getenv	2017-11-13 09:04:24.446214423 +0100
++++ openssl-1.0.2m/crypto/md5/md5_dgst.c	2017-11-13 09:04:24.456214656 +0100
+@@ -56,6 +56,8 @@
+  * [including the GNU Public Licence.]
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include "md5_locl.h"
+ #include <openssl/opensslv.h>
+@@ -75,7 +77,8 @@ const char MD5_version[] = "MD5" OPENSSL
+ int MD5_Init(MD5_CTX *c)
+ #ifdef OPENSSL_FIPS
+ {
+-    if (FIPS_mode() && getenv("OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW") == NULL)
++    if (FIPS_mode()
++        && secure_getenv("OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW") == NULL)
+         OpenSSLDie(__FILE__, __LINE__, "Digest MD5 forbidden in FIPS mode!");
+     return private_MD5_Init(c);
+ }
+diff -up openssl-1.0.2m/crypto/o_init.c.secure-getenv openssl-1.0.2m/crypto/o_init.c
+--- openssl-1.0.2m/crypto/o_init.c.secure-getenv	2017-11-13 09:04:24.431214072 +0100
++++ openssl-1.0.2m/crypto/o_init.c	2017-11-13 09:04:24.456214656 +0100
+@@ -53,6 +53,8 @@
+  *
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <e_os.h>
+ #include <openssl/err.h>
+ #ifdef OPENSSL_FIPS
+@@ -72,7 +74,7 @@ static void init_fips_mode(void)
+     char buf[2] = "0";
+     int fd;
+ 
+-    if (getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) {
++    if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) {
+         buf[0] = '1';
+     } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) {
+         while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ;
+diff -up openssl-1.0.2m/crypto/rand/randfile.c.secure-getenv openssl-1.0.2m/crypto/rand/randfile.c
+--- openssl-1.0.2m/crypto/rand/randfile.c.secure-getenv	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/crypto/rand/randfile.c	2017-11-13 09:04:24.457214679 +0100
+@@ -55,6 +55,8 @@
+  * copied and put under another distribution licence
+  * [including the GNU Public Licence.]
+  */
++/* for secure_getenv */
++#define _GNU_SOURCE
+ 
+ #include <errno.h>
+ #include <stdio.h>
+@@ -327,14 +329,12 @@ const char *RAND_file_name(char *buf, si
+     struct stat sb;
+ #endif
+ 
+-    if (OPENSSL_issetugid() == 0)
+-        s = getenv("RANDFILE");
++    s = secure_getenv("RANDFILE");
+     if (s != NULL && *s && strlen(s) + 1 < size) {
+         if (BUF_strlcpy(buf, s, size) >= size)
+             return NULL;
+     } else {
+-        if (OPENSSL_issetugid() == 0)
+-            s = getenv("HOME");
++        s = secure_getenv("HOME");
+ #ifdef DEFAULT_HOME
+         if (s == NULL) {
+             s = DEFAULT_HOME;
+diff -up openssl-1.0.2m/crypto/x509/by_dir.c.secure-getenv openssl-1.0.2m/crypto/x509/by_dir.c
+--- openssl-1.0.2m/crypto/x509/by_dir.c.secure-getenv	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/crypto/x509/by_dir.c	2017-11-13 09:04:24.457214679 +0100
+@@ -56,6 +56,8 @@
+  * [including the GNU Public Licence.]
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <time.h>
+ #include <errno.h>
+@@ -128,7 +130,7 @@ static int dir_ctrl(X509_LOOKUP *ctx, in
+     switch (cmd) {
+     case X509_L_ADD_DIR:
+         if (argl == X509_FILETYPE_DEFAULT) {
+-            dir = (char *)getenv(X509_get_default_cert_dir_env());
++            dir = (char *)secure_getenv(X509_get_default_cert_dir_env());
+             if (dir)
+                 ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
+             else
+diff -up openssl-1.0.2m/crypto/x509/by_file.c.secure-getenv openssl-1.0.2m/crypto/x509/by_file.c
+--- openssl-1.0.2m/crypto/x509/by_file.c.secure-getenv	2017-11-13 09:04:24.405213466 +0100
++++ openssl-1.0.2m/crypto/x509/by_file.c	2017-11-13 09:05:04.115139752 +0100
+@@ -56,6 +56,8 @@
+  * [including the GNU Public Licence.]
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <time.h>
+ #include <errno.h>
+@@ -97,7 +99,7 @@ static int by_file_ctrl(X509_LOOKUP *ctx
+     switch (cmd) {
+     case X509_L_FILE_LOAD:
+         if (argl == X509_FILETYPE_DEFAULT) {
+-            file = getenv(X509_get_default_cert_file_env());
++            file = secure_getenv(X509_get_default_cert_file_env());
+             if (file)
+                 ok = (X509_load_cert_crl_file(ctx, file,
+                                               X509_FILETYPE_PEM) != 0);
+diff -up openssl-1.0.2m/crypto/x509/x509_vfy.c.secure-getenv openssl-1.0.2m/crypto/x509/x509_vfy.c
+--- openssl-1.0.2m/crypto/x509/x509_vfy.c.secure-getenv	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/crypto/x509/x509_vfy.c	2017-11-13 09:04:24.458214702 +0100
+@@ -56,6 +56,8 @@
+  * [including the GNU Public Licence.]
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <time.h>
+ #include <errno.h>
+@@ -620,7 +622,7 @@ static int check_chain_extensions(X509_S
+          * A hack to keep people who don't want to modify their software
+          * happy
+          */
+-        if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
++        if (secure_getenv("OPENSSL_ALLOW_PROXY_CERTS"))
+             allow_proxy_certs = 1;
+         purpose = ctx->param->purpose;
+     }
+diff -up openssl-1.0.2m/engines/ccgost/gost_ctl.c.secure-getenv openssl-1.0.2m/engines/ccgost/gost_ctl.c
+--- openssl-1.0.2m/engines/ccgost/gost_ctl.c.secure-getenv	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/engines/ccgost/gost_ctl.c	2017-11-13 09:04:24.458214702 +0100
+@@ -6,6 +6,8 @@
+  *        Implementation of control commands for GOST engine          *
+  *            OpenSSL 0.9.9 libraries required                        *
+  **********************************************************************/
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdlib.h>
+ #include <string.h>
+ #include <openssl/crypto.h>
+@@ -64,7 +66,7 @@ const char *get_gost_engine_param(int pa
+     if (gost_params[param] != NULL) {
+         return gost_params[param];
+     }
+-    tmp = getenv(gost_envnames[param]);
++    tmp = secure_getenv(gost_envnames[param]);
+     if (tmp) {
+         if (gost_params[param])
+             OPENSSL_free(gost_params[param]);
+@@ -79,7 +81,7 @@ int gost_set_default_param(int param, co
+     const char *tmp;
+     if (param < 0 || param > GOST_PARAM_MAX)
+         return 0;
+-    tmp = getenv(gost_envnames[param]);
++    tmp = secure_getenv(gost_envnames[param]);
+     /*
+      * if there is value in the environment, use it, else -passed string *
+      */

openssl-1.0.2m-trusted-first-doc.patch

@@ -0,0 +1,286 @@
+diff -up openssl-1.0.2m/apps/cms.c.trusted-first openssl-1.0.2m/apps/cms.c
+--- openssl-1.0.2m/apps/cms.c.trusted-first	2017-11-02 15:32:57.000000000 +0100
++++ openssl-1.0.2m/apps/cms.c	2017-11-13 09:08:18.613672265 +0100
+@@ -644,6 +644,8 @@ int MAIN(int argc, char **argv)
+                    "-CApath dir    trusted certificates directory\n");
+         BIO_printf(bio_err, "-CAfile file   trusted certificates file\n");
+         BIO_printf(bio_err,
++                   "-trusted_first use trusted certificates first when building the trust chain\n");
++        BIO_printf(bio_err,
+                    "-no_alt_chains only ever use the first certificate chain found\n");
+         BIO_printf(bio_err,
+                    "-crl_check     check revocation status of signer's certificate using CRLs\n");
+diff -up openssl-1.0.2m/apps/ocsp.c.trusted-first openssl-1.0.2m/apps/ocsp.c
+--- openssl-1.0.2m/apps/ocsp.c.trusted-first	2017-11-02 15:32:57.000000000 +0100
++++ openssl-1.0.2m/apps/ocsp.c	2017-11-13 09:08:18.613672265 +0100
+@@ -537,6 +537,8 @@ int MAIN(int argc, char **argv)
+         BIO_printf(bio_err,
+                    "-CAfile file         trusted certificates file\n");
+         BIO_printf(bio_err,
++                   "-trusted_first       use trusted certificates first when building the trust chain\n");
++        BIO_printf(bio_err,
+                    "-no_alt_chains       only ever use the first certificate chain found\n");
+         BIO_printf(bio_err,
+                    "-VAfile file         validator certificates file\n");
+diff -up openssl-1.0.2m/apps/s_client.c.trusted-first openssl-1.0.2m/apps/s_client.c
+--- openssl-1.0.2m/apps/s_client.c.trusted-first	2017-11-13 09:08:18.571671320 +0100
++++ openssl-1.0.2m/apps/s_client.c	2017-11-13 09:08:18.613672265 +0100
+@@ -334,6 +334,8 @@ static void sc_usage(void)
+     BIO_printf(bio_err, " -CApath arg   - PEM format directory of CA's\n");
+     BIO_printf(bio_err, " -CAfile arg   - PEM format file of CA's\n");
+     BIO_printf(bio_err,
++               " -trusted_first - Use trusted CA's first when building the trust chain\n");
++    BIO_printf(bio_err,
+                " -no_alt_chains - only ever use the first certificate chain found\n");
+     BIO_printf(bio_err,
+                " -reconnect    - Drop and re-make the connection with the same Session-ID\n");
+diff -up openssl-1.0.2m/apps/smime.c.trusted-first openssl-1.0.2m/apps/smime.c
+--- openssl-1.0.2m/apps/smime.c.trusted-first	2017-11-02 15:32:57.000000000 +0100
++++ openssl-1.0.2m/apps/smime.c	2017-11-13 09:08:18.614672288 +0100
+@@ -440,6 +440,8 @@ int MAIN(int argc, char **argv)
+                    "-CApath dir    trusted certificates directory\n");
+         BIO_printf(bio_err, "-CAfile file   trusted certificates file\n");
+         BIO_printf(bio_err,
++                   "-trusted_first use trusted certificates first when building the trust chain\n");
++        BIO_printf(bio_err,
+                    "-no_alt_chains only ever use the first certificate chain found\n");
+         BIO_printf(bio_err,
+                    "-crl_check     check revocation status of signer's certificate using CRLs\n");
+diff -up openssl-1.0.2m/apps/s_server.c.trusted-first openssl-1.0.2m/apps/s_server.c
+--- openssl-1.0.2m/apps/s_server.c.trusted-first	2017-11-13 09:08:18.560671072 +0100
++++ openssl-1.0.2m/apps/s_server.c	2017-11-13 09:08:18.614672288 +0100
+@@ -572,6 +572,8 @@ static void sv_usage(void)
+     BIO_printf(bio_err, " -CApath arg   - PEM format directory of CA's\n");
+     BIO_printf(bio_err, " -CAfile arg   - PEM format file of CA's\n");
+     BIO_printf(bio_err,
++               " -trusted_first - Use trusted CA's first when building the trust chain\n");
++    BIO_printf(bio_err,
+                " -no_alt_chains - only ever use the first certificate chain found\n");
+     BIO_printf(bio_err,
+                " -nocert       - Don't use any certificates (Anon-DH)\n");
+diff -up openssl-1.0.2m/apps/s_time.c.trusted-first openssl-1.0.2m/apps/s_time.c
+--- openssl-1.0.2m/apps/s_time.c.trusted-first	2017-11-13 09:08:18.526670306 +0100
++++ openssl-1.0.2m/apps/s_time.c	2017-11-13 09:08:18.614672288 +0100
+@@ -182,6 +182,7 @@ static void s_time_usage(void)
+                 file if not specified by this option\n\
+ -CApath arg   - PEM format directory of CA's\n\
+ -CAfile arg   - PEM format file of CA's\n\
++-trusted_first - Use trusted CA's first when building the trust chain\n\
+ -cipher       - preferred cipher to use, play with 'openssl ciphers'\n\n";
+ 
+     printf("usage: s_time <args>\n\n");
+diff -up openssl-1.0.2m/apps/ts.c.trusted-first openssl-1.0.2m/apps/ts.c
+--- openssl-1.0.2m/apps/ts.c.trusted-first	2017-11-13 09:08:18.569671275 +0100
++++ openssl-1.0.2m/apps/ts.c	2017-11-13 09:08:18.614672288 +0100
+@@ -352,7 +352,7 @@ int MAIN(int argc, char **argv)
+                "ts -verify [-data file_to_hash] [-digest digest_bytes] "
+                "[-queryfile request.tsq] "
+                "-in response.tsr [-token_in] "
+-               "-CApath ca_path -CAfile ca_file.pem "
++               "-CApath ca_path -CAfile ca_file.pem -trusted_first"
+                "-untrusted cert_file.pem\n");
+  cleanup:
+     /* Clean up. */
+diff -up openssl-1.0.2m/apps/verify.c.trusted-first openssl-1.0.2m/apps/verify.c
+--- openssl-1.0.2m/apps/verify.c.trusted-first	2017-11-02 15:32:57.000000000 +0100
++++ openssl-1.0.2m/apps/verify.c	2017-11-13 09:08:18.615672310 +0100
+@@ -227,7 +227,7 @@ int MAIN(int argc, char **argv)
+  usage:
+     if (ret == 1) {
+         BIO_printf(bio_err,
+-                   "usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check]");
++                   "usage: verify [-verbose] [-CApath path] [-CAfile file] [-trusted_first] [-purpose purpose] [-crl_check]");
+         BIO_printf(bio_err, " [-no_alt_chains] [-attime timestamp]");
+ #ifndef OPENSSL_NO_ENGINE
+         BIO_printf(bio_err, " [-engine e]");
+diff -up openssl-1.0.2m/doc/apps/cms.pod.trusted-first openssl-1.0.2m/doc/apps/cms.pod
+--- openssl-1.0.2m/doc/apps/cms.pod.trusted-first	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/doc/apps/cms.pod	2017-11-13 09:08:18.615672310 +0100
+@@ -36,6 +36,7 @@ B<openssl> B<cms>
+ [B<-print>]
+ [B<-CAfile file>]
+ [B<-CApath dir>]
++[B<-trusted_first>]
+ [B<-no_alt_chains>]
+ [B<-md digest>]
+ [B<-[cipher]>]
+@@ -249,6 +250,12 @@ B<-verify>. This directory must be a sta
+ is a hash of each subject name (using B<x509 -hash>) should be linked
+ to each certificate.
+ 
++=item B<-trusted_first>
++
++Use certificates in CA file or CA directory before untrusted certificates
++from the message when building the trust chain to verify certificates.
++This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
++
+ =item B<-md digest>
+ 
+ digest algorithm to use when signing or resigning. If not present then the
+diff -up openssl-1.0.2m/doc/apps/ocsp.pod.trusted-first openssl-1.0.2m/doc/apps/ocsp.pod
+--- openssl-1.0.2m/doc/apps/ocsp.pod.trusted-first	2017-11-13 09:08:18.569671275 +0100
++++ openssl-1.0.2m/doc/apps/ocsp.pod	2017-11-13 09:08:18.615672310 +0100
+@@ -31,6 +31,7 @@ B<openssl> B<ocsp>
+ [B<-path>]
+ [B<-CApath dir>]
+ [B<-CAfile file>]
++[B<-trusted_first>]
+ [B<-no_alt_chains>]
+ [B<-VAfile file>]
+ [B<-validity_period n>]
+@@ -154,6 +155,13 @@ connection timeout to the OCSP responder
+ file or pathname containing trusted CA certificates. These are used to verify
+ the signature on the OCSP response.
+ 
++=item B<-trusted_first>
++
++Use certificates in CA file or CA directory over certificates provided
++in the response or residing in other certificates file when building the trust
++chain to verify responder certificate.
++This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
++
+ =item B<-no_alt_chains>
+ 
+ See L<B<verify>|verify(1)> manual page for details.
+diff -up openssl-1.0.2m/doc/apps/s_client.pod.trusted-first openssl-1.0.2m/doc/apps/s_client.pod
+--- openssl-1.0.2m/doc/apps/s_client.pod.trusted-first	2017-11-13 09:08:18.582671567 +0100
++++ openssl-1.0.2m/doc/apps/s_client.pod	2017-11-13 09:08:18.615672310 +0100
+@@ -20,6 +20,7 @@ B<openssl> B<s_client>
+ [B<-pass arg>]
+ [B<-CApath directory>]
+ [B<-CAfile filename>]
++[B<-trusted_first>]
+ [B<-no_alt_chains>]
+ [B<-reconnect>]
+ [B<-pause>]
+@@ -129,7 +130,7 @@ also used when building the client certi
+ A file containing trusted certificates to use during server authentication
+ and to use when attempting to build the client certificate chain.
+ 
+-=item B<-purpose, -ignore_critical, -issuer_checks, -crl_check, -crl_check_all, -policy_check, -extended_crl, -x509_strict, -policy -check_ss_sig -no_alt_chains>
++=item B<-purpose, -ignore_critical, -issuer_checks, -crl_check, -crl_check_all, -policy_check, -extended_crl, -x509_strict, -policy -check_ss_sig, -trusted_first -no_alt_chains>
+ 
+ Set various certificate chain valiadition option. See the
+ L<B<verify>|verify(1)> manual page for details.
+diff -up openssl-1.0.2m/doc/apps/smime.pod.trusted-first openssl-1.0.2m/doc/apps/smime.pod
+--- openssl-1.0.2m/doc/apps/smime.pod.trusted-first	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/doc/apps/smime.pod	2017-11-13 09:08:18.615672310 +0100
+@@ -16,6 +16,9 @@ B<openssl> B<smime>
+ [B<-pk7out>]
+ [B<-[cipher]>]
+ [B<-in file>]
++[B<-CAfile file>]
++[B<-CApath dir>]
++[B<-trusted_first>]
+ [B<-no_alt_chains>]
+ [B<-certfile file>]
+ [B<-signer file>]
+@@ -151,6 +154,12 @@ B<-verify>. This directory must be a sta
+ is a hash of each subject name (using B<x509 -hash>) should be linked
+ to each certificate.
+ 
++=item B<-trusted_first>
++
++Use certificates in CA file or CA directory over certificates provided
++in the message when building the trust chain to verify a certificate.
++This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
++
+ =item B<-md digest>
+ 
+ digest algorithm to use when signing or resigning. If not present then the
+diff -up openssl-1.0.2m/doc/apps/s_server.pod.trusted-first openssl-1.0.2m/doc/apps/s_server.pod
+--- openssl-1.0.2m/doc/apps/s_server.pod.trusted-first	2017-11-13 09:08:18.583671590 +0100
++++ openssl-1.0.2m/doc/apps/s_server.pod	2017-11-13 09:09:04.706710088 +0100
+@@ -34,6 +34,7 @@ B<openssl> B<s_server>
+ [B<-state>]
+ [B<-CApath directory>]
+ [B<-CAfile filename>]
++[B<-trusted_first>]
+ [B<-no_alt_chains>]
+ [B<-nocert>]
+ [B<-client_sigalgs sigalglist>]
+@@ -183,6 +184,12 @@ and to use when attempting to build the
+ is also used in the list of acceptable client CAs passed to the client when
+ a certificate is requested.
+ 
++=item B<-trusted_first>
++
++Use certificates in CA file or CA directory before other certificates 
++when building the trust chain to verify client certificates.
++This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
++
+ =item B<-no_alt_chains>
+ 
+ See the L<B<verify>|verify(1)> manual page for details.
+diff -up openssl-1.0.2m/doc/apps/s_time.pod.trusted-first openssl-1.0.2m/doc/apps/s_time.pod
+--- openssl-1.0.2m/doc/apps/s_time.pod.trusted-first	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/doc/apps/s_time.pod	2017-11-13 09:08:18.616672333 +0100
+@@ -15,6 +15,7 @@ B<openssl> B<s_time>
+ [B<-key filename>]
+ [B<-CApath directory>]
+ [B<-CAfile filename>]
++[B<-trusted_first>]
+ [B<-reuse>]
+ [B<-new>]
+ [B<-verify depth>]
+@@ -77,6 +78,12 @@ also used when building the client certi
+ A file containing trusted certificates to use during server authentication
+ and to use when attempting to build the client certificate chain.
+ 
++=item B<-trusted_first>
++
++Use certificates in CA file or CA directory over the certificates provided
++by the server when building the trust chain to verify server certificate.
++This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
++
+ =item B<-new>
+ 
+ performs the timing test using a new session ID for each connection.
+diff -up openssl-1.0.2m/doc/apps/ts.pod.trusted-first openssl-1.0.2m/doc/apps/ts.pod
+--- openssl-1.0.2m/doc/apps/ts.pod.trusted-first	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/doc/apps/ts.pod	2017-11-13 09:08:18.616672333 +0100
+@@ -47,6 +47,7 @@ B<-verify>
+ [B<-token_in>]
+ [B<-CApath> trusted_cert_path]
+ [B<-CAfile> trusted_certs.pem]
++[B<-trusted_first>]
+ [B<-untrusted> cert_file.pem]
+ 
+ =head1 DESCRIPTION
+@@ -325,6 +326,12 @@ L<verify(1)|verify(1)> for additional de
+ or B<-CApath> must be specified.
+ (Optional)
+ 
++=item B<-trusted_first>
++
++Use certificates in CA file or CA directory before other certificates
++when building the trust chain to verify certificates.
++This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
++
+ =item B<-untrusted> cert_file.pem
+ 
+ Set of additional untrusted certificates in PEM format which may be
+diff -up openssl-1.0.2m/doc/apps/verify.pod.trusted-first openssl-1.0.2m/doc/apps/verify.pod
+--- openssl-1.0.2m/doc/apps/verify.pod.trusted-first	2017-11-02 15:32:58.000000000 +0100
++++ openssl-1.0.2m/doc/apps/verify.pod	2017-11-13 09:08:18.616672333 +0100
+@@ -10,6 +10,7 @@ verify - Utility to verify certificates.
+ B<openssl> B<verify>
+ [B<-CApath directory>]
+ [B<-CAfile file>]
++[B<-trusted_first>]
+ [B<-purpose purpose>]
+ [B<-policy arg>]
+ [B<-ignore_critical>]
+@@ -87,6 +88,12 @@ If a valid CRL cannot be found an error
+ A file of untrusted certificates. The file should contain multiple certificates
+ in PEM format concatenated together.
+ 
++=item B<-trusted_first>
++
++Use certificates in CA file or CA directory before the certificates in the untrusted
++file when building the trust chain to verify certificates.
++This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
++
+ =item B<-purpose purpose>
+ 
+ The intended use for the certificate. If this option is not specified,

openssl-1.0.2o-cc-reqs.patch

@@ -0,0 +1,27 @@
+diff -up openssl-1.0.2o/crypto/rsa/rsa_gen.c.cc-reqs openssl-1.0.2o/crypto/rsa/rsa_gen.c
+--- openssl-1.0.2o/crypto/rsa/rsa_gen.c.cc-reqs	2018-04-05 17:48:48.180527469 +0200
++++ openssl-1.0.2o/crypto/rsa/rsa_gen.c	2018-04-05 17:57:41.740893045 +0200
+@@ -506,6 +506,12 @@ static int rsa_builtin_keygen(RSA *rsa,
+     if (!rsa->iqmp && ((rsa->iqmp = BN_new()) == NULL))
+         goto err;
+ 
++    /* prepare minimum p and q difference */
++    if (!BN_one(r3))
++        goto err;
++    if (bitsp > 100 && !BN_lshift(r3, r3, bitsp - 100))
++        goto err;
++
+     if (BN_copy(rsa->e, e_value) == NULL)
+         goto err;
+ 
+@@ -538,7 +544,9 @@ static int rsa_builtin_keygen(RSA *rsa,
+         do {
+             if (!BN_generate_prime_ex(rsa->q, bitsq, 0, NULL, NULL, cb))
+                 goto err;
+-        } while (BN_cmp(rsa->p, rsa->q) == 0);
++            if (!BN_sub(r2, rsa->q, rsa->p))
++                goto err;
++        } while (BN_ucmp(r2, r3) <= 0);
+         if (!BN_sub(r2, rsa->q, BN_value_one()))
+             goto err;
+         ERR_set_mark();

openssl-1.0.2o-conf-10.patch

@@ -0,0 +1,39 @@
+diff -up openssl-1.0.2o/e_os.h.conf-10 openssl-1.0.2o/e_os.h
+--- openssl-1.0.2o/e_os.h.conf-10	2018-03-27 15:54:46.000000000 +0200
++++ openssl-1.0.2o/e_os.h	2018-08-03 10:56:59.138382466 +0200
+@@ -370,7 +370,7 @@ extern FILE *_imp___iob;
+ #  ifndef R_OK
+ #   define R_OK        4
+ #  endif
+-#  define OPENSSL_CONF  "openssl.cnf"
++#  define OPENSSL_CONF  "openssl10.cnf"
+ #  define SSLEAY_CONF   OPENSSL_CONF
+ #  define NUL_DEV       "nul"
+ #  define RFILE         ".rnd"
+@@ -403,7 +403,7 @@ extern FILE *_imp___iob;
+ #   else
+ #    include <unixlib.h>
+ #   endif
+-#   define OPENSSL_CONF        "openssl.cnf"
++#   define OPENSSL_CONF        "openssl10.cnf"
+ #   define SSLEAY_CONF         OPENSSL_CONF
+ #   define RFILE               ".rnd"
+ #   define LIST_SEPARATOR_CHAR ','
+@@ -453,7 +453,7 @@ extern int kbhit(void);
+ #   define _kbhit kbhit
+ #   define _O_TEXT O_TEXT
+ #   define _O_BINARY O_BINARY
+-#   define OPENSSL_CONF   "openssl.cnf"
++#   define OPENSSL_CONF   "openssl10.cnf"
+ #   define SSLEAY_CONF    OPENSSL_CONF
+ #   define RFILE    ".rnd"
+ #   define LIST_SEPARATOR_CHAR ';'
+@@ -487,7 +487,7 @@ typedef unsigned long clock_t;
+ #    include <fcntl.h>
+ #   endif
+ 
+-#   define OPENSSL_CONF        "openssl.cnf"
++#   define OPENSSL_CONF        "openssl10.cnf"
+ #   define SSLEAY_CONF         OPENSSL_CONF
+ #   define RFILE               ".rnd"
+ #   define LIST_SEPARATOR_CHAR ':'

openssl-1.0.2o-cve-2022-0778.patch

@@ -0,0 +1,66 @@
+From 3118eb64934499d93db3230748a452351d1d9a65 Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tomas@openssl.org>
+Date: Mon, 28 Feb 2022 18:26:21 +0100
+Subject: [PATCH] Fix possible infinite loop in BN_mod_sqrt()
+
+The calculation in some cases does not finish for non-prime p.
+
+This fixes CVE-2022-0778.
+
+Based on patch by David Benjamin <davidben@google.com>.
+
+Reviewed-by: Paul Dale <pauli@openssl.org>
+Reviewed-by: Matt Caswell <matt@openssl.org>
+---
+ crypto/bn/bn_sqrt.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/crypto/bn/bn_sqrt.c b/crypto/bn/bn_sqrt.c
+index 1723d5ded5a8..53b0f559855c 100644
+--- a/crypto/bn/bn_sqrt.c
++++ b/crypto/bn/bn_sqrt.c
+@@ -14,7 +14,8 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
+ /*
+  * Returns 'ret' such that ret^2 == a (mod p), using the Tonelli/Shanks
+  * algorithm (cf. Henri Cohen, "A Course in Algebraic Computational Number
+- * Theory", algorithm 1.5.1). 'p' must be prime!
++ * Theory", algorithm 1.5.1). 'p' must be prime, otherwise an error or
++ * an incorrect "result" will be returned.
+  */
+ {
+     BIGNUM *ret = in;
+@@ -301,18 +302,23 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
+             goto vrfy;
+         }
+ 
+-        /* find smallest  i  such that  b^(2^i) = 1 */
+-        i = 1;
+-        if (!BN_mod_sqr(t, b, p, ctx))
+-            goto end;
+-        while (!BN_is_one(t)) {
+-            i++;
+-            if (i == e) {
+-                BNerr(BN_F_BN_MOD_SQRT, BN_R_NOT_A_SQUARE);
+-                goto end;
++        /* Find the smallest i, 0 < i < e, such that b^(2^i) = 1. */
++        for (i = 1; i < e; i++) {
++            if (i == 1) {
++                if (!BN_mod_sqr(t, b, p, ctx))
++                    goto end;
++
++            } else {
++                if (!BN_mod_mul(t, t, t, p, ctx))
++                    goto end;
+             }
+-            if (!BN_mod_mul(t, t, t, p, ctx))
+-                goto end;
++            if (BN_is_one(t))
++                break;
++        }
++        /* If not found, a is not a square or p is not prime. */
++        if (i >= e) {
++            BNerr(BN_F_BN_MOD_SQRT, BN_R_NOT_A_SQUARE);
++            goto end;
+         }
+ 
+         /* t := y^2^(e - i - 1) */

openssl-1.0.2o-ipv6-apps.patch

@@ -0,0 +1,525 @@
+diff -up openssl-1.0.2o/apps/s_apps.h.ipv6-apps openssl-1.0.2o/apps/s_apps.h
+--- openssl-1.0.2o/apps/s_apps.h.ipv6-apps	2018-04-05 16:12:50.408193566 +0200
++++ openssl-1.0.2o/apps/s_apps.h	2018-04-05 16:12:50.649199144 +0200
+@@ -151,7 +151,7 @@ typedef fd_mask fd_set;
+ #define PORT_STR        "4433"
+ #define PROTOCOL        "tcp"
+ 
+-int do_server(int port, int type, int *ret,
++int do_server(char *port, int type, int *ret,
+               int (*cb) (char *hostname, int s, int stype,
+                          unsigned char *context), unsigned char *context,
+               int naccept);
+@@ -167,11 +167,10 @@ int ssl_print_point_formats(BIO *out, SS
+ int ssl_print_curves(BIO *out, SSL *s, int noshared);
+ #endif
+ int ssl_print_tmp_key(BIO *out, SSL *s);
+-int init_client(int *sock, char *server, int port, int type);
++int init_client(int *sock, char *server, char *port, int type);
+ int should_retry(int i);
+ int extract_port(char *str, short *port_ptr);
+-int extract_host_port(char *str, char **host_ptr, unsigned char *ip,
+-                      short *p);
++int extract_host_port(char *str, char **host_ptr, char **port_ptr);
+ 
+ long MS_CALLBACK bio_dump_callback(BIO *bio, int cmd, const char *argp,
+                                    int argi, long argl, long ret);
+diff -up openssl-1.0.2o/apps/s_client.c.ipv6-apps openssl-1.0.2o/apps/s_client.c
+--- openssl-1.0.2o/apps/s_client.c.ipv6-apps	2018-03-27 15:54:46.000000000 +0200
++++ openssl-1.0.2o/apps/s_client.c	2018-04-05 16:12:50.649199144 +0200
+@@ -668,7 +668,7 @@ int MAIN(int argc, char **argv)
+     int cbuf_len, cbuf_off;
+     int sbuf_len, sbuf_off;
+     fd_set readfds, writefds;
+-    short port = PORT;
++    char *port_str = PORT_STR;
+     int full_log = 1;
+     char *host = SSL_HOST_NAME;
+     char *cert_file = NULL, *key_file = NULL, *chain_file = NULL;
+@@ -792,13 +792,11 @@ int MAIN(int argc, char **argv)
+         } else if (strcmp(*argv, "-port") == 0) {
+             if (--argc < 1)
+                 goto bad;
+-            port = atoi(*(++argv));
+-            if (port == 0)
+-                goto bad;
++            port_str = *(++argv);
+         } else if (strcmp(*argv, "-connect") == 0) {
+             if (--argc < 1)
+                 goto bad;
+-            if (!extract_host_port(*(++argv), &host, NULL, &port))
++            if (!extract_host_port(*(++argv), &host, &port_str))
+                 goto bad;
+         } else if (strcmp(*argv, "-verify") == 0) {
+             verify = SSL_VERIFY_PEER;
+@@ -1449,7 +1447,7 @@ int MAIN(int argc, char **argv)
+ 
+  re_start:
+ 
+-    if (init_client(&s, host, port, socket_type) == 0) {
++    if (init_client(&s, host, port_str, socket_type) == 0) {
+         BIO_printf(bio_err, "connect:errno=%d\n", get_last_socket_error());
+         SHUTDOWN(s);
+         goto end;
+diff -up openssl-1.0.2o/apps/s_server.c.ipv6-apps openssl-1.0.2o/apps/s_server.c
+--- openssl-1.0.2o/apps/s_server.c.ipv6-apps	2018-04-05 16:12:50.640198936 +0200
++++ openssl-1.0.2o/apps/s_server.c	2018-04-05 16:12:50.650199167 +0200
+@@ -1082,7 +1082,7 @@ int MAIN(int argc, char *argv[])
+ {
+     X509_VERIFY_PARAM *vpm = NULL;
+     int badarg = 0;
+-    short port = PORT;
++    char *port_str = PORT_STR;
+     char *CApath = NULL, *CAfile = NULL;
+     char *chCApath = NULL, *chCAfile = NULL;
+     char *vfyCApath = NULL, *vfyCAfile = NULL;
+@@ -1170,7 +1170,8 @@ int MAIN(int argc, char *argv[])
+         if ((strcmp(*argv, "-port") == 0) || (strcmp(*argv, "-accept") == 0)) {
+             if (--argc < 1)
+                 goto bad;
+-            if (!extract_port(*(++argv), &port))
++            port_str = *(++argv);
++            if (port_str == NULL || *port_str == '\0')
+                 goto bad;
+         } else if (strcmp(*argv, "-naccept") == 0) {
+             if (--argc < 1)
+@@ -2064,13 +2065,13 @@ int MAIN(int argc, char *argv[])
+     BIO_printf(bio_s_out, "ACCEPT\n");
+     (void)BIO_flush(bio_s_out);
+     if (rev)
+-        do_server(port, socket_type, &accept_socket, rev_body, context,
++        do_server(port_str, socket_type, &accept_socket, rev_body, context,
+                   naccept);
+     else if (www)
+-        do_server(port, socket_type, &accept_socket, www_body, context,
++        do_server(port_str, socket_type, &accept_socket, www_body, context,
+                   naccept);
+     else
+-        do_server(port, socket_type, &accept_socket, sv_body, context,
++        do_server(port_str, socket_type, &accept_socket, sv_body, context,
+                   naccept);
+     print_stats(bio_s_out, ctx);
+     ret = 0;
+diff -up openssl-1.0.2o/apps/s_socket.c.ipv6-apps openssl-1.0.2o/apps/s_socket.c
+--- openssl-1.0.2o/apps/s_socket.c.ipv6-apps	2018-03-27 15:54:46.000000000 +0200
++++ openssl-1.0.2o/apps/s_socket.c	2018-04-05 16:15:52.400415779 +0200
+@@ -106,9 +106,7 @@ static struct hostent *GetHostByName(cha
+ static void ssl_sock_cleanup(void);
+ # endif
+ static int ssl_sock_init(void);
+-static int init_client_ip(int *sock, unsigned char ip[4], int port, int type);
+-static int init_server(int *sock, int port, int type);
+-static int init_server_long(int *sock, int port, char *ip, int type);
++static int init_server(int *sock, char *port, int type);
+ static int do_accept(int acc_sock, int *sock, char **host);
+ static int host_ip(char *str, unsigned char ip[4]);
+ 
+@@ -231,65 +229,66 @@ static int ssl_sock_init(void)
+     return (1);
+ }
+ 
+-int init_client(int *sock, char *host, int port, int type)
++int init_client(int *sock, char *host, char *port, int type)
+ {
+-    unsigned char ip[4];
+-
+-    memset(ip, '\0', sizeof(ip));
+-    if (!host_ip(host, &(ip[0])))
+-        return 0;
+-    return init_client_ip(sock, ip, port, type);
+-}
+-
+-static int init_client_ip(int *sock, unsigned char ip[4], int port, int type)
+-{
+-    unsigned long addr;
+-    struct sockaddr_in them;
+-    int s, i;
++    struct addrinfo *res, *res0, hints;
++    char *failed_call = NULL;
++    int s;
++    int e;
+ 
+     if (!ssl_sock_init())
+         return (0);
+ 
+-    memset((char *)&them, 0, sizeof(them));
+-    them.sin_family = AF_INET;
+-    them.sin_port = htons((unsigned short)port);
+-    addr = (unsigned long)
+-        ((unsigned long)ip[0] << 24L) |
+-        ((unsigned long)ip[1] << 16L) |
+-        ((unsigned long)ip[2] << 8L) | ((unsigned long)ip[3]);
+-    them.sin_addr.s_addr = htonl(addr);
+-
+-    if (type == SOCK_STREAM)
+-        s = socket(AF_INET, SOCK_STREAM, SOCKET_PROTOCOL);
+-    else                        /* ( type == SOCK_DGRAM) */
+-        s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
+-
+-    if (s == INVALID_SOCKET) {
+-        perror("socket");
++    memset(&hints, '\0', sizeof(hints));
++    hints.ai_socktype = type;
++    hints.ai_flags = AI_ADDRCONFIG;
++
++    e = getaddrinfo(host, port, &hints, &res);
++    if (e) {
++        fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(e));
++        if (e == EAI_SYSTEM)
++            perror("getaddrinfo");
+         return (0);
+     }
++
++    res0 = res;
++    while (res) {
++        s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
++        if (s == INVALID_SOCKET) {
++            failed_call = "socket";
++            goto nextres;
++        }
+ # if defined(SO_KEEPALIVE) && !defined(OPENSSL_SYS_MPE)
+-    if (type == SOCK_STREAM) {
+-        i = 0;
+-        i = setsockopt(s, SOL_SOCKET, SO_KEEPALIVE, (char *)&i, sizeof(i));
+-        if (i < 0) {
+-            closesocket(s);
+-            perror("keepalive");
+-            return (0);
++        if (type == SOCK_STREAM) {
++            int i = 0;
++            i = setsockopt(s, SOL_SOCKET, SO_KEEPALIVE,
++                           (char *)&i, sizeof(i));
++            if (i < 0) {
++                failed_call = "keepalive";
++                goto nextres;
++            }
+         }
+-    }
+ # endif
+-
+-    if (connect(s, (struct sockaddr *)&them, sizeof(them)) == -1) {
+-        closesocket(s);
+-        perror("connect");
+-        return (0);
++        if (connect(s, (struct sockaddr *)res->ai_addr, res->ai_addrlen) == 0) {
++            freeaddrinfo(res0);
++            *sock = s;
++            return (1);
++        }
++
++        failed_call = "socket";
++ nextres:
++        if (s != INVALID_SOCKET)
++            close(s);
++        res = res->ai_next;
+     }
+-    *sock = s;
+-    return (1);
++    freeaddrinfo(res0);
++    closesocket(s);
++
++    perror(failed_call);
++    return (0);
+ }
+ 
+-int do_server(int port, int type, int *ret,
++int do_server(char *port, int type, int *ret,
+               int (*cb) (char *hostname, int s, int stype,
+                          unsigned char *context), unsigned char *context,
+               int naccept)
+@@ -328,69 +327,89 @@ int do_server(int port, int type, int *r
+     }
+ }
+ 
+-static int init_server_long(int *sock, int port, char *ip, int type)
++static int init_server(int *sock, char *port, int type)
+ {
+-    int ret = 0;
+-    struct sockaddr_in server;
+-    int s = -1;
++    struct addrinfo *res, *res0 = NULL, hints;
++    char *failed_call = NULL;
++    int s = INVALID_SOCKET;
++    int e;
+ 
+     if (!ssl_sock_init())
+         return (0);
+ 
+-    memset((char *)&server, 0, sizeof(server));
+-    server.sin_family = AF_INET;
+-    server.sin_port = htons((unsigned short)port);
+-    if (ip == NULL)
+-        server.sin_addr.s_addr = INADDR_ANY;
+-    else
+-/* Added for T3E, address-of fails on bit field (beckman@acl.lanl.gov) */
+-# ifndef BIT_FIELD_LIMITS
+-        memcpy(&server.sin_addr.s_addr, ip, 4);
+-# else
+-        memcpy(&server.sin_addr, ip, 4);
+-# endif
+-
+-    if (type == SOCK_STREAM)
+-        s = socket(AF_INET, SOCK_STREAM, SOCKET_PROTOCOL);
+-    else                        /* type == SOCK_DGRAM */
+-        s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
++    memset(&hints, '\0', sizeof(hints));
++    hints.ai_family = AF_INET6;
++ tryipv4:
++    hints.ai_socktype = type;
++    hints.ai_flags = AI_PASSIVE;
++
++    e = getaddrinfo(NULL, port, &hints, &res);
++    if (e) {
++        if (hints.ai_family == AF_INET) {
++            fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(e));
++            if (e == EAI_SYSTEM)
++                perror("getaddrinfo");
++            return (0);
++        } else
++            res = NULL;
++    }
+ 
+-    if (s == INVALID_SOCKET)
+-        goto err;
++    res0 = res;
++    while (res) {
++        s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
++        if (s == INVALID_SOCKET) {
++            failed_call = "socket";
++            goto nextres;
++        }
++        if (hints.ai_family == AF_INET6) {
++            int j = 0;
++            setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, (void *)&j, sizeof(j));
++        }
+ # if defined SOL_SOCKET && defined SO_REUSEADDR
+-    {
+-        int j = 1;
+-        setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void *)&j, sizeof(j));
+-    }
+-# endif
+-    if (bind(s, (struct sockaddr *)&server, sizeof(server)) == -1) {
+-# ifndef OPENSSL_SYS_WINDOWS
+-        perror("bind");
++        {
++            int j = 1;
++            setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void *)&j, sizeof(j));
++        }
+ # endif
+-        goto err;
++
++        if (bind(s, (struct sockaddr *)res->ai_addr, res->ai_addrlen) == -1) {
++            failed_call = "bind";
++            goto nextres;
++        }
++        if (type == SOCK_STREAM && listen(s, 128) == -1) {
++            failed_call = "listen";
++            goto nextres;
++        }
++
++        *sock = s;
++        return (1);
++
++ nextres:
++        if (s != INVALID_SOCKET)
++            close(s);
++        res = res->ai_next;
+     }
+-    /* Make it 128 for linux */
+-    if (type == SOCK_STREAM && listen(s, 128) == -1)
+-        goto err;
+-    *sock = s;
+-    ret = 1;
+- err:
+-    if ((ret == 0) && (s != -1)) {
+-        SHUTDOWN(s);
++    if (res0)
++        freeaddrinfo(res0);
++
++    if (s == INVALID_SOCKET) {
++        if (hints.ai_family == AF_INET6) {
++            hints.ai_family = AF_INET;
++            goto tryipv4;
++        }
++        perror("socket");
++        return (0);
+     }
+-    return (ret);
+-}
+ 
+-static int init_server(int *sock, int port, int type)
+-{
+-    return (init_server_long(sock, port, NULL, type));
++    perror(failed_call);
++    return (0);
+ }
+ 
+ static int do_accept(int acc_sock, int *sock, char **host)
+ {
++    static struct sockaddr_storage from;
++    char buffer[NI_MAXHOST];
+     int ret;
+-    struct hostent *h1, *h2;
+-    static struct sockaddr_in from;
+     int len;
+ /*      struct linger ling; */
+ 
+@@ -432,134 +451,60 @@ static int do_accept(int acc_sock, int *
+     ling.l_onoff=1;
+     ling.l_linger=0;
+     i=setsockopt(ret,SOL_SOCKET,SO_LINGER,(char *)&ling,sizeof(ling));
+-    if (i < 0) { perror("linger"); return(0); }
++    if (i < 0) { closesocket(ret); perror("linger"); return(0); }
+     i=0;
+     i=setsockopt(ret,SOL_SOCKET,SO_KEEPALIVE,(char *)&i,sizeof(i));
+-    if (i < 0) { perror("keepalive"); return(0); }
++    if (i < 0) { closesocket(ret); perror("keepalive"); return(0); }
+ */
+ 
+     if (host == NULL)
+         goto end;
+-# ifndef BIT_FIELD_LIMITS
+-    /* I should use WSAAsyncGetHostByName() under windows */
+-    h1 = gethostbyaddr((char *)&from.sin_addr.s_addr,
+-                       sizeof(from.sin_addr.s_addr), AF_INET);
+-# else
+-    h1 = gethostbyaddr((char *)&from.sin_addr,
+-                       sizeof(struct in_addr), AF_INET);
+-# endif
+-    if (h1 == NULL) {
+-        BIO_printf(bio_err, "bad gethostbyaddr\n");
++
++    if (getnameinfo((struct sockaddr *)&from, sizeof(from),
++                    buffer, sizeof(buffer), NULL, 0, 0)) {
++        BIO_printf(bio_err, "getnameinfo failed\n");
+         *host = NULL;
+         /* return(0); */
+     } else {
+-        if ((*host = (char *)OPENSSL_malloc(strlen(h1->h_name) + 1)) == NULL) {
++        if ((*host = (char *)OPENSSL_malloc(strlen(buffer) + 1)) == NULL) {
+             perror("OPENSSL_malloc");
+             closesocket(ret);
+             return (0);
+         }
+-        BUF_strlcpy(*host, h1->h_name, strlen(h1->h_name) + 1);
+-
+-        h2 = GetHostByName(*host);
+-        if (h2 == NULL) {
+-            BIO_printf(bio_err, "gethostbyname failure\n");
+-            closesocket(ret);
+-            return (0);
+-        }
+-        if (h2->h_addrtype != AF_INET) {
+-            BIO_printf(bio_err, "gethostbyname addr is not AF_INET\n");
+-            closesocket(ret);
+-            return (0);
+-        }
++        strcpy(*host, buffer);
+     }
+  end:
+     *sock = ret;
+     return (1);
+ }
+ 
+-int extract_host_port(char *str, char **host_ptr, unsigned char *ip,
+-                      short *port_ptr)
++int extract_host_port(char *str, char **host_ptr, char **port_ptr)
+ {
+-    char *h, *p;
++    char *h, *p, *x;
+ 
+-    h = str;
+-    p = strchr(str, ':');
++    x = h = str;
++    if (*h == '[') {
++        h++;
++        p = strchr(h, ']');
++        if (p == NULL) {
++            BIO_printf(bio_err, "no ending bracket for IPv6 address\n");
++            return (0);
++        }
++        *(p++) = '\0';
++        x = p;
++    }
++    p = strchr(x, ':');
+     if (p == NULL) {
+         BIO_printf(bio_err, "no port defined\n");
+         return (0);
+     }
+     *(p++) = '\0';
+ 
+-    if ((ip != NULL) && !host_ip(str, ip))
+-        goto err;
+     if (host_ptr != NULL)
+         *host_ptr = h;
++    if (port_ptr != NULL)
++        *port_ptr = p;
+ 
+-    if (!extract_port(p, port_ptr))
+-        goto err;
+-    return (1);
+- err:
+-    return (0);
+-}
+-
+-static int host_ip(char *str, unsigned char ip[4])
+-{
+-    unsigned int in[4];
+-    int i;
+-
+-    if (sscanf(str, "%u.%u.%u.%u", &(in[0]), &(in[1]), &(in[2]), &(in[3])) ==
+-        4) {
+-        for (i = 0; i < 4; i++)
+-            if (in[i] > 255) {
+-                BIO_printf(bio_err, "invalid IP address\n");
+-                goto err;
+-            }
+-        ip[0] = in[0];
+-        ip[1] = in[1];
+-        ip[2] = in[2];
+-        ip[3] = in[3];
+-    } else {                    /* do a gethostbyname */
+-        struct hostent *he;
+-
+-        if (!ssl_sock_init())
+-            return (0);
+-
+-        he = GetHostByName(str);
+-        if (he == NULL) {
+-            BIO_printf(bio_err, "gethostbyname failure\n");
+-            goto err;
+-        }
+-        /* cast to short because of win16 winsock definition */
+-        if ((short)he->h_addrtype != AF_INET) {
+-            BIO_printf(bio_err, "gethostbyname addr is not AF_INET\n");
+-            return (0);
+-        }
+-        ip[0] = he->h_addr_list[0][0];
+-        ip[1] = he->h_addr_list[0][1];
+-        ip[2] = he->h_addr_list[0][2];
+-        ip[3] = he->h_addr_list[0][3];
+-    }
+-    return (1);
+- err:
+-    return (0);
+-}
+-
+-int extract_port(char *str, short *port_ptr)
+-{
+-    int i;
+-    struct servent *s;
+-
+-    i = atoi(str);
+-    if (i != 0)
+-        *port_ptr = (unsigned short)i;
+-    else {
+-        s = getservbyname(str, "tcp");
+-        if (s == NULL) {
+-            BIO_printf(bio_err, "getservbyname failure for %s\n", str);
+-            return (0);
+-        }
+-        *port_ptr = ntohs((unsigned short)s->s_port);
+-    }
+     return (1);
+ }
+ 

openssl-1.0.2o-system-cipherlist.patch

@@ -0,0 +1,301 @@
+diff -up openssl-1.0.2o/Configure.system openssl-1.0.2o/Configure
+--- openssl-1.0.2o/Configure.system	2018-08-03 10:57:10.936666776 +0200
++++ openssl-1.0.2o/Configure	2018-08-03 10:57:10.934666728 +0200
+@@ -11,7 +11,7 @@ use File::Compare;
+ 
+ # see INSTALL for instructions.
+ 
+-my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-krb5] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags]\n";
++my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-krb5] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--system-ciphers-file=SYSTEMCIPHERFILE] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags]\n";
+ 
+ # Options:
+ #
+@@ -36,6 +36,9 @@ my $usage="Usage: Configure [no-<cipher>
+ # --with-krb5-flavor  Declare what flavor of Kerberos 5 is used.  Currently
+ #		supported values are "MIT" and "Heimdal".  A value is required.
+ #
++# --system-ciphers-file  A file to read cipher string from when the PROFILE=SYSTEM
++#		cipher is specified (default).
++#
+ # --test-sanity Make a number of sanity checks on the data in this file.
+ #               This is a debugging tool for OpenSSL developers.
+ #
+@@ -730,6 +733,7 @@ my $prefix="";
+ my $libdir="";
+ my $openssldir="";
+ my $enginesdir="";
++my $system_ciphers_file="";
+ my $exe_ext="";
+ my $install_prefix= "$ENV{'INSTALL_PREFIX'}";
+ my $cross_compile_prefix="";
+@@ -963,6 +967,10 @@ PROCESS_ARGS:
+ 				{
+ 				$enginesdir=$1;
+ 				}
++			elsif (/^--system-ciphers-file=(.*)$/)
++				{
++				$system_ciphers_file=$1;
++				}
+ 			elsif (/^--install.prefix=(.*)$/)
+ 				{
+ 				$install_prefix=$1;
+@@ -1120,6 +1128,7 @@ print "Configuring for $target\n";
+ 
+ &usage if (!defined($table{$target}));
+ 
++chop $system_ciphers_file if $system_ciphers_file =~ /\/$/;
+ 
+ foreach (sort (keys %disabled))
+ 	{
+@@ -1718,6 +1727,7 @@ while (<IN>)
+ 	s/^MULTILIB=.*$/MULTILIB=$multilib/;
+ 	s/^OPENSSLDIR=.*$/OPENSSLDIR=$openssldir/;
+ 	s/^ENGINESDIR=.*$/ENGINESDIR=$enginesdir/;
++	s/^SYSTEM_CIPHERS_FILE=.*$/SYSTEM_CIPHERS_FILE=$system_ciphers_file/;
+ 	s/^LIBDIR=.*$/LIBDIR=$libdir/;
+ 	s/^INSTALL_PREFIX=.*$/INSTALL_PREFIX=$install_prefix/;
+ 	s/^PLATFORM=.*$/PLATFORM=$target/;
+@@ -1938,6 +1948,14 @@ while (<IN>)
+ 		$foo =~ s/\\/\\\\/g;
+ 		print OUT "#define ENGINESDIR \"$foo\"\n";
+ 		}
++	elsif	(/^#((define)|(undef))\s+SYSTEM_CIPHERS_FILE/)
++		{
++		my $foo = "$system_ciphers_file";
++		if ($foo ne '') {
++			$foo =~ s/\\/\\\\/g;
++			print OUT "#define SYSTEM_CIPHERS_FILE \"$foo\"\n";
++		}
++		}
+ 	elsif	(/^#((define)|(undef))\s+OPENSSL_EXPORT_VAR_AS_FUNCTION/)
+ 		{ printf OUT "#undef OPENSSL_EXPORT_VAR_AS_FUNCTION\n"
+ 			if $export_var_as_fn;
+diff -up openssl-1.0.2o/crypto/opensslconf.h.in.system openssl-1.0.2o/crypto/opensslconf.h.in
+--- openssl-1.0.2o/crypto/opensslconf.h.in.system	2018-08-03 10:57:10.839664439 +0200
++++ openssl-1.0.2o/crypto/opensslconf.h.in	2018-08-03 10:57:10.883665499 +0200
+@@ -25,6 +25,8 @@
+ #endif
+ #endif
+ 
++#undef SYSTEM_CIPHERS_FILE
++
+ #undef OPENSSL_UNISTD
+ #define OPENSSL_UNISTD <unistd.h>
+ 
+diff -up openssl-1.0.2o/ssl/ssl_ciph.c.system openssl-1.0.2o/ssl/ssl_ciph.c
+--- openssl-1.0.2o/ssl/ssl_ciph.c.system	2018-08-03 10:57:10.843664535 +0200
++++ openssl-1.0.2o/ssl/ssl_ciph.c	2018-08-03 11:29:43.617274708 +0200
+@@ -1467,6 +1467,66 @@ static int check_suiteb_cipher_list(cons
+ }
+ #endif
+ 
++#ifdef SYSTEM_CIPHERS_FILE
++static char *load_system_str(const char *suffix)
++{
++    FILE *fp;
++    char buf[1024];
++    char *new_rules;
++    unsigned len, slen;
++
++    fp = fopen(SYSTEM_CIPHERS_FILE, "r");
++    if (fp == NULL || fgets(buf, sizeof(buf), fp) == NULL) {
++        /* cannot open or file is empty */
++        snprintf(buf, sizeof(buf), "%s", SSL_DEFAULT_CIPHER_LIST);
++    }
++    else {
++        /* we need to skip eventual @SECLEVEL set for OpenSSL-1.1 */
++        char *seclevel, *eptr;
++
++        seclevel = strstr(buf, "@SECLEVEL=");
++        if (seclevel != NULL) {
++            eptr = strchr(seclevel, ':');
++            if (eptr == NULL)
++                *seclevel = '\0';
++            else {
++                len = strlen(eptr);
++                /* move also the NUL terminator */
++                memmove(seclevel, eptr + 1, len);
++            }
++        }
++    }
++
++    if (fp)
++        fclose(fp);
++
++    slen = strlen(suffix);
++    len = strlen(buf);
++
++    if (buf[len - 1] == '\n') {
++        len--;
++        buf[len] = 0;
++    }
++    if (buf[len - 1] == '\r') {
++        len--;
++        buf[len] = 0;
++    }
++
++    new_rules = OPENSSL_malloc(len + slen + 1);
++    if (new_rules == 0)
++        return NULL;
++
++    memcpy(new_rules, buf, len);
++    if (slen > 0) {
++        memcpy(&new_rules[len], suffix, slen);
++        len += slen;
++    }
++    new_rules[len] = 0;
++
++    return new_rules;
++}
++#endif
++
+ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)
+                                              **cipher_list, STACK_OF(SSL_CIPHER)
+                                              **cipher_list_by_id,
+@@ -1475,19 +1535,29 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+     int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
+     unsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac,
+         disabled_ssl;
+-    STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
++    STACK_OF(SSL_CIPHER) *cipherstack = NULL, *tmp_cipher_list;
+     const char *rule_p;
+     CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
+     const SSL_CIPHER **ca_list = NULL;
++#ifdef SYSTEM_CIPHERS_FILE
++    char *new_rules = NULL;
++
++    if (rule_str != NULL && strncmp(rule_str, "PROFILE=SYSTEM", 14) == 0) {
++        char *p = rule_str + 14;
++    
++        new_rules = load_system_str(p);
++        rule_str = new_rules;
++    }
++#endif
+ 
+     /*
+      * Return with error if nothing to do.
+      */
+     if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)
+-        return NULL;
++        goto end;
+ #ifndef OPENSSL_NO_EC
+     if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))
+-        return NULL;
++        goto end;
+ #endif
+ 
+     /*
+@@ -1511,7 +1581,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+         (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
+     if (co_list == NULL) {
+         SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
+-        return (NULL);          /* Failure */
++        goto end;
+     }
+ 
+     ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
+@@ -1572,8 +1642,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+      * in force within each class
+      */
+     if (!ssl_cipher_strength_sort(&head, &tail)) {
+-        OPENSSL_free(co_list);
+-        return NULL;
++        goto end;
+     }
+ 
+     /* Now disable everything (maintaining the ordering!) */
+@@ -1591,9 +1660,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+     num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
+     ca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
+     if (ca_list == NULL) {
+-        OPENSSL_free(co_list);
+         SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
+-        return (NULL);          /* Failure */
++        goto end;
+     }
+     ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
+                                disabled_mkey, disabled_auth, disabled_enc,
+@@ -1619,8 +1687,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+     OPENSSL_free((void *)ca_list); /* Not needed anymore */
+ 
+     if (!ok) {                  /* Rule processing failure */
+-        OPENSSL_free(co_list);
+-        return (NULL);
++        goto end;
+     }
+ 
+     /*
+@@ -1628,8 +1695,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+      * if we cannot get one.
+      */
+     if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
+-        OPENSSL_free(co_list);
+-        return (NULL);
++        goto end;
+     }
+ 
+     /*
+@@ -1650,12 +1716,12 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+ #endif
+         }
+     }
+-    OPENSSL_free(co_list);      /* Not needed any longer */
+ 
+     tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);
+     if (tmp_cipher_list == NULL) {
+         sk_SSL_CIPHER_free(cipherstack);
+-        return NULL;
++        cipherstack = NULL;
++        goto end;
+     }
+     if (*cipher_list != NULL)
+         sk_SSL_CIPHER_free(*cipher_list);
+@@ -1667,6 +1733,12 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+                                      ssl_cipher_ptr_id_cmp);
+ 
+     sk_SSL_CIPHER_sort(*cipher_list_by_id);
++
++ end:
++    OPENSSL_free(co_list);
++#ifdef SYSTEM_CIPHERS_FILE
++    OPENSSL_free(new_rules);
++#endif
+     return (cipherstack);
+ }
+ 
+diff -up openssl-1.0.2o/ssl/ssl.h.system openssl-1.0.2o/ssl/ssl.h
+--- openssl-1.0.2o/ssl/ssl.h.system	2018-08-03 10:57:10.724661667 +0200
++++ openssl-1.0.2o/ssl/ssl.h	2018-08-03 10:57:10.895665788 +0200
+@@ -345,6 +345,11 @@ extern "C" {
+  * throwing out anonymous and unencrypted ciphersuites! (The latter are not
+  * actually enabled by ALL, but "ALL:RSA" would enable some of them.)
+  */
++# ifdef SYSTEM_CIPHERS_FILE
++#  define SSL_SYSTEM_DEFAULT_CIPHER_LIST "PROFILE=SYSTEM"
++# else
++#  define SSL_SYSTEM_DEFAULT_CIPHER_LIST SSL_DEFAULT_CIPHER_LIST
++# endif
+ 
+ /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */
+ # define SSL_SENT_SHUTDOWN       1
+diff -up openssl-1.0.2o/ssl/ssl_lib.c.system openssl-1.0.2o/ssl/ssl_lib.c
+--- openssl-1.0.2o/ssl/ssl_lib.c.system	2018-03-27 15:54:46.000000000 +0200
++++ openssl-1.0.2o/ssl/ssl_lib.c	2018-08-03 10:57:10.887665596 +0200
+@@ -282,7 +282,7 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx
+                                 &(ctx->cipher_list_by_id),
+                                 meth->version ==
+                                 SSL2_VERSION ? "SSLv2" :
+-                                SSL_DEFAULT_CIPHER_LIST, ctx->cert);
++                                SSL_SYSTEM_DEFAULT_CIPHER_LIST, ctx->cert);
+     if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
+         SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,
+                SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
+@@ -1968,7 +1968,7 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *m
+     ssl_create_cipher_list(ret->method,
+                            &ret->cipher_list, &ret->cipher_list_by_id,
+                            meth->version ==
+-                           SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST,
++                           SSL2_VERSION ? "SSLv2" : SSL_SYSTEM_DEFAULT_CIPHER_LIST,
+                            ret->cert);
+     if (ret->cipher_list == NULL || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
+         SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);

openssl-1.0.2o-test-use-localhost.patch

@@ -0,0 +1,21 @@
+diff -up openssl-1.0.2o/ssl/ssltest.c.use-localhost openssl-1.0.2o/ssl/ssltest.c
+--- openssl-1.0.2o/ssl/ssltest.c.use-localhost	2018-04-05 16:09:54.338118770 +0200
++++ openssl-1.0.2o/ssl/ssltest.c	2018-04-05 16:11:36.201476198 +0200
+@@ -1859,16 +1859,7 @@ int main(int argc, char *argv[])
+ 
+ #ifndef OPENSSL_NO_KRB5
+     if (c_ssl && c_ssl->kssl_ctx) {
+-        char localhost[MAXHOSTNAMELEN + 2];
+-
+-        if (gethostname(localhost, sizeof(localhost) - 1) == 0) {
+-            localhost[sizeof(localhost) - 1] = '\0';
+-            if (strlen(localhost) == sizeof(localhost) - 1) {
+-                BIO_printf(bio_err, "localhost name too long\n");
+-                goto end;
+-            }
+-            kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER, localhost);
+-        }
++        kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER, "localhost");
+     }
+ #endif                          /* OPENSSL_NO_KRB5 */
+ 

openssl-1.0.2o-wrap-pad.patch

@@ -0,0 +1,534 @@
+diff -up openssl-1.0.2o/crypto/evp/c_allc.c.wrap openssl-1.0.2o/crypto/evp/c_allc.c
+--- openssl-1.0.2o/crypto/evp/c_allc.c.wrap	2018-04-05 17:58:38.328213250 +0200
++++ openssl-1.0.2o/crypto/evp/c_allc.c	2018-04-05 17:58:38.407215094 +0200
+@@ -179,6 +179,7 @@ void OpenSSL_add_all_ciphers(void)
+     EVP_add_cipher(EVP_aes_128_xts());
+     EVP_add_cipher(EVP_aes_128_ccm());
+     EVP_add_cipher(EVP_aes_128_wrap());
++    EVP_add_cipher(EVP_aes_128_wrap_pad());
+     EVP_add_cipher_alias(SN_aes_128_cbc, "AES128");
+     EVP_add_cipher_alias(SN_aes_128_cbc, "aes128");
+     EVP_add_cipher(EVP_aes_192_ecb());
+@@ -191,6 +192,7 @@ void OpenSSL_add_all_ciphers(void)
+     EVP_add_cipher(EVP_aes_192_gcm());
+     EVP_add_cipher(EVP_aes_192_ccm());
+     EVP_add_cipher(EVP_aes_192_wrap());
++    EVP_add_cipher(EVP_aes_192_wrap_pad());
+     EVP_add_cipher_alias(SN_aes_192_cbc, "AES192");
+     EVP_add_cipher_alias(SN_aes_192_cbc, "aes192");
+     EVP_add_cipher(EVP_aes_256_ecb());
+@@ -204,6 +206,7 @@ void OpenSSL_add_all_ciphers(void)
+     EVP_add_cipher(EVP_aes_256_xts());
+     EVP_add_cipher(EVP_aes_256_ccm());
+     EVP_add_cipher(EVP_aes_256_wrap());
++    EVP_add_cipher(EVP_aes_256_wrap_pad());
+     EVP_add_cipher_alias(SN_aes_256_cbc, "AES256");
+     EVP_add_cipher_alias(SN_aes_256_cbc, "aes256");
+ # if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
+@@ -258,6 +261,7 @@ void OpenSSL_add_all_ciphers(void)
+ 
+         EVP_add_cipher(EVP_des_ede());
+         EVP_add_cipher(EVP_des_ede3());
++        EVP_add_cipher(EVP_des_ede3_wrap());
+ # endif
+ 
+ # ifndef OPENSSL_NO_AES
+@@ -272,6 +276,7 @@ void OpenSSL_add_all_ciphers(void)
+         EVP_add_cipher(EVP_aes_128_xts());
+         EVP_add_cipher(EVP_aes_128_ccm());
+         EVP_add_cipher(EVP_aes_128_wrap());
++        EVP_add_cipher(EVP_aes_128_wrap_pad());
+         EVP_add_cipher_alias(SN_aes_128_cbc, "AES128");
+         EVP_add_cipher_alias(SN_aes_128_cbc, "aes128");
+         EVP_add_cipher(EVP_aes_192_ecb());
+@@ -284,6 +289,7 @@ void OpenSSL_add_all_ciphers(void)
+         EVP_add_cipher(EVP_aes_192_gcm());
+         EVP_add_cipher(EVP_aes_192_ccm());
+         EVP_add_cipher(EVP_aes_192_wrap());
++        EVP_add_cipher(EVP_aes_192_wrap_pad());
+         EVP_add_cipher_alias(SN_aes_192_cbc, "AES192");
+         EVP_add_cipher_alias(SN_aes_192_cbc, "aes192");
+         EVP_add_cipher(EVP_aes_256_ecb());
+@@ -297,6 +303,7 @@ void OpenSSL_add_all_ciphers(void)
+         EVP_add_cipher(EVP_aes_256_xts());
+         EVP_add_cipher(EVP_aes_256_ccm());
+         EVP_add_cipher(EVP_aes_256_wrap());
++        EVP_add_cipher(EVP_aes_256_wrap_pad());
+         EVP_add_cipher_alias(SN_aes_256_cbc, "AES256");
+         EVP_add_cipher_alias(SN_aes_256_cbc, "aes256");
+ # endif
+diff -up openssl-1.0.2o/crypto/evp/e_aes.c.wrap openssl-1.0.2o/crypto/evp/e_aes.c
+--- openssl-1.0.2o/crypto/evp/e_aes.c.wrap	2018-04-05 17:58:38.379214440 +0200
++++ openssl-1.0.2o/crypto/evp/e_aes.c	2018-04-05 17:58:38.408215117 +0200
+@@ -1969,7 +1969,7 @@ static int aes_wrap_init_key(EVP_CIPHER_
+             wctx->iv = NULL;
+     }
+     if (iv) {
+-        memcpy(ctx->iv, iv, 8);
++        memcpy(ctx->iv, iv, EVP_CIPHER_CTX_iv_length(ctx));
+         wctx->iv = ctx->iv;
+     }
+     return 1;
+@@ -1980,30 +1980,57 @@ static int aes_wrap_cipher(EVP_CIPHER_CT
+ {
+     EVP_AES_WRAP_CTX *wctx = ctx->cipher_data;
+     size_t rv;
++    /* AES wrap with padding has IV length of 4, without padding 8 */
++    int pad = EVP_CIPHER_CTX_iv_length(ctx) == 4;
++    /* No final operation so always return zero length */
+     if (!in)
+         return 0;
+-    if (inlen % 8)
++    /* Input length must always be non-zero */
++    if (!inlen)
+         return -1;
+-    if (ctx->encrypt && inlen < 8)
++    /* If decrypting need at least 16 bytes and multiple of 8 */
++    if (!ctx->encrypt && (inlen < 16 || inlen & 0x7))
+         return -1;
+-    if (!ctx->encrypt && inlen < 16)
++    /* If not padding input must be multiple of 8 */
++    if (!pad && inlen & 0x7)
+         return -1;
+     if (!out) {
+-        if (ctx->encrypt)
++        if (ctx->encrypt) {
++            /* If padding round up to multiple of 8 */
++            if (pad)
++                inlen = (inlen + 7) / 8 * 8;
++            /* 8 byte prefix */
+             return inlen + 8;
+-        else
++        } else {
++            /* If not padding output will be exactly 8 bytes
++             * smaller than input. If padding it will be at
++             * least 8 bytes smaller but we don't know how
++             * much.
++             */
+             return inlen - 8;
+     }
++    }
++    if (pad) {
+     if (ctx->encrypt)
+-        rv = CRYPTO_128_wrap(&wctx->ks.ks, wctx->iv, out, in, inlen,
++            rv = CRYPTO_128_wrap_pad(&wctx->ks.ks, wctx->iv,
++                                     out, in, inlen,
+                              (block128_f) AES_encrypt);
+     else
+-        rv = CRYPTO_128_unwrap(&wctx->ks.ks, wctx->iv, out, in, inlen,
++            rv = CRYPTO_128_unwrap_pad(&wctx->ks.ks, wctx->iv,
++                                       out, in, inlen,
+                                (block128_f) AES_decrypt);
++    } else {
++        if (ctx->encrypt)
++            rv = CRYPTO_128_wrap(&wctx->ks.ks, wctx->iv,
++                                 out, in, inlen, (block128_f) AES_encrypt);
++        else
++            rv = CRYPTO_128_unwrap(&wctx->ks.ks, wctx->iv,
++                                   out, in, inlen, (block128_f) AES_decrypt);
++    }
+     return rv ? (int)rv : -1;
+ }
+ 
+-#define WRAP_FLAGS      (EVP_CIPH_WRAP_MODE \
++# define WRAP_FLAGS      (EVP_CIPH_WRAP_MODE | EVP_CIPH_FLAG_FIPS \
+                 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
+                 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_FLAG_DEFAULT_ASN1)
+ 
+@@ -2048,3 +2075,45 @@ const EVP_CIPHER *EVP_aes_256_wrap(void)
+ {
+     return &aes_256_wrap;
+ }
++
++static const EVP_CIPHER aes_128_wrap_pad = {
++    NID_id_aes128_wrap_pad,
++    8, 16, 4, WRAP_FLAGS,
++    aes_wrap_init_key, aes_wrap_cipher,
++    NULL,
++    sizeof(EVP_AES_WRAP_CTX),
++    NULL, NULL, NULL, NULL
++};
++
++const EVP_CIPHER *EVP_aes_128_wrap_pad(void)
++{
++    return &aes_128_wrap_pad;
++}
++
++static const EVP_CIPHER aes_192_wrap_pad = {
++    NID_id_aes192_wrap_pad,
++    8, 24, 4, WRAP_FLAGS,
++    aes_wrap_init_key, aes_wrap_cipher,
++    NULL,
++    sizeof(EVP_AES_WRAP_CTX),
++    NULL, NULL, NULL, NULL
++};
++
++const EVP_CIPHER *EVP_aes_192_wrap_pad(void)
++{
++    return &aes_192_wrap_pad;
++}
++
++static const EVP_CIPHER aes_256_wrap_pad = {
++    NID_id_aes256_wrap_pad,
++    8, 32, 4, WRAP_FLAGS,
++    aes_wrap_init_key, aes_wrap_cipher,
++    NULL,
++    sizeof(EVP_AES_WRAP_CTX),
++    NULL, NULL, NULL, NULL
++};
++
++const EVP_CIPHER *EVP_aes_256_wrap_pad(void)
++{
++    return &aes_256_wrap_pad;
++}
+diff -up openssl-1.0.2o/crypto/evp/e_des3.c.wrap openssl-1.0.2o/crypto/evp/e_des3.c
+--- openssl-1.0.2o/crypto/evp/e_des3.c.wrap	2018-04-05 17:58:38.329213274 +0200
++++ openssl-1.0.2o/crypto/evp/e_des3.c	2018-04-05 17:58:38.408215117 +0200
+@@ -477,7 +477,7 @@ static const EVP_CIPHER des3_wrap = {
+     NID_id_smime_alg_CMS3DESwrap,
+     8, 24, 0,
+     EVP_CIPH_WRAP_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER
+-        | EVP_CIPH_FLAG_DEFAULT_ASN1,
++        | EVP_CIPH_FLAG_DEFAULT_ASN1 | EVP_CIPH_FLAG_FIPS,
+     des_ede3_init_key, des_ede3_wrap_cipher,
+     NULL,
+     sizeof(DES_EDE_KEY),
+diff -up openssl-1.0.2o/crypto/evp/evp.h.wrap openssl-1.0.2o/crypto/evp/evp.h
+--- openssl-1.0.2o/crypto/evp/evp.h.wrap	2018-04-05 17:58:38.330213297 +0200
++++ openssl-1.0.2o/crypto/evp/evp.h	2018-04-05 17:58:38.408215117 +0200
+@@ -841,6 +841,7 @@ const EVP_CIPHER *EVP_aes_128_ccm(void);
+ const EVP_CIPHER *EVP_aes_128_gcm(void);
+ const EVP_CIPHER *EVP_aes_128_xts(void);
+ const EVP_CIPHER *EVP_aes_128_wrap(void);
++const EVP_CIPHER *EVP_aes_128_wrap_pad(void);
+ const EVP_CIPHER *EVP_aes_192_ecb(void);
+ const EVP_CIPHER *EVP_aes_192_cbc(void);
+ const EVP_CIPHER *EVP_aes_192_cfb1(void);
+@@ -852,6 +853,7 @@ const EVP_CIPHER *EVP_aes_192_ctr(void);
+ const EVP_CIPHER *EVP_aes_192_ccm(void);
+ const EVP_CIPHER *EVP_aes_192_gcm(void);
+ const EVP_CIPHER *EVP_aes_192_wrap(void);
++const EVP_CIPHER *EVP_aes_192_wrap_pad(void);
+ const EVP_CIPHER *EVP_aes_256_ecb(void);
+ const EVP_CIPHER *EVP_aes_256_cbc(void);
+ const EVP_CIPHER *EVP_aes_256_cfb1(void);
+@@ -864,6 +866,7 @@ const EVP_CIPHER *EVP_aes_256_ccm(void);
+ const EVP_CIPHER *EVP_aes_256_gcm(void);
+ const EVP_CIPHER *EVP_aes_256_xts(void);
+ const EVP_CIPHER *EVP_aes_256_wrap(void);
++const EVP_CIPHER *EVP_aes_256_wrap_pad(void);
+ #  if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
+ const EVP_CIPHER *EVP_aes_128_cbc_hmac_sha1(void);
+ const EVP_CIPHER *EVP_aes_256_cbc_hmac_sha1(void);
+diff -up openssl-1.0.2o/crypto/evp/evptests.txt.wrap openssl-1.0.2o/crypto/evp/evptests.txt
+--- openssl-1.0.2o/crypto/evp/evptests.txt.wrap	2018-03-27 15:54:46.000000000 +0200
++++ openssl-1.0.2o/crypto/evp/evptests.txt	2018-04-05 17:58:38.409215140 +0200
+@@ -399,3 +399,7 @@ id-aes256-wrap:000102030405060708090A0B0
+ id-aes192-wrap:000102030405060708090A0B0C0D0E0F1011121314151617::00112233445566778899AABBCCDDEEFF0001020304050607:031D33264E15D33268F24EC260743EDCE1C6C7DDEE725A936BA814915C6762D2
+ id-aes256-wrap:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F::00112233445566778899AABBCCDDEEFF0001020304050607:A8F9BC1612C68B3FF6E6F4FBE30E71E4769C8B80A32CB8958CD5D17D6B254DA1
+ id-aes256-wrap:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F::00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F:28C9F404C4B810F4CBCCB35CFB87F8263F5786E2D80ED326CBC7F0E71A99F43BFB988B9B7A02DD21
++# AES wrap tests from RFC5649
++id-aes192-wrap-pad:5840df6e29b02af1ab493b705bf16ea1ae8338f4dcc176a8::c37b7e6492584340bed12207808941155068f738:138bdeaa9b8fa7fc61f97742e72248ee5ae6ae5360d1ae6a5f54f373fa543b6a
++id-aes192-wrap-pad:5840df6e29b02af1ab493b705bf16ea1ae8338f4dcc176a8::466f7250617369:afbeb0f07dfbf5419200f2ccb50bb24f
++
+diff -up openssl-1.0.2o/crypto/modes/modes.h.wrap openssl-1.0.2o/crypto/modes/modes.h
+--- openssl-1.0.2o/crypto/modes/modes.h.wrap	2018-04-05 17:58:37.643197269 +0200
++++ openssl-1.0.2o/crypto/modes/modes.h	2018-04-05 17:58:38.409215140 +0200
+@@ -157,6 +157,12 @@ size_t CRYPTO_128_unwrap(void *key, cons
+                          unsigned char *out,
+                          const unsigned char *in, size_t inlen,
+                          block128_f block);
++size_t CRYPTO_128_wrap_pad(void *key, const unsigned char *icv,
++                           unsigned char *out, const unsigned char *in,
++                           size_t inlen, block128_f block);
++size_t CRYPTO_128_unwrap_pad(void *key, const unsigned char *icv,
++                             unsigned char *out, const unsigned char *in,
++                             size_t inlen, block128_f block);
+ 
+ #ifdef  __cplusplus
+ }
+diff -up openssl-1.0.2o/crypto/modes/wrap128.c.wrap openssl-1.0.2o/crypto/modes/wrap128.c
+--- openssl-1.0.2o/crypto/modes/wrap128.c.wrap	2018-03-27 15:54:46.000000000 +0200
++++ openssl-1.0.2o/crypto/modes/wrap128.c	2018-04-05 17:58:38.409215140 +0200
+@@ -2,6 +2,7 @@
+ /*
+  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+  * project.
++ * Mode with padding contributed by Petr Spacek (pspacek@redhat.com).
+  */
+ /* ====================================================================
+  * Copyright (c) 2013 The OpenSSL Project.  All rights reserved.
+@@ -52,19 +53,44 @@
+  * ====================================================================
+  */
+ 
++/**  Beware!
++ *
++ *  Following wrapping modes were designed for AES but this implementation
++ *  allows you to use them for any 128 bit block cipher.
++ */
++
+ #include "cryptlib.h"
+ #include <openssl/modes.h>
+ 
++/** RFC 3394 section 2.2.3.1 Default Initial Value */
+ static const unsigned char default_iv[] = {
+     0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6,
+ };
+ 
+-/*
+- * Input size limit: lower than maximum of standards but far larger than
++/** RFC 5649 section 3 Alternative Initial Value 32-bit constant */
++static const unsigned char default_aiv[] = {
++    0xA6, 0x59, 0x59, 0xA6
++};
++
++/** Input size limit: lower than maximum of standards but far larger than
+  * anything that will be used in practice.
+  */
+ #define CRYPTO128_WRAP_MAX (1UL << 31)
+ 
++/** Wrapping according to RFC 3394 section 2.2.1.
++ *
++ *  @param[in]  key    Key value. 
++ *  @param[in]  iv     IV value. Length = 8 bytes. NULL = use default_iv.
++ *  @param[in]  in     Plain text as n 64-bit blocks, n >= 2.
++ *  @param[in]  inlen  Length of in.
++ *  @param[out] out    Cipher text. Minimal buffer length = (inlen + 8) bytes.
++ *                     Input and output buffers can overlap if block function
++ *                     supports that.
++ *  @param[in]  block  Block processing function.
++ *  @return            0 if inlen does not consist of n 64-bit blocks, n >= 2.
++ *                     or if inlen > CRYPTO128_WRAP_MAX.
++ *                     Output length if wrapping succeeded.
++ */
+ size_t CRYPTO_128_wrap(void *key, const unsigned char *iv,
+                        unsigned char *out,
+                        const unsigned char *in, size_t inlen,
+@@ -72,7 +98,7 @@ size_t CRYPTO_128_wrap(void *key, const
+ {
+     unsigned char *A, B[16], *R;
+     size_t i, j, t;
+-    if ((inlen & 0x7) || (inlen < 8) || (inlen > CRYPTO128_WRAP_MAX))
++    if ((inlen & 0x7) || (inlen < 16) || (inlen > CRYPTO128_WRAP_MAX))
+         return 0;
+     A = B;
+     t = 1;
+@@ -100,7 +126,23 @@ size_t CRYPTO_128_wrap(void *key, const
+     return inlen + 8;
+ }
+ 
+-size_t CRYPTO_128_unwrap(void *key, const unsigned char *iv,
++/** Unwrapping according to RFC 3394 section 2.2.2 steps 1-2.
++ *  IV check (step 3) is responsibility of the caller.
++ *
++ *  @param[in]  key    Key value. 
++ *  @param[out] iv     Unchecked IV value. Minimal buffer length = 8 bytes.
++ *  @param[out] out    Plain text without IV.
++ *                     Minimal buffer length = (inlen - 8) bytes.
++ *                     Input and output buffers can overlap if block function
++ *                     supports that.
++ *  @param[in]  in     Ciphertext text as n 64-bit blocks
++ *  @param[in]  inlen  Length of in.
++ *  @param[in]  block  Block processing function.
++ *  @return            0 if inlen is out of range [24, CRYPTO128_WRAP_MAX]
++ *                     or if inlen is not multiply of 8.
++ *                     Output length otherwise.
++ */
++static size_t crypto_128_unwrap_raw(void *key, unsigned char *iv,
+                          unsigned char *out,
+                          const unsigned char *in, size_t inlen,
+                          block128_f block)
+@@ -128,11 +170,190 @@ size_t CRYPTO_128_unwrap(void *key, cons
+             memcpy(R, B + 8, 8);
+         }
+     }
++    memcpy(iv, A, 8);
++    return inlen;
++}
++
++/** Unwrapping according to RFC 3394 section 2.2.2 including IV check.
++ *  First block of plain text have to match supplied IV otherwise an error is
++ *  returned.
++ *
++ *  @param[in]  key    Key value. 
++ *  @param[out] iv     Unchecked IV value. Minimal buffer length = 8 bytes.
++ *  @param[out] out    Plain text without IV.
++ *                     Minimal buffer length = (inlen - 8) bytes.
++ *                     Input and output buffers can overlap if block function
++ *                     supports that.
++ *  @param[in]  in     Ciphertext text as n 64-bit blocks
++ *  @param[in]  inlen  Length of in.
++ *  @param[in]  block  Block processing function.
++ *  @return            0 if inlen is out of range [24, CRYPTO128_WRAP_MAX]
++ *                     or if inlen is not multiply of 8
++ *                     or if IV doesn't match expected value.
++ *                     Output length otherwise.
++ */
++size_t CRYPTO_128_unwrap(void *key, const unsigned char *iv,
++                         unsigned char *out, const unsigned char *in,
++                         size_t inlen, block128_f block)
++{
++    size_t ret;
++    unsigned char got_iv[8];
++
++    ret = crypto_128_unwrap_raw(key, got_iv, out, in, inlen, block);
++    if (ret == 0)
++        return 0;
++
+     if (!iv)
+         iv = default_iv;
+-    if (memcmp(A, iv, 8)) {
++    if (CRYPTO_memcmp(got_iv, iv, 8)) {
++        OPENSSL_cleanse(out, ret);
++        return 0;
++    }
++    return ret;
++}
++
++/** Wrapping according to RFC 5649 section 4.1.
++ *
++ *  @param[in]  key    Key value. 
++ *  @param[in]  icv    (Non-standard) IV, 4 bytes. NULL = use default_aiv.
++ *  @param[out] out    Cipher text. Minimal buffer length = (inlen + 15) bytes.
++ *                     Input and output buffers can overlap if block function
++ *                     supports that.
++ *  @param[in]  in     Plain text as n 64-bit blocks, n >= 2.
++ *  @param[in]  inlen  Length of in.
++ *  @param[in]  block  Block processing function.
++ *  @return            0 if inlen is out of range [1, CRYPTO128_WRAP_MAX].
++ *                     Output length if wrapping succeeded.
++ */
++size_t CRYPTO_128_wrap_pad(void *key, const unsigned char *icv,
++                           unsigned char *out,
++                           const unsigned char *in, size_t inlen,
++                           block128_f block)
++{
++    /* n: number of 64-bit blocks in the padded key data */
++    const size_t blocks_padded = (inlen + 7) / 8;
++    const size_t padded_len = blocks_padded * 8;
++    const size_t padding_len = padded_len - inlen;
++    /* RFC 5649 section 3: Alternative Initial Value */
++    unsigned char aiv[8];
++    int ret;
++
++    /* Section 1: use 32-bit fixed field for plaintext octet length */
++    if (inlen == 0 || inlen >= CRYPTO128_WRAP_MAX)
++        return 0;
++
++    /* Section 3: Alternative Initial Value */
++    if (!icv)
++        memcpy(aiv, default_aiv, 4);
++    else
++        memcpy(aiv, icv, 4);    /* Standard doesn't mention this. */
++
++    aiv[4] = (inlen >> 24) & 0xFF;
++    aiv[5] = (inlen >> 16) & 0xFF;
++    aiv[6] = (inlen >> 8) & 0xFF;
++    aiv[7] = inlen & 0xFF;
++
++    if (padded_len == 8) {
++        /* Section 4.1 - special case in step 2:
++         * If the padded plaintext contains exactly eight octets, then
++         * prepend the AIV and encrypt the resulting 128-bit block
++         * using AES in ECB mode. */
++        memmove(out + 8, in, inlen);
++        memcpy(out, aiv, 8);
++        memset(out + 8 + inlen, 0, padding_len);
++        block(out, out, key);
++        ret = 16;               /* AIV + padded input */
++    } else {
++        memmove(out, in, inlen);
++        memset(out + inlen, 0, padding_len); /* Section 4.1 step 1 */
++        ret = CRYPTO_128_wrap(key, aiv, out, out, padded_len, block);
++    }
++
++    return ret;
++}
++
++/** Unwrapping according to RFC 5649 section 4.2.
++ *
++ *  @param[in]  key    Key value. 
++ *  @param[in]  icv    (Non-standard) IV, 4 bytes. NULL = use default_aiv.
++ *  @param[out] out    Plain text. Minimal buffer length = inlen bytes.
++ *                     Input and output buffers can overlap if block function
++ *                     supports that.
++ *  @param[in]  in     Ciphertext text as n 64-bit blocks
++ *  @param[in]  inlen  Length of in.
++ *  @param[in]  block  Block processing function.
++ *  @return            0 if inlen is out of range [16, CRYPTO128_WRAP_MAX],
++ *                     or if inlen is not multiply of 8
++ *                     or if IV and message length indicator doesn't match.
++ *                     Output length if unwrapping succeeded and IV matches.
++ */
++size_t CRYPTO_128_unwrap_pad(void *key, const unsigned char *icv,
++                             unsigned char *out,
++                             const unsigned char *in, size_t inlen,
++                             block128_f block)
++{
++    /* n: number of 64-bit blocks in the padded key data */
++    size_t n = inlen / 8 - 1;
++    size_t padded_len;
++    size_t padding_len;
++    size_t ptext_len;
++    /* RFC 5649 section 3: Alternative Initial Value */
++    unsigned char aiv[8];
++    static unsigned char zeros[8] = { 0x0 };
++    size_t ret;
++
++    /* Section 4.2: Cipher text length has to be (n+1) 64-bit blocks. */
++    if ((inlen & 0x7) != 0 || inlen < 16 || inlen >= CRYPTO128_WRAP_MAX)
++        return 0;
++
++    memmove(out, in, inlen);
++    if (inlen == 16) {
++        /* Section 4.2 - special case in step 1:
++         * When n=1, the ciphertext contains exactly two 64-bit
++         * blocks and they are decrypted as a single AES
++         * block using AES in ECB mode:
++         * AIV | P[1] = DEC(K, C[0] | C[1])
++         */
++        block(out, out, key);
++        memcpy(aiv, out, 8);
++        /* Remove AIV */
++        memmove(out, out + 8, 8);
++        padded_len = 8;
++    } else {
++        padded_len = inlen - 8;
++        ret = crypto_128_unwrap_raw(key, aiv, out, out, inlen, block);
++        if (padded_len != ret) {
+         OPENSSL_cleanse(out, inlen);
+         return 0;
+     }
+-    return inlen;
++    }
++
++    /* Section 3: AIV checks: Check that MSB(32,A) = A65959A6.
++     * Optionally a user-supplied value can be used
++     * (even if standard doesn't mention this). */
++    if ((!icv && CRYPTO_memcmp(aiv, default_aiv, 4))
++        || (icv && CRYPTO_memcmp(aiv, icv, 4))) {
++        OPENSSL_cleanse(out, inlen);
++        return 0;
++    }
++
++    /* Check that 8*(n-1) < LSB(32,AIV) <= 8*n.
++     * If so, let ptext_len = LSB(32,AIV). */
++
++    ptext_len = (aiv[4] << 24) | (aiv[5] << 16) | (aiv[6] << 8) | aiv[7];
++    if (8 * (n - 1) >= ptext_len || ptext_len > 8 * n) {
++        OPENSSL_cleanse(out, inlen);
++        return 0;
++    }
++
++    /* Check that the rightmost padding_len octets of the output data
++     * are zero. */
++    padding_len = padded_len - ptext_len;
++    if (CRYPTO_memcmp(out + ptext_len, zeros, padding_len) != 0) {
++        OPENSSL_cleanse(out, inlen);
++        return 0;
++    }
++
++    /* Section 4.2 step 3: Remove padding */
++    return ptext_len;
+ }

openssl-thread-test.c

@@ -0,0 +1,400 @@
+/* Test program to verify that RSA signing is thread-safe in OpenSSL. */
+
+#include <assert.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/objects.h>
+#include <openssl/rand.h>
+#include <openssl/rsa.h>
+#include <openssl/md5.h>
+#include <openssl/ssl.h>
+
+/* Just assume we want to do engine stuff if we're using 0.9.6b or
+ * higher. This assumption is only valid for versions bundled with RHL. */
+#if OPENSSL_VERSION_NUMBER  >= 0x0090602fL
+#include <openssl/engine.h>
+#define USE_ENGINE
+#endif
+
+#define MAX_THREAD_COUNT	10000
+#define ITERATION_COUNT		10
+#define MAIN_COUNT		100
+
+/* OpenSSL requires us to provide thread ID and locking primitives. */
+pthread_mutex_t *mutex_locks = NULL;
+static unsigned long
+thread_id_cb(void)
+{
+	return (unsigned long) pthread_self();
+}
+static void
+lock_cb(int mode, int n, const char *file, int line)
+{
+	if (mode & CRYPTO_LOCK) {
+		pthread_mutex_lock(&mutex_locks[n]);
+	} else {
+		pthread_mutex_unlock(&mutex_locks[n]);
+	}
+}
+
+struct thread_args {
+	RSA *rsa;
+	int digest_type;
+	unsigned char *digest;
+	unsigned int digest_len;
+	unsigned char *signature;
+	unsigned int signature_len;
+	pthread_t main_thread;
+};
+
+static int print = 0;
+
+pthread_mutex_t sign_lock = PTHREAD_MUTEX_INITIALIZER;
+static int locked_sign = 0;
+static void SIGN_LOCK() {if (locked_sign) pthread_mutex_lock(&sign_lock);}
+static void SIGN_UNLOCK() {if (locked_sign) pthread_mutex_unlock(&sign_lock);}
+
+pthread_mutex_t verify_lock = PTHREAD_MUTEX_INITIALIZER;
+static int locked_verify = 0;
+static void VERIFY_LOCK() {if (locked_verify) pthread_mutex_lock(&verify_lock);}
+static void VERIFY_UNLOCK() {if (locked_verify) pthread_mutex_unlock(&verify_lock);}
+
+pthread_mutex_t failure_count_lock = PTHREAD_MUTEX_INITIALIZER;
+long failure_count = 0;
+static void
+failure()
+{
+	pthread_mutex_lock(&failure_count_lock);
+	failure_count++;
+	pthread_mutex_unlock(&failure_count_lock);
+}
+
+static void *
+thread_main(void *argp)
+{
+	struct thread_args *args = argp;
+	unsigned char *signature;
+	unsigned int signature_len, signature_alloc_len;
+	int ret, i;
+
+	signature_alloc_len = args->signature_len;
+	if (RSA_size(args->rsa) > signature_alloc_len) {
+		signature_alloc_len = RSA_size(args->rsa);
+	}
+	signature = malloc(signature_alloc_len);
+	if (signature == NULL) {
+		fprintf(stderr, "Skipping checks in thread %lu -- %s.\n",
+			(unsigned long) pthread_self(), strerror(errno));
+		pthread_exit(0);
+		return NULL;
+	}
+	for (i = 0; i < ITERATION_COUNT; i++) {
+		signature_len = signature_alloc_len;
+		SIGN_LOCK();
+		ret = RSA_check_key(args->rsa);
+		ERR_print_errors_fp(stdout);
+		if (ret != 1) {
+			failure();
+			break;
+		}
+		ret = RSA_sign(args->digest_type,
+			       args->digest,
+			       args->digest_len,
+			       signature, &signature_len,
+			       args->rsa);
+		SIGN_UNLOCK();
+		ERR_print_errors_fp(stdout);
+		if (ret != 1) {
+			failure();
+			break;
+		}
+
+		VERIFY_LOCK();
+		ret = RSA_verify(args->digest_type,
+			         args->digest,
+			         args->digest_len,
+			         signature, signature_len,
+			         args->rsa);
+		VERIFY_UNLOCK();
+		if (ret != 1) {
+			fprintf(stderr,
+				"Signature from thread %lu(%d) fails "
+				"verification (passed in thread #%lu)!\n",
+				(long) pthread_self(), i,
+				(long) args->main_thread);
+			ERR_print_errors_fp(stdout);
+			failure();
+			continue;
+		}
+		if (print) {
+			fprintf(stderr, ">%d\n", i);
+		}
+	}
+	free(signature);
+
+	pthread_exit(0);
+
+	return NULL;
+}
+
+unsigned char *
+xmemdup(unsigned char *s, size_t len)
+{
+	unsigned char *r;
+	r = malloc(len);
+	if (r == NULL) {
+		fprintf(stderr, "Out of memory.\n");
+		ERR_print_errors_fp(stdout);
+		assert(r != NULL);
+	}
+	memcpy(r, s, len);
+	return r;
+}
+
+int
+main(int argc, char **argv)
+{
+	RSA *rsa;
+	MD5_CTX md5;
+	int fd, i;
+	pthread_t threads[MAX_THREAD_COUNT];
+	int thread_count = 1000;
+	unsigned char *message, *digest;
+	unsigned int message_len, digest_len;
+	unsigned char *correct_signature;
+	unsigned int correct_siglen, ret;
+	struct thread_args master_args, *args;
+	int sync = 0, seed = 0;
+	int again = 1;
+#ifdef USE_ENGINE
+	char *engine = NULL;
+	ENGINE *e = NULL;
+#endif
+
+	pthread_mutex_init(&failure_count_lock, NULL);
+
+	for (i = 1; i < argc; i++) {
+		if (strcmp(argv[i], "--seed") == 0) {
+			printf("Seeding PRNG.\n");
+			seed++;
+		} else
+		if (strcmp(argv[i], "--sync") == 0) {
+			printf("Running synchronized.\n");
+			sync++;
+		} else
+		if ((strcmp(argv[i], "--threads") == 0) && (i < argc - 1)) {
+			i++;
+			thread_count = atol(argv[i]);
+			if (thread_count > MAX_THREAD_COUNT) {
+				thread_count = MAX_THREAD_COUNT;
+			}
+			printf("Starting %d threads.\n", thread_count);
+			sync++;
+		} else
+		if (strcmp(argv[i], "--sign") == 0) {
+			printf("Locking signing.\n");
+			locked_sign++;
+		} else
+		if (strcmp(argv[i], "--verify") == 0) {
+			printf("Locking verifies.\n");
+			locked_verify++;
+		} else
+		if (strcmp(argv[i], "--print") == 0) {
+			printf("Tracing.\n");
+			print++;
+#ifdef USE_ENGINE
+		} else
+		if ((strcmp(argv[i], "--engine") == 0) && (i < argc - 1)) {
+			printf("Using engine \"%s\".\n", argv[i + 1]);
+			engine = argv[i + 1];
+			i++;
+#endif
+		} else {
+			printf("Bad argument: %s\n", argv[i]);
+			return 1;
+		}
+	}
+
+	/* Get some random data to sign. */
+	fd = open("/dev/urandom", O_RDONLY);
+	if (fd == -1) {
+		fprintf(stderr, "Error opening /dev/urandom: %s\n",
+			strerror(errno));
+	}
+
+	if (print) {
+		fprintf(stderr, "Reading random data.\n");
+	}
+	message = malloc(message_len = 9371);
+	read(fd, message, message_len);
+	close(fd);
+
+	/* Initialize the SSL library and set up thread-safe locking. */
+	ERR_load_crypto_strings();
+	SSL_library_init();
+	mutex_locks = malloc(sizeof(pthread_mutex_t) * CRYPTO_num_locks());
+	for (i = 0; i < CRYPTO_num_locks(); i++) {
+		pthread_mutex_init(&mutex_locks[i], NULL);
+	}
+	CRYPTO_set_id_callback(thread_id_cb);
+	CRYPTO_set_locking_callback(lock_cb);
+	ERR_print_errors_fp(stdout);
+
+	/* Seed the PRNG if we were asked to do so. */
+	if (seed) {
+		if (print) {
+			fprintf(stderr, "Seeding PRNG.\n");
+		}
+		RAND_add(message, message_len, message_len);
+		ERR_print_errors_fp(stdout);
+	}
+
+	/* Turn on a hardware crypto device if asked to do so. */
+#ifdef USE_ENGINE
+	if (engine) {
+#if OPENSSL_VERSION_NUMBER  >= 0x0090700fL
+		ENGINE_load_builtin_engines();
+#endif
+		if (print) {
+			fprintf(stderr, "Initializing \"%s\" engine.\n",
+				engine);
+		}
+		e = ENGINE_by_id(engine);
+		ERR_print_errors_fp(stdout);
+		if (e) {
+			i = ENGINE_init(e);
+			ERR_print_errors_fp(stdout);
+			i = ENGINE_set_default_RSA(e);
+			ERR_print_errors_fp(stdout);
+		}
+	}
+#endif
+
+	/* Compute the digest for the signature. */
+	if (print) {
+		fprintf(stderr, "Computing digest.\n");
+	}
+	digest = malloc(digest_len = MD5_DIGEST_LENGTH);
+	MD5_Init(&md5);
+	MD5_Update(&md5, message, message_len);
+	MD5_Final(digest, &md5);
+
+	/* Generate a signing key. */
+	if (print) {
+		fprintf(stderr, "Generating key.\n");
+	}
+	rsa = RSA_generate_key(4096, 3, NULL, NULL);
+	ERR_print_errors_fp(stdout);
+	if (rsa == NULL) {
+		_exit(1);
+	}
+
+	/* Sign the data. */
+	correct_siglen = RSA_size(rsa);
+	correct_signature = malloc(correct_siglen);
+	for (i = 0; i < MAIN_COUNT; i++) {
+		if (print) {
+			fprintf(stderr, "Signing data (%d).\n", i);
+		}
+		ret = RSA_check_key(rsa);
+		ERR_print_errors_fp(stdout);
+		if (ret != 1) {
+			failure();
+		}
+		correct_siglen = RSA_size(rsa);
+		ret = RSA_sign(NID_md5, digest, digest_len,
+			       correct_signature, &correct_siglen,
+			       rsa);
+		ERR_print_errors_fp(stdout);
+		if (ret != 1) {
+			_exit(2);
+		}
+		if (print) {
+			fprintf(stderr, "Verifying data (%d).\n", i);
+		}
+		ret = RSA_verify(NID_md5, digest, digest_len,
+			         correct_signature, correct_siglen,
+			         rsa);
+		if (ret != 1) {
+			_exit(2);
+		}
+	}
+
+	/* Collect up the inforamtion which other threads will need for
+	 * comparing their signature results with ours. */
+	master_args.rsa = rsa;
+	master_args.digest_type = NID_md5;
+	master_args.digest = digest;
+	master_args.digest_len = digest_len;
+	master_args.signature = correct_signature;
+	master_args.signature_len = correct_siglen;
+	master_args.main_thread = pthread_self();
+	
+	fprintf(stdout, "Performing %d signatures in each of %d threads "
+		"(%d, %d).\n", ITERATION_COUNT, thread_count,
+		digest_len, correct_siglen);
+	fflush(NULL);
+
+	/* Start up all of the threads. */
+	for (i = 0; i < thread_count; i++) {
+		args = malloc(sizeof(struct thread_args));
+		args->rsa = RSAPrivateKey_dup(master_args.rsa);
+		args->digest_type = master_args.digest_type;
+		args->digest_len = master_args.digest_len;
+		args->digest = xmemdup(master_args.digest, args->digest_len);
+		args->signature_len = master_args.signature_len;
+		args->signature = xmemdup(master_args.signature,
+					  args->signature_len);
+		args->main_thread = pthread_self();
+		ret = pthread_create(&threads[i], NULL, thread_main, args);
+		while ((ret != 0) && (errno == EAGAIN)) {
+			ret = pthread_create(&threads[i], NULL,
+					     thread_main, &args);
+			fprintf(stderr, "Thread limit hit at %d.\n", i);
+		}
+		if (ret != 0) {
+			fprintf(stderr, "Unable to create thread %d: %s.\n",
+				i, strerror(errno));
+			threads[i] = -1;
+		} else {
+			if (sync) {
+				ret = pthread_join(threads[i], NULL);
+				assert(ret == 0);
+			}
+			if (print) {
+				fprintf(stderr, "%d\n", i);
+			}
+		}
+	}
+
+	/* Wait for all threads to complete.  So long as we can find an
+	 * unjoined thread, keep joining threads. */
+	do {
+		again = 0;
+		for (i = 0; i < thread_count; i++) {
+			/* If we have an unterminated thread, join it. */
+			if (threads[i] != -1) {
+				again = 1;
+				if (print) {
+					fprintf(stderr, "Joining thread %d.\n",
+						i);
+				}
+				pthread_join(threads[i], NULL);
+				threads[i] = -1;
+				break;
+			}
+		}
+	} while (again == 1);
+
+	fprintf(stderr, "%ld failures\n", failure_count);
+
+	return (failure_count != 0);
+}

opensslconf-new-warning.h

@@ -0,0 +1,7 @@
+/* Prepended at openssl package build-time.  Don't include this file directly,
+ * use <openssl/opensslconf.h> instead. */
+
+#ifndef openssl_opensslconf_multilib_redirection_h
+#error "Don't include this file directly, use <openssl/opensslconf.h> instead!"
+#endif
+

opensslconf-new.h

@@ -0,0 +1,47 @@
+/* This file is here to prevent a file conflict on multiarch systems.  A
+ * conflict will frequently occur because arch-specific build-time
+ * configuration options are stored (and used, so they can't just be stripped
+ * out) in opensslconf.h.  The original opensslconf.h has been renamed.
+ * DO NOT INCLUDE THE NEW FILE DIRECTLY -- ALWAYS INCLUDE THIS ONE INSTEAD. */
+
+#ifdef openssl_opensslconf_multilib_redirection_h
+#error "Do not define openssl_opensslconf_multilib_redirection_h!"
+#endif
+#define openssl_opensslconf_multilib_redirection_h
+
+#if defined(__i386__)
+#include "opensslconf-i386.h"
+#elif defined(__ia64__)
+#include "opensslconf-ia64.h"
+#elif defined(__mips64) && defined(__MIPSEL__)
+#include "opensslconf-mips64el.h"
+#elif defined(__mips64)
+#include "opensslconf-mips64.h"
+#elif defined(__mips) && defined(__MIPSEL__)
+#include "opensslconf-mipsel.h"
+#elif defined(__mips)
+#include "opensslconf-mips.h"
+#elif defined(__powerpc64__)
+#include <endian.h>
+#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+#include "opensslconf-ppc64.h"
+#else
+#include "opensslconf-ppc64le.h"
+#endif
+#elif defined(__powerpc__)
+#include "opensslconf-ppc.h"
+#elif defined(__s390x__)
+#include "opensslconf-s390x.h"
+#elif defined(__s390__)
+#include "opensslconf-s390.h"
+#elif defined(__sparc__) && defined(__arch64__)
+#include "opensslconf-sparc64.h"
+#elif defined(__sparc__)
+#include "opensslconf-sparc.h"
+#elif defined(__x86_64__)
+#include "opensslconf-x86_64.h"
+#else
+#error "This openssl-devel package does not work your architecture?"
+#endif
+
+#undef openssl_opensslconf_multilib_redirection_h

renew-dummy-cert

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+if [ $# -eq 0 ]; then
+	echo $"Usage: `basename $0` filename" 1>&2
+	exit 1
+fi
+
+PEM=$1
+REQ=`/bin/mktemp /tmp/openssl.XXXXXX`
+KEY=`/bin/mktemp /tmp/openssl.XXXXXX`
+CRT=`/bin/mktemp /tmp/openssl.XXXXXX`
+NEW=${PEM}_
+
+trap "rm -f $REQ $KEY $CRT $NEW" SIGINT
+
+if [ ! -f $PEM ]; then
+	echo "$PEM: file not found" 1>&2
+	exit 1
+fi
+
+let -a SERIAL=0x$(openssl x509 -in $PEM -noout -serial | cut -d= -f2)
+let SERIAL++
+
+umask 077
+
+OWNER=`ls -l $PEM | awk '{ printf "%s.%s", $3, $4; }'`
+
+openssl rsa -inform pem -in $PEM -out $KEY
+openssl x509 -x509toreq -in $PEM -signkey $KEY -out $REQ
+openssl x509 -req -in $REQ -signkey $KEY -set_serial $SERIAL -days 365 \
+	-extfile /etc/pki/tls/openssl.cnf -extensions v3_ca -out $CRT
+
+(cat $KEY ; echo "" ; cat $CRT) > $NEW
+
+chown $OWNER $NEW
+
+mv -f $NEW $PEM
+
+rm -f $REQ $KEY $CRT
+
+exit 0
+

sources

@@ -0,0 +1 @@
+SHA512 (openssl-1.0.2o-hobbled.tar.xz) = e0c2da98288c5546a4821598784c3cfbb11120c667e815d00ab6143e13cd45037d5f6e4ee8b076ae690ac8eabc8bf68d37c57d386158df3a6b9e2e851713c423